Merge WebKit at r70209: Initial merge by Git

Change-Id: Id23a68efa36e9d1126bcce0b137872db00892c8e

2236 files changed, 102754 insertions, 29589 deletions

diff --git a/JavaScriptCore/Android.mk b/JavaScriptCore/Android.mk
index 959fbc4..c690477 100644
--- a/JavaScriptCore/Android.mk
+++ b/JavaScriptCore/Android.mk
@@ -166,6 +166,7 @@ LOCAL_SRC_FILES := \
 	wtf/ByteArray.cpp \
 	wtf/CurrentTime.cpp \
 	wtf/DateMath.cpp \
+	wtf/DecimalNumber.cpp \
 	wtf/FastMalloc.cpp \
 	wtf/HashTable.cpp \
 	wtf/MD5.cpp \
@@ -185,6 +186,7 @@ LOCAL_SRC_FILES := \
 	\
 	wtf/text/AtomicString.cpp \
 	wtf/text/CString.cpp \
+	wtf/text/StringBuilder.cpp \
 	wtf/text/StringImpl.cpp \
 	wtf/text/StringStatics.cpp \
 	wtf/text/WTFString.cpp \
diff --git a/JavaScriptCore/Android.v8.wtf.mk b/JavaScriptCore/Android.v8.wtf.mk
index 16554b1..a9c8a3b 100644
--- a/JavaScriptCore/Android.v8.wtf.mk
+++ b/JavaScriptCore/Android.v8.wtf.mk
@@ -36,6 +36,7 @@ LOCAL_SRC_FILES := \
 	wtf/ByteArray.cpp \
 	wtf/CurrentTime.cpp \
 	wtf/DateMath.cpp \
+	wtf/DecimalNumber.cpp \
 	wtf/FastMalloc.cpp \
 	wtf/HashTable.cpp \
 	wtf/MD5.cpp \
@@ -55,6 +56,7 @@ LOCAL_SRC_FILES := \
 	\
 	wtf/text/AtomicString.cpp \
 	wtf/text/CString.cpp \
+	wtf/text/StringBuidler.cpp \
 	wtf/text/StringImpl.cpp \
 	wtf/text/StringStatics.cpp \
 	wtf/text/WTFString.cpp \
diff --git a/JavaScriptCore/CMakeLists.txt b/JavaScriptCore/CMakeLists.txt
index 89c9ef1..90067a4 100644
--- a/JavaScriptCore/CMakeLists.txt
+++ b/JavaScriptCore/CMakeLists.txt
@@ -157,6 +157,7 @@ SET(JavaScriptCore_SOURCES
     runtime/RopeImpl.cpp
     runtime/ScopeChain.cpp
     runtime/SmallStrings.cpp
+    runtime/StrictEvalActivation.cpp
     runtime/StringConstructor.cpp
     runtime/StringObject.cpp
     runtime/StringPrototype.cpp
@@ -254,7 +255,7 @@ SOURCE_GROUP(yarr "yarr/")
 SOURCE_GROUP(wtf "wtf/")
 
 ADD_SUBDIRECTORY(wtf)
-ADD_SUBDIRECTORY(jsc)
+ADD_SUBDIRECTORY(shell)
 
 WEBKIT_WRAP_SOURCELIST(${JavaScriptCore_SOURCES})
 INCLUDE_DIRECTORIES(${JavaScriptCore_INCLUDE_DIRECTORIES})
diff --git a/JavaScriptCore/ChangeLog b/JavaScriptCore/ChangeLog
index bbdf703..95bf475 100644
--- a/JavaScriptCore/ChangeLog
+++ b/JavaScriptCore/ChangeLog
@@ -1,3 +1,1734 @@
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the EFL build.
+
+        * wtf/CMakeLists.txt:
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix Windows build: export needed symbols.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47851
+        
+        Add methods to DecimalNumber to return the buffer length
+        required for decimal and exponential output.
+        
+        Make some of the DecimalNumber code non-inline (no
+        effect on Sunspider), adding DecimalNumber.cpp to various
+        build systems.
+        
+        Make some DecimalNumber methods 'const'.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * runtime/NumberPrototype.cpp:
+        (JSC::numberProtoFuncToExponential):
+        (JSC::numberProtoFuncToFixed):
+        (JSC::numberProtoFuncToPrecision):
+        * wtf/DecimalNumber.cpp: Added.
+        (WTF::DecimalNumber::bufferLengthForStringDecimal):
+        (WTF::DecimalNumber::bufferLengthForStringExponential):
+        (WTF::DecimalNumber::toStringDecimal):
+        (WTF::DecimalNumber::toStringExponential):
+        * wtf/DecimalNumber.h:
+        (WTF::DecimalNumber::sign):
+        (WTF::DecimalNumber::exponent):
+        (WTF::DecimalNumber::significand):
+        (WTF::DecimalNumber::precision):
+        * wtf/dtoa.cpp:
+        (WTF::dtoa):
+        * wtf/dtoa.h:
+        * wtf/wtf.pri:
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70165.
+        http://trac.webkit.org/changeset/70165
+        https://bugs.webkit.org/show_bug.cgi?id=48007
+
+        It broke tests on Qt bot (Requested by Ossy on #webkit).
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Removed.
+
+2010-10-20  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix the Windows build after r70165. Move the copying of JavaScript headers from JavaScriptCore's post-build
+        step to JavaScriptCoreGenerated, so the copying is done even when a cpp file in JavaScriptCore is changed.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make:
+
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Unreviewed, fixing the Win build.
+
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+
+2010-10-20  Geoffrey Garen  <ggaren@apple.com>
+
+        Reviewed by Darin Adler.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=41948
+        REGRESSION(r60392): Registerfile can be unwound too far following an exception
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::throwException): Walk the stack to calculate the high
+        water mark currently in use. It's not safe to assume that the current
+        CallFrame's high water mark is the highest high water mark because
+        calls do not always set up at the end of a CallFrame. A large caller
+        CallFrame can encompass a small callee CallFrame.
+
+2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Adds TextPosition* classes -- a structure that stores line/column/generation
+        level coordinates inside text document. Adds *BasedNumber classes -- typesafe int
+        wrappers that emphasize whether int number is used as zero-based or
+        one-based.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/text/TextPosition.h: Added.
+        (WTF::TextPosition::TextPosition):
+        (WTF::TextPosition::minimumPosition):
+        (WTF::TextPosition::belowRangePosition):
+        (WTF::ZeroBasedNumber::fromZeroBasedInt):
+        (WTF::ZeroBasedNumber::ZeroBasedNumber):
+        (WTF::ZeroBasedNumber::zeroBasedInt):
+        (WTF::ZeroBasedNumber::base):
+        (WTF::ZeroBasedNumber::belowBase):
+        (WTF::OneBasedNumber::fromOneBasedInt):
+        (WTF::OneBasedNumber::OneBasedNumber):
+        (WTF::OneBasedNumber::oneBasedInt):
+        (WTF::OneBasedNumber::convertAsZeroBasedInt):
+        (WTF::OneBasedNumber::convertToZeroBased):
+        (WTF::OneBasedNumber::base):
+        (WTF::OneBasedNumber::belowBase):
+        (WTF::toZeroBasedTextPosition):
+        (WTF::toOneBasedTextPosition):
+        (WTF::ZeroBasedNumber::convertToOneBased):
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        [BREWMP] Turn off JIT for simulator build
+        https://bugs.webkit.org/show_bug.cgi?id=47937
+
+        We don't need to test x86 JIT.
+
+        * wtf/Platform.h:
+
+2010-10-19  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoffrey Garen.
+
+        Remove support for JSVALUE32 from JSC
+        https://bugs.webkit.org/show_bug.cgi?id=47948
+
+        Remove all the code for supporting JSVALUE32 from JSC.
+
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITArithmetic.cpp:
+        (JSC::JIT::emit_op_lshift):
+        (JSC::JIT::emitSlow_op_lshift):
+        (JSC::JIT::emit_op_rshift):
+        (JSC::JIT::emitSlow_op_rshift):
+        (JSC::JIT::emit_op_urshift):
+        (JSC::JIT::emitSlow_op_urshift):
+        (JSC::JIT::emit_op_jnless):
+        (JSC::JIT::emitSlow_op_jnless):
+        (JSC::JIT::emit_op_jless):
+        (JSC::JIT::emitSlow_op_jless):
+        (JSC::JIT::emit_op_jlesseq):
+        (JSC::JIT::emitSlow_op_jlesseq):
+        (JSC::JIT::emit_op_bitand):
+        (JSC::JIT::emit_op_post_inc):
+        (JSC::JIT::emit_op_post_dec):
+        (JSC::JIT::emit_op_pre_inc):
+        (JSC::JIT::emit_op_pre_dec):
+        (JSC::JIT::emit_op_mod):
+        (JSC::JIT::emitSlow_op_mod):
+        * jit/JITCall.cpp:
+        * jit/JITInlineMethods.h:
+        (JSC::JIT::emitGetFromCallFrameHeaderPtr):
+        (JSC::JIT::emitGetFromCallFrameHeader32):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_loop_if_lesseq):
+        (JSC::JIT::emit_op_bitnot):
+        (JSC::JIT::emit_op_next_pname):
+        * jit/JITPropertyAccess.cpp:
+        (JSC::JIT::emit_op_get_by_val):
+        (JSC::JIT::emit_op_put_by_val):
+        * jit/JITStubs.h:
+        * jit/JSInterfaceJIT.h:
+        * jit/SpecializedThunkJIT.h:
+        (JSC::SpecializedThunkJIT::returnDouble):
+        (JSC::SpecializedThunkJIT::tagReturnAsInt32):
+        * jit/ThunkGenerators.cpp:
+        (JSC::sqrtThunkGenerator):
+        (JSC::powThunkGenerator):
+        * runtime/Collector.cpp:
+        (JSC::isPossibleCell):
+        (JSC::typeName):
+        * runtime/JSCell.h:
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.h:
+        (JSC::Structure::prototypeForLookup):
+        * runtime/JSImmediate.h:
+        (JSC::reinterpretIntptrToDouble):
+        (JSC::JSImmediate::isIntegerNumber):
+        (JSC::JSImmediate::isDouble):
+        (JSC::JSImmediate::areBothImmediateIntegerNumbers):
+        (JSC::JSImmediate::makeDouble):
+        (JSC::JSImmediate::doubleValue):
+        (JSC::JSImmediate::toBoolean):
+        (JSC::JSImmediate::fromNumberOutsideIntegerRange):
+        (JSC::JSImmediate::from):
+        (JSC::JSImmediate::toDouble):
+        (JSC::JSFastMath::rightShiftImmediateNumbers):
+        * runtime/JSNumberCell.cpp:
+        * runtime/JSNumberCell.h:
+        * runtime/JSObject.h:
+        (JSC::JSObject::JSObject):
+        * runtime/JSValue.h:
+        * runtime/NumberObject.h:
+        * wtf/Platform.h:
+
+2010-10-19  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Geoffrey Garen.
+
+        BytecodeGenerator::m_lastOpcodePosition must be initialized in all constructors
+        https://bugs.webkit.org/show_bug.cgi?id=47920
+
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator): Add missing member initialization.
+
+2010-10-19  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by David Kilzer.
+
+        RVCT fails to compile DateMath.cpp due to overloaded function pow
+        https://bugs.webkit.org/show_bug.cgi?id=47844
+
+        Choose std::pow(double, double) among multiple overloaded pow functions
+        to fix build for RVCT.
+
+        * wtf/DateMath.cpp:
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        Use UChar instead of wchar_t in UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47904
+
+        Make UnicodeWinCE more portable, so we can use it for other ports too.
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isHighSurrogate):
+        (WTF::Unicode::isLowSurrogate):
+        (WTF::Unicode::umemcasecmp):
+        (WTF::Unicode::surrogateToUcs4):
+
+2010-10-19  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix style of UnicodeWinCE
+        https://bugs.webkit.org/show_bug.cgi?id=47818
+
+        * wtf/unicode/wince/UnicodeWinCE.cpp:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        * wtf/unicode/wince/UnicodeWinCE.h:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add missing file.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Functions created with the function constructor don't implement strict mode semantics
+        https://bugs.webkit.org/show_bug.cgi?id=47860
+
+        When creating the FunctionExecutable for a new function the function constructor
+        was always passing false for whether or not a function was strict, rather than
+        using the information from the freshly parsed function itself.
+
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::fromGlobalCode):
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Strict mode: |this| should be undefined if it is not explicitly provided
+        https://bugs.webkit.org/show_bug.cgi?id=47833
+
+        To make strict mode behave correctly we want to pass undefined instead of null
+        as the default this value.  This has no impact on behaviour outside of strict
+        mode as both values are replaced with the global object if necessary.
+
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::FunctionCallValueNode::emitBytecode):
+        (JSC::FunctionCallResolveNode::emitBytecode):
+        (JSC::CallFunctionCallDotNode::emitBytecode):
+        (JSC::ApplyFunctionCallDotNode::emitBytecode):
+
+
+2010-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        Make a nullptr that works with OwnPtr and RefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=47756
+
+        * JavaScriptCore.xcodeproj/project.pbxproj: Added NullPtr.h.
+
+        * wtf/NullPtr.h: Added.
+
+        * wtf/OwnArrayPtr.h: Add an overload of = taking nullptr.
+        * wtf/OwnPtr.h: Ditto.
+        * wtf/PassOwnArrayPtr.h: Ditto.
+        * wtf/PassOwnPtr.h: Ditto.
+        * wtf/PassRefPtr.h: Ditto.
+        * wtf/RefPtr.h: Ditto.
+        * wtf/RetainPtr.h: Ditto.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: JIT doesn't check for |this| being an immediate before dereferencing
+        https://bugs.webkit.org/show_bug.cgi?id=47826
+
+        There's no guarantee that |this| will be a cell in a strict mode function, so
+        don't claim that it is.
+
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isKnownNotImmediate):
+
+2010-10-18  Zoltan Herczeg  <zherczeg@webkit.org>
+
+        Reviewed by Oliver Hunt.
+
+        if (0) throw "x" ; else { } throws parse error after r69906
+        https://bugs.webkit.org/show_bug.cgi?id=47807
+
+        r69906 introduced a bug: the semicolon is not parsed after a throw
+        expression anymore. Thus, the semicolon terminates the "if" parsing
+        in the example above, and the else token results a parse error.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+
+2010-10-18  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        Remove some unnecessary lines of code from Parser.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47816
+
+        * parser/Parser.cpp:
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Build broken with JIT disabled
+        https://bugs.webkit.org/show_bug.cgi?id=47801
+
+        This is a regression caused by r69940.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+
+2010-10-18  Zoltan Horvath  <zoltan@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Change FastAllocBase implementation into a macro
+        https://bugs.webkit.org/show_bug.cgi?id=42998
+
+        It was investigated in bug #33896 that inheriting classes from FastAllocBase 
+        can result in objects getting larger which leads to memory regressions. 
+        Using a macro instead of inheriting classes from FastAllocBase would solve the issue. 
+
+        * wtf/FastAllocBase.h: Add a WTF_MAKE_FAST_ALLOCATED macro
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: arguments is not valid as the base expression for pre- or post-fix expressions
+        https://bugs.webkit.org/show_bug.cgi?id=47791
+
+        Simple fix, check for arguments in addition to eval.
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseUnaryExpression):
+
+2010-10-17  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Strict mode: Assignment that would create a global should be a late ReferenceError, not a syntax failure
+        https://bugs.webkit.org/show_bug.cgi?id=47788
+
+        Fixing this required a couple of changes:
+         * resolve_base now has a flag to indicate whether it is being used for a put in strict mode.
+           this allows us to throw an exception when we're doing a completely generic resolve for
+           assignment, and that assignment would create a new global.
+         * There is a new opcode 'op_ensure_property_exists' that is used to determine whether
+           the property being assigned to already exists on the global object.  This currently
+           has no caching, but such caching could be added relatively trivially.  It is only used
+           in the case where we know that a property will be placed on the global object, and
+           we cannot verify that the property already exists.
+
+        In the jit we plant a call to cti_op_resolve_base_strict_put in the effected case rather
+        than making op_resolve_base have an additional runtime branch.
+
+        There's also a new helper function to create the exception for the invalid assignment.
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::emitResolveBase):
+        (JSC::BytecodeGenerator::emitResolveBaseForPut):
+        * bytecompiler/BytecodeGenerator.h:
+        * bytecompiler/NodesCodegen.cpp:
+        (JSC::AssignResolveNode::emitBytecode):
+        (JSC::ForInNode::emitBytecode):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_resolve_base):
+        (JSC::JIT::emit_op_ensure_property_exists):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseProgram):
+        * runtime/ExceptionHelpers.cpp:
+        (JSC::createErrorForInvalidGlobalAssignment):
+        * runtime/ExceptionHelpers.h:
+        * runtime/Operations.h:
+        (JSC::resolveBase):
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        First part of fix for Windows build failure. Will wait for the
+        next set of link errors to determine the mangled forms for dtoaRoundSF
+        and dtoaRoundDP.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Very large and small numbers fail to round-trip through CSS
+        https://bugs.webkit.org/show_bug.cgi?id=20674
+        
+        New exports required to use DecimalNumber in WebCore.
+
+        * JavaScriptCore.exp:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+
+2010-10-16  Kyusun Kim  <maniagoon@company100.net>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Add using declarations for currentTimeMS() and parseDateFromNullTerminatedCharacters()
+        https://bugs.webkit.org/show_bug.cgi?id=47758
+
+        * wtf/CurrentTime.h:
+        * wtf/DateMath.h:
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename StringHasherFunctions.h to StringHasher.h
+        https://bugs.webkit.org/show_bug.cgi?id=47200
+
+        Now StringHasherFunctions.h only contains the StringHasher class, so rename it to the correct name.
+
+        * GNUmakefile.am:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/StringHashFunctions.h: Removed.
+        * wtf/StringHasher.h: Copied from JavaScriptCore/wtf/StringHashFunctions.h.
+        * wtf/text/StringHash.h:
+        * wtf/text/StringImpl.h:
+
+2010-10-15  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Automatic Semicolon Insertion incorrectly inserts semicolon after break, continue, and return followed by a newline
+        https://bugs.webkit.org/show_bug.cgi?id=47762
+
+        The old YACC parser depended on the lexer for some classes of semicolon insertion.
+        The new parser handles ASI entirely on its own so when the lexer inserts a semicolon
+        on its own the net result is a spurious semicolon in the input stream.  This can result
+        in incorrect parsing in some cases:
+
+        if (0)
+            break
+        ;else {}
+
+        Would result in a parse failure as the output from the lexer is essentially
+
+        if (0)
+             break
+        ;;else
+
+        So the second semicolon is interpreted as a empty statement, which terminates the if,
+        making the else an error.
+
+
+        * parser/JSParser.cpp:
+        (JSC::JSParser::parseThrowStatement):
+          Parsing of throw statement was wrong, and only worked due to the weird behaviour
+          in the lexer
+        * parser/Lexer.cpp:
+        (JSC::Lexer::lex):
+          Remove bogus semicolon insertion from the newline handling
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * wtf/text/StringConcatenate.h: Add UChar specific StringTypeAdapter, to accept single UChars in makeString().
+
+2010-10-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Unreviewed build fix for Debug Leopard which is failng to compile after r69842.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-15  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The parenthetical assertion checking isn't working in some cases with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46893
+
+        Calculate the countToCheck value of a TypeParentheticalAssertion by
+        subtracting the number of characters which follows
+        a TypeParentheticalAssertion term with the number of characters which should
+        be matched by terms which are contained
+        in the TypeParentheticalAssertion term (minimumSize).
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::ByteCompiler::emitDisjunction):
+
+2010-10-14  Nathan Vander Wilt  <nate@andyet.net>
+
+        Reviewed by Darin Adler.
+
+        Added parser for ECMAScript 5 standard date format, so Date.parse can handle RFC 3339 timestamps: https://bugs.webkit.org/show_bug.cgi?id=44632
+
+        * runtime/DateConversion.cpp:
+        (JSC::parseDate):
+        * wtf/DateMath.cpp:
+        (WTF::ymdhmsToSeconds):
+        (WTF::parseES5DateFromNullTerminatedCharacters):
+        * wtf/DateMath.h:
+
+2010-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace lots of String::format() usages by StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47664
+
+        Add StringTypeAdapter<char> to accept single characters for makeString().
+
+        * wtf/text/StringConcatenate.h:
+        (WTF::makeString):
+
+2010-10-14  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        need way to measure size of JITed ARM code
+        https://bugs.webkit.org/show_bug.cgi?id=47121
+
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        (JSC::LinkBuffer::dumpLinkStats):
+        (JSC::LinkBuffer::dumpCode):
+
+2010-10-14  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The backreference checking isn't working in some cases with YARR Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46904
+
+        The Interpreter::matchBackReference() function returns true without matching
+        when a backreference points to the same parentheses where it is.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::matchBackReference):
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Text breaking is slow: enable ICU as an opt-in
+        https://bugs.webkit.org/show_bug.cgi?id=40332
+
+        Added a config flag that enables ICU as an opt-in instead of the Qt specific code.
+        Because of the inclusion of ICU headers, some explicit casting was necessary in UnicodeQt4.h
+
+        * JavaScriptCore.pri:
+        * wtf/unicode/qt4/UnicodeQt4.h:
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+
+2010-10-14  Anton Faern  <anton@bladehawke.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47658
+        NetBSD was not included in the WTF_PLATFORM_FOO to WTF_OS_FOO
+        change.  This means that OS(NETBSD) is also undefined.
+
+        * wtf/Platform.h: s/_PLATFORM_/_OS_/ for NetBSD
+
+2010-10-13  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should generated conditional branches when possible
+        https://bugs.webkit.org/show_bug.cgi?id=47384
+
+        Use different jump padding sizes for conditional and unconditional
+        jumps (12 bytes and 10 bytes respectively). This allows the JIT to
+        include the IT instruction as part of the conditional jump sequence
+        which in turn allows it to optimize away the IT using an ARMv7 
+        conditional branch instruction. Use 2-byte B(T1) and 4-byte B(T3) for
+        conditional branches when displacement is in range. Also use IT/B(T4)
+        for conditional branch when displacement does not fit in B(T3).
+
+        For unconditional jump, instruction selection options are:
+        B(T2), B(T4), MOVW/MOVT/BX. For conditional jump, instruction selection
+        options are: B(T1), B(T3), IT/B(T4), ITTT/MOVW/MOVT/BX.
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::JmpSrc::JmpSrc):
+        (JSC::ARMv7Assembler::ifThenElse):
+        (JSC::ARMv7Assembler::jumpSizeDelta):
+        (JSC::ARMv7Assembler::canCompact):
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT1):
+        (JSC::ARMv7Assembler::canBeJumpT3):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT1):
+        (JSC::ARMv7Assembler::linkJumpT3):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkConditionalJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkConditionalBX):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+        * assembler/LinkBuffer.h:
+        (JSC::LinkBuffer::linkCode):
+        * assembler/MacroAssemblerARMv7.h:
+        (JSC::MacroAssemblerARMv7::canCompact):
+        (JSC::MacroAssemblerARMv7::computeJumpType):
+        (JSC::MacroAssemblerARMv7::jumpSizeDelta):
+        (JSC::MacroAssemblerARMv7::jump):
+        (JSC::MacroAssemblerARMv7::nearCall):
+        (JSC::MacroAssemblerARMv7::call):
+        (JSC::MacroAssemblerARMv7::ret):
+        (JSC::MacroAssemblerARMv7::tailRecursiveCall):
+        (JSC::MacroAssemblerARMv7::makeJump):
+        (JSC::MacroAssemblerARMv7::makeBranch):
+
+2010-10-13  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Darin Adler.
+
+        Don't depend on Windows on sched_yield and sched.h
+        https://bugs.webkit.org/show_bug.cgi?id=45543
+
+        sched.h is part of pthreads and sched_yield is implemented
+        in pthreads-win32 as Sleep(0). This patch avoids a gratuitous
+        dependency on pthreads-win32 in this file.
+
+        * wtf/TCSpinLock.h:
+        (TCMalloc_SlowLock):
+
+2010-10-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port unicode
+        https://bugs.webkit.org/show_bug.cgi?id=45716
+
+        Brew MP port uses only the subset of ICU library to reduce the binary size.
+        Follow the WinCE's implementation.
+
+        * wtf/Platform.h:
+        * wtf/unicode/Unicode.h:
+        * wtf/unicode/brew/UnicodeBrew.cpp: Added.
+        (WTF::Unicode::toLower):
+        (WTF::Unicode::toUpper):
+        (WTF::Unicode::foldCase):
+        (WTF::Unicode::isPrintableChar):
+        (WTF::Unicode::isUpper):
+        (WTF::Unicode::isLower):
+        (WTF::Unicode::isDigit):
+        (WTF::Unicode::isPunct):
+        (WTF::Unicode::isAlphanumeric):
+        (WTF::Unicode::toTitleCase):
+        (WTF::Unicode::direction):
+        (WTF::Unicode::category):
+        (WTF::Unicode::decompositionType):
+        (WTF::Unicode::combiningClass):
+        (WTF::Unicode::mirroredChar):
+        (WTF::Unicode::digitValue):
+        (WTF::Unicode::isSpace):
+        (WTF::Unicode::isLetter):
+        * wtf/unicode/brew/UnicodeBrew.h: Added.
+        (WTF::Unicode::isArabicChar):
+        (WTF::Unicode::isSeparatorSpace):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContext):
+        (WTF::Unicode::hasLineBreakingPropertyComplexContextOrIdeographic):
+        (WTF::Unicode::umemcasecmp):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add URLQueryCanonicalizer
+        https://bugs.webkit.org/show_bug.cgi?id=45088
+
+        This class canonicalizes the query component of URLs.  The main tricky
+        bit there is the convertCharset function, which I've moved to a
+        templated dependency.  There'll likely be more about that in future
+        patches.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLEscape.cpp: Added.
+        * wtf/url/src/URLEscape.h: Added.
+        (WTF::appendEscapedCharacter):
+        * wtf/url/src/URLQueryCanonicalizer.h: Added.
+        (WTF::URLQueryCanonicalizer::canonicalize):
+        (WTF::URLQueryCanonicalizer::isAllASCII):
+        (WTF::URLQueryCanonicalizer::appendRaw8BitQueryString):
+        (WTF::URLQueryCanonicalizer::convertToQueryEncoding):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43987 - Downloading using XHR is much slower than before
+        Change StringBuilder to use overcapacity in a StringImpl, rather than a Vector.
+        Fundamentally this should be the same (copies current contents to expand capacity,
+        rather than using a rope), but this approach allows the intermadiate state of the
+        String to be inspected in the buffer without copying to resolve.
+
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::appendQuotedString):
+        (JSC::Stringifier::Holder::appendNextProperty):
+            Renamed StringBuilder::size() -> length() (to match other String types).
+
+        * runtime/UStringBuilder.h:
+        (JSC::UStringBuilder::append):
+        (JSC::UStringBuilder::toUString):
+            Update for changes in parent class, can just 'using' the append methods.
+
+        * wtf/text/StringBuilder.cpp: Added.
+        (WTF::StringBuilder::reifyString):
+        (WTF::StringBuilder::resize):
+        (WTF::StringBuilder::reserveCapacity):
+        (WTF::StringBuilder::allocateBuffer):
+        (WTF::StringBuilder::appendUninitialized):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::shrinkToFit):
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::StringBuilder):
+        (WTF::StringBuilder::append):
+        (WTF::StringBuilder::toString):
+        (WTF::StringBuilder::toStringPreserveCapacity):
+        (WTF::StringBuilder::length):
+        (WTF::StringBuilder::isEmpty):
+        (WTF::StringBuilder::operator[]):
+        (WTF::StringBuilder::clear):
+            Class updated to use overcapacity in a StringImpl, rather than a Vector.
+
+        * Android.mk:
+        * Android.v8.wtf.mk:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.gypi:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops:
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj:
+        * JavaScriptCore.vcproj/jsc/jsc.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/CMakeLists.txt:
+        * wtf/wtf.pri:
+
+2010-10-13  Adam Roben  <aroben@apple.com>
+
+        Export tryFastRealloc for WebKit2's benefit
+
+        Rubber-stamped by Anders Carlsson.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def: Added
+        tryFastRealloc. Removed RegExpObject::info, which is now exported via
+        JS_EXPORTDATA.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Maciej Stachowiak.
+
+        [WTFURL] Add a mechanism for classifying types of characters
+        https://bugs.webkit.org/show_bug.cgi?id=45085
+
+        Various characters have different escaping rules depending on where
+        they are in URLs.  This patch adds a table containing that information.
+
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * wtf/url/src/URLCharacterTypes.cpp: Added.
+        * wtf/url/src/URLCharacterTypes.h: Added.
+        (WTF::URLCharacterTypes::isQueryChar):
+        (WTF::URLCharacterTypes::isIPv4Char):
+        (WTF::URLCharacterTypes::isHexChar):
+        (WTF::URLCharacterTypes::isCharOfType):
+
+2010-10-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Missing parameters for bytecode dump of next_pname
+        https://bugs.webkit.org/show_bug.cgi?id=47590
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump): add missing parameters to the dump.
+
+2010-10-13  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add wtf/text/StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47584
+
+        Move runtime/StringConcatenate.h to wtf/text, make it work for Strings too.
+        Add a special runtime/UStringConcatenate.h class that inherits from StringConcatenate, and extends it for use with UString.
+        Exactly the same design that has been followed while refactoring StringBuilder.
+
+        The UString variants can all be removed as soon as WTF::String & JSC::UString converge.
+
+        * GNUmakefile.am: Add wtf/text/StringConcatenate.h and runtime/UStringConcatenate.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * bytecode/CodeBlock.cpp: s/makeString/makeUString/
+        (JSC::escapeQuotes):
+        (JSC::valueToSourceString):
+        (JSC::constantName):
+        (JSC::idName):
+        (JSC::CodeBlock::registerName):
+        (JSC::regexpToSourceString):
+        (JSC::regexpName):
+        * bytecompiler/NodesCodegen.cpp: Ditto.
+        (JSC::substitute):
+        * profiler/Profiler.cpp: Ditto.
+        (JSC::Profiler::createCallIdentifier):
+        * runtime/ExceptionHelpers.cpp: Ditto.
+        (JSC::createUndefinedVariableError):
+        (JSC::createErrorMessage):
+        (JSC::createInvalidParamError):
+        * runtime/FunctionConstructor.cpp: Ditto.
+        (JSC::constructFunction):
+        * runtime/FunctionPrototype.cpp: Ditto.
+        (JSC::insertSemicolonIfNeeded):
+        * runtime/JSONObject.cpp: Ditto.
+        (JSC::Stringifier::indent):
+        * runtime/JSStringBuilder.h:
+        (JSC::jsMakeNontrivialString):
+        * runtime/RegExpConstructor.cpp: Ditto.
+        (JSC::constructRegExp):
+        * runtime/RegExpObject.cpp: Ditto.
+        (JSC::RegExpObject::match):
+        * runtime/RegExpPrototype.cpp: Ditto.
+        (JSC::regExpProtoFuncCompile):
+        * runtime/StringConcatenate.h: Removed.
+        * runtime/UStringConcatenate.h: Added. Only contains the StringTypeAdapter<JSC::UString> code and the makeUString variants, the rest lives in wtf/text/StringConcatenate.h
+        (JSC::makeUString):
+        * wtf/text/StringConcatenate.h: Copied from runtime/StringConcatenate.h.
+        (WTF::makeString):
+
+2010-10-12  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix.
+
+        * wtf/text/StringBuilder.h:
+        (WTF::StringBuilder::length):
+
+2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Unify JSC::StringBuilder & WebCore::StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=47538
+
+        Move runtime/StringBuilder.h to wtf/text/StringBuilder.h. Rename build() to toString() and return a WTF::String().
+        Move the append(const JSC::UString&) method into runtime/UStringBuilder.h.
+        UStringBuilder inherits from StringBuilder.h and adds append(const JSC::UString&) and UString toUString() functionality.
+
+        No new code, just move code around.
+
+        * GNUmakefile.am: Add wtf/text/StringBuilder.h / runtime/UStringBuilder.h. Remove runtime/StringBuilder.h.
+        * JavaScriptCore.gypi: Ditto.
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj: Ditto.
+        * JavaScriptCore.vcproj/WTF/WTF.vcproj: Ditto.
+        * JavaScriptCore.xcodeproj/project.pbxproj: Ditto.
+        * runtime/Executable.cpp:
+        (JSC::FunctionExecutable::paramString): Use UStringBuilder, instead of StringBuilder. Rename build() -> toUString().
+        * runtime/FunctionConstructor.cpp:
+        (JSC::constructFunction): Ditto.
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncUnescape): Ditto.
+        * runtime/JSONObject.cpp:
+        (JSC::Stringifier::stringify): Ditto.
+        (JSC::Stringifier::appendQuotedString): Ditto.
+        (JSC::Stringifier::appendStringifiedValue): Ditto.
+        (JSC::Stringifier::startNewLine): Ditto.
+        (JSC::Stringifier::Holder::appendNextProperty): Ditto.
+        * runtime/LiteralParser.cpp:
+        (JSC::LiteralParser::Lexer::lexString): Ditto.
+        * runtime/NumberPrototype.cpp: Remove unneeded JSStringBuilder.h / StringBuilder.h include.
+        * runtime/StringBuilder.h: Removed.
+        * runtime/UStringBuilder.h: Added. Inherits from WTF::StringBuilder, extending it by two methods.
+        (JSC::UStringBuilder::append): append(const JSC::UString&)
+        (JSC::UStringBuilder::toUString):
+        * wtf/text/StringBuilder.h: Copied from runtime/StringBuilder.h. Move JSC::UString parts into runtime/UStringBuilder.h
+        (WTF::StringBuilder::append): Renamed m_buffer to buffer everywhere.
+        (WTF::StringBuilder::isEmpty): Ditto (+ constify method). 
+        (WTF::StringBuilder::reserveCapacity): Ditto.
+        (WTF::StringBuilder::resize): Ditto.
+        (WTF::StringBuilder::size): Ditto.
+        (WTF::StringBuilder::operator[]): Ditto.
+        (WTF::StringBuilder::toString): Ditto (+ renamed from build()). Returns a String, not an UString. The old build() method is now named toUString() and lives in UStringBuilder.
+
+2010-10-12  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Cleaned up the processing of replacements after regular expression
+        processing, especially the case where there wasn't a match.
+        Changed to use empty strings instead of computing a zero length sub
+        string.
+        https://bugs.webkit.org/show_bug.cgi?id=47506
+
+        * runtime/StringPrototype.cpp:
+        (JSC::jsSpliceSubstringsWithSeparators):
+        (JSC::stringProtoFuncReplace):
+
+2010-10-11  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Clang build fix after r69472.
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Undo last minute change to 32bit build.
+
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_convert_this_strict):
+
+2010-10-11  Brian Weinstein  <bweinstein@apple.com>
+
+        Build fix for Windows. Add a necessary export from r69516.
+
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Fix interpreter build -- was broken by incorrect merge.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=10701
+
+        Initial strict mode implementation.  This is the simplest
+        implementation that could possibly work and adds (hopefully)
+        all of the restrictions required by strict mode.  There are
+        a number of inefficiencies, especially in the handling of
+        arguments and eval as smart implementations would make this
+        patch more complicated.  
+
+        The SyntaxChecker AST builder has become somewhat more complex
+        as strict mode does require more parse tree information to
+        validate the syntax.
+
+        Summary of major changes to the parser:
+            * We track when we enter strict mode (this may come as a surprise)
+            * Strict mode actually requires a degree of AST knowledge to validate
+              so the SyntaxChecker now produces values that can be used to distinguish
+              "node" types.
+            * We now track variables that are written to.  We do this to
+              statically identify writes to global properties that don't exist
+              and abort at that point.  This should actually make it possible
+              to optimise some other cases in the future but for now it's
+              purely for validity checking.  Currently writes are only tracked
+              in strict mode code.
+            * Labels are now tracked as it is now a syntax error to jump to a label
+              that does not exist (or to use break, continue, or return in a context
+              where they would be invalid).
+
+        Runtime changes:
+            * In order to get correct hanlding of the Arguments object all
+              strict mode functions that reference arguments create and tearoff
+              the arguments object on entry.  This is not strictly necessary
+              but was the least work necessary to get the correct behaviour.
+            * PutPropertySlot now tracks whether it is being used for a strict
+              mode write, and if so Object::put will throw when a write can't be
+              completed.
+            * StrictEvalActivation was added as an "activation" object for strict
+              mode eval (so that strict eval does not introduce new variables into
+              the containing scope).
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * JavaScriptCore.exp:
+        * JavaScriptCore.pro:
+        * JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj:
+        * JavaScriptCore.xcodeproj/project.pbxproj:
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::CodeBlock):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::isStrictMode):
+        * bytecode/EvalCodeCache.h:
+        (JSC::EvalCodeCache::get):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::createArgumentsIfNecessary):
+        (JSC::BytecodeGenerator::emitReturn):
+        * bytecompiler/BytecodeGenerator.h:
+        (JSC::BytecodeGenerator::isStrictMode):
+        (JSC::BytecodeGenerator::makeFunction):
+        * debugger/Debugger.cpp:
+        (JSC::evaluateInGlobalCallFrame):
+        * debugger/DebuggerCallFrame.cpp:
+        (JSC::DebuggerCallFrame::evaluate):
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::callEval):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::execute):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        (JSC::JIT::privateCompileSlowCases):
+        * jit/JIT.h:
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        (JSC::JIT::emit_op_convert_this_strict):
+        (JSC::JIT::emitSlow_op_convert_this_strict):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_pnames):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+        * jit/JITStubs.h:
+        * parser/ASTBuilder.h:
+        (JSC::ASTBuilder::createFunctionBody):
+        (JSC::ASTBuilder::isResolve):
+        * parser/JSParser.cpp:
+        (JSC::JSParser::next):
+        (JSC::JSParser::startLoop):
+        (JSC::JSParser::endLoop):
+        (JSC::JSParser::startSwitch):
+        (JSC::JSParser::endSwitch):
+        (JSC::JSParser::setStrictMode):
+        (JSC::JSParser::strictMode):
+        (JSC::JSParser::isValidStrictMode):
+        (JSC::JSParser::declareParameter):
+        (JSC::JSParser::breakIsValid):
+        (JSC::JSParser::pushLabel):
+        (JSC::JSParser::popLabel):
+        (JSC::JSParser::hasLabel):
+        (JSC::JSParser::DepthManager::DepthManager):
+        (JSC::JSParser::DepthManager::~DepthManager):
+        (JSC::JSParser::Scope::Scope):
+        (JSC::JSParser::Scope::startSwitch):
+        (JSC::JSParser::Scope::endSwitch):
+        (JSC::JSParser::Scope::startLoop):
+        (JSC::JSParser::Scope::endLoop):
+        (JSC::JSParser::Scope::inLoop):
+        (JSC::JSParser::Scope::breakIsValid):
+        (JSC::JSParser::Scope::pushLabel):
+        (JSC::JSParser::Scope::popLabel):
+        (JSC::JSParser::Scope::hasLabel):
+        (JSC::JSParser::Scope::isFunction):
+        (JSC::JSParser::Scope::declareVariable):
+        (JSC::JSParser::Scope::declareWrite):
+        (JSC::JSParser::Scope::deleteProperty):
+        (JSC::JSParser::Scope::declareParameter):
+        (JSC::JSParser::Scope::setNeedsFullActivation):
+        (JSC::JSParser::Scope::collectFreeVariables):
+        (JSC::JSParser::Scope::getUncapturedWrittenVariables):
+        (JSC::JSParser::Scope::getDeletedVariables):
+        (JSC::JSParser::Scope::setStrictMode):
+        (JSC::JSParser::Scope::strictMode):
+        (JSC::JSParser::Scope::isValidStrictMode):
+        (JSC::JSParser::pushScope):
+        (JSC::JSParser::popScope):
+        (JSC::JSParser::declareVariable):
+        (JSC::JSParser::declareWrite):
+        (JSC::JSParser::deleteProperty):
+        (JSC::jsParse):
+        (JSC::JSParser::JSParser):
+        (JSC::JSParser::parseProgram):
+        (JSC::JSParser::parseSourceElements):
+        (JSC::JSParser::parseDoWhileStatement):
+        (JSC::JSParser::parseWhileStatement):
+        (JSC::JSParser::parseVarDeclarationList):
+        (JSC::JSParser::parseConstDeclarationList):
+        (JSC::JSParser::parseForStatement):
+        (JSC::JSParser::parseBreakStatement):
+        (JSC::JSParser::parseContinueStatement):
+        (JSC::JSParser::parseReturnStatement):
+        (JSC::JSParser::parseWithStatement):
+        (JSC::JSParser::parseSwitchStatement):
+        (JSC::JSParser::parseSwitchClauses):
+        (JSC::JSParser::parseSwitchDefaultClause):
+        (JSC::JSParser::parseTryStatement):
+        (JSC::JSParser::parseBlockStatement):
+        (JSC::JSParser::parseStatement):
+        (JSC::JSParser::parseFormalParameters):
+        (JSC::JSParser::parseFunctionBody):
+        (JSC::JSParser::parseFunctionInfo):
+        (JSC::JSParser::parseFunctionDeclaration):
+        (JSC::JSParser::parseExpressionOrLabelStatement):
+        (JSC::JSParser::parseIfStatement):
+        (JSC::JSParser::parseExpression):
+        (JSC::JSParser::parseAssignmentExpression):
+        (JSC::JSParser::parseConditionalExpression):
+        (JSC::JSParser::parseBinaryExpression):
+        (JSC::JSParser::parseStrictObjectLiteral):
+        (JSC::JSParser::parsePrimaryExpression):
+        (JSC::JSParser::parseMemberExpression):
+        (JSC::JSParser::parseUnaryExpression):
+        * parser/JSParser.h:
+        * parser/Lexer.cpp:
+        (JSC::Lexer::parseString):
+        (JSC::Lexer::lex):
+        * parser/Lexer.h:
+        (JSC::Lexer::isReparsing):
+        * parser/Nodes.cpp:
+        (JSC::ScopeNode::ScopeNode):
+        (JSC::FunctionBodyNode::FunctionBodyNode):
+        (JSC::FunctionBodyNode::create):
+        * parser/Nodes.h:
+        (JSC::ScopeNode::isStrictMode):
+        * parser/Parser.cpp:
+        (JSC::Parser::parse):
+        * parser/Parser.h:
+        (JSC::Parser::parse):
+        * parser/SyntaxChecker.h:
+        (JSC::SyntaxChecker::SyntaxChecker):
+        (JSC::SyntaxChecker::makeFunctionCallNode):
+        (JSC::SyntaxChecker::appendToComma):
+        (JSC::SyntaxChecker::createCommaExpr):
+        (JSC::SyntaxChecker::makeAssignNode):
+        (JSC::SyntaxChecker::makePrefixNode):
+        (JSC::SyntaxChecker::makePostfixNode):
+        (JSC::SyntaxChecker::makeTypeOfNode):
+        (JSC::SyntaxChecker::makeDeleteNode):
+        (JSC::SyntaxChecker::makeNegateNode):
+        (JSC::SyntaxChecker::makeBitwiseNotNode):
+        (JSC::SyntaxChecker::createLogicalNot):
+        (JSC::SyntaxChecker::createUnaryPlus):
+        (JSC::SyntaxChecker::createVoid):
+        (JSC::SyntaxChecker::thisExpr):
+        (JSC::SyntaxChecker::createResolve):
+        (JSC::SyntaxChecker::createObjectLiteral):
+        (JSC::SyntaxChecker::createArray):
+        (JSC::SyntaxChecker::createNumberExpr):
+        (JSC::SyntaxChecker::createString):
+        (JSC::SyntaxChecker::createBoolean):
+        (JSC::SyntaxChecker::createNull):
+        (JSC::SyntaxChecker::createBracketAccess):
+        (JSC::SyntaxChecker::createDotAccess):
+        (JSC::SyntaxChecker::createRegex):
+        (JSC::SyntaxChecker::createNewExpr):
+        (JSC::SyntaxChecker::createConditionalExpr):
+        (JSC::SyntaxChecker::createAssignResolve):
+        (JSC::SyntaxChecker::createFunctionExpr):
+        (JSC::SyntaxChecker::createFunctionBody):
+        (JSC::SyntaxChecker::appendBinaryExpressionInfo):
+        (JSC::SyntaxChecker::operatorStackPop):
+        * runtime/Arguments.cpp:
+        (JSC::Arguments::createStrictModeCallerIfNecessary):
+        (JSC::Arguments::createStrictModeCalleeIfNecessary):
+        (JSC::Arguments::getOwnPropertySlot):
+        (JSC::Arguments::getOwnPropertyDescriptor):
+        (JSC::Arguments::put):
+        (JSC::Arguments::deleteProperty):
+        * runtime/Arguments.h:
+        (JSC::Arguments::Arguments):
+        * runtime/CommonIdentifiers.cpp:
+        (JSC::CommonIdentifiers::CommonIdentifiers):
+        * runtime/CommonIdentifiers.h:
+        * runtime/Error.cpp:
+        (JSC::StrictModeTypeErrorFunction::StrictModeTypeErrorFunction):
+        (JSC::StrictModeTypeErrorFunction::constructThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getConstructData):
+        (JSC::StrictModeTypeErrorFunction::callThrowTypeError):
+        (JSC::StrictModeTypeErrorFunction::getCallData):
+        (JSC::createTypeErrorFunction):
+        * runtime/Error.h:
+        * runtime/Executable.cpp:
+        (JSC::EvalExecutable::EvalExecutable):
+        (JSC::ProgramExecutable::ProgramExecutable):
+        (JSC::FunctionExecutable::FunctionExecutable):
+        (JSC::EvalExecutable::compileInternal):
+        (JSC::ProgramExecutable::checkSyntax):
+        (JSC::ProgramExecutable::compileInternal):
+        (JSC::FunctionExecutable::compileForCallInternal):
+        (JSC::FunctionExecutable::compileForConstructInternal):
+        (JSC::FunctionExecutable::reparseExceptionInfo):
+        (JSC::EvalExecutable::reparseExceptionInfo):
+        (JSC::FunctionExecutable::fromGlobalCode):
+        (JSC::ProgramExecutable::reparseExceptionInfo):
+        * runtime/Executable.h:
+        (JSC::ScriptExecutable::ScriptExecutable):
+        (JSC::ScriptExecutable::isStrictMode):
+        (JSC::EvalExecutable::create):
+        (JSC::FunctionExecutable::create):
+        * runtime/JSActivation.cpp:
+        (JSC::JSActivation::toStrictThisObject):
+        * runtime/JSActivation.h:
+        * runtime/JSFunction.cpp:
+        (JSC::createDescriptorForThrowingProperty):
+        (JSC::JSFunction::getOwnPropertySlot):
+        (JSC::JSFunction::getOwnPropertyDescriptor):
+        (JSC::JSFunction::put):
+        * runtime/JSGlobalData.cpp:
+        (JSC::JSGlobalData::JSGlobalData):
+        * runtime/JSGlobalData.h:
+        * runtime/JSGlobalObject.cpp:
+        (JSC::JSGlobalObject::reset):
+        * runtime/JSGlobalObject.h:
+        (JSC::JSGlobalObject::internalFunctionStructure):
+        * runtime/JSGlobalObjectFunctions.cpp:
+        (JSC::globalFuncEval):
+        * runtime/JSObject.cpp:
+        (JSC::JSObject::put):
+        (JSC::JSObject::toStrictThisObject):
+        (JSC::throwTypeError):
+        * runtime/JSObject.h:
+        (JSC::JSObject::isStrictModeFunction):
+        (JSC::JSObject::putDirectInternal):
+        (JSC::JSObject::putDirect):
+        (JSC::JSValue::putDirect):
+        (JSC::JSValue::toStrictThisObject):
+        * runtime/JSStaticScopeObject.cpp:
+        (JSC::JSStaticScopeObject::toStrictThisObject):
+        * runtime/JSStaticScopeObject.h:
+        * runtime/JSValue.h:
+        * runtime/JSZombie.h:
+        (JSC::JSZombie::toStrictThisObject):
+        * runtime/PutPropertySlot.h:
+        (JSC::PutPropertySlot::PutPropertySlot):
+        (JSC::PutPropertySlot::isStrictMode):
+        * runtime/StrictEvalActivation.cpp: Added.
+        (JSC::StrictEvalActivation::StrictEvalActivation):
+        (JSC::StrictEvalActivation::deleteProperty):
+        (JSC::StrictEvalActivation::toThisObject):
+        (JSC::StrictEvalActivation::toStrictThisObject):
+        * runtime/StrictEvalActivation.h: Added.
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Windows build fix after r69472.
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-10  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Use WTF::StringHasher in WTF::CaseFoldingHash
+        https://bugs.webkit.org/show_bug.cgi?id=46523
+
+        * wtf/text/StringHash.h:
+        (WTF::CaseFoldingHash::foldCase):
+        (WTF::CaseFoldingHash::hash):
+
+2010-10-09  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Xan Lopez.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47445
+        Remove unused function WTFThreadData::initializeIdentifierTable()
+
+        * wtf/WTFThreadData.h:
+
+2010-10-08  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Added check to start of subexpression being positive before using
+        subexpression in replacement.
+        https://bugs.webkit.org/show_bug.cgi?id=47324
+
+        * runtime/StringPrototype.cpp:
+        (JSC::substituteBackreferencesSlow):
+
+2010-10-08  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47393
+
+        Use unsigned consistently to check for max StringImpl length.
+        Add a few integer overflow checks.
+        Uses the existing paradigm of CRASH() when we can't reasonably handle a crazily large request.
+
+        * wtf/text/WTFString.cpp:
+        * wtf/text/StringImpl.h:
+        * wtf/text/StringImpl.cpp:
+        Better use of size_t vs. unsigned; check for integer overflows.
+
+2010-10-07  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARM JIT generates undefined operations due to partially uninitialized ShiftTypeAndAmount
+        https://bugs.webkit.org/show_bug.cgi?id=47356
+
+        * assembler/ARMv7Assembler.h:
+
+2010-10-06  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47248
+
+        Use size_t consistently in CString, to prevent theoretical trouble
+        with > 4GB strings on 64-bit platforms.
+
+        * wtf/text/CString.h:
+        * wtf/text/CString.cpp:
+        Use size_t for string lengths.
+        * wtf/MD5.cpp:
+        (WTF::expectMD5): use suitable format string + cast for size_t.
+        * JavaScriptCore.exp:
+        Update symbol name.
+
+2010-10-06  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start cleaning up Arguments.h
+        https://bugs.webkit.org/show_bug.cgi?id=47304
+
+        * wtf/TypeTraits.h:
+        * wtf/TypeTraits.cpp:
+        Add RemoveReference type trait.
+
+2010-10-06  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [EFL] Build fix for glib support.
+        https://bugs.webkit.org/show_bug.cgi?id=47221
+
+        If compiling with GLib support enabled, we also need to link wtf against
+        glib library.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Gavin Barraclough.
+
+        [BREWMP] Port ExecutableAllocator::cacheFlush to enable ARM JIT
+        https://bugs.webkit.org/show_bug.cgi?id=47117
+
+        Use IMemCache1 to flush data cache and invalidate instruction cache.
+
+        * jit/ExecutableAllocator.h:
+        (JSC::ExecutableAllocator::cacheFlush):
+
+2010-10-05  Leandro Pereira  <leandro@profusion.mobi>
+
+        Unreviewed. Build fix.
+
+        Moved "jsc" directory to "shell", so that the name does not clash with the
+        JavaScriptCore shell in some build systems.
+        http://webkit.org/b/47049
+
+        * CMakeLists.txt: Changed reference from "jsc" to "shell".
+        * jsc: Removed.
+        * jsc/CMakeLists.txt: Removed.
+        * jsc/CMakeListsEfl.txt: Removed.
+        * shell: Copied from JavaScriptCore/jsc.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use PlatformRefPtr in randomNumber
+        https://bugs.webkit.org/show_bug.cgi?id=46989
+
+        Use PlatformRefPtr to free memory automatically.
+
+        * wtf/RandomNumber.cpp:
+        (WTF::randomNumber):
+
+2010-10-05  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r68338): JavaScript error on PowerPC only (crashes on Interpreter built for x86_64)
+        https://bugs.webkit.org/show_bug.cgi?id=46690
+
+        Use the correct register value when initialising the arguments
+        object in the interpreter.  This is covered by existing tests.
+
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::privateExecute):
+
+2010-10-04  David Goodwin  <david_goodwin@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        ARMv7 JIT should take advantage of 2-byte branches to reduce code size
+        https://bugs.webkit.org/show_bug.cgi?id=47007
+
+        * assembler/ARMv7Assembler.cpp:
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::computeJumpType):
+        (JSC::ARMv7Assembler::link):
+        (JSC::ARMv7Assembler::canBeJumpT2):
+        (JSC::ARMv7Assembler::canBeJumpT4):
+        (JSC::ARMv7Assembler::linkBX):
+        (JSC::ARMv7Assembler::linkJumpT4):
+        (JSC::ARMv7Assembler::linkJumpT2):
+        (JSC::ARMv7Assembler::linkJumpAbsolute):
+
+2010-10-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Use fast malloc for WebKit EFL
+        https://bugs.webkit.org/show_bug.cgi?id=46691
+
+        Use fast malloc for WebKit EFL because the fast malloc is to allocate
+        memory quickly.
+
+        * wtf/CMakeListsEfl.txt:
+
+2010-10-04  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Geoff Garen.
+
+        Lazily create activation objects
+        https://bugs.webkit.org/show_bug.cgi?id=47107
+
+        Make it possible to lazily create the activation object
+        for a function that needs one.  This allows us to reduce
+        the overhead of entering a function that may require
+        an activation in some cases, but not always.
+
+        This does make exception handling a little more complex as
+        it's now necessary to verify that a callframes activation
+        has been created, and create it if not, in all of the
+        paths used in exception handling.
+
+        We also need to add logic to check for the existence of
+        the activation in the scoped_var opcodes, as well as
+        op_ret, op_ret_object_or_this and op_tearoff_activation
+        so that we can avoid creating an activation unnecesarily
+        on function exit. 
+
+        * bytecode/CodeBlock.cpp:
+        (JSC::CodeBlock::dump):
+        (JSC::CodeBlock::reparseForExceptionInfoIfNecessary):
+        (JSC::CodeBlock::createActivation):
+        * bytecode/CodeBlock.h:
+        (JSC::CodeBlock::setActivationRegister):
+        (JSC::CodeBlock::activationRegister):
+        * bytecode/Opcode.h:
+        * bytecompiler/BytecodeGenerator.cpp:
+        (JSC::BytecodeGenerator::BytecodeGenerator):
+        (JSC::BytecodeGenerator::emitNewFunctionInternal):
+        (JSC::BytecodeGenerator::emitNewFunctionExpression):
+        (JSC::BytecodeGenerator::createActivationIfNecessary):
+        * bytecompiler/BytecodeGenerator.h:
+        * interpreter/Interpreter.cpp:
+        (JSC::Interpreter::resolveSkip):
+        (JSC::Interpreter::resolveGlobalDynamic):
+        (JSC::Interpreter::resolveBase):
+        (JSC::Interpreter::unwindCallFrame):
+        (JSC::Interpreter::throwException):
+        (JSC::Interpreter::privateExecute):
+        * jit/JIT.cpp:
+        (JSC::JIT::privateCompileMainPass):
+        * jit/JIT.h:
+        * jit/JITCall32_64.cpp:
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        * jit/JITOpcodes.cpp:
+        (JSC::JIT::emit_op_end):
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_ret):
+        (JSC::JIT::emit_op_ret_object_or_this):
+        (JSC::JIT::emit_op_create_activation):
+        (JSC::JIT::emit_op_resolve_global_dynamic):
+        * jit/JITOpcodes32_64.cpp:
+        (JSC::JIT::emit_op_get_scoped_var):
+        (JSC::JIT::emit_op_put_scoped_var):
+        (JSC::JIT::emit_op_tear_off_activation):
+        (JSC::JIT::emit_op_create_activation):
+        * jit/JITStubs.cpp:
+        (JSC::DEFINE_STUB_FUNCTION):
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove ENABLE_SANDBOX
+        https://bugs.webkit.org/show_bug.cgi?id=47032
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-10-01  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        Specify ALWAYS_INLINE at function declaration not function definition
+        https://bugs.webkit.org/show_bug.cgi?id=46960
+
+        For functions defined with ALWAYS_INLINE, add the attribute to the declaration as well.
+
+        * bytecompiler/BytecodeGenerator.h:
+        * wtf/FastMalloc.cpp:
+
+2010-10-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed.
+
+        [BREWMP] Change Collector BLOCK_SIZE to 64KB
+        https://bugs.webkit.org/show_bug.cgi?id=46436
+
+        Lower BLOCK_SIZE to 64KB because Brew MP runs on low end devices.
+
+        * runtime/Collector.h:
+
+2010-10-01  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Stack overflow on symbian platform.
+        https://bugs.webkit.org/show_bug.cgi?id=40598
+        
+        Move big allocation in arrayProtoFuncToString from stack to heap.
+        JSC::arrayProtoFuncToString function can be called recursivly and
+        1K allocation on stack cahse stack overflow.
+        Can be useful for other platforms with limited stack size.
+
+        * runtime/ArrayPrototype.cpp:
+        (JSC::arrayProtoFuncToString):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add a factory function which returns an instance wrapped in PlatformRefPtr.
+        https://bugs.webkit.org/show_bug.cgi?id=46373
+
+        A Brew MP instance has reference count 1 when it is created, so call adoptPlatformRef
+        to wrap the instance in PlatformRefPtr.
+
+        * wtf/brew/ShellBrew.h:
+        (WTF::createRefPtrInstance):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port PlatformRefPtr
+        https://bugs.webkit.org/show_bug.cgi?id=46370
+
+        Implement refPlatformPtr and derefPlatformPtr to use PlatformRefPtr in Brew MP.
+
+        * wtf/brew/RefPtrBrew.h: Added.
+        (WTF::refPlatformPtr):
+        (WTF::derefPlatformPtr):
+
+2010-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add additional checks to StringBuffer.
+        <rdar://problem/7756381>
+
+        * wtf/text/StringBuffer.h:
+        (WTF::StringBuffer::StringBuffer):
+        (WTF::StringBuffer::resize):
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+        
+        Added ACCELERATED_2D_CANVAS to FeatureDefines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-30  Kevin Ollivier  <kevino@theolliviers.com>
+
+        [wx] wxMSW build fix. Make sure we copy the compiler flags and remove exception handling from
+        the copy so as not to alter global settings.
+
+        * wscript:
+
+2010-09-30  Peter Varga  <pvarga@inf.u-szeged.hu>
+
+        Reviewed by Gavin Barraclough.
+
+        The case-insensitivity backreference checking isn't working with YARR
+        Interpreter
+        https://bugs.webkit.org/show_bug.cgi?id=46882
+
+        Add ignorecase checking to the Interpreter::tryConsumeBackReference() function.
+
+        * yarr/RegexInterpreter.cpp:
+        (JSC::Yarr::Interpreter::tryConsumeBackReference):
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Andreas Kling.
+
+        [BREWMP] Leave initializeRandomNumberGenerator empty.
+        https://bugs.webkit.org/show_bug.cgi?id=46851
+
+        On Brew MP, AEECLSID_RANDOM initializes itself.
+
+        * wtf/RandomNumberSeed.h:
+        (WTF::initializeRandomNumberGenerator):
+
+2010-09-30  Gabor Loki  <loki@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Remove unnecessary cacheFlush calls from Thumb-2
+        https://bugs.webkit.org/show_bug.cgi?id=46702
+
+        * assembler/ARMv7Assembler.h:
+        (JSC::ARMv7Assembler::relinkCall):
+        (JSC::ARMv7Assembler::repatchInt32):
+        (JSC::ARMv7Assembler::repatchPointer):
+
 2010-09-29  Patrick Gansterer  <paroga@webkit.org>
 
         Unreviewed.
diff --git a/JavaScriptCore/Configurations/FeatureDefines.xcconfig b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
index 2ed3a8e..4c698ce 100644
--- a/JavaScriptCore/Configurations/FeatureDefines.xcconfig
+++ b/JavaScriptCore/Configurations/FeatureDefines.xcconfig
@@ -33,6 +33,11 @@
 
 ENABLE_LINK_PREFETCH = ;
 
+ENABLE_ACCELERATED_2D_CANVAS = $(ENABLE_ACCELERATED_2D_CANVAS_$(REAL_PLATFORM_NAME));
+ENABLE_ACCELERATED_2D_CANVAS_macosx = $(ENABLE_ACCELERATED_2D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1060 = ;
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1070 = ;
+
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(REAL_PLATFORM_NAME));
 ENABLE_3D_CANVAS_macosx = $(ENABLE_3D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_macosx_1060 = ENABLE_3D_CANVAS;
@@ -88,9 +93,6 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_RUBY = $(ENABLE_RUBY_$(REAL_PLATFORM_NAME));
 ENABLE_RUBY_macosx = ENABLE_RUBY;
 
-ENABLE_SANDBOX = $(ENABLE_SANDBOX_$(REAL_PLATFORM_NAME));
-ENABLE_SANDBOX_macosx = ENABLE_SANDBOX;
-
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
 ENABLE_SHARED_WORKERS_macosx = ENABLE_SHARED_WORKERS;
 
@@ -119,4 +121,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/JavaScriptCore/Configurations/Version.xcconfig b/JavaScriptCore/Configurations/Version.xcconfig
index f688ea8..35ae251 100644
--- a/JavaScriptCore/Configurations/Version.xcconfig
+++ b/JavaScriptCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 10;
+MINOR_VERSION = 11;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptCore/GNUmakefile.am b/JavaScriptCore/GNUmakefile.am
index 88d1761..c507f5d 100644
--- a/JavaScriptCore/GNUmakefile.am
+++ b/JavaScriptCore/GNUmakefile.am
@@ -388,8 +388,8 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/ScopeChainMark.h \
 	JavaScriptCore/runtime/SmallStrings.cpp \
 	JavaScriptCore/runtime/SmallStrings.h \
-	JavaScriptCore/runtime/StringBuilder.h \
-	JavaScriptCore/runtime/StringConcatenate.h \
+	JavaScriptCore/runtime/StrictEvalActivation.cpp \
+	JavaScriptCore/runtime/StrictEvalActivation.h \
 	JavaScriptCore/runtime/StringConstructor.cpp \
 	JavaScriptCore/runtime/StringConstructor.h \
 	JavaScriptCore/runtime/StringObject.cpp \
@@ -409,6 +409,8 @@ javascriptcore_sources += \
 	JavaScriptCore/runtime/Tracing.h \
 	JavaScriptCore/runtime/UString.cpp \
 	JavaScriptCore/runtime/UString.h \
+	JavaScriptCore/runtime/UStringBuilder.h \
+	JavaScriptCore/runtime/UStringConcatenate.h \
 	JavaScriptCore/runtime/WeakGCMap.h \
 	JavaScriptCore/runtime/WeakGCPtr.h \
 	JavaScriptCore/runtime/WeakRandom.h \
@@ -428,6 +430,7 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/DateMath.cpp \
 	JavaScriptCore/wtf/DateMath.h \
 	JavaScriptCore/wtf/DecimalNumber.h \
+	JavaScriptCore/wtf/DecimalNumber.cpp \
 	JavaScriptCore/wtf/Deque.h \
 	JavaScriptCore/wtf/DisallowCType.h \
 	JavaScriptCore/wtf/dtoa.cpp \
@@ -466,6 +469,7 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/NonCopyingSort.h \
 	JavaScriptCore/wtf/Noncopyable.h \
 	JavaScriptCore/wtf/NotFound.h \
+	JavaScriptCore/wtf/NullPtr.h \
 	JavaScriptCore/wtf/OwnArrayPtr.h \
 	JavaScriptCore/wtf/OwnFastMallocPtr.h \
 	JavaScriptCore/wtf/OwnArrayPtrCommon.h \
@@ -493,7 +497,7 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/StaticConstructors.h \
 	JavaScriptCore/wtf/StdLibExtras.h \
 	JavaScriptCore/wtf/StringExtras.h \
-	JavaScriptCore/wtf/StringHashFunctions.h \
+	JavaScriptCore/wtf/StringHasher.h \
 	JavaScriptCore/wtf/TCPackedCache.h \
 	JavaScriptCore/wtf/TCPageMap.h \
 	JavaScriptCore/wtf/TCSpinLock.h \
@@ -506,6 +510,9 @@ javascriptcore_sources += \
 	JavaScriptCore/wtf/text/CString.cpp \
 	JavaScriptCore/wtf/text/CString.h \
 	JavaScriptCore/wtf/text/StringBuffer.h \
+	JavaScriptCore/wtf/text/StringBuilder.cpp \
+	JavaScriptCore/wtf/text/StringBuilder.h \
+	JavaScriptCore/wtf/text/StringConcatenate.h \
 	JavaScriptCore/wtf/text/StringHash.h \
 	JavaScriptCore/wtf/text/StringImplBase.h \
 	JavaScriptCore/wtf/text/StringImpl.cpp \
diff --git a/JavaScriptCore/JavaScriptCore.exp b/JavaScriptCore/JavaScriptCore.exp
index ff3d9b3..6ef8ead 100644
--- a/JavaScriptCore/JavaScriptCore.exp
+++ b/JavaScriptCore/JavaScriptCore.exp
@@ -132,6 +132,8 @@ __ZN3JSC12JSGlobalData14sharedInstanceEv
 __ZN3JSC12JSGlobalData15dumpRegExpTraceEv
 __ZN3JSC12JSGlobalData6createENS_15ThreadStackTypeE
 __ZN3JSC12JSGlobalDataD1Ev
+__ZN3JSC12RegExpObject4infoE
+__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEENS4_INS_6RegExpEEE
 __ZN3JSC12SamplingTool5setupEv
 __ZN3JSC12SmallStrings17createEmptyStringEPNS_12JSGlobalDataE
 __ZN3JSC12SmallStrings27createSingleCharacterStringEPNS_12JSGlobalDataEh
@@ -150,7 +152,6 @@ __ZN3JSC13SamplingFlags4stopEv
 __ZN3JSC13SamplingFlags5startEv
 __ZN3JSC13SamplingFlags7s_flagsE
 __ZN3JSC13StatementNode6setLocEii
-__ZN3JSC14heapStatisticsEPNS_12JSGlobalDataE
 __ZN3JSC14JSGlobalObject10globalExecEv
 __ZN3JSC14JSGlobalObject12defineGetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
 __ZN3JSC14JSGlobalObject12defineSetterEPNS_9ExecStateERKNS_10IdentifierEPNS_8JSObjectEj
@@ -165,6 +166,7 @@ __ZN3JSC14SamplingThread4stopEv
 __ZN3JSC14SamplingThread5startEj
 __ZN3JSC14TimeoutChecker10didTimeOutEPNS_9ExecStateE
 __ZN3JSC14TimeoutChecker5resetEv
+__ZN3JSC14heapStatisticsEPNS_12JSGlobalDataE
 __ZN3JSC14throwTypeErrorEPNS_9ExecStateE
 __ZN3JSC15JSWrapperObject12markChildrenERNS_9MarkStackE
 __ZN3JSC15createTypeErrorEPNS_9ExecStateERKNS_7UStringE
@@ -239,6 +241,8 @@ __ZN3JSC6JSLock4lockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock6unlockENS_14JSLockBehaviorE
 __ZN3JSC6JSLock9lockCountEv
 __ZN3JSC6JSLockC1EPNS_9ExecStateE
+__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
+__ZN3JSC6RegExpD1Ev
 __ZN3JSC7JSArray12markChildrenERNS_9MarkStackE
 __ZN3JSC7JSArray15setSubclassDataEPv
 __ZN3JSC7JSArray18getOwnPropertySlotEPNS_9ExecStateEjRNS_12PropertySlotE
@@ -372,6 +376,11 @@ __ZN3WTF12createThreadEPFPvS0_ES0_PKc
 __ZN3WTF12detachThreadEj
 __ZN3WTF12isMainThreadEv
 __ZN3WTF12randomNumberEv
+__ZN3WTF13StringBuilder11reifyStringEv
+__ZN3WTF13StringBuilder11shrinkToFitEv
+__ZN3WTF13StringBuilder6appendEPKcj
+__ZN3WTF13StringBuilder6appendEPKtj
+__ZN3WTF13StringBuilder6resizeEj
 __ZN3WTF13WTFThreadData10staticDataE
 __ZN3WTF13WTFThreadDataC1Ev
 __ZN3WTF13WTFThreadDataD1Ev
@@ -458,7 +467,7 @@ __ZN3WTF6strtodEPKcPPc
 __ZN3WTF7CString11mutableDataEv
 __ZN3WTF7CString16newUninitializedEmRPc
 __ZN3WTF7CStringC1EPKc
-__ZN3WTF7CStringC1EPKcj
+__ZN3WTF7CStringC1EPKcm
 __ZN3WTF7Unicode18convertUTF16ToUTF8EPPKtS2_PPcS4_b
 __ZN3WTF7Unicode18convertUTF8ToUTF16EPPKcS2_PPtS4_b
 __ZN3WTF7xmlAtomE
@@ -484,8 +493,6 @@ __ZNK3JSC10JSFunction23isHostFunctionNonInlineEv
 __ZNK3JSC11Interpreter14retrieveCallerEPNS_9ExecStateEPNS_10JSFunctionE
 __ZNK3JSC11Interpreter18retrieveLastCallerEPNS_9ExecStateERiRlRNS_7UStringERNS_7JSValueE
 __ZNK3JSC12PropertySlot14functionGetterEPNS_9ExecStateE
-__ZN3JSC12RegExpObject4infoE
-__ZN3JSC12RegExpObjectC1EPNS_14JSGlobalObjectEN3WTF17NonNullPassRefPtrINS_9StructureEEENS4_INS_6RegExpEEE
 __ZNK3JSC14JSGlobalObject14isDynamicScopeERb
 __ZNK3JSC16InternalFunction9classInfoEv
 __ZNK3JSC16JSVariableObject16isVariableObjectEv
@@ -516,8 +523,6 @@ __ZNK3JSC6JSCell9getStringEPNS_9ExecStateE
 __ZNK3JSC6JSCell9getStringEPNS_9ExecStateERNS_7UStringE
 __ZNK3JSC6JSCell9getUInt32ERj
 __ZNK3JSC6JSCell9toBooleanEPNS_9ExecStateE
-__ZN3JSC6RegExp6createEPNS_12JSGlobalDataERKNS_7UStringES5_
-__ZN3JSC6RegExpD1Ev
 __ZNK3JSC7ArgList8getSliceEiRS0_
 __ZNK3JSC7JSArray12subclassDataEv
 __ZNK3JSC7JSValue16toObjectSlowCaseEPNS_9ExecStateE
@@ -531,6 +536,7 @@ __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateERKNS_10IdentifierE
 __ZNK3JSC8JSObject11hasPropertyEPNS_9ExecStateEj
 __ZNK3JSC8JSObject12defaultValueEPNS_9ExecStateENS_22PreferredPrimitiveTypeE
 __ZNK3JSC8JSObject12toThisObjectEPNS_9ExecStateE
+__ZNK3JSC8JSObject18toStrictThisObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toNumberEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toObjectEPNS_9ExecStateE
 __ZNK3JSC8JSObject8toStringEPNS_9ExecStateE
@@ -539,7 +545,12 @@ __ZNK3JSC8JSObject9toBooleanEPNS_9ExecStateE
 __ZNK3JSC8JSString11resolveRopeEPNS_9ExecStateE
 __ZNK3JSC9HashTable11createTableEPNS_12JSGlobalDataE
 __ZNK3JSC9HashTable11deleteTableEv
+__ZN3WTF11dtoaRoundSFEPcdiRbRiRj
+__ZN3WTF11dtoaRoundDPEPcdiRbRiRj
+__ZN3WTF4dtoaEPcdRbRiRj
 __ZNK3WTF12AtomicString5lowerEv
+__ZNK3WTF13DecimalNumber15toStringDecimalEPtj
+__ZNK3WTF13DecimalNumber28bufferLengthForStringDecimalEv
 __ZNK3WTF6String11toIntStrictEPbi
 __ZNK3WTF6String12toUIntStrictEPbi
 __ZNK3WTF6String13toInt64StrictEPbi
diff --git a/JavaScriptCore/JavaScriptCore.gypi b/JavaScriptCore/JavaScriptCore.gypi
index 462960d..6252d07 100644
--- a/JavaScriptCore/JavaScriptCore.gypi
+++ b/JavaScriptCore/JavaScriptCore.gypi
@@ -346,6 +346,8 @@
             'runtime/Tracing.h',
             'runtime/UString.cpp',
             'runtime/UString.h',
+            'runtime/UStringBuilder.h',
+            'runtime/UStringConcatenate.h',
             'runtime/WeakRandom.h',
             'wtf/AlwaysInline.h',
             'wtf/ASCIICType.h',
@@ -363,6 +365,7 @@
             'wtf/CurrentTime.h',
             'wtf/DateMath.cpp',
             'wtf/DateMath.h',
+            'wtf/DecimalNumber.cpp',
             'wtf/Deque.h',
             'wtf/DisallowCType.h',
             'wtf/dtoa.cpp',
@@ -422,7 +425,7 @@
             'wtf/StaticConstructors.h',
             'wtf/StdLibExtras.h',
             'wtf/StringExtras.h',
-            'wtf/StringHashFunctions.h',
+            'wtf/StringHasher.h',
             'wtf/TCPackedCache.h',
             'wtf/qt/MainThreadQt.cpp',
             'wtf/qt/StringQt.cpp',
@@ -450,6 +453,10 @@
             'wtf/text/AtomicStringImpl.h',
             'wtf/text/CString.cpp',
             'wtf/text/CString.h',
+            'wtf/text/StringBuffer.h',
+            'wtf/text/StringBuilder.cpp',
+            'wtf/text/StringBuilder.h',
+            'wtf/text/StringConcatenate.h',
             'wtf/text/StringHash.h',
             'wtf/text/StringImpl.cpp',
             'wtf/text/StringImpl.h',
diff --git a/JavaScriptCore/JavaScriptCore.pri b/JavaScriptCore/JavaScriptCore.pri
index 57b1ce8..847576d 100644
--- a/JavaScriptCore/JavaScriptCore.pri
+++ b/JavaScriptCore/JavaScriptCore.pri
@@ -54,6 +54,12 @@ win32-*: DEFINES += _HAS_TR1=0
 
 DEFINES += BUILDING_QT__ BUILDING_JavaScriptCore BUILDING_WTF
 
+# CONFIG += text_breaking_with_icu
+
+contains (CONFIG, text_breaking_with_icu) {
+    DEFINES += WTF_USE_QT_ICU_TEXT_BREAKING=1
+}
+
 wince* {
     INCLUDEPATH += $$QT_SOURCE_TREE/src/3rdparty/ce-compat
     INCLUDEPATH += $$PWD/../JavaScriptCore/os-win32
diff --git a/JavaScriptCore/JavaScriptCore.pro b/JavaScriptCore/JavaScriptCore.pro
index f463f41..f83bf4c 100644
--- a/JavaScriptCore/JavaScriptCore.pro
+++ b/JavaScriptCore/JavaScriptCore.pro
@@ -197,6 +197,7 @@ SOURCES += \
     runtime/RopeImpl.cpp \
     runtime/ScopeChain.cpp \
     runtime/SmallStrings.cpp \
+    runtime/StrictEvalActivation.cpp \
     runtime/StringConstructor.cpp \
     runtime/StringObject.cpp \
     runtime/StringPrototype.cpp \
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
index ba564f0..779b0bc 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.def
@@ -41,7 +41,6 @@ EXPORTS
     ??8JSC@@YA_NABVUString@0@0@Z
     ??8WTF@@YA_NABVCString@0@0@Z
     ?NaN@JSC@@3NB
-    ?utf8@UString@JSC@@QBE?AVCString@WTF@@_N@Z
     ?add@Identifier@JSC@@SA?AV?$PassRefPtr@VStringImpl@WTF@@@WTF@@PAVExecState@2@PBD@Z
     ?add@PropertyNameArray@JSC@@QAEXPAVStringImpl@WTF@@@Z
     ?addBytes@MD5@WTF@@QAEXPBEI@Z
@@ -53,9 +52,12 @@ EXPORTS
     ?allocate@Heap@JSC@@QAEPAXI@Z
     ?allocatePropertyStorage@JSObject@JSC@@QAEXII@Z
     ?allocateStack@MarkStack@JSC@@CAPAXI@Z
+    ?append@StringBuilder@WTF@@QAEXPBDI@Z
+    ?append@StringBuilder@WTF@@QAEXPB_WI@Z
     ?ascii@UString@JSC@@QBE?AVCString@WTF@@XZ
     ?attach@Debugger@JSC@@QAEXPAVJSGlobalObject@2@@Z
     ?broadcast@ThreadCondition@WTF@@QAEXXZ
+    ?bufferLengthForStringDecimal@DecimalNumber@WTF@@QBEIXZ
     ?calculatedFunctionName@DebuggerCallFrame@JSC@@QBE?AVUString@2@XZ
     ?call@JSC@@YA?AVJSValue@1@PAVExecState@1@V21@W4CallType@1@ABTCallData@1@1ABVArgList@1@@Z
     ?callOnMainThread@WTF@@YAXP6AXPAX@Z0@Z
@@ -130,6 +132,7 @@ EXPORTS
     ?detach@Debugger@JSC@@UAEXPAVJSGlobalObject@2@@Z
     ?detachThread@WTF@@YAXI@Z
     ?didTimeOut@TimeoutChecker@JSC@@QAE_NPAVExecState@2@@Z
+    ?dtoa@WTF@@YAXQADNAA_NAAHAAI@Z
     ?dumpSampleData@JSGlobalData@JSC@@QAEXPAVExecState@2@@Z
     ?empty@StringImpl@WTF@@SAPAV12@XZ
     ?enumerable@PropertyDescriptor@JSC@@QBE_NXZ
@@ -149,10 +152,6 @@ EXPORTS
     ?free@WeakGCHandlePool@JSC@@QAEXPAVWeakGCHandle@2@@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@H@Z
     ?from@Identifier@JSC@@SA?AV12@PAVExecState@2@I@Z
-    ?number@UString@JSC@@SA?AV12@H@Z
-    ?number@UString@JSC@@SA?AV12@I@Z
-    ?number@UString@JSC@@SA?AV12@N@Z
-    ?numberToString@WTF@@YAINQA_W@Z
     ?functionGetter@PropertySlot@JSC@@ABE?AVJSValue@2@PAVExecState@2@@Z
     ?functionName@DebuggerCallFrame@JSC@@QBEPBVUString@2@XZ
     ?get@Structure@JSC@@QAEIPBVStringImpl@WTF@@AAIAAPAVJSCell@2@@Z
@@ -193,7 +192,6 @@ EXPORTS
     ?hasTransition@Structure@JSC@@QAE_NPAVStringImpl@WTF@@I@Z
     ?heap@Heap@JSC@@SAPAV12@VJSValue@2@@Z
     ?increment@RefCountedLeakCounter@WTF@@QAEXXZ
-    ?info@RegExpObject@JSC@@2UClassInfo@2@B
     ?init@AtomicString@WTF@@SAXXZ
     ?init@JSGlobalObject@JSC@@AAEXPAVJSObject@2@@Z
     ?initializeMainThread@WTF@@YAXXZ
@@ -230,6 +228,10 @@ EXPORTS
     ?name@JSFunction@JSC@@QAEABVUString@2@PAVExecState@2@@Z
     ?newUninitialized@CString@WTF@@SA?AV12@IAAPAD@Z
     ?nonInlineNaN@JSC@@YANXZ
+    ?number@UString@JSC@@SA?AV12@H@Z
+    ?number@UString@JSC@@SA?AV12@I@Z
+    ?number@UString@JSC@@SA?AV12@N@Z
+    ?numberToString@WTF@@YAINQA_W@Z
     ?objectCount@Heap@JSC@@QBEIXZ
     ?objectProtoFuncToString@JSC@@YI_JPAVExecState@1@@Z
     ?parseDateFromNullTerminatedCharacters@WTF@@YANPBD@Z
@@ -257,10 +259,12 @@ EXPORTS
     ?randomNumber@WTF@@YANXZ
     ?recompileAllJSFunctions@Debugger@JSC@@QAEXPAVJSGlobalData@2@@Z
     ?recordExtraCost@Heap@JSC@@AAEXI@Z
+    ?reifyString@StringBuilder@WTF@@AAEXXZ
     ?releaseStack@MarkStack@JSC@@CAXPAXI@Z
     ?reset@ParserArena@JSC@@QAEXXZ
     ?reset@TimeoutChecker@JSC@@QAEXXZ
     ?resetDateCache@JSGlobalData@JSC@@QAEXXZ
+    ?resize@StringBuilder@WTF@@QAEXI@Z
     ?resolveRope@JSString@JSC@@ABEXPAVExecState@2@@Z
     ?restoreAll@Profile@JSC@@QAEXXZ
     ?retrieveCaller@Interpreter@JSC@@QBE?AVJSValue@2@PAVExecState@2@PAVJSFunction@2@@Z
@@ -280,6 +284,7 @@ EXPORTS
     ?setUpStaticFunctionSlot@JSC@@YAXPAVExecState@1@PBVHashEntry@1@PAVJSObject@1@ABVIdentifier@1@AAVPropertySlot@1@@Z
     ?setWritable@PropertyDescriptor@JSC@@QAEX_N@Z
     ?setter@PropertyDescriptor@JSC@@QBE?AVJSValue@2@XZ
+    ?shrinkToFit@StringBuilder@WTF@@QAEXXZ
     ?signal@ThreadCondition@WTF@@QAEXXZ
     ?size@Heap@JSC@@QBEIXZ
     ?slowAppend@MarkedArgumentBuffer@JSC@@AAEXVJSValue@2@@Z
@@ -315,6 +320,8 @@ EXPORTS
     ?toObjectSlowCase@JSValue@JSC@@ABEPAVJSObject@2@PAVExecState@2@@Z
     ?toPrimitive@JSCell@JSC@@UBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
     ?toPrimitive@JSString@JSC@@EBE?AVJSValue@2@PAVExecState@2@W4PreferredPrimitiveType@2@@Z
+    ?toStrictThisObject@JSObject@JSC@@UBE?AVJSValue@2@PAVExecState@2@@Z
+    ?toStringDecimal@DecimalNumber@WTF@@QBEIPA_WI@Z
     ?toString@JSCell@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSObject@JSC@@UBE?AVUString@2@PAVExecState@2@@Z
     ?toString@JSString@JSC@@EBE?AVUString@2@PAVExecState@2@@Z
@@ -325,6 +332,7 @@ EXPORTS
     ?toUInt32@Identifier@JSC@@SAIABVUString@2@AA_N@Z
     ?tryFastCalloc@WTF@@YA?AUTryMallocReturnValue@1@II@Z
     ?tryFastMalloc@WTF@@YA?AUTryMallocReturnValue@1@I@Z
+    ?tryFastRealloc@WTF@@YA?AUTryMallocReturnValue@1@PAXI@Z
     ?tryLock@Mutex@WTF@@QAE_NXZ
     ?type@DebuggerCallFrame@JSC@@QBE?AW4Type@12@XZ
     ?unlock@JSLock@JSC@@SAXW4JSLockBehavior@2@@Z
@@ -332,6 +340,7 @@ EXPORTS
     ?unlockAtomicallyInitializedStaticMutex@WTF@@YAXXZ
     ?unprotect@Heap@JSC@@QAE_NVJSValue@2@@Z
     ?unwrappedObject@JSObject@JSC@@UAEPAV12@XZ
+    ?utf8@UString@JSC@@QBE?AVCString@WTF@@_N@Z
     ?wait@ThreadCondition@WTF@@QAEXAAVMutex@2@@Z
     ?waitForThreadCompletion@WTF@@YAHIPAPAX@Z
     ?writable@PropertyDescriptor@JSC@@QBE_NXZ
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
index 83d34e3..4823286 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCore.vcproj
@@ -1173,6 +1173,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\StrictEvalActivation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\StrictEvalActivation.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\StringConstructor.cpp"

 				>

 			</File>

@@ -1245,6 +1253,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\..\runtime\UStringBuilder.h"

+				>

+			</File>

+			<File

+				RelativePath="..\..\runtime\UStringConcatenate.h"

+				>

+			</File>

+			<File

 				RelativePath="..\..\runtime\UStringImpl.h"

 				>

 			</File>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
index c92196e..6929c8a 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreCommon.vsprops
@@ -19,7 +19,7 @@
 	/>

 	<Tool

 		Name="VCPostBuildEventTool"

-		CommandLine="mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\text\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\unicode\icu\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\parser\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\runtime\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\VM\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\bytecode\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\interpreter\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\assembler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\jit\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\debugger\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\profiler\*.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\create_hash_table&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\pcre\pcre.h&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\text\AtomicString.cpp&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\text\StringImpl.cpp&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\..\wtf\text\WTFString.cpp&quot; &quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;&#x0D;&#x0A;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(OutDir)\JavaScriptCore.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)..\$(ProjectName).resources\*&quot; &quot;$(OutDir)\$(ProjectName).resources&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 	/>

 	<Tool

 		Name="VCPreBuildEventTool"

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
index 098ff08..d1e5d46 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
+++ b/JavaScriptCore/JavaScriptCore.vcproj/JavaScriptCore/JavaScriptCoreGenerated.make
@@ -21,6 +21,32 @@ all:
     xcopy /y /d "..\..\API\JSRetainPtr.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\OpaqueJSString.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
     xcopy /y /d "..\..\API\WebKitAvailability.h" "$(WEBKITOUTPUTDIR)\include\JavaScriptCore"
+    
+    -mkdir 2>NUL "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+
+    xcopy /y /d "..\..\wtf\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\unicode\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\unicode\icu\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\parser\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\runtime\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\bytecode\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\interpreter\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\assembler\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\jit\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\debugger\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\profiler\*.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\create_hash_table" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\pcre\pcre.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\AtomicString.cpp" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\StringBuilder.cpp" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\StringImpl.cpp" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    xcopy /y /d "..\..\wtf\text\WTFString.cpp" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+
+
+    -mkdir 2>NUL "$(WEBKITOUTPUTDIR)\bin\JavaScriptCore.resources"
+    xcopy /y /d "..\JavaScriptCore.resources\*" "$(WEBKITOUTPUTDIR)\bin\JavaScriptCore.resources"
+    
     -del "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore\stdbool.h" "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore\stdint.h"
     -del "$(WEBKITOUTPUTDIR)\buildfailed"
 
@@ -28,3 +54,5 @@ clean:
     -del "$(WEBKITOUTPUTDIR)\buildfailed"
     -del /s /q "$(WEBKITOUTPUTDIR)\include\JavaScriptCore\JavaScriptCore"
     -del /s /q "$(WEBKITOUTPUTDIR)\obj\JavaScriptCore\DerivedSources"
+    -del /s /q "$(WEBKITOUTPUTDIR)\include\private\JavaScriptCore"
+    -del /s /q "$(WEBKITOUTPUTDIR)\bin\JavaScriptCore.resources"
diff --git a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
index 42a91eb..3a53070 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/WTF/WTF.vcproj
@@ -309,6 +309,14 @@
 			>

 		</File>

 		<File

+			RelativePath="..\..\wtf\DecimalNumber.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\..\wtf\DecimalNumber.h"

+			>

+		</File>

+		<File

 			RelativePath="..\..\wtf\FastAllocBase.h"

 			>

 		</File>

@@ -609,6 +617,22 @@
  			>

  		</File>

  		<File

+ 			RelativePath="..\..\wtf\text\StringBuffer.h"

+ 			>

+ 		</File>

+ 		<File

+ 			RelativePath="..\..\wtf\text\StringBuilder.cpp"

+ 			>

+ 		</File>

+ 		<File

+ 			RelativePath="..\..\wtf\text\StringBuilder.h"

+ 			>

+ 		</File>

+ 		<File

+ 			RelativePath="..\..\wtf\text\StringConcatenate.h"

+ 			>

+ 		</File>

+ 		<File

  			RelativePath="..\..\wtf\text\StringHash.h"

  			>

  		</File>

@@ -620,6 +644,10 @@
  			RelativePath="..\..\wtf\text\StringImpl.h"

  			>

  		</File>

+ 		<File

+ 			RelativePath="..\..\wtf\text\TextPosition.h"

+ 			>

+ 		</File>

 		<File

  			RelativePath="..\..\wtf\text\WTFString.cpp"

  			>

diff --git a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
index 0f3e145..029a4b0 100644
--- a/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
+++ b/JavaScriptCore/JavaScriptCore.vcproj/jsc/jsc.vcproj
@@ -334,6 +334,10 @@
 			>

 		</File>

 		<File

+			RelativePath="$(WebKitOutputDir)\include\private\JavaScriptCore\StringBuilder.cpp"

+			>

+		</File>

+		<File

 			RelativePath="$(WebKitOutputDir)\include\private\JavaScriptCore\StringImpl.cpp"

 			>

 		</File>

diff --git a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
index 675d26d..d134a73 100644
--- a/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
+++ b/JavaScriptCore/JavaScriptCore.xcodeproj/project.pbxproj
@@ -36,14 +36,18 @@
 /* Begin PBXBuildFile section */
 		06D358B30DAADAA4003B174E /* MainThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 06D358A20DAAD9C4003B174E /* MainThread.cpp */; };
 		06D358B40DAADAAA003B174E /* MainThreadMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 06D358A10DAAD9C4003B174E /* MainThreadMac.mm */; };
+		081469491264378500DFF935 /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 081469481264375E00DFF935 /* StringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		088FA5BB0EF76D4300578E6F /* RandomNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 088FA5B90EF76D4300578E6F /* RandomNumber.cpp */; };
 		088FA5BC0EF76D4300578E6F /* RandomNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 088FA5BA0EF76D4300578E6F /* RandomNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		08CABBA61265AB3900B206CE /* StringConcatenate.h in Headers */ = {isa = PBXBuildFile; fileRef = 0896C29E1265AB0900B1CDD3 /* StringConcatenate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		08DDA5C11264631700751732 /* UStringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 08DDA5BB12645F1D00751732 /* UStringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		08E279E90EF83B10007DB523 /* RandomNumberSeed.h in Headers */ = {isa = PBXBuildFile; fileRef = 08E279E80EF83B10007DB523 /* RandomNumberSeed.h */; };
 		0B330C270F38C62300692DE3 /* TypeTraits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0B330C260F38C62300692DE3 /* TypeTraits.cpp */; };
 		0B4D7E630F319AC800AD7E58 /* TypeTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 0B4D7E620F319AC800AD7E58 /* TypeTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BDFFAE00FC6192900D69EF4 /* CrossThreadRefCounted.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BDFFAE10FC6193100D69EF4 /* OwnFastMallocPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0BF28A2911A33DC300638F84 /* SizeLimits.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0BF28A2811A33DC300638F84 /* SizeLimits.cpp */; };
+		0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */; };
 		14035DB110DBFB2A00FFFFE7 /* WeakGCPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		140566C4107EC255005DBC8D /* JSAPIValueWrapper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC0894D50FAFBA2D00001865 /* JSAPIValueWrapper.cpp */; };
 		140566D1107EC267005DBC8D /* JSStaticScopeObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7E42C190E3938830065A544 /* JSStaticScopeObject.cpp */; };
@@ -182,7 +186,7 @@
 		5D53726F0E1C54880021E549 /* Tracing.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D53726E0E1C54880021E549 /* Tracing.h */; };
 		5D5D8AB60E0D0A7200F9C692 /* jsc in Copy Into Framework */ = {isa = PBXBuildFile; fileRef = 932F5BE10822A1C700736975 /* jsc */; };
 		5D5D8AD10E0D0EBE00F9C692 /* libedit.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */; };
-		5D63E9AD10F2BD6E00FC8AE9 /* StringHashFunctions.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D63E9AC10F2BD6E00FC8AE9 /* StringHashFunctions.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		5D63E9AD10F2BD6E00FC8AE9 /* StringHasher.h in Headers */ = {isa = PBXBuildFile; fileRef = 5D63E9AC10F2BD6E00FC8AE9 /* StringHasher.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		5D6A566B0F05995500266145 /* Threading.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 5D6A566A0F05995500266145 /* Threading.cpp */; };
 		5DE6E5B30E1728EC00180407 /* create_hash_table in Headers */ = {isa = PBXBuildFile; fileRef = F692A8540255597D01FF60F7 /* create_hash_table */; settings = {ATTRIBUTES = (); }; };
 		6507D29E0E871E5E00D7D896 /* JSTypeInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 6507D2970E871E4A00D7D896 /* JSTypeInfo.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -201,8 +205,9 @@
 		8626BECF11928E3900782FAB /* StringStatics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8626BECE11928E3900782FAB /* StringStatics.cpp */; };
 		8627E5EB11F1281900A313B5 /* PageAllocation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8627E5E911F1281900A313B5 /* PageAllocation.cpp */; };
 		8627E5EC11F1281900A313B5 /* PageAllocation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8627E5EA11F1281900A313B5 /* PageAllocation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		862AF4B612239C7B0024E5B8 /* DecimalNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 862AF4B512239C7B0024E5B8 /* DecimalNumber.h */; };
+		862AF4B612239C7B0024E5B8 /* DecimalNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 862AF4B512239C7B0024E5B8 /* DecimalNumber.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		863B23E00FC6118900703AA4 /* MacroAssemblerCodeRef.h in Headers */ = {isa = PBXBuildFile; fileRef = 863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86438FC31265503E00E0DFCA /* StringBuilder.cpp */; };
 		86565742115BE3DA00291F40 /* CString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86565740115BE3DA00291F40 /* CString.cpp */; };
 		86565743115BE3DA00291F40 /* CString.h in Headers */ = {isa = PBXBuildFile; fileRef = 86565741115BE3DA00291F40 /* CString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		865F408810E7D56300947361 /* APIShims.h in Headers */ = {isa = PBXBuildFile; fileRef = 865F408710E7D56300947361 /* APIShims.h */; };
@@ -217,13 +222,11 @@
 		868BFA18117CF19900B908B1 /* WTFString.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA16117CF19900B908B1 /* WTFString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */ = {isa = PBXBuildFile; fileRef = 868BFA5F117D048200B908B1 /* StaticConstructors.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		8690231512092D5C00630AF9 /* PageReservation.h in Headers */ = {isa = PBXBuildFile; fileRef = 8690231412092D5C00630AF9 /* PageReservation.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		8698B86910D44D9400D8D01B /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 8698B86810D44D9400D8D01B /* StringBuilder.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869D04AF1193B54D00803475 /* CachedTranscendentalFunction.h in Headers */ = {isa = PBXBuildFile; fileRef = 869D04AE1193B54D00803475 /* CachedTranscendentalFunction.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		869EBCB70E8C6D4A008722CC /* ResultType.h in Headers */ = {isa = PBXBuildFile; fileRef = 869EBCB60E8C6D4A008722CC /* ResultType.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86A90ED00EE7D51F00AB350D /* JITArithmetic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */; };
 		86ADD1450FDDEA980006EEC2 /* ARMv7Assembler.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */; };
 		86ADD1460FDDEA980006EEC2 /* MacroAssemblerARMv7.h in Headers */ = {isa = PBXBuildFile; fileRef = 86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */; };
-		86B6DA0212132B9A000D316F /* StringConcatenate.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B6DA0112132B9A000D316F /* StringConcatenate.h */; };
 		86B99AB8117E391E00DF5A90 /* RopeImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 86B99AB6117E391E00DF5A90 /* RopeImpl.cpp */; };
 		86B99AB9117E391E00DF5A90 /* RopeImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B99AB7117E391E00DF5A90 /* RopeImpl.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 86B99AE1117E578100DF5A90 /* StringBuffer.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -275,6 +278,7 @@
 		932F5BEA0822A1C700736975 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 932F5BD90822A1C700736975 /* JavaScriptCore.framework */; };
 		933040040E6A749400786E6A /* SmallStrings.h in Headers */ = {isa = PBXBuildFile; fileRef = 93303FEA0E6A72C000786E6A /* SmallStrings.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		9330402C0E6A764000786E6A /* SmallStrings.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93303FE80E6A72B500786E6A /* SmallStrings.cpp */; };
+		933F5CDC1269229B0049191E /* NullPtr.h in Headers */ = {isa = PBXBuildFile; fileRef = 933F5CDB126922690049191E /* NullPtr.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		937013480CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */; settings = {COMPILER_FLAGS = "-Wno-sign-compare"; }; };
 		93E26BD408B1514100F85226 /* pcre_xclass.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E26BD308B1514100F85226 /* pcre_xclass.cpp */; };
 		9534AAFB0E5B7A9600B8A45B /* JSProfilerPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = 952C63AC0E4777D600C13936 /* JSProfilerPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -310,6 +314,8 @@
 		9714AF5F122F32070092D9F5 /* ParsedURL.h in Headers */ = {isa = PBXBuildFile; fileRef = 9714AF58122F31F50092D9F5 /* ParsedURL.h */; };
 		9714AF60122F32070092D9F5 /* URLString.h in Headers */ = {isa = PBXBuildFile; fileRef = 9714AF59122F31F50092D9F5 /* URLString.h */; };
 		971EDEA61169E0D3005E4262 /* Terminator.h in Headers */ = {isa = PBXBuildFile; fileRef = 97F6903A1169DF7F00A6BB46 /* Terminator.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		972A485F12661E0800F4514F /* URLCharacterTypes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A485D12661E0800F4514F /* URLCharacterTypes.cpp */; };
+		972A48771266256F00F4514F /* URLEscape.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 972A48741266256F00F4514F /* URLEscape.cpp */; };
 		A1712B3B11C7B212007A5315 /* RegExpCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A1712B3A11C7B212007A5315 /* RegExpCache.cpp */; };
 		A1712B3F11C7B228007A5315 /* RegExpCache.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B3E11C7B228007A5315 /* RegExpCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A1712B4111C7B235007A5315 /* RegExpKey.h in Headers */ = {isa = PBXBuildFile; fileRef = A1712B4011C7B235007A5315 /* RegExpKey.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -318,6 +324,8 @@
 		A72701B90DADE94900E548D7 /* ExceptionHelpers.h in Headers */ = {isa = PBXBuildFile; fileRef = A72701B30DADE94900E548D7 /* ExceptionHelpers.h */; };
 		A727FF6B0DA3092200E548D7 /* JSPropertyNameIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */; };
 		A7280A2811557E3000D56957 /* JSObjectRefPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = A79EDB0811531CD60019E912 /* JSObjectRefPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */ = {isa = PBXBuildFile; fileRef = A730B6101250068F009D25B1 /* StrictEvalActivation.h */; };
+		A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */; };
 		A7386554118697B400540279 /* SpecializedThunkJIT.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386551118697B400540279 /* SpecializedThunkJIT.h */; };
 		A7386555118697B400540279 /* ThunkGenerators.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A7386552118697B400540279 /* ThunkGenerators.cpp */; };
 		A7386556118697B400540279 /* ThunkGenerators.h in Headers */ = {isa = PBXBuildFile; fileRef = A7386553118697B400540279 /* ThunkGenerators.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -627,14 +635,19 @@
 		06D358A10DAAD9C4003B174E /* MainThreadMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = MainThreadMac.mm; sourceTree = "<group>"; };
 		06D358A20DAAD9C4003B174E /* MainThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MainThread.cpp; sourceTree = "<group>"; };
 		06D358A30DAAD9C4003B174E /* MainThread.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MainThread.h; sourceTree = "<group>"; };
+		081469481264375E00DFF935 /* StringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StringBuilder.h; path = text/StringBuilder.h; sourceTree = "<group>"; };
 		088FA5B90EF76D4300578E6F /* RandomNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RandomNumber.cpp; sourceTree = "<group>"; };
 		088FA5BA0EF76D4300578E6F /* RandomNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RandomNumber.h; sourceTree = "<group>"; };
+		0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringConcatenate.h; sourceTree = "<group>"; };
+		0896C29E1265AB0900B1CDD3 /* StringConcatenate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StringConcatenate.h; path = text/StringConcatenate.h; sourceTree = "<group>"; };
+		08DDA5BB12645F1D00751732 /* UStringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UStringBuilder.h; sourceTree = "<group>"; };
 		08E279E80EF83B10007DB523 /* RandomNumberSeed.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RandomNumberSeed.h; sourceTree = "<group>"; };
 		0B330C260F38C62300692DE3 /* TypeTraits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = TypeTraits.cpp; sourceTree = "<group>"; };
 		0B4D7E620F319AC800AD7E58 /* TypeTraits.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TypeTraits.h; sourceTree = "<group>"; };
 		0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OwnFastMallocPtr.h; sourceTree = "<group>"; };
 		0BDFFAD40FC6171000D69EF4 /* CrossThreadRefCounted.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CrossThreadRefCounted.h; sourceTree = "<group>"; };
 		0BF28A2811A33DC300638F84 /* SizeLimits.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SizeLimits.cpp; sourceTree = "<group>"; };
+		0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DecimalNumber.cpp; sourceTree = "<group>"; };
 		14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WeakGCPtr.h; sourceTree = "<group>"; };
 		140D17D60E8AD4A9000CD17D /* JSBasePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSBasePrivate.h; sourceTree = "<group>"; };
 		141211020A48780900480255 /* minidom.c */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.c; name = minidom.c; path = tests/minidom.c; sourceTree = "<group>"; };
@@ -741,7 +754,7 @@
 		5D53726E0E1C54880021E549 /* Tracing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Tracing.h; sourceTree = "<group>"; };
 		5D53727D0E1C55EC0021E549 /* TracingDtrace.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TracingDtrace.h; sourceTree = "<group>"; };
 		5D5D8AD00E0D0EBE00F9C692 /* libedit.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libedit.dylib; path = /usr/lib/libedit.dylib; sourceTree = "<absolute>"; };
-		5D63E9AC10F2BD6E00FC8AE9 /* StringHashFunctions.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringHashFunctions.h; sourceTree = "<group>"; };
+		5D63E9AC10F2BD6E00FC8AE9 /* StringHasher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringHasher.h; sourceTree = "<group>"; };
 		5D6A566A0F05995500266145 /* Threading.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Threading.cpp; sourceTree = "<group>"; };
 		5DA479650CFBCF56009328A0 /* TCPackedCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TCPackedCache.h; sourceTree = "<group>"; };
 		5DBD18AF0C5401A700C15EAE /* MallocZoneSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MallocZoneSupport.h; sourceTree = "<group>"; };
@@ -803,6 +816,7 @@
 		8627E5EA11F1281900A313B5 /* PageAllocation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageAllocation.h; sourceTree = "<group>"; };
 		862AF4B512239C7B0024E5B8 /* DecimalNumber.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DecimalNumber.h; sourceTree = "<group>"; };
 		863B23DF0FC60E6200703AA4 /* MacroAssemblerCodeRef.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerCodeRef.h; sourceTree = "<group>"; };
+		86438FC31265503E00E0DFCA /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = StringBuilder.cpp; path = text/StringBuilder.cpp; sourceTree = "<group>"; };
 		86565740115BE3DA00291F40 /* CString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CString.cpp; path = text/CString.cpp; sourceTree = "<group>"; };
 		86565741115BE3DA00291F40 /* CString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CString.h; path = text/CString.h; sourceTree = "<group>"; };
 		865F408710E7D56300947361 /* APIShims.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = APIShims.h; sourceTree = "<group>"; };
@@ -820,13 +834,11 @@
 		868BFA16117CF19900B908B1 /* WTFString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WTFString.h; path = text/WTFString.h; sourceTree = "<group>"; };
 		868BFA5F117D048200B908B1 /* StaticConstructors.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StaticConstructors.h; sourceTree = "<group>"; };
 		8690231412092D5C00630AF9 /* PageReservation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PageReservation.h; sourceTree = "<group>"; };
-		8698B86810D44D9400D8D01B /* StringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuilder.h; sourceTree = "<group>"; };
 		869D04AE1193B54D00803475 /* CachedTranscendentalFunction.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedTranscendentalFunction.h; sourceTree = "<group>"; };
 		869EBCB60E8C6D4A008722CC /* ResultType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResultType.h; sourceTree = "<group>"; };
 		86A90ECF0EE7D51F00AB350D /* JITArithmetic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JITArithmetic.cpp; sourceTree = "<group>"; };
 		86ADD1430FDDEA980006EEC2 /* ARMv7Assembler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ARMv7Assembler.h; sourceTree = "<group>"; };
 		86ADD1440FDDEA980006EEC2 /* MacroAssemblerARMv7.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MacroAssemblerARMv7.h; sourceTree = "<group>"; };
-		86B6DA0112132B9A000D316F /* StringConcatenate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringConcatenate.h; sourceTree = "<group>"; };
 		86B99AB6117E391E00DF5A90 /* RopeImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RopeImpl.cpp; sourceTree = "<group>"; };
 		86B99AB7117E391E00DF5A90 /* RopeImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RopeImpl.h; sourceTree = "<group>"; };
 		86B99AE1117E578100DF5A90 /* StringBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = StringBuffer.h; path = text/StringBuffer.h; sourceTree = "<group>"; };
@@ -882,6 +894,7 @@
 		93303FEA0E6A72C000786E6A /* SmallStrings.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SmallStrings.h; sourceTree = "<group>"; };
 		933A349A038AE7C6008635CE /* Identifier.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Identifier.h; sourceTree = "<group>"; tabWidth = 8; };
 		933A349D038AE80F008635CE /* Identifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Identifier.cpp; sourceTree = "<group>"; tabWidth = 8; };
+		933F5CDB126922690049191E /* NullPtr.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NullPtr.h; sourceTree = "<group>"; };
 		935AF46909E9D9DB00ACD1D8 /* Forward.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Forward.h; sourceTree = "<group>"; };
 		935AF46B09E9D9DB00ACD1D8 /* UnusedParam.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = UnusedParam.h; sourceTree = "<group>"; };
 		937013470CA97E0E00FA14D3 /* pcre_ucp_searchfuncs.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = pcre_ucp_searchfuncs.cpp; sourceTree = "<group>"; };
@@ -939,6 +952,11 @@
 		9714AF57122F31F50092D9F5 /* ParsedURL.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = ParsedURL.cpp; path = url/api/ParsedURL.cpp; sourceTree = "<group>"; };
 		9714AF58122F31F50092D9F5 /* ParsedURL.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = ParsedURL.h; path = url/api/ParsedURL.h; sourceTree = "<group>"; };
 		9714AF59122F31F50092D9F5 /* URLString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLString.h; path = url/api/URLString.h; sourceTree = "<group>"; };
+		972A485D12661E0800F4514F /* URLCharacterTypes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = URLCharacterTypes.cpp; path = url/src/URLCharacterTypes.cpp; sourceTree = "<group>"; };
+		972A485E12661E0800F4514F /* URLCharacterTypes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLCharacterTypes.h; path = url/src/URLCharacterTypes.h; sourceTree = "<group>"; };
+		972A48741266256F00F4514F /* URLEscape.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = URLEscape.cpp; path = url/src/URLEscape.cpp; sourceTree = "<group>"; };
+		972A48751266256F00F4514F /* URLEscape.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLEscape.h; path = url/src/URLEscape.h; sourceTree = "<group>"; };
+		972A48761266256F00F4514F /* URLQueryCanonicalizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = URLQueryCanonicalizer.h; path = url/src/URLQueryCanonicalizer.h; sourceTree = "<group>"; };
 		97F6903A1169DF7F00A6BB46 /* Terminator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Terminator.h; sourceTree = "<group>"; };
 		A1712B3A11C7B212007A5315 /* RegExpCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RegExpCache.cpp; sourceTree = "<group>"; };
 		A1712B3E11C7B228007A5315 /* RegExpCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RegExpCache.h; sourceTree = "<group>"; };
@@ -951,6 +969,8 @@
 		A72701B30DADE94900E548D7 /* ExceptionHelpers.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ExceptionHelpers.h; sourceTree = "<group>"; };
 		A727FF650DA3053B00E548D7 /* JSPropertyNameIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSPropertyNameIterator.h; sourceTree = "<group>"; };
 		A727FF660DA3053B00E548D7 /* JSPropertyNameIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSPropertyNameIterator.cpp; sourceTree = "<group>"; };
+		A730B6101250068F009D25B1 /* StrictEvalActivation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StrictEvalActivation.h; sourceTree = "<group>"; };
+		A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StrictEvalActivation.cpp; sourceTree = "<group>"; };
 		A7386551118697B400540279 /* SpecializedThunkJIT.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SpecializedThunkJIT.h; sourceTree = "<group>"; };
 		A7386552118697B400540279 /* ThunkGenerators.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ThunkGenerators.cpp; sourceTree = "<group>"; };
 		A7386553118697B400540279 /* ThunkGenerators.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ThunkGenerators.h; sourceTree = "<group>"; };
@@ -1470,6 +1490,7 @@
 				41359CF40FDD89CB00206180 /* DateMath.cpp */,
 				41359CF50FDD89CB00206180 /* DateMath.h */,
 				862AF4B512239C7B0024E5B8 /* DecimalNumber.h */,
+				0F29479B126E698C00B3ABF5 /* DecimalNumber.cpp */,
 				5186111D0CC824830081412B /* Deque.h */,
 				938C4F6B0CA06BCE00D9310A /* DisallowCType.h */,
 				651F6412039D5B5F0078395C /* dtoa.cpp */,
@@ -1501,6 +1522,7 @@
 				65E1A2F4122B880D00B26097 /* NonCopyingSort.h */,
 				9303F5690991190000AD71B8 /* Noncopyable.h */,
 				C0A2723F0E509F1E00E96E15 /* NotFound.h */,
+				933F5CDB126922690049191E /* NullPtr.h */,
 				9303F5A409911A5800AD71B8 /* OwnArrayPtr.h */,
 				BCFBE697122561D200309E9D /* OwnArrayPtrCommon.h */,
 				0BDFFAD10FC616EC00D69EF4 /* OwnFastMallocPtr.h */,
@@ -1528,7 +1550,7 @@
 				868BFA5F117D048200B908B1 /* StaticConstructors.h */,
 				FE1B44790ECCD73B004F4DD1 /* StdLibExtras.h */,
 				E11D51750B2E798D0056C188 /* StringExtras.h */,
-				5D63E9AC10F2BD6E00FC8AE9 /* StringHashFunctions.h */,
+				5D63E9AC10F2BD6E00FC8AE9 /* StringHasher.h */,
 				5DA479650CFBCF56009328A0 /* TCPackedCache.h */,
 				6541BD6E08E80A17002CBEE7 /* TCPageMap.h */,
 				6541BD6F08E80A17002CBEE7 /* TCSpinLock.h */,
@@ -1789,8 +1811,6 @@
 				7E2C6C980D31C6B6002D44E2 /* ScopeChainMark.h */,
 				93303FE80E6A72B500786E6A /* SmallStrings.cpp */,
 				93303FEA0E6A72C000786E6A /* SmallStrings.h */,
-				8698B86810D44D9400D8D01B /* StringBuilder.h */,
-				86B6DA0112132B9A000D316F /* StringConcatenate.h */,
 				BC18C3C00E16EE3300B34460 /* StringConstructor.cpp */,
 				BC18C3C10E16EE3300B34460 /* StringConstructor.h */,
 				BC18C3C20E16EE3300B34460 /* StringObject.cpp */,
@@ -1811,9 +1831,13 @@
 				5D53726E0E1C54880021E549 /* Tracing.h */,
 				F692A8850255597D01FF60F7 /* UString.cpp */,
 				F692A8860255597D01FF60F7 /* UString.h */,
+				08DDA5BB12645F1D00751732 /* UStringBuilder.h */,
+				0896C29B1265AAF600B1CDD3 /* UStringConcatenate.h */,
 				14BFCE6810CDB1FC00364CCE /* WeakGCMap.h */,
 				14035DB010DBFB2A00FFFFE7 /* WeakGCPtr.h */,
 				1420BE7A10AA6DDB00F455D2 /* WeakRandom.h */,
+				A730B6101250068F009D25B1 /* StrictEvalActivation.h */,
+				A730B6111250068F009D25B1 /* StrictEvalActivation.cpp */,
 			);
 			path = runtime;
 			sourceTree = "<group>";
@@ -1828,6 +1852,9 @@
 				86565740115BE3DA00291F40 /* CString.cpp */,
 				86565741115BE3DA00291F40 /* CString.h */,
 				86B99AE1117E578100DF5A90 /* StringBuffer.h */,
+				86438FC31265503E00E0DFCA /* StringBuilder.cpp */,
+				081469481264375E00DFF935 /* StringBuilder.h */,
+				0896C29E1265AB0900B1CDD3 /* StringConcatenate.h */,
 				868BFA05117CEFD100B908B1 /* StringHash.h */,
 				868BFA06117CEFD100B908B1 /* StringImpl.cpp */,
 				868BFA07117CEFD100B908B1 /* StringImpl.h */,
@@ -1944,8 +1971,13 @@
 			children = (
 				9714AF31122F27E70092D9F5 /* RawURLBuffer.h */,
 				9714AF32122F27E70092D9F5 /* URLBuffer.h */,
+				972A485D12661E0800F4514F /* URLCharacterTypes.cpp */,
+				972A485E12661E0800F4514F /* URLCharacterTypes.h */,
 				9714AF33122F27E70092D9F5 /* URLComponent.h */,
+				972A48741266256F00F4514F /* URLEscape.cpp */,
+				972A48751266256F00F4514F /* URLEscape.h */,
 				9714AF34122F27E70092D9F5 /* URLParser.h */,
+				972A48761266256F00F4514F /* URLQueryCanonicalizer.h */,
 				9714AF35122F27E70092D9F5 /* URLSegments.cpp */,
 				9714AF36122F27E70092D9F5 /* URLSegments.h */,
 			);
@@ -2250,11 +2282,12 @@
 				868BFA60117D048200B908B1 /* StaticConstructors.h in Headers */,
 				FE1B447A0ECCD73B004F4DD1 /* StdLibExtras.h in Headers */,
 				86B99AE3117E578100DF5A90 /* StringBuffer.h in Headers */,
-				8698B86910D44D9400D8D01B /* StringBuilder.h in Headers */,
+				081469491264378500DFF935 /* StringBuilder.h in Headers */,
+				08CABBA61265AB3900B206CE /* StringConcatenate.h in Headers */,
 				BC18C4660E16F5CD00B34460 /* StringConstructor.h in Headers */,
 				BC18C4670E16F5CD00B34460 /* StringExtras.h in Headers */,
 				868BFA0D117CEFD100B908B1 /* StringHash.h in Headers */,
-				5D63E9AD10F2BD6E00FC8AE9 /* StringHashFunctions.h in Headers */,
+				5D63E9AD10F2BD6E00FC8AE9 /* StringHasher.h in Headers */,
 				868BFA0F117CEFD100B908B1 /* StringImpl.h in Headers */,
 				86B99AE4117E578100DF5A90 /* StringImplBase.h in Headers */,
 				BC18C4680E16F5CD00B34460 /* StringObject.h in Headers */,
@@ -2286,6 +2319,7 @@
 				BC18C4740E16F5CD00B34460 /* UnicodeIcu.h in Headers */,
 				BC18C4750E16F5CD00B34460 /* UnusedParam.h in Headers */,
 				BC18C4760E16F5CD00B34460 /* UString.h in Headers */,
+				08DDA5C11264631700751732 /* UStringBuilder.h in Headers */,
 				BC18C4770E16F5CD00B34460 /* UTF8.h in Headers */,
 				E17FF771112131D200076A19 /* ValueCheck.h in Headers */,
 				BC18C4780E16F5CD00B34460 /* Vector.h in Headers */,
@@ -2302,7 +2336,6 @@
 				DD2724691208D1FF00F9ABE7 /* AlignedMemoryAllocator.h in Headers */,
 				DDE82AD81209D955005C1756 /* GCHandle.h in Headers */,
 				86F38859121130CA007A7CE3 /* AtomicStringHash.h in Headers */,
-				86B6DA0212132B9A000D316F /* StringConcatenate.h in Headers */,
 				862AF4B612239C7B0024E5B8 /* DecimalNumber.h in Headers */,
 				BCFBE696122560E800309E9D /* PassOwnArrayPtr.h in Headers */,
 				BCFBE698122561D200309E9D /* OwnArrayPtrCommon.h in Headers */,
@@ -2314,6 +2347,8 @@
 				9714AF5F122F32070092D9F5 /* ParsedURL.h in Headers */,
 				9714AF60122F32070092D9F5 /* URLString.h in Headers */,
 				90213E3E123A40C200D422F3 /* MemoryStatistics.h in Headers */,
+				A730B6121250068F009D25B1 /* StrictEvalActivation.h in Headers */,
+				933F5CDC1269229B0049191E /* NullPtr.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2407,6 +2442,7 @@
 			isa = PBXProject;
 			buildConfigurationList = 149C277108902AFE008A9EFC /* Build configuration list for PBXProject "JavaScriptCore" */;
 			compatibilityVersion = "Xcode 2.4";
+			developmentRegion = English;
 			hasScannedForEncodings = 1;
 			knownRegions = (
 				English,
@@ -2768,6 +2804,9 @@
 				9714AF46122F28850092D9F5 /* URLSegments.cpp in Sources */,
 				9714AF5E122F32070092D9F5 /* ParsedURL.cpp in Sources */,
 				90213E3D123A40C200D422F3 /* MemoryStatistics.cpp in Sources */,
+				A730B6131250068F009D25B1 /* StrictEvalActivation.cpp in Sources */,
+				86438FC41265503E00E0DFCA /* StringBuilder.cpp in Sources */,
+				0F29479C126E698C00B3ABF5 /* DecimalNumber.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -2777,6 +2816,8 @@
 			files = (
 				932F5BDD0822A1C700736975 /* jsc.cpp in Sources */,
 				DDE82AD31209D955005C1756 /* GCHandle.cpp in Sources */,
+				972A485F12661E0800F4514F /* URLCharacterTypes.cpp in Sources */,
+				972A48771266256F00F4514F /* URLEscape.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.cpp b/JavaScriptCore/assembler/ARMv7Assembler.cpp
index 233a6f1..7aa1f10 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.cpp
+++ b/JavaScriptCore/assembler/ARMv7Assembler.cpp
@@ -31,7 +31,10 @@
 
 namespace JSC {
 
-const int ARMv7Assembler::JumpSizes[] = { 0xffffffff, 2 * sizeof(uint16_t), 2 * sizeof(uint16_t), 5 * sizeof(uint16_t) };
+const int ARMv7Assembler::JumpSizes[] = { 0xffffffff, sizeof(uint16_t), sizeof(uint16_t),
+    2 * sizeof(uint16_t), 2 * sizeof(uint16_t), 3 * sizeof(uint16_t), 5 * sizeof(uint16_t), 6 * sizeof(uint16_t) };
+const int ARMv7Assembler::JumpPaddingSizes[] = { 0, 5 * sizeof(uint16_t), 6 * sizeof(uint16_t),
+    5 * sizeof(uint16_t), 6 * sizeof(uint16_t) };
 
 }
 
diff --git a/JavaScriptCore/assembler/ARMv7Assembler.h b/JavaScriptCore/assembler/ARMv7Assembler.h
index d960546..37b650b 100644
--- a/JavaScriptCore/assembler/ARMv7Assembler.h
+++ b/JavaScriptCore/assembler/ARMv7Assembler.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
@@ -440,7 +440,7 @@ private:
         };
         struct {
             unsigned type   : 2;
-            unsigned amount : 5;
+            unsigned amount : 6;
         };
     } m_u;
 };
@@ -478,10 +478,11 @@ public:
         ConditionInvalid
     } Condition;
 
-    enum JumpType { JumpNoCondition, JumpCondition, JumpFullSize };
-    enum JumpLinkType { LinkInvalid, LinkShortJump, LinkConditionalShortJump, LinkLongJump, JumpTypeCount };
-    static const int JumpSizes[JumpTypeCount];
-    enum { JumpPaddingSize = 5 * sizeof(uint16_t) };
+    enum JumpType { JumpFixed, JumpNoCondition, JumpCondition, JumpNoConditionFixedSize, JumpConditionFixedSize, JumpTypeCount };
+    enum JumpLinkType { LinkInvalid, LinkJumpT1, LinkJumpT2, LinkJumpT3,
+        LinkJumpT4, LinkConditionalJumpT4, LinkBX, LinkConditionalBX, JumpLinkTypeCount };
+    static const int JumpSizes[JumpLinkTypeCount];
+    static const int JumpPaddingSizes[JumpTypeCount];
     class LinkRecord {
     public:
         LinkRecord(intptr_t from, intptr_t to, JumpType type, Condition condition)
@@ -502,8 +503,8 @@ public:
     private:
         intptr_t m_from : 31;
         intptr_t m_to : 31;
-        JumpType m_type : 2;
-        JumpLinkType m_linkType : 3;
+        JumpType m_type : 3;
+        JumpLinkType m_linkType : 4;
         Condition m_condition : 16;
     };
     
@@ -523,7 +524,7 @@ public:
             , m_condition(ConditionInvalid)
             , m_type(type)
         {
-            ASSERT(m_type != JumpCondition);
+            ASSERT(m_type == JumpFixed || m_type == JumpNoCondition || m_type == JumpNoConditionFixedSize);
         }
 
         JmpSrc(int offset, JumpType type, Condition condition)
@@ -531,7 +532,7 @@ public:
             , m_condition(condition)
             , m_type(type)
         {
-            ASSERT(m_type == JumpCondition || m_type == JumpFullSize);
+            ASSERT(m_type == JumpFixed || m_type == JumpCondition || m_type == JumpConditionFixedSize);
         }
 
         int m_offset;
@@ -628,6 +629,8 @@ private:
     } OpcodeID;
 
     typedef enum {
+        OP_B_T1         = 0xD000,
+        OP_B_T2         = 0xE000,
         OP_AND_reg_T2   = 0xEA00,
         OP_TST_reg_T2   = 0xEA10,
         OP_ORR_reg_T2   = 0xEA40,
@@ -655,6 +658,7 @@ private:
         OP_VCVT_FPIVFP  = 0xEEB0,
         OP_VMOV_IMM_T2  = 0xEEB0,
         OP_VMRS         = 0xEEB0,
+        OP_B_T3a        = 0xF000,
         OP_B_T4a        = 0xF000,
         OP_AND_imm_T1   = 0xF000,
         OP_TST_imm      = 0xF010,
@@ -707,6 +711,7 @@ private:
         OP_VCVT_FPIVFPb = 0x0A40,
         OP_VSUB_T2b     = 0x0A40,
         OP_NOP_T2b      = 0x8000,
+        OP_B_T3b        = 0x8000,
         OP_B_T4b        = 0x9000,
     } OpcodeID2;
 
@@ -743,7 +748,7 @@ private:
             | (ifThenElseConditionBit(condition, inst3if) << 2)
             | (ifThenElseConditionBit(condition, inst4if) << 1)
             | 1;
-        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
         return (condition << 4) | mask;
     }
     uint8_t ifThenElse(Condition condition, bool inst2if, bool inst3if)
@@ -751,21 +756,20 @@ private:
         int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
             | (ifThenElseConditionBit(condition, inst3if) << 2)
             | 2;
-        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
         return (condition << 4) | mask;
     }
     uint8_t ifThenElse(Condition condition, bool inst2if)
     {
         int mask = (ifThenElseConditionBit(condition, inst2if) << 3)
             | 4;
-        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
+        ASSERT((condition != ConditionAL) || !(mask & (mask - 1)));
         return (condition << 4) | mask;
     }
 
     uint8_t ifThenElse(Condition condition)
     {
         int mask = 8;
-        ASSERT((condition != ConditionAL) || (mask & (mask - 1)));
         return (condition << 4) | mask;
     }
 
@@ -1662,7 +1666,7 @@ public:
         return static_cast<int32_t*>(m_formatter.data())[location / sizeof(int32_t) - 1];
     }
     
-    int jumpSizeDelta(JumpLinkType jumpLinkType) { return JumpPaddingSize - JumpSizes[jumpLinkType]; }
+    int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return JumpPaddingSizes[jumpType] - JumpSizes[jumpLinkType]; }
     
     // Assembler admin methods:
 
@@ -1676,30 +1680,73 @@ public:
         return a.from() < b.from();
     }
 
-    JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to)
+    bool canCompact(JumpType jumpType)
     {
-        if (record.type() >= JumpFullSize) {
-            record.setLinkType(LinkLongJump);
-            return LinkLongJump;
-        }
+        // The following cannot be compacted:
+        //   JumpFixed: represents custom jump sequence
+        //   JumpNoConditionFixedSize: represents unconditional jump that must remain a fixed size
+        //   JumpConditionFixedSize: represents conditional jump that must remain a fixed size
+        return (jumpType == JumpNoCondition) || (jumpType == JumpCondition);
+    }
+    
+    JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to)
+    {
+        if (jumpType == JumpFixed)
+            return LinkInvalid;
+        
+        // for patchable jump we must leave space for the longest code sequence
+        if (jumpType == JumpNoConditionFixedSize)
+            return LinkBX;
+        if (jumpType == JumpConditionFixedSize)
+            return LinkConditionalBX;
+        
+        const int paddingSize = JumpPaddingSizes[jumpType];
         bool mayTriggerErrata = false;
-        const uint16_t* shortJumpLocation = reinterpret_cast<const uint16_t*>(from  - (JumpPaddingSize - JumpSizes[LinkShortJump]));
-        if (!canBeShortJump(shortJumpLocation, to, mayTriggerErrata)) {
-            record.setLinkType(LinkLongJump);
-            return LinkLongJump;
-        }
-        if (mayTriggerErrata) {
-            record.setLinkType(LinkLongJump);
-            return LinkLongJump;
-        }
-        if (record.type() == JumpCondition) {
-            record.setLinkType(LinkConditionalShortJump);
-            return LinkConditionalShortJump;
+        
+        if (jumpType == JumpCondition) {
+            // 2-byte conditional T1
+            const uint16_t* jumpT1Location = reinterpret_cast<const uint16_t*>(from - (paddingSize - JumpSizes[LinkJumpT1]));
+            if (canBeJumpT1(jumpT1Location, to))
+                return LinkJumpT1;
+            // 4-byte conditional T3
+            const uint16_t* jumpT3Location = reinterpret_cast<const uint16_t*>(from - (paddingSize - JumpSizes[LinkJumpT3]));
+            if (canBeJumpT3(jumpT3Location, to, mayTriggerErrata)) {
+                if (!mayTriggerErrata)
+                    return LinkJumpT3;
+            }
+            // 4-byte conditional T4 with IT
+            const uint16_t* conditionalJumpT4Location = 
+            reinterpret_cast<const uint16_t*>(from - (paddingSize - JumpSizes[LinkConditionalJumpT4]));
+            if (canBeJumpT4(conditionalJumpT4Location, to, mayTriggerErrata)) {
+                if (!mayTriggerErrata)
+                    return LinkConditionalJumpT4;
+            }
+        } else {
+            // 2-byte unconditional T2
+            const uint16_t* jumpT2Location = reinterpret_cast<const uint16_t*>(from - (paddingSize - JumpSizes[LinkJumpT2]));
+            if (canBeJumpT2(jumpT2Location, to))
+                return LinkJumpT2;
+            // 4-byte unconditional T4
+            const uint16_t* jumpT4Location = reinterpret_cast<const uint16_t*>(from - (paddingSize - JumpSizes[LinkJumpT4]));
+            if (canBeJumpT4(jumpT4Location, to, mayTriggerErrata)) {
+                if (!mayTriggerErrata)
+                    return LinkJumpT4;
+            }
+            // use long jump sequence
+            return LinkBX;
         }
-        record.setLinkType(LinkShortJump);
-        return LinkShortJump;
+        
+        ASSERT(jumpType == JumpCondition);
+        return LinkConditionalBX;
     }
-
+    
+    JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to)
+    {
+        JumpLinkType linkType = computeJumpType(record.type(), from, to);
+        record.setLinkType(linkType);
+        return linkType;
+    }
+    
     void recordLinkOffsets(int32_t regionStart, int32_t regionEnd, int32_t offset)
     {
         int32_t ptr = regionStart / sizeof(int32_t);
@@ -1717,16 +1764,32 @@ public:
 
     void link(LinkRecord& record, uint8_t* from, uint8_t* to)
     {
-        uint16_t* itttLocation;
-        if (record.linkType() == LinkConditionalShortJump) {
-            itttLocation = reinterpret_cast<uint16_t*>(from - JumpSizes[LinkConditionalShortJump] - 2);
-            itttLocation[0] = ifThenElse(record.condition()) | OP_IT;
+        switch (record.linkType()) {
+        case LinkJumpT1:
+            linkJumpT1(record.condition(), reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkJumpT2:
+            linkJumpT2(reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkJumpT3:
+            linkJumpT3(record.condition(), reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkJumpT4:
+            linkJumpT4(reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkConditionalJumpT4:
+            linkConditionalJumpT4(record.condition(), reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkConditionalBX:
+            linkConditionalBX(record.condition(), reinterpret_cast<uint16_t*>(from), to);
+            break;
+        case LinkBX:
+            linkBX(reinterpret_cast<uint16_t*>(from), to);
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+            break;
         }
-        ASSERT(record.linkType() != LinkInvalid);
-        if (record.linkType() != LinkLongJump)
-            linkShortJump(reinterpret_cast<uint16_t*>(from), to);
-        else
-            linkLongJump(reinterpret_cast<uint16_t*>(from), to);
     }
 
     void* unlinkedCode() { return m_formatter.data(); }
@@ -1792,8 +1855,6 @@ public:
         ASSERT(reinterpret_cast<intptr_t>(to) & 1);
 
         setPointer(reinterpret_cast<uint16_t*>(from) - 1, to);
-
-        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(from) - 5, 4 * sizeof(uint16_t));
     }
 
     static void repatchInt32(void* where, int32_t value)
@@ -1801,8 +1862,6 @@ public:
         ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
         
         setInt32(where, value);
-
-        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
     }
 
     static void repatchPointer(void* where, void* value)
@@ -1810,8 +1869,6 @@ public:
         ASSERT(!(reinterpret_cast<intptr_t>(where) & 1));
         
         setPointer(where, value);
-
-        ExecutableAllocator::cacheFlush(reinterpret_cast<uint16_t*>(where) - 4, 4 * sizeof(uint16_t));
     }
 
     static void repatchLoadPtrToLEA(void* where)
@@ -1952,7 +2009,54 @@ private:
         return (instruction[0] == OP_NOP_T2a) && (instruction[1] == OP_NOP_T2b);
     }
 
-    static bool canBeShortJump(const uint16_t* instruction, const void* target, bool& mayTriggerErrata)
+    static bool canBeJumpT1(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T1 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        return ((relative << 23) >> 23) == relative;
+    }
+    
+    static bool canBeJumpT2(const uint16_t* instruction, const void* target)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T2 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        return ((relative << 20) >> 20) == relative;
+    }
+    
+    static bool canBeJumpT3(const uint16_t* instruction, const void* target, bool& mayTriggerErrata)
+    {
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // From Cortex-A8 errata:
+        // If the 32-bit Thumb-2 branch instruction spans two 4KiB regions and
+        // the target of the branch falls within the first region it is
+        // possible for the processor to incorrectly determine the branch
+        // instruction, and it is also possible in some cases for the processor
+        // to enter a deadlock state.
+        // The instruction is spanning two pages if it ends at an address ending 0x002
+        bool spansTwo4K = ((reinterpret_cast<intptr_t>(instruction) & 0xfff) == 0x002);
+        mayTriggerErrata = spansTwo4K;
+        // The target is in the first page if the jump branch back by [3..0x1002] bytes
+        bool targetInFirstPage = (relative >= -0x1002) && (relative < -2);
+        bool wouldTriggerA8Errata = spansTwo4K && targetInFirstPage;
+        return ((relative << 11) >> 11) == relative && !wouldTriggerA8Errata;
+    }
+    
+    static bool canBeJumpT4(const uint16_t* instruction, const void* target, bool& mayTriggerErrata)
     {
         ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
         ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
@@ -1972,50 +2076,127 @@ private:
         bool wouldTriggerA8Errata = spansTwo4K && targetInFirstPage;
         return ((relative << 7) >> 7) == relative && !wouldTriggerA8Errata;
     }
-
-    static void linkLongJump(uint16_t* instruction, void* target)
+    
+    void linkJumpT1(Condition cond, uint16_t* instruction, void* target)
     {
-        linkJumpAbsolute(instruction, target);
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT1(instruction, target));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T1 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        instruction[-1] = OP_B_T1 | ((cond & 0xf) << 8) | ((relative & 0x1fe) >> 1);
     }
     
-    static void linkShortJump(uint16_t* instruction, void* target)
+    static void linkJumpT2(uint16_t* instruction, void* target)
     {
         // FIMXE: this should be up in the MacroAssembler layer. :-(        
         ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
         ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        ASSERT(canBeJumpT2(instruction, target));
         
         intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        // It does not appear to be documented in the ARM ARM (big surprise), but
+        // for OP_B_T2 the branch displacement encoded in the instruction is 2 
+        // less than the actual displacement.
+        relative -= 2;
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        instruction[-1] = OP_B_T2 | ((relative & 0xffe) >> 1);
+    }
+    
+    void linkJumpT3(Condition cond, uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
         bool scratch;
         UNUSED_PARAM(scratch);
-        ASSERT(canBeShortJump(instruction, target, scratch));
+        ASSERT(canBeJumpT3(instruction, target, scratch));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+        
+        // All branch offsets should be an even distance.
+        ASSERT(!(relative & 1));
+        instruction[-2] = OP_B_T3a | ((relative & 0x100000) >> 10) | ((cond & 0xf) << 6) | ((relative & 0x3f000) >> 12);
+        instruction[-1] = OP_B_T3b | ((relative & 0x80000) >> 8) | ((relative & 0x40000) >> 5) | ((relative & 0xffe) >> 1);
+    }
+    
+    static void linkJumpT4(uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        bool scratch;
+        UNUSED_PARAM(scratch);
+        ASSERT(canBeJumpT4(instruction, target, scratch));
+        
+        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
         // ARM encoding for the top two bits below the sign bit is 'peculiar'.
         if (relative >= 0)
             relative ^= 0xC00000;
-
+        
         // All branch offsets should be an even distance.
         ASSERT(!(relative & 1));
         instruction[-2] = OP_B_T4a | ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
         instruction[-1] = OP_B_T4b | ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
     }
-
+    
+    void linkConditionalJumpT4(Condition cond, uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        instruction[-3] = ifThenElse(cond) | OP_IT;
+        linkJumpT4(instruction, target);
+    }
+    
+    static void linkBX(uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
+        ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
+        ARMThumbImmediate hi16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) >> 16));
+        instruction[-5] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOV_imm_T3, lo16);
+        instruction[-4] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, lo16);
+        instruction[-3] = twoWordOp5i6Imm4Reg4EncodedImmFirst(OP_MOVT, hi16);
+        instruction[-2] = twoWordOp5i6Imm4Reg4EncodedImmSecond(JUMP_TEMPORARY_REGISTER, hi16);
+        instruction[-1] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
+    }
+    
+    void linkConditionalBX(Condition cond, uint16_t* instruction, void* target)
+    {
+        // FIMXE: this should be up in the MacroAssembler layer. :-(        
+        ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
+        ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
+        
+        linkBX(instruction, target);
+        instruction[-6] = ifThenElse(cond, true, true) | OP_IT;
+    }
+    
     static void linkJumpAbsolute(uint16_t* instruction, void* target)
     {
         // FIMXE: this should be up in the MacroAssembler layer. :-(
         ASSERT(!(reinterpret_cast<intptr_t>(instruction) & 1));
         ASSERT(!(reinterpret_cast<intptr_t>(target) & 1));
-
+        
         ASSERT((isMOV_imm_T3(instruction - 5) && isMOVT(instruction - 3) && isBX(instruction - 1))
-            || (isNOP_T1(instruction - 5) && isNOP_T2(instruction - 4) && isB(instruction - 2)));
-
-        intptr_t relative = reinterpret_cast<intptr_t>(target) - (reinterpret_cast<intptr_t>(instruction));
+               || (isNOP_T1(instruction - 5) && isNOP_T2(instruction - 4) && isB(instruction - 2)));
+        
         bool scratch;
-        if (canBeShortJump(instruction, target, scratch)) {
-            // ARM encoding for the top two bits below the sign bit is 'peculiar'.
-            if (relative >= 0)
-                relative ^= 0xC00000;
-
-            // All branch offsets should be an even distance.
-            ASSERT(!(relative & 1));
+        if (canBeJumpT4(instruction, target, scratch)) {
             // There may be a better way to fix this, but right now put the NOPs first, since in the
             // case of an conditional branch this will be coming after an ITTT predicating *three*
             // instructions!  Looking backwards to modify the ITTT to an IT is not easy, due to
@@ -2024,8 +2205,7 @@ private:
             instruction[-5] = OP_NOP_T1;
             instruction[-4] = OP_NOP_T2a;
             instruction[-3] = OP_NOP_T2b;
-            instruction[-2] = OP_B_T4a | ((relative & 0x1000000) >> 14) | ((relative & 0x3ff000) >> 12);
-            instruction[-1] = OP_B_T4b | ((relative & 0x800000) >> 10) | ((relative & 0x400000) >> 11) | ((relative & 0xffe) >> 1);
+            linkJumpT4(instruction, target);
         } else {
             const uint16_t JUMP_TEMPORARY_REGISTER = ARMRegisters::ip;
             ARMThumbImmediate lo16 = ARMThumbImmediate::makeUInt16(static_cast<uint16_t>(reinterpret_cast<uint32_t>(target) + 1));
@@ -2037,7 +2217,7 @@ private:
             instruction[-1] = OP_BX | (JUMP_TEMPORARY_REGISTER << 3);
         }
     }
-
+    
     static uint16_t twoWordOp5i6Imm4Reg4EncodedImmFirst(uint16_t op, ARMThumbImmediate imm)
     {
         return op | (imm.m_value.i << 10) | imm.m_value.imm4;
diff --git a/JavaScriptCore/assembler/LinkBuffer.h b/JavaScriptCore/assembler/LinkBuffer.h
index 408deb0..e1dca0b 100644
--- a/JavaScriptCore/assembler/LinkBuffer.h
+++ b/JavaScriptCore/assembler/LinkBuffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +28,9 @@
 
 #if ENABLE(ASSEMBLER)
 
+#define DUMP_LINK_STATISTICS 0
+#define DUMP_CODE 0
+
 #include <MacroAssembler.h>
 #include <wtf/Noncopyable.h>
 
@@ -235,12 +238,14 @@ private:
                 target = linkBase + jumpsToLink[i].to() - m_assembler->executableOffsetFor(jumpsToLink[i].to());
             
             JumpLinkType jumpLinkType = m_assembler->computeJumpType(jumpsToLink[i], linkBase + writePtr, target);
-
-            // Step back in the write stream
-            int32_t delta = m_assembler->jumpSizeDelta(jumpLinkType);
-            if (delta) {
-                writePtr -= delta;
-                m_assembler->recordLinkOffsets(jumpsToLink[i].from() - delta, readPtr, readPtr - writePtr);
+            // Compact branch if we can...
+            if (m_assembler->canCompact(jumpsToLink[i].type())) {
+                // Step back in the write stream
+                int32_t delta = m_assembler->jumpSizeDelta(jumpsToLink[i].type(), jumpLinkType);
+                if (delta) {
+                    writePtr -= delta;
+                    m_assembler->recordLinkOffsets(jumpsToLink[i].from() - delta, readPtr, readPtr - writePtr);
+                }
             }
             jumpsToLink[i].setFrom(writePtr);
         }
@@ -261,6 +266,13 @@ private:
         jumpsToLink.clear();
         m_size = writePtr + m_assembler->size() - readPtr;
         m_executablePool->returnLastBytes(initialSize - m_size);
+
+#if DUMP_LINK_STATISTICS
+        dumpLinkStatistics(m_code, initialSize, m_size);
+#endif
+#if DUMP_CODE
+        dumpCode(m_code, m_size);
+#endif
 #endif
     }
 
@@ -275,6 +287,53 @@ private:
         ExecutableAllocator::cacheFlush(code(), m_size);
     }
 
+#if DUMP_LINK_STATISTICS
+    static void dumpLinkStatistics(void* code, size_t initialSize, size_t finalSize)
+    {
+        static unsigned linkCount = 0;
+        static unsigned totalInitialSize = 0;
+        static unsigned totalFinalSize = 0;
+        linkCount++;
+        totalInitialSize += initialSize;
+        totalFinalSize += finalSize;
+        printf("link %p: orig %u, compact %u (delta %u, %.2f%%)\n", 
+               code, static_cast<unsigned>(initialSize), static_cast<unsigned>(finalSize),
+               static_cast<unsigned>(initialSize - finalSize),
+               100.0 * (initialSize - finalSize) / initialSize);
+        printf("\ttotal %u: orig %u, compact %u (delta %u, %.2f%%)\n", 
+               linkCount, totalInitialSize, totalFinalSize, totalInitialSize - totalFinalSize,
+               100.0 * (totalInitialSize - totalFinalSize) / totalInitialSize);
+    }
+#endif
+    
+#if DUMP_CODE
+    static void dumpCode(void* code, size_t size)
+    {
+#if CPU(ARM_THUMB2)
+        // Dump the generated code in an asm file format that can be assembled and then disassembled
+        // for debugging purposes. For example, save this output as jit.s:
+        //   gcc -arch armv7 -c jit.s
+        //   otool -tv jit.o
+        static unsigned codeCount = 0;
+        unsigned short* tcode = static_cast<unsigned short*>(code);
+        size_t tsize = size / sizeof(short);
+        char nameBuf[128];
+        snprintf(nameBuf, sizeof(nameBuf), "_jsc_jit%u", codeCount++);
+        printf("\t.syntax unified\n"
+               "\t.section\t__TEXT,__text,regular,pure_instructions\n"
+               "\t.globl\t%s\n"
+               "\t.align 2\n"
+               "\t.code 16\n"
+               "\t.thumb_func\t%s\n"
+               "# %p\n"
+               "%s:\n", nameBuf, nameBuf, code, nameBuf);
+        
+        for (unsigned i = 0; i < tsize; i++)
+            printf("\t.short\t0x%x\n", tcode[i]);
+#endif
+    }
+#endif
+    
     RefPtr<ExecutablePool> m_executablePool;
     size_t m_size;
     void* m_code;
diff --git a/JavaScriptCore/assembler/MacroAssemblerARMv7.h b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
index a1539f2..fe5d052 100644
--- a/JavaScriptCore/assembler/MacroAssemblerARMv7.h
+++ b/JavaScriptCore/assembler/MacroAssemblerARMv7.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 University of Szeged
  *
  * Redistribution and use in source and binary forms, with or without
@@ -46,6 +46,7 @@ class MacroAssemblerARMv7 : public AbstractMacroAssembler<ARMv7Assembler> {
 
 public:
     typedef ARMv7Assembler::LinkRecord LinkRecord;
+    typedef ARMv7Assembler::JumpType JumpType;
     typedef ARMv7Assembler::JumpLinkType JumpLinkType;
 
     MacroAssemblerARMv7()
@@ -57,9 +58,11 @@ public:
     void endUninterruptedSequence() { m_inUninterruptedSequence = false; }
     Vector<LinkRecord>& jumpsToLink() { return m_assembler.jumpsToLink(); }
     void* unlinkedCode() { return m_assembler.unlinkedCode(); }
+    bool canCompact(JumpType jumpType) { return m_assembler.canCompact(jumpType); }
+    JumpLinkType computeJumpType(JumpType jumpType, const uint8_t* from, const uint8_t* to) { return m_assembler.computeJumpType(jumpType, from, to); }
     JumpLinkType computeJumpType(LinkRecord& record, const uint8_t* from, const uint8_t* to) { return m_assembler.computeJumpType(record, from, to); }
     void recordLinkOffsets(int32_t regionStart, int32_t regionEnd, int32_t offset) {return m_assembler.recordLinkOffsets(regionStart, regionEnd, offset); }
-    int jumpSizeDelta(JumpLinkType jumpLinkType) { return m_assembler.jumpSizeDelta(jumpLinkType); }
+    int jumpSizeDelta(JumpType jumpType, JumpLinkType jumpLinkType) { return m_assembler.jumpSizeDelta(jumpType, jumpLinkType); }
     void link(LinkRecord& record, uint8_t* from, uint8_t* to) { return m_assembler.link(record, from, to); }
 
     struct ArmAddress {
@@ -986,14 +989,14 @@ public:
 
     void jump(RegisterID target)
     {
-        m_assembler.bx(target, inUninterruptedSequence() ? ARMv7Assembler::JumpFullSize : ARMv7Assembler::JumpNoCondition);
+        m_assembler.bx(target, ARMv7Assembler::JumpFixed);
     }
 
     // Address is a memory location containing the address to jump to
     void jump(Address address)
     {
         load32(address, dataTempRegister);
-        m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpFullSize : ARMv7Assembler::JumpNoCondition);
+        m_assembler.bx(dataTempRegister, ARMv7Assembler::JumpFixed);
     }
 
 
@@ -1082,29 +1085,29 @@ public:
     Call nearCall()
     {
         moveFixedWidthEncoding(Imm32(0), dataTempRegister);
-        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFullSize), Call::LinkableNear);
+        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::LinkableNear);
     }
 
     Call call()
     {
         moveFixedWidthEncoding(Imm32(0), dataTempRegister);
-        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFullSize), Call::Linkable);
+        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
     Call call(RegisterID target)
     {
-        return Call(m_assembler.blx(target, ARMv7Assembler::JumpFullSize), Call::None);
+        return Call(m_assembler.blx(target, ARMv7Assembler::JumpFixed), Call::None);
     }
 
     Call call(Address address)
     {
         load32(address, dataTempRegister);
-        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFullSize), Call::None);
+        return Call(m_assembler.blx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::None);
     }
 
     void ret()
     {
-        m_assembler.bx(linkRegister, ARMv7Assembler::JumpFullSize);
+        m_assembler.bx(linkRegister, ARMv7Assembler::JumpFixed);
     }
 
     void set32(Condition cond, RegisterID left, RegisterID right, RegisterID dest)
@@ -1204,7 +1207,7 @@ public:
     {
         // Like a normal call, but don't link.
         moveFixedWidthEncoding(Imm32(0), dataTempRegister);
-        return Call(m_assembler.bx(dataTempRegister, ARMv7Assembler::JumpFullSize), Call::Linkable);
+        return Call(m_assembler.bx(dataTempRegister, ARMv7Assembler::JumpFixed), Call::Linkable);
     }
 
     Call makeTailRecursiveCall(Jump oldJump)
@@ -1228,14 +1231,14 @@ protected:
     ARMv7Assembler::JmpSrc makeJump()
     {
         moveFixedWidthEncoding(Imm32(0), dataTempRegister);
-        return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpFullSize : ARMv7Assembler::JumpNoCondition);
+        return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpNoConditionFixedSize : ARMv7Assembler::JumpNoCondition);
     }
 
     ARMv7Assembler::JmpSrc makeBranch(ARMv7Assembler::Condition cond)
     {
         m_assembler.it(cond, true, true);
         moveFixedWidthEncoding(Imm32(0), dataTempRegister);
-        return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpFullSize : ARMv7Assembler::JumpCondition, cond);
+        return m_assembler.bx(dataTempRegister, inUninterruptedSequence() ? ARMv7Assembler::JumpConditionFixedSize : ARMv7Assembler::JumpCondition, cond);
     }
     ARMv7Assembler::JmpSrc makeBranch(Condition cond) { return makeBranch(armV7Condition(cond)); }
     ARMv7Assembler::JmpSrc makeBranch(DoubleCondition cond) { return makeBranch(armV7Condition(cond)); }
diff --git a/JavaScriptCore/bytecode/CodeBlock.cpp b/JavaScriptCore/bytecode/CodeBlock.cpp
index 6c0696e..55101d4 100644
--- a/JavaScriptCore/bytecode/CodeBlock.cpp
+++ b/JavaScriptCore/bytecode/CodeBlock.cpp
@@ -34,10 +34,11 @@
 #include "Debugger.h"
 #include "Interpreter.h"
 #include "JIT.h"
+#include "JSActivation.h"
 #include "JSFunction.h"
 #include "JSStaticScopeObject.h"
 #include "JSValue.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include <stdio.h>
 #include <wtf/StringExtras.h>
 
@@ -52,7 +53,7 @@ static UString escapeQuotes(const UString& str)
     UString result = str;
     size_t pos = 0;
     while ((pos = result.find('\"', pos)) != notFound) {
-        result = makeString(result.substringSharingImpl(0, pos), "\"\\\"\"", result.substringSharingImpl(pos + 1));
+        result = makeUString(result.substringSharingImpl(0, pos), "\"\\\"\"", result.substringSharingImpl(pos + 1));
         pos += 4;
     }
     return result;
@@ -64,19 +65,19 @@ static UString valueToSourceString(ExecState* exec, JSValue val)
         return "0";
 
     if (val.isString())
-        return makeString("\"", escapeQuotes(val.toString(exec)), "\"");
+        return makeUString("\"", escapeQuotes(val.toString(exec)), "\"");
 
     return val.toString(exec);
 }
 
 static CString constantName(ExecState* exec, int k, JSValue value)
 {
-    return makeString(valueToSourceString(exec, value), "(@k", UString::number(k - FirstConstantRegisterIndex), ")").utf8();
+    return makeUString(valueToSourceString(exec, value), "(@k", UString::number(k - FirstConstantRegisterIndex), ")").utf8();
 }
 
 static CString idName(int id0, const Identifier& ident)
 {
-    return makeString(ident.ustring(), "(@id", UString::number(id0), ")").utf8();
+    return makeUString(ident.ustring(), "(@id", UString::number(id0), ")").utf8();
 }
 
 CString CodeBlock::registerName(ExecState* exec, int r) const
@@ -87,7 +88,7 @@ CString CodeBlock::registerName(ExecState* exec, int r) const
     if (isConstantRegisterIndex(r))
         return constantName(exec, r, getConstant(r));
 
-    return makeString("r", UString::number(r)).utf8();
+    return makeUString("r", UString::number(r)).utf8();
 }
 
 static UString regexpToSourceString(RegExp* regExp)
@@ -101,12 +102,12 @@ static UString regexpToSourceString(RegExp* regExp)
     if (regExp->multiline())
         postfix[index] = 'm';
 
-    return makeString("/", regExp->pattern(), postfix);
+    return makeUString("/", regExp->pattern(), postfix);
 }
 
 static CString regexpName(int re, RegExp* regexp)
 {
-    return makeString(regexpToSourceString(regexp), "(@re", UString::number(re), ")").utf8();
+    return makeUString(regexpToSourceString(regexp), "(@re", UString::number(re), ")").utf8();
 }
 
 static UString pointerToSourceString(void* p)
@@ -485,9 +486,9 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] enter\n", location);
             break;
         }
-        case op_enter_with_activation: {
+        case op_create_activation: {
             int r0 = (++it)->u.operand;
-            printf("[%4d] enter_with_activation %s\n", location, registerName(exec, r0).data());
+            printf("[%4d] create_activation %s\n", location, registerName(exec, r0).data());
             break;
         }
         case op_create_arguments: {
@@ -516,6 +517,11 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             printf("[%4d] convert_this %s\n", location, registerName(exec, r0).data());
             break;
         }
+        case op_convert_this_strict: {
+            int r0 = (++it)->u.operand;
+            printf("[%4d] convert_this_strict %s\n", location, registerName(exec, r0).data());
+            break;
+        }
         case op_new_object: {
             int r0 = (++it)->u.operand;
             printf("[%4d] new_object\t %s\n", location, registerName(exec, r0).data());
@@ -722,9 +728,8 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
             int id0 = (++it)->u.operand;
             JSValue scope = JSValue((++it)->u.jsCell);
             ++it;
-            int depth = it[2].u.operand;
+            int depth = (++it)->u.operand;
             printf("[%4d] resolve_global_dynamic\t %s, %s, %s, %d\n", location, registerName(exec, r0).data(), valueToSourceString(exec, scope).utf8().data(), idName(id0, m_identifiers[id0]).data(), depth);
-            it += 3;
             break;
         }
         case op_get_scoped_var: {
@@ -756,7 +761,14 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         case op_resolve_base: {
             int r0 = (++it)->u.operand;
             int id0 = (++it)->u.operand;
-            printf("[%4d] resolve_base\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            int isStrict = (++it)->u.operand;
+            printf("[%4d] resolve_base%s\t %s, %s\n", location, isStrict ? "_strict" : "", registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
+            break;
+        }
+        case op_ensure_property_exists: {
+            int r0 = (++it)->u.operand;
+            int id0 = (++it)->u.operand;
+            printf("[%4d] ensure_property_exists\t %s, %s\n", location, registerName(exec, r0).data(), idName(id0, m_identifiers[id0]).data());
             break;
         }
         case op_resolve_with_base: {
@@ -1134,9 +1146,12 @@ void CodeBlock::dump(ExecState* exec, const Vector<Instruction>::const_iterator&
         }
         case op_next_pname: {
             int dest = it[1].u.operand;
-            int iter = it[4].u.operand;
-            int offset = it[5].u.operand;
-            printf("[%4d] next_pname\t %s, %s, %d(->%d)\n", location, registerName(exec, dest).data(), registerName(exec, iter).data(), offset, location + offset);
+            int base = it[2].u.operand;
+            int i = it[3].u.operand;
+            int size = it[4].u.operand;
+            int iter = it[5].u.operand;
+            int offset = it[6].u.operand;
+            printf("[%4d] next_pname\t %s, %s, %s, %s, %s, %d(->%d)\n", location, registerName(exec, dest).data(), registerName(exec, base).data(), registerName(exec, i).data(), registerName(exec, size).data(), registerName(exec, iter).data(), offset, location + offset);
             it += OPCODE_LENGTH(op_next_pname) - 1;
             break;
         }
@@ -1371,6 +1386,7 @@ CodeBlock::CodeBlock(ScriptExecutable* ownerExecutable, CodeType codeType, JSGlo
     , m_needsFullScopeChain(ownerExecutable->needsActivation())
     , m_usesEval(ownerExecutable->usesEval())
     , m_isNumericCompareFunction(false)
+    , m_isStrictMode(ownerExecutable->isStrictMode())
     , m_codeType(codeType)
     , m_source(sourceProvider)
     , m_sourceOffset(sourceOffset)
@@ -1542,6 +1558,10 @@ bool CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
     ASSERT(!m_rareData || !m_rareData->m_exceptionHandlers.size());
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     if (m_needsFullScopeChain) {
+        if (codeType() == FunctionCode && !callFrame->r(activationRegister()).jsValue()) {
+            createActivation(callFrame);
+            scopeChain = callFrame->scopeChain();
+        }
         ScopeChain sc(scopeChain);
         int scopeDelta = sc.localDepth();
         if (m_codeType == EvalCode)
@@ -1553,7 +1573,7 @@ bool CodeBlock::reparseForExceptionInfoIfNecessary(CallFrame* callFrame)
             scopeChain = scopeChain->next;
     }
 
-    m_exceptionInfo = m_ownerExecutable->reparseExceptionInfo(m_globalData, scopeChain, this);
+    m_exceptionInfo = m_ownerExecutable->reparseExceptionInfo(scopeChain, this);
     return m_exceptionInfo;
 }
 
@@ -1765,4 +1785,14 @@ void CodeBlock::shrinkToFit()
     }
 }
 
+void CodeBlock::createActivation(CallFrame* callFrame)
+{
+    ASSERT(codeType() == FunctionCode);
+    ASSERT(needsFullScopeChain());
+    ASSERT(!callFrame->r(activationRegister()).jsValue());
+    JSActivation* activation = new (callFrame) JSActivation(callFrame, static_cast<FunctionExecutable*>(ownerExecutable()));
+    callFrame->r(activationRegister()) = JSValue(activation);
+    callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/bytecode/CodeBlock.h b/JavaScriptCore/bytecode/CodeBlock.h
index cda4530..e4ebeb8 100644
--- a/JavaScriptCore/bytecode/CodeBlock.h
+++ b/JavaScriptCore/bytecode/CodeBlock.h
@@ -297,9 +297,11 @@ namespace JSC {
         void printStructure(const char* name, const Instruction*, int operand) const;
 #endif
 
+        bool isStrictMode() const { return m_isStrictMode; }
+
         inline bool isKnownNotImmediate(int index)
         {
-            if (index == m_thisRegister)
+            if (index == m_thisRegister && !m_isStrictMode)
                 return true;
 
             if (isConstantRegisterIndex(index))
@@ -408,6 +410,15 @@ namespace JSC {
             ASSERT(usesArguments());
             return m_argumentsRegister;
         }
+        void setActivationRegister(int activationRegister)
+        {
+            m_activationRegister = activationRegister;
+        }
+        int activationRegister()
+        {
+            ASSERT(needsFullScopeChain());
+            return m_activationRegister;
+        }
         bool usesArguments() const { return m_argumentsRegister != -1; }
 
         CodeType codeType() const { return m_codeType; }
@@ -420,6 +431,8 @@ namespace JSC {
         unsigned jumpTarget(int index) const { return m_jumpTargets[index]; }
         unsigned lastJumpTarget() const { return m_jumpTargets.last(); }
 
+        void createActivation(CallFrame*);
+
 #if ENABLE(INTERPRETER)
         void addPropertyAccessInstruction(unsigned propertyAccessInstruction) { m_propertyAccessInstructions.append(propertyAccessInstruction); }
         void addGlobalResolveInstruction(unsigned globalResolveInstruction) { m_globalResolveInstructions.append(globalResolveInstruction); }
@@ -548,10 +561,12 @@ namespace JSC {
 
         int m_thisRegister;
         int m_argumentsRegister;
+        int m_activationRegister;
 
         bool m_needsFullScopeChain;
         bool m_usesEval;
         bool m_isNumericCompareFunction;
+        bool m_isStrictMode;
 
         CodeType m_codeType;
 
diff --git a/JavaScriptCore/bytecode/EvalCodeCache.h b/JavaScriptCore/bytecode/EvalCodeCache.h
index 7c4cb33..edd575f 100644
--- a/JavaScriptCore/bytecode/EvalCodeCache.h
+++ b/JavaScriptCore/bytecode/EvalCodeCache.h
@@ -43,20 +43,20 @@ namespace JSC {
 
     class EvalCodeCache {
     public:
-        PassRefPtr<EvalExecutable> get(ExecState* exec, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
+        PassRefPtr<EvalExecutable> get(ExecState* exec, bool inStrictContext, const UString& evalSource, ScopeChainNode* scopeChain, JSValue& exceptionValue)
         {
             RefPtr<EvalExecutable> evalExecutable;
 
-            if (evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
+            if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject())
                 evalExecutable = m_cacheMap.get(evalSource.impl());
 
             if (!evalExecutable) {
-                evalExecutable = EvalExecutable::create(exec, makeSource(evalSource));
+                evalExecutable = EvalExecutable::create(exec, makeSource(evalSource), inStrictContext);
                 exceptionValue = evalExecutable->compile(exec, scopeChain);
                 if (exceptionValue)
                     return 0;
 
-                if (evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
+                if (!inStrictContext && evalSource.length() < maxCacheableSourceLength && (*scopeChain->begin())->isVariableObject() && m_cacheMap.size() < maxCacheEntries)
                     m_cacheMap.set(evalSource.impl(), evalExecutable);
             }
 
diff --git a/JavaScriptCore/bytecode/Opcode.h b/JavaScriptCore/bytecode/Opcode.h
index 03f6573..e1ef01e 100644
--- a/JavaScriptCore/bytecode/Opcode.h
+++ b/JavaScriptCore/bytecode/Opcode.h
@@ -39,12 +39,13 @@ namespace JSC {
 
     #define FOR_EACH_OPCODE_ID(macro) \
         macro(op_enter, 1) \
-        macro(op_enter_with_activation, 2) \
+        macro(op_create_activation, 2) \
         macro(op_init_lazy_reg, 2) \
         macro(op_create_arguments, 2) \
         macro(op_create_this, 3) \
         macro(op_get_callee, 2) \
         macro(op_convert_this, 2) \
+        macro(op_convert_this_strict, 2) \
         \
         macro(op_new_object, 2) \
         macro(op_new_array, 4) \
@@ -99,7 +100,8 @@ namespace JSC {
         macro(op_put_scoped_var, 4) \
         macro(op_get_global_var, 3) \
         macro(op_put_global_var, 3) \
-        macro(op_resolve_base, 3) \
+        macro(op_resolve_base, 4) \
+        macro(op_ensure_property_exists, 3) \
         macro(op_resolve_with_base, 4) \
         macro(op_get_by_id, 8) \
         macro(op_get_by_id_self, 8) \
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
index 986709b..f34c38c 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.cpp
@@ -214,6 +214,7 @@ BytecodeGenerator::BytecodeGenerator(ProgramNode* programNode, const Debugger* d
     , m_nextGlobalIndex(-1)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
+    , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
@@ -306,10 +307,14 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     , m_codeType(FunctionCode)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
+    , m_hasCreatedActivation(false)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
+#ifndef NDEBUG
+    , m_lastOpcodePosition(0)
+#endif
     , m_emitNodeDepth(0)
     , m_usesExceptions(false)
     , m_regeneratingForExceptionInfo(false)
@@ -319,13 +324,13 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
         m_codeBlock->setNeedsFullScopeChain(true);
 
     codeBlock->setGlobalData(m_globalData);
-
+    
+    emitOpcode(op_enter);
     if (m_codeBlock->needsFullScopeChain()) {
         m_activationRegister = addVar();
-        emitOpcode(op_enter_with_activation);
-        instructions().append(m_activationRegister->index());
-    } else
-        emitOpcode(op_enter);
+        emitInitLazyRegister(m_activationRegister);
+        m_codeBlock->setActivationRegister(m_activationRegister->index());
+    }
 
     // Both op_tear_off_activation and op_tear_off_arguments tear off the 'arguments'
     // object, if created.
@@ -341,6 +346,11 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 
         emitInitLazyRegister(argumentsRegister);
         emitInitLazyRegister(unmodifiedArgumentsRegister);
+        
+        if (m_codeBlock->isStrictMode()) {
+            emitOpcode(op_create_arguments);
+            instructions().append(argumentsRegister->index());
+        }
 
         // The debugger currently retrieves the arguments object from an activation rather than pulling
         // it from a call frame.  In the long-term it should stop doing that (<rdar://problem/6911886>),
@@ -356,11 +366,17 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
 
     // Captured variables and functions go first so that activations don't have
     // to step over the non-captured locals to mark them.
+    m_hasCreatedActivation = false;
     if (functionBody->hasCapturedVariables()) {
         for (size_t i = 0; i < functionStack.size(); ++i) {
             FunctionBodyNode* function = functionStack[i];
             const Identifier& ident = function->ident();
             if (functionBody->captures(ident)) {
+                if (!m_hasCreatedActivation) {
+                    m_hasCreatedActivation = true;
+                    emitOpcode(op_create_activation);
+                    instructions().append(m_activationRegister->index());
+                }
                 m_functions.add(ident.impl());
                 emitNewFunction(addVar(ident, false), function);
             }
@@ -371,7 +387,13 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
                 addVar(ident, varStack[i].second & DeclarationStacks::IsConstant);
         }
     }
-    bool canLazilyCreateFunctions = !functionBody->needsActivationForMoreThanVariables();
+    bool canLazilyCreateFunctions = !functionBody->needsActivationForMoreThanVariables() && !debugger;
+    if (!canLazilyCreateFunctions && !m_hasCreatedActivation) {
+        m_hasCreatedActivation = true;
+        emitOpcode(op_create_activation);
+        instructions().append(m_activationRegister->index());
+    }
+
     codeBlock->m_numCapturedVars = codeBlock->m_numVars;
     m_firstLazyFunction = codeBlock->m_numVars;
     for (size_t i = 0; i < functionStack.size(); ++i) {
@@ -399,7 +421,6 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
     
     if (debugger)
         codeBlock->m_numCapturedVars = codeBlock->m_numVars;
-        
 
     FunctionParameters& parameters = *functionBody->parameters();
     size_t parameterCount = parameters.size();
@@ -429,7 +450,10 @@ BytecodeGenerator::BytecodeGenerator(FunctionBodyNode* functionBody, const Debug
         instructions().append(m_thisRegister.index());
         instructions().append(funcProto->index());
     } else if (functionBody->usesThis() || m_shouldEmitDebugHooks) {
-        emitOpcode(op_convert_this);
+        if (codeBlock->isStrictMode())
+            emitOpcode(op_convert_this_strict);
+        else
+            emitOpcode(op_convert_this);
         instructions().append(m_thisRegister.index());
     }
 }
@@ -448,10 +472,14 @@ BytecodeGenerator::BytecodeGenerator(EvalNode* evalNode, const Debugger* debugge
     , m_codeType(EvalCode)
     , m_nextConstantOffset(0)
     , m_globalConstantIndex(0)
+    , m_hasCreatedActivation(true)
     , m_firstLazyFunction(0)
     , m_lastLazyFunction(0)
     , m_globalData(&scopeChain.globalObject()->globalExec()->globalData())
     , m_lastOpcodeID(op_end)
+#ifndef NDEBUG
+    , m_lastOpcodePosition(0)
+#endif
     , m_emitNodeDepth(0)
     , m_usesExceptions(false)
     , m_regeneratingForExceptionInfo(false)
@@ -1249,6 +1277,7 @@ RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const Identifier
         emitOpcode(op_resolve_base);
         instructions().append(dst->index());
         instructions().append(addConstant(property));
+        instructions().append(false);
         return dst;
     }
 
@@ -1256,6 +1285,32 @@ RegisterID* BytecodeGenerator::emitResolveBase(RegisterID* dst, const Identifier
     return emitLoad(dst, JSValue(globalObject));
 }
 
+RegisterID* BytecodeGenerator::emitResolveBaseForPut(RegisterID* dst, const Identifier& property)
+{
+    if (!m_codeBlock->isStrictMode())
+        return emitResolveBase(dst, property);
+    size_t depth = 0;
+    int index = 0;
+    JSObject* globalObject = 0;
+    bool requiresDynamicChecks = false;
+    findScopedProperty(property, index, depth, false, requiresDynamicChecks, globalObject);
+    if (!globalObject || requiresDynamicChecks) {
+        // We can't optimise at all :-(
+        emitOpcode(op_resolve_base);
+        instructions().append(dst->index());
+        instructions().append(addConstant(property));
+        instructions().append(true);
+        return dst;
+    }
+    
+    // Global object is the base
+    RefPtr<RegisterID> result = emitLoad(dst, JSValue(globalObject));
+    emitOpcode(op_ensure_property_exists);
+    instructions().append(dst->index());
+    instructions().append(addConstant(property));
+    return result.get();
+}
+
 RegisterID* BytecodeGenerator::emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property)
 {
     size_t depth = 0;
@@ -1504,6 +1559,7 @@ RegisterID* BytecodeGenerator::emitLazyNewFunction(RegisterID* dst, FunctionBody
 
 RegisterID* BytecodeGenerator::emitNewFunctionInternal(RegisterID* dst, unsigned index, bool doNullCheck)
 {
+    createActivationIfNecessary();
     emitOpcode(op_new_func);
     instructions().append(dst->index());
     instructions().append(index);
@@ -1523,7 +1579,8 @@ RegisterID* BytecodeGenerator::emitNewFunctionExpression(RegisterID* r0, FuncExp
 {
     FunctionBodyNode* function = n->body();
     unsigned index = m_codeBlock->addFunctionExpr(makeFunction(m_globalData, function));
-
+    
+    createActivationIfNecessary();
     emitOpcode(op_new_func_exp);
     instructions().append(r0->index());
     instructions().append(index);
@@ -1541,10 +1598,26 @@ void BytecodeGenerator::createArgumentsIfNecessary()
         return;
     ASSERT(m_codeBlock->usesArguments());
 
+    // If we're in strict mode we tear off the arguments on function
+    // entry, so there's no need to check if we need to create them
+    // now
+    if (m_codeBlock->isStrictMode())
+        return;
+
     emitOpcode(op_create_arguments);
     instructions().append(m_codeBlock->argumentsRegister());
 }
 
+void BytecodeGenerator::createActivationIfNecessary()
+{
+    if (m_hasCreatedActivation)
+        return;
+    if (!m_codeBlock->needsFullScopeChain())
+        return;
+    emitOpcode(op_create_activation);
+    instructions().append(m_activationRegister->index());
+}
+
 RegisterID* BytecodeGenerator::emitCallEval(RegisterID* dst, RegisterID* func, CallArguments& callArguments, unsigned divot, unsigned startOffset, unsigned endOffset)
 {
     return emitCall(op_call_eval, dst, func, callArguments, divot, startOffset, endOffset);
@@ -1648,7 +1721,8 @@ RegisterID* BytecodeGenerator::emitReturn(RegisterID* src)
         emitOpcode(op_tear_off_activation);
         instructions().append(m_activationRegister->index());
         instructions().append(m_codeBlock->argumentsRegister());
-    } else if (m_codeBlock->usesArguments() && m_codeBlock->m_numParameters > 1) { // If there are no named parameters, there's nothing to tear off, since extra / unnamed parameters get copied to the arguments object at construct time.
+    } else if (m_codeBlock->usesArguments() && m_codeBlock->m_numParameters > 1
+               && !m_codeBlock->isStrictMode()) { // If there are no named parameters, there's nothing to tear off, since extra / unnamed parameters get copied to the arguments object at construct time.
         emitOpcode(op_tear_off_arguments);
         instructions().append(m_codeBlock->argumentsRegister());
     }
diff --git a/JavaScriptCore/bytecompiler/BytecodeGenerator.h b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
index 2afa0c4..d0e4a6b 100644
--- a/JavaScriptCore/bytecompiler/BytecodeGenerator.h
+++ b/JavaScriptCore/bytecompiler/BytecodeGenerator.h
@@ -329,6 +329,7 @@ namespace JSC {
         RegisterID* emitPutScopedVar(size_t skip, int index, RegisterID* value, JSValue globalObject);
 
         RegisterID* emitResolveBase(RegisterID* dst, const Identifier& property);
+        RegisterID* emitResolveBaseForPut(RegisterID* dst, const Identifier& property);
         RegisterID* emitResolveWithBase(RegisterID* baseDst, RegisterID* propDst, const Identifier& property);
 
         void emitMethodCheck();
@@ -419,13 +420,15 @@ namespace JSC {
         }
 
         bool shouldEmitProfileHooks() { return m_shouldEmitProfileHooks; }
+        
+        bool isStrictMode() const { return m_codeBlock->isStrictMode(); }
 
     private:
         void emitOpcode(OpcodeID);
         void retrieveLastBinaryOp(int& dstIndex, int& src1Index, int& src2Index);
         void retrieveLastUnaryOp(int& dstIndex, int& srcIndex);
-        void rewindBinaryOp();
-        void rewindUnaryOp();
+        ALWAYS_INLINE void rewindBinaryOp();
+        ALWAYS_INLINE void rewindUnaryOp();
 
         PassRefPtr<Label> emitComplexJumpScopes(Label* target, ControlFlowContext* topScope, ControlFlowContext* bottomScope);
 
@@ -499,12 +502,12 @@ namespace JSC {
 
         PassRefPtr<FunctionExecutable> makeFunction(ExecState* exec, FunctionBodyNode* body)
         {
-            return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+            return FunctionExecutable::create(exec, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
 
         PassRefPtr<FunctionExecutable> makeFunction(JSGlobalData* globalData, FunctionBodyNode* body)
         {
-            return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+            return FunctionExecutable::create(globalData, body->ident(), body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
         }
 
         RegisterID* emitInitLazyRegister(RegisterID*);
@@ -518,6 +521,7 @@ namespace JSC {
         RegisterID* emitThrowExpressionTooDeepException();
 
         void createArgumentsIfNecessary();
+        void createActivationIfNecessary();
         RegisterID* createLazyRegisterIfNecessary(RegisterID*);
 
         bool m_shouldEmitDebugHooks;
@@ -558,6 +562,7 @@ namespace JSC {
 
         int m_globalVarStorageOffset;
 
+        bool m_hasCreatedActivation;
         int m_firstLazyFunction;
         int m_lastLazyFunction;
         HashMap<unsigned int, FunctionBodyNode*, WTF::IntHash<unsigned int>, WTF::UnsignedWithZeroKeyHashTraits<unsigned int> > m_lazyFunctions;
diff --git a/JavaScriptCore/bytecompiler/NodesCodegen.cpp b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
index 2cc1a3f..449cae9 100644
--- a/JavaScriptCore/bytecompiler/NodesCodegen.cpp
+++ b/JavaScriptCore/bytecompiler/NodesCodegen.cpp
@@ -42,7 +42,7 @@
 #include "RegExpCache.h"
 #include "RegExpObject.h"
 #include "SamplingTool.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include <wtf/Assertions.h>
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/Threading.h>
@@ -80,7 +80,7 @@ static void substitute(UString& string, const UString& substring)
 {
     size_t position = string.find("%s");
     ASSERT(position != notFound);
-    string = makeString(string.substringSharingImpl(0, position), substring, string.substringSharingImpl(position + 2));
+    string = makeUString(string.substringSharingImpl(0, position), substring, string.substringSharingImpl(position + 2));
 }
 
 RegisterID* ThrowableExpressionData::emitThrowError(BytecodeGenerator& generator, bool isReferenceError, const char* message)
@@ -371,7 +371,7 @@ RegisterID* FunctionCallValueNode::emitBytecode(BytecodeGenerator& generator, Re
 {
     RefPtr<RegisterID> func = generator.emitNode(m_expr);
     CallArguments callArguments(generator, m_args);
-    generator.emitLoad(callArguments.thisRegister(), jsNull());
+    generator.emitLoad(callArguments.thisRegister(), jsUndefined());
     return generator.emitCall(generator.finalDestinationOrIgnored(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());
 }
 
@@ -381,7 +381,7 @@ RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator,
 {
     if (RefPtr<RegisterID> local = generator.registerFor(m_ident)) {
         CallArguments callArguments(generator, m_args);
-        generator.emitLoad(callArguments.thisRegister(), jsNull());
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
         return generator.emitCall(generator.finalDestinationOrIgnored(dst, callArguments.thisRegister()), local.get(), callArguments, divot(), startOffset(), endOffset());
     }
 
@@ -392,7 +392,7 @@ RegisterID* FunctionCallResolveNode::emitBytecode(BytecodeGenerator& generator,
     if (generator.findScopedProperty(m_ident, index, depth, false, requiresDynamicChecks, globalObject) && index != missingSymbolMarker() && !requiresDynamicChecks) {
         RefPtr<RegisterID> func = generator.emitGetScopedVar(generator.newTemporary(), depth, index, globalObject);
         CallArguments callArguments(generator, m_args);
-        generator.emitLoad(callArguments.thisRegister(), jsNull());
+        generator.emitLoad(callArguments.thisRegister(), jsUndefined());
         return generator.emitCall(generator.finalDestinationOrIgnored(dst, func.get()), func.get(), callArguments, divot(), startOffset(), endOffset());
     }
 
@@ -455,7 +455,7 @@ RegisterID* CallFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator,
         } else {
             RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
             CallArguments callArguments(generator, m_args);
-            generator.emitLoad(callArguments.thisRegister(), jsNull());
+            generator.emitLoad(callArguments.thisRegister(), jsUndefined());
             generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());
             generator.emitJump(end.get());
         }
@@ -513,7 +513,7 @@ RegisterID* ApplyFunctionCallDotNode::emitBytecode(BytecodeGenerator& generator,
             } else {
                 RefPtr<RegisterID> realFunction = generator.emitMove(generator.tempDestination(dst), base.get());
                 CallArguments callArguments(generator, m_args);
-                generator.emitLoad(callArguments.thisRegister(), jsNull());
+                generator.emitLoad(callArguments.thisRegister(), jsUndefined());
                 generator.emitCall(finalDestinationOrIgnored.get(), realFunction.get(), callArguments, divot(), startOffset(), endOffset());
             }
         } else {
@@ -1231,7 +1231,7 @@ RegisterID* AssignResolveNode::emitBytecode(BytecodeGenerator& generator, Regist
         return value;
     }
 
-    RefPtr<RegisterID> base = generator.emitResolveBase(generator.newTemporary(), m_ident);
+    RefPtr<RegisterID> base = generator.emitResolveBaseForPut(generator.newTemporary(), m_ident);
     if (dst == generator.ignoredResult())
         dst = 0;
     RegisterID* value = generator.emitNode(dst, m_right);
@@ -1605,7 +1605,7 @@ RegisterID* ForInNode::emitBytecode(BytecodeGenerator& generator, RegisterID* ds
         if (!propertyName) {
             propertyName = generator.newTemporary();
             RefPtr<RegisterID> protect = propertyName;
-            RegisterID* base = generator.emitResolveBase(generator.newTemporary(), ident);
+            RegisterID* base = generator.emitResolveBaseForPut(generator.newTemporary(), ident);
 
             generator.emitExpressionInfo(divot(), startOffset(), endOffset());
             generator.emitPutById(base, ident, propertyName);
diff --git a/JavaScriptCore/debugger/Debugger.cpp b/JavaScriptCore/debugger/Debugger.cpp
index cbcbd21..17dfdf7 100644
--- a/JavaScriptCore/debugger/Debugger.cpp
+++ b/JavaScriptCore/debugger/Debugger.cpp
@@ -101,7 +101,7 @@ JSValue evaluateInGlobalCallFrame(const UString& script, JSValue& exception, JSG
 {
     CallFrame* globalCallFrame = globalObject->globalExec();
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(globalCallFrame, makeSource(script));
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(globalCallFrame, makeSource(script), false);
     JSObject* error = eval->compile(globalCallFrame, globalCallFrame->scopeChain());
     if (error)
         return error;
diff --git a/JavaScriptCore/debugger/DebuggerCallFrame.cpp b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
index 32f65dd..c98c7cc 100644
--- a/JavaScriptCore/debugger/DebuggerCallFrame.cpp
+++ b/JavaScriptCore/debugger/DebuggerCallFrame.cpp
@@ -88,7 +88,7 @@ JSValue DebuggerCallFrame::evaluate(const UString& script, JSValue& exception) c
     if (!m_callFrame->codeBlock())
         return JSValue();
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(m_callFrame, makeSource(script));
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(m_callFrame, makeSource(script), m_callFrame->codeBlock()->isStrictMode());
     JSObject* error = eval->compile(m_callFrame, m_callFrame->scopeChain());
     if (error)
         return error;
diff --git a/JavaScriptCore/interpreter/Interpreter.cpp b/JavaScriptCore/interpreter/Interpreter.cpp
index 5943ece..632571d 100644
--- a/JavaScriptCore/interpreter/Interpreter.cpp
+++ b/JavaScriptCore/interpreter/Interpreter.cpp
@@ -59,6 +59,7 @@
 #include "RegExpPrototype.h"
 #include "Register.h"
 #include "SamplingTool.h"
+#include "StrictEvalActivation.h"
 #include <limits.h>
 #include <stdio.h>
 #include <wtf/Threading.h>
@@ -127,6 +128,12 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
     ScopeChainIterator iter = scopeChain->begin();
     ScopeChainIterator end = scopeChain->end();
     ASSERT(iter != end);
+    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        if (callFrame->r(codeBlock->activationRegister()).jsValue())
+            ++iter;
+    }
     while (skip--) {
         ++iter;
         ASSERT(iter != end);
@@ -140,6 +147,7 @@ NEVER_INLINE bool Interpreter::resolveSkip(CallFrame* callFrame, Instruction* vP
             exceptionValue = callFrame->globalData().exception;
             if (exceptionValue)
                 return false;
+            ASSERT(result);
             callFrame->r(dst) = JSValue(result);
             return true;
         }
@@ -203,6 +211,12 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     ScopeChainIterator iter = scopeChain->begin();
     ScopeChainIterator end = scopeChain->end();
     ASSERT(iter != end);
+    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        if (callFrame->r(codeBlock->activationRegister()).jsValue())
+            ++iter;
+    }
     while (skip--) {
         JSObject* o = *iter;
         if (o->hasCustomProperties()) {
@@ -214,6 +228,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
                     exceptionValue = callFrame->globalData().exception;
                     if (exceptionValue)
                         return false;
+                    ASSERT(result);
                     callFrame->r(dst) = JSValue(result);
                     return true;
                 }
@@ -230,6 +245,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
     
     if (structure == globalObject->structure()) {
         callFrame->r(dst) = JSValue(globalObject->getDirectOffset(offset));
+        ASSERT(callFrame->r(dst).jsValue());
         return true;
     }
 
@@ -243,6 +259,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
             globalObject->structure()->ref();
             vPC[3] = globalObject->structure();
             vPC[4] = slot.cachedOffset();
+            ASSERT(result);
             callFrame->r(dst) = JSValue(result);
             return true;
         }
@@ -250,6 +267,7 @@ NEVER_INLINE bool Interpreter::resolveGlobalDynamic(CallFrame* callFrame, Instru
         exceptionValue = callFrame->globalData().exception;
         if (exceptionValue)
             return false;
+        ASSERT(result);
         callFrame->r(dst) = JSValue(result);
         return true;
     }
@@ -262,7 +280,14 @@ NEVER_INLINE void Interpreter::resolveBase(CallFrame* callFrame, Instruction* vP
 {
     int dst = vPC[1].u.operand;
     int property = vPC[2].u.operand;
-    callFrame->r(dst) = JSValue(JSC::resolveBase(callFrame, callFrame->codeBlock()->identifier(property), callFrame->scopeChain()));
+    bool isStrictPut = vPC[3].u.operand;
+    Identifier ident = callFrame->codeBlock()->identifier(property);
+    JSValue result = JSC::resolveBase(callFrame, ident, callFrame->scopeChain(), isStrictPut);
+    if (!result) {
+        callFrame->r(dst) = result;
+        ASSERT(callFrame->r(dst).jsValue());
+    } else
+        callFrame->globalData().exception = createErrorForInvalidGlobalAssignment(callFrame, ident.ustring());
 }
 
 NEVER_INLINE bool Interpreter::resolveBaseAndProperty(CallFrame* callFrame, Instruction* vPC, JSValue& exceptionValue)
@@ -371,14 +396,18 @@ NEVER_INLINE JSValue Interpreter::callEval(CallFrame* callFrame, RegisterFile* r
     UString programSource = asString(program)->value(callFrame);
     if (callFrame->hadException())
         return JSValue();
-
-    LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
-    if (JSValue parsedObject = preparser.tryLiteralParse())
-        return parsedObject;
+    
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    if (!codeBlock->isStrictMode()) {
+        // FIXME: We can use the preparser in strict mode, we just need additional logic
+        // to prevent duplicates.
+        LiteralParser preparser(callFrame, programSource, LiteralParser::NonStrictJSON);
+        if (JSValue parsedObject = preparser.tryLiteralParse())
+            return parsedObject;
+    }
 
     ScopeChainNode* scopeChain = callFrame->scopeChain();
-    CodeBlock* codeBlock = callFrame->codeBlock();
-    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, programSource, scopeChain, exceptionValue);
+    RefPtr<EvalExecutable> eval = codeBlock->evalCodeCache().get(callFrame, codeBlock->isStrictMode(), programSource, scopeChain, exceptionValue);
 
     JSValue result = jsUndefined();
     if (eval)
@@ -535,13 +564,19 @@ NEVER_INLINE bool Interpreter::unwindCallFrame(CallFrame*& callFrame, JSValue ex
 
     // If this call frame created an activation or an 'arguments' object, tear it off.
     if (oldCodeBlock->codeType() == FunctionCode && oldCodeBlock->needsFullScopeChain()) {
+        if (!callFrame->r(oldCodeBlock->activationRegister()).jsValue()) {
+            oldCodeBlock->createActivation(callFrame);
+            scopeChain = callFrame->scopeChain();
+        }
         while (!scopeChain->object->inherits(&JSActivation::info))
             scopeChain = scopeChain->pop();
         JSActivation* activation = asActivation(scopeChain->object);
         activation->copyRegisters();
-        if (JSValue arguments = callFrame->r(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue())
-            asArguments(arguments)->setActivation(activation);
-    } else if (oldCodeBlock->usesArguments()) {
+        if (JSValue arguments = callFrame->r(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue()) {
+            if (!oldCodeBlock->isStrictMode())
+                asArguments(arguments)->setActivation(activation);
+        }
+    } else if (oldCodeBlock->usesArguments() && !oldCodeBlock->isStrictMode()) {
         if (JSValue arguments = callFrame->r(unmodifiedArgumentsRegister(oldCodeBlock->argumentsRegister())).jsValue())
             asArguments(arguments)->copyRegisters();
     }
@@ -641,12 +676,23 @@ NEVER_INLINE HandlerInfo* Interpreter::throwException(CallFrame*& callFrame, JSV
     }
 
     // Shrink the JS stack, in case stack overflow made it huge.
-    m_registerFile.shrink(callFrame->registers() + callFrame->codeBlock()->m_numCalleeRegisters);
+    Register* highWaterMark = callFrame->registers() + callFrame->codeBlock()->m_numCalleeRegisters;
+    for (CallFrame* callerFrame = callFrame->callerFrame()->removeHostCallFrameFlag(); callerFrame; callerFrame = callerFrame->callerFrame()->removeHostCallFrameFlag()) {
+        CodeBlock* codeBlock = callerFrame->codeBlock();
+        if (!codeBlock)
+            continue;
+        Register* callerHighWaterMark = callerFrame->registers() + codeBlock->m_numCalleeRegisters;
+        highWaterMark = max(highWaterMark, callerHighWaterMark);
+    }
+    m_registerFile.shrink(highWaterMark);
 
     // Unwind the scope chain within the exception handler's call frame.
     ScopeChainNode* scopeChain = callFrame->scopeChain();
     ScopeChain sc(scopeChain);
-    int scopeDelta = depth(codeBlock, sc) - handler->scopeDepth;
+    int scopeDelta = 0;
+    if (!codeBlock->needsFullScopeChain() || codeBlock->codeType() != FunctionCode 
+        || callFrame->r(codeBlock->activationRegister()).jsValue())
+        scopeDelta = depth(codeBlock, sc) - handler->scopeDepth;
     ASSERT(scopeDelta >= 0);
     while (scopeDelta--)
         scopeChain = scopeChain->pop();
@@ -1036,7 +1082,7 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     }
     EvalCodeBlock* codeBlock = &eval->generatedBytecode();
 
-    JSVariableObject* variableObject;
+    JSObject* variableObject;
     for (ScopeChainNode* node = scopeChain; ; node = node->next) {
         ASSERT(node);
         if (node->object->isVariableObject()) {
@@ -1047,7 +1093,13 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
 
     unsigned numVariables = codeBlock->numVariables();
     int numFunctions = codeBlock->numberOfFunctionDecls();
+    bool pushedScope = false;
     if (numVariables || numFunctions) {
+        if (codeBlock->isStrictMode()) {
+            variableObject = new (callFrame) StrictEvalActivation(callFrame);
+            scopeChain = scopeChain->push(variableObject);
+            pushedScope = true;
+        }
         // Scope for BatchedTransitionOptimizer
         BatchedTransitionOptimizer optimizer(variableObject);
 
@@ -1070,6 +1122,8 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
     Register* newEnd = m_registerFile.start() + globalRegisterOffset + codeBlock->m_numCalleeRegisters;
     if (!m_registerFile.grow(newEnd)) {
         *exception = createStackOverflowError(callFrame);
+        if (pushedScope)
+            scopeChain->pop();
         return jsNull();
     }
 
@@ -1112,6 +1166,8 @@ JSValue Interpreter::execute(EvalExecutable* eval, CallFrame* callFrame, JSObjec
         (*profiler)->didExecute(callFrame, eval->sourceURL(), eval->lineNo());
 
     m_registerFile.shrink(oldEnd);
+    if (pushedScope)
+        scopeChain->pop();
     return result;
 }
 
@@ -1518,6 +1574,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         */
         int dst = vPC[1].u.operand;
         int src = vPC[2].u.operand;
+        
         callFrame->r(dst) = callFrame->r(src);
 
         vPC += OPCODE_LENGTH(op_mov);
@@ -2327,6 +2384,13 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ScopeChainIterator iter = scopeChain->begin();
         ScopeChainIterator end = scopeChain->end();
         ASSERT(iter != end);
+        ASSERT(codeBlock == callFrame->codeBlock());
+        bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+        ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+            if (callFrame->r(codeBlock->activationRegister()).jsValue())
+                ++iter;
+        }
         while (skip--) {
             ++iter;
             ASSERT(iter != end);
@@ -2334,6 +2398,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
         callFrame->r(dst) = scope->registerAt(index);
+        ASSERT(callFrame->r(dst).jsValue());
         vPC += OPCODE_LENGTH(op_get_scoped_var);
         NEXT_INSTRUCTION();
     }
@@ -2348,7 +2413,14 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         ScopeChainNode* scopeChain = callFrame->scopeChain();
         ScopeChainIterator iter = scopeChain->begin();
         ScopeChainIterator end = scopeChain->end();
+        ASSERT(codeBlock == callFrame->codeBlock());
         ASSERT(iter != end);
+        bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+        ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+            if (callFrame->r(codeBlock->activationRegister()).jsValue())
+                ++iter;
+        }
         while (skip--) {
             ++iter;
             ASSERT(iter != end);
@@ -2356,6 +2428,7 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
 
         ASSERT((*iter)->isVariableObject());
         JSVariableObject* scope = static_cast<JSVariableObject*>(*iter);
+        ASSERT(callFrame->r(value).jsValue());
         scope->registerAt(index) = JSValue(callFrame->r(value).jsValue());
         vPC += OPCODE_LENGTH(op_put_scoped_var);
         NEXT_INSTRUCTION();
@@ -2373,6 +2446,24 @@ JSValue Interpreter::privateExecute(ExecutionFlag flag, RegisterFile* registerFi
         vPC += OPCODE_LENGTH(op_resolve_base);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_ensure_property_exists) {
+        /* ensure_property_exists base(r) property(id)
+
+           Throws an exception if property does not exist on base
+         */
+        int base = vPC[1].u.operand;
+        int property = vPC[2].u.operand;
+        Identifier& ident = codeBlock->identifier(property);
+        
+        JSValue baseVal = callFrame->r(base).jsValue();
+        JSObject* baseObject = asObject(baseVal);
+        PropertySlot slot(baseVal);
+        if (!baseObject->getPropertySlot(callFrame, ident, slot)) {
+            exceptionValue = createErrorForInvalidGlobalAssignment(callFrame, ident.ustring());
+            goto vm_throw;
+        }
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_resolve_with_base) {
         /* resolve_with_base baseDst(r) propDst(r) property(id)
 
@@ -2922,7 +3013,7 @@ skip_id_custom_self:
 
         JSValue baseValue = callFrame->r(base).jsValue();
         Identifier& ident = codeBlock->identifier(property);
-        PutPropertySlot slot;
+        PutPropertySlot slot(codeBlock->isStrictMode());
         if (direct) {
             baseValue.putDirect(callFrame, ident, callFrame->r(value).jsValue(), slot);
             ASSERT(slot.base() == baseValue);
@@ -3038,7 +3129,7 @@ skip_id_custom_self:
 
         JSValue baseValue = callFrame->r(base).jsValue();
         Identifier& ident = codeBlock->identifier(property);
-        PutPropertySlot slot;
+        PutPropertySlot slot(codeBlock->isStrictMode());
         if (direct) {
             baseValue.putDirect(callFrame, ident, callFrame->r(value).jsValue(), slot);
             ASSERT(slot.base() == baseValue);
@@ -3063,9 +3154,13 @@ skip_id_custom_self:
 
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame);
         Identifier& ident = codeBlock->identifier(property);
-        JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, ident));
+        bool result = baseObj->deleteProperty(callFrame, ident);
+        if (!result && codeBlock->isStrictMode()) {
+            exceptionValue = createTypeError(callFrame, "Unable to delete property.");
+            goto vm_throw;
+        }
         CHECK_FOR_EXCEPTION();
-        callFrame->r(dst) = result;
+        callFrame->r(dst) = jsBoolean(result);
         vPC += OPCODE_LENGTH(op_del_by_id);
         NEXT_INSTRUCTION();
     }
@@ -3131,8 +3226,8 @@ skip_id_custom_self:
         }
         if (!arguments) {
             Arguments* arguments = new (globalData) Arguments(callFrame);
-            callFrame->r(dst) = JSValue(arguments);
-            callFrame->r(unmodifiedArgumentsRegister(dst)) = JSValue(arguments);
+            callFrame->r(argumentsRegister) = JSValue(arguments);
+            callFrame->r(unmodifiedArgumentsRegister(argumentsRegister)) = JSValue(arguments);
         }
         // fallthrough
     }
@@ -3218,7 +3313,7 @@ skip_id_custom_self:
         } else {
             Identifier property(callFrame, subscript.toString(callFrame));
             if (!globalData->exception) { // Don't put to an object if toString threw an exception.
-                PutPropertySlot slot;
+                PutPropertySlot slot(codeBlock->isStrictMode());
                 baseValue.put(callFrame, property, callFrame->r(value).jsValue(), slot);
             }
         }
@@ -3242,19 +3337,22 @@ skip_id_custom_self:
         JSObject* baseObj = callFrame->r(base).jsValue().toObject(callFrame); // may throw
 
         JSValue subscript = callFrame->r(property).jsValue();
-        JSValue result;
+        bool result;
         uint32_t i;
         if (subscript.getUInt32(i))
-            result = jsBoolean(baseObj->deleteProperty(callFrame, i));
+            result = baseObj->deleteProperty(callFrame, i);
         else {
             CHECK_FOR_EXCEPTION();
             Identifier property(callFrame, subscript.toString(callFrame));
             CHECK_FOR_EXCEPTION();
-            result = jsBoolean(baseObj->deleteProperty(callFrame, property));
+            result = baseObj->deleteProperty(callFrame, property);
+        }
+        if (!result && codeBlock->isStrictMode()) {
+            exceptionValue = createTypeError(callFrame, "Unable to delete property.");
+            goto vm_throw;
         }
-
         CHECK_FOR_EXCEPTION();
-        callFrame->r(dst) = result;
+        callFrame->r(dst) = jsBoolean(result);
         vPC += OPCODE_LENGTH(op_del_by_val);
         NEXT_INSTRUCTION();
     }
@@ -3658,7 +3756,7 @@ skip_id_custom_self:
         int dst = vPC[1].u.operand;
         int func = vPC[2].u.operand;
         int shouldCheck = vPC[3].u.operand;
-
+        ASSERT(codeBlock->codeType() != FunctionCode || !codeBlock->needsFullScopeChain() || callFrame->r(codeBlock->activationRegister()).jsValue());
         if (!shouldCheck || !callFrame->r(dst).jsValue())
             callFrame->r(dst) = JSValue(codeBlock->functionDecl(func)->make(callFrame, callFrame->scopeChain()));
 
@@ -3675,7 +3773,8 @@ skip_id_custom_self:
         */
         int dst = vPC[1].u.operand;
         int funcIndex = vPC[2].u.operand;
-
+        
+        ASSERT(codeBlock->codeType() != FunctionCode || !codeBlock->needsFullScopeChain() || callFrame->r(codeBlock->activationRegister()).jsValue());
         FunctionExecutable* function = codeBlock->functionExpr(funcIndex);
         JSFunction* func = function->make(callFrame, callFrame->scopeChain());
 
@@ -3711,7 +3810,8 @@ skip_id_custom_self:
         int func = vPC[1].u.operand;
         int argCount = vPC[2].u.operand;
         int registerOffset = vPC[3].u.operand;
-
+        
+        ASSERT(codeBlock->codeType() != FunctionCode || !codeBlock->needsFullScopeChain() || callFrame->r(codeBlock->activationRegister()).jsValue());
         JSValue funcVal = callFrame->r(func).jsValue();
 
         Register* newCallFrame = callFrame->registers() + registerOffset;
@@ -3980,15 +4080,22 @@ skip_id_custom_self:
            This opcode appears before op_ret in functions that require full scope chains.
         */
 
-        int src1 = vPC[1].u.operand;
-        int src2 = vPC[2].u.operand;
+        int activation = vPC[1].u.operand;
+        int arguments = vPC[2].u.operand;
         ASSERT(codeBlock->needsFullScopeChain());
-
-        JSActivation* activation = asActivation(callFrame->r(src1).jsValue());
-        activation->copyRegisters();
-
-        if (JSValue arguments = callFrame->r(unmodifiedArgumentsRegister(src2)).jsValue())
-            asArguments(arguments)->setActivation(activation);
+        JSValue activationValue = callFrame->r(activation).jsValue();
+        if (activationValue) {
+            asActivation(activationValue)->copyRegisters();
+
+            if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue())
+                asArguments(argumentsValue)->setActivation(asActivation(activationValue));
+        } else if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue())
+            asArguments(argumentsValue)->copyRegisters();
+
+        if (JSValue argumentsValue = callFrame->r(unmodifiedArgumentsRegister(arguments)).jsValue()) {
+            if (!codeBlock->isStrictMode())
+                asArguments(argumentsValue)->setActivation(asActivation(activationValue));
+        }
 
         vPC += OPCODE_LENGTH(op_tear_off_activation);
         NEXT_INSTRUCTION();
@@ -4026,7 +4133,7 @@ skip_id_custom_self:
 
         int result = vPC[1].u.operand;
 
-        if (callFrame->codeBlock()->needsFullScopeChain())
+        if (callFrame->codeBlock()->needsFullScopeChain() && callFrame->r(codeBlock->activationRegister()).jsValue())
             callFrame->scopeChain()->deref();
 
         JSValue returnValue = callFrame->r(result).jsValue();
@@ -4067,7 +4174,7 @@ skip_id_custom_self:
 
         int result = vPC[1].u.operand;
 
-        if (codeBlock->needsFullScopeChain())
+        if (codeBlock->needsFullScopeChain() && callFrame->r(codeBlock->activationRegister()).jsValue())
             callFrame->scopeChain()->deref();
 
         JSValue returnValue = callFrame->r(result).jsValue();
@@ -4103,25 +4210,20 @@ skip_id_custom_self:
         vPC += OPCODE_LENGTH(op_enter);
         NEXT_INSTRUCTION();
     }
-    DEFINE_OPCODE(op_enter_with_activation) {
-        /* enter_with_activation dst(r)
-
-           Initializes local variables to undefined, creates an activation object,
-           places it in dst, and pushes it onto the scope chain.
+    DEFINE_OPCODE(op_create_activation) {
+        /* create_activation dst(r)
 
-           This opcode appears only at the beginning of a code block.
+           If the activation object for this callframe has not yet been created,
+           this creates it and writes it back to dst.
         */
 
-        size_t i = 0;
-        for (size_t count = codeBlock->m_numVars; i < count; ++i)
-            callFrame->r(i) = jsUndefined();
-
-        int dst = vPC[1].u.operand;
-        JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
-        callFrame->r(dst) = JSValue(activation);
-        callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
-
-        vPC += OPCODE_LENGTH(op_enter_with_activation);
+        int activationReg = vPC[1].u.operand;
+        if (!callFrame->r(activationReg).jsValue()) {
+            JSActivation* activation = new (globalData) JSActivation(callFrame, static_cast<FunctionExecutable*>(codeBlock->ownerExecutable()));
+            callFrame->r(activationReg) = JSValue(activation);
+            callFrame->setScopeChain(callFrame->scopeChain()->copy()->push(activation));
+        }
+        vPC += OPCODE_LENGTH(op_create_activation);
         NEXT_INSTRUCTION();
     }
     DEFINE_OPCODE(op_get_callee) {
@@ -4184,6 +4286,25 @@ skip_id_custom_self:
         vPC += OPCODE_LENGTH(op_convert_this);
         NEXT_INSTRUCTION();
     }
+    DEFINE_OPCODE(op_convert_this_strict) {
+        /* convert_this_strict this(r)
+         
+         Takes the value in the 'this' register, and converts it to
+         its "this" form if (and only if) "this" is an object with a
+         custom this conversion
+         
+         This opcode should only be used at the beginning of a code
+         block.
+         */
+        
+        int thisRegister = vPC[1].u.operand;
+        JSValue thisVal = callFrame->r(thisRegister).jsValue();
+        if (thisVal.isObject() && thisVal.needsThisConversion())
+            callFrame->r(thisRegister) = JSValue(thisVal.toStrictThisObject(callFrame));
+        
+        vPC += OPCODE_LENGTH(op_convert_this_strict);
+        NEXT_INSTRUCTION();
+    }
     DEFINE_OPCODE(op_init_lazy_reg) {
         /* init_lazy_reg dst(r)
 
diff --git a/JavaScriptCore/jit/ExecutableAllocator.h b/JavaScriptCore/jit/ExecutableAllocator.h
index f145404..f362605 100644
--- a/JavaScriptCore/jit/ExecutableAllocator.h
+++ b/JavaScriptCore/jit/ExecutableAllocator.h
@@ -53,6 +53,12 @@
 extern "C" __declspec(dllimport) void CacheRangeFlush(LPVOID pAddr, DWORD dwLength, DWORD dwFlags);
 #endif
 
+#if PLATFORM(BREWMP)
+#include <AEEIMemCache1.h>
+#include <AEEMemCache1.bid>
+#include <wtf/brew/RefPtrBrew.h>
+#endif
+
 #define JIT_ALLOCATOR_PAGE_SIZE (ExecutableAllocator::pageSize)
 #define JIT_ALLOCATOR_LARGE_ALLOC_SIZE (ExecutableAllocator::pageSize * 4)
 
@@ -294,6 +300,13 @@ public:
     {
         CacheRangeFlush(code, size, CACHE_SYNC_ALL);
     }
+#elif PLATFORM(BREWMP)
+    static void cacheFlush(void* code, size_t size)
+    {
+        PlatformRefPtr<IMemCache1> memCache = createRefPtrInstance<IMemCache1>(AEECLSID_MemCache1);
+        IMemCache1_ClearCache(memCache.get(), reinterpret_cast<uint32>(code), size, MEMSPACE_CACHE_FLUSH, MEMSPACE_DATACACHE);
+        IMemCache1_ClearCache(memCache.get(), reinterpret_cast<uint32>(code), size, MEMSPACE_CACHE_INVALIDATE, MEMSPACE_INSTCACHE);
+    }
 #else
     #error "The cacheFlush support is missing on this platform."
 #endif
diff --git a/JavaScriptCore/jit/JIT.cpp b/JavaScriptCore/jit/JIT.cpp
index a508d0c..0eabdf5 100644
--- a/JavaScriptCore/jit/JIT.cpp
+++ b/JavaScriptCore/jit/JIT.cpp
@@ -186,7 +186,7 @@ void JIT::privateCompileMainPass()
             sampleInstruction(currentInstruction);
 #endif
 
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
         if (m_labels[m_bytecodeOffset].isUsed())
             killLastResultRegister();
 #endif
@@ -195,9 +195,6 @@ void JIT::privateCompileMainPass()
 
         switch (m_interpreter->getOpcodeID(currentInstruction->u.opcode)) {
         DEFINE_BINARY_OP(op_del_by_val)
-#if USE(JSVALUE32)
-        DEFINE_BINARY_OP(op_div)
-#endif
         DEFINE_BINARY_OP(op_in)
         DEFINE_BINARY_OP(op_less)
         DEFINE_BINARY_OP(op_lesseq)
@@ -207,7 +204,7 @@ void JIT::privateCompileMainPass()
         DEFINE_UNARY_OP(op_is_object)
         DEFINE_UNARY_OP(op_is_string)
         DEFINE_UNARY_OP(op_is_undefined)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
         DEFINE_UNARY_OP(op_negate)
 #endif
         DEFINE_UNARY_OP(op_typeof)
@@ -225,16 +222,15 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_get_callee)
         DEFINE_OP(op_create_this)
         DEFINE_OP(op_convert_this)
+        DEFINE_OP(op_convert_this_strict)
         DEFINE_OP(op_init_lazy_reg)
         DEFINE_OP(op_create_arguments)
         DEFINE_OP(op_debug)
         DEFINE_OP(op_del_by_id)
-#if !USE(JSVALUE32)
         DEFINE_OP(op_div)
-#endif
         DEFINE_OP(op_end)
         DEFINE_OP(op_enter)
-        DEFINE_OP(op_enter_with_activation)
+        DEFINE_OP(op_create_activation)
         DEFINE_OP(op_eq)
         DEFINE_OP(op_eq_null)
         DEFINE_OP(op_get_by_id)
@@ -301,6 +297,7 @@ void JIT::privateCompileMainPass()
         DEFINE_OP(op_put_setter)
         DEFINE_OP(op_resolve)
         DEFINE_OP(op_resolve_base)
+        DEFINE_OP(op_ensure_property_exists)
         DEFINE_OP(op_resolve_global)
         DEFINE_OP(op_resolve_global_dynamic)
         DEFINE_OP(op_resolve_skip)
@@ -375,7 +372,7 @@ void JIT::privateCompileSlowCases()
     m_callLinkInfoIndex = 0;
 
     for (Vector<SlowCaseEntry>::iterator iter = m_slowCases.begin(); iter != m_slowCases.end();) {
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
         killLastResultRegister();
 #endif
 
@@ -396,9 +393,8 @@ void JIT::privateCompileSlowCases()
         DEFINE_SLOWCASE_OP(op_call_varargs)
         DEFINE_SLOWCASE_OP(op_construct)
         DEFINE_SLOWCASE_OP(op_convert_this)
-#if !USE(JSVALUE32)
+        DEFINE_SLOWCASE_OP(op_convert_this_strict)
         DEFINE_SLOWCASE_OP(op_div)
-#endif
         DEFINE_SLOWCASE_OP(op_eq)
         DEFINE_SLOWCASE_OP(op_get_by_id)
         DEFINE_SLOWCASE_OP(op_get_arguments_length)
@@ -596,7 +592,7 @@ JITCode JIT::privateCompile(CodePtr* functionEntryArityCheck)
     return patchBuffer.finalizeCode();
 }
 
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 void JIT::emitGetVariableObjectRegister(RegisterID variableObject, int index, RegisterID dst)
 {
     loadPtr(Address(variableObject, OBJECT_OFFSETOF(JSVariableObject, d)), dst);
diff --git a/JavaScriptCore/jit/JIT.h b/JavaScriptCore/jit/JIT.h
index 6b2e70e..3ef0538 100644
--- a/JavaScriptCore/jit/JIT.h
+++ b/JavaScriptCore/jit/JIT.h
@@ -516,8 +516,7 @@ namespace JSC {
         Jump emitJumpIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID);
         void emitJumpSlowCaseIfNotJSCell(RegisterID, int VReg);
-#if USE(JSVALUE64)
-#else
+#if USE(JSVALUE32_64)
         JIT::Jump emitJumpIfImmediateNumber(RegisterID reg)
         {
             return emitJumpIfImmediateInteger(reg);
@@ -535,7 +534,7 @@ namespace JSC {
         void emitJumpSlowCaseIfNotImmediateNumber(RegisterID);
         void emitJumpSlowCaseIfNotImmediateIntegers(RegisterID, RegisterID, RegisterID);
 
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32_64)
         void emitFastArithDeTagImmediate(RegisterID);
         Jump emitFastArithDeTagImmediateJumpIfZero(RegisterID);
 #endif
@@ -738,13 +737,14 @@ namespace JSC {
         void emit_op_get_callee(Instruction*);
         void emit_op_create_this(Instruction*);
         void emit_op_convert_this(Instruction*);
+        void emit_op_convert_this_strict(Instruction*);
         void emit_op_create_arguments(Instruction*);
         void emit_op_debug(Instruction*);
         void emit_op_del_by_id(Instruction*);
         void emit_op_div(Instruction*);
         void emit_op_end(Instruction*);
         void emit_op_enter(Instruction*);
-        void emit_op_enter_with_activation(Instruction*);
+        void emit_op_create_activation(Instruction*);
         void emit_op_eq(Instruction*);
         void emit_op_eq_null(Instruction*);
         void emit_op_get_by_id(Instruction*);
@@ -810,6 +810,7 @@ namespace JSC {
         void emit_op_put_setter(Instruction*);
         void emit_op_resolve(Instruction*);
         void emit_op_resolve_base(Instruction*);
+        void emit_op_ensure_property_exists(Instruction*);
         void emit_op_resolve_global(Instruction*, bool dynamic = false);
         void emit_op_resolve_global_dynamic(Instruction*);
         void emit_op_resolve_skip(Instruction*);
@@ -845,6 +846,7 @@ namespace JSC {
         void emitSlow_op_call_varargs(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_construct(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_convert_this(Instruction*, Vector<SlowCaseEntry>::iterator&);
+        void emitSlow_op_convert_this_strict(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_div(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_eq(Instruction*, Vector<SlowCaseEntry>::iterator&);
         void emitSlow_op_get_by_id(Instruction*, Vector<SlowCaseEntry>::iterator&);
diff --git a/JavaScriptCore/jit/JITArithmetic.cpp b/JavaScriptCore/jit/JITArithmetic.cpp
index d75f8b5..d4fa12f 100644
--- a/JavaScriptCore/jit/JITArithmetic.cpp
+++ b/JavaScriptCore/jit/JITArithmetic.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if ENABLE(JIT)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 #include "JIT.h"
 
 #include "CodeBlock.h"
@@ -60,10 +60,6 @@ void JIT::emit_op_lshift(Instruction* currentInstruction)
     emitFastArithImmToInt(regT0);
     emitFastArithImmToInt(regT2);
     lshift32(regT2, regT0);
-#if USE(JSVALUE32)
-    addSlowCase(branchAdd32(Overflow, regT0, regT0));
-    signExtend32ToPtr(regT0, regT0);
-#endif
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(result);
 }
@@ -74,20 +70,10 @@ void JIT::emitSlow_op_lshift(Instruction* currentInstruction, Vector<SlowCaseEnt
     unsigned op1 = currentInstruction[2].u.operand;
     unsigned op2 = currentInstruction[3].u.operand;
 
-#if USE(JSVALUE64)
     UNUSED_PARAM(op1);
     UNUSED_PARAM(op2);
     linkSlowCase(iter);
     linkSlowCase(iter);
-#else
-    // If we are limited to 32-bit immediates there is a third slow case, which required the operands to have been reloaded.
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
-    linkSlowCase(iter);
-    emitGetVirtualRegisters(op1, regT0, op2, regT2);
-    notImm1.link(this);
-    notImm2.link(this);
-#endif
     JITStubCall stubCall(this, cti_op_lshift);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT2);
@@ -110,20 +96,11 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         emitGetVirtualRegisters(op1, regT0, op2, regT2);
         if (supportsFloatingPointTruncate()) {
             Jump lhsIsInt = emitJumpIfImmediateInteger(regT0);
-#if USE(JSVALUE64)
             // supportsFloatingPoint() && USE(JSVALUE64) => 3 SlowCases
             addSlowCase(emitJumpIfNotImmediateNumber(regT0));
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
             addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
-#else
-            // supportsFloatingPoint() && !USE(JSVALUE64) => 5 SlowCases (of which 1 IfNotJSCell)
-            emitJumpSlowCaseIfNotJSCell(regT0, op1);
-            addSlowCase(checkStructure(regT0, m_globalData->numberStructure.get()));
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-            addSlowCase(branchTruncateDoubleToInt32(fpRegT0, regT0));
-            addSlowCase(branchAdd32(Overflow, regT0, regT0));
-#endif
             lhsIsInt.link(this);
             emitJumpSlowCaseIfNotImmediateInteger(regT2);
         } else {
@@ -133,15 +110,8 @@ void JIT::emit_op_rshift(Instruction* currentInstruction)
         }
         emitFastArithImmToInt(regT2);
         rshift32(regT2, regT0);
-#if USE(JSVALUE32)
-        signExtend32ToPtr(regT0, regT0);
-#endif
     }
-#if USE(JSVALUE64)
     emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-    orPtr(Imm32(JSImmediate::TagTypeNumber), regT0);
-#endif
     emitPutVirtualRegister(result);
 }
 
@@ -159,17 +129,9 @@ void JIT::emitSlow_op_rshift(Instruction* currentInstruction, Vector<SlowCaseEnt
         stubCall.addArgument(op2, regT2);
     } else {
         if (supportsFloatingPointTruncate()) {
-#if USE(JSVALUE64)
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-            linkSlowCase(iter);
-#else
-            linkSlowCaseIfNotJSCell(iter, op1);
-            linkSlowCase(iter);
             linkSlowCase(iter);
             linkSlowCase(iter);
             linkSlowCase(iter);
-#endif
             // We're reloading op1 to regT0 as we can no longer guarantee that
             // we have not munged the operand.  It may have already been shifted
             // correctly, but it still will not have been tagged.
@@ -206,10 +168,6 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
         // as an immediate int.
         if (shift < 0 || !(shift & 31))
             addSlowCase(branch32(LessThan, regT0, Imm32(0)));
-#if USE(JSVALUE32)
-        addSlowCase(branchAdd32(Overflow, regT0, regT0));
-        signExtend32ToPtr(regT0, regT0);
-#endif
         emitFastArithReTagImmediate(regT0, regT0);
         emitPutVirtualRegister(dst, regT0);
         return;
@@ -222,10 +180,6 @@ void JIT::emit_op_urshift(Instruction* currentInstruction)
     emitFastArithImmToInt(regT1);
     urshift32(regT1, regT0);
     addSlowCase(branch32(LessThan, regT0, Imm32(0)));
-#if USE(JSVALUE32)
-    addSlowCase(branchAdd32(Overflow, regT0, regT0));
-    signExtend32ToPtr(regT0, regT0);
-#endif
     emitFastArithReTagImmediate(regT0, regT0);
     emitPutVirtualRegister(dst, regT0);
 }
@@ -239,7 +193,6 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
         int shift = getConstantOperand(op2).asInt32();
         // op1 = regT0
         linkSlowCase(iter); // int32 check
-#if USE(JSVALUE64)
         if (supportsFloatingPointTruncate()) {
             JumpList failures;
             failures.append(emitJumpIfNotImmediateNumber(regT0)); // op1 is not a double
@@ -255,18 +208,13 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
             failures.link(this);
         }
-#endif // JSVALUE64
         if (shift < 0 || !(shift & 31))
             linkSlowCase(iter); // failed to box in hot path
-#if USE(JSVALUE32)
-        linkSlowCase(iter); // Couldn't box result
-#endif
     } else {
         // op1 = regT0
         // op2 = regT1
         if (!isOperandConstantImmediateInt(op1)) {
             linkSlowCase(iter); // int32 check -- op1 is not an int
-#if USE(JSVALUE64)
             if (supportsFloatingPointTruncate()) {
                 JumpList failures;
                 failures.append(emitJumpIfNotImmediateNumber(regT0)); // op1 is not a double
@@ -282,14 +230,10 @@ void JIT::emitSlow_op_urshift(Instruction* currentInstruction, Vector<SlowCaseEn
                 emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_rshift));
                 failures.link(this);
             }
-#endif
         }
         
         linkSlowCase(iter); // int32 check - op2 is not an int
         linkSlowCase(iter); // Can't represent unsigned result as an immediate
-#if USE(JSVALUE32)
-        linkSlowCase(iter); // Couldn't box result
-#endif
     }
     
     JITStubCall stubCall(this, cti_op_urshift);
@@ -330,20 +274,12 @@ void JIT::emit_op_jnless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
         addJump(branch32(GreaterThanOrEqual, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
         addJump(branch32(LessThanOrEqual, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
@@ -381,18 +317,9 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-#endif
 
             int32_t op2imm = getConstantOperand(op2).asInt32();;
 
@@ -403,13 +330,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jless);
@@ -422,18 +343,9 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             int32_t op1imm = getConstantOperand(op1).asInt32();;
 
@@ -444,13 +356,7 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jless);
@@ -463,7 +369,6 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
             Jump fail3 = emitJumpIfImmediateInteger(regT1);
@@ -471,37 +376,14 @@ void JIT::emitSlow_op_jnless(Instruction* currentInstruction, Vector<SlowCaseEnt
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT0, fpRegT0);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
-            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             emitJumpSlowToHot(branchDouble(DoubleLessThanOrEqualOrUnordered, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
             fail2.link(this);
             fail3.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2.link(this);
-            fail3.link(this);
-            fail4.link(this);
-#endif
         }
 
         linkSlowCase(iter);
@@ -545,20 +427,12 @@ void JIT::emit_op_jless(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
         addJump(branch32(LessThan, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
         addJump(branch32(GreaterThan, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
@@ -596,18 +470,9 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-#endif
 
             int32_t op2imm = getConstantOperand(op2).asInt32();
 
@@ -618,13 +483,7 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jless);
@@ -637,18 +496,9 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             int32_t op1imm = getConstantOperand(op1).asInt32();
 
@@ -659,13 +509,7 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jless);
@@ -678,7 +522,6 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
             Jump fail3 = emitJumpIfImmediateInteger(regT1);
@@ -686,37 +529,14 @@ void JIT::emitSlow_op_jless(Instruction* currentInstruction, Vector<SlowCaseEntr
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT0, fpRegT0);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
-            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             emitJumpSlowToHot(branchDouble(DoubleLessThan, fpRegT0, fpRegT1), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnless));
 
-#if USE(JSVALUE64)
             fail1.link(this);
             fail2.link(this);
             fail3.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2.link(this);
-            fail3.link(this);
-            fail4.link(this);
-#endif
         }
 
         linkSlowCase(iter);
@@ -760,20 +580,12 @@ void JIT::emit_op_jlesseq(Instruction* currentInstruction, bool invert)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
         addJump(branch32(invert ? GreaterThan : LessThanOrEqual, regT0, Imm32(op2imm)), target);
     } else if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT1);
         emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(JSVALUE64)
         int32_t op1imm = getConstantOperandImmediateInt(op1);
-#else
-        int32_t op1imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)));
-#endif
         addJump(branch32(invert ? LessThan : GreaterThanOrEqual, regT1, Imm32(op1imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
@@ -812,18 +624,9 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             addPtr(tagTypeNumberRegister, regT0);
             movePtrToDouble(regT0, fpRegT0);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2 = checkStructure(regT0, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-#endif
 
             int32_t op2imm = getConstantOperand(op2).asInt32();;
 
@@ -834,13 +637,7 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jlesseq);
@@ -853,18 +650,9 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT1);
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail2 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             int32_t op1imm = getConstantOperand(op1).asInt32();;
 
@@ -875,13 +663,7 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(JSVALUE64)
             fail1.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail1.link(this);
-            fail2.link(this);
-#endif
         }
 
         JITStubCall stubCall(this, cti_op_jlesseq);
@@ -894,7 +676,6 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
         linkSlowCase(iter);
 
         if (supportsFloatingPoint()) {
-#if USE(JSVALUE64)
             Jump fail1 = emitJumpIfNotImmediateNumber(regT0);
             Jump fail2 = emitJumpIfNotImmediateNumber(regT1);
             Jump fail3 = emitJumpIfImmediateInteger(regT1);
@@ -902,37 +683,14 @@ void JIT::emitSlow_op_jlesseq(Instruction* currentInstruction, Vector<SlowCaseEn
             addPtr(tagTypeNumberRegister, regT1);
             movePtrToDouble(regT0, fpRegT0);
             movePtrToDouble(regT1, fpRegT1);
-#else
-            Jump fail1;
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1 = emitJumpIfNotJSCell(regT0);
-
-            Jump fail2;
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2 = emitJumpIfNotJSCell(regT1);
-
-            Jump fail3 = checkStructure(regT0, m_globalData->numberStructure.get());
-            Jump fail4 = checkStructure(regT1, m_globalData->numberStructure.get());
-            loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-            loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-#endif
 
             emitJumpSlowToHot(branchDouble(invert ? DoubleLessThanOrUnordered : DoubleGreaterThanOrEqual, fpRegT1, fpRegT0), target);
 
             emitJumpSlowToHot(jump(), OPCODE_LENGTH(op_jnlesseq));
 
-#if USE(JSVALUE64)
             fail1.link(this);
             fail2.link(this);
             fail3.link(this);
-#else
-            if (!m_codeBlock->isKnownNotImmediate(op1))
-                fail1.link(this);
-            if (!m_codeBlock->isKnownNotImmediate(op2))
-                fail2.link(this);
-            fail3.link(this);
-            fail4.link(this);
-#endif
         }
 
         linkSlowCase(iter);
@@ -963,25 +721,17 @@ void JIT::emit_op_bitand(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op1)) {
         emitGetVirtualRegister(op2, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t imm = getConstantOperandImmediateInt(op1);
         andPtr(Imm32(imm), regT0);
         if (imm >= 0)
             emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op1)))), regT0);
-#endif
     } else if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t imm = getConstantOperandImmediateInt(op2);
         andPtr(Imm32(imm), regT0);
         if (imm >= 0)
             emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-        andPtr(Imm32(static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)))), regT0);
-#endif
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
         andPtr(regT1, regT0);
@@ -1023,13 +773,8 @@ void JIT::emit_op_post_inc(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
     addSlowCase(branchAdd32(Overflow, Imm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
-#else
-    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
-    signExtend32ToPtr(regT1, regT1);
-#endif
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
@@ -1055,13 +800,8 @@ void JIT::emit_op_post_dec(Instruction* currentInstruction)
     emitGetVirtualRegister(srcDst, regT0);
     move(regT0, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
     addSlowCase(branchSub32(Zero, Imm32(1), regT1));
     emitFastArithIntToImmNoCheck(regT1, regT1);
-#else
-    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT1));
-    signExtend32ToPtr(regT1, regT1);
-#endif
     emitPutVirtualRegister(srcDst, regT1);
     emitPutVirtualRegister(result);
 }
@@ -1085,13 +825,8 @@ void JIT::emit_op_pre_inc(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
     addSlowCase(branchAdd32(Overflow, Imm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-    addSlowCase(branchAdd32(Overflow, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
-    signExtend32ToPtr(regT0, regT0);
-#endif
     emitPutVirtualRegister(srcDst);
 }
 
@@ -1114,13 +849,8 @@ void JIT::emit_op_pre_dec(Instruction* currentInstruction)
 
     emitGetVirtualRegister(srcDst, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
     addSlowCase(branchSub32(Zero, Imm32(1), regT0));
     emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-    addSlowCase(branchSub32(Zero, Imm32(1 << JSImmediate::IntegerPayloadShift), regT0));
-    signExtend32ToPtr(regT0, regT0);
-#endif
     emitPutVirtualRegister(srcDst);
 }
 
@@ -1158,22 +888,9 @@ void JIT::emit_op_mod(Instruction* currentInstruction)
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT2);
 
-#if USE(JSVALUE64)
     addSlowCase(branchPtr(Equal, regT2, ImmPtr(JSValue::encode(jsNumber(m_globalData, 0)))));
     m_assembler.cdq();
     m_assembler.idivl_r(regT2);
-#else
-    emitFastArithDeTagImmediate(regT0);
-    addSlowCase(emitFastArithDeTagImmediateJumpIfZero(regT2));
-#if CPU(X86) || CPU(X86_64)
-    m_assembler.cdq();
-    m_assembler.idivl_r(regT2);
-    signExtend32ToPtr(regT1, regT1);
-#elif CPU(MIPS)
-    m_assembler.div(regT0, regT2);
-    m_assembler.mfhi(regT1);
-#endif
-#endif
     emitFastArithReTagImmediate(regT1, regT0);
     emitPutVirtualRegister(result);
 }
@@ -1182,19 +899,9 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
 {
     unsigned result = currentInstruction[1].u.operand;
 
-#if USE(JSVALUE64)
     linkSlowCase(iter);
     linkSlowCase(iter);
     linkSlowCase(iter);
-#else
-    Jump notImm1 = getSlowCase(iter);
-    Jump notImm2 = getSlowCase(iter);
-    linkSlowCase(iter);
-    emitFastArithReTagImmediate(regT0, regT0);
-    emitFastArithReTagImmediate(regT2, regT2);
-    notImm1.link(this);
-    notImm2.link(this);
-#endif
     JITStubCall stubCall(this, cti_op_mod);
     stubCall.addArgument(regT0);
     stubCall.addArgument(regT2);
@@ -1249,8 +956,6 @@ void JIT::emitSlow_op_mod(Instruction* currentInstruction, Vector<SlowCaseEntry>
 
 /* ------------------------------ END: OP_MOD ------------------------------ */
 
-#if USE(JSVALUE64)
-
 /* ------------------------------ BEGIN: USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
 
 void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned, unsigned op1, unsigned op2, OperandTypes)
@@ -1543,310 +1248,9 @@ void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>
     compileBinaryArithOpSlowCase(op_sub, iter, result, op1, op2, types, false, false);
 }
 
-#else // USE(JSVALUE64)
-
-/* ------------------------------ BEGIN: !USE(JSVALUE64) (OP_ADD, OP_SUB, OP_MUL) ------------------------------ */
-
-void JIT::compileBinaryArithOp(OpcodeID opcodeID, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
-{
-    Structure* numberStructure = m_globalData->numberStructure.get();
-    Jump wasJSNumberCell1;
-    Jump wasJSNumberCell2;
-
-    emitGetVirtualRegisters(src1, regT0, src2, regT1);
-
-    if (types.second().isReusable() && supportsFloatingPoint()) {
-        ASSERT(types.second().mightBeNumber());
-
-        // Check op2 is a number
-        Jump op2imm = emitJumpIfImmediateInteger(regT1);
-        if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(regT1, src2);
-            addSlowCase(checkStructure(regT1, numberStructure));
-        }
-
-        // (1) In this case src2 is a reusable number cell.
-        //     Slow case if src1 is not a number type.
-        Jump op1imm = emitJumpIfImmediateInteger(regT0);
-        if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(regT0, src1);
-            addSlowCase(checkStructure(regT0, numberStructure));
-        }
-
-        // (1a) if we get here, src1 is also a number cell
-        loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-        Jump loadedDouble = jump();
-        // (1b) if we get here, src1 is an immediate
-        op1imm.link(this);
-        emitFastArithImmToInt(regT0);
-        convertInt32ToDouble(regT0, fpRegT0);
-        // (1c)
-        loadedDouble.link(this);
-        if (opcodeID == op_add)
-            addDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-        else if (opcodeID == op_sub)
-            subDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-        else {
-            ASSERT(opcodeID == op_mul);
-            mulDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-        }
-
-        // Store the result to the JSNumberCell and jump.
-        storeDouble(fpRegT0, Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)));
-        move(regT1, regT0);
-        emitPutVirtualRegister(dst);
-        wasJSNumberCell2 = jump();
-
-        // (2) This handles cases where src2 is an immediate number.
-        //     Two slow cases - either src1 isn't an immediate, or the subtract overflows.
-        op2imm.link(this);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-    } else if (types.first().isReusable() && supportsFloatingPoint()) {
-        ASSERT(types.first().mightBeNumber());
-
-        // Check op1 is a number
-        Jump op1imm = emitJumpIfImmediateInteger(regT0);
-        if (!types.first().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(regT0, src1);
-            addSlowCase(checkStructure(regT0, numberStructure));
-        }
-
-        // (1) In this case src1 is a reusable number cell.
-        //     Slow case if src2 is not a number type.
-        Jump op2imm = emitJumpIfImmediateInteger(regT1);
-        if (!types.second().definitelyIsNumber()) {
-            emitJumpSlowCaseIfNotJSCell(regT1, src2);
-            addSlowCase(checkStructure(regT1, numberStructure));
-        }
-
-        // (1a) if we get here, src2 is also a number cell
-        loadDouble(Address(regT1, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT1);
-        Jump loadedDouble = jump();
-        // (1b) if we get here, src2 is an immediate
-        op2imm.link(this);
-        emitFastArithImmToInt(regT1);
-        convertInt32ToDouble(regT1, fpRegT1);
-        // (1c)
-        loadedDouble.link(this);
-        loadDouble(Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)), fpRegT0);
-        if (opcodeID == op_add)
-            addDouble(fpRegT1, fpRegT0);
-        else if (opcodeID == op_sub)
-            subDouble(fpRegT1, fpRegT0);
-        else {
-            ASSERT(opcodeID == op_mul);
-            mulDouble(fpRegT1, fpRegT0);
-        }
-        storeDouble(fpRegT0, Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)));
-        emitPutVirtualRegister(dst);
-
-        // Store the result to the JSNumberCell and jump.
-        storeDouble(fpRegT0, Address(regT0, OBJECT_OFFSETOF(JSNumberCell, m_value)));
-        emitPutVirtualRegister(dst);
-        wasJSNumberCell1 = jump();
-
-        // (2) This handles cases where src1 is an immediate number.
-        //     Two slow cases - either src2 isn't an immediate, or the subtract overflows.
-        op1imm.link(this);
-        emitJumpSlowCaseIfNotImmediateInteger(regT1);
-    } else
-        emitJumpSlowCaseIfNotImmediateIntegers(regT0, regT1, regT2);
-
-    if (opcodeID == op_add) {
-        emitFastArithDeTagImmediate(regT0);
-        addSlowCase(branchAdd32(Overflow, regT1, regT0));
-    } else  if (opcodeID == op_sub) {
-        addSlowCase(branchSub32(Overflow, regT1, regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitFastArithReTagImmediate(regT0, regT0);
-    } else {
-        ASSERT(opcodeID == op_mul);
-        // convert eax & edx from JSImmediates to ints, and check if either are zero
-        emitFastArithImmToInt(regT1);
-        Jump op1Zero = emitFastArithDeTagImmediateJumpIfZero(regT0);
-        Jump op2NonZero = branchTest32(NonZero, regT1);
-        op1Zero.link(this);
-        // if either input is zero, add the two together, and check if the result is < 0.
-        // If it is, we have a problem (N < 0), (N * 0) == -0, not representatble as a JSImmediate.
-        move(regT0, regT2);
-        addSlowCase(branchAdd32(Signed, regT1, regT2));
-        // Skip the above check if neither input is zero
-        op2NonZero.link(this);
-        addSlowCase(branchMul32(Overflow, regT1, regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitFastArithReTagImmediate(regT0, regT0);
-    }
-    emitPutVirtualRegister(dst);
-
-    if (types.second().isReusable() && supportsFloatingPoint())
-        wasJSNumberCell2.link(this);
-    else if (types.first().isReusable() && supportsFloatingPoint())
-        wasJSNumberCell1.link(this);
-}
-
-void JIT::compileBinaryArithOpSlowCase(OpcodeID opcodeID, Vector<SlowCaseEntry>::iterator& iter, unsigned dst, unsigned src1, unsigned src2, OperandTypes types)
-{
-    linkSlowCase(iter);
-    if (types.second().isReusable() && supportsFloatingPoint()) {
-        if (!types.first().definitelyIsNumber()) {
-            linkSlowCaseIfNotJSCell(iter, src1);
-            linkSlowCase(iter);
-        }
-        if (!types.second().definitelyIsNumber()) {
-            linkSlowCaseIfNotJSCell(iter, src2);
-            linkSlowCase(iter);
-        }
-    } else if (types.first().isReusable() && supportsFloatingPoint()) {
-        if (!types.first().definitelyIsNumber()) {
-            linkSlowCaseIfNotJSCell(iter, src1);
-            linkSlowCase(iter);
-        }
-        if (!types.second().definitelyIsNumber()) {
-            linkSlowCaseIfNotJSCell(iter, src2);
-            linkSlowCase(iter);
-        }
-    }
-    linkSlowCase(iter);
-
-    // additional entry point to handle -0 cases.
-    if (opcodeID == op_mul)
-        linkSlowCase(iter);
-
-    JITStubCall stubCall(this, opcodeID == op_add ? cti_op_add : opcodeID == op_sub ? cti_op_sub : cti_op_mul);
-    stubCall.addArgument(src1, regT2);
-    stubCall.addArgument(src2, regT2);
-    stubCall.call(dst);
-}
-
-void JIT::emit_op_add(Instruction* currentInstruction)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-
-    if (!types.first().mightBeNumber() || !types.second().mightBeNumber()) {
-        JITStubCall stubCall(this, cti_op_add);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call(result);
-        return;
-    }
-
-    if (isOperandConstantImmediateInt(op1)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        addSlowCase(branchAdd32(Overflow, Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitPutVirtualRegister(result);
-    } else {
-        compileBinaryArithOp(op_add, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-    }
-}
-
-void JIT::emitSlow_op_add(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-
-    OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-    if (!types.first().mightBeNumber() || !types.second().mightBeNumber())
-        return;
-
-    if (isOperandConstantImmediateInt(op1)) {
-        Jump notImm = getSlowCase(iter);
-        linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op1) << JSImmediate::IntegerPayloadShift), regT0);
-        notImm.link(this);
-        JITStubCall stubCall(this, cti_op_add);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(regT0);
-        stubCall.call(result);
-    } else if (isOperandConstantImmediateInt(op2)) {
-        Jump notImm = getSlowCase(iter);
-        linkSlowCase(iter);
-        sub32(Imm32(getConstantOperandImmediateInt(op2) << JSImmediate::IntegerPayloadShift), regT0);
-        notImm.link(this);
-        JITStubCall stubCall(this, cti_op_add);
-        stubCall.addArgument(regT0);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call(result);
-    } else {
-        OperandTypes types = OperandTypes::fromInt(currentInstruction[4].u.operand);
-        ASSERT(types.first().mightBeNumber() && types.second().mightBeNumber());
-        compileBinaryArithOpSlowCase(op_add, iter, result, op1, op2, types);
-    }
-}
-
-void JIT::emit_op_mul(Instruction* currentInstruction)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-
-    // For now, only plant a fast int case if the constant operand is greater than zero.
-    int32_t value;
-    if (isOperandConstantImmediateInt(op1) && ((value = getConstantOperandImmediateInt(op1)) > 0)) {
-        emitGetVirtualRegister(op2, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitFastArithDeTagImmediate(regT0);
-        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitFastArithReTagImmediate(regT0, regT0);
-        emitPutVirtualRegister(result);
-    } else if (isOperandConstantImmediateInt(op2) && ((value = getConstantOperandImmediateInt(op2)) > 0)) {
-        emitGetVirtualRegister(op1, regT0);
-        emitJumpSlowCaseIfNotImmediateInteger(regT0);
-        emitFastArithDeTagImmediate(regT0);
-        addSlowCase(branchMul32(Overflow, Imm32(value), regT0, regT0));
-        signExtend32ToPtr(regT0, regT0);
-        emitFastArithReTagImmediate(regT0, regT0);
-        emitPutVirtualRegister(result);
-    } else
-        compileBinaryArithOp(op_mul, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-}
-
-void JIT::emitSlow_op_mul(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    unsigned result = currentInstruction[1].u.operand;
-    unsigned op1 = currentInstruction[2].u.operand;
-    unsigned op2 = currentInstruction[3].u.operand;
-
-    if ((isOperandConstantImmediateInt(op1) && (getConstantOperandImmediateInt(op1) > 0))
-        || (isOperandConstantImmediateInt(op2) && (getConstantOperandImmediateInt(op2) > 0))) {
-        linkSlowCase(iter);
-        linkSlowCase(iter);
-        // There is an extra slow case for (op1 * -N) or (-N * op2), to check for 0 since this should produce a result of -0.
-        JITStubCall stubCall(this, cti_op_mul);
-        stubCall.addArgument(op1, regT2);
-        stubCall.addArgument(op2, regT2);
-        stubCall.call(result);
-    } else
-        compileBinaryArithOpSlowCase(op_mul, iter, result, op1, op2, OperandTypes::fromInt(currentInstruction[4].u.operand));
-}
-
-void JIT::emit_op_sub(Instruction* currentInstruction)
-{
-    compileBinaryArithOp(op_sub, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-}
-
-void JIT::emitSlow_op_sub(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
-{
-    compileBinaryArithOpSlowCase(op_sub, iter, currentInstruction[1].u.operand, currentInstruction[2].u.operand, currentInstruction[3].u.operand, OperandTypes::fromInt(currentInstruction[4].u.operand));
-}
-
-#endif // USE(JSVALUE64)
-
 /* ------------------------------ END: OP_ADD, OP_SUB, OP_MUL ------------------------------ */
 
 } // namespace JSC
 
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITCall.cpp b/JavaScriptCore/jit/JITCall.cpp
index 368eab9..fdd0d47 100644
--- a/JavaScriptCore/jit/JITCall.cpp
+++ b/JavaScriptCore/jit/JITCall.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if ENABLE(JIT)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 #include "JIT.h"
 
 #include "CodeBlock.h"
@@ -257,5 +257,5 @@ void JIT::compileOpCallSlowCase(Instruction* instruction, Vector<SlowCaseEntry>:
 
 } // namespace JSC
 
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITCall32_64.cpp b/JavaScriptCore/jit/JITCall32_64.cpp
index e4005ae..daf5d2d 100644
--- a/JavaScriptCore/jit/JITCall32_64.cpp
+++ b/JavaScriptCore/jit/JITCall32_64.cpp
@@ -108,9 +108,11 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
     unsigned dst = currentInstruction[1].u.operand;
 
     // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain())
+    if (m_codeBlock->needsFullScopeChain()) {
+        Jump activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
         JITStubCall(this, cti_op_ret_scopeChain).call();
-
+        activationNotCreated.link(this);
+    }
     emitLoad(dst, regT1, regT0);
     emitGetFromCallFrameHeaderPtr(RegisterFile::ReturnPC, regT2);
     emitGetFromCallFrameHeaderPtr(RegisterFile::CallerFrame, callFrameRegister);
@@ -125,8 +127,11 @@ void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
     unsigned thisReg = currentInstruction[2].u.operand;
 
     // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain())
+    if (m_codeBlock->needsFullScopeChain()) {
+        Jump activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
         JITStubCall(this, cti_op_ret_scopeChain).call();
+        activationNotCreated.link(this);
+    }
 
     emitLoad(result, regT1, regT0);
     Jump notJSCell = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
diff --git a/JavaScriptCore/jit/JITInlineMethods.h b/JavaScriptCore/jit/JITInlineMethods.h
index e2e77db..0fe9929 100644
--- a/JavaScriptCore/jit/JITInlineMethods.h
+++ b/JavaScriptCore/jit/JITInlineMethods.h
@@ -63,7 +63,7 @@ ALWAYS_INLINE void JIT::emitPutImmediateToCallFrameHeader(void* value, RegisterF
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeaderPtr(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
     loadPtr(Address(from, entry * sizeof(Register)), to);
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
     killLastResultRegister();
 #endif
 }
@@ -81,7 +81,7 @@ ALWAYS_INLINE void JIT::emitLoadCharacterString(RegisterID src, RegisterID dst,
 ALWAYS_INLINE void JIT::emitGetFromCallFrameHeader32(RegisterFile::CallFrameHeaderEntry entry, RegisterID to, RegisterID from)
 {
     load32(Address(from, entry * sizeof(Register)), to);
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
     killLastResultRegister();
 #endif
 }
@@ -750,7 +750,7 @@ ALWAYS_INLINE void JIT::emitJumpSlowCaseIfNotImmediateNumber(RegisterID reg)
     addSlowCase(emitJumpIfNotImmediateNumber(reg));
 }
 
-#if !USE(JSVALUE64)
+#if USE(JSVALUE32_64)
 ALWAYS_INLINE void JIT::emitFastArithDeTagImmediate(RegisterID reg)
 {
     subPtr(Imm32(JSImmediate::TagTypeNumber), reg);
diff --git a/JavaScriptCore/jit/JITOpcodes.cpp b/JavaScriptCore/jit/JITOpcodes.cpp
index c81932a..a468c18 100644
--- a/JavaScriptCore/jit/JITOpcodes.cpp
+++ b/JavaScriptCore/jit/JITOpcodes.cpp
@@ -39,7 +39,7 @@
 
 namespace JSC {
 
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 
 #define RECORD_JUMP_TARGET(targetOffset) \
    do { m_labels[m_bytecodeOffset + (targetOffset)].used(); } while (false)
@@ -337,6 +337,7 @@ void JIT::emit_op_end(Instruction* currentInstruction)
 {
     if (m_codeBlock->needsFullScopeChain())
         JITStubCall(this, cti_op_end).call();
+
     ASSERT(returnValueRegister != callFrameRegister);
     emitGetVirtualRegister(currentInstruction[1].u.operand, returnValueRegister);
     restoreReturnAddressBeforeReturn(Address(callFrameRegister, RegisterFile::ReturnPC * static_cast<int>(sizeof(Register))));
@@ -360,11 +361,7 @@ void JIT::emit_op_loop_if_lesseq(Instruction* currentInstruction)
     if (isOperandConstantImmediateInt(op2)) {
         emitGetVirtualRegister(op1, regT0);
         emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
         int32_t op2imm = getConstantOperandImmediateInt(op2);
-#else
-        int32_t op2imm = static_cast<int32_t>(JSImmediate::rawValue(getConstantOperand(op2)));
-#endif
         addJump(branch32(LessThanOrEqual, regT0, Imm32(op2imm)), target);
     } else {
         emitGetVirtualRegisters(op1, regT0, op2, regT1);
@@ -467,6 +464,15 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
     int skip = currentInstruction[3].u.operand;
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT0);
+    bool checkTopLevel = m_codeBlock->codeType() == FunctionCode && m_codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        Jump activationNotCreated;
+        if (checkTopLevel)
+            activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        activationNotCreated.link(this);
+    }
     while (skip--)
         loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
 
@@ -481,6 +487,15 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT1);
     emitGetVirtualRegister(currentInstruction[3].u.operand, regT0);
+    bool checkTopLevel = m_codeBlock->codeType() == FunctionCode && m_codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        Jump activationNotCreated;
+        if (checkTopLevel)
+            activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
+        loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
+        activationNotCreated.link(this);
+    }
     while (skip--)
         loadPtr(Address(regT1, OBJECT_OFFSETOF(ScopeChainNode, next)), regT1);
 
@@ -490,10 +505,16 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
 
 void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 {
+    unsigned activation = currentInstruction[1].u.operand;
+    unsigned arguments = currentInstruction[2].u.operand;
+    Jump activationCreated = branchTestPtr(NonZero, addressFor(activation));
+    Jump argumentsNotCreated = branchTestPtr(Zero, addressFor(arguments));
+    activationCreated.link(this);
     JITStubCall stubCall(this, cti_op_tear_off_activation);
-    stubCall.addArgument(currentInstruction[1].u.operand, regT2);
-    stubCall.addArgument(unmodifiedArgumentsRegister(currentInstruction[2].u.operand), regT2);
+    stubCall.addArgument(activation, regT2);
+    stubCall.addArgument(unmodifiedArgumentsRegister(arguments), regT2);
     stubCall.call();
+    argumentsNotCreated.link(this);
 }
 
 void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
@@ -510,9 +531,11 @@ void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
 void JIT::emit_op_ret(Instruction* currentInstruction)
 {
     // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain())
+    if (m_codeBlock->needsFullScopeChain()) {
+        Jump activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
         JITStubCall(this, cti_op_ret_scopeChain).call();
-
+        activationNotCreated.link(this);
+    }
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
     ASSERT(returnValueRegister != callFrameRegister);
@@ -534,8 +557,11 @@ void JIT::emit_op_ret(Instruction* currentInstruction)
 void JIT::emit_op_ret_object_or_this(Instruction* currentInstruction)
 {
     // We could JIT generate the deref, only calling out to C when the refcount hits zero.
-    if (m_codeBlock->needsFullScopeChain())
+    if (m_codeBlock->needsFullScopeChain()) {
+        Jump activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
         JITStubCall(this, cti_op_ret_scopeChain).call();
+        activationNotCreated.link(this);
+    }
 
     ASSERT(callFrameRegister != regT1);
     ASSERT(regT1 != returnValueRegister);
@@ -614,7 +640,15 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_resolve_base);
+    JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_ensure_property_exists);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -772,12 +806,8 @@ void JIT::emit_op_bitnot(Instruction* currentInstruction)
 {
     emitGetVirtualRegister(currentInstruction[2].u.operand, regT0);
     emitJumpSlowCaseIfNotImmediateInteger(regT0);
-#if USE(JSVALUE64)
     not32(regT0);
     emitFastArithIntToImmNoCheck(regT0, regT0);
-#else
-    xorPtr(Imm32(~JSImmediate::TagTypeNumber), regT0);
-#endif
     emitPutVirtualRegister(currentInstruction[1].u.operand);
 }
 
@@ -865,7 +895,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     emitGetVirtualRegister(base, regT0);
     if (!m_codeBlock->isKnownNotImmediate(base))
         isNotObject.append(emitJumpIfNotJSCell(regT0));
-    if (base != m_codeBlock->thisRegister()) {
+    if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
         isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
@@ -913,11 +943,7 @@ void JIT::emit_op_next_pname(Instruction* currentInstruction)
     loadPtr(addressFor(it), regT1);
     loadPtr(Address(regT1, OBJECT_OFFSETOF(JSPropertyNameIterator, m_jsStrings)), regT2);
 
-#if USE(JSVALUE64)
     loadPtr(BaseIndex(regT2, regT0, TimesEight), regT2);
-#else
-    loadPtr(BaseIndex(regT2, regT0, TimesFour), regT2);
-#endif
 
     emitPutVirtualRegister(dst, regT2);
 
@@ -1185,16 +1211,14 @@ void JIT::emit_op_enter(Instruction*)
 
 }
 
-void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+void JIT::emit_op_create_activation(Instruction* currentInstruction)
 {
-    // Even though CTI doesn't use them, we initialize our constant
-    // registers to zap stale pointers, to avoid unnecessarily prolonging
-    // object lifetime and increasing GC pressure.
-    size_t count = m_codeBlock->m_numVars;
-    for (size_t j = 0; j < count; ++j)
-        emitInitRegister(j);
-
+    unsigned dst = currentInstruction[1].u.operand;
+    
+    Jump activationCreated = branchTestPtr(NonZero, Address(callFrameRegister, sizeof(Register) * dst));
     JITStubCall(this, cti_op_push_activation).call(currentInstruction[1].u.operand);
+    emitPutVirtualRegister(dst);
+    activationCreated.link(this);
 }
 
 void JIT::emit_op_create_arguments(Instruction* currentInstruction)
@@ -1227,6 +1251,23 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
 }
 
+void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
+{
+    emitGetVirtualRegister(currentInstruction[1].u.operand, regT0);
+    Jump notNull = branchTestPtr(NonZero, regT0);
+    move(ImmPtr(JSValue::encode(jsNull())), regT0);
+    emitPutVirtualRegister(currentInstruction[1].u.operand, regT0);
+    Jump setThis = jump();
+    notNull.link(this);
+    Jump isImmediate = emitJumpIfNotJSCell(regT0);
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT1);
+    Jump notAnObject = branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT1, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    isImmediate.link(this);
+    notAnObject.link(this);
+    setThis.link(this);
+}
+
 void JIT::emit_op_get_callee(Instruction* currentInstruction)
 {
     unsigned result = currentInstruction[1].u.operand;
@@ -1276,6 +1317,14 @@ void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowC
     stubCall.call(currentInstruction[1].u.operand);
 }
 
+void JIT::emitSlow_op_convert_this_strict(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    linkSlowCase(iter);
+    JITStubCall stubCall(this, cti_op_convert_this_strict);
+    stubCall.addArgument(regT0);
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
 void JIT::emitSlow_op_to_primitive(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     linkSlowCase(iter);
@@ -1552,13 +1601,25 @@ void JIT::emitSlow_op_get_argument_by_val(Instruction* currentInstruction, Vecto
     stubCall.call(dst);
 }
 
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 
 void JIT::emit_op_resolve_global_dynamic(Instruction* currentInstruction)
 {
     int skip = currentInstruction[5].u.operand;
     
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT0);
+    
+    bool checkTopLevel = m_codeBlock->codeType() == FunctionCode && m_codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        Jump activationNotCreated;
+        if (checkTopLevel)
+            activationNotCreated = branchTestPtr(Zero, addressFor(m_codeBlock->activationRegister()));
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
+        addSlowCase(checkStructure(regT1, m_globalData->activationStructure.get()));
+        loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, next)), regT0);
+        activationNotCreated.link(this);
+    }
     while (skip--) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(ScopeChainNode, object)), regT1);
         addSlowCase(checkStructure(regT1, m_globalData->activationStructure.get()));
diff --git a/JavaScriptCore/jit/JITOpcodes32_64.cpp b/JavaScriptCore/jit/JITOpcodes32_64.cpp
index ad3b558..c3b7ac2 100644
--- a/JavaScriptCore/jit/JITOpcodes32_64.cpp
+++ b/JavaScriptCore/jit/JITOpcodes32_64.cpp
@@ -610,6 +610,15 @@ void JIT::emit_op_get_scoped_var(Instruction* currentInstruction)
     int skip = currentInstruction[3].u.operand;
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
+    bool checkTopLevel = m_codeBlock->codeType() == FunctionCode && m_codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        Jump activationNotCreated;
+        if (checkTopLevel)
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+        activationNotCreated.link(this);
+    }
     while (skip--)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
@@ -631,6 +640,15 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
     emitLoad(value, regT1, regT0);
 
     emitGetFromCallFrameHeaderPtr(RegisterFile::ScopeChain, regT2);
+    bool checkTopLevel = m_codeBlock->codeType() == FunctionCode && m_codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        Jump activationNotCreated;
+        if (checkTopLevel)
+            activationNotCreated = branch32(Equal, tagFor(m_codeBlock->activationRegister()), Imm32(JSValue::EmptyValueTag));
+        loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
+        activationNotCreated.link(this);
+    }
     while (skip--)
         loadPtr(Address(regT2, OBJECT_OFFSETOF(ScopeChainNode, next)), regT2);
 
@@ -644,10 +662,16 @@ void JIT::emit_op_put_scoped_var(Instruction* currentInstruction)
 
 void JIT::emit_op_tear_off_activation(Instruction* currentInstruction)
 {
+    unsigned activation = currentInstruction[1].u.operand;
+    unsigned arguments = currentInstruction[2].u.operand;
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
+    Jump argumentsNotCreated = branch32(Equal, tagFor(arguments), Imm32(JSValue::EmptyValueTag));
+    activationCreated.link(this);
     JITStubCall stubCall(this, cti_op_tear_off_activation);
     stubCall.addArgument(currentInstruction[1].u.operand);
     stubCall.addArgument(unmodifiedArgumentsRegister(currentInstruction[2].u.operand));
     stubCall.call();
+    argumentsNotCreated.link(this);
 }
 
 void JIT::emit_op_tear_off_arguments(Instruction* currentInstruction)
@@ -713,7 +737,15 @@ void JIT::emit_op_strcat(Instruction* currentInstruction)
 
 void JIT::emit_op_resolve_base(Instruction* currentInstruction)
 {
-    JITStubCall stubCall(this, cti_op_resolve_base);
+    JITStubCall stubCall(this, currentInstruction[3].u.operand ? cti_op_resolve_base_strict_put : cti_op_resolve_base);
+    stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
+    stubCall.call(currentInstruction[1].u.operand);
+}
+
+void JIT::emit_op_ensure_property_exists(Instruction* currentInstruction)
+{
+    JITStubCall stubCall(this, cti_op_ensure_property_exists);
+    stubCall.addArgument(Imm32(currentInstruction[1].u.operand));
     stubCall.addArgument(ImmPtr(&m_codeBlock->identifier(currentInstruction[2].u.operand)));
     stubCall.call(currentInstruction[1].u.operand);
 }
@@ -1215,7 +1247,7 @@ void JIT::emit_op_get_pnames(Instruction* currentInstruction)
     emitLoad(base, regT1, regT0);
     if (!m_codeBlock->isKnownNotImmediate(base))
         isNotObject.append(branch32(NotEqual, regT1, Imm32(JSValue::CellTag)));
-    if (base != m_codeBlock->thisRegister()) {
+    if (base != m_codeBlock->thisRegister() || m_codeBlock->isStrictMode()) {
         loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
         isNotObject.append(branch8(NotEqual, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType)));
     }
@@ -1467,11 +1499,13 @@ void JIT::emit_op_enter(Instruction*)
         emitStore(i, jsUndefined());
 }
 
-void JIT::emit_op_enter_with_activation(Instruction* currentInstruction)
+void JIT::emit_op_create_activation(Instruction* currentInstruction)
 {
-    emit_op_enter(currentInstruction);
-
-    JITStubCall(this, cti_op_push_activation).call(currentInstruction[1].u.operand);
+    unsigned activation = currentInstruction[1].u.operand;
+    
+    Jump activationCreated = branch32(NotEqual, tagFor(activation), Imm32(JSValue::EmptyValueTag));
+    JITStubCall(this, cti_op_push_activation).call(activation);
+    activationCreated.link(this);
 }
 
 void JIT::emit_op_create_arguments(Instruction* currentInstruction)
@@ -1528,6 +1562,26 @@ void JIT::emit_op_convert_this(Instruction* currentInstruction)
     map(m_bytecodeOffset + OPCODE_LENGTH(op_convert_this), thisRegister, regT1, regT0);
 }
 
+void JIT::emit_op_convert_this_strict(Instruction* currentInstruction)
+{
+    unsigned thisRegister = currentInstruction[1].u.operand;
+    
+    emitLoad(thisRegister, regT1, regT0);
+    
+    Jump notNull = branch32(NotEqual, regT1, Imm32(JSValue::EmptyValueTag));
+    emitStore(thisRegister, jsNull());
+    Jump setThis = jump();
+    notNull.link(this);
+    Jump isImmediate = branch32(NotEqual, regT1, Imm32(JSValue::CellTag));
+    loadPtr(Address(regT0, OBJECT_OFFSETOF(JSCell, m_structure)), regT2);
+    Jump notAnObject = branch8(NotEqual, Address(regT3, OBJECT_OFFSETOF(Structure, m_typeInfo.m_type)), Imm32(ObjectType));
+    addSlowCase(branchTest8(NonZero, Address(regT2, OBJECT_OFFSETOF(Structure, m_typeInfo.m_flags)), Imm32(NeedsThisConversion)));
+    isImmediate.link(this);
+    notAnObject.link(this);
+    setThis.link(this);
+    map(m_bytecodeOffset + OPCODE_LENGTH(op_convert_this_strict), thisRegister, regT1, regT0);
+}
+
 void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
 {
     unsigned thisRegister = currentInstruction[1].u.operand;
@@ -1540,6 +1594,17 @@ void JIT::emitSlow_op_convert_this(Instruction* currentInstruction, Vector<SlowC
     stubCall.call(thisRegister);
 }
 
+void JIT::emitSlow_op_convert_this_strict(Instruction* currentInstruction, Vector<SlowCaseEntry>::iterator& iter)
+{
+    unsigned thisRegister = currentInstruction[1].u.operand;
+    
+    linkSlowCase(iter);
+    
+    JITStubCall stubCall(this, cti_op_convert_this_strict);
+    stubCall.addArgument(regT1, regT0);
+    stubCall.call(thisRegister);
+}
+
 void JIT::emit_op_profile_will_call(Instruction* currentInstruction)
 {
     peek(regT2, OBJECT_OFFSETOF(JITStackFrame, enabledProfilerReference) / sizeof(void*));
diff --git a/JavaScriptCore/jit/JITPropertyAccess.cpp b/JavaScriptCore/jit/JITPropertyAccess.cpp
index 7c129a5..2edc860 100644
--- a/JavaScriptCore/jit/JITPropertyAccess.cpp
+++ b/JavaScriptCore/jit/JITPropertyAccess.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if ENABLE(JIT)
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 #include "JIT.h"
 
 #include "CodeBlock.h"
@@ -89,7 +89,7 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
 
     emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(JSVALUE64)
+
     // This is technically incorrect - we're zero-extending an int32.  On the hot path this doesn't matter.
     // We check the value as if it was a uint32 against the m_vectorLength - which will always fail if
     // number was signed since m_vectorLength is always less than intmax (since the total allocation
@@ -97,9 +97,7 @@ void JIT::emit_op_get_by_val(Instruction* currentInstruction)
     // to 64-bits is necessary since it's used in the address calculation.  We zero extend rather than sign
     // extending since it makes it easier to re-tag the value in the slow case.
     zeroExtend32ToPtr(regT1, regT1);
-#else
-    emitFastArithImmToInt(regT1);
-#endif
+
     emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
 
@@ -204,12 +202,8 @@ void JIT::emit_op_put_by_val(Instruction* currentInstruction)
 
     emitGetVirtualRegisters(base, regT0, property, regT1);
     emitJumpSlowCaseIfNotImmediateInteger(regT1);
-#if USE(JSVALUE64)
     // See comment in op_get_by_val.
     zeroExtend32ToPtr(regT1, regT1);
-#else
-    emitFastArithImmToInt(regT1);
-#endif
     emitJumpSlowCaseIfNotJSCell(regT0, base);
     addSlowCase(branchPtr(NotEqual, Address(regT0), ImmPtr(m_globalData->jsArrayVPtr)));
     addSlowCase(branch32(AboveOrEqual, regT1, Address(regT0, OBJECT_OFFSETOF(JSArray, m_vectorLength))));
@@ -1103,5 +1097,5 @@ void JIT::privateCompileGetByIdChain(StructureStubInfo* stubInfo, Structure* str
 
 } // namespace JSC
 
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 #endif // ENABLE(JIT)
diff --git a/JavaScriptCore/jit/JITStubs.cpp b/JavaScriptCore/jit/JITStubs.cpp
index f1ec079..8340211 100644
--- a/JavaScriptCore/jit/JITStubs.cpp
+++ b/JavaScriptCore/jit/JITStubs.cpp
@@ -1065,7 +1065,9 @@ static NEVER_INLINE void throwStackOverflowError(CallFrame* callFrame, JSGlobalD
         return 0; \
     } while (0)
 #define VM_THROW_EXCEPTION_AT_END() \
-    returnToThrowTrampoline(stackFrame.globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS)
+    do {\
+        returnToThrowTrampoline(stackFrame.globalData, STUB_RETURN_ADDRESS, STUB_RETURN_ADDRESS);\
+    } while (0)
 
 #define CHECK_FOR_EXCEPTION() \
     do { \
@@ -1301,6 +1303,18 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this)
     return JSValue::encode(result);
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_convert_this_strict)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    
+    JSValue v1 = stackFrame.args[0].jsValue();
+    CallFrame* callFrame = stackFrame.callFrame;
+
+    JSValue result = v1.toStrictThisObject(callFrame);
+    CHECK_FOR_EXCEPTION_AT_END();
+    return JSValue::encode(result);
+}
+
 DEFINE_STUB_FUNCTION(void, op_end)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -1404,7 +1418,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_generic)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    PutPropertySlot slot;
+    PutPropertySlot slot(stackFrame.callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().put(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
     CHECK_FOR_EXCEPTION_AT_END();
 }
@@ -1413,7 +1427,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_direct_generic)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
     
-    PutPropertySlot slot;
+    PutPropertySlot slot(stackFrame.callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().putDirect(stackFrame.callFrame, stackFrame.args[1].identifier(), stackFrame.args[2].jsValue(), slot);
     CHECK_FOR_EXCEPTION_AT_END();
 }
@@ -1441,7 +1455,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
     
-    PutPropertySlot slot;
+    PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
     
     CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
@@ -1460,7 +1474,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_direct)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
     
-    PutPropertySlot slot;
+    PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().putDirect(callFrame, ident, stackFrame.args[2].jsValue(), slot);
     
     CodeBlock* codeBlock = stackFrame.callFrame->codeBlock();
@@ -1479,8 +1493,8 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_fail)
 
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
-
-    PutPropertySlot slot;
+    
+    PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().put(callFrame, ident, stackFrame.args[2].jsValue(), slot);
 
     CHECK_FOR_EXCEPTION_AT_END();
@@ -1493,7 +1507,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_id_direct_fail)
     CallFrame* callFrame = stackFrame.callFrame;
     Identifier& ident = stackFrame.args[1].identifier();
     
-    PutPropertySlot slot;
+    PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
     stackFrame.args[0].jsValue().putDirect(callFrame, ident, stackFrame.args[2].jsValue(), slot);
     
     CHECK_FOR_EXCEPTION_AT_END();
@@ -1880,7 +1894,11 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_id)
     
     JSObject* baseObj = stackFrame.args[0].jsValue().toObject(callFrame);
 
-    JSValue result = jsBoolean(baseObj->deleteProperty(callFrame, stackFrame.args[1].identifier()));
+    bool couldDelete = baseObj->deleteProperty(callFrame, stackFrame.args[1].identifier());
+    JSValue result = jsBoolean(couldDelete);
+    if (!couldDelete && callFrame->codeBlock()->isStrictMode())
+        stackFrame.globalData->exception = createTypeError(stackFrame.callFrame, "Unable to delete property.");
+
     CHECK_FOR_EXCEPTION_AT_END();
     return JSValue::encode(result);
 }
@@ -1906,7 +1924,8 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_mul)
 DEFINE_STUB_FUNCTION(JSObject*, op_new_func)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
-
+    
+    ASSERT(stackFrame.callFrame->codeBlock()->codeType() != FunctionCode || !stackFrame.callFrame->codeBlock()->needsFullScopeChain() || stackFrame.callFrame->r(stackFrame.callFrame->codeBlock()->activationRegister()).jsValue());
     return stackFrame.args[0].function()->make(stackFrame.callFrame, stackFrame.callFrame->scopeChain());
 }
 
@@ -2213,10 +2232,18 @@ DEFINE_STUB_FUNCTION(void, op_tear_off_activation)
     STUB_INIT_STACK_FRAME(stackFrame);
 
     ASSERT(stackFrame.callFrame->codeBlock()->needsFullScopeChain());
+    JSValue activationValue = stackFrame.args[0].jsValue();
+    if (!activationValue) {
+        if (JSValue v = stackFrame.args[1].jsValue())
+            asArguments(v)->copyRegisters();
+        return;
+    }
     JSActivation* activation = asActivation(stackFrame.args[0].jsValue());
     activation->copyRegisters();
-    if (JSValue v = stackFrame.args[1].jsValue())
-        asArguments(v)->setActivation(activation);
+    if (JSValue v = stackFrame.args[1].jsValue()) {
+        if (!stackFrame.callFrame->codeBlock()->isStrictMode())
+            asArguments(v)->setActivation(activation);
+    }
 }
 
 DEFINE_STUB_FUNCTION(void, op_tear_off_arguments)
@@ -2496,7 +2523,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val)
     } else {
         Identifier property(callFrame, subscript.toString(callFrame));
         if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
+            PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
             baseValue.put(callFrame, property, value, slot);
         }
     }
@@ -2539,7 +2566,7 @@ DEFINE_STUB_FUNCTION(void, op_put_by_val_byte_array)
     } else {
         Identifier property(callFrame, subscript.toString(callFrame));
         if (!stackFrame.globalData->exception) { // Don't put to an object if toString threw an exception.
-            PutPropertySlot slot;
+            PutPropertySlot slot(callFrame->codeBlock()->isStrictMode());
             baseValue.put(callFrame, property, value, slot);
         }
     }
@@ -2670,9 +2697,35 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
 
-    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain()));
+    return JSValue::encode(JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain(), false));
 }
 
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_base_strict_put)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    JSValue base = JSC::resolveBase(stackFrame.callFrame, stackFrame.args[0].identifier(), stackFrame.callFrame->scopeChain(), true);
+    if (!base) {
+        stackFrame.globalData->exception = createErrorForInvalidGlobalAssignment(stackFrame.callFrame, stackFrame.args[0].identifier().ustring());
+        VM_THROW_EXCEPTION();
+    }
+    return JSValue::encode(base);
+}
+
+DEFINE_STUB_FUNCTION(EncodedJSValue, op_ensure_property_exists)
+{
+    STUB_INIT_STACK_FRAME(stackFrame);
+    JSValue base = stackFrame.callFrame->r(stackFrame.args[0].int32()).jsValue();
+    JSObject* object = asObject(base);
+    PropertySlot slot(object);
+    ASSERT(stackFrame.callFrame->codeBlock()->isStrictMode());
+    if (!object->getPropertySlot(stackFrame.callFrame, stackFrame.args[1].identifier(), slot)) {
+        stackFrame.globalData->exception = createErrorForInvalidGlobalAssignment(stackFrame.callFrame, stackFrame.args[1].identifier().ustring());
+        VM_THROW_EXCEPTION();
+    }
+
+    return JSValue::encode(base);
+}
+    
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
@@ -2685,6 +2738,13 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
     ScopeChainIterator iter = scopeChain->begin();
     ScopeChainIterator end = scopeChain->end();
     ASSERT(iter != end);
+    CodeBlock* codeBlock = callFrame->codeBlock();
+    bool checkTopLevel = codeBlock->codeType() == FunctionCode && codeBlock->needsFullScopeChain();
+    ASSERT(skip || !checkTopLevel);
+    if (checkTopLevel && skip--) {
+        if (callFrame->r(codeBlock->activationRegister()).jsValue())
+            ++iter;
+    }
     while (skip--) {
         ++iter;
         ASSERT(iter != end);
@@ -2700,7 +2760,6 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_resolve_skip)
         }
     } while (++iter != end);
 
-    CodeBlock* codeBlock = callFrame->codeBlock();
     unsigned vPCIndex = codeBlock->bytecodeOffset(callFrame, STUB_RETURN_ADDRESS);
     stackFrame.globalData->exception = createUndefinedVariableError(callFrame, ident, vPCIndex, codeBlock);
     VM_THROW_EXCEPTION();
@@ -3049,6 +3108,7 @@ DEFINE_STUB_FUNCTION(JSObject*, op_new_func_exp)
 
     FunctionExecutable* function = stackFrame.args[0].function();
     JSFunction* func = function->make(callFrame, callFrame->scopeChain());
+    ASSERT(callFrame->codeBlock()->codeType() != FunctionCode || !callFrame->codeBlock()->needsFullScopeChain() || callFrame->r(callFrame->codeBlock()->activationRegister()).jsValue());
 
     /* 
         The Identifier in a FunctionExpression can be referenced from inside
@@ -3155,6 +3215,7 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_bitor)
 DEFINE_STUB_FUNCTION(EncodedJSValue, op_call_eval)
 {
     STUB_INIT_STACK_FRAME(stackFrame);
+    ASSERT(stackFrame.callFrame->codeBlock()->codeType() != FunctionCode || !stackFrame.callFrame->codeBlock()->needsFullScopeChain() || stackFrame.callFrame->r(stackFrame.callFrame->codeBlock()->activationRegister()).jsValue());
 
     CallFrame* callFrame = stackFrame.callFrame;
     RegisterFile* registerFile = stackFrame.registerFile;
@@ -3486,19 +3547,22 @@ DEFINE_STUB_FUNCTION(EncodedJSValue, op_del_by_val)
     JSObject* baseObj = baseValue.toObject(callFrame); // may throw
 
     JSValue subscript = stackFrame.args[1].jsValue();
-    JSValue result;
+    bool result;
     uint32_t i;
     if (subscript.getUInt32(i))
-        result = jsBoolean(baseObj->deleteProperty(callFrame, i));
+        result = baseObj->deleteProperty(callFrame, i);
     else {
         CHECK_FOR_EXCEPTION();
         Identifier property(callFrame, subscript.toString(callFrame));
         CHECK_FOR_EXCEPTION();
-        result = jsBoolean(baseObj->deleteProperty(callFrame, property));
+        result = baseObj->deleteProperty(callFrame, property);
     }
 
+    if (!result && callFrame->codeBlock()->isStrictMode())
+        stackFrame.globalData->exception = createTypeError(stackFrame.callFrame, "Unable to delete property.");
+
     CHECK_FOR_EXCEPTION_AT_END();
-    return JSValue::encode(result);
+    return JSValue::encode(jsBoolean(result));
 }
 
 DEFINE_STUB_FUNCTION(void, op_put_getter)
diff --git a/JavaScriptCore/jit/JITStubs.h b/JavaScriptCore/jit/JITStubs.h
index 2b22e6d..b91a074 100644
--- a/JavaScriptCore/jit/JITStubs.h
+++ b/JavaScriptCore/jit/JITStubs.h
@@ -147,7 +147,7 @@ namespace JSC {
     struct JITStackFrame {
         JITStubArg reserved; // Unused
         JITStubArg args[6];
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
         void* padding; // Maintain 16-byte stack alignment.
 #endif
 
@@ -296,6 +296,7 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_construct_NotJSConstruct(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_create_this(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_convert_this(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_convert_this_strict(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_create_arguments(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_create_arguments_no_params(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_del_by_id(STUB_ARGS_DECLARATION);
@@ -337,6 +338,8 @@ extern "C" {
     EncodedJSValue JIT_STUB cti_op_pre_inc(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_base(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_resolve_base_strict_put(STUB_ARGS_DECLARATION);
+    EncodedJSValue JIT_STUB cti_op_ensure_property_exists(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_global(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_global_dynamic(STUB_ARGS_DECLARATION);
     EncodedJSValue JIT_STUB cti_op_resolve_skip(STUB_ARGS_DECLARATION);
diff --git a/JavaScriptCore/jit/JSInterfaceJIT.h b/JavaScriptCore/jit/JSInterfaceJIT.h
index 031bfa8..6453bab 100644
--- a/JavaScriptCore/jit/JSInterfaceJIT.h
+++ b/JavaScriptCore/jit/JSInterfaceJIT.h
@@ -166,7 +166,7 @@ namespace JSC {
         inline Address tagFor(unsigned index, RegisterID base = callFrameRegister);
 #endif
 
-#if USE(JSVALUE32) || USE(JSVALUE64)
+#if USE(JSVALUE64)
         Jump emitJumpIfImmediateNumber(RegisterID reg);
         Jump emitJumpIfNotImmediateNumber(RegisterID reg);
         void emitFastArithImmToInt(RegisterID reg);
@@ -273,35 +273,7 @@ namespace JSC {
     
 #endif
 
-#if USE(JSVALUE32)
-    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadJSCell(unsigned virtualRegisterIndex, RegisterID dst)
-    {
-        loadPtr(addressFor(virtualRegisterIndex), dst);
-        return branchTest32(NonZero, dst, Imm32(JSImmediate::TagMask));
-    }
-
-    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadInt32(unsigned virtualRegisterIndex, RegisterID dst)
-    {
-        loadPtr(addressFor(virtualRegisterIndex), dst);
-        Jump result = branchTest32(Zero, dst, Imm32(JSImmediate::TagTypeNumber));
-        rshift32(Imm32(JSImmediate::IntegerPayloadShift), dst);
-        return result;
-    }
-
-    inline JSInterfaceJIT::Jump JSInterfaceJIT::emitLoadDouble(unsigned, FPRegisterID, RegisterID)
-    {
-        ASSERT_NOT_REACHED();
-        return jump();
-    }
-    
-    ALWAYS_INLINE void JSInterfaceJIT::emitFastArithImmToInt(RegisterID reg)
-    {
-        rshift32(Imm32(JSImmediate::IntegerPayloadShift), reg);
-    }
-    
-#endif
-
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
     inline JSInterfaceJIT::Address JSInterfaceJIT::payloadFor(unsigned virtualRegisterIndex, RegisterID base)
     {
         ASSERT(static_cast<int>(virtualRegisterIndex) < FirstConstantRegisterIndex);
diff --git a/JavaScriptCore/jit/SpecializedThunkJIT.h b/JavaScriptCore/jit/SpecializedThunkJIT.h
index 57515fb..5c593d9 100644
--- a/JavaScriptCore/jit/SpecializedThunkJIT.h
+++ b/JavaScriptCore/jit/SpecializedThunkJIT.h
@@ -96,14 +96,10 @@ namespace JSC {
 #if USE(JSVALUE64)
             moveDoubleToPtr(src, regT0);
             subPtr(tagTypeNumberRegister, regT0);
-#elif USE(JSVALUE32_64)
+#else
             storeDouble(src, Address(stackPointerRegister, -(int)sizeof(double)));
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.tag) - sizeof(double)), regT1);
             loadPtr(Address(stackPointerRegister, OBJECT_OFFSETOF(JSValue, u.asBits.payload) - sizeof(double)), regT0);
-#else
-            UNUSED_PARAM(src);
-            ASSERT_NOT_REACHED();
-            m_failures.append(jump());
 #endif
             loadPtr(Address(callFrameRegister, RegisterFile::CallerFrame * (int)sizeof(Register)), callFrameRegister);
             ret();
@@ -144,13 +140,8 @@ namespace JSC {
         {
 #if USE(JSVALUE64)
             orPtr(tagTypeNumberRegister, regT0);
-#elif USE(JSVALUE32_64)
-            move(Imm32(JSValue::Int32Tag), regT1);
 #else
-            signExtend32ToPtr(regT0, regT0);
-            // If we can't tag the result, give up and jump to the slow case
-            m_failures.append(branchAddPtr(Overflow, regT0, regT0));
-            addPtr(Imm32(JSImmediate::TagTypeNumber), regT0);
+            move(Imm32(JSValue::Int32Tag), regT1);
 #endif
         }
 
diff --git a/JavaScriptCore/jit/ThunkGenerators.cpp b/JavaScriptCore/jit/ThunkGenerators.cpp
index 4c7a354..9b40f12 100644
--- a/JavaScriptCore/jit/ThunkGenerators.cpp
+++ b/JavaScriptCore/jit/ThunkGenerators.cpp
@@ -92,7 +92,6 @@ MacroAssemblerCodePtr fromCharCodeThunkGenerator(JSGlobalData* globalData, Execu
 
 MacroAssemblerCodePtr sqrtThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
 {
-#if USE(JSVALUE64) || USE(JSVALUE32_64)
     SpecializedThunkJIT jit(1, globalData, pool);
     if (!jit.supportsFloatingPointSqrt())
         return globalData->jitStubs->ctiNativeCall();
@@ -101,10 +100,6 @@ MacroAssemblerCodePtr sqrtThunkGenerator(JSGlobalData* globalData, ExecutablePoo
     jit.sqrtDouble(SpecializedThunkJIT::fpRegT0, SpecializedThunkJIT::fpRegT0);
     jit.returnDouble(SpecializedThunkJIT::fpRegT0);
     return jit.finalize(globalData->jitStubs->ctiNativeCall());
-#else
-    UNUSED_PARAM(pool);
-    return globalData->jitStubs->ctiNativeCall();
-#endif
 }
 
 static const double oneConstant = 1.0;
@@ -112,7 +107,6 @@ static const double negativeHalfConstant = -0.5;
 
 MacroAssemblerCodePtr powThunkGenerator(JSGlobalData* globalData, ExecutablePool* pool)
 {
-#if USE(JSVALUE64) || USE(JSVALUE32_64)
     SpecializedThunkJIT jit(2, globalData, pool);
     if (!jit.supportsFloatingPoint())
         return globalData->jitStubs->ctiNativeCall();
@@ -161,10 +155,6 @@ MacroAssemblerCodePtr powThunkGenerator(JSGlobalData* globalData, ExecutablePool
         jit.appendFailure(nonIntExponent);
 
     return jit.finalize(globalData->jitStubs->ctiNativeCall());
-#else
-    UNUSED_PARAM(pool);
-    return globalData->jitStubs->ctiNativeCall();
-#endif
 }
 
 }
diff --git a/JavaScriptCore/parser/ASTBuilder.h b/JavaScriptCore/parser/ASTBuilder.h
index 40023f8..9a68144 100644
--- a/JavaScriptCore/parser/ASTBuilder.h
+++ b/JavaScriptCore/parser/ASTBuilder.h
@@ -249,10 +249,10 @@ public:
         return result;
     }
 
-    FunctionBodyNode* createFunctionBody()
+    FunctionBodyNode* createFunctionBody(bool inStrictContext)
     {
         usesClosures();
-        return FunctionBodyNode::create(m_globalData);
+        return FunctionBodyNode::create(m_globalData, inStrictContext);
     }
     
     template <bool> PropertyNode* createGetterOrSetterProperty(PropertyNode::Type type, const Identifier* name, ParameterNode* params, FunctionBodyNode* body, int openBracePos, int closeBracePos, int bodyStartLine, int bodyEndLine)
@@ -578,6 +578,9 @@ public:
     
     const Identifier& getName(Property property) { return property->name(); }
     PropertyNode::Type getType(Property property) { return property->type(); }
+
+    bool isResolve(ExpressionNode* expr) { return expr->isResolveNode(); }
+
 private:
     struct Scope {
         Scope(JSGlobalData* globalData)
diff --git a/JavaScriptCore/parser/JSParser.cpp b/JavaScriptCore/parser/JSParser.cpp
index 0e526ac..0338210 100644
--- a/JavaScriptCore/parser/JSParser.cpp
+++ b/JavaScriptCore/parser/JSParser.cpp
@@ -29,6 +29,7 @@
 
 using namespace JSC;
 
+#include "CodeBlock.h"
 #include "JSGlobalData.h"
 #include "NodeInfo.h"
 #include "ASTBuilder.h"
@@ -42,6 +43,8 @@ namespace JSC {
 #define fail() do { m_error = true; return 0; } while (0)
 #define failIfFalse(cond) do { if (!(cond)) fail(); } while (0)
 #define failIfTrue(cond) do { if ((cond)) fail(); } while (0)
+#define failIfTrueIfStrict(cond) do { if ((cond) && strictMode()) fail(); } while (0)
+#define failIfFalseIfStrict(cond) do { if ((!(cond)) && strictMode()) fail(); } while (0)
 #define consumeOrFail(tokenType) do { if (!consume(tokenType)) fail(); } while (0)
 #define matchOrFail(tokenType) do { if (!match(tokenType)) fail(); } while (0)
 #define failIfStackOverflow() do { failIfFalse(canRecurse()); } while (0)
@@ -67,8 +70,8 @@ static const ptrdiff_t kMaxParserStackUsage = 128 * sizeof(void*) * 1024;
 
 class JSParser {
 public:
-    JSParser(Lexer*, JSGlobalData*, FunctionParameters*, SourceProvider*);
-    bool parseProgram();
+    JSParser(Lexer*, JSGlobalData*, FunctionParameters*, bool isStrictContext, bool isFunction, SourceProvider*);
+    bool parseProgram(JSGlobalObject*);
 private:
     struct AllowInOverride {
         AllowInOverride(JSParser* parser)
@@ -90,7 +93,7 @@ private:
         m_lastLine = m_token.m_info.line;
         m_lastTokenEnd = m_token.m_info.endOffset;
         m_lexer->setLastLineNumber(m_lastLine);
-        m_token.m_type = m_lexer->lex(&m_token.m_data, &m_token.m_info, lexType);
+        m_token.m_type = m_lexer->lex(&m_token.m_data, &m_token.m_info, lexType, strictMode());
         m_tokenCount++;
     }
 
@@ -121,9 +124,23 @@ private:
     {
         return m_token.m_info.endOffset;
     }
-
-    template <class TreeBuilder> TreeSourceElements parseSourceElements(TreeBuilder&);
-    template <class TreeBuilder> TreeStatement parseStatement(TreeBuilder&);
+    
+    void startLoop() { currentScope()->startLoop(); }
+    void endLoop() { currentScope()->endLoop(); }
+    void startSwitch() { currentScope()->startSwitch(); }
+    void endSwitch() { currentScope()->endSwitch(); }
+    void setStrictMode() { currentScope()->setStrictMode(); }
+    bool strictMode() { return currentScope()->strictMode(); }
+    bool isValidStrictMode() { return currentScope()->isValidStrictMode(); }
+    bool declareParameter(const Identifier* ident) { return currentScope()->declareParameter(ident); }
+    bool breakIsValid() { return currentScope()->breakIsValid(); }
+    void pushLabel(const Identifier* label) { currentScope()->pushLabel(label); }
+    void popLabel() { currentScope()->popLabel(); }
+    bool hasLabel(const Identifier* label) { return currentScope()->hasLabel(label); }
+
+    enum SourceElementsMode { CheckForStrictMode, DontCheckForStrictMode };
+    template <SourceElementsMode mode, class TreeBuilder> TreeSourceElements parseSourceElements(TreeBuilder&);
+    template <class TreeBuilder> TreeStatement parseStatement(TreeBuilder&, const Identifier*& directive);
     template <class TreeBuilder> TreeStatement parseFunctionDeclaration(TreeBuilder&);
     template <class TreeBuilder> TreeStatement parseVarDeclaration(TreeBuilder&);
     template <class TreeBuilder> TreeStatement parseConstDeclaration(TreeBuilder&);
@@ -199,32 +216,118 @@ private:
     int m_assignmentCount;
     int m_nonLHSCount;
     bool m_syntaxAlreadyValidated;
+    int m_statementDepth;
+    int m_nonTrivialExpressionCount;
+    const Identifier* m_lastIdentifier;
+
+    struct DepthManager {
+        DepthManager(int* depth)
+            : m_originalDepth(*depth)
+            , m_depth(depth)
+        {
+        }
+        
+        ~DepthManager()
+        {
+            *m_depth = m_originalDepth;
+        }
+        
+    private:
+        int m_originalDepth;
+        int* m_depth;
+    };
 
     struct Scope {
-        Scope()
-            : m_usesEval(false)
+        Scope(JSGlobalData* globalData, bool isFunction, bool strictMode)
+            : m_globalData(globalData)
+            , m_usesEval(false)
             , m_needsFullActivation(false)
             , m_allowsNewDecls(true)
+            , m_strictMode(strictMode)
+            , m_isFunction(isFunction)
+            , m_isValidStrictMode(true)
+            , m_loopDepth(0)
+            , m_switchDepth(0)
+            , m_labels(0)
+        {
+        }
+        
+        void startSwitch() { m_switchDepth++; }
+        void endSwitch() { m_switchDepth--; }
+        void startLoop() { m_loopDepth++; }
+        void endLoop() { ASSERT(m_loopDepth); m_loopDepth--; }
+        bool inLoop() { return !!m_loopDepth; }
+        bool breakIsValid() { return m_loopDepth || m_switchDepth; }
+
+        void pushLabel(const Identifier* label)
+        {
+            if (!m_labels)
+                m_labels = new LabelStack;
+            m_labels->append(label->impl());
+        }
+
+        void popLabel()
         {
+            ASSERT(m_labels);
+            ASSERT(m_labels->size());
+            m_labels->removeLast();
         }
+
+        bool hasLabel(const Identifier* label)
+        {
+            if (!m_labels)
+                return false;
+            for (int i = m_labels->size(); i > 0; i--) {
+                if (m_labels->at(i - 1) == label->impl())
+                    return true;
+            }
+            return false;
+        }
+
+        void setIsFunction() { m_isFunction = true; }
+        bool isFunction() { return m_isFunction; }
         
-        void declareVariable(const Identifier* ident)
+        bool declareVariable(const Identifier* ident)
         {
+            bool isValidStrictMode = m_globalData->propertyNames->eval != *ident && m_globalData->propertyNames->arguments != *ident;
+            m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
             m_declaredVariables.add(ident->ustring().impl());
+            return isValidStrictMode;
+        }
+        
+        void declareWrite(const Identifier* ident)
+        {
+            ASSERT(m_strictMode);
+            m_writtenVariables.add(ident->impl());
+        }
+        
+        bool deleteProperty(const Identifier* ident)
+        {
+            if (m_declaredVariables.contains(ident->impl()))
+                return false;
+            m_deletedVariables.add(ident->impl());
+            return true;
         }
         
         void preventNewDecls() { m_allowsNewDecls = false; }
         bool allowsNewDecls() const { return m_allowsNewDecls; }
 
+        bool declareParameter(const Identifier* ident)
+        {
+            bool isValidStrictMode = m_declaredVariables.add(ident->ustring().impl()).second && m_globalData->propertyNames->eval != *ident && m_globalData->propertyNames->arguments != *ident;
+            m_isValidStrictMode = m_isValidStrictMode && isValidStrictMode;
+            return isValidStrictMode;
+        }
+        
         void useVariable(const Identifier* ident, bool isEval)
         {
             m_usesEval |= isEval;
             m_usedVariables.add(ident->ustring().impl());
         }
         
-        void needsFullActivation() { m_needsFullActivation = true; }
+        void setNeedsFullActivation() { m_needsFullActivation = true; }
         
-        void collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
+        bool collectFreeVariables(Scope* nestedScope, bool shouldTrackClosedVariables)
         {
             if (nestedScope->m_usesEval)
                 m_usesEval = true;
@@ -236,6 +339,45 @@ private:
                 if (shouldTrackClosedVariables)
                     m_closedVariables.add(*ptr);
             }
+            if (nestedScope->m_writtenVariables.size()) {
+                IdentifierSet::iterator end = nestedScope->m_writtenVariables.end();
+                for (IdentifierSet::iterator ptr = nestedScope->m_writtenVariables.begin(); ptr != end; ++ptr) {
+                    if (nestedScope->m_declaredVariables.contains(*ptr))
+                        continue;
+                    m_writtenVariables.add(*ptr);
+                }
+            }
+            if (nestedScope->m_deletedVariables.size()) {
+                IdentifierSet::iterator end = nestedScope->m_deletedVariables.end();
+                for (IdentifierSet::iterator ptr = nestedScope->m_deletedVariables.begin(); ptr != end; ++ptr) {
+                    if (nestedScope->m_declaredVariables.contains(*ptr))
+                        return false;
+                    if (m_declaredVariables.contains(*ptr))
+                        return false;
+                    m_deletedVariables.add(*ptr);
+                }
+            }
+            return true;
+        }
+
+        void getUncapturedWrittenVariables(IdentifierSet& writtenVariables)
+        {
+            IdentifierSet::iterator end = m_writtenVariables.end();
+            for (IdentifierSet::iterator ptr = m_writtenVariables.begin(); ptr != end; ++ptr) {
+                if (!m_declaredVariables.contains(*ptr))
+                    writtenVariables.add(*ptr);
+            }
+        }
+
+        bool getDeletedVariables(IdentifierSet& deletedVariables)
+        {
+            IdentifierSet::iterator end = m_deletedVariables.end();
+            for (IdentifierSet::iterator ptr = m_deletedVariables.begin(); ptr != end; ++ptr) {
+                if (m_declaredVariables.contains(*ptr))
+                    return false;
+            }
+            deletedVariables.swap(m_deletedVariables);
+            return true;
         }
 
         void getCapturedVariables(IdentifierSet& capturedVariables)
@@ -250,13 +392,27 @@ private:
                 capturedVariables.add(*ptr);
             }
         }
+        void setStrictMode() { m_strictMode = true; }
+        bool strictMode() const { return m_strictMode; }
+        bool isValidStrictMode() const { return m_isValidStrictMode; }
+
     private:
-        bool m_usesEval;
-        bool m_needsFullActivation;
-        bool m_allowsNewDecls;
+        JSGlobalData* m_globalData;
+        bool m_usesEval : 1;
+        bool m_needsFullActivation : 1;
+        bool m_allowsNewDecls : 1;
+        bool m_strictMode : 1;
+        bool m_isFunction : 1;
+        bool m_isValidStrictMode : 1;
+        int m_loopDepth;
+        int m_switchDepth;
+        typedef Vector<StringImpl*, 2> LabelStack;
+        LabelStack* m_labels;
         IdentifierSet m_declaredVariables;
         IdentifierSet m_usedVariables;
         IdentifierSet m_closedVariables;
+        IdentifierSet m_writtenVariables;
+        IdentifierSet m_deletedVariables;
     };
     
     typedef Vector<Scope, 10> ScopeStack;
@@ -281,19 +437,26 @@ private:
     
     ScopeRef pushScope()
     {
-        m_scopeStack.append(Scope());
+        bool isFunction = false;
+        bool isStrict = false;
+        if (!m_scopeStack.isEmpty()) {
+            isStrict = m_scopeStack.last().strictMode();
+            isFunction = m_scopeStack.last().isFunction();
+        }
+        m_scopeStack.append(Scope(m_globalData, isFunction, isStrict));
         return currentScope();
     }
 
-    void popScope(ScopeRef scope, bool shouldTrackClosedVariables)
+    bool popScope(ScopeRef scope, bool shouldTrackClosedVariables)
     {
         ASSERT_UNUSED(scope, scope.index() == m_scopeStack.size() - 1);
         ASSERT(m_scopeStack.size() > 1);
-        m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
+        bool result = m_scopeStack[m_scopeStack.size() - 2].collectFreeVariables(&m_scopeStack.last(), shouldTrackClosedVariables);
         m_scopeStack.removeLast();
+        return result;
     }
     
-    void declareVariable(const Identifier* ident)
+    bool declareVariable(const Identifier* ident)
     {
         unsigned i = m_scopeStack.size() - 1;
         ASSERT(i < m_scopeStack.size());
@@ -301,19 +464,32 @@ private:
             i--;
             ASSERT(i < m_scopeStack.size());
         }
-        m_scopeStack[i].declareVariable(ident);
+        return m_scopeStack[i].declareVariable(ident);
+    }
+    
+    void declareWrite(const Identifier* ident)
+    {
+        if (!m_syntaxAlreadyValidated)
+            m_scopeStack.last().declareWrite(ident);
     }
 
+    bool deleteProperty(const Identifier* ident)
+    {
+        if (!m_syntaxAlreadyValidated)
+            return m_scopeStack.last().deleteProperty(ident);
+        return true;
+    }
+    
     ScopeStack m_scopeStack;
 };
 
-int jsParse(JSGlobalData* globalData, FunctionParameters* parameters, const SourceCode* source)
+int jsParse(JSGlobalObject* lexicalGlobalObject, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode parserMode, const SourceCode* source)
 {
-    JSParser parser(globalData->lexer, globalData, parameters, source->provider());
-    return parser.parseProgram();
+    JSParser parser(lexicalGlobalObject->globalData()->lexer, lexicalGlobalObject->globalData(), parameters, strictness == JSParseStrict, parserMode == JSParseFunctionCode, source->provider());
+    return parser.parseProgram(lexicalGlobalObject);
 }
 
-JSParser::JSParser(Lexer* lexer, JSGlobalData* globalData, FunctionParameters* parameters, SourceProvider* provider)
+JSParser::JSParser(Lexer* lexer, JSGlobalData* globalData, FunctionParameters* parameters, bool inStrictContext, bool isFunction, SourceProvider* provider)
     : m_lexer(lexer)
     , m_endAddress(0)
     , m_error(false)
@@ -325,28 +501,48 @@ JSParser::JSParser(Lexer* lexer, JSGlobalData* globalData, FunctionParameters* p
     , m_assignmentCount(0)
     , m_nonLHSCount(0)
     , m_syntaxAlreadyValidated(provider->isValid())
+    , m_statementDepth(0)
+    , m_nonTrivialExpressionCount(0)
+    , m_lastIdentifier(0)
 {
     m_endAddress = wtfThreadData().approximatedStackStart() - kMaxParserStackUsage;
-    next();
-    m_lexer->setLastLineNumber(tokenLine());
     ScopeRef scope = pushScope();
+    if (isFunction)
+        scope->setIsFunction();
+    if (inStrictContext)
+        scope->setStrictMode();
     if (parameters) {
         for (unsigned i = 0; i < parameters->size(); i++)
-            scope->declareVariable(&parameters->at(i));
+            scope->declareParameter(&parameters->at(i));
     }
+    next();
+    m_lexer->setLastLineNumber(tokenLine());
 }
 
-bool JSParser::parseProgram()
+bool JSParser::parseProgram(JSGlobalObject* lexicalGlobalObject)
 {
     ASTBuilder context(m_globalData, m_lexer);
+    if (m_lexer->isReparsing())
+        m_statementDepth--;
     ScopeRef scope = currentScope();
-    SourceElements* sourceElements = parseSourceElements<ASTBuilder>(context);
+    SourceElements* sourceElements = parseSourceElements<CheckForStrictMode>(context);
     if (!sourceElements || !consume(EOFTOK))
         return true;
+    if (!m_syntaxAlreadyValidated) {
+        IdentifierSet deletedVariables;
+        if (!scope->getDeletedVariables(deletedVariables))
+            return true;
+        IdentifierSet::const_iterator end = deletedVariables.end();
+        SymbolTable& globalEnvRecord = lexicalGlobalObject->symbolTable();
+        for (IdentifierSet::const_iterator ptr = deletedVariables.begin(); ptr != end; ++ptr) {
+            if (!globalEnvRecord.get(*ptr).isNull())
+                return true;
+        }
+    }
     IdentifierSet capturedVariables;
     scope->getCapturedVariables(capturedVariables);
-    m_globalData->parser->didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), context.features(),
-                                          m_lastLine, context.numConstants(), capturedVariables);
+    m_globalData->parser->didFinishParsing(sourceElements, context.varDeclarations(), context.funcDeclarations(), context.features() | (scope->strictMode() ? StrictModeFeature : 0),
+                                           m_lastLine, context.numConstants(), capturedVariables);
     return false;
 }
 
@@ -355,11 +551,30 @@ bool JSParser::allowAutomaticSemicolon()
     return match(CLOSEBRACE) || match(EOFTOK) || m_lexer->prevTerminator();
 }
 
-template <class TreeBuilder> TreeSourceElements JSParser::parseSourceElements(TreeBuilder& context)
+template <JSParser::SourceElementsMode mode, class TreeBuilder> TreeSourceElements JSParser::parseSourceElements(TreeBuilder& context)
 {
     TreeSourceElements sourceElements = context.createSourceElements();
-    while (TreeStatement statement = parseStatement(context))
+    bool seenNonDirective = false;
+    const Identifier* directive = 0;
+    unsigned startOffset = m_token.m_info.startOffset;
+    bool hasSetStrict = false;
+    while (TreeStatement statement = parseStatement(context, directive)) {
+        if (mode == CheckForStrictMode && !seenNonDirective) {
+            if (directive) {
+                if (!hasSetStrict && m_globalData->propertyNames->useStrictIdentifier == *directive) {
+                    setStrictMode();
+                    hasSetStrict = true;
+                    failIfFalse(isValidStrictMode());
+                    m_lexer->setOffset(startOffset);
+                    next();
+                    failIfTrue(m_error);
+                    continue;
+                }
+            } else
+                seenNonDirective = true;
+        }
         context.appendStatement(sourceElements, statement);
+    }
 
     if (m_error)
         fail();
@@ -399,7 +614,10 @@ template <class TreeBuilder> TreeStatement JSParser::parseDoWhileStatement(TreeB
     ASSERT(match(DO));
     int startLine = tokenLine();
     next();
-    TreeStatement statement = parseStatement(context);
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
     failIfFalse(statement);
     int endLine = tokenLine();
     consumeOrFail(WHILE);
@@ -422,7 +640,10 @@ template <class TreeBuilder> TreeStatement JSParser::parseWhileStatement(TreeBui
     failIfFalse(expr);
     int endLine = tokenLine();
     consumeOrFail(CLOSEPAREN);
-    TreeStatement statement = parseStatement(context);
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
     failIfFalse(statement);
     return context.createWhileStatement(expr, statement, startLine, endLine);
 }
@@ -441,7 +662,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseVarDeclarationList(Tr
         lastIdent = name;
         next();
         bool hasInitializer = match(EQUAL);
-        declareVariable(name);
+        failIfFalseIfStrict(declareVariable(name));
         context.addVar(name, (hasInitializer || (!m_allowsIn && match(INTOKEN))) ? DeclarationStacks::HasInitializer : 0);
         if (hasInitializer) {
             int varDivot = tokenStart() + 1;
@@ -465,6 +686,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseVarDeclarationList(Tr
 
 template <class TreeBuilder> TreeConstDeclList JSParser::parseConstDeclarationList(TreeBuilder& context)
 {
+    failIfTrue(strictMode());
     TreeConstDeclList constDecls = 0;
     TreeConstDeclList tail = 0;
     do {
@@ -532,7 +754,10 @@ template <class TreeBuilder> TreeStatement JSParser::parseForStatement(TreeBuild
         int endLine = tokenLine();
         consumeOrFail(CLOSEPAREN);
 
-        TreeStatement statement = parseStatement(context);
+        const Identifier* unused = 0;
+        startLoop();
+        TreeStatement statement = parseStatement(context, unused);
+        endLoop();
         failIfFalse(statement);
 
         return context.createForInLoop(forInTarget, forInInitializer, expr, statement, declsStart, inLocation, exprEnd, initStart, initEnd, startLine, endLine);
@@ -566,7 +791,10 @@ template <class TreeBuilder> TreeStatement JSParser::parseForStatement(TreeBuild
         }
         int endLine = tokenLine();
         consumeOrFail(CLOSEPAREN);
-        TreeStatement statement = parseStatement(context);
+        const Identifier* unused = 0;
+        startLoop();
+        TreeStatement statement = parseStatement(context, unused);
+        endLoop();
         failIfFalse(statement);
         return context.createForLoop(decls, condition, increment, statement, hasDeclaration, startLine, endLine);
     }
@@ -579,7 +807,10 @@ template <class TreeBuilder> TreeStatement JSParser::parseForStatement(TreeBuild
     int exprEnd = lastTokenEnd();
     int endLine = tokenLine();
     consumeOrFail(CLOSEPAREN);
-    TreeStatement statement = parseStatement(context);
+    const Identifier* unused = 0;
+    startLoop();
+    TreeStatement statement = parseStatement(context, unused);
+    endLoop();
     failIfFalse(statement);
     
     return context.createForInLoop(decls, expr, statement, declsStart, declsEnd, exprEnd, startLine, endLine);
@@ -594,10 +825,13 @@ template <class TreeBuilder> TreeStatement JSParser::parseBreakStatement(TreeBui
     int endLine = tokenLine();
     next();
 
-    if (autoSemiColon())
+    if (autoSemiColon()) {
+        failIfFalseIfStrict(breakIsValid());
         return context.createBreakStatement(startCol, endCol, startLine, endLine);
+    }
     matchOrFail(IDENT);
     const Identifier* ident = m_token.m_data.ident;
+    failIfFalseIfStrict(hasLabel(ident));
     endCol = tokenEnd();
     endLine = tokenLine();
     next();
@@ -614,10 +848,13 @@ template <class TreeBuilder> TreeStatement JSParser::parseContinueStatement(Tree
     int endLine = tokenLine();
     next();
 
-    if (autoSemiColon())
+    if (autoSemiColon()) {
+        failIfFalseIfStrict(breakIsValid());
         return context.createContinueStatement(startCol, endCol, startLine, endLine);
+    }
     matchOrFail(IDENT);
     const Identifier* ident = m_token.m_data.ident;
+    failIfFalseIfStrict(hasLabel(ident));
     endCol = tokenEnd();
     endLine = tokenLine();
     next();
@@ -628,6 +865,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseContinueStatement(Tree
 template <class TreeBuilder> TreeStatement JSParser::parseReturnStatement(TreeBuilder& context)
 {
     ASSERT(match(RETURN));
+    failIfFalseIfStrict(currentScope()->isFunction());
     int startLine = tokenLine();
     int endLine = startLine;
     int start = tokenStart();
@@ -655,6 +893,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseThrowStatement(TreeBui
     int eStart = tokenStart();
     int startLine = tokenLine();
     next();
+    
+    failIfTrue(autoSemiColon());
 
     TreeExpression expr = parseExpression(context);
     failIfFalse(expr);
@@ -668,7 +908,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseThrowStatement(TreeBui
 template <class TreeBuilder> TreeStatement JSParser::parseWithStatement(TreeBuilder& context)
 {
     ASSERT(match(WITH));
-    currentScope()->needsFullActivation();
+    failIfTrue(strictMode());
+    currentScope()->setNeedsFullActivation();
     int startLine = tokenLine();
     next();
     consumeOrFail(OPENPAREN);
@@ -679,8 +920,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseWithStatement(TreeBuil
 
     int endLine = tokenLine();
     consumeOrFail(CLOSEPAREN);
-    
-    TreeStatement statement = parseStatement(context);
+    const Identifier* unused = 0;
+    TreeStatement statement = parseStatement(context, unused);
     failIfFalse(statement);
 
     return context.createWithStatement(expr, statement, start, end, startLine, endLine);
@@ -697,7 +938,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseSwitchStatement(TreeBu
     int endLine = tokenLine();
     consumeOrFail(CLOSEPAREN);
     consumeOrFail(OPENBRACE);
-
+    startSwitch();
     TreeClauseList firstClauses = parseSwitchClauses(context);
     failIfTrue(m_error);
 
@@ -706,6 +947,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseSwitchStatement(TreeBu
 
     TreeClauseList secondClauses = parseSwitchClauses(context);
     failIfTrue(m_error);
+    endSwitch();
     consumeOrFail(CLOSEBRACE);
 
     return context.createSwitchStatement(expr, firstClauses, defaultClause, secondClauses, startLine, endLine);
@@ -720,7 +962,7 @@ template <class TreeBuilder> TreeClauseList JSParser::parseSwitchClauses(TreeBui
     TreeExpression condition = parseExpression(context);
     failIfFalse(condition);
     consumeOrFail(COLON);
-    TreeSourceElements statements = parseSourceElements(context);
+    TreeSourceElements statements = parseSourceElements<DontCheckForStrictMode>(context);
     failIfFalse(statements);
     TreeClause clause = context.createClause(condition, statements);
     TreeClauseList clauseList = context.createClauseList(clause);
@@ -731,7 +973,7 @@ template <class TreeBuilder> TreeClauseList JSParser::parseSwitchClauses(TreeBui
         TreeExpression condition = parseExpression(context);
         failIfFalse(condition);
         consumeOrFail(COLON);
-        TreeSourceElements statements = parseSourceElements(context);
+        TreeSourceElements statements = parseSourceElements<DontCheckForStrictMode>(context);
         failIfFalse(statements);
         clause = context.createClause(condition, statements);
         tail = context.createClauseList(tail, clause);
@@ -745,7 +987,7 @@ template <class TreeBuilder> TreeClause JSParser::parseSwitchDefaultClause(TreeB
         return 0;
     next();
     consumeOrFail(COLON);
-    TreeSourceElements statements = parseSourceElements(context);
+    TreeSourceElements statements = parseSourceElements<DontCheckForStrictMode>(context);
     failIfFalse(statements);
     return context.createClause(0, statements);
 }
@@ -767,14 +1009,14 @@ template <class TreeBuilder> TreeStatement JSParser::parseTryStatement(TreeBuild
     int lastLine = m_lastLine;
 
     if (match(CATCH)) {
-        currentScope()->needsFullActivation();
+        currentScope()->setNeedsFullActivation();
         next();
         consumeOrFail(OPENPAREN);
         matchOrFail(IDENT);
         ident = m_token.m_data.ident;
         next();
         ScopeRef catchScope = pushScope();
-        catchScope->declareVariable(ident);
+        failIfFalseIfStrict(catchScope->declareVariable(ident));
         catchScope->preventNewDecls();
         consumeOrFail(CLOSEPAREN);
         matchOrFail(OPENBRACE);
@@ -782,7 +1024,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseTryStatement(TreeBuild
         catchBlock = parseBlockStatement(context);
         failIfFalse(catchBlock);
         catchHasEval = initialEvalCount != context.evalCount();
-        popScope(catchScope, TreeBuilder::NeedsFreeVariableInfo);
+        failIfFalse(popScope(catchScope, TreeBuilder::NeedsFreeVariableInfo));
     }
 
     if (match(FINALLY)) {
@@ -816,15 +1058,19 @@ template <class TreeBuilder> TreeStatement JSParser::parseBlockStatement(TreeBui
         next();
         return context.createBlockStatement(0, start, m_lastLine);
     }
-    TreeSourceElements subtree = parseSourceElements(context);
+    TreeSourceElements subtree = parseSourceElements<DontCheckForStrictMode>(context);
     failIfFalse(subtree);
     matchOrFail(CLOSEBRACE);
     next();
     return context.createBlockStatement(subtree, start, m_lastLine);
 }
 
-template <class TreeBuilder> TreeStatement JSParser::parseStatement(TreeBuilder& context)
+template <class TreeBuilder> TreeStatement JSParser::parseStatement(TreeBuilder& context, const Identifier*& directive)
 {
+    DepthManager statementDepth(&m_statementDepth);
+    m_statementDepth++;
+    directive = 0;
+    int nonTrivialExpressionCount = 0;
     failIfStackOverflow();
     switch (m_token.m_type) {
     case OPENBRACE:
@@ -834,6 +1080,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseStatement(TreeBuilder&
     case CONSTTOKEN:
         return parseConstDeclaration(context);
     case FUNCTION:
+        failIfFalseIfStrict(m_statementDepth == 1);
         return parseFunctionDeclaration(context);
     case SEMICOLON:
         next();
@@ -870,8 +1117,14 @@ template <class TreeBuilder> TreeStatement JSParser::parseStatement(TreeBuilder&
         return 0;
     case IDENT:
         return parseExpressionOrLabelStatement(context);
+    case STRING:
+        directive = m_token.m_data.ident;
+        nonTrivialExpressionCount = m_nonTrivialExpressionCount;
     default:
-        return parseExpressionStatement(context);
+        TreeStatement exprStatement = parseExpressionStatement(context);
+        if (directive && nonTrivialExpressionCount != m_nonTrivialExpressionCount)
+            directive = 0;
+        return exprStatement;
     }
 }
 
@@ -879,7 +1132,7 @@ template <class TreeBuilder> TreeFormalParameterList JSParser::parseFormalParame
 {
     matchOrFail(IDENT);
     usesArguments = m_globalData->propertyNames->arguments == *m_token.m_data.ident;
-    declareVariable(m_token.m_data.ident);
+    failIfFalseIfStrict(declareParameter(m_token.m_data.ident));
     TreeFormalParameterList list = context.createFormalParameterList(*m_token.m_data.ident);
     TreeFormalParameterList tail = list;
     next();
@@ -887,7 +1140,8 @@ template <class TreeBuilder> TreeFormalParameterList JSParser::parseFormalParame
         next();
         matchOrFail(IDENT);
         const Identifier* ident = m_token.m_data.ident;
-        declareVariable(ident);
+        usesArguments |= m_globalData->propertyNames->arguments == *m_token.m_data.ident;
+        failIfFalseIfStrict(declareParameter(ident));
         next();
         usesArguments = usesArguments || m_globalData->propertyNames->arguments == *ident;
         tail = context.createFormalParameterList(tail, *ident);
@@ -898,20 +1152,23 @@ template <class TreeBuilder> TreeFormalParameterList JSParser::parseFormalParame
 template <class TreeBuilder> TreeFunctionBody JSParser::parseFunctionBody(TreeBuilder& context)
 {
     if (match(CLOSEBRACE))
-        return context.createFunctionBody();
+        return context.createFunctionBody(strictMode());
+    DepthManager statementDepth(&m_statementDepth);
+    m_statementDepth = 0;
     typename TreeBuilder::FunctionBodyBuilder bodyBuilder(m_globalData, m_lexer);
-    failIfFalse(parseSourceElements(bodyBuilder));
-    return context.createFunctionBody();
+    failIfFalse(parseSourceElements<CheckForStrictMode>(bodyBuilder));
+    return context.createFunctionBody(strictMode());
 }
 
 template <JSParser::FunctionRequirements requirements, bool nameIsInContainingScope, class TreeBuilder> bool JSParser::parseFunctionInfo(TreeBuilder& context, const Identifier*& name, TreeFormalParameterList& parameters, TreeFunctionBody& body, int& openBracePos, int& closeBracePos, int& bodyStartLine)
 {
     ScopeRef functionScope = pushScope();
+    functionScope->setIsFunction();
     if (match(IDENT)) {
         name = m_token.m_data.ident;
         next();
         if (!nameIsInContainingScope)
-            functionScope->declareVariable(name);
+            failIfFalseIfStrict(functionScope->declareVariable(name));
     } else if (requirements == FunctionNeedsName)
         return false;
     consumeOrFail(OPENPAREN);
@@ -931,7 +1188,11 @@ template <JSParser::FunctionRequirements requirements, bool nameIsInContainingSc
     failIfFalse(body);
     if (usesArguments)
         context.setUsesArguments(body);
-    popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo);
+    if (functionScope->strictMode() && name) {
+        failIfTrue(m_globalData->propertyNames->arguments == *name);
+        failIfTrue(m_globalData->propertyNames->eval == *name);
+    }
+    failIfFalse(popScope(functionScope, TreeBuilder::NeedsFreeVariableInfo));
     matchOrFail(CLOSEBRACE);
     closeBracePos = m_token.m_data.intValue;
     next();
@@ -950,7 +1211,7 @@ template <class TreeBuilder> TreeStatement JSParser::parseFunctionDeclaration(Tr
     int bodyStartLine = 0;
     failIfFalse((parseFunctionInfo<FunctionNeedsName, true>(context, name, parameters, body, openBracePos, closeBracePos, bodyStartLine)));
     failIfFalse(name);
-    declareVariable(name);
+    failIfFalseIfStrict(declareVariable(name));
     return context.createFuncDeclStatement(name, body, parameters, openBracePos, closeBracePos, bodyStartLine, m_lastLine);
 }
 
@@ -973,7 +1234,12 @@ template <class TreeBuilder> TreeStatement JSParser::parseExpressionOrLabelState
     failIfFalse(currentToken + 1 == m_tokenCount);
     int end = tokenEnd();
     consumeOrFail(COLON);
-    TreeStatement statement = parseStatement(context);
+    const Identifier* unused = 0;
+    if (strictMode() && !m_syntaxAlreadyValidated)
+        pushLabel(ident);
+    TreeStatement statement = parseStatement(context, unused);
+    if (strictMode() && !m_syntaxAlreadyValidated)
+        popLabel();
     failIfFalse(statement);
     return context.createLabelStatement(ident, statement, start, end);
 }
@@ -1001,7 +1267,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseIfStatement(TreeBuilde
     int end = tokenLine();
     consumeOrFail(CLOSEPAREN);
 
-    TreeStatement trueBlock = parseStatement(context);
+    const Identifier* unused = 0;
+    TreeStatement trueBlock = parseStatement(context, unused);
     failIfFalse(trueBlock);
 
     if (!match(ELSE))
@@ -1014,7 +1281,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseIfStatement(TreeBuilde
     do {
         next();
         if (!match(IF)) {
-            TreeStatement block = parseStatement(context);
+            const Identifier* unused = 0;
+            TreeStatement block = parseStatement(context, unused);
             failIfFalse(block);
             statementStack.append(block);
             trailingElse = true;
@@ -1029,8 +1297,8 @@ template <class TreeBuilder> TreeStatement JSParser::parseIfStatement(TreeBuilde
         failIfFalse(innerCondition);
         int innerEnd = tokenLine();
         consumeOrFail(CLOSEPAREN);
-        
-        TreeStatement innerTrueBlock = parseStatement(context);
+        const Identifier* unused = 0;
+        TreeStatement innerTrueBlock = parseStatement(context, unused);
         failIfFalse(innerTrueBlock);     
         exprStack.append(innerCondition);
         posStack.append(make_pair(innerStart, innerEnd));
@@ -1070,6 +1338,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseExpression(TreeBuilde
     if (!match(COMMA))
         return node;
     next();
+    m_nonTrivialExpressionCount++;
     m_nonLHSCount++;
     TreeExpression right = parseAssignmentExpression(context);
     failIfFalse(right);
@@ -1115,11 +1384,17 @@ template <typename TreeBuilder> TreeExpression JSParser::parseAssignmentExpressi
         default:
             goto end;
         }
+        m_nonTrivialExpressionCount++;
         hadAssignment = true;
         context.assignmentStackAppend(assignmentStack, lhs, start, tokenStart(), m_assignmentCount, op);
         start = tokenStart();
         m_assignmentCount++;
         next();
+        if (strictMode() && m_lastIdentifier && context.isResolve(lhs)) {
+            failIfTrueIfStrict(m_globalData->propertyNames->eval == *m_lastIdentifier);
+            declareWrite(m_lastIdentifier);
+            m_lastIdentifier = 0;
+        }
         lhs = parseConditionalExpression(context);
         failIfFalse(lhs);
         if (initialNonLHSCount != m_nonLHSCount)
@@ -1144,6 +1419,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseConditionalExpression
     failIfFalse(cond);
     if (!match(QUESTION))
         return cond;
+    m_nonTrivialExpressionCount++;
     m_nonLHSCount++;
     next();
     TreeExpression lhs = parseAssignmentExpression(context);
@@ -1181,6 +1457,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseBinaryExpression(Tree
         int precedence = isBinaryOperator(m_token.m_type);
         if (!precedence)
             break;
+        m_nonTrivialExpressionCount++;
         m_nonLHSCount++;
         int operatorToken = m_token.m_type;
         next();
@@ -1196,7 +1473,6 @@ template <class TreeBuilder> TreeExpression JSParser::parseBinaryExpression(Tree
         }
         context.operatorStackAppend(operatorStackDepth, operatorToken, precedence);
     }
-
     while (operatorStackDepth) {
         ASSERT(operandStackDepth > 1);
 
@@ -1327,6 +1603,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseStrictObjectLiteral(T
         if (!m_syntaxAlreadyValidated) {
             std::pair<ObjectValidationMap::iterator, bool> propertyEntryIter = objectValidator.add(context.getName(property).impl(), context.getType(property));
             if (!propertyEntryIter.second) {
+                failIfTrue(strictMode());
                 if ((context.getType(property) & propertyEntryIter.first->second) != PropertyNode::Constant) {
                     // Can't have multiple getters or setters with the same name, nor can we define 
                     // a property as both an accessor and a constant value
@@ -1389,6 +1666,8 @@ template <class TreeBuilder> TreeExpression JSParser::parsePrimaryExpression(Tre
 {
     switch (m_token.m_type) {
     case OPENBRACE:
+        if (strictMode())
+            return parseStrictObjectLiteral(context);
         return parseObjectLiteral(context);
     case OPENBRACKET:
         return parseArrayLiteral(context);
@@ -1410,6 +1689,7 @@ template <class TreeBuilder> TreeExpression JSParser::parsePrimaryExpression(Tre
         const Identifier* ident = m_token.m_data.ident;
         next();
         currentScope()->useVariable(ident, m_globalData->propertyNames->eval == *ident);
+        m_lastIdentifier = ident;
         return context.createResolve(ident, start);
     }
     case STRING: {
@@ -1485,6 +1765,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseMemberExpression(Tree
         next();
         newCount++;
     }
+
     if (match(FUNCTION)) {
         const Identifier* name = &m_globalData->propertyNames->nullIdentifier;
         TreeFormalParameterList parameters = 0;
@@ -1502,6 +1783,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseMemberExpression(Tree
     while (true) {
         switch (m_token.m_type) {
         case OPENBRACKET: {
+            m_nonTrivialExpressionCount++;
             int expressionEnd = lastTokenEnd();
             next();
             int nonLHSCount = m_nonLHSCount;
@@ -1515,6 +1797,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseMemberExpression(Tree
             break;
         }
         case OPENPAREN: {
+            m_nonTrivialExpressionCount++;
             if (newCount) {
                 newCount--;
                 if (match(OPENPAREN)) {
@@ -1535,6 +1818,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseMemberExpression(Tree
             break;
         }
         case DOT: {
+            m_nonTrivialExpressionCount++;
             int expressionEnd = lastTokenEnd();
             next(Lexer::IgnoreReservedWords);
             matchOrFail(IDENT);
@@ -1556,25 +1840,62 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
 {
     AllowInOverride allowInOverride(this);
     int tokenStackDepth = 0;
+    bool modifiesExpr = false;
+    bool requiresLExpr = false;
     while (isUnaryOp(m_token.m_type)) {
+        if (strictMode()) {
+            switch (m_token.m_type) {
+            case PLUSPLUS:
+            case MINUSMINUS:
+            case AUTOPLUSPLUS:
+            case AUTOMINUSMINUS:
+                failIfTrue(requiresLExpr);
+                modifiesExpr = true;
+                requiresLExpr = true;
+                break;
+            case DELETETOKEN:
+                failIfTrue(requiresLExpr);
+                requiresLExpr = true;
+                break;
+            default:
+                failIfTrue(requiresLExpr);
+                break;
+            }
+        }
         m_nonLHSCount++;
         context.appendUnaryToken(tokenStackDepth, m_token.m_type, tokenStart());
         next();
+        m_nonTrivialExpressionCount++;
     }
     int subExprStart = tokenStart();
     TreeExpression expr = parseMemberExpression(context);
     failIfFalse(expr);
+    bool isEvalOrArguments = false;
+    if (strictMode() && !m_syntaxAlreadyValidated) {
+        if (context.isResolve(expr)) {
+            isEvalOrArguments = m_globalData->propertyNames->eval == *m_lastIdentifier;
+            if (!isEvalOrArguments && currentScope()->isFunction())
+                isEvalOrArguments = m_globalData->propertyNames->arguments == *m_lastIdentifier;
+        }
+    }
+    failIfTrueIfStrict(isEvalOrArguments && modifiesExpr);
     switch (m_token.m_type) {
     case PLUSPLUS:
+        m_nonTrivialExpressionCount++;
         m_nonLHSCount++;
         expr = context.makePostfixNode(expr, OpPlusPlus, subExprStart, lastTokenEnd(), tokenEnd());
         m_assignmentCount++;
+        failIfTrueIfStrict(isEvalOrArguments);
+        failIfTrueIfStrict(requiresLExpr);
         next();
         break;
     case MINUSMINUS:
+        m_nonTrivialExpressionCount++;
         m_nonLHSCount++;
         expr = context.makePostfixNode(expr, OpMinusMinus, subExprStart, lastTokenEnd(), tokenEnd());
         m_assignmentCount++;
+        failIfTrueIfStrict(isEvalOrArguments);
+        failIfTrueIfStrict(requiresLExpr);
         next();
         break;
     default:
@@ -1583,7 +1904,7 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
 
     int end = lastTokenEnd();
 
-    if (!TreeBuilder::CreatesAST)
+    if (!TreeBuilder::CreatesAST && (m_syntaxAlreadyValidated || !strictMode()))
         return expr;
 
     while (tokenStackDepth) {
@@ -1617,6 +1938,8 @@ template <class TreeBuilder> TreeExpression JSParser::parseUnaryExpression(TreeB
             expr = context.createVoid(expr);
             break;
         case DELETETOKEN:
+            if (strictMode() && context.isResolve(expr))
+                failIfFalse(deleteProperty(m_lastIdentifier));
             expr = context.makeDeleteNode(expr, context.unaryTokenStackLastStart(tokenStackDepth), end, end);
             break;
         default:
diff --git a/JavaScriptCore/parser/JSParser.h b/JavaScriptCore/parser/JSParser.h
index ab18fab..64b18e7 100644
--- a/JavaScriptCore/parser/JSParser.h
+++ b/JavaScriptCore/parser/JSParser.h
@@ -28,9 +28,10 @@
 
 namespace JSC {
 
+class ExecState;
 class FunctionParameters;
 class Identifier;
-class JSGlobalData;
+class JSGlobalObject;
 class SourceCode;
 
 enum {
@@ -155,6 +156,9 @@ struct JSToken {
     JSTokenInfo m_info;
 };
 
-int jsParse(JSGlobalData*, FunctionParameters*, const SourceCode*);
+enum JSParserStrictness { JSParseNormal, JSParseStrict };
+enum JSParserMode { JSParseProgramCode, JSParseFunctionCode };
+
+int jsParse(JSGlobalObject*, FunctionParameters*, JSParserStrictness, JSParserMode, const SourceCode*);
 }
 #endif // JSParser_h
diff --git a/JavaScriptCore/parser/Lexer.cpp b/JavaScriptCore/parser/Lexer.cpp
index cc4321d..b443561 100644
--- a/JavaScriptCore/parser/Lexer.cpp
+++ b/JavaScriptCore/parser/Lexer.cpp
@@ -453,7 +453,7 @@ ALWAYS_INLINE JSTokenType Lexer::parseIdentifier(JSTokenData* lvalp, LexType lex
     return IDENT;
 }
 
-ALWAYS_INLINE bool Lexer::parseString(JSTokenData* lvalp)
+ALWAYS_INLINE bool Lexer::parseString(JSTokenData* lvalp, bool strictMode)
 {
     int stringQuoteCharacter = m_current;
     shift();
@@ -494,6 +494,8 @@ ALWAYS_INLINE bool Lexer::parseString(JSTokenData* lvalp)
                     return false;
             } else if (isASCIIOctalDigit(m_current)) {
                 // Octal character sequences
+                if (strictMode)
+                    return false;
                 int character1 = m_current;
                 shift();
                 if (isASCIIOctalDigit(m_current)) {
@@ -696,7 +698,7 @@ ALWAYS_INLINE bool Lexer::parseMultilineComment()
     }
 }
 
-JSTokenType Lexer::lex(JSTokenData* lvalp, JSTokenInfo* llocp, LexType lexType)
+JSTokenType Lexer::lex(JSTokenData* lvalp, JSTokenInfo* llocp, LexType lexType, bool strictMode)
 {
     ASSERT(!m_error);
     ASSERT(m_buffer8.isEmpty());
@@ -976,8 +978,11 @@ start:
         } else {
             record8('0');
             if (isASCIIOctalDigit(m_current)) {
-                if (parseOctal(lvalp->doubleValue))
+                if (parseOctal(lvalp->doubleValue)) {
+                    if (strictMode)
+                        goto returnError;
                     token = NUMBER;
+                }
             }
         }
         // Fall through into CharacterNumber
@@ -1006,7 +1011,7 @@ inNumberAfterDecimalPoint:
         m_delimited = false;
         break;
     case CharacterQuote:
-        if (UNLIKELY(!parseString(lvalp)))
+        if (UNLIKELY(!parseString(lvalp, strictMode)))
             goto returnError;
         shift();
         m_delimited = false;
@@ -1023,11 +1028,6 @@ inNumberAfterDecimalPoint:
         shiftLineTerminator();
         m_atLineStart = true;
         m_terminator = true;
-        if (lastTokenWasRestrKeyword()) {
-            token = SEMICOLON;
-            m_delimited = true;
-            goto returnToken;
-        }
         goto start;
     case CharacterInvalid:
         goto returnError;
diff --git a/JavaScriptCore/parser/Lexer.h b/JavaScriptCore/parser/Lexer.h
index e6c1efd..4d2513d 100644
--- a/JavaScriptCore/parser/Lexer.h
+++ b/JavaScriptCore/parser/Lexer.h
@@ -48,10 +48,11 @@ namespace JSC {
         // Functions to set up parsing.
         void setCode(const SourceCode&, ParserArena&);
         void setIsReparsing() { m_isReparsing = true; }
+        bool isReparsing() const { return m_isReparsing; }
 
         // Functions for the parser itself.
         enum LexType { IdentifyReservedWords, IgnoreReservedWords };
-        JSTokenType lex(JSTokenData* lvalp, JSTokenInfo* llocp, LexType);
+        JSTokenType lex(JSTokenData* lvalp, JSTokenInfo* llocp, LexType, bool strictMode);
         int lineNumber() const { return m_lineNumber; }
         void setLastLineNumber(int lastLineNumber) { m_lastLineNumber = lastLineNumber; }
         int lastLineNumber() const { return m_lastLineNumber; }
@@ -95,7 +96,7 @@ namespace JSC {
         ALWAYS_INLINE bool lastTokenWasRestrKeyword() const;
 
         ALWAYS_INLINE JSTokenType parseIdentifier(JSTokenData*, LexType);
-        ALWAYS_INLINE bool parseString(JSTokenData* lvalp);
+        ALWAYS_INLINE bool parseString(JSTokenData* lvalp, bool strictMode);
         ALWAYS_INLINE void parseHex(double& returnValue);
         ALWAYS_INLINE bool parseOctal(double& returnValue);
         ALWAYS_INLINE bool parseDecimal(double& returnValue);
diff --git a/JavaScriptCore/parser/Nodes.cpp b/JavaScriptCore/parser/Nodes.cpp
index 534e28a..34aa674 100644
--- a/JavaScriptCore/parser/Nodes.cpp
+++ b/JavaScriptCore/parser/Nodes.cpp
@@ -89,10 +89,10 @@ ScopeNodeData::ScopeNodeData(ParserArena& arena, SourceElements* statements, Var
 
 // ------------------------------ ScopeNode -----------------------------
 
-ScopeNode::ScopeNode(JSGlobalData* globalData)
+ScopeNode::ScopeNode(JSGlobalData* globalData, bool inStrictContext)
     : StatementNode(globalData)
     , ParserArenaRefCounted(globalData)
-    , m_features(NoFeatures)
+    , m_features(inStrictContext ? StrictModeFeature : NoFeatures)
 {
 }
 
@@ -154,8 +154,8 @@ FunctionParameters::FunctionParameters(ParameterNode* firstParameter)
         append(parameter->ident());
 }
 
-inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData)
-    : ScopeNode(globalData)
+inline FunctionBodyNode::FunctionBodyNode(JSGlobalData* globalData, bool inStrictContext)
+    : ScopeNode(globalData, inStrictContext)
 {
 }
 
@@ -177,9 +177,9 @@ void FunctionBodyNode::finishParsing(PassRefPtr<FunctionParameters> parameters,
     m_ident = ident;
 }
 
-FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData)
+FunctionBodyNode* FunctionBodyNode::create(JSGlobalData* globalData, bool inStrictContext)
 {
-    return new FunctionBodyNode(globalData);
+    return new FunctionBodyNode(globalData, inStrictContext);
 }
 
 PassRefPtr<FunctionBodyNode> FunctionBodyNode::create(JSGlobalData* globalData, SourceElements* children, VarStack* varStack, FunctionStack* funcStack, IdentifierSet& capturedVariables, const SourceCode& sourceCode, CodeFeatures features, int numConstants)
diff --git a/JavaScriptCore/parser/Nodes.h b/JavaScriptCore/parser/Nodes.h
index fa61cdc..f2a7c1e 100644
--- a/JavaScriptCore/parser/Nodes.h
+++ b/JavaScriptCore/parser/Nodes.h
@@ -57,6 +57,7 @@ namespace JSC {
     const CodeFeatures WithFeature = 1 << 4;
     const CodeFeatures CatchFeature = 1 << 5;
     const CodeFeatures ThisFeature = 1 << 6;
+    const CodeFeatures StrictModeFeature = 1 << 7;
     const CodeFeatures AllFeatures = EvalFeature | ClosureFeature | AssignFeature | ArgumentsFeature | WithFeature | CatchFeature | ThisFeature;
 
     enum Operator {
@@ -1393,7 +1394,7 @@ namespace JSC {
         typedef DeclarationStacks::VarStack VarStack;
         typedef DeclarationStacks::FunctionStack FunctionStack;
 
-        ScopeNode(JSGlobalData*);
+        ScopeNode(JSGlobalData*, bool inStrictContext);
         ScopeNode(JSGlobalData*, const SourceCode&, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, CodeFeatures, int numConstants);
 
         using ParserArenaRefCounted::operator new;
@@ -1410,6 +1411,7 @@ namespace JSC {
 
         bool usesEval() const { return m_features & EvalFeature; }
         bool usesArguments() const { return m_features & ArgumentsFeature; }
+        bool isStrictMode() const { return m_features & StrictModeFeature; }
         void setUsesArguments() { m_features |= ArgumentsFeature; }
         bool usesThis() const { return m_features & ThisFeature; }
         bool needsActivationForMoreThanVariables() const { ASSERT(m_data); return m_features & (EvalFeature | WithFeature | CatchFeature); }
@@ -1444,6 +1446,7 @@ namespace JSC {
 
     class ProgramNode : public ScopeNode {
     public:
+        static const bool isFunctionNode = false;
         static PassRefPtr<ProgramNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         static const bool scopeIsFunction = false;
@@ -1456,6 +1459,7 @@ namespace JSC {
 
     class EvalNode : public ScopeNode {
     public:
+        static const bool isFunctionNode = false;
         static PassRefPtr<EvalNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         static const bool scopeIsFunction = false;
@@ -1476,7 +1480,8 @@ namespace JSC {
 
     class FunctionBodyNode : public ScopeNode {
     public:
-        static FunctionBodyNode* create(JSGlobalData*);
+        static const bool isFunctionNode = true;
+        static FunctionBodyNode* create(JSGlobalData*, bool isStrictMode);
         static PassRefPtr<FunctionBodyNode> create(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         FunctionParameters* parameters() const { return m_parameters.get(); }
@@ -1492,7 +1497,7 @@ namespace JSC {
         static const bool scopeIsFunction = true;
 
     private:
-        FunctionBodyNode(JSGlobalData*);
+        FunctionBodyNode(JSGlobalData*, bool inStrictContext);
         FunctionBodyNode(JSGlobalData*, SourceElements*, VarStack*, FunctionStack*, IdentifierSet&, const SourceCode&, CodeFeatures, int numConstants);
 
         Identifier m_ident;
diff --git a/JavaScriptCore/parser/Parser.cpp b/JavaScriptCore/parser/Parser.cpp
index bd77742..5092357 100644
--- a/JavaScriptCore/parser/Parser.cpp
+++ b/JavaScriptCore/parser/Parser.cpp
@@ -26,12 +26,6 @@
 #include "Debugger.h"
 #include "JSParser.h"
 #include "Lexer.h"
-#include <wtf/HashSet.h>
-#include <wtf/Vector.h>
-
-#ifndef yyparse
-extern int jscyyparse(void*);
-#endif
 
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
@@ -39,11 +33,15 @@ extern int jscyyparse(void*);
 
 namespace JSC {
 
-void Parser::parse(JSGlobalData* globalData, FunctionParameters* parameters, int* errLine, UString* errMsg)
+void Parser::parse(JSGlobalObject* lexicalGlobalObject, FunctionParameters* parameters, JSParserStrictness strictness, JSParserMode mode, int* errLine, UString* errMsg)
 {
+<<<<<<< HEAD
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::JavaScriptParseTimeCounter);
 #endif
+=======
+    ASSERT(lexicalGlobalObject);
+>>>>>>> webkit.org at r70209
     m_sourceElements = 0;
 
     int defaultErrLine;
@@ -57,10 +55,10 @@ void Parser::parse(JSGlobalData* globalData, FunctionParameters* parameters, int
     *errLine = -1;
     *errMsg = UString();
 
-    Lexer& lexer = *globalData->lexer;
+    Lexer& lexer = *lexicalGlobalObject->globalData()->lexer;
     lexer.setCode(*m_source, m_arena);
 
-    int parseError = jsParse(globalData, parameters, m_source);
+    int parseError = jsParse(lexicalGlobalObject, parameters, strictness, mode, m_source);
     int lineNumber = lexer.lineNumber();
     bool lexError = lexer.sawError();
     lexer.clear();
diff --git a/JavaScriptCore/parser/Parser.h b/JavaScriptCore/parser/Parser.h
index 9134de1..f5bbcb8 100644
--- a/JavaScriptCore/parser/Parser.h
+++ b/JavaScriptCore/parser/Parser.h
@@ -48,7 +48,7 @@ namespace JSC {
     class Parser : public Noncopyable {
     public:
         template <class ParsedNode>
-        PassRefPtr<ParsedNode> parse(JSGlobalData* globalData, JSGlobalObject* lexicalGlobalObject, Debugger*, ExecState*, const SourceCode& source, FunctionParameters*, JSObject** exception);
+        PassRefPtr<ParsedNode> parse(JSGlobalObject* lexicalGlobalObject, Debugger*, ExecState*, const SourceCode& source, FunctionParameters*, JSParserStrictness strictness, JSObject** exception);
 
         void didFinishParsing(SourceElements*, ParserArenaData<DeclarationStacks::VarStack>*, 
                               ParserArenaData<DeclarationStacks::FunctionStack>*, CodeFeatures features,
@@ -57,7 +57,7 @@ namespace JSC {
         ParserArena& arena() { return m_arena; }
 
     private:
-        void parse(JSGlobalData*, FunctionParameters*, int* errLine, UString* errMsg);
+        void parse(JSGlobalObject* lexicalGlobalObject, FunctionParameters*, JSParserStrictness strictness, JSParserMode mode, int* errLine, UString* errMsg);
 
         // Used to determine type of error to report.
         bool isFunctionBodyNode(ScopeNode*) { return false; }
@@ -75,20 +75,21 @@ namespace JSC {
     };
 
     template <class ParsedNode>
-    PassRefPtr<ParsedNode> Parser::parse(JSGlobalData* globalData, JSGlobalObject* lexicalGlobalObject, Debugger* debugger, ExecState* debuggerExecState, const SourceCode& source, FunctionParameters* parameters, JSObject** exception)
+    PassRefPtr<ParsedNode> Parser::parse(JSGlobalObject* lexicalGlobalObject, Debugger* debugger, ExecState* debuggerExecState, const SourceCode& source, FunctionParameters* parameters, JSParserStrictness strictness, JSObject** exception)
     {
+        ASSERT(lexicalGlobalObject);
         ASSERT(exception && !*exception);
         int errLine;
         UString errMsg;
 
         m_source = &source;
         if (ParsedNode::scopeIsFunction)
-            globalData->lexer->setIsReparsing();
-        parse(globalData, parameters, &errLine, &errMsg);
+            lexicalGlobalObject->globalData()->lexer->setIsReparsing();
+        parse(lexicalGlobalObject, parameters, strictness, ParsedNode::isFunctionNode ? JSParseFunctionCode : JSParseProgramCode, &errLine, &errMsg);
 
         RefPtr<ParsedNode> result;
         if (m_sourceElements) {
-            result = ParsedNode::create(globalData,
+            result = ParsedNode::create(lexicalGlobalObject->globalData(),
                 m_sourceElements,
                 m_varDeclarations ? &m_varDeclarations->data : 0,
                 m_funcDeclarations ? &m_funcDeclarations->data : 0,
@@ -107,7 +108,7 @@ namespace JSC {
             if (isFunctionBodyNode(static_cast<ParsedNode*>(0)))
                 *exception = createStackOverflowError(lexicalGlobalObject);
             else
-                *exception = addErrorInfo(globalData, createSyntaxError(lexicalGlobalObject, errMsg), errLine, source);
+                *exception = addErrorInfo(lexicalGlobalObject->globalData(), createSyntaxError(lexicalGlobalObject, errMsg), errLine, source);
         }
 
         m_arena.reset();
diff --git a/JavaScriptCore/parser/SyntaxChecker.h b/JavaScriptCore/parser/SyntaxChecker.h
index ce3ab61..f9093a7 100644
--- a/JavaScriptCore/parser/SyntaxChecker.h
+++ b/JavaScriptCore/parser/SyntaxChecker.h
@@ -30,15 +30,24 @@ namespace JSC {
 class SyntaxChecker {
 public:
     SyntaxChecker(JSGlobalData* , Lexer*)
+        : m_topBinaryExpr(0)
     {
     }
 
     typedef SyntaxChecker FunctionBodyBuilder;
+    enum { NoneExpr = 0,
+        ResolveEvalExpr, ResolveExpr, NumberExpr, StringExpr,
+        ThisExpr, NullExpr, BoolExpr, RegExpExpr, ObjectLiteralExpr,
+        FunctionExpr, BracketExpr, DotExpr, CallExpr,
+        NewExpr, PreExpr, PostExpr, UnaryExpr, BinaryExpr,
+        ConditionalExpr, AssignmentExpr, TypeofExpr,
+        DeleteExpr, ArrayLiteralExpr };
+    typedef int ExpressionType;
 
-    typedef int Expression;
+    typedef ExpressionType Expression;
     typedef int SourceElements;
     typedef int Arguments;
-    typedef int Comma;
+    typedef ExpressionType Comma;
     struct Property {
         ALWAYS_INLINE Property(void* = 0)
             : type((PropertyNode::Type)0)
@@ -73,38 +82,38 @@ public:
     static const bool NeedsFreeVariableInfo = false;
 
     int createSourceElements() { return 1; }
-    int makeFunctionCallNode(int, int, int, int, int) { return 1; }
-    void appendToComma(int, int) { }
-    int createCommaExpr(int, int) { return 1; }
-    int makeAssignNode(int, Operator, int, bool, bool, int, int, int) { return 1; }
-    int makePrefixNode(int, Operator, int, int, int) { return 1; }
-    int makePostfixNode(int, Operator, int, int, int) { return 1; }
-    int makeTypeOfNode(int) { return 1; }
-    int makeDeleteNode(int, int, int, int) { return 1; }
-    int makeNegateNode(int) { return 1; }
-    int makeBitwiseNotNode(int) { return 1; }
-    int createLogicalNot(int) { return 1; }
-    int createUnaryPlus(int) { return 1; }
-    int createVoid(int) { return 1; }
-    int thisExpr() { return 1; }
-    int createResolve(const Identifier*, int) { return 1; }
-    int createObjectLiteral() { return 1; }
-    int createObjectLiteral(int) { return 1; }
-    int createArray(int) { return 1; }
-    int createArray(int, int) { return 1; }
-    int createNumberExpr(double) { return 1; }
-    int createString(const Identifier*) { return 1; }
-    int createBoolean(bool) { return 1; }
-    int createNull() { return 1; }
-    int createBracketAccess(int, int, bool, int, int, int) { return 1; }
-    int createDotAccess(int, const Identifier&, int, int, int) { return 1; }
-    int createRegex(const Identifier&, const Identifier&, int) { return 1; }
-    int createNewExpr(int, int, int, int, int) { return 1; }
-    int createNewExpr(int, int, int) { return 1; }
-    int createConditionalExpr(int, int, int) { return 1; }
-    int createAssignResolve(const Identifier&, int, bool, int, int, int) { return 1; }
-    int createFunctionExpr(const Identifier*, int, int, int, int, int, int) { return 1; }
-    int createFunctionBody() { return 1; }
+    ExpressionType makeFunctionCallNode(int, int, int, int, int) { return CallExpr; }
+    void appendToComma(ExpressionType& base, ExpressionType right) { base = right; }
+    ExpressionType createCommaExpr(ExpressionType, ExpressionType right) { return right; }
+    ExpressionType makeAssignNode(ExpressionType, Operator, ExpressionType, bool, bool, int, int, int) { return AssignmentExpr; }
+    ExpressionType makePrefixNode(ExpressionType, Operator, int, int, int) { return PreExpr; }
+    ExpressionType makePostfixNode(ExpressionType, Operator, int, int, int) { return PostExpr; }
+    ExpressionType makeTypeOfNode(ExpressionType) { return TypeofExpr; }
+    ExpressionType makeDeleteNode(ExpressionType, int, int, int) { return DeleteExpr; }
+    ExpressionType makeNegateNode(ExpressionType) { return UnaryExpr; }
+    ExpressionType makeBitwiseNotNode(ExpressionType) { return UnaryExpr; }
+    ExpressionType createLogicalNot(ExpressionType) { return UnaryExpr; }
+    ExpressionType createUnaryPlus(ExpressionType) { return UnaryExpr; }
+    ExpressionType createVoid(ExpressionType) { return UnaryExpr; }
+    ExpressionType thisExpr() { return ThisExpr; }
+    ExpressionType createResolve(const Identifier*, int) { return ResolveExpr; }
+    ExpressionType createObjectLiteral() { return ObjectLiteralExpr; }
+    ExpressionType createObjectLiteral(int) { return ObjectLiteralExpr; }
+    ExpressionType createArray(int) { return ArrayLiteralExpr; }
+    ExpressionType createArray(int, int) { return ArrayLiteralExpr; }
+    ExpressionType createNumberExpr(double) { return NumberExpr; }
+    ExpressionType createString(const Identifier*) { return StringExpr; }
+    ExpressionType createBoolean(bool) { return BoolExpr; }
+    ExpressionType createNull() { return NullExpr; }
+    ExpressionType createBracketAccess(ExpressionType, ExpressionType, bool, int, int, int) { return BracketExpr; }
+    ExpressionType createDotAccess(ExpressionType, const Identifier&, int, int, int) { return DotExpr; }
+    ExpressionType createRegex(const Identifier&, const Identifier&, int) { return RegExpExpr; }
+    ExpressionType createNewExpr(ExpressionType, int, int, int, int) { return NewExpr; }
+    ExpressionType createNewExpr(ExpressionType, int, int) { return NewExpr; }
+    ExpressionType createConditionalExpr(ExpressionType, ExpressionType, ExpressionType) { return ConditionalExpr; }
+    ExpressionType createAssignResolve(const Identifier&, ExpressionType, bool, int, int, int) { return AssignmentExpr; }
+    ExpressionType createFunctionExpr(const Identifier*, int, int, int, int, int, int) { return FunctionExpr; }
+    int createFunctionBody(bool) { return 1; }
     int createArguments() { return 1; }
     int createArguments(int) { return 1; }
     int createArgumentsList(int) { return 1; }
@@ -169,26 +178,38 @@ public:
     void addVar(const Identifier*, bool) { }
     int combineCommaNodes(int, int) { return 1; }
     int evalCount() const { return 0; }
-    void appendBinaryExpressionInfo(int& operandStackDepth, int, int, int, int, bool) { operandStackDepth++; }
+    void appendBinaryExpressionInfo(int& operandStackDepth, int expr, int, int, int, bool)
+    {
+        if (!m_topBinaryExpr)
+            m_topBinaryExpr = expr;
+        else
+            m_topBinaryExpr = BinaryExpr;
+        operandStackDepth++;
+    }
     
     // Logic to handle datastructures used during parsing of binary expressions
     void operatorStackPop(int& operatorStackDepth) { operatorStackDepth--; }
     bool operatorStackHasHigherPrecedence(int&, int) { return true; }
-    BinaryOperand getFromOperandStack(int) { return 1; }
+    BinaryOperand getFromOperandStack(int) { return m_topBinaryExpr; }
     void shrinkOperandStackBy(int& operandStackDepth, int amount) { operandStackDepth -= amount; }
     void appendBinaryOperation(int& operandStackDepth, int&, BinaryOperand, BinaryOperand) { operandStackDepth++; }
     void operatorStackAppend(int& operatorStackDepth, int, int) { operatorStackDepth++; }
-    int popOperandStack(int&) { return 1; }
+    int popOperandStack(int&) { int res = m_topBinaryExpr; m_topBinaryExpr = 0; return res; }
     
-    void appendUnaryToken(int&, int, int) { }
-    int unaryTokenStackLastType(int&) { ASSERT_NOT_REACHED(); return 1; }
-    int unaryTokenStackLastStart(int&) { ASSERT_NOT_REACHED(); return 1; }
-    void unaryTokenStackRemoveLast(int&) { }
+    void appendUnaryToken(int& stackDepth, int tok, int) { stackDepth = 1; m_topUnaryToken = tok; }
+    int unaryTokenStackLastType(int&) { return m_topUnaryToken; }
+    int unaryTokenStackLastStart(int&) { return 0; }
+    void unaryTokenStackRemoveLast(int& stackDepth) { stackDepth = 0; }
     
     void assignmentStackAppend(int, int, int, int, int, Operator) { }
     int createAssignment(int, int, int, int, int) { ASSERT_NOT_REACHED(); return 1; }
     const Identifier& getName(const Property& property) { ASSERT(property.name); return *property.name; }
     PropertyNode::Type getType(const Property& property) { return property.type; }
+    bool isResolve(ExpressionType expr) { return expr == ResolveExpr || expr == ResolveEvalExpr; }
+    
+private:
+    int m_topBinaryExpr;
+    int m_topUnaryToken;
 };
 
 }
diff --git a/JavaScriptCore/profiler/Profiler.cpp b/JavaScriptCore/profiler/Profiler.cpp
index 021ecff..78fe2f5 100644
--- a/JavaScriptCore/profiler/Profiler.cpp
+++ b/JavaScriptCore/profiler/Profiler.cpp
@@ -39,7 +39,7 @@
 #include "Profile.h"
 #include "ProfileGenerator.h"
 #include "ProfileNode.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include <stdio.h>
 
 namespace JSC {
@@ -152,7 +152,7 @@ CallIdentifier Profiler::createCallIdentifier(ExecState* exec, JSValue functionV
         return CallIdentifier(static_cast<JSFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
     if (asObject(functionValue)->inherits(&InternalFunction::info))
         return CallIdentifier(static_cast<InternalFunction*>(asObject(functionValue))->name(exec), defaultSourceURL, defaultLineNumber);
-    return CallIdentifier(makeString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
+    return CallIdentifier(makeUString("(", asObject(functionValue)->className(), " object)"), defaultSourceURL, defaultLineNumber);
 }
 
 CallIdentifier createCallIdentifierFromFunctionImp(ExecState* exec, JSFunction* function)
diff --git a/JavaScriptCore/runtime/Arguments.cpp b/JavaScriptCore/runtime/Arguments.cpp
index 450dc7d..5c5e522 100644
--- a/JavaScriptCore/runtime/Arguments.cpp
+++ b/JavaScriptCore/runtime/Arguments.cpp
@@ -153,6 +153,30 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, unsigned i, PropertySlot& sl
 
     return JSObject::getOwnPropertySlot(exec, Identifier(exec, UString::number(i)), slot);
 }
+    
+void Arguments::createStrictModeCallerIfNecessary(ExecState* exec)
+{
+    if (d->overrodeCaller)
+        return;
+
+    d->overrodeCaller = true;
+    PropertyDescriptor descriptor;
+    JSValue thrower = createTypeErrorFunction(exec, "Unable to access caller of strict mode function");
+    descriptor.setAccessorDescriptor(thrower, thrower, DontEnum | DontDelete | Getter | Setter);
+    defineOwnProperty(exec, exec->propertyNames().caller, descriptor, false);
+}
+
+void Arguments::createStrictModeCalleeIfNecessary(ExecState* exec)
+{
+    if (d->overrodeCallee)
+        return;
+    
+    d->overrodeCallee = true;
+    PropertyDescriptor descriptor;
+    JSValue thrower = createTypeErrorFunction(exec, "Unable to access callee of strict mode function");
+    descriptor.setAccessorDescriptor(thrower, thrower, DontEnum | DontDelete | Getter | Setter);
+    defineOwnProperty(exec, exec->propertyNames().callee, descriptor, false);
+}
 
 bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyName, PropertySlot& slot)
 {
@@ -172,10 +196,16 @@ bool Arguments::getOwnPropertySlot(ExecState* exec, const Identifier& propertyNa
     }
 
     if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
-        slot.setValue(d->callee);
-        return true;
+        if (!d->isStrictMode) {
+            slot.setValue(d->callee);
+            return true;
+        }
+        createStrictModeCalleeIfNecessary(exec);
     }
 
+    if (propertyName == exec->propertyNames().caller && d->isStrictMode)
+        createStrictModeCallerIfNecessary(exec);
+
     return JSObject::getOwnPropertySlot(exec, propertyName, slot);
 }
 
@@ -197,9 +227,15 @@ bool Arguments::getOwnPropertyDescriptor(ExecState* exec, const Identifier& prop
     }
     
     if (propertyName == exec->propertyNames().callee && LIKELY(!d->overrodeCallee)) {
-        descriptor.setDescriptor(d->callee, DontEnum);
-        return true;
+        if (!d->isStrictMode) {
+            descriptor.setDescriptor(d->callee, DontEnum);
+            return true;
+        }
+        createStrictModeCalleeIfNecessary(exec);
     }
+
+    if (propertyName == exec->propertyNames().caller && d->isStrictMode)
+        createStrictModeCallerIfNecessary(exec);
     
     return JSObject::getOwnPropertyDescriptor(exec, propertyName, descriptor);
 }
@@ -249,11 +285,17 @@ void Arguments::put(ExecState* exec, const Identifier& propertyName, JSValue val
     }
 
     if (propertyName == exec->propertyNames().callee && !d->overrodeCallee) {
-        d->overrodeCallee = true;
-        putDirect(propertyName, value, DontEnum);
-        return;
+        if (!d->isStrictMode) {
+            d->overrodeCallee = true;
+            putDirect(propertyName, value, DontEnum);
+            return;
+        }
+        createStrictModeCalleeIfNecessary(exec);
     }
 
+    if (propertyName == exec->propertyNames().caller && d->isStrictMode)
+        createStrictModeCallerIfNecessary(exec);
+
     JSObject::put(exec, propertyName, value, slot);
 }
 
@@ -294,9 +336,15 @@ bool Arguments::deleteProperty(ExecState* exec, const Identifier& propertyName)
     }
 
     if (propertyName == exec->propertyNames().callee && !d->overrodeCallee) {
-        d->overrodeCallee = true;
-        return true;
+        if (!d->isStrictMode) {
+            d->overrodeCallee = true;
+            return true;
+        }
+        createStrictModeCalleeIfNecessary(exec);
     }
+    
+    if (propertyName == exec->propertyNames().caller && !d->isStrictMode)
+        createStrictModeCallerIfNecessary(exec);
 
     return JSObject::deleteProperty(exec, propertyName);
 }
diff --git a/JavaScriptCore/runtime/Arguments.h b/JavaScriptCore/runtime/Arguments.h
index 49c8b3b..715a2ac 100644
--- a/JavaScriptCore/runtime/Arguments.h
+++ b/JavaScriptCore/runtime/Arguments.h
@@ -50,6 +50,8 @@ namespace JSC {
         JSFunction* callee;
         bool overrodeLength : 1;
         bool overrodeCallee : 1;
+        bool overrodeCaller : 1;
+        bool isStrictMode : 1;
     };
 
 
@@ -105,6 +107,8 @@ namespace JSC {
         virtual void put(ExecState*, unsigned propertyName, JSValue, PutPropertySlot&);
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
         virtual bool deleteProperty(ExecState*, unsigned propertyName);
+        void createStrictModeCallerIfNecessary(ExecState*);
+        void createStrictModeCalleeIfNecessary(ExecState*);
 
         virtual const ClassInfo* classInfo() const { return &info; }
 
@@ -172,6 +176,10 @@ namespace JSC {
         d->callee = callee;
         d->overrodeLength = false;
         d->overrodeCallee = false;
+        d->overrodeCaller = false;
+        d->isStrictMode = callFrame->codeBlock()->isStrictMode();
+        if (d->isStrictMode)
+            copyRegisters();
     }
 
     inline Arguments::Arguments(CallFrame* callFrame, NoParametersType)
@@ -201,6 +209,10 @@ namespace JSC {
         d->callee = asFunction(callFrame->callee());
         d->overrodeLength = false;
         d->overrodeCallee = false;
+        d->overrodeCaller = false;
+        d->isStrictMode = callFrame->codeBlock()->isStrictMode();
+        if (d->isStrictMode)
+            copyRegisters();
     }
 
     inline void Arguments::copyRegisters()
diff --git a/JavaScriptCore/runtime/ArrayPrototype.cpp b/JavaScriptCore/runtime/ArrayPrototype.cpp
index 28269ff..6002ebb 100644
--- a/JavaScriptCore/runtime/ArrayPrototype.cpp
+++ b/JavaScriptCore/runtime/ArrayPrototype.cpp
@@ -180,7 +180,14 @@ EncodedJSValue JSC_HOST_CALL arrayProtoFuncToString(ExecState* exec)
 
     unsigned length = thisObj->get(exec, exec->propertyNames().length).toUInt32(exec);
     unsigned totalSize = length ? length - 1 : 0;
+#if OS(SYMBIAN)
+    // Symbian has very limited stack size available.
+    // This function could be called recursively and allocating 1K on stack here cause
+    // stack overflow on Symbian devices.
+    Vector<RefPtr<StringImpl> > strBuffer(length);
+#else
     Vector<RefPtr<StringImpl>, 256> strBuffer(length);
+#endif    
     for (unsigned k = 0; k < length; k++) {
         JSValue element;
         if (isRealArray && thisObj->canGetIndex(k))
diff --git a/JavaScriptCore/runtime/Collector.cpp b/JavaScriptCore/runtime/Collector.cpp
index 93b91bb..f341646 100644
--- a/JavaScriptCore/runtime/Collector.cpp
+++ b/JavaScriptCore/runtime/Collector.cpp
@@ -642,19 +642,6 @@ inline bool isPointerAligned(void* p)
 // Cell size needs to be a power of two for isPossibleCell to be valid.
 COMPILE_ASSERT(sizeof(CollectorCell) % 2 == 0, Collector_cell_size_is_power_of_two);
 
-#if USE(JSVALUE32)
-static bool isHalfCellAligned(void *p)
-{
-    return (((intptr_t)(p) & (CELL_MASK >> 1)) == 0);
-}
-
-static inline bool isPossibleCell(void* p)
-{
-    return isHalfCellAligned(p) && p;
-}
-
-#else
-
 static inline bool isCellAligned(void *p)
 {
     return (((intptr_t)(p) & CELL_MASK) == 0);
@@ -664,7 +651,6 @@ static inline bool isPossibleCell(void* p)
 {
     return isCellAligned(p) && p;
 }
-#endif // USE(JSVALUE32)
 
 void Heap::markConservatively(MarkStack& markStack, void* start, void* end)
 {
@@ -1145,10 +1131,6 @@ static const char* typeName(JSCell* cell)
 {
     if (cell->isString())
         return "string";
-#if USE(JSVALUE32)
-    if (cell->isNumber())
-        return "number";
-#endif
     if (cell->isGetterSetter())
         return "Getter-Setter";
     if (cell->isAPIValueWrapper())
diff --git a/JavaScriptCore/runtime/Collector.h b/JavaScriptCore/runtime/Collector.h
index 05d5c10..237c139 100644
--- a/JavaScriptCore/runtime/Collector.h
+++ b/JavaScriptCore/runtime/Collector.h
@@ -57,7 +57,7 @@ namespace JSC {
 
     class LiveObjectIterator;
 
-#if OS(WINCE) || OS(SYMBIAN)
+#if OS(WINCE) || OS(SYMBIAN) || PLATFORM(BREWMP)
     const size_t BLOCK_SIZE = 64 * 1024; // 64k
 #else
     const size_t BLOCK_SIZE = 256 * 1024; // 256k
diff --git a/JavaScriptCore/runtime/CommonIdentifiers.cpp b/JavaScriptCore/runtime/CommonIdentifiers.cpp
index 3837817..1561102 100644
--- a/JavaScriptCore/runtime/CommonIdentifiers.cpp
+++ b/JavaScriptCore/runtime/CommonIdentifiers.cpp
@@ -32,6 +32,7 @@ CommonIdentifiers::CommonIdentifiers(JSGlobalData* globalData)
     , emptyIdentifier(globalData, "")
     , underscoreProto(globalData, "__proto__")
     , thisIdentifier(globalData, "this")
+    , useStrictIdentifier(globalData, "use strict")
     JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(INITIALIZE_PROPERTY_NAME)
 {
 }
diff --git a/JavaScriptCore/runtime/CommonIdentifiers.h b/JavaScriptCore/runtime/CommonIdentifiers.h
index de24f4a..1e22b6a 100644
--- a/JavaScriptCore/runtime/CommonIdentifiers.h
+++ b/JavaScriptCore/runtime/CommonIdentifiers.h
@@ -94,6 +94,7 @@ namespace JSC {
         const Identifier emptyIdentifier;
         const Identifier underscoreProto;
         const Identifier thisIdentifier;
+        const Identifier useStrictIdentifier;
 
 #define JSC_IDENTIFIER_DECLARE_PROPERTY_NAME_GLOBAL(name) const Identifier name;
         JSC_COMMON_IDENTIFIERS_EACH_PROPERTY_NAME(JSC_IDENTIFIER_DECLARE_PROPERTY_NAME_GLOBAL)
diff --git a/JavaScriptCore/runtime/DateConversion.cpp b/JavaScriptCore/runtime/DateConversion.cpp
index 7eb82e4..d4b8232 100644
--- a/JavaScriptCore/runtime/DateConversion.cpp
+++ b/JavaScriptCore/runtime/DateConversion.cpp
@@ -57,7 +57,9 @@ double parseDate(ExecState* exec, const UString &date)
 {
     if (date == exec->globalData().cachedDateString)
         return exec->globalData().cachedDateStringValue;
-    double value = parseDateFromNullTerminatedCharacters(exec, date.utf8().data());
+    double value = parseES5DateFromNullTerminatedCharacters(date.utf8().data());
+    if (isnan(value))
+        value = parseDateFromNullTerminatedCharacters(exec, date.utf8().data());
     exec->globalData().cachedDateString = date;
     exec->globalData().cachedDateStringValue = value;
     return value;
diff --git a/JavaScriptCore/runtime/Error.cpp b/JavaScriptCore/runtime/Error.cpp
index a2be473..e35424b 100644
--- a/JavaScriptCore/runtime/Error.cpp
+++ b/JavaScriptCore/runtime/Error.cpp
@@ -195,4 +195,47 @@ JSObject* throwSyntaxError(ExecState* exec)
     return throwError(exec, createSyntaxError(exec, "Syntax error"));
 }
 
+class StrictModeTypeErrorFunction : public InternalFunction {
+public:
+    StrictModeTypeErrorFunction(ExecState* exec, JSGlobalObject* globalObject, NonNullPassRefPtr<Structure> structure, const UString& message)
+        : InternalFunction(&exec->globalData(), globalObject, structure, exec->globalData().propertyNames->emptyIdentifier)
+        , m_message(message)
+    {
+    }
+    
+    static EncodedJSValue JSC_HOST_CALL constructThrowTypeError(ExecState* exec)
+    {
+        throwTypeError(exec, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
+        return JSValue::encode(jsNull());
+    }
+    
+    ConstructType getConstructData(ConstructData& constructData)
+    {
+        constructData.native.function = constructThrowTypeError;
+        return ConstructTypeHost;
+    }
+    
+    static EncodedJSValue JSC_HOST_CALL callThrowTypeError(ExecState* exec)
+    {
+        throwTypeError(exec, static_cast<StrictModeTypeErrorFunction*>(exec->callee())->m_message);
+        return JSValue::encode(jsNull());
+    }
+
+    CallType getCallData(CallData& callData)
+    {
+        callData.native.function = callThrowTypeError;
+        return CallTypeHost;
+    }
+
+private:
+    UString m_message;
+};
+
+COMPILE_ASSERT(sizeof(StrictModeTypeErrorFunction) <= sizeof(CollectorCell), sizeof_StrictModeTypeErrorFunction_must_be_less_than_CollectorCell);
+
+JSValue createTypeErrorFunction(ExecState* exec, const UString& message)
+{
+    return new (exec) StrictModeTypeErrorFunction(exec, exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->internalFunctionStructure(), message);
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/Error.h b/JavaScriptCore/runtime/Error.h
index 1a0ece5..bfde7dc 100644
--- a/JavaScriptCore/runtime/Error.h
+++ b/JavaScriptCore/runtime/Error.h
@@ -73,6 +73,8 @@ namespace JSC {
     inline EncodedJSValue throwVMError(ExecState* exec, JSValue error) { return JSValue::encode(throwError(exec, error)); }
     inline EncodedJSValue throwVMTypeError(ExecState* exec) { return JSValue::encode(throwTypeError(exec)); }
 
+    JSValue createTypeErrorFunction(ExecState* exec, const UString& message);
+    
 } // namespace JSC
 
 #endif // Error_h
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.cpp b/JavaScriptCore/runtime/ExceptionHelpers.cpp
index 9a6fe5e..a1e28d1 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.cpp
+++ b/JavaScriptCore/runtime/ExceptionHelpers.cpp
@@ -36,7 +36,7 @@
 #include "JSNotAnObject.h"
 #include "Interpreter.h"
 #include "Nodes.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 
 namespace JSC {
 
@@ -90,7 +90,7 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString message(makeString("Can't find variable: ", ident.ustring()));
+    UString message(makeUString("Can't find variable: ", ident.ustring()));
     JSObject* exception = addErrorInfo(exec, createReferenceError(exec, message), line, codeBlock->ownerExecutable()->source(), divotPoint, startOffset, endOffset);
     return exception;
 }
@@ -98,9 +98,9 @@ JSValue createUndefinedVariableError(ExecState* exec, const Identifier& ident, u
 static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, int expressionStart, int expressionStop, JSValue value, UString error)
 {
     if (!expressionStop || expressionStart > codeBlock->source()->length())
-        return makeString(value.toString(exec), " is ", error);
+        return makeUString(value.toString(exec), " is ", error);
     if (expressionStart < expressionStop)
-        return makeString("Result of expression '", codeBlock->source()->getRange(expressionStart, expressionStop), "' [", value.toString(exec), "] is ", error, ".");
+        return makeUString("Result of expression '", codeBlock->source()->getRange(expressionStart, expressionStop), "' [", value.toString(exec), "] is ", error, ".");
 
     // No range information, so give a few characters of context
     const UChar* data = codeBlock->source()->data();
@@ -117,7 +117,7 @@ static UString createErrorMessage(ExecState* exec, CodeBlock* codeBlock, int, in
         stop++;
     while (stop > expressionStart && isStrWhiteSpace(data[stop]))
         stop--;
-    return makeString("Result of expression near '...", codeBlock->source()->getRange(start, stop), "...' [", value.toString(exec), "] is ", error, ".");
+    return makeUString("Result of expression near '...", codeBlock->source()->getRange(start, stop), "...' [", value.toString(exec), "] is ", error, ".");
 }
 
 JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value, unsigned bytecodeOffset, CodeBlock* codeBlock)
@@ -126,7 +126,7 @@ JSObject* createInvalidParamError(ExecState* exec, const char* op, JSValue value
     int endOffset = 0;
     int divotPoint = 0;
     int line = codeBlock->expressionRangeForBytecodeOffset(exec, bytecodeOffset, divotPoint, startOffset, endOffset);
-    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, makeString("not a valid argument for '", op, "'"));
+    UString errorMessage = createErrorMessage(exec, codeBlock, line, divotPoint, divotPoint + endOffset, value, makeUString("not a valid argument for '", op, "'"));
     JSObject* exception = addErrorInfo(exec, createTypeError(exec, errorMessage), line, codeBlock->ownerExecutable()->source(), divotPoint, startOffset, endOffset);
     return exception;
 }
@@ -192,4 +192,9 @@ JSValue throwOutOfMemoryError(ExecState* exec)
     return throwError(exec, createError(exec, "Out of memory"));
 }
 
+JSObject* createErrorForInvalidGlobalAssignment(ExecState* exec, const UString& propertyName)
+{
+    return createReferenceError(exec, makeUString("Strict mode forbids implicit creation of global property '", propertyName, "'"));
+}    
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/ExceptionHelpers.h b/JavaScriptCore/runtime/ExceptionHelpers.h
index 3e6de86..9b6f1f2 100644
--- a/JavaScriptCore/runtime/ExceptionHelpers.h
+++ b/JavaScriptCore/runtime/ExceptionHelpers.h
@@ -54,6 +54,7 @@ namespace JSC {
     JSValue createNotAFunctionError(ExecState*, JSValue, unsigned bytecodeOffset, CodeBlock*);
     JSObject* createNotAnObjectError(ExecState*, JSNotAnObjectErrorStub*, unsigned bytecodeOffset, CodeBlock*);
     JSValue throwOutOfMemoryError(ExecState*);
+    JSObject* createErrorForInvalidGlobalAssignment(ExecState*, const UString&);
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/Executable.cpp b/JavaScriptCore/runtime/Executable.cpp
index 871f3e2..2ad4b2d 100644
--- a/JavaScriptCore/runtime/Executable.cpp
+++ b/JavaScriptCore/runtime/Executable.cpp
@@ -30,7 +30,7 @@
 #include "CodeBlock.h"
 #include "JIT.h"
 #include "Parser.h"
-#include "StringBuilder.h"
+#include "UStringBuilder.h"
 #include "Vector.h"
 
 namespace JSC {
@@ -45,8 +45,8 @@ VPtrHackExecutable::~VPtrHackExecutable()
 {
 }
 
-EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source)
-    : ScriptExecutable(exec, source)
+EvalExecutable::EvalExecutable(ExecState* exec, const SourceCode& source, bool inStrictContext)
+    : ScriptExecutable(exec, source, inStrictContext)
 {
 }
 
@@ -55,7 +55,7 @@ EvalExecutable::~EvalExecutable()
 }
 
 ProgramExecutable::ProgramExecutable(ExecState* exec, const SourceCode& source)
-    : ScriptExecutable(exec, source)
+    : ScriptExecutable(exec, source, false)
 {
 }
 
@@ -63,8 +63,8 @@ ProgramExecutable::~ProgramExecutable()
 {
 }
 
-FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
-    : ScriptExecutable(globalData, source)
+FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
+    : ScriptExecutable(globalData, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -75,8 +75,8 @@ FunctionExecutable::FunctionExecutable(JSGlobalData* globalData, const Identifie
     m_lastLine = lastLine;
 }
 
-FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
-    : ScriptExecutable(exec, source)
+FunctionExecutable::FunctionExecutable(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool inStrictContext, int firstLine, int lastLine)
+    : ScriptExecutable(exec, source, inStrictContext)
     , m_numCapturedVariables(0)
     , m_forceUsesArguments(forceUsesArguments)
     , m_parameters(parameters)
@@ -96,7 +96,7 @@ JSObject* EvalExecutable::compileInternal(ExecState* exec, ScopeChainNode* scope
     JSObject* exception = 0;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<EvalNode> evalNode = globalData->parser->parse<EvalNode>(globalData, lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, &exception);
+    RefPtr<EvalNode> evalNode = globalData->parser->parse<EvalNode>(lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
     if (!evalNode) {
         ASSERT(exception);
         return exception;
@@ -131,7 +131,7 @@ JSObject* ProgramExecutable::checkSyntax(ExecState* exec)
     JSObject* exception = 0;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> programNode = globalData->parser->parse<ProgramNode>(globalData, lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, &exception);
+    RefPtr<ProgramNode> programNode = globalData->parser->parse<ProgramNode>(lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, JSParseNormal, &exception);
     if (programNode)
         return 0;
     ASSERT(exception);
@@ -145,7 +145,7 @@ JSObject* ProgramExecutable::compileInternal(ExecState* exec, ScopeChainNode* sc
     JSObject* exception = 0;
     JSGlobalData* globalData = &exec->globalData();
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> programNode = globalData->parser->parse<ProgramNode>(globalData, lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, &exception);
+    RefPtr<ProgramNode> programNode = globalData->parser->parse<ProgramNode>(lexicalGlobalObject, lexicalGlobalObject->debugger(), exec, m_source, 0, isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
     if (!programNode) {
         ASSERT(exception);
         return exception;
@@ -178,7 +178,7 @@ JSObject* FunctionExecutable::compileForCallInternal(ExecState* exec, ScopeChain
 {
     JSObject* exception = 0;
     JSGlobalData* globalData = scopeChainNode->globalData;
-    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, exec->lexicalGlobalObject(), 0, 0, m_source, m_parameters.get(), &exception);
+    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(exec->lexicalGlobalObject(), 0, 0, m_source, m_parameters.get(), isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
     if (!body) {
         ASSERT(exception);
         return exception;
@@ -219,7 +219,7 @@ JSObject* FunctionExecutable::compileForConstructInternal(ExecState* exec, Scope
 {
     JSObject* exception = 0;
     JSGlobalData* globalData = scopeChainNode->globalData;
-    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(globalData, exec->lexicalGlobalObject(), 0, 0, m_source, m_parameters.get(), &exception);
+    RefPtr<FunctionBodyNode> body = globalData->parser->parse<FunctionBodyNode>(exec->lexicalGlobalObject(), 0, 0, m_source, m_parameters.get(), isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
     if (!body) {
         ASSERT(exception);
         return exception;
@@ -264,12 +264,14 @@ void FunctionExecutable::markAggregate(MarkStack& markStack)
         m_codeBlockForConstruct->markAggregate(markStack);
 }
 
-PassOwnPtr<ExceptionInfo> FunctionExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+PassOwnPtr<ExceptionInfo> FunctionExecutable::reparseExceptionInfo(ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
 {
     JSObject* exception = 0;
-    RefPtr<FunctionBodyNode> newFunctionBody = globalData->parser->parse<FunctionBodyNode>(globalData, 0, 0, 0, m_source, m_parameters.get(), &exception);
+    JSGlobalData* globalData = scopeChainNode->globalData;
+    RefPtr<FunctionBodyNode> newFunctionBody = globalData->parser->parse<FunctionBodyNode>(scopeChainNode->globalObject, 0, 0, m_source, m_parameters.get(), isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
     if (!newFunctionBody)
         return PassOwnPtr<ExceptionInfo>();
+    ASSERT(newFunctionBody->isStrictMode() == isStrictMode());
     if (m_forceUsesArguments)
         newFunctionBody->setUsesArguments();
     newFunctionBody->finishParsing(m_parameters, m_name);
@@ -298,10 +300,12 @@ PassOwnPtr<ExceptionInfo> FunctionExecutable::reparseExceptionInfo(JSGlobalData*
     return newCodeBlock->extractExceptionInfo();
 }
 
-PassOwnPtr<ExceptionInfo> EvalExecutable::reparseExceptionInfo(JSGlobalData* globalData, ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
+PassOwnPtr<ExceptionInfo> EvalExecutable::reparseExceptionInfo(ScopeChainNode* scopeChainNode, CodeBlock* codeBlock)
 {
     JSObject* exception = 0;
-    RefPtr<EvalNode> newEvalBody = globalData->parser->parse<EvalNode>(globalData, 0, 0, 0, m_source, 0, &exception);
+    JSGlobalData* globalData = scopeChainNode->globalData;
+    RefPtr<EvalNode> newEvalBody = globalData->parser->parse<EvalNode>(scopeChainNode->globalObject, 0, 0, m_source, 0, isStrictMode() ? JSParseStrict : JSParseNormal, &exception);
+    ASSERT(newEvalBody->isStrictMode() == isStrictMode());
     if (!newEvalBody)
         return PassOwnPtr<ExceptionInfo>();
 
@@ -341,7 +345,7 @@ void FunctionExecutable::recompile(ExecState*)
 PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifier& functionName, ExecState* exec, Debugger* debugger, const SourceCode& source, JSObject** exception)
 {
     JSGlobalObject* lexicalGlobalObject = exec->lexicalGlobalObject();
-    RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(&exec->globalData(), lexicalGlobalObject, debugger, exec, source, 0, exception);
+    RefPtr<ProgramNode> program = exec->globalData().parser->parse<ProgramNode>(lexicalGlobalObject, debugger, exec, source, 0, JSParseNormal, exception);
     if (!program) {
         ASSERT(*exception);
         return 0;
@@ -357,22 +361,22 @@ PassRefPtr<FunctionExecutable> FunctionExecutable::fromGlobalCode(const Identifi
     FunctionBodyNode* body = static_cast<FuncExprNode*>(funcExpr)->body();
     ASSERT(body);
 
-    return FunctionExecutable::create(&exec->globalData(), functionName, body->source(), body->usesArguments(), body->parameters(), body->lineNo(), body->lastLine());
+    return FunctionExecutable::create(&exec->globalData(), functionName, body->source(), body->usesArguments(), body->parameters(), body->isStrictMode(), body->lineNo(), body->lastLine());
 }
 
 UString FunctionExecutable::paramString() const
 {
     FunctionParameters& parameters = *m_parameters;
-    StringBuilder builder;
+    UStringBuilder builder;
     for (size_t pos = 0; pos < parameters.size(); ++pos) {
         if (!builder.isEmpty())
             builder.append(", ");
         builder.append(parameters[pos].ustring());
     }
-    return builder.build();
+    return builder.toUString();
 }
 
-PassOwnPtr<ExceptionInfo> ProgramExecutable::reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*)
+PassOwnPtr<ExceptionInfo> ProgramExecutable::reparseExceptionInfo(ScopeChainNode*, CodeBlock*)
 {
     // CodeBlocks for program code are transient and therefore do not gain from from throwing out their exception information.
     return PassOwnPtr<ExceptionInfo>();
diff --git a/JavaScriptCore/runtime/Executable.h b/JavaScriptCore/runtime/Executable.h
index feab7ef..4c4ca56 100644
--- a/JavaScriptCore/runtime/Executable.h
+++ b/JavaScriptCore/runtime/Executable.h
@@ -138,10 +138,10 @@ namespace JSC {
 
     class ScriptExecutable : public ExecutableBase {
     public:
-        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source)
+        ScriptExecutable(JSGlobalData* globalData, const SourceCode& source, bool isInStrictContext)
             : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
-            , m_features(0)
+            , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
 #if ENABLE(CODEBLOCK_SAMPLING)
             relaxAdoptionRequirement();
@@ -152,10 +152,10 @@ namespace JSC {
 #endif
         }
 
-        ScriptExecutable(ExecState* exec, const SourceCode& source)
+        ScriptExecutable(ExecState* exec, const SourceCode& source, bool isInStrictContext)
             : ExecutableBase(NUM_PARAMETERS_NOT_COMPILED)
             , m_source(source)
-            , m_features(0)
+            , m_features(isInStrictContext ? StrictModeFeature : 0)
         {
 #if ENABLE(CODEBLOCK_SAMPLING)
             relaxAdoptionRequirement();
@@ -175,8 +175,9 @@ namespace JSC {
         bool usesEval() const { return m_features & EvalFeature; }
         bool usesArguments() const { return m_features & ArgumentsFeature; }
         bool needsActivation() const { return m_hasCapturedVariables || m_features & (EvalFeature | WithFeature | CatchFeature); }
+        bool isStrictMode() const { return m_features & StrictModeFeature; }
 
-        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*) = 0;
+        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(ScopeChainNode*, CodeBlock*) = 0;
 
     protected:
         void recordParse(CodeFeatures features, bool hasCapturedVariables, int firstLine, int lastLine)
@@ -214,7 +215,7 @@ namespace JSC {
             return *m_evalCodeBlock;
         }
 
-        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source) { return adoptRef(new EvalExecutable(exec, source)); }
+        static PassRefPtr<EvalExecutable> create(ExecState* exec, const SourceCode& source, bool isInStrictContext) { return adoptRef(new EvalExecutable(exec, source, isInStrictContext)); }
 
 #if ENABLE(JIT)
         JITCode& generatedJITCode()
@@ -224,11 +225,11 @@ namespace JSC {
 #endif
 
     private:
-        EvalExecutable(ExecState*, const SourceCode&);
+        EvalExecutable(ExecState*, const SourceCode&, bool);
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
 
-        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(ScopeChainNode*, CodeBlock*);
 
         OwnPtr<EvalCodeBlock> m_evalCodeBlock;
     };
@@ -271,7 +272,7 @@ namespace JSC {
 
         JSObject* compileInternal(ExecState*, ScopeChainNode*);
 
-        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(ScopeChainNode*, CodeBlock*);
 
         OwnPtr<ProgramCodeBlock> m_programCodeBlock;
     };
@@ -279,14 +280,14 @@ namespace JSC {
     class FunctionExecutable : public ScriptExecutable {
         friend class JIT;
     public:
-        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        static PassRefPtr<FunctionExecutable> create(ExecState* exec, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, firstLine, lastLine));
+            return adoptRef(new FunctionExecutable(exec, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
         }
 
-        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, int firstLine, int lastLine)
+        static PassRefPtr<FunctionExecutable> create(JSGlobalData* globalData, const Identifier& name, const SourceCode& source, bool forceUsesArguments, FunctionParameters* parameters, bool isInStrictContext, int firstLine, int lastLine)
         {
-            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, firstLine, lastLine));
+            return adoptRef(new FunctionExecutable(globalData, name, source, forceUsesArguments, parameters, isInStrictContext, firstLine, lastLine));
         }
 
         ~FunctionExecutable();
@@ -358,13 +359,13 @@ namespace JSC {
         static PassRefPtr<FunctionExecutable> fromGlobalCode(const Identifier&, ExecState*, Debugger*, const SourceCode&, JSObject** exception);
 
     private:
-        FunctionExecutable(JSGlobalData*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, int firstLine, int lastLine);
-        FunctionExecutable(ExecState*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, int firstLine, int lastLine);
+        FunctionExecutable(JSGlobalData*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool, int firstLine, int lastLine);
+        FunctionExecutable(ExecState*, const Identifier& name, const SourceCode&, bool forceUsesArguments, FunctionParameters*, bool, int firstLine, int lastLine);
 
         JSObject* compileForCallInternal(ExecState*, ScopeChainNode*);
         JSObject* compileForConstructInternal(ExecState*, ScopeChainNode*);
 
-        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(JSGlobalData*, ScopeChainNode*, CodeBlock*);
+        virtual PassOwnPtr<ExceptionInfo> reparseExceptionInfo(ScopeChainNode*, CodeBlock*);
 
         unsigned m_numCapturedVariables : 31;
         bool m_forceUsesArguments : 1;
diff --git a/JavaScriptCore/runtime/FunctionConstructor.cpp b/JavaScriptCore/runtime/FunctionConstructor.cpp
index f72a273..9b59720 100644
--- a/JavaScriptCore/runtime/FunctionConstructor.cpp
+++ b/JavaScriptCore/runtime/FunctionConstructor.cpp
@@ -30,8 +30,8 @@
 #include "Lexer.h"
 #include "Nodes.h"
 #include "Parser.h"
-#include "StringBuilder.h"
-#include "StringConcatenate.h"
+#include "UStringBuilder.h"
+#include "UStringConcatenate.h"
 
 namespace JSC {
 
@@ -81,9 +81,9 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
     if (args.isEmpty())
         program = "(function() { \n})";
     else if (args.size() == 1)
-        program = makeString("(function() { ", args.at(0).toString(exec), "\n})");
+        program = makeUString("(function() { ", args.at(0).toString(exec), "\n})");
     else {
-        StringBuilder builder;
+        UStringBuilder builder;
         builder.append("(function(");
         builder.append(args.at(0).toString(exec));
         for (size_t i = 1; i < args.size() - 1; i++) {
@@ -93,7 +93,7 @@ JSObject* constructFunction(ExecState* exec, const ArgList& args, const Identifi
         builder.append(") { ");
         builder.append(args.at(args.size() - 1).toString(exec));
         builder.append("\n})");
-        program = builder.build();
+        program = builder.toUString();
     }
 
     JSGlobalObject* globalObject = exec->lexicalGlobalObject();
diff --git a/JavaScriptCore/runtime/FunctionPrototype.cpp b/JavaScriptCore/runtime/FunctionPrototype.cpp
index c740624..ef42cdc 100644
--- a/JavaScriptCore/runtime/FunctionPrototype.cpp
+++ b/JavaScriptCore/runtime/FunctionPrototype.cpp
@@ -77,7 +77,7 @@ static inline void insertSemicolonIfNeeded(UString& functionBody)
         UChar ch = functionBody[i];
         if (!Lexer::isWhiteSpace(ch) && !Lexer::isLineTerminator(ch)) {
             if (ch != ';' && ch != '}')
-                functionBody = makeString(functionBody.substringSharingImpl(0, i + 1), ";", functionBody.substringSharingImpl(i + 1, functionBody.length() - (i + 1)));
+                functionBody = makeUString(functionBody.substringSharingImpl(0, i + 1), ";", functionBody.substringSharingImpl(i + 1, functionBody.length() - (i + 1)));
             return;
         }
     }
diff --git a/JavaScriptCore/runtime/JSActivation.cpp b/JavaScriptCore/runtime/JSActivation.cpp
index d121518..795ad1f 100644
--- a/JavaScriptCore/runtime/JSActivation.cpp
+++ b/JavaScriptCore/runtime/JSActivation.cpp
@@ -186,6 +186,11 @@ JSObject* JSActivation::toThisObject(ExecState* exec) const
     return exec->globalThisValue();
 }
 
+JSValue JSActivation::toStrictThisObject(ExecState*) const
+{
+    return jsNull();
+}
+    
 bool JSActivation::isDynamicScope(bool& requiresDynamicChecks) const
 {
     requiresDynamicChecks = d()->functionExecutable->usesEval();
diff --git a/JavaScriptCore/runtime/JSActivation.h b/JavaScriptCore/runtime/JSActivation.h
index 9ff9168..6dd6d70 100644
--- a/JavaScriptCore/runtime/JSActivation.h
+++ b/JavaScriptCore/runtime/JSActivation.h
@@ -60,6 +60,7 @@ namespace JSC {
         virtual bool deleteProperty(ExecState*, const Identifier& propertyName);
 
         virtual JSObject* toThisObject(ExecState*) const;
+        virtual JSValue toStrictThisObject(ExecState*) const;
 
         void copyRegisters();
         
diff --git a/JavaScriptCore/runtime/JSCell.h b/JavaScriptCore/runtime/JSCell.h
index cfa1454..1a7f8b2 100644
--- a/JavaScriptCore/runtime/JSCell.h
+++ b/JavaScriptCore/runtime/JSCell.h
@@ -75,9 +75,6 @@ namespace JSC {
         }
 
         // Querying the type.
-#if USE(JSVALUE32)
-        bool isNumber() const;
-#endif
         bool isString() const;
         bool isObject() const;
         virtual bool isGetterSetter() const;
@@ -156,13 +153,6 @@ namespace JSC {
     {
     }
 
-#if USE(JSVALUE32)
-    inline bool JSCell::isNumber() const
-    {
-        return m_structure->typeInfo().type() == NumberType;
-    }
-#endif
-
     inline bool JSCell::isObject() const
     {
         return m_structure->typeInfo().type() == ObjectType;
@@ -253,13 +243,13 @@ namespace JSC {
         return false;
     }
 
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
     ALWAYS_INLINE JSCell* JSValue::asCell() const
     {
         ASSERT(isCell());
         return m_ptr;
     }
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 
     inline JSValue JSValue::toPrimitive(ExecState* exec, PreferredPrimitiveType preferredType) const
     {
diff --git a/JavaScriptCore/runtime/JSFunction.cpp b/JavaScriptCore/runtime/JSFunction.cpp
index 7eb9ba5..fdaa509 100644
--- a/JavaScriptCore/runtime/JSFunction.cpp
+++ b/JavaScriptCore/runtime/JSFunction.cpp
@@ -122,6 +122,15 @@ JSFunction::~JSFunction()
     }
 }
 
+static const char* StrictModeCallerAccessError = "Cannot access caller property of a strict mode function";
+static const char* StrictModeArgumentsAccessError = "Cannot access arguments property of a strict mode function";
+
+static void createDescriptorForThrowingProperty(ExecState* exec, PropertyDescriptor& descriptor, const char* message)
+{
+    JSValue thrower = createTypeErrorFunction(exec, message);
+    descriptor.setAccessorDescriptor(thrower, thrower, DontEnum | DontDelete | Getter | Setter);
+}
+
 const UString& JSFunction::name(ExecState* exec)
 {
     return asString(getDirect(exec->globalData().propertyNames->name))->tryGetValue();
@@ -209,6 +218,12 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     }
 
     if (propertyName == exec->propertyNames().arguments) {
+        if (jsExecutable()->isStrictMode()) {
+            throwTypeError(exec, "Can't access arguments object of a strict mode function");
+            slot.setValue(jsNull());
+            return true;
+        }
+   
         slot.setCacheableCustom(this, argumentsGetter);
         return true;
     }
@@ -219,6 +234,11 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     }
 
     if (propertyName == exec->propertyNames().caller) {
+        if (jsExecutable()->isStrictMode()) {
+            throwTypeError(exec, StrictModeCallerAccessError);
+            slot.setValue(jsNull());
+            return true;
+        }
         slot.setCacheableCustom(this, callerGetter);
         return true;
     }
@@ -226,35 +246,41 @@ bool JSFunction::getOwnPropertySlot(ExecState* exec, const Identifier& propertyN
     return Base::getOwnPropertySlot(exec, propertyName, slot);
 }
 
-    bool JSFunction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
-    {
-        if (isHostFunction())
-            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-        
-        if (propertyName == exec->propertyNames().prototype) {
-            PropertySlot slot;
-            getOwnPropertySlot(exec, propertyName, slot);
-            return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
-        }
-        
-        if (propertyName == exec->propertyNames().arguments) {
+bool JSFunction::getOwnPropertyDescriptor(ExecState* exec, const Identifier& propertyName, PropertyDescriptor& descriptor)
+{
+    if (isHostFunction())
+        return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    
+    if (propertyName == exec->propertyNames().prototype) {
+        PropertySlot slot;
+        getOwnPropertySlot(exec, propertyName, slot);
+        return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+    }
+    
+    if (propertyName == exec->propertyNames().arguments) {
+        if (jsExecutable()->isStrictMode())
+            createDescriptorForThrowingProperty(exec, descriptor, StrictModeArgumentsAccessError);
+        else
             descriptor.setDescriptor(exec->interpreter()->retrieveArguments(exec, this), ReadOnly | DontEnum | DontDelete);
-            return true;
-        }
-        
-        if (propertyName == exec->propertyNames().length) {
-            descriptor.setDescriptor(jsNumber(exec, jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
-            return true;
-        }
-        
-        if (propertyName == exec->propertyNames().caller) {
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().length) {
+        descriptor.setDescriptor(jsNumber(exec, jsExecutable()->parameterCount()), ReadOnly | DontEnum | DontDelete);
+        return true;
+    }
+    
+    if (propertyName == exec->propertyNames().caller) {
+        if (jsExecutable()->isStrictMode())
+            createDescriptorForThrowingProperty(exec, descriptor, StrictModeCallerAccessError);
+        else
             descriptor.setDescriptor(exec->interpreter()->retrieveCaller(exec, this), ReadOnly | DontEnum | DontDelete);
-            return true;
-        }
-        
-        return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+        return true;
     }
     
+    return Base::getOwnPropertyDescriptor(exec, propertyName, descriptor);
+}
+
 void JSFunction::getOwnPropertyNames(ExecState* exec, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     if (!isHostFunction() && (mode == IncludeDontEnumProperties)) {
@@ -272,6 +298,16 @@ void JSFunction::put(ExecState* exec, const Identifier& propertyName, JSValue va
         Base::put(exec, propertyName, value, slot);
         return;
     }
+    if (jsExecutable()->isStrictMode()) {
+        if (propertyName == exec->propertyNames().arguments) {
+            throwTypeError(exec, StrictModeArgumentsAccessError);
+            return;
+        }
+        if (propertyName == exec->propertyNames().caller) {
+            throwTypeError(exec, StrictModeCallerAccessError);
+            return;
+        }
+    }
     if (propertyName == exec->propertyNames().arguments || propertyName == exec->propertyNames().length)
         return;
     Base::put(exec, propertyName, value, slot);
diff --git a/JavaScriptCore/runtime/JSGlobalData.cpp b/JavaScriptCore/runtime/JSGlobalData.cpp
index 5eaa59b..1404ddf 100644
--- a/JavaScriptCore/runtime/JSGlobalData.cpp
+++ b/JavaScriptCore/runtime/JSGlobalData.cpp
@@ -50,6 +50,7 @@
 #include "Nodes.h"
 #include "Parser.h"
 #include "RegExpCache.h"
+#include "StrictEvalActivation.h"
 #include <wtf/WTFThreadData.h>
 #if ENABLE(REGEXP_TRACING)
 #include "RegExp.h"
@@ -124,6 +125,7 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , interruptedExecutionErrorStructure(JSObject::createStructure(jsNull()))
     , terminatedExecutionErrorStructure(JSObject::createStructure(jsNull()))
     , staticScopeStructure(JSStaticScopeObject::createStructure(jsNull()))
+    , strictEvalActivationStructure(StrictEvalActivation::createStructure(jsNull()))
     , stringStructure(JSString::createStructure(jsNull()))
     , notAnObjectErrorStubStructure(JSNotAnObjectErrorStub::createStructure(jsNull()))
     , notAnObjectStructure(JSNotAnObject::createStructure(jsNull()))
@@ -131,9 +133,6 @@ JSGlobalData::JSGlobalData(GlobalDataType globalDataType, ThreadStackType thread
     , getterSetterStructure(GetterSetter::createStructure(jsNull()))
     , apiWrapperStructure(JSAPIValueWrapper::createStructure(jsNull()))
     , dummyMarkableCellStructure(JSCell::createDummyStructure())
-#if USE(JSVALUE32)
-    , numberStructure(JSNumberCell::createStructure(jsNull()))
-#endif
     , identifierTable(globalDataType == Default ? wtfThreadData().currentIdentifierTable() : createIdentifierTable())
     , propertyNames(new CommonIdentifiers(this))
     , emptyList(new MarkedArgumentBuffer)
diff --git a/JavaScriptCore/runtime/JSGlobalData.h b/JavaScriptCore/runtime/JSGlobalData.h
index 8e2ed61..775d026 100644
--- a/JavaScriptCore/runtime/JSGlobalData.h
+++ b/JavaScriptCore/runtime/JSGlobalData.h
@@ -145,6 +145,7 @@ namespace JSC {
         RefPtr<Structure> interruptedExecutionErrorStructure;
         RefPtr<Structure> terminatedExecutionErrorStructure;
         RefPtr<Structure> staticScopeStructure;
+        RefPtr<Structure> strictEvalActivationStructure;
         RefPtr<Structure> stringStructure;
         RefPtr<Structure> notAnObjectErrorStubStructure;
         RefPtr<Structure> notAnObjectStructure;
@@ -153,10 +154,6 @@ namespace JSC {
         RefPtr<Structure> apiWrapperStructure;
         RefPtr<Structure> dummyMarkableCellStructure;
 
-#if USE(JSVALUE32)
-        RefPtr<Structure> numberStructure;
-#endif
-
         static void storeVPtrs();
         static JS_EXPORTDATA void* jsArrayVPtr;
         static JS_EXPORTDATA void* jsByteArrayVPtr;
diff --git a/JavaScriptCore/runtime/JSGlobalObject.cpp b/JavaScriptCore/runtime/JSGlobalObject.cpp
index 89c042a..903e573 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObject.cpp
@@ -204,6 +204,7 @@ void JSGlobalObject::reset(JSValue prototype)
 
     d()->functionPrototype = new (exec) FunctionPrototype(exec, this, FunctionPrototype::createStructure(jsNull())); // The real prototype will be set once ObjectPrototype is created.
     d()->prototypeFunctionStructure = PrototypeFunction::createStructure(d()->functionPrototype);
+    d()->internalFunctionStructure = InternalFunction::createStructure(d()->functionPrototype);
     NativeFunctionWrapper* callFunction = 0;
     NativeFunctionWrapper* applyFunction = 0;
     d()->functionPrototype->addFunctionProperties(exec, this, d()->prototypeFunctionStructure.get(), &callFunction, &applyFunction);
diff --git a/JavaScriptCore/runtime/JSGlobalObject.h b/JavaScriptCore/runtime/JSGlobalObject.h
index f5d2fb0..36fa70b 100644
--- a/JavaScriptCore/runtime/JSGlobalObject.h
+++ b/JavaScriptCore/runtime/JSGlobalObject.h
@@ -148,6 +148,7 @@ namespace JSC {
             RefPtr<Structure> regExpMatchesArrayStructure;
             RefPtr<Structure> regExpStructure;
             RefPtr<Structure> stringObjectStructure;
+            RefPtr<Structure> internalFunctionStructure;
 
             SymbolTable symbolTable;
             unsigned profileGroup;
@@ -243,6 +244,7 @@ namespace JSC {
         Structure* functionStructure() const { return d()->functionStructure.get(); }
         Structure* numberObjectStructure() const { return d()->numberObjectStructure.get(); }
         Structure* prototypeFunctionStructure() const { return d()->prototypeFunctionStructure.get(); }
+        Structure* internalFunctionStructure() const { return d()->internalFunctionStructure.get(); }
         Structure* regExpMatchesArrayStructure() const { return d()->regExpMatchesArrayStructure.get(); }
         Structure* regExpStructure() const { return d()->regExpStructure.get(); }
         Structure* stringObjectStructure() const { return d()->stringObjectStructure.get(); }
@@ -384,16 +386,8 @@ namespace JSC {
         if (typeInfo().type() == ObjectType)
             return m_prototype;
 
-#if USE(JSVALUE32)
-        if (typeInfo().type() == StringType)
-            return exec->lexicalGlobalObject()->stringPrototype();
-
-        ASSERT(typeInfo().type() == NumberType);
-        return exec->lexicalGlobalObject()->numberPrototype();
-#else
         ASSERT(typeInfo().type() == StringType);
         return exec->lexicalGlobalObject()->stringPrototype();
-#endif
     }
 
     inline StructureChain* Structure::prototypeChain(ExecState* exec) const
diff --git a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
index 1e20f7f..ed06fa5 100644
--- a/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
+++ b/JavaScriptCore/runtime/JSGlobalObjectFunctions.cpp
@@ -35,7 +35,7 @@
 #include "LiteralParser.h"
 #include "Nodes.h"
 #include "Parser.h"
-#include "StringBuilder.h"
+#include "UStringBuilder.h"
 #include "dtoa.h"
 #include <stdio.h>
 #include <stdlib.h>
@@ -450,7 +450,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncEval(ExecState* exec)
     if (JSValue parsedObject = preparser.tryLiteralParse())
         return JSValue::encode(parsedObject);
 
-    RefPtr<EvalExecutable> eval = EvalExecutable::create(exec, makeSource(s));
+    RefPtr<EvalExecutable> eval = EvalExecutable::create(exec, makeSource(s), false);
     JSObject* error = eval->compile(exec, static_cast<JSGlobalObject*>(unwrappedObject)->globalScopeChain().node());
     if (error)
         return throwVMError(exec, error);
@@ -563,7 +563,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncEscape(ExecState* exec)
 
 EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
 {
-    StringBuilder builder;
+    UStringBuilder builder;
     UString str = exec->argument(0).toString(exec);
     int k = 0;
     int len = str.length();
@@ -585,7 +585,7 @@ EncodedJSValue JSC_HOST_CALL globalFuncUnescape(ExecState* exec)
         builder.append(*c);
     }
 
-    return JSValue::encode(jsString(exec, builder.build()));
+    return JSValue::encode(jsString(exec, builder.toUString()));
 }
 
 #ifndef NDEBUG
diff --git a/JavaScriptCore/runtime/JSImmediate.h b/JavaScriptCore/runtime/JSImmediate.h
index 9127b6a..ffa446e 100644
--- a/JavaScriptCore/runtime/JSImmediate.h
+++ b/JavaScriptCore/runtime/JSImmediate.h
@@ -22,7 +22,7 @@
 #ifndef JSImmediate_h
 #define JSImmediate_h
 
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
 
 #include <wtf/Assertions.h>
 #include <wtf/AlwaysInline.h>
@@ -44,7 +44,6 @@ namespace JSC {
     class JSObject;
     class UString;
 
-#if USE(JSVALUE64)
     inline intptr_t reinterpretDoubleToIntptr(double value)
     {
         return WTF::bitwise_cast<intptr_t>(value);
@@ -54,7 +53,6 @@ namespace JSC {
     {
         return WTF::bitwise_cast<double>(value);
     }
-#endif
 
     /*
      * A JSValue* is either a pointer to a cell (a heap-allocated object) or an immediate (a type-tagged 
@@ -159,16 +157,12 @@ namespace JSC {
         friend JSValue jsNumber(JSGlobalData* globalData, long long i);
         friend JSValue jsNumber(JSGlobalData* globalData, unsigned long long i);
 
-#if USE(JSVALUE64)
         // If all bits in the mask are set, this indicates an integer number,
         // if any but not all are set this value is a double precision number.
         static const intptr_t TagTypeNumber = 0xffff000000000000ll;
         // This value is 2^48, used to encode doubles such that the encoded value will begin
         // with a 16-bit pattern within the range 0x0001..0xFFFE.
         static const intptr_t DoubleEncodeOffset = 0x1000000000000ll;
-#elif USE(JSVALUE32)
-        static const intptr_t TagTypeNumber = 0x1; // bottom bit set indicates integer, this dominates the following bit
-#endif
         static const intptr_t TagBitTypeOther   = 0x2; // second bit set indicates immediate other than an integer
         static const intptr_t TagMask           = TagTypeNumber | TagBitTypeOther;
 
@@ -181,11 +175,7 @@ namespace JSC {
         static const intptr_t FullTagTypeUndefined = TagBitTypeOther | ExtendedTagBitUndefined;
         static const intptr_t FullTagTypeNull      = TagBitTypeOther;
 
-#if USE(JSVALUE64)
         static const int32_t IntegerPayloadShift  = 0;
-#else
-        static const int32_t IntegerPayloadShift  = 1;
-#endif
         static const int32_t ExtendedPayloadShift = 4;
 
         static const intptr_t ExtendedPayloadBitBoolValue = 1 << ExtendedPayloadShift;
@@ -204,19 +194,13 @@ namespace JSC {
 
         static ALWAYS_INLINE bool isIntegerNumber(JSValue v)
         {
-#if USE(JSVALUE64)
             return (rawValue(v) & TagTypeNumber) == TagTypeNumber;
-#else
-            return isNumber(v);
-#endif
         }
 
-#if USE(JSVALUE64)
         static ALWAYS_INLINE bool isDouble(JSValue v)
         {
             return isNumber(v) && !isIntegerNumber(v);
         }
-#endif
 
         static ALWAYS_INLINE bool isPositiveIntegerNumber(JSValue v)
         {
@@ -260,11 +244,7 @@ namespace JSC {
 
         static ALWAYS_INLINE bool areBothImmediateIntegerNumbers(JSValue v1, JSValue v2)
         {
-#if USE(JSVALUE64)
             return (rawValue(v1) & rawValue(v2) & TagTypeNumber) == TagTypeNumber;
-#else
-            return rawValue(v1) & rawValue(v2) & TagTypeNumber;
-#endif
         }
 
         static double toDouble(JSValue);
@@ -285,13 +265,8 @@ namespace JSC {
         static JSValue oneImmediate();
 
     private:
-#if USE(JSVALUE64)
         static const int minImmediateInt = ((-INT_MAX) - 1);
         static const int maxImmediateInt = INT_MAX;
-#else
-        static const int minImmediateInt = ((-INT_MAX) - 1) >> IntegerPayloadShift;
-        static const int maxImmediateInt = INT_MAX >> IntegerPayloadShift;
-#endif
         static const unsigned maxImmediateUInt = maxImmediateInt;
 
         static ALWAYS_INLINE JSValue makeValue(intptr_t integer)
@@ -302,21 +277,15 @@ namespace JSC {
         // With USE(JSVALUE64) we want the argument to be zero extended, so the
         // integer doesn't interfere with the tag bits in the upper word.  In the default encoding,
         // if intptr_t id larger then int32_t we sign extend the value through the upper word.
-#if USE(JSVALUE64)
         static ALWAYS_INLINE JSValue makeInt(uint32_t value)
-#else
-        static ALWAYS_INLINE JSValue makeInt(int32_t value)
-#endif
         {
             return makeValue((static_cast<intptr_t>(value) << IntegerPayloadShift) | TagTypeNumber);
         }
         
-#if USE(JSVALUE64)
         static ALWAYS_INLINE JSValue makeDouble(double value)
         {
             return makeValue(reinterpretDoubleToIntptr(value) + DoubleEncodeOffset);
         }
-#endif
         
         static ALWAYS_INLINE JSValue makeBool(bool b)
         {
@@ -336,12 +305,10 @@ namespace JSC {
         template<typename T>
         static JSValue fromNumberOutsideIntegerRange(T);
 
-#if USE(JSVALUE64)
         static ALWAYS_INLINE double doubleValue(JSValue v)
         {
             return reinterpretIntptrToDouble(rawValue(v) - DoubleEncodeOffset);
         }
-#endif
 
         static ALWAYS_INLINE int32_t intValue(JSValue v)
         {
@@ -371,7 +338,6 @@ namespace JSC {
     ALWAYS_INLINE JSValue JSImmediate::zeroImmediate() { return makeInt(0); }
     ALWAYS_INLINE JSValue JSImmediate::oneImmediate() { return makeInt(1); }
 
-#if USE(JSVALUE64)
     inline bool doubleToBoolean(double value)
     {
         return value < 0.0 || value > 0.0;
@@ -383,13 +349,6 @@ namespace JSC {
         return isNumber(v) ? isIntegerNumber(v) ? v != zeroImmediate()
             : doubleToBoolean(doubleValue(v)) : v == trueImmediate();
     }
-#else
-    ALWAYS_INLINE bool JSImmediate::toBoolean(JSValue v)
-    {
-        ASSERT(isImmediate(v));
-        return isIntegerNumber(v) ? v != zeroImmediate() : v == trueImmediate();
-    }
-#endif
 
     ALWAYS_INLINE uint32_t JSImmediate::getTruncatedUInt32(JSValue v)
     {
@@ -398,19 +357,11 @@ namespace JSC {
         return intValue(v);
     }
 
-#if USE(JSVALUE64)
     template<typename T>
     inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T value)
     {
         return makeDouble(static_cast<double>(value));
     }
-#else
-    template<typename T>
-    inline JSValue JSImmediate::fromNumberOutsideIntegerRange(T)
-    {
-        return JSValue();
-    }
-#endif
 
     ALWAYS_INLINE JSValue JSImmediate::from(char i)
     {
@@ -439,10 +390,6 @@ namespace JSC {
 
     ALWAYS_INLINE JSValue JSImmediate::from(int i)
     {
-#if !USE(JSVALUE64)
-        if ((i < minImmediateInt) | (i > maxImmediateInt))
-            return fromNumberOutsideIntegerRange(i);
-#endif
         return makeInt(i);
     }
 
@@ -505,14 +452,10 @@ namespace JSC {
         if (isIntegerNumber(v))
             return intValue(v);
 
-#if USE(JSVALUE64)
         if (isNumber(v)) {
             ASSERT(isDouble(v));
             return doubleValue(v);
         }
-#else
-        ASSERT(!isNumber(v));
-#endif
 
         if (rawValue(v) == FullTagTypeUndefined)
             return nonInlineNaN();
@@ -670,11 +613,7 @@ namespace JSC {
         static ALWAYS_INLINE JSValue rightShiftImmediateNumbers(JSValue val, JSValue shift)
         {
             ASSERT(canDoFastRshift(val, shift) || canDoFastUrshift(val, shift));
-#if USE(JSVALUE64)
             return JSImmediate::makeValue(static_cast<intptr_t>(static_cast<uint32_t>(static_cast<int32_t>(JSImmediate::rawValue(val)) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f))) | JSImmediate::TagTypeNumber);
-#else
-            return JSImmediate::makeValue((JSImmediate::rawValue(val) >> ((JSImmediate::rawValue(shift) >> JSImmediate::IntegerPayloadShift) & 0x1f)) | JSImmediate::TagTypeNumber);
-#endif
         }
 
         static ALWAYS_INLINE bool canDoFastAdditiveOperations(JSValue v)
@@ -718,6 +657,6 @@ namespace JSC {
 
 } // namespace JSC
 
-#endif // !USE(JSVALUE32_64)
+#endif // USE(JSVALUE64)
 
 #endif // JSImmediate_h
diff --git a/JavaScriptCore/runtime/JSNumberCell.cpp b/JavaScriptCore/runtime/JSNumberCell.cpp
index 77388e0..6fa6b2a 100644
--- a/JavaScriptCore/runtime/JSNumberCell.cpp
+++ b/JavaScriptCore/runtime/JSNumberCell.cpp
@@ -23,75 +23,6 @@
 #include "config.h"
 #include "JSNumberCell.h"
 
-#if USE(JSVALUE32)
-
-#include "NumberObject.h"
-#include "UString.h"
-
-namespace JSC {
-
-JSValue JSNumberCell::toPrimitive(ExecState*, PreferredPrimitiveType) const
-{
-    return const_cast<JSNumberCell*>(this);
-}
-
-bool JSNumberCell::getPrimitiveNumber(ExecState*, double& number, JSValue& value)
-{
-    number = m_value;
-    value = this;
-    return true;
-}
-
-bool JSNumberCell::toBoolean(ExecState*) const
-{
-    return m_value < 0.0 || m_value > 0.0; // false for NaN
-}
-
-double JSNumberCell::toNumber(ExecState*) const
-{
-  return m_value;
-}
-
-UString JSNumberCell::toString(ExecState*) const
-{
-    return UString::number(m_value);
-}
-
-JSObject* JSNumberCell::toObject(ExecState* exec) const
-{
-    return constructNumber(exec, const_cast<JSNumberCell*>(this));
-}
-
-JSObject* JSNumberCell::toThisObject(ExecState* exec) const
-{
-    return constructNumber(exec, const_cast<JSNumberCell*>(this));
-}
-
-bool JSNumberCell::getUInt32(uint32_t& uint32) const
-{
-    uint32 = static_cast<uint32_t>(m_value);
-    return uint32 == m_value;
-}
-
-JSValue JSNumberCell::getJSNumber()
-{
-    return this;
-}
-
-JSValue jsNumberCell(ExecState* exec, double d)
-{
-    return new (exec) JSNumberCell(exec, d);
-}
-
-JSValue jsNumberCell(JSGlobalData* globalData, double d)
-{
-    return new (globalData) JSNumberCell(globalData, d);
-}
-
-} // namespace JSC
-
-#else // USE(JSVALUE32)
-
 // Keep our exported symbols lists happy.
 namespace JSC {
 
@@ -105,4 +36,3 @@ JSValue jsNumberCell(ExecState*, double)
 
 } // namespace JSC
 
-#endif // USE(JSVALUE32)
diff --git a/JavaScriptCore/runtime/JSNumberCell.h b/JavaScriptCore/runtime/JSNumberCell.h
index cdd2d8c..a25c531 100644
--- a/JavaScriptCore/runtime/JSNumberCell.h
+++ b/JavaScriptCore/runtime/JSNumberCell.h
@@ -35,167 +35,6 @@ namespace JSC {
     extern const double NaN;
     extern const double Inf;
 
-#if USE(JSVALUE32)
-    JSValue jsNumberCell(ExecState*, double);
-
-    class Identifier;
-    class JSCell;
-    class JSObject;
-    class JSString;
-    class PropertySlot;
-
-    struct ClassInfo;
-    struct Instruction;
-
-    class JSNumberCell : public JSCell {
-        friend class JIT;
-        friend JSValue jsNumberCell(JSGlobalData*, double);
-        friend JSValue jsNumberCell(ExecState*, double);
-
-    public:
-        double value() const { return m_value; }
-
-        virtual JSValue toPrimitive(ExecState*, PreferredPrimitiveType) const;
-        virtual bool getPrimitiveNumber(ExecState*, double& number, JSValue& value);
-        virtual bool toBoolean(ExecState*) const;
-        virtual double toNumber(ExecState*) const;
-        virtual UString toString(ExecState*) const;
-        virtual JSObject* toObject(ExecState*) const;
-
-        virtual JSObject* toThisObject(ExecState*) const;
-        virtual JSValue getJSNumber();
-
-        void* operator new(size_t size, ExecState* exec)
-        {
-            return exec->heap()->allocateNumber(size);
-        }
-
-        void* operator new(size_t size, JSGlobalData* globalData)
-        {
-            return globalData->heap.allocateNumber(size);
-        }
-
-        static PassRefPtr<Structure> createStructure(JSValue proto) { return Structure::create(proto, TypeInfo(NumberType, OverridesGetOwnPropertySlot | NeedsThisConversion), AnonymousSlotCount); }
-
-    private:
-        JSNumberCell(JSGlobalData* globalData, double value)
-            : JSCell(globalData->numberStructure.get())
-            , m_value(value)
-        {
-        }
-
-        JSNumberCell(ExecState* exec, double value)
-            : JSCell(exec->globalData().numberStructure.get())
-            , m_value(value)
-        {
-        }
-
-        virtual bool getUInt32(uint32_t&) const;
-
-        double m_value;
-    };
-
-    JSValue jsNumberCell(JSGlobalData*, double);
-
-    inline bool isNumberCell(JSValue v)
-    {
-        return v.isCell() && v.asCell()->isNumber();
-    }
-
-    inline JSNumberCell* asNumberCell(JSValue v)
-    {
-        ASSERT(isNumberCell(v));
-        return static_cast<JSNumberCell*>(v.asCell());
-    }
-
-    ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState* exec, double d)
-    {
-        *this = jsNumberCell(exec, d);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, double d)
-    {
-        JSValue v = JSImmediate::from(d);
-        *this = v ? v : jsNumberCell(exec, d);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, int i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, i);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, unsigned i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, i);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, i);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, unsigned long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, i);
-    }
-
-    inline JSValue::JSValue(ExecState* exec, long long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
-    }
-
-    inline JSValue::JSValue(ExecState* exec, unsigned long long i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(exec, static_cast<double>(i));
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, double d)
-    {
-        JSValue v = JSImmediate::from(d);
-        *this = v ? v : jsNumberCell(globalData, d);
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, int i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, i);
-    }
-
-    inline JSValue::JSValue(JSGlobalData* globalData, unsigned i)
-    {
-        JSValue v = JSImmediate::from(i);
-        *this = v ? v : jsNumberCell(globalData, i);
-    }
-
-    inline bool JSValue::isDouble() const
-    {
-        return isNumberCell(asValue());
-    }
-
-    inline double JSValue::asDouble() const
-    {
-        return asNumberCell(asValue())->value();
-    }
-
-    inline bool JSValue::isNumber() const
-    {
-        return JSImmediate::isNumber(asValue()) || isDouble();
-    }
-
-    inline double JSValue::uncheckedGetNumber() const
-    {
-        ASSERT(isNumber());
-        return JSImmediate::isImmediate(asValue()) ? JSImmediate::toDouble(asValue()) : asDouble();
-    }
-
-#endif // USE(JSVALUE32)
-
 #if USE(JSVALUE64)
     ALWAYS_INLINE JSValue::JSValue(EncodeAsDoubleTag, ExecState*, double d)
     {
@@ -295,7 +134,7 @@ namespace JSC {
 
 #endif // USE(JSVALUE64)
 
-#if USE(JSVALUE32) || USE(JSVALUE64)
+#if USE(JSVALUE64)
 
     inline JSValue::JSValue(ExecState*, char i)
     {
@@ -351,7 +190,7 @@ namespace JSC {
         return true;
     }
 
-#endif // USE(JSVALUE32) || USE(JSVALUE64)
+#endif // USE(JSVALUE64)
 
 } // namespace JSC
 
diff --git a/JavaScriptCore/runtime/JSONObject.cpp b/JavaScriptCore/runtime/JSONObject.cpp
index ba50721..0794189 100644
--- a/JavaScriptCore/runtime/JSONObject.cpp
+++ b/JavaScriptCore/runtime/JSONObject.cpp
@@ -34,8 +34,8 @@
 #include "LiteralParser.h"
 #include "Lookup.h"
 #include "PropertyNameArray.h"
-#include "StringBuilder.h"
-#include "StringConcatenate.h"
+#include "UStringBuilder.h"
+#include "UStringConcatenate.h"
 #include <wtf/MathExtras.h>
 
 namespace JSC {
@@ -85,7 +85,7 @@ private:
 
         JSObject* object() const { return m_object; }
 
-        bool appendNextProperty(Stringifier&, StringBuilder&);
+        bool appendNextProperty(Stringifier&, UStringBuilder&);
 
     private:
         JSObject* const m_object;
@@ -98,17 +98,17 @@ private:
 
     friend class Holder;
 
-    static void appendQuotedString(StringBuilder&, const UString&);
+    static void appendQuotedString(UStringBuilder&, const UString&);
 
     JSValue toJSON(JSValue, const PropertyNameForFunctionCall&);
 
     enum StringifyResult { StringifyFailed, StringifySucceeded, StringifyFailedDueToUndefinedValue };
-    StringifyResult appendStringifiedValue(StringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
+    StringifyResult appendStringifiedValue(UStringBuilder&, JSValue, JSObject* holder, const PropertyNameForFunctionCall&);
 
     bool willIndent() const;
     void indent();
     void unindent();
-    void startNewLine(StringBuilder&) const;
+    void startNewLine(UStringBuilder&) const;
 
     Stringifier* const m_nextStringifierToMark;
     ExecState* const m_exec;
@@ -270,21 +270,21 @@ JSValue Stringifier::stringify(JSValue value)
     PropertyNameForFunctionCall emptyPropertyName(m_exec->globalData().propertyNames->emptyIdentifier);
     object->putDirect(m_exec->globalData().propertyNames->emptyIdentifier, value);
 
-    StringBuilder result;
+    UStringBuilder result;
     if (appendStringifiedValue(result, value, object, emptyPropertyName) != StringifySucceeded)
         return jsUndefined();
     if (m_exec->hadException())
         return jsNull();
 
-    return jsString(m_exec, result.build());
+    return jsString(m_exec, result.toUString());
 }
 
-void Stringifier::appendQuotedString(StringBuilder& builder, const UString& value)
+void Stringifier::appendQuotedString(UStringBuilder& builder, const UString& value)
 {
     int length = value.length();
 
     // String length plus 2 for quote marks plus 8 so we can accomodate a few escaped characters.
-    builder.reserveCapacity(builder.size() + length + 2 + 8);
+    builder.reserveCapacity(builder.length() + length + 2 + 8);
 
     builder.append('"');
 
@@ -361,7 +361,7 @@ inline JSValue Stringifier::toJSON(JSValue value, const PropertyNameForFunctionC
     return call(m_exec, object, callType, callData, value, args);
 }
 
-Stringifier::StringifyResult Stringifier::appendStringifiedValue(StringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
+Stringifier::StringifyResult Stringifier::appendStringifiedValue(UStringBuilder& builder, JSValue value, JSObject* holder, const PropertyNameForFunctionCall& propertyName)
 {
     // Call the toJSON function.
     value = toJSON(value, propertyName);
@@ -466,7 +466,7 @@ inline void Stringifier::indent()
     // Use a single shared string, m_repeatedGap, so we don't keep allocating new ones as we indent and unindent.
     unsigned newSize = m_indent.length() + m_gap.length();
     if (newSize > m_repeatedGap.length())
-        m_repeatedGap = makeString(m_repeatedGap, m_gap);
+        m_repeatedGap = makeUString(m_repeatedGap, m_gap);
     ASSERT(newSize <= m_repeatedGap.length());
     m_indent = m_repeatedGap.substringSharingImpl(0, newSize);
 }
@@ -477,7 +477,7 @@ inline void Stringifier::unindent()
     m_indent = m_repeatedGap.substringSharingImpl(0, m_indent.length() - m_gap.length());
 }
 
-inline void Stringifier::startNewLine(StringBuilder& builder) const
+inline void Stringifier::startNewLine(UStringBuilder& builder) const
 {
     if (m_gap.isEmpty())
         return;
@@ -492,7 +492,7 @@ inline Stringifier::Holder::Holder(JSObject* object)
 {
 }
 
-bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBuilder& builder)
+bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, UStringBuilder& builder)
 {
     ASSERT(m_index <= m_size);
 
@@ -521,7 +521,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
     // Last time through, finish up and return false.
     if (m_index == m_size) {
         stringifier.unindent();
-        if (m_size && builder[builder.size() - 1] != '{')
+        if (m_size && builder[builder.length() - 1] != '{')
             stringifier.startNewLine(builder);
         builder.append(m_isArray ? ']' : '}');
         return false;
@@ -562,7 +562,7 @@ bool Stringifier::Holder::appendNextProperty(Stringifier& stringifier, StringBui
         if (exec->hadException())
             return false;
 
-        rollBackPoint = builder.size();
+        rollBackPoint = builder.length();
 
         // Append the separator string.
         if (builder[rollBackPoint - 1] != '{')
diff --git a/JavaScriptCore/runtime/JSObject.cpp b/JavaScriptCore/runtime/JSObject.cpp
index cabc428..30e40e4 100644
--- a/JavaScriptCore/runtime/JSObject.cpp
+++ b/JavaScriptCore/runtime/JSObject.cpp
@@ -43,6 +43,8 @@ namespace JSC {
 
 ASSERT_CLASS_FITS_IN_CELL(JSObject);
 
+const char* StrictModeReadonlyPropertyWriteError = "Attempted to assign to readonly property.";
+
 static inline void getClassPropertyNames(ExecState* exec, const ClassInfo* classInfo, PropertyNameArray& propertyNames, EnumerationMode mode)
 {
     // Add properties from the static hashtables of properties
@@ -114,15 +116,19 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
     for (JSObject* obj = this; !obj->structure()->hasGetterSetterProperties(); obj = asObject(prototype)) {
         prototype = obj->prototype();
         if (prototype.isNull()) {
-            putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
+            if (!putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot) && slot.isStrictMode())
+                throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
             return;
         }
     }
     
     unsigned attributes;
     JSCell* specificValue;
-    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly)
+    if ((m_structure->get(propertyName, attributes, specificValue) != WTF::notFound) && attributes & ReadOnly) {
+        if (slot.isStrictMode())
+            throwError(exec, createTypeError(exec, StrictModeReadonlyPropertyWriteError));
         return;
+    }
 
     for (JSObject* obj = this; ; obj = asObject(prototype)) {
         if (JSValue gs = obj->getDirect(propertyName)) {
@@ -151,7 +157,8 @@ void JSObject::put(ExecState* exec, const Identifier& propertyName, JSValue valu
             break;
     }
 
-    putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot);
+    if (!putDirectInternal(exec->globalData(), propertyName, value, 0, true, slot) && slot.isStrictMode())
+        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
     return;
 }
 
@@ -489,6 +496,11 @@ JSObject* JSObject::toThisObject(ExecState*) const
     return const_cast<JSObject*>(this);
 }
 
+JSValue JSObject::toStrictThisObject(ExecState*) const
+{
+    return const_cast<JSObject*>(this);
+}
+
 JSObject* JSObject::unwrappedObject()
 {
     return this;
@@ -702,4 +714,9 @@ bool JSObject::defineOwnProperty(ExecState* exec, const Identifier& propertyName
     return true;
 }
 
+JSObject* throwTypeError(ExecState* exec, const UString& message)
+{
+    return throwError(exec, createTypeError(exec, message));
+}
+
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/JSObject.h b/JavaScriptCore/runtime/JSObject.h
index 4201703..8981469 100644
--- a/JavaScriptCore/runtime/JSObject.h
+++ b/JavaScriptCore/runtime/JSObject.h
@@ -55,6 +55,9 @@ namespace JSC {
     class Structure;
     struct HashTable;
 
+    JSObject* throwTypeError(ExecState*, const UString&);
+    extern const char* StrictModeReadonlyPropertyWriteError;
+
     // ECMA 262-3 8.6.1
     // Property attributes
     enum Attribute {
@@ -140,6 +143,7 @@ namespace JSC {
         virtual JSObject* toObject(ExecState*) const;
 
         virtual JSObject* toThisObject(ExecState*) const;
+        virtual JSValue toStrictThisObject(ExecState*) const;
         virtual JSObject* unwrappedObject();
 
         bool getPropertySpecificValue(ExecState* exec, const Identifier& propertyName, JSCell*& specificFunction) const;
@@ -175,9 +179,9 @@ namespace JSC {
         bool hasCustomProperties() { return !m_structure->isEmpty(); }
         bool hasGetterSetterProperties() { return m_structure->hasGetterSetterProperties(); }
 
-        void putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        bool putDirect(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
         void putDirect(const Identifier& propertyName, JSValue value, unsigned attr = 0);
-        void putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot&);
+        bool putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot&);
 
         void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr = 0);
         void putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
@@ -205,6 +209,7 @@ namespace JSC {
         virtual bool isVariableObject() const { return false; }
         virtual bool isActivationObject() const { return false; }
         virtual bool isNotAnObjectErrorStub() const { return false; }
+        virtual bool isStrictModeFunction() const { return false; }
 
         virtual ComplType exceptionType() const { return Throw; }
 
@@ -248,9 +253,6 @@ namespace JSC {
         void getString(ExecState* exec);
         void isObject();
         void isString();
-#if USE(JSVALUE32)
-        void isNumber();
-#endif
 
         ConstPropertyStorage propertyStorage() const { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
         PropertyStorage propertyStorage() { return (isUsingInlineStorage() ? m_inlineStorage : m_externalStorage); }
@@ -265,8 +267,8 @@ namespace JSC {
             return reinterpret_cast<JSValue*>(&propertyStorage()[offset]);
         }
 
-        void putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
-        void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
+        bool putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot, JSCell*);
+        bool putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr, bool checkReadOnly, PutPropertySlot& slot);
         void putDirectInternal(JSGlobalData&, const Identifier& propertyName, JSValue value, unsigned attr = 0);
 
         bool inlineGetOwnPropertySlot(ExecState*, const Identifier& propertyName, PropertySlot&);
@@ -299,9 +301,7 @@ inline JSObject::JSObject(NonNullPassRefPtr<Structure> structure)
     ASSERT(m_structure->propertyStorageCapacity() == inlineStorageCapacity);
     ASSERT(m_structure->isEmpty());
     ASSERT(prototype().isNull() || Heap::heap(this) == Heap::heap(prototype()));
-#if USE(JSVALUE64) || USE(JSVALUE32_64)
     ASSERT(OBJECT_OFFSETOF(JSObject, m_inlineStorage) % sizeof(double) == 0);
-#endif
 }
 
 inline JSObject::~JSObject()
@@ -450,7 +450,7 @@ inline JSValue JSObject::get(ExecState* exec, unsigned propertyName) const
     return jsUndefined();
 }
 
-inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
+inline bool JSObject::putDirectInternal(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot, JSCell* specificFunction)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
@@ -465,7 +465,8 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
             if (currentSpecificFunction && (specificFunction != currentSpecificFunction))
                 m_structure->despecifyDictionaryFunction(propertyName);
             if (checkReadOnly && currentAttributes & ReadOnly)
-                return;
+                return false;
+
             putDirectOffset(offset, value);
             // At this point, the objects structure only has a specific value set if previously there
             // had been one set, and if the new value being specified is the same (otherwise we would
@@ -475,7 +476,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
             // If there was previously a value, and the new value is the same, then we cannot cache.
             if (!currentSpecificFunction || (specificFunction != currentSpecificFunction))
                 slot.setExistingProperty(this, offset);
-            return;
+            return true;
         }
 
         size_t currentCapacity = m_structure->propertyStorageCapacity();
@@ -488,7 +489,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         // See comment on setNewProperty call below.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
-        return;
+        return true;
     }
 
     size_t offset;
@@ -504,7 +505,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         // so leave the slot in an uncachable state.
         if (!specificFunction)
             slot.setNewProperty(this, offset);
-        return;
+        return true;
     }
 
     unsigned currentAttributes;
@@ -512,7 +513,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
     offset = m_structure->get(propertyName, currentAttributes, currentSpecificFunction);
     if (offset != WTF::notFound) {
         if (checkReadOnly && currentAttributes & ReadOnly)
-            return;
+            return false;
 
         // There are three possibilities here:
         //  (1) There is an existing specific value set, and we're overwriting with *the same value*.
@@ -527,7 +528,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
             // case (1) Do the put, then return leaving the slot uncachable.
             if (specificFunction == currentSpecificFunction) {
                 putDirectOffset(offset, value);
-                return;
+                return true;
             }
             // case (2) Despecify, fall through to (3).
             setStructure(Structure::despecifyFunctionTransition(m_structure, propertyName));
@@ -536,7 +537,7 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
         // case (3) set the slot, do the put, return.
         slot.setExistingProperty(this, offset);
         putDirectOffset(offset, value);
-        return;
+        return true;
     }
 
     // If we have a specific function, we may have got to this point if there is
@@ -561,14 +562,15 @@ inline void JSObject::putDirectInternal(const Identifier& propertyName, JSValue
     // so leave the slot in an uncachable state.
     if (!specificFunction)
         slot.setNewProperty(this, offset);
+    return true;
 }
 
-inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline bool JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
+    return putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, getJSFunction(globalData, value));
 }
 
 inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifier& propertyName, JSValue value, unsigned attributes)
@@ -577,12 +579,12 @@ inline void JSObject::putDirectInternal(JSGlobalData& globalData, const Identifi
     putDirectInternal(propertyName, value, attributes, false, slot, getJSFunction(globalData, value));
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
+inline bool JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
 {
     ASSERT(value);
     ASSERT(!Heap::heap(value) || Heap::heap(value) == Heap::heap(this));
 
-    putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
+    return putDirectInternal(propertyName, value, attributes, checkReadOnly, slot, 0);
 }
 
 inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, unsigned attributes)
@@ -591,9 +593,9 @@ inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, u
     putDirectInternal(propertyName, value, attributes, false, slot, 0);
 }
 
-inline void JSObject::putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+inline bool JSObject::putDirect(const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
-    putDirectInternal(propertyName, value, 0, false, slot, 0);
+    return putDirectInternal(propertyName, value, 0, false, slot, 0);
 }
 
 inline void JSObject::putDirectFunction(const Identifier& propertyName, JSCell* value, unsigned attributes, bool checkReadOnly, PutPropertySlot& slot)
@@ -698,10 +700,11 @@ inline void JSValue::put(ExecState* exec, const Identifier& propertyName, JSValu
     asCell()->put(exec, propertyName, value, slot);
 }
 
-inline void JSValue::putDirect(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
+inline void JSValue::putDirect(ExecState* exec, const Identifier& propertyName, JSValue value, PutPropertySlot& slot)
 {
     ASSERT(isCell() && isObject());
-    asObject(asCell())->putDirect(propertyName, value, slot);
+    if (!asObject(asCell())->putDirect(propertyName, value, slot) && slot.isStrictMode())
+        throwTypeError(exec, StrictModeReadonlyPropertyWriteError);
 }
 
 inline void JSValue::put(ExecState* exec, unsigned propertyName, JSValue value)
@@ -756,6 +759,13 @@ inline JSString* JSValue::toThisJSString(ExecState* exec) const
     return isString() ? static_cast<JSString*>(asCell()) : jsString(exec, toThisObject(exec)->toString(exec));
 }
 
+inline JSValue JSValue::toStrictThisObject(ExecState* exec) const
+{
+    if (!isObject())
+        return *this;
+    return asObject(asCell())->toStrictThisObject(exec);
+}
+
 } // namespace JSC
 
 #endif // JSObject_h
diff --git a/JavaScriptCore/runtime/JSStaticScopeObject.cpp b/JavaScriptCore/runtime/JSStaticScopeObject.cpp
index ad10218..7ab1d1c 100644
--- a/JavaScriptCore/runtime/JSStaticScopeObject.cpp
+++ b/JavaScriptCore/runtime/JSStaticScopeObject.cpp
@@ -42,6 +42,11 @@ JSObject* JSStaticScopeObject::toThisObject(ExecState* exec) const
     return exec->globalThisValue();
 }
 
+JSValue JSStaticScopeObject::toStrictThisObject(ExecState*) const
+{
+    return jsNull();
+}
+
 void JSStaticScopeObject::put(ExecState*, const Identifier& propertyName, JSValue value, PutPropertySlot&)
 {
     if (symbolTablePut(propertyName, value))
diff --git a/JavaScriptCore/runtime/JSStaticScopeObject.h b/JavaScriptCore/runtime/JSStaticScopeObject.h
index c0519c1..e69356a 100644
--- a/JavaScriptCore/runtime/JSStaticScopeObject.h
+++ b/JavaScriptCore/runtime/JSStaticScopeObject.h
@@ -53,6 +53,7 @@ namespace JSC{
         virtual void markChildren(MarkStack&);
         bool isDynamicScope(bool& requiresDynamicChecks) const;
         virtual JSObject* toThisObject(ExecState*) const;
+        virtual JSValue toStrictThisObject(ExecState*) const;
         virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&);
         virtual void put(ExecState*, const Identifier&, JSValue, PutPropertySlot&);
         void putWithAttributes(ExecState*, const Identifier&, JSValue, unsigned attributes);
diff --git a/JavaScriptCore/runtime/JSStringBuilder.h b/JavaScriptCore/runtime/JSStringBuilder.h
index 25fe685..49d4a63 100644
--- a/JavaScriptCore/runtime/JSStringBuilder.h
+++ b/JavaScriptCore/runtime/JSStringBuilder.h
@@ -28,7 +28,7 @@
 
 #include "ExceptionHelpers.h"
 #include "JSString.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include "Vector.h"
 
 namespace JSC {
@@ -87,7 +87,7 @@ protected:
 template<typename StringType1, typename StringType2>
 inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2)
 {
-    PassRefPtr<StringImpl> result = tryMakeString(string1, string2);
+    PassRefPtr<StringImpl> result = WTF::tryMakeString(string1, string2);
     if (!result)
         return throwOutOfMemoryError(exec);
     return jsNontrivialString(exec, result);
@@ -96,7 +96,7 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, Stri
 template<typename StringType1, typename StringType2, typename StringType3>
 inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3)
 {
-    PassRefPtr<StringImpl> result = tryMakeString(string1, string2, string3);
+    PassRefPtr<StringImpl> result = WTF::tryMakeString(string1, string2, string3);
     if (!result)
         return throwOutOfMemoryError(exec);
     return jsNontrivialString(exec, result);
@@ -105,7 +105,7 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, Stri
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
 inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
 {
-    PassRefPtr<StringImpl> result = tryMakeString(string1, string2, string3, string4);
+    PassRefPtr<StringImpl> result = WTF::tryMakeString(string1, string2, string3, string4);
     if (!result)
         return throwOutOfMemoryError(exec);
     return jsNontrivialString(exec, result);
@@ -114,7 +114,7 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, Stri
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
 inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
 {
-    PassRefPtr<StringImpl> result = tryMakeString(string1, string2, string3, string4, string5);
+    PassRefPtr<StringImpl> result = WTF::tryMakeString(string1, string2, string3, string4, string5);
     if (!result)
         return throwOutOfMemoryError(exec);
     return jsNontrivialString(exec, result);
@@ -123,7 +123,7 @@ inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, Stri
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
 inline JSValue jsMakeNontrivialString(ExecState* exec, StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
 {
-    PassRefPtr<StringImpl> result = tryMakeString(string1, string2, string3, string4, string5, string6);
+    PassRefPtr<StringImpl> result = WTF::tryMakeString(string1, string2, string3, string4, string5, string6);
     if (!result)
         return throwOutOfMemoryError(exec);
     return jsNontrivialString(exec, result);
diff --git a/JavaScriptCore/runtime/JSValue.h b/JavaScriptCore/runtime/JSValue.h
index b5834c1..b5dcbec 100644
--- a/JavaScriptCore/runtime/JSValue.h
+++ b/JavaScriptCore/runtime/JSValue.h
@@ -80,7 +80,7 @@ namespace JSC {
     public:
         static EncodedJSValue encode(JSValue value);
         static JSValue decode(EncodedJSValue ptr);
-#if !USE(JSVALUE32_64)
+#if USE(JSVALUE64)
     private:
         static JSValue makeImmediate(intptr_t value);
         intptr_t immediateValue();
@@ -193,6 +193,7 @@ namespace JSC {
 
         bool needsThisConversion() const;
         JSObject* toThisObject(ExecState*) const;
+        JSValue toStrictThisObject(ExecState*) const;
         UString toThisString(ExecState*) const;
         JSString* toThisJSString(ExecState*) const;
 
diff --git a/JavaScriptCore/runtime/JSZombie.h b/JavaScriptCore/runtime/JSZombie.h
index 711f673..da45699 100644
--- a/JavaScriptCore/runtime/JSZombie.h
+++ b/JavaScriptCore/runtime/JSZombie.h
@@ -60,6 +60,7 @@ public:
     virtual bool deleteProperty(ExecState*, const Identifier&) { ASSERT_NOT_REACHED(); return false; }
     virtual bool deleteProperty(ExecState*, unsigned) { ASSERT_NOT_REACHED(); return false; }
     virtual JSObject* toThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return 0; }
+    virtual JSValue toStrictThisObject(ExecState*) const { ASSERT_NOT_REACHED(); return JSValue(); }
     virtual JSValue getJSNumber() { ASSERT_NOT_REACHED(); return jsNull(); }
     virtual bool getOwnPropertySlot(ExecState*, const Identifier&, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
     virtual bool getOwnPropertySlot(ExecState*, unsigned, PropertySlot&) { ASSERT_NOT_REACHED(); return false; }
diff --git a/JavaScriptCore/runtime/LiteralParser.cpp b/JavaScriptCore/runtime/LiteralParser.cpp
index cc33bae..f1df15f 100644
--- a/JavaScriptCore/runtime/LiteralParser.cpp
+++ b/JavaScriptCore/runtime/LiteralParser.cpp
@@ -29,7 +29,7 @@
 #include "JSArray.h"
 #include "JSString.h"
 #include "Lexer.h"
-#include "StringBuilder.h"
+#include "UStringBuilder.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/dtoa.h>
 
@@ -135,7 +135,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
 {
     ++m_ptr;
     const UChar* runStart;
-    StringBuilder builder;
+    UStringBuilder builder;
     do {
         runStart = m_ptr;
         while (m_ptr < m_end && isSafeStringCharacter<mode>(*m_ptr))
@@ -200,7 +200,7 @@ template <LiteralParser::ParserMode mode> inline LiteralParser::TokenType Litera
     if (m_ptr >= m_end || *m_ptr != '"')
         return TokError;
 
-    token.stringToken = builder.build();
+    token.stringToken = builder.toUString();
     token.type = TokString;
     token.end = ++m_ptr;
     return TokString;
diff --git a/JavaScriptCore/runtime/NumberObject.h b/JavaScriptCore/runtime/NumberObject.h
index 6c18cdd..e82b593 100644
--- a/JavaScriptCore/runtime/NumberObject.h
+++ b/JavaScriptCore/runtime/NumberObject.h
@@ -37,11 +37,7 @@ namespace JSC {
         }
 
     protected:
-#if USE(JSVALUE32)
-        static const unsigned StructureFlags = OverridesMarkChildren | JSWrapperObject::StructureFlags;
-#else
         static const unsigned StructureFlags = JSWrapperObject::StructureFlags;
-#endif
 
     private:
         virtual const ClassInfo* classInfo() const { return &info; }
diff --git a/JavaScriptCore/runtime/NumberPrototype.cpp b/JavaScriptCore/runtime/NumberPrototype.cpp
index e18553b..4a2ca74 100644
--- a/JavaScriptCore/runtime/NumberPrototype.cpp
+++ b/JavaScriptCore/runtime/NumberPrototype.cpp
@@ -25,10 +25,8 @@
 #include "Error.h"
 #include "JSFunction.h"
 #include "JSString.h"
-#include "JSStringBuilder.h"
 #include "Operations.h"
 #include "PrototypeFunction.h"
-#include "StringBuilder.h"
 #include "dtoa.h"
 #include <wtf/Assertions.h>
 #include <wtf/DecimalNumber.h>
@@ -119,8 +117,8 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToExponential(ExecState* exec)
     // Round if the argument is not undefined, always format as exponential.
     NumberToStringBuffer buffer;
     unsigned length = isUndefined
-        ? DecimalNumber(x).toStringExponential(buffer)
-        : DecimalNumber(x, RoundingSignificantFigures, decimalPlacesInExponent + 1).toStringExponential(buffer);
+        ? DecimalNumber(x).toStringExponential(buffer, WTF::NumberToStringBufferLength)
+        : DecimalNumber(x, RoundingSignificantFigures, decimalPlacesInExponent + 1).toStringExponential(buffer, WTF::NumberToStringBufferLength);
 
     return JSValue::encode(jsString(exec, UString(buffer, length)));
 }
@@ -156,7 +154,7 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToFixed(ExecState* exec)
 
     // Convert to decimal with rounding, and format as decimal.
     NumberToStringBuffer buffer;
-    unsigned length = DecimalNumber(x, RoundingDecimalPlaces, decimalPlaces).toStringDecimal(buffer);
+    unsigned length = DecimalNumber(x, RoundingDecimalPlaces, decimalPlaces).toStringDecimal(buffer, WTF::NumberToStringBufferLength);
     return JSValue::encode(jsString(exec, UString(buffer, length)));
 }
 
@@ -198,8 +196,8 @@ EncodedJSValue JSC_HOST_CALL numberProtoFuncToPrecision(ExecState* exec)
     // 1234 (1.234e+3) requires 4 digits. (See ECMA-262 15.7.4.7.10.c)
     NumberToStringBuffer buffer;
     unsigned length = number.exponent() >= -6 && number.exponent() < significantFigures
-        ? number.toStringDecimal(buffer)
-        : number.toStringExponential(buffer);
+        ? number.toStringDecimal(buffer, WTF::NumberToStringBufferLength)
+        : number.toStringExponential(buffer, WTF::NumberToStringBufferLength);
     return JSValue::encode(jsString(exec, UString(buffer, length)));
 }
 
diff --git a/JavaScriptCore/runtime/Operations.h b/JavaScriptCore/runtime/Operations.h
index eed1f16..9226953 100644
--- a/JavaScriptCore/runtime/Operations.h
+++ b/JavaScriptCore/runtime/Operations.h
@@ -460,7 +460,7 @@ namespace JSC {
         }
     }
 
-    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain)
+    ALWAYS_INLINE JSValue resolveBase(CallFrame* callFrame, Identifier& property, ScopeChainNode* scopeChain, bool isStrictPut)
     {
         ScopeChainIterator iter = scopeChain->begin();
         ScopeChainIterator next = iter;
@@ -472,7 +472,9 @@ namespace JSC {
         JSObject* base;
         while (true) {
             base = *iter;
-            if (next == end || base->getPropertySlot(callFrame, property, slot))
+            if (next == end)
+                return isStrictPut ? JSValue() : base;
+            if (base->getPropertySlot(callFrame, property, slot))
                 return base;
 
             iter = next;
diff --git a/JavaScriptCore/runtime/PutPropertySlot.h b/JavaScriptCore/runtime/PutPropertySlot.h
index eb8ea8a..4b0b394 100644
--- a/JavaScriptCore/runtime/PutPropertySlot.h
+++ b/JavaScriptCore/runtime/PutPropertySlot.h
@@ -38,9 +38,10 @@ namespace JSC {
     public:
         enum Type { Uncachable, ExistingProperty, NewProperty };
 
-        PutPropertySlot()
+        PutPropertySlot(bool isStrictMode = false)
             : m_type(Uncachable)
             , m_base(0)
+            , m_isStrictMode(isStrictMode)
         {
         }
 
@@ -61,6 +62,7 @@ namespace JSC {
         Type type() const { return m_type; }
         JSObject* base() const { return m_base; }
 
+        bool isStrictMode() const { return m_isStrictMode; }
         bool isCacheable() const { return m_type != Uncachable; }
         size_t cachedOffset() const {
             ASSERT(isCacheable());
@@ -70,6 +72,7 @@ namespace JSC {
         Type m_type;
         JSObject* m_base;
         size_t m_offset;
+        bool m_isStrictMode;
     };
 
 } // namespace JSC
diff --git a/JavaScriptCore/runtime/RegExpConstructor.cpp b/JavaScriptCore/runtime/RegExpConstructor.cpp
index 214e528..b9aa587 100644
--- a/JavaScriptCore/runtime/RegExpConstructor.cpp
+++ b/JavaScriptCore/runtime/RegExpConstructor.cpp
@@ -35,7 +35,7 @@
 #include "RegExpPrototype.h"
 #include "RegExp.h"
 #include "RegExpCache.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace JSC {
@@ -307,7 +307,7 @@ JSObject* constructRegExp(ExecState* exec, const ArgList& args)
 
     RefPtr<RegExp> regExp = exec->globalData().regExpCache()->lookupOrCreate(pattern, flags);
     if (!regExp->isValid())
-        return throwError(exec, createSyntaxError(exec, makeString("Invalid regular expression: ", regExp->errorMessage())));
+        return throwError(exec, createSyntaxError(exec, makeUString("Invalid regular expression: ", regExp->errorMessage())));
     return new (exec) RegExpObject(exec->lexicalGlobalObject(), exec->lexicalGlobalObject()->regExpStructure(), regExp.release());
 }
 
diff --git a/JavaScriptCore/runtime/RegExpObject.cpp b/JavaScriptCore/runtime/RegExpObject.cpp
index 4462879..7d14814 100644
--- a/JavaScriptCore/runtime/RegExpObject.cpp
+++ b/JavaScriptCore/runtime/RegExpObject.cpp
@@ -29,7 +29,7 @@
 #include "Lookup.h"
 #include "RegExpConstructor.h"
 #include "RegExpPrototype.h"
-#include "StringConcatenate.h"
+#include "UStringConcatenate.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace JSC {
@@ -146,7 +146,7 @@ bool RegExpObject::match(ExecState* exec)
 
     UString input = !exec->argumentCount() ? regExpConstructor->input() : exec->argument(0).toString(exec);
     if (input.isNull()) {
-        throwError(exec, createError(exec, makeString("No input to ", toString(exec), ".")));
+        throwError(exec, createError(exec, makeUString("No input to ", toString(exec), ".")));
         return false;
     }
 
diff --git a/JavaScriptCore/runtime/RegExpPrototype.cpp b/JavaScriptCore/runtime/RegExpPrototype.cpp
index d66f5d7..0a4c8bf 100644
--- a/JavaScriptCore/runtime/RegExpPrototype.cpp
+++ b/JavaScriptCore/runtime/RegExpPrototype.cpp
@@ -34,6 +34,7 @@
 #include "RegExpObject.h"
 #include "RegExp.h"
 #include "RegExpCache.h"
+#include "UStringConcatenate.h"
 
 namespace JSC {
 
@@ -94,7 +95,7 @@ EncodedJSValue JSC_HOST_CALL regExpProtoFuncCompile(ExecState* exec)
     }
 
     if (!regExp->isValid())
-        return throwVMError(exec, createSyntaxError(exec, makeString("Invalid regular expression: ", regExp->errorMessage())));
+        return throwVMError(exec, createSyntaxError(exec, makeUString("Invalid regular expression: ", regExp->errorMessage())));
 
     asRegExpObject(thisValue)->setRegExp(regExp.release());
     asRegExpObject(thisValue)->setLastIndex(0);
diff --git a/JavaScriptCore/runtime/StrictEvalActivation.cpp b/JavaScriptCore/runtime/StrictEvalActivation.cpp
new file mode 100644
index 0000000..5bb013b
--- /dev/null
+++ b/JavaScriptCore/runtime/StrictEvalActivation.cpp
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "StrictEvalActivation.h"
+
+namespace JSC {
+
+StrictEvalActivation::StrictEvalActivation(ExecState* exec)
+    : JSObject(exec->globalData().strictEvalActivationStructure)
+{
+}
+
+bool StrictEvalActivation::deleteProperty(ExecState*, const Identifier&)
+{
+    return false;
+}
+
+JSObject* StrictEvalActivation::toThisObject(ExecState* exec) const
+{
+    return exec->globalThisValue();
+}
+
+JSValue StrictEvalActivation::toStrictThisObject(ExecState*) const
+{
+    return jsNull();
+}
+
+}
diff --git a/JavaScriptCore/runtime/StrictEvalActivation.h b/JavaScriptCore/runtime/StrictEvalActivation.h
new file mode 100644
index 0000000..1385eec
--- /dev/null
+++ b/JavaScriptCore/runtime/StrictEvalActivation.h
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef StrictEvalActivation_h
+#define StrictEvalActivation_h
+
+#include "JSObject.h"
+
+namespace JSC {
+
+class StrictEvalActivation : public JSObject {
+public:
+    StrictEvalActivation(ExecState*);
+    virtual bool deleteProperty(ExecState*, const Identifier&);
+    virtual JSObject* toThisObject(ExecState*) const;
+    virtual JSValue toStrictThisObject(ExecState*) const;
+};
+
+} // namespace JSC
+
+#endif // StrictEvalActivation_h
diff --git a/JavaScriptCore/runtime/StringBuilder.h b/JavaScriptCore/runtime/StringBuilder.h
deleted file mode 100644
index 27aa57f..0000000
--- a/JavaScriptCore/runtime/StringBuilder.h
+++ /dev/null
@@ -1,87 +0,0 @@
-/*
- * Copyright (C) 2009 Apple Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef StringBuilder_h
-#define StringBuilder_h
-
-#include <wtf/Vector.h>
-
-namespace JSC {
-
-class StringBuilder {
-public:
-    void append(const UChar u)
-    {
-        buffer.append(u);
-    }
-
-    void append(const char* str)
-    {
-        append(str, strlen(str));
-    }
-
-    void append(const char* str, size_t len)
-    {
-        reserveCapacity(buffer.size() + len);
-        for (size_t i = 0; i < len; i++)
-            buffer.append(static_cast<unsigned char>(str[i]));
-    }
-
-    void append(const UChar* str, size_t len)
-    {
-        buffer.append(str, len);
-    }
-
-    void append(const UString& str)
-    {
-        buffer.append(str.characters(), str.length());
-    }
-
-    bool isEmpty() { return buffer.isEmpty(); }
-    void reserveCapacity(size_t newCapacity)
-    {
-        if (newCapacity < buffer.capacity())
-            return;
-        buffer.reserveCapacity(std::max(newCapacity, buffer.capacity() + buffer.capacity() / 4 + 1));
-    }
-    void resize(size_t size) { buffer.resize(size); }
-    size_t size() const { return buffer.size(); }
-
-    UChar operator[](size_t i) const { return buffer.at(i); }
-
-    UString build()
-    {
-        buffer.shrinkToFit();
-        ASSERT(buffer.data() || !buffer.size());
-        return UString::adopt(buffer);
-    }
-
-protected:
-    Vector<UChar, 64> buffer;
-};
-
-}
-
-#endif
diff --git a/JavaScriptCore/runtime/StringPrototype.cpp b/JavaScriptCore/runtime/StringPrototype.cpp
index 91e9b06..37436f9 100644
--- a/JavaScriptCore/runtime/StringPrototype.cpp
+++ b/JavaScriptCore/runtime/StringPrototype.cpp
@@ -206,7 +206,8 @@ static NEVER_INLINE UString substituteBackreferencesSlow(const UString& replacem
             substitutedReplacement.append(replacement.characters() + offset, i - offset);
         i += 1 + advance;
         offset = i + 1;
-        substitutedReplacement.append(source.characters() + backrefStart, backrefLength);
+        if (backrefStart >= 0)
+            substitutedReplacement.append(source.characters() + backrefStart, backrefLength);
     } while ((i = replacement.find('$', i + 1)) != notFound);
 
     if (replacement.length() - offset)
@@ -275,12 +276,16 @@ static ALWAYS_INLINE JSValue jsSpliceSubstringsWithSeparators(ExecState* exec, J
     int bufferPos = 0;
     for (int i = 0; i < maxCount; i++) {
         if (i < rangeCount) {
-            StringImpl::copyChars(buffer + bufferPos, source.characters() + substringRanges[i].position, substringRanges[i].length);
-            bufferPos += substringRanges[i].length;
+            if (int srcLen = substringRanges[i].length) {
+                StringImpl::copyChars(buffer + bufferPos, source.characters() + substringRanges[i].position, srcLen);
+                bufferPos += srcLen;
+            }
         }
         if (i < separatorCount) {
-            StringImpl::copyChars(buffer + bufferPos, separators[i].characters(), separators[i].length());
-            bufferPos += separators[i].length();
+            if (int sepLen = separators[i].length()) {
+                StringImpl::copyChars(buffer + bufferPos, separators[i].characters(), sepLen);
+                bufferPos += sepLen;
+            }
         }
     }
 
@@ -302,6 +307,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
 
     if (pattern.inherits(&RegExpObject::info)) {
         const UString& source = sourceVal->value(exec);
+        unsigned sourceLen = source.length();
         if (exec->hadException())
             return JSValue::encode(JSValue());
         RegExp* reg = asRegExpObject(pattern)->regExp();
@@ -330,7 +336,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                 regExpConstructor->performMatch(reg, source, startPosition, matchIndex, matchLen, &ovector);
                 if (matchIndex < 0)
                     break;
-                
+
                 sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
 
                 int completeMatchStart = ovector[0];
@@ -347,7 +353,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
 
                 cachedCall.setArgument(i++, jsNumber(exec, completeMatchStart));
                 cachedCall.setArgument(i++, sourceVal);
-                
+
                 cachedCall.setThis(exec->globalThisValue());
                 JSValue result = cachedCall.call();
                 if (LIKELY(result.isString()))
@@ -363,10 +369,10 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                 // special case of empty match
                 if (matchLen == 0) {
                     startPosition++;
-                    if (startPosition > source.length())
+                    if (startPosition > sourceLen)
                         break;
                 }
-            }            
+            }
         } else {
             do {
                 int matchIndex;
@@ -376,16 +382,16 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                 if (matchIndex < 0)
                     break;
 
-                sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
-
                 if (callType != CallTypeNone) {
+                    sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
+
                     int completeMatchStart = ovector[0];
                     MarkedArgumentBuffer args;
 
                     for (unsigned i = 0; i < reg->numSubpatterns() + 1; ++i) {
                         int matchStart = ovector[i * 2];
                         int matchLen = ovector[i * 2 + 1] - matchStart;
-
+ 
                         if (matchStart < 0)
                             args.append(jsUndefined());
                         else
@@ -398,8 +404,17 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                     replacements.append(call(exec, replacement, callType, callData, exec->globalThisValue(), args).toString(exec));
                     if (exec->hadException())
                         break;
-                } else
-                    replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
+                } else {
+                    int replLen = replacementString.length();
+                    if (lastIndex < matchIndex || replLen) {
+                        sourceRanges.append(StringRange(lastIndex, matchIndex - lastIndex));
+ 
+                        if (replLen)
+                            replacements.append(substituteBackreferences(replacementString, source, ovector, reg));
+                        else
+                            replacements.append(UString());
+                    }
+                }
 
                 lastIndex = matchIndex + matchLen;
                 startPosition = lastIndex;
@@ -407,7 +422,7 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
                 // special case of empty match
                 if (matchLen == 0) {
                     startPosition++;
-                    if (startPosition > source.length())
+                    if (startPosition > sourceLen)
                         break;
                 }
             } while (global);
@@ -416,8 +431,8 @@ EncodedJSValue JSC_HOST_CALL stringProtoFuncReplace(ExecState* exec)
         if (!lastIndex && replacements.isEmpty())
             return JSValue::encode(sourceVal);
 
-        if (static_cast<unsigned>(lastIndex) < source.length())
-            sourceRanges.append(StringRange(lastIndex, source.length() - lastIndex));
+        if (static_cast<unsigned>(lastIndex) < sourceLen)
+            sourceRanges.append(StringRange(lastIndex, sourceLen - lastIndex));
 
         return JSValue::encode(jsSpliceSubstringsWithSeparators(exec, sourceVal, source, sourceRanges.data(), sourceRanges.size(), replacements.data(), replacements.size()));
     }
diff --git a/WebKit/mac/Misc/WebIconFetcherInternal.h b/JavaScriptCore/runtime/UStringBuilder.h
index 5951ef9..31ccf38 100644
--- a/WebKit/mac/Misc/WebIconFetcherInternal.h
+++ b/JavaScriptCore/runtime/UStringBuilder.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,20 +23,21 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import <WebKit/WebIconFetcher.h>
-#import <wtf/Forward.h>
+#ifndef UStringBuilder_h
+#define UStringBuilder_h
 
-namespace WebCore {
-    class IconFetcher;
-}
+#include <wtf/text/StringBuilder.h>
 
-@class WebFrame;
+namespace JSC {
 
-@interface WebIconFetcher (WebInternal)
+class UStringBuilder : public StringBuilder {
+public:
+    using StringBuilder::append;
+    void append(const UString& str) { append(String(str.impl())); }
 
-+ (WebIconFetcher *)_fetchApplicationIconForFrame:(WebFrame *)webFrame
-                                           target:(id)target
-                                         selector:(SEL)selector;
+    UString toUString() { return toString().impl(); }
+};
 
-@end
+} // namespace JSC
 
+#endif // UStringBuilder_h
diff --git a/JavaScriptCore/runtime/UStringConcatenate.h b/JavaScriptCore/runtime/UStringConcatenate.h
new file mode 100644
index 0000000..0990c72
--- /dev/null
+++ b/JavaScriptCore/runtime/UStringConcatenate.h
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef UStringConcatenate_h
+#define UStringConcatenate_h
+
+#include "UString.h"
+#include <wtf/text/StringConcatenate.h>
+
+namespace WTF {
+
+template<>
+class StringTypeAdapter<JSC::UString> {
+public:
+    StringTypeAdapter<JSC::UString>(JSC::UString& string)
+        : m_data(string.characters())
+        , m_length(string.length())
+    {
+    }
+
+    unsigned length() { return m_length; }
+
+    void writeTo(UChar* destination)
+    {
+        for (unsigned i = 0; i < m_length; ++i)
+            destination[i] = m_data[i];
+    }
+
+private:
+    const UChar* m_data;
+    unsigned m_length;
+};
+
+}; // namespace WTF
+
+namespace JSC {
+
+template<typename StringType1, typename StringType2>
+UString makeUString(StringType1 string1, StringType2 string2)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6, string7);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
+UString makeUString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
+{
+    PassRefPtr<StringImpl> resultImpl = WTF::tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
+    if (!resultImpl)
+        CRASH();
+    return resultImpl;
+}
+
+} // namespace JSC
+
+#endif
diff --git a/JavaScriptCore/jsc/CMakeLists.txt b/JavaScriptCore/shell/CMakeLists.txt
index 1f529a5..1f529a5 100644
--- a/JavaScriptCore/jsc/CMakeLists.txt
+++ b/JavaScriptCore/shell/CMakeLists.txt
diff --git a/JavaScriptCore/jsc/CMakeListsEfl.txt b/JavaScriptCore/shell/CMakeListsEfl.txt
index 58d44f4..58d44f4 100644
--- a/JavaScriptCore/jsc/CMakeListsEfl.txt
+++ b/JavaScriptCore/shell/CMakeListsEfl.txt
diff --git a/JavaScriptCore/wscript b/JavaScriptCore/wscript
index d85364c..8d7f69c 100644
--- a/JavaScriptCore/wscript
+++ b/JavaScriptCore/wscript
@@ -75,10 +75,10 @@ def build(bld):
         install_path = output_dir,
         )
         
-    # we'll get an error if exceptions are on because of an unwind error when using __try
     if building_on_win32:
-        flags = obj.env.CXXFLAGS
-        flags.remove('/EHsc')
-        obj.env.CXXFLAGS = flags
+        myenv = obj.env.copy()
+        myenv.CXXFLAGS = myenv.CXXFLAGS[:]
+        myenv.CXXFLAGS.remove('/EHsc')
+        obj.env = myenv
 
     bld.install_files(os.path.join(output_dir, 'JavaScriptCore'), 'API/*.h')
diff --git a/JavaScriptCore/wtf/CMakeLists.txt b/JavaScriptCore/wtf/CMakeLists.txt
index 896794e..898d19b 100644
--- a/JavaScriptCore/wtf/CMakeLists.txt
+++ b/JavaScriptCore/wtf/CMakeLists.txt
@@ -2,6 +2,7 @@ SET(WTF_SOURCES
     Assertions.cpp
     ByteArray.cpp
     CurrentTime.cpp
+    DecimalNumber.cpp
     FastMalloc.cpp
     HashTable.cpp
     MainThread.cpp
@@ -16,6 +17,7 @@ SET(WTF_SOURCES
 
     text/AtomicString.cpp
     text/CString.cpp
+    text/StringBuilder.cpp
     text/StringImpl.cpp
     text/StringStatics.cpp
     text/WTFString.cpp
diff --git a/JavaScriptCore/wtf/CMakeListsEfl.txt b/JavaScriptCore/wtf/CMakeListsEfl.txt
index 6a714ae..e5d8bd7 100644
--- a/JavaScriptCore/wtf/CMakeListsEfl.txt
+++ b/JavaScriptCore/wtf/CMakeListsEfl.txt
@@ -1,4 +1,10 @@
-ADD_DEFINITIONS(-DUSE_SYSTEM_MALLOC=1)
+IF (ENABLE_FAST_MALLOC)
+  LIST(APPEND WTF_SOURCES
+    TCSystemAlloc.cpp
+  )
+ELSE ()
+  ADD_DEFINITIONS(-DUSE_SYSTEM_MALLOC=1)
+ENDIF()
 
 LIST(APPEND WTF_SOURCES
     efl/MainThreadEfl.cpp
@@ -16,7 +22,12 @@ IF (ENABLE_GLIB_SUPPORT)
   )
 
   LIST(APPEND WTF_INCLUDE_DIRECTORIES
-       ${JAVASCRIPTCORE_DIR}/wtf/gobject
+    ${Glib_INCLUDE_DIRS}
+    ${JAVASCRIPTCORE_DIR}/wtf/gobject
+  )
+
+  LIST(APPEND WTF_LIBRARIES
+    ${Glib_LIBRARIES}
   )
 ENDIF ()
 
diff --git a/JavaScriptCore/wtf/CurrentTime.h b/JavaScriptCore/wtf/CurrentTime.h
index dcb1f6c..7119656 100644
--- a/JavaScriptCore/wtf/CurrentTime.h
+++ b/JavaScriptCore/wtf/CurrentTime.h
@@ -61,6 +61,7 @@ namespace WTF {
 } // namespace WTF
 
 using WTF::currentTime;
+using WTF::currentTimeMS;
 using WTF::getLocalTime;
 
 #endif // CurrentTime_h
diff --git a/JavaScriptCore/wtf/DateMath.cpp b/JavaScriptCore/wtf/DateMath.cpp
index b9a0207..d005859 100644
--- a/JavaScriptCore/wtf/DateMath.cpp
+++ b/JavaScriptCore/wtf/DateMath.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2006, 2007 Apple Inc. All rights reserved.
  * Copyright (C) 2009 Google Inc. All rights reserved.
  * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ * Copyright (C) 2010 &yet, LLC. (nate@andyet.net)
  *
  * The Original Code is Mozilla Communicator client code, released
  * March 31, 1998.
@@ -479,7 +480,7 @@ void initializeDates()
     equivalentYearForDST(2000); // Need to call once to initialize a static used in this function.
 }
 
-static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, int second)
+static inline double ymdhmsToSeconds(long year, int mon, int day, int hour, int minute, double second)
 {
     double days = (day - 32075)
         + floor(1461 * (year + 4800.0 + (mon - 14) / 12) / 4)
@@ -557,6 +558,162 @@ static bool parseLong(const char* string, char** stopPosition, int base, long* r
     return true;
 }
 
+double parseES5DateFromNullTerminatedCharacters(const char* dateString)
+{
+    // This parses a date of the form defined in ECMA-262-5, section 15.9.1.15
+    // (similar to RFC 3339 / ISO 8601: YYYY-MM-DDTHH:mm:ss[.sss]Z).
+    // In most cases it is intentionally strict (e.g. correct field widths, no stray whitespace).
+    
+    static const long daysPerMonth[12] = { 31, 29, 31, 30, 31, 30, 31, 31, 30, 31, 30, 31 };
+    
+    const char* currentPosition = dateString;
+    char* postParsePosition;
+    
+    // This is a bit more lenient on the year string than ES5 specifies:
+    // instead of restricting to 4 digits (or 6 digits with mandatory +/-),
+    // it accepts any integer value. Consider this an implementation fallback.
+    long year;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &year))
+        return NaN;
+    if (*postParsePosition != '-')
+        return NaN;
+    currentPosition = postParsePosition + 1;
+    
+    long month;
+    if (!isASCIIDigit(*currentPosition))
+        return NaN;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &month))
+        return NaN;
+    if (*postParsePosition != '-' || (postParsePosition - currentPosition) != 2)
+        return NaN;
+    currentPosition = postParsePosition + 1;
+    
+    long day;
+    if (!isASCIIDigit(*currentPosition))
+        return NaN;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &day))
+        return NaN;
+    if (*postParsePosition != 'T' || (postParsePosition - currentPosition) != 2)
+        return NaN;
+    currentPosition = postParsePosition + 1;
+    
+    long hours;
+    if (!isASCIIDigit(*currentPosition))
+        return NaN;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &hours))
+        return NaN;
+    if (*postParsePosition != ':' || (postParsePosition - currentPosition) != 2)
+        return NaN;
+    currentPosition = postParsePosition + 1;
+    
+    long minutes;
+    if (!isASCIIDigit(*currentPosition))
+        return NaN;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &minutes))
+        return NaN;
+    if (*postParsePosition != ':' || (postParsePosition - currentPosition) != 2)
+        return NaN;
+    currentPosition = postParsePosition + 1;
+    
+    long intSeconds;
+    if (!isASCIIDigit(*currentPosition))
+        return NaN;
+    if (!parseLong(currentPosition, &postParsePosition, 10, &intSeconds))
+        return NaN;
+    if ((postParsePosition - currentPosition) != 2)
+        return NaN;
+    
+    double seconds = intSeconds;
+    if (*postParsePosition == '.') {
+        currentPosition = postParsePosition + 1;
+        
+        // In ECMA-262-5 it's a bit unclear if '.' can be present without milliseconds, but
+        // a reasonable interpretation guided by the given examples and RFC 3339 says "no".
+        // We check the next character to avoid reading +/- timezone hours after an invalid decimal.
+        if (!isASCIIDigit(*currentPosition))
+            return NaN;
+        
+        // We are more lenient than ES5 by accepting more or less than 3 fraction digits.
+        long fracSeconds;
+        if (!parseLong(currentPosition, &postParsePosition, 10, &fracSeconds))
+            return NaN;
+        
+        long numFracDigits = postParsePosition - currentPosition;
+        seconds += fracSeconds * pow(10.0, static_cast<double>(-numFracDigits));
+    }
+    currentPosition = postParsePosition;
+    
+    // A few of these checks could be done inline above, but since many of them are interrelated
+    // we would be sacrificing readability to "optimize" the (presumably less common) failure path.
+    if (month < 1 || month > 12)
+        return NaN;
+    if (day < 1 || day > daysPerMonth[month - 1])
+        return NaN;
+    if (month == 2 && day > 28 && !isLeapYear(year))
+        return NaN;
+    if (hours < 0 || hours > 24)
+        return NaN;
+    if (hours == 24 && (minutes || seconds))
+        return NaN;
+    if (minutes < 0 || minutes > 59)
+        return NaN;
+    if (seconds < 0 || seconds >= 61)
+        return NaN;
+    if (seconds > 60) {
+        // Discard leap seconds by clamping to the end of a minute.
+        seconds = 60;
+    }
+    
+    long timeZoneSeconds = 0;
+    if (*currentPosition != 'Z') {
+        bool tzNegative;
+        if (*currentPosition == '-')
+            tzNegative = true;
+        else if (*currentPosition == '+')
+            tzNegative = false;
+        else
+            return NaN;
+        currentPosition += 1;
+        
+        long tzHours;
+        long tzHoursAbs;
+        long tzMinutes;
+        
+        if (!isASCIIDigit(*currentPosition))
+            return NaN;
+        if (!parseLong(currentPosition, &postParsePosition, 10, &tzHours))
+            return NaN;
+        if (*postParsePosition != ':' || (postParsePosition - currentPosition) != 2)
+            return NaN;
+        tzHoursAbs = abs(tzHours);
+        currentPosition = postParsePosition + 1;
+        
+        if (!isASCIIDigit(*currentPosition))
+            return NaN;
+        if (!parseLong(currentPosition, &postParsePosition, 10, &tzMinutes))
+            return NaN;
+        if ((postParsePosition - currentPosition) != 2)
+            return NaN;
+        currentPosition = postParsePosition;
+        
+        if (tzHoursAbs > 24)
+            return NaN;
+        if (tzMinutes < 0 || tzMinutes > 59)
+            return NaN;
+        
+        timeZoneSeconds = 60 * (tzMinutes + (60 * tzHoursAbs));
+        if (tzNegative)
+            timeZoneSeconds = -timeZoneSeconds;
+    } else {
+        currentPosition += 1;
+    }
+    if (*currentPosition)
+        return NaN;
+    
+    double dateSeconds = ymdhmsToSeconds(year, month, day, hours, minutes, seconds) - timeZoneSeconds;
+    return dateSeconds * msPerSecond;
+}
+
 // Odd case where 'exec' is allowed to be 0, to accomodate a caller in WebCore.
 static double parseDateFromNullTerminatedCharacters(const char* dateString, bool& haveTZ, int& offset)
 {
diff --git a/JavaScriptCore/wtf/DateMath.h b/JavaScriptCore/wtf/DateMath.h
index 033d25e..be51947 100644
--- a/JavaScriptCore/wtf/DateMath.h
+++ b/JavaScriptCore/wtf/DateMath.h
@@ -53,7 +53,8 @@ namespace WTF {
 void initializeDates();
 int equivalentYearForDST(int year);
 
-// Not really math related, but this is currently the only shared place to put these.  
+// Not really math related, but this is currently the only shared place to put these.
+double parseES5DateFromNullTerminatedCharacters(const char* dateString);
 double parseDateFromNullTerminatedCharacters(const char* dateString);
 double timeClip(double);
 
@@ -94,6 +95,7 @@ using WTF::msPerDay;
 using WTF::msPerSecond;
 using WTF::msToYear;
 using WTF::secondsPerMinute;
+using WTF::parseDateFromNullTerminatedCharacters;
 
 #if USE(JSC)
 namespace JSC {
diff --git a/JavaScriptCore/wtf/DecimalNumber.cpp b/JavaScriptCore/wtf/DecimalNumber.cpp
new file mode 100644
index 0000000..70304e2
--- /dev/null
+++ b/JavaScriptCore/wtf/DecimalNumber.cpp
@@ -0,0 +1,199 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "DecimalNumber.h"
+#include <math.h>
+#include <wtf/MathExtras.h>
+#include <wtf/text/WTFString.h>
+
+namespace WTF {
+
+unsigned DecimalNumber::bufferLengthForStringDecimal() const
+{
+    unsigned length = 0;
+    // if the exponent is negative the number decimal representation is of the form:
+    // [<sign>]0.[<zeros>]<significand>
+    if (m_exponent < 0) {
+        if (m_sign)
+            ++length;
+        length += 2; // for "0."
+        length += -m_exponent - 1;
+        length += m_precision;
+        return length;
+    }
+
+    unsigned digitsBeforeDecimalPoint = m_exponent + 1;
+
+    // If the precision is <= than the number of digits to get up to the decimal
+    // point, then there is no fractional part, number is of the form:
+    // [<sign>]<significand>[<zeros>]
+    if (m_precision <= digitsBeforeDecimalPoint) {
+        if (m_sign)
+            ++length;
+        length += m_precision;
+        length += digitsBeforeDecimalPoint - m_precision;
+        return length;
+    }
+
+    // If we get here, number starts before the decimal point, and ends after it,
+    // as such is of the form:
+    // [<sign>]<significand-begin>.<significand-end>
+    if (m_sign)
+        ++length;
+    length += digitsBeforeDecimalPoint;
+    ++length; // for decimal point
+    length += m_precision - digitsBeforeDecimalPoint;
+
+    return length;
+}
+
+unsigned DecimalNumber::bufferLengthForStringExponential() const
+{
+    unsigned length = 0;
+    if (m_sign)
+        ++length;
+
+    // Add the significand
+    ++length;
+
+    if (m_precision > 1) {
+        ++length; // for decimal point
+        length += m_precision - 1;
+    }
+
+    // Add "e+" or "e-"
+    length += 2;
+
+    int exponent = (m_exponent >= 0) ? m_exponent : -m_exponent;
+
+    // Add the exponent
+    if (exponent >= 100)
+        ++length;
+    if (exponent >= 10)
+        ++length;
+    ++length;
+
+    return length;
+}
+
+unsigned DecimalNumber::toStringDecimal(UChar* buffer, unsigned bufferLength) const
+{
+    ASSERT_UNUSED(bufferLength, bufferLength >= bufferLengthForStringDecimal());
+
+    // Should always be at least one digit to add to the string!
+    ASSERT(m_precision);
+    UChar* next = buffer;
+
+    // if the exponent is negative the number decimal representation is of the form:
+    // [<sign>]0.[<zeros>]<significand>
+    if (m_exponent < 0) {
+        unsigned zeros = -m_exponent - 1;
+
+        if (m_sign)
+            *next++ = '-';
+        *next++ = '0';
+        *next++ = '.';
+        for (unsigned i = 0; i < zeros; ++i)
+            *next++ = '0';
+        for (unsigned i = 0; i < m_precision; ++i)
+            *next++ = m_significand[i];
+
+        return next - buffer;
+    }
+
+    unsigned digitsBeforeDecimalPoint = m_exponent + 1;
+
+    // If the precision is <= than the number of digits to get up to the decimal
+    // point, then there is no fractional part, number is of the form:
+    // [<sign>]<significand>[<zeros>]
+    if (m_precision <= digitsBeforeDecimalPoint) {
+        if (m_sign)
+            *next++ = '-';
+        for (unsigned i = 0; i < m_precision; ++i)
+            *next++ = m_significand[i];
+        for (unsigned i = 0; i < (digitsBeforeDecimalPoint - m_precision); ++i)
+            *next++ = '0';
+
+        return next - buffer;
+    }
+
+    // If we get here, number starts before the decimal point, and ends after it,
+    // as such is of the form:
+    // [<sign>]<significand-begin>.<significand-end>
+
+    if (m_sign)
+        *next++ = '-';
+    for (unsigned i = 0; i < digitsBeforeDecimalPoint; ++i)
+        *next++ = m_significand[i];
+    *next++ = '.';
+    for (unsigned i = digitsBeforeDecimalPoint; i < m_precision; ++i)
+        *next++ = m_significand[i];
+
+    return next - buffer;
+}
+
+unsigned DecimalNumber::toStringExponential(UChar* buffer, unsigned bufferLength) const
+{
+    ASSERT_UNUSED(bufferLength, bufferLength >= bufferLengthForStringExponential());
+
+    // Should always be at least one digit to add to the string!
+    ASSERT(m_precision);
+    UChar* next = buffer;
+
+    // Add the sign
+    if (m_sign)
+        *next++ = '-';
+
+    // Add the significand
+    *next++ = m_significand[0];
+    if (m_precision > 1) {
+        *next++ = '.';
+        for (unsigned i = 1; i < m_precision; ++i)
+            *next++ = m_significand[i];
+    }
+
+    // Add "e+" or "e-"
+    *next++ = 'e';
+    int exponent;
+    if (m_exponent >= 0) {
+        *next++ = '+';
+        exponent = m_exponent;
+    } else {
+        *next++ = '-';
+        exponent = -m_exponent;
+    }
+
+    // Add the exponent
+    if (exponent >= 100)
+        *next++ = '0' + exponent / 100;
+    if (exponent >= 10)
+        *next++ = '0' + (exponent % 100) / 10;
+    *next++ = '0' + exponent % 10;
+
+    return next - buffer;
+}
+
+} // namespace WTF
diff --git a/JavaScriptCore/wtf/DecimalNumber.h b/JavaScriptCore/wtf/DecimalNumber.h
index 3a831b7..c42f00b 100644
--- a/JavaScriptCore/wtf/DecimalNumber.h
+++ b/JavaScriptCore/wtf/DecimalNumber.h
@@ -81,104 +81,16 @@ public:
         ASSERT(m_significand[0] != '0' || !m_exponent);
     }
 
-    unsigned toStringDecimal(NumberToStringBuffer buffer)
-    {
-        // Should always be at least one digit to add to the string!
-        ASSERT(m_precision);
-        UChar* next = buffer;
-
-        // if the exponent is negative the number decimal representation is of the form:
-        // [<sign>]0.[<zeros>]<significand>
-        if (m_exponent < 0) {
-            unsigned zeros = -m_exponent - 1;
-
-            if (m_sign)
-                *next++ = '-';
-            *next++ = '0';
-            *next++ = '.';
-            for (unsigned i = 0; i < zeros; ++i)
-                *next++ = '0';
-            for (unsigned i = 0; i < m_precision; ++i)
-                *next++ = m_significand[i];
-
-            return next - buffer;
-        }
-
-        unsigned digitsBeforeDecimalPoint = m_exponent + 1;
-
-        // If the precision is <= than the number of digits to get up to the decimal
-        // point, then there is no fractional part, number is of the form:
-        // [<sign>]<significand>[<zeros>]
-        if (m_precision <= digitsBeforeDecimalPoint) {
-            if (m_sign)
-                *next++ = '-';
-            for (unsigned i = 0; i < m_precision; ++i)
-                *next++ = m_significand[i];
-            for (unsigned i = 0; i < (digitsBeforeDecimalPoint - m_precision); ++i)
-                *next++ = '0';
-
-            return next - buffer;
-        }
-
-        // If we get here, number starts before the decimal point, and ends after it,
-        // as such is of the form:
-        // [<sign>]<significand-begin>.<significand-end>
-
-        if (m_sign)
-            *next++ = '-';
-        for (unsigned i = 0; i < digitsBeforeDecimalPoint; ++i)
-            *next++ = m_significand[i];
-        *next++ = '.';
-        for (unsigned i = digitsBeforeDecimalPoint; i < m_precision; ++i)
-            *next++ = m_significand[i];
-
-        return next - buffer;
-    }
+    unsigned bufferLengthForStringDecimal() const;
+    unsigned bufferLengthForStringExponential() const;
 
-    unsigned toStringExponential(NumberToStringBuffer buffer)
-    {
-        // Should always be at least one digit to add to the string!
-        ASSERT(m_precision);
-
-        UChar* next = buffer;
-
-        // Add the sign
-        if (m_sign)
-            *next++ = '-';
-
-        // Add the significand
-        *next++ = m_significand[0];
-        if (m_precision > 1) {
-            *next++ = '.';
-            for (unsigned i = 1; i < m_precision; ++i)
-                *next++ = m_significand[i];
-        }
-
-        // Add "e+" or "e-"
-        *next++ = 'e';
-        int exponent;
-        if (m_exponent >= 0) {
-            *next++ = '+';
-            exponent = m_exponent;
-        } else {
-            *next++ = '-';
-            exponent = -m_exponent;
-        }
-
-        // Add the exponent
-        if (exponent >= 100)
-            *next++ = '0' + exponent / 100;
-        if (exponent >= 10)
-            *next++ = '0' + (exponent % 100) / 10;
-        *next++ = '0' + exponent % 10;
-
-        return next - buffer;
-    }
+    unsigned toStringDecimal(UChar* buffer, unsigned bufferLength) const;
+    unsigned toStringExponential(UChar* buffer, unsigned bufferLength) const;
 
-    bool sign() { return m_sign; }
-    int exponent() { return m_exponent; }
-    const char* significand() { return m_significand; } // significand contains precision characters, is not null-terminated.
-    unsigned precision() { return m_precision; }
+    bool sign() const { return m_sign; }
+    int exponent() const { return m_exponent; }
+    const char* significand() const { return m_significand; } // significand contains precision characters, is not null-terminated.
+    unsigned precision() const { return m_precision; }
 
 private:
     bool m_sign;
diff --git a/JavaScriptCore/wtf/FastAllocBase.h b/JavaScriptCore/wtf/FastAllocBase.h
index 81b1de0..bb1825e 100644
--- a/JavaScriptCore/wtf/FastAllocBase.h
+++ b/JavaScriptCore/wtf/FastAllocBase.h
@@ -85,38 +85,41 @@
 
 namespace WTF {
 
-    class FastAllocBase {
-    public:
-        // Placement operator new.
-        void* operator new(size_t, void* p) { return p; }
-        void* operator new[](size_t, void* p) { return p; }
-
-        void* operator new(size_t size)
-        {
-            void* p = fastMalloc(size);
-            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNew);
-            return p;
-        }
-
-        void operator delete(void* p)
-        {
-            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNew);
-            fastFree(p);
-        }
-
-        void* operator new[](size_t size)
-        {
-            void* p = fastMalloc(size);
-            fastMallocMatchValidateMalloc(p, Internal::AllocTypeClassNewArray);
-            return p;
-        }
-
-        void operator delete[](void* p)
-        {
-            fastMallocMatchValidateFree(p, Internal::AllocTypeClassNewArray);
-            fastFree(p);
-        }
-    };
+#define WTF_MAKE_FAST_ALLOCATED \
+public: \
+    void* operator new(size_t, void* p) { return p; } \
+    void* operator new[](size_t, void* p) { return p; } \
+    \
+    void* operator new(size_t size) \
+    { \
+        void* p = ::WTF::fastMalloc(size); \
+         ::WTF::fastMallocMatchValidateMalloc(p, ::WTF::Internal::AllocTypeClassNew); \
+        return p; \
+    } \
+    \
+    void operator delete(void* p) \
+    { \
+        ::WTF::fastMallocMatchValidateFree(p, ::WTF::Internal::AllocTypeClassNew); \
+        ::WTF::fastFree(p); \
+    } \
+    \
+    void* operator new[](size_t size) \
+    { \
+        void* p = ::WTF::fastMalloc(size); \
+        ::WTF::fastMallocMatchValidateMalloc(p, ::WTF::Internal::AllocTypeClassNewArray); \
+        return p; \
+    } \
+    \
+    void operator delete[](void* p) \
+    { \
+         ::WTF::fastMallocMatchValidateFree(p, ::WTF::Internal::AllocTypeClassNewArray); \
+         ::WTF::fastFree(p); \
+    } \
+private:
+
+class FastAllocBase {
+    WTF_MAKE_FAST_ALLOCATED  
+};
 
     // fastNew / fastDelete
 
diff --git a/JavaScriptCore/wtf/FastMalloc.cpp b/JavaScriptCore/wtf/FastMalloc.cpp
index 1e537b9..bbbdaf2 100644
--- a/JavaScriptCore/wtf/FastMalloc.cpp
+++ b/JavaScriptCore/wtf/FastMalloc.cpp
@@ -2185,10 +2185,10 @@ class TCMalloc_ThreadCache {
   // Total byte size in cache
   size_t Size() const { return size_; }
 
-  void* Allocate(size_t size);
+  ALWAYS_INLINE void* Allocate(size_t size);
   void Deallocate(void* ptr, size_t size_class);
 
-  void FetchFromCentralCache(size_t cl, size_t allocationSize);
+  ALWAYS_INLINE void FetchFromCentralCache(size_t cl, size_t allocationSize);
   void ReleaseToCentralCache(size_t cl, int N);
   void Scavenge();
   void Print() const;
@@ -2289,12 +2289,12 @@ class TCMalloc_Central_FreeList {
   // REQUIRES: lock_ is held
   // Release an object to spans.
   // May temporarily release lock_.
-  void ReleaseToSpans(void* object);
+  ALWAYS_INLINE void ReleaseToSpans(void* object);
 
   // REQUIRES: lock_ is held
   // Populate cache by fetching from the page heap.
   // May temporarily release lock_.
-  void Populate();
+  ALWAYS_INLINE void Populate();
 
   // REQUIRES: lock is held.
   // Tries to make room for a TCEntry.  If the cache is full it will try to
@@ -2307,7 +2307,7 @@ class TCMalloc_Central_FreeList {
   // just iterates over the sizeclasses but does so without taking a lock.
   // Returns true on success.
   // May temporarily lock a "random" size class.
-  static bool EvictRandomSizeClass(size_t locked_size_class, bool force);
+  static ALWAYS_INLINE bool EvictRandomSizeClass(size_t locked_size_class, bool force);
 
   // REQUIRES: lock_ is *not* held.
   // Tries to shrink the Cache.  If force is true it will relase objects to
@@ -3705,7 +3705,7 @@ extern "C"
 #define do_malloc do_malloc<crashOnFailure>
 
 template <bool crashOnFailure>
-void* malloc(size_t);
+ALWAYS_INLINE void* malloc(size_t);
 
 void* fastMalloc(size_t size)
 {
@@ -3766,7 +3766,7 @@ void free(void* ptr) {
 extern "C" 
 #else
 template <bool crashOnFailure>
-void* calloc(size_t, size_t);
+ALWAYS_INLINE void* calloc(size_t, size_t);
 
 void* fastCalloc(size_t n, size_t elem_size)
 {
@@ -3830,7 +3830,7 @@ void cfree(void* ptr) {
 extern "C" 
 #else
 template <bool crashOnFailure>
-void* realloc(void*, size_t);
+ALWAYS_INLINE void* realloc(void*, size_t);
 
 void* fastRealloc(void* old_ptr, size_t new_size)
 {
diff --git a/JavaScriptCore/wtf/MD5.cpp b/JavaScriptCore/wtf/MD5.cpp
index 375446e..c926a7b 100644
--- a/JavaScriptCore/wtf/MD5.cpp
+++ b/JavaScriptCore/wtf/MD5.cpp
@@ -76,7 +76,7 @@ static void expectMD5(CString input, CString expected)
         snprintf(buf, 3, "%02x", digest.at(i));
         buf += 2;
     }
-    ASSERT_WITH_MESSAGE(actual == expected, "input:%s[%d] actual:%s expected:%s", input.data(), input.length(), actual.data(), expected.data());
+    ASSERT_WITH_MESSAGE(actual == expected, "input:%s[%lu] actual:%s expected:%s", input.data(), static_cast<unsigned long>(input.length()), actual.data(), expected.data());
 }
 
 static void testMD5()
diff --git a/JavaScriptCore/wtf/Noncopyable.h b/JavaScriptCore/wtf/Noncopyable.h
index 898c1ba..285ed2e 100644
--- a/JavaScriptCore/wtf/Noncopyable.h
+++ b/JavaScriptCore/wtf/Noncopyable.h
@@ -1,5 +1,5 @@
 /*
- *  Copyright (C) 2006 Apple Computer, Inc.
+ *  Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
diff --git a/JavaScriptCore/wtf/NullPtr.h b/JavaScriptCore/wtf/NullPtr.h
new file mode 100644
index 0000000..10a5814
--- /dev/null
+++ b/JavaScriptCore/wtf/NullPtr.h
@@ -0,0 +1,48 @@
+/*
+
+Copyright (C) 2010 Apple Inc. All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions
+are met:
+1.  Redistributions of source code must retain the above copyright
+    notice, this list of conditions and the following disclaimer.
+2.  Redistributions in binary form must reproduce the above copyright
+    notice, this list of conditions and the following disclaimer in the
+    documentation and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+*/
+
+#ifndef NullPtr_h
+#define NullPtr_h
+
+// For compilers and standard libraries that do not yet include it, this adds the
+// nullptr_t type and nullptr object. They are defined in the same namespaces they
+// would be in compiler and library that had the support.
+
+#ifndef __has_feature
+    #define __has_feature(feature) 0
+#endif
+
+#if !__has_feature(cxx_nullptr)
+
+namespace std {
+    class nullptr_t { };
+}
+
+extern std::nullptr_t nullptr;
+
+#endif
+
+#endif
diff --git a/JavaScriptCore/wtf/OwnArrayPtr.h b/JavaScriptCore/wtf/OwnArrayPtr.h
index ce056b3..643b90b 100644
--- a/JavaScriptCore/wtf/OwnArrayPtr.h
+++ b/JavaScriptCore/wtf/OwnArrayPtr.h
@@ -23,6 +23,7 @@
 
 #include "Assertions.h"
 #include "Noncopyable.h"
+#include "NullPtr.h"
 #include "OwnArrayPtrCommon.h"
 #include <algorithm>
 
@@ -73,6 +74,7 @@ public:
 #endif
 
     OwnArrayPtr& operator=(const PassOwnArrayPtr<T>&);
+    OwnArrayPtr& operator=(std::nullptr_t) { clear(); return *this; }
     template<typename U> OwnArrayPtr& operator=(const PassOwnArrayPtr<U>&);
 
     void swap(OwnArrayPtr& o) { std::swap(m_ptr, o.m_ptr); }
diff --git a/JavaScriptCore/wtf/OwnPtr.h b/JavaScriptCore/wtf/OwnPtr.h
index cadfad2..cdc277c 100644
--- a/JavaScriptCore/wtf/OwnPtr.h
+++ b/JavaScriptCore/wtf/OwnPtr.h
@@ -23,6 +23,7 @@
 
 #include "Assertions.h"
 #include "Noncopyable.h"
+#include "NullPtr.h"
 #include "OwnPtrCommon.h"
 #include "TypeTraits.h"
 #include <algorithm>
@@ -72,6 +73,7 @@ namespace WTF {
         operator UnspecifiedBoolType() const { return m_ptr ? &OwnPtr::m_ptr : 0; }
 
         OwnPtr& operator=(const PassOwnPtr<T>&);
+        OwnPtr& operator=(std::nullptr_t) { clear(); return *this; }
         template<typename U> OwnPtr& operator=(const PassOwnPtr<U>&);
 
         void swap(OwnPtr& o) { std::swap(m_ptr, o.m_ptr); }
diff --git a/JavaScriptCore/wtf/PassOwnArrayPtr.h b/JavaScriptCore/wtf/PassOwnArrayPtr.h
index 597339c..6a55491 100644
--- a/JavaScriptCore/wtf/PassOwnArrayPtr.h
+++ b/JavaScriptCore/wtf/PassOwnArrayPtr.h
@@ -27,6 +27,7 @@
 #define WTF_PassOwnArrayPtr_h
 
 #include "Assertions.h"
+#include "NullPtr.h"
 #include "OwnArrayPtrCommon.h"
 #include "TypeTraits.h"
 
@@ -72,6 +73,7 @@ public:
 #endif
 
     PassOwnArrayPtr& operator=(const PassOwnArrayPtr<T>&);
+    PassOwnArrayPtr& operator=(std::nullptr_t) { clear(); return *this; }
     template<typename U> PassOwnArrayPtr& operator=(const PassOwnArrayPtr<U>&);
 
     template<typename U> friend PassOwnArrayPtr<U> adoptArrayPtr(U*);
diff --git a/JavaScriptCore/wtf/PassOwnPtr.h b/JavaScriptCore/wtf/PassOwnPtr.h
index a223fa9..60453fc 100644
--- a/JavaScriptCore/wtf/PassOwnPtr.h
+++ b/JavaScriptCore/wtf/PassOwnPtr.h
@@ -27,6 +27,7 @@
 #define WTF_PassOwnPtr_h
 
 #include "Assertions.h"
+#include "NullPtr.h"
 #include "OwnPtrCommon.h"
 #include "TypeTraits.h"
 
@@ -71,6 +72,7 @@ namespace WTF {
         operator UnspecifiedBoolType() const { return m_ptr ? &PassOwnPtr::m_ptr : 0; }
 
         PassOwnPtr& operator=(const PassOwnPtr<T>&);
+        PassOwnPtr& operator=(std::nullptr_t) { clear(); return *this; }
         template<typename U> PassOwnPtr& operator=(const PassOwnPtr<U>&);
 
         template<typename U> friend PassOwnPtr<U> adoptPtr(U*);
diff --git a/JavaScriptCore/wtf/PassRefPtr.h b/JavaScriptCore/wtf/PassRefPtr.h
index 052d6e2..b179cef 100644
--- a/JavaScriptCore/wtf/PassRefPtr.h
+++ b/JavaScriptCore/wtf/PassRefPtr.h
@@ -22,6 +22,7 @@
 #define WTF_PassRefPtr_h
 
 #include "AlwaysInline.h"
+#include "NullPtr.h"
 
 namespace WTF {
 
@@ -90,6 +91,7 @@ namespace WTF {
 
         PassRefPtr& operator=(T*);
         PassRefPtr& operator=(const PassRefPtr&);
+        PassRefPtr& operator=(std::nullptr_t) { clear(); return *this; }
         template<typename U> PassRefPtr& operator=(const PassRefPtr<U>&);
         template<typename U> PassRefPtr& operator=(const RefPtr<U>&);
 
diff --git a/JavaScriptCore/wtf/Platform.h b/JavaScriptCore/wtf/Platform.h
index 1843bea..9895824 100644
--- a/JavaScriptCore/wtf/Platform.h
+++ b/JavaScriptCore/wtf/Platform.h
@@ -398,7 +398,7 @@
 
 /* OS(NETBSD) - NetBSD */
 #if defined(__NetBSD__)
-#define WTF_PLATFORM_NETBSD 1
+#define WTF_OS_NETBSD 1
 #endif
 
 /* OS(OPENBSD) - OpenBSD */
@@ -574,6 +574,8 @@
 #define WTF_USE_QT4_UNICODE 1
 #elif OS(WINCE)
 #define WTF_USE_WINCE_UNICODE 1
+#elif PLATFORM(BREWMP)
+#define WTF_USE_BREWMP_UNICODE 1
 #elif PLATFORM(GTK)
 /* The GTK+ Unicode backend is configurable */
 #else
@@ -692,6 +694,10 @@
 #define USE_SYSTEM_MALLOC 1
 #endif
 
+#if PLATFORM(BREWMP_SIMULATOR)
+#define ENABLE_JIT 0
+#endif
+
 #if !defined(HAVE_ACCESSIBILITY)
 #if PLATFORM(IOS) || PLATFORM(MAC) || PLATFORM(WIN) || PLATFORM(GTK) || PLATFORM(CHROMIUM)
 #define HAVE_ACCESSIBILITY 1
@@ -934,19 +940,17 @@
 #define ENABLE_FULLSCREEN_API 0
 #endif
 
-#if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64)
+#if !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32_64)
 #if (CPU(X86_64) && (OS(UNIX) || OS(WINDOWS))) \
     || (CPU(IA64) && !CPU(IA64_32)) \
     || CPU(ALPHA) \
     || CPU(SPARC64) \
     || CPU(PPC64)
 #define WTF_USE_JSVALUE64 1
-#elif CPU(ARM_TRADITIONAL) && COMPILER(MSVC)
-#define WTF_USE_JSVALUE32 1
 #else
 #define WTF_USE_JSVALUE32_64 1
 #endif
-#endif /* !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32) && !defined(WTF_USE_JSVALUE32_64) */
+#endif /* !defined(WTF_USE_JSVALUE64) && !defined(WTF_USE_JSVALUE32_64) */
 
 #if !defined(ENABLE_REPAINT_THROTTLING)
 #define ENABLE_REPAINT_THROTTLING 0
@@ -986,10 +990,6 @@
     #endif
     #endif
 
-    #if !defined(ENABLE_JIT_OPTIMIZE_NATIVE_CALL) && CPU(X86) && USE(JSVALUE32)
-    #define ENABLE_JIT_OPTIMIZE_NATIVE_CALL 0
-    #endif
-
     #ifndef ENABLE_JIT_OPTIMIZE_CALL
     #define ENABLE_JIT_OPTIMIZE_CALL 1
     #endif
diff --git a/JavaScriptCore/wtf/RandomNumber.cpp b/JavaScriptCore/wtf/RandomNumber.cpp
index b20652b..7a9b6a8 100644
--- a/JavaScriptCore/wtf/RandomNumber.cpp
+++ b/JavaScriptCore/wtf/RandomNumber.cpp
@@ -44,6 +44,8 @@ extern "C" {
 #include <AEEAppGen.h>
 #include <AEESource.h>
 #include <AEEStdLib.h>
+#include <wtf/brew/RefPtrBrew.h>
+#include <wtf/brew/ShellBrew.h>
 #endif
 
 namespace WTF {
@@ -97,12 +99,8 @@ double randomNumber()
     return static_cast<double>(fullRandom)/static_cast<double>(1LL << 53);
 #elif PLATFORM(BREWMP)
     uint32_t bits;
-    ISource* randomSource;
-
-    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
-    ISHELL_CreateInstance(shell, AEECLSID_RANDOM, reinterpret_cast<void**>(&randomSource));
-    ISOURCE_Read(randomSource, reinterpret_cast<char*>(&bits), 4);
-    ISOURCE_Release(randomSource);
+    PlatformRefPtr<ISource> randomSource = createRefPtrInstance<ISource>(AEECLSID_RANDOM);
+    ISOURCE_Read(randomSource.get(), reinterpret_cast<char*>(&bits), 4);
 
     return static_cast<double>(bits) / (static_cast<double>(std::numeric_limits<uint32_t>::max()) + 1.0);
 #else
diff --git a/JavaScriptCore/wtf/RandomNumberSeed.h b/JavaScriptCore/wtf/RandomNumberSeed.h
index ae414c0..1f1c00e 100644
--- a/JavaScriptCore/wtf/RandomNumberSeed.h
+++ b/JavaScriptCore/wtf/RandomNumberSeed.h
@@ -64,6 +64,8 @@ inline void initializeRandomNumberGenerator()
     init_by_array(initializationBuffer, 4);
 #elif COMPILER(MSVC) && defined(_CRT_RAND_S)
     // On Windows we use rand_s which initialises itself
+#elif PLATFORM(BREWMP)
+    // On Brew MP we use AEECLSID_RANDOM which initialises itself
 #elif OS(UNIX)
     // srandomdev is not guaranteed to exist on linux so we use this poor seed, this should be improved
     timeval time;
diff --git a/JavaScriptCore/wtf/RefPtr.h b/JavaScriptCore/wtf/RefPtr.h
index 8bd1ac3..6afa886 100644
--- a/JavaScriptCore/wtf/RefPtr.h
+++ b/JavaScriptCore/wtf/RefPtr.h
@@ -24,7 +24,6 @@
 #define WTF_RefPtr_h
 
 #include <algorithm>
-#include "AlwaysInline.h"
 #include "FastAllocBase.h"
 #include "PassRefPtr.h"
 
@@ -75,6 +74,7 @@ namespace WTF {
         RefPtr& operator=(T*);
         RefPtr& operator=(const PassRefPtr<T>&);
         RefPtr& operator=(const NonNullPassRefPtr<T>&);
+        RefPtr& operator=(std::nullptr_t) { clear(); return *this; }
         template<typename U> RefPtr& operator=(const RefPtr<U>&);
         template<typename U> RefPtr& operator=(const PassRefPtr<U>&);
         template<typename U> RefPtr& operator=(const NonNullPassRefPtr<U>&);
diff --git a/JavaScriptCore/wtf/RetainPtr.h b/JavaScriptCore/wtf/RetainPtr.h
index 68b5a04..8a14cfe 100644
--- a/JavaScriptCore/wtf/RetainPtr.h
+++ b/JavaScriptCore/wtf/RetainPtr.h
@@ -22,6 +22,7 @@
 #define RetainPtr_h
 
 #include "HashTraits.h"
+#include "NullPtr.h"
 #include "TypeTraits.h"
 #include <algorithm>
 #include <CoreFoundation/CoreFoundation.h>
@@ -86,6 +87,7 @@ namespace WTF {
         template<typename U> RetainPtr& operator=(const RetainPtr<U>&);
         RetainPtr& operator=(PtrType);
         template<typename U> RetainPtr& operator=(U*);
+        RetainPtr& operator=(std::nullptr_t) { clear(); return *this; }
 
         void adoptCF(PtrType);
         void adoptNS(PtrType);
diff --git a/JavaScriptCore/wtf/StringHashFunctions.h b/JavaScriptCore/wtf/StringHasher.h
index 3ad7701..63ce74f 100644
--- a/JavaScriptCore/wtf/StringHashFunctions.h
+++ b/JavaScriptCore/wtf/StringHasher.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  *
  */
-#ifndef WTF_StringHashFunctions_h
-#define WTF_StringHashFunctions_h
+#ifndef WTF_StringHasher_h
+#define WTF_StringHasher_h
 
 #include <wtf/unicode/Unicode.h>
 
@@ -167,4 +167,4 @@ private:
 
 } // namespace WTF
 
-#endif // WTF_StringHashFunctions_h
+#endif // WTF_StringHasher_h
diff --git a/JavaScriptCore/wtf/TCSpinLock.h b/JavaScriptCore/wtf/TCSpinLock.h
index 240b497..81b7d0c 100644
--- a/JavaScriptCore/wtf/TCSpinLock.h
+++ b/JavaScriptCore/wtf/TCSpinLock.h
@@ -38,8 +38,6 @@
 
 #include <time.h>       /* For nanosleep() */
 
-#include <sched.h>      /* For sched_yield() */
-
 #if HAVE(STDINT_H)
 #include <stdint.h>
 #elif HAVE(INTTYPES_H)
@@ -53,6 +51,8 @@
 #define WIN32_LEAN_AND_MEAN
 #endif
 #include <windows.h>
+#else
+#include <sched.h>      /* For sched_yield() */
 #endif
 
 static void TCMalloc_SlowLock(volatile unsigned int* lockword);
@@ -135,7 +135,12 @@ struct TCMalloc_SpinLock {
 #define SPINLOCK_INITIALIZER { 0 }
 
 static void TCMalloc_SlowLock(volatile unsigned int* lockword) {
-  sched_yield();        // Yield immediately since fast path failed
+// Yield immediately since fast path failed
+#if OS(WINDOWS)
+  Sleep(0);
+#else
+  sched_yield();
+#endif
   while (true) {
     int r;
 #if COMPILER(GCC)
diff --git a/JavaScriptCore/wtf/TypeTraits.cpp b/JavaScriptCore/wtf/TypeTraits.cpp
index a55019b..afeaa5e 100644
--- a/JavaScriptCore/wtf/TypeTraits.cpp
+++ b/JavaScriptCore/wtf/TypeTraits.cpp
@@ -136,4 +136,7 @@ COMPILE_ASSERT((IsSameType<int, RemovePointer<int>::Type>::value), WTF_Test_Remo
 COMPILE_ASSERT((IsSameType<int, RemovePointer<int*>::Type>::value), WTF_Test_RemovePointer_int_pointer);
 COMPILE_ASSERT((!IsSameType<int, RemovePointer<int**>::Type>::value), WTF_Test_RemovePointer_int_pointer_pointer);
 
+COMPILE_ASSERT((IsSameType<int, RemoveReference<int>::Type>::value), WTF_Test_RemoveReference_int);
+COMPILE_ASSERT((IsSameType<int, RemoveReference<int&>::Type>::value), WTF_Test_RemoveReference_int_reference);
+
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/TypeTraits.h b/JavaScriptCore/wtf/TypeTraits.h
index cf9b4af..44103cd 100644
--- a/JavaScriptCore/wtf/TypeTraits.h
+++ b/JavaScriptCore/wtf/TypeTraits.h
@@ -39,6 +39,7 @@ namespace WTF {
     //   IsSameType<T, U>::value
     //
     //   RemovePointer<T>::Type
+    //   RemoveReference<T>::Type
     //   RemoveConst<T>::Type
     //   RemoveVolatile<T>::Type
     //   RemoveConstVolatile<T>::Type
@@ -170,6 +171,14 @@ namespace WTF {
         typedef T Type;
     };
 
+    template <typename T> struct RemoveReference {
+        typedef T Type;
+    };
+
+    template <typename T> struct RemoveReference<T&> {
+        typedef T Type;
+    };
+
 #if (defined(__GLIBCXX__) && (__GLIBCXX__ >= 20070724) && defined(__GXX_EXPERIMENTAL_CXX0X__)) || (defined(_MSC_VER) && (_MSC_VER >= 1600))
 
     // GCC's libstdc++ 20070724 and later supports C++ TR1 type_traits in the std namespace.
diff --git a/JavaScriptCore/wtf/WTFThreadData.h b/JavaScriptCore/wtf/WTFThreadData.h
index 7f91e1a..5019c33 100644
--- a/JavaScriptCore/wtf/WTFThreadData.h
+++ b/JavaScriptCore/wtf/WTFThreadData.h
@@ -95,12 +95,6 @@ public:
     }
 
 #if USE(JSC)
-    void initializeIdentifierTable(JSC::IdentifierTable* identifierTable)
-    {
-        m_defaultIdentifierTable = identifierTable;
-        m_currentIdentifierTable = identifierTable;
-    }
-
     JSC::IdentifierTable* currentIdentifierTable()
     {
         return m_currentIdentifierTable;
diff --git a/JavaScriptCore/wtf/brew/RefPtrBrew.h b/JavaScriptCore/wtf/brew/RefPtrBrew.h
new file mode 100644
index 0000000..7fb0b7c
--- /dev/null
+++ b/JavaScriptCore/wtf/brew/RefPtrBrew.h
@@ -0,0 +1,53 @@
+/*
+ *  Copyright (C) 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ *  Copyright (C) 2008 Collabora Ltd.
+ *  Copyright (C) 2009 Martin Robinson
+ *  Copyright (C) 2010 Company 100, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef RefPtrBrew_h
+#define RefPtrBrew_h
+
+#include "AlwaysInline.h"
+#include "PlatformRefPtr.h"
+#include <AEEIBase.h>
+#include <algorithm>
+
+namespace WTF {
+
+// All Brew MP classes are derived from either IBase or IQI.
+// Technically, IBase and IQI are different types. However, it is
+// okay to cast both types to IBase because they have AddRef and Release
+// in the same method vtable slots.
+template <typename T> inline T* refPlatformPtr(T* ptr)
+{
+    if (ptr)
+        IBase_AddRef(reinterpret_cast<IBase*>(ptr));
+    return ptr;
+}
+
+template <typename T> inline void derefPlatformPtr(T* ptr)
+{
+    if (ptr)
+        IBase_Release(reinterpret_cast<IBase*>(ptr));
+}
+
+} // namespace WTF
+
+#endif // RefPtrBrew_h
diff --git a/JavaScriptCore/wtf/brew/ShellBrew.h b/JavaScriptCore/wtf/brew/ShellBrew.h
index 7416eca..faccc75 100644
--- a/JavaScriptCore/wtf/brew/ShellBrew.h
+++ b/JavaScriptCore/wtf/brew/ShellBrew.h
@@ -34,6 +34,7 @@
 
 #include <wtf/Assertions.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/PlatformRefPtr.h>
 
 namespace WTF {
 
@@ -49,8 +50,21 @@ static inline PassOwnPtr<T> createInstance(AEECLSID cls)
     return instance;
 }
 
+template <typename T>
+static inline PlatformRefPtr<T> createRefPtrInstance(AEECLSID cls)
+{
+    T* instance = 0;
+
+    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
+    ISHELL_CreateInstance(shell, cls, reinterpret_cast<void**>(&instance));
+    ASSERT(instance);
+
+    return adoptPlatformRef(instance);
+}
+
 } // namespace WTF
 
 using WTF::createInstance;
+using WTF::createRefPtrInstance;
 
 #endif // ShellBrew_h
diff --git a/JavaScriptCore/wtf/dtoa.cpp b/JavaScriptCore/wtf/dtoa.cpp
index 298bb27..c89c036 100644
--- a/JavaScriptCore/wtf/dtoa.cpp
+++ b/JavaScriptCore/wtf/dtoa.cpp
@@ -1824,8 +1824,8 @@ unsigned numberToString(double d, NumberToStringBuffer buffer)
     // Convert to decimal with rounding.
     DecimalNumber number(d);
     return number.exponent() >= -6 && number.exponent() < 21
-        ? number.toStringDecimal(buffer)
-        : number.toStringExponential(buffer);
+        ? number.toStringDecimal(buffer, NumberToStringBufferLength)
+        : number.toStringExponential(buffer, NumberToStringBufferLength);
 }
 
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/dtoa.h b/JavaScriptCore/wtf/dtoa.h
index 7e4fc41..3924a1c 100644
--- a/JavaScriptCore/wtf/dtoa.h
+++ b/JavaScriptCore/wtf/dtoa.h
@@ -39,7 +39,8 @@ void dtoaRoundSF(DtoaBuffer result, double dd, int ndigits, bool& sign, int& exp
 void dtoaRoundDP(DtoaBuffer result, double dd, int ndigits, bool& sign, int& exponent, unsigned& precision);
 
 // Size = 80 for sizeof(DtoaBuffer) + some sign bits, decimal point, 'e', exponent digits.
-typedef UChar NumberToStringBuffer[96];
+const unsigned NumberToStringBufferLength = 96;
+typedef UChar NumberToStringBuffer[NumberToStringBufferLength];
 unsigned numberToString(double, NumberToStringBuffer);
 
 } // namespace WTF
diff --git a/JavaScriptCore/wtf/text/CString.cpp b/JavaScriptCore/wtf/text/CString.cpp
index 7d09f12..c048a1b 100644
--- a/JavaScriptCore/wtf/text/CString.cpp
+++ b/JavaScriptCore/wtf/text/CString.cpp
@@ -36,12 +36,12 @@ CString::CString(const char* str)
     init(str, strlen(str));
 }
 
-CString::CString(const char* str, unsigned length)
+CString::CString(const char* str, size_t length)
 {
     init(str, length);
 }
 
-void CString::init(const char* str, unsigned length)
+void CString::init(const char* str, size_t length)
 {
     if (!str)
         return;
diff --git a/JavaScriptCore/wtf/text/CString.h b/JavaScriptCore/wtf/text/CString.h
index d8250c5..343a7a5 100644
--- a/JavaScriptCore/wtf/text/CString.h
+++ b/JavaScriptCore/wtf/text/CString.h
@@ -40,8 +40,8 @@ public:
 private:
     friend class CString;
 
-    static PassRefPtr<CStringBuffer> create(unsigned length) { return adoptRef(new CStringBuffer(length)); }
-    CStringBuffer(unsigned length) : m_vector(length) { }
+    static PassRefPtr<CStringBuffer> create(size_t length) { return adoptRef(new CStringBuffer(length)); }
+    CStringBuffer(size_t length) : m_vector(length) { }
     char* mutableData() { return m_vector.data(); }
 
     Vector<char> m_vector;
@@ -53,7 +53,7 @@ class CString {
 public:
     CString() { }
     CString(const char*);
-    CString(const char*, unsigned length);
+    CString(const char*, size_t length);
     CString(CStringBuffer* buffer) : m_buffer(buffer) { }
     static CString newUninitialized(size_t length, char*& characterBuffer);
 
@@ -62,7 +62,7 @@ public:
         return m_buffer ? m_buffer->data() : 0;
     }
     char* mutableData();
-    unsigned length() const
+    size_t length() const
     {
         return m_buffer ? m_buffer->length() - 1 : 0;
     }
@@ -73,7 +73,7 @@ public:
 
 private:
     void copyBufferIfNeeded();
-    void init(const char*, unsigned length);
+    void init(const char*, size_t length);
     RefPtr<CStringBuffer> m_buffer;
 };
 
diff --git a/JavaScriptCore/wtf/text/StringBuffer.h b/JavaScriptCore/wtf/text/StringBuffer.h
index c29dd79..a546bf3 100644
--- a/JavaScriptCore/wtf/text/StringBuffer.h
+++ b/JavaScriptCore/wtf/text/StringBuffer.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -32,6 +32,7 @@
 #include <wtf/Assertions.h>
 #include <wtf/Noncopyable.h>
 #include <wtf/unicode/Unicode.h>
+#include <limits>
 
 namespace WTF {
 
@@ -39,9 +40,12 @@ class StringBuffer : public Noncopyable {
 public:
     explicit StringBuffer(unsigned length)
         : m_length(length)
-        , m_data(static_cast<UChar*>(fastMalloc(length * sizeof(UChar))))
     {
+        if (m_length > std::numeric_limits<unsigned>::max() / sizeof(UChar))
+            CRASH();
+        m_data = static_cast<UChar*>(fastMalloc(m_length * sizeof(UChar)));
     }
+
     ~StringBuffer()
     {
         fastFree(m_data);
@@ -55,8 +59,11 @@ public:
 
     void resize(unsigned newLength)
     {
-        if (newLength > m_length)
+        if (newLength > m_length) {
+            if (newLength > std::numeric_limits<unsigned>::max() / sizeof(UChar))
+                CRASH();
             m_data = static_cast<UChar*>(fastRealloc(m_data, newLength * sizeof(UChar)));
+        }
         m_length = newLength;
     }
 
@@ -72,8 +79,8 @@ private:
     UChar* m_data;
 };
 
-}
+} // namespace WTF
 
 using WTF::StringBuffer;
 
-#endif
+#endif // StringBuffer_h
diff --git a/JavaScriptCore/wtf/text/StringBuilder.cpp b/JavaScriptCore/wtf/text/StringBuilder.cpp
new file mode 100644
index 0000000..dfc9ff3
--- /dev/null
+++ b/JavaScriptCore/wtf/text/StringBuilder.cpp
@@ -0,0 +1,172 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "StringBuilder.h"
+
+#include "WTFString.h"
+
+namespace WTF {
+
+void StringBuilder::reifyString()
+{
+    // Check if the string already exists.
+    if (!m_string.isNull()) {
+        ASSERT(m_string.length() == m_length);
+        return;
+    }
+
+    // Check for empty.
+    if (!m_length) {
+        m_string = StringImpl::empty();
+        return;
+    }
+
+    // Must be valid in the buffer, take a substring (unless string fills the buffer).
+    ASSERT(m_buffer && m_length <= m_buffer->length());
+    m_string = (m_length == m_buffer->length())
+        ? m_buffer.get()
+        : StringImpl::create(m_buffer, 0, m_length);
+}
+
+void StringBuilder::resize(unsigned newSize)
+{
+    // Check newSize < m_length, hence m_length > 0.
+    ASSERT(newSize <= m_length);
+    if (newSize == m_length)
+        return;
+    ASSERT(m_length);
+
+    // If there is a buffer, we only need to duplicate it if it has more than one ref.
+    if (m_buffer) {
+        if (!m_buffer->hasOneRef())
+            allocateBuffer(m_buffer->characters(), m_buffer->length());
+        m_length = newSize;
+        m_string = String();
+        return;
+    }
+
+    // Since m_length && !m_buffer, the string must be valid in m_string, and m_string.length() > 0.
+    ASSERT(!m_string.isEmpty());
+    ASSERT(m_length == m_string.length());
+    ASSERT(newSize < m_string.length());
+    m_length = newSize;
+    m_string = StringImpl::create(m_string.impl(), 0, newSize);
+}
+
+void StringBuilder::reserveCapacity(unsigned newCapacity)
+{
+    if (m_buffer) {
+        // If there is already a buffer, then grow if necessary.
+        if (newCapacity > m_buffer->length())
+            allocateBuffer(m_buffer->characters(), newCapacity);
+    } else {
+        // Grow the string, if necessary.
+        if (newCapacity > m_length)
+            allocateBuffer(m_string.characters(), newCapacity);
+    }
+}
+
+// Allocate a new buffer, copying in currentCharacters (these may come from either m_string
+// or m_buffer,  neither will be reassigned until the copy has completed).
+void StringBuilder::allocateBuffer(const UChar* currentCharacters, unsigned requiredLength)
+{
+    // Copy the existing data into a new buffer, set result to point to the end of the existing data.
+    RefPtr<StringImpl> buffer = StringImpl::createUninitialized(requiredLength, m_bufferCharacters);
+    memcpy(m_bufferCharacters, currentCharacters, static_cast<size_t>(m_length) * sizeof(UChar)); // This can't overflow.
+
+    // Update the builder state.
+    m_buffer = buffer.release();
+    m_string = String();
+}
+
+// Make 'length' additional capacity be available in m_buffer, update m_string & m_length,
+// return a pointer to the newly allocated storage.
+UChar* StringBuilder::appendUninitialized(unsigned length)
+{
+    ASSERT(length);
+
+    // Calcuate the new size of the builder after appending.
+    unsigned requiredLength = length + m_length;
+    if (requiredLength < length)
+        CRASH();
+
+    if (m_buffer) {
+        // If the buffer is valid it must be at least as long as the current builder contents!
+        ASSERT(m_buffer->length() >= m_length);
+
+        // Check if the buffer already has sufficient capacity.
+        if (requiredLength <= m_buffer->length()) {
+            unsigned currentLength = m_length;
+            m_string = String();
+            m_length = requiredLength;
+            return m_bufferCharacters + currentLength;
+        }
+
+        // We need to realloc the buffer.
+        allocateBuffer(m_buffer->characters(), std::max(requiredLength, m_buffer->length() * 2));
+    } else {
+        ASSERT(m_string.length() == m_length);
+        allocateBuffer(m_string.characters(), std::max(requiredLength, requiredLength * 2));
+    }
+
+    UChar* result = m_bufferCharacters + m_length;
+    m_length = requiredLength;
+    return result;
+}
+
+void StringBuilder::append(const UChar* characters, unsigned length)
+{
+    if (!length)
+        return;
+    ASSERT(characters);
+
+    memcpy(appendUninitialized(length), characters, static_cast<size_t>(length) * 2);
+}
+
+void StringBuilder::append(const char* characters, unsigned length)
+{
+    if (!length)
+        return;
+    ASSERT(characters);
+
+    UChar* dest = appendUninitialized(length);
+    const char* end = characters + length;
+    while (characters < end)
+        *(dest++) = *(const unsigned char*)(characters++);
+}
+
+void StringBuilder::shrinkToFit()
+{
+    // If the buffer is at least 80% full, don't bother copying. Need to tune this heuristic!
+    if (m_buffer && m_buffer->length() > (m_length + (m_length >> 2))) {
+        UChar* result;
+        m_string = StringImpl::createUninitialized(m_length, result);
+        memcpy(result, m_buffer->characters(), static_cast<size_t>(m_length) * 2); // This can't overflow.
+        m_buffer = 0;
+    }
+}
+
+} // namespace WTF
diff --git a/JavaScriptCore/wtf/text/StringBuilder.h b/JavaScriptCore/wtf/text/StringBuilder.h
new file mode 100644
index 0000000..f10af64
--- /dev/null
+++ b/JavaScriptCore/wtf/text/StringBuilder.h
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef StringBuilder_h
+#define StringBuilder_h
+
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WTF {
+
+class StringBuilder {
+public:
+    StringBuilder()
+        : m_length(0)
+    {
+    }
+
+    void append(const UChar*, unsigned);
+    void append(const char*, unsigned);
+
+    void append(const String& string)
+    {
+        // If we're appending to an empty string, and there is not buffer
+        // (in case reserveCapacity has been called) then just retain the
+        // string.
+        if (!m_length && !m_buffer) {
+            m_string = string;
+            m_length = string.length();
+            return;
+        }
+        append(string.characters(), string.length());
+    }
+
+    void append(const char* characters)
+    {
+        if (characters)
+            append(characters, strlen(characters));
+    }
+
+    void append(UChar c)
+    {
+        if (m_buffer && m_length < m_buffer->length() && m_string.isNull())
+            m_bufferCharacters[m_length++] = c;
+        else
+            append(&c, 1);
+    }
+
+    void append(char c)
+    {
+        if (m_buffer && m_length < m_buffer->length() && m_string.isNull())
+            m_bufferCharacters[m_length++] = (unsigned char)c;
+        else
+            append(&c, 1);
+    }
+
+    String toString()
+    {
+        if (m_string.isNull()) {
+            shrinkToFit();
+            reifyString();
+        }
+        return m_string;
+    }
+
+    String toStringPreserveCapacity()
+    {
+        if (m_string.isNull())
+            reifyString();
+        return m_string;
+    }
+
+    unsigned length() const
+    {
+        return m_length;
+    }
+
+    bool isEmpty() const { return !length(); }
+
+    void reserveCapacity(unsigned newCapacity);
+
+    void resize(unsigned newSize);
+
+    void shrinkToFit();
+
+    UChar operator[](unsigned i) const
+    {
+        ASSERT(i < m_length);
+        if (!m_string.isNull())
+            return m_string[i];
+        ASSERT(m_buffer);
+        return m_buffer->characters()[i];
+    }
+
+    void clear()
+    {
+        m_length = 0;
+        m_string = String();
+        m_buffer = 0;
+    }
+
+private:
+    void allocateBuffer(const UChar* currentCharacters, unsigned requiredLength);
+    UChar* appendUninitialized(unsigned length);
+    void reifyString();
+
+    unsigned m_length;
+    String m_string;
+    RefPtr<StringImpl> m_buffer;
+    UChar* m_bufferCharacters;
+};
+
+} // namespace WTF
+
+using WTF::StringBuilder;
+
+#endif // StringBuilder_h
diff --git a/JavaScriptCore/runtime/StringConcatenate.h b/JavaScriptCore/wtf/text/StringConcatenate.h
index 18a52ef..b54a108 100644
--- a/JavaScriptCore/runtime/StringConcatenate.h
+++ b/JavaScriptCore/wtf/text/StringConcatenate.h
@@ -26,15 +26,45 @@
 #ifndef StringConcatenate_h
 #define StringConcatenate_h
 
-#include "UString.h"
+#include <wtf/text/WTFString.h>
 
-namespace JSC {
+namespace WTF {
 
 template<typename StringType>
 class StringTypeAdapter {
 };
 
 template<>
+class StringTypeAdapter<char> {
+public:
+    StringTypeAdapter<char>(char buffer)
+        : m_buffer(buffer)
+    {
+    }
+
+    unsigned length() { return 1; }
+    void writeTo(UChar* destination) { *destination = m_buffer; }
+
+private:
+    unsigned char m_buffer;
+};
+
+template<>
+class StringTypeAdapter<UChar> {
+public:
+    StringTypeAdapter<UChar>(UChar buffer)
+        : m_buffer(buffer)
+    {
+    }
+
+    unsigned length() { return 1; }
+    void writeTo(UChar* destination) { *destination = m_buffer; }
+
+private:
+    UChar m_buffer;
+};
+
+template<>
 class StringTypeAdapter<char*> {
 public:
     StringTypeAdapter<char*>(char* buffer)
@@ -79,9 +109,9 @@ private:
 };
 
 template<>
-class StringTypeAdapter<UString> {
+class StringTypeAdapter<String> {
 public:
-    StringTypeAdapter<UString>(UString& string)
+    StringTypeAdapter<String>(String& string)
         : m_data(string.characters())
         , m_length(string.length())
     {
@@ -360,8 +390,15 @@ PassRefPtr<StringImpl> tryMakeString(StringType1 string1, StringType2 string2, S
     return resultImpl;
 }
 
+// Convenience only.
+template<typename StringType1>
+String makeString(StringType1 string1)
+{
+    return String(string1);
+}
+
 template<typename StringType1, typename StringType2>
-UString makeString(StringType1 string1, StringType2 string2)
+String makeString(StringType1 string1, StringType2 string2)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2);
     if (!resultImpl)
@@ -370,7 +407,7 @@ UString makeString(StringType1 string1, StringType2 string2)
 }
 
 template<typename StringType1, typename StringType2, typename StringType3>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3);
     if (!resultImpl)
@@ -379,7 +416,7 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4);
     if (!resultImpl)
@@ -388,7 +425,7 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5);
     if (!resultImpl)
@@ -397,7 +434,7 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6);
     if (!resultImpl)
@@ -406,7 +443,7 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7);
     if (!resultImpl)
@@ -415,7 +452,7 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
 }
 
 template<typename StringType1, typename StringType2, typename StringType3, typename StringType4, typename StringType5, typename StringType6, typename StringType7, typename StringType8>
-UString makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
+String makeString(StringType1 string1, StringType2 string2, StringType3 string3, StringType4 string4, StringType5 string5, StringType6 string6, StringType7 string7, StringType8 string8)
 {
     PassRefPtr<StringImpl> resultImpl = tryMakeString(string1, string2, string3, string4, string5, string6, string7, string8);
     if (!resultImpl)
@@ -423,6 +460,8 @@ UString makeString(StringType1 string1, StringType2 string2, StringType3 string3
     return resultImpl;
 }
 
-} // namespace JSC
+} // namespace WTF
+
+using WTF::makeString;
 
 #endif
diff --git a/JavaScriptCore/wtf/text/StringHash.h b/JavaScriptCore/wtf/text/StringHash.h
index bfd05eb..d7aabdb 100644
--- a/JavaScriptCore/wtf/text/StringHash.h
+++ b/JavaScriptCore/wtf/text/StringHash.h
@@ -26,7 +26,7 @@
 #include "WTFString.h"
 #include <wtf/Forward.h>
 #include <wtf/HashTraits.h>
-#include <wtf/StringHashFunctions.h>
+#include <wtf/StringHasher.h>
 #include <wtf/unicode/Unicode.h>
 
 namespace WTF {
@@ -97,99 +97,26 @@ namespace WTF {
 
     class CaseFoldingHash {
     public:
-        // Paul Hsieh's SuperFastHash
-        // http://www.azillionmonkeys.com/qed/hash.html
+        template<typename T> static inline UChar foldCase(T ch)
+        {
+            return WTF::Unicode::foldCase(ch);
+        }
+
         static unsigned hash(const UChar* data, unsigned length)
         {
-            unsigned l = length;
-            const UChar* s = data;
-            uint32_t hash = WTF::stringHashingStartValue;
-            uint32_t tmp;
-            
-            int rem = l & 1;
-            l >>= 1;
-            
-            // Main loop.
-            for (; l > 0; l--) {
-                hash += WTF::Unicode::foldCase(s[0]);
-                tmp = (WTF::Unicode::foldCase(s[1]) << 11) ^ hash;
-                hash = (hash << 16) ^ tmp;
-                s += 2;
-                hash += hash >> 11;
-            }
-            
-            // Handle end case.
-            if (rem) {
-                hash += WTF::Unicode::foldCase(s[0]);
-                hash ^= hash << 11;
-                hash += hash >> 17;
-            }
-            
-            // Force "avalanching" of final 127 bits.
-            hash ^= hash << 3;
-            hash += hash >> 5;
-            hash ^= hash << 2;
-            hash += hash >> 15;
-            hash ^= hash << 10;
-            
-            // This avoids ever returning a hash code of 0, since that is used to
-            // signal "hash not computed yet", using a value that is likely to be
-            // effectively the same as 0 when the low bits are masked.
-            hash |= !hash << 31;
-            
-            return hash;
+            return StringHasher::createHash<UChar, foldCase<UChar> >(data, length);
         }
 
         static unsigned hash(StringImpl* str)
         {
             return hash(str->characters(), str->length());
         }
-        
-        static unsigned hash(const char* str, unsigned length)
-        {
-            // This hash is designed to work on 16-bit chunks at a time. But since the normal case
-            // (above) is to hash UTF-16 characters, we just treat the 8-bit chars as if they
-            // were 16-bit chunks, which will give matching results.
 
-            unsigned l = length;
-            const char* s = str;
-            uint32_t hash = WTF::stringHashingStartValue;
-            uint32_t tmp;
-            
-            int rem = l & 1;
-            l >>= 1;
-            
-            // Main loop
-            for (; l > 0; l--) {
-                hash += WTF::Unicode::foldCase(s[0]);
-                tmp = (WTF::Unicode::foldCase(s[1]) << 11) ^ hash;
-                hash = (hash << 16) ^ tmp;
-                s += 2;
-                hash += hash >> 11;
-            }
-            
-            // Handle end case
-            if (rem) {
-                hash += WTF::Unicode::foldCase(s[0]);
-                hash ^= hash << 11;
-                hash += hash >> 17;
-            }
-            
-            // Force "avalanching" of final 127 bits
-            hash ^= hash << 3;
-            hash += hash >> 5;
-            hash ^= hash << 2;
-            hash += hash >> 15;
-            hash ^= hash << 10;
-            
-            // this avoids ever returning a hash code of 0, since that is used to
-            // signal "hash not computed yet", using a value that is likely to be
-            // effectively the same as 0 when the low bits are masked
-            hash |= !hash << 31;
-            
-            return hash;
+        static unsigned hash(const char* data, unsigned length)
+        {
+            return StringHasher::createHash<char, foldCase<char> >(data, length);
         }
-        
+
         static bool equal(const StringImpl* a, const StringImpl* b)
         {
             if (a == b)
diff --git a/JavaScriptCore/wtf/text/StringImpl.cpp b/JavaScriptCore/wtf/text/StringImpl.cpp
index 7822c00..e1e08ee 100644
--- a/JavaScriptCore/wtf/text/StringImpl.cpp
+++ b/JavaScriptCore/wtf/text/StringImpl.cpp
@@ -81,7 +81,7 @@ PassRefPtr<StringImpl> StringImpl::createUninitialized(unsigned length, UChar*&
     // Allocate a single buffer large enough to contain the StringImpl
     // struct as well as the data which it contains. This removes one 
     // heap allocation from this call.
-    if (length > ((std::numeric_limits<size_t>::max() - sizeof(StringImpl)) / sizeof(UChar)))
+    if (length > ((std::numeric_limits<unsigned>::max() - sizeof(StringImpl)) / sizeof(UChar)))
         CRASH();
     size_t size = sizeof(StringImpl) + length * sizeof(UChar);
     StringImpl* string = static_cast<StringImpl*>(fastMalloc(size));
diff --git a/JavaScriptCore/wtf/text/StringImpl.h b/JavaScriptCore/wtf/text/StringImpl.h
index 7025d9f..897751d 100644
--- a/JavaScriptCore/wtf/text/StringImpl.h
+++ b/JavaScriptCore/wtf/text/StringImpl.h
@@ -29,7 +29,7 @@
 #include <wtf/Forward.h>
 #include <wtf/OwnFastMallocPtr.h>
 #include <wtf/StdLibExtras.h>
-#include <wtf/StringHashFunctions.h>
+#include <wtf/StringHasher.h>
 #include <wtf/Vector.h>
 #include <wtf/text/StringImplBase.h>
 #include <wtf/unicode/Unicode.h>
@@ -165,7 +165,7 @@ public:
             return empty();
         }
 
-        if (length > ((std::numeric_limits<size_t>::max() - sizeof(StringImpl)) / sizeof(UChar))) {
+        if (length > ((std::numeric_limits<unsigned>::max() - sizeof(StringImpl)) / sizeof(UChar))) {
             output = 0;
             return 0;
         }
@@ -187,6 +187,8 @@ public:
     {
         if (size_t size = vector.size()) {
             ASSERT(vector.data());
+            if (size > std::numeric_limits<unsigned>::max())
+                CRASH();
             return adoptRef(new StringImpl(vector.releaseBuffer(), size));
         }
         return empty();
diff --git a/JavaScriptCore/wtf/text/WTFString.cpp b/JavaScriptCore/wtf/text/WTFString.cpp
index 9b53e81..5161477 100644
--- a/JavaScriptCore/wtf/text/WTFString.cpp
+++ b/JavaScriptCore/wtf/text/WTFString.cpp
@@ -48,9 +48,12 @@ String::String(const UChar* str)
     if (!str)
         return;
         
-    int len = 0;
+    size_t len = 0;
     while (str[len] != UChar(0))
         len++;
+
+    if (len > std::numeric_limits<unsigned>::max())
+        CRASH();
     
     m_impl = StringImpl::create(str, len);
 }
@@ -175,6 +178,8 @@ void String::append(const UChar* charactersToAppend, unsigned lengthToAppend)
 
     ASSERT(charactersToAppend);
     UChar* data;
+    if (lengthToAppend > std::numeric_limits<unsigned>::max() - length())
+        CRASH();
     RefPtr<StringImpl> newImpl =
         StringImpl::createUninitialized(length() + lengthToAppend, data);
     memcpy(data, characters(), length() * sizeof(UChar));
@@ -196,6 +201,8 @@ void String::insert(const UChar* charactersToInsert, unsigned lengthToInsert, un
 
     ASSERT(charactersToInsert);
     UChar* data;
+    if (lengthToInsert > std::numeric_limits<unsigned>::max() - length())
+        CRASH();
     RefPtr<StringImpl> newImpl =
       StringImpl::createUninitialized(length() + lengthToInsert, data);
     memcpy(data, characters(), position * sizeof(UChar));
@@ -718,6 +725,9 @@ CString String::utf8(bool strict) const
 
 String String::fromUTF8(const char* stringStart, size_t length)
 {
+    if (length > std::numeric_limits<unsigned>::max())
+        CRASH();
+
     if (!stringStart)
         return String();
 
diff --git a/JavaScriptCore/wtf/unicode/Unicode.h b/JavaScriptCore/wtf/unicode/Unicode.h
index c755c6c..50524b1 100644
--- a/JavaScriptCore/wtf/unicode/Unicode.h
+++ b/JavaScriptCore/wtf/unicode/Unicode.h
@@ -33,6 +33,8 @@
 #include <wtf/unicode/glib/UnicodeGLib.h>
 #elif USE(WINCE_UNICODE)
 #include <wtf/unicode/wince/UnicodeWinCE.h>
+#elif USE(BREWMP_UNICODE)
+#include <wtf/unicode/brew/UnicodeBrew.h>
 #else
 #error "Unknown Unicode implementation"
 #endif
diff --git a/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.cpp b/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.cpp
new file mode 100644
index 0000000..8367f17
--- /dev/null
+++ b/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.cpp
@@ -0,0 +1,181 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *  Copyright (C) 2010 Company 100, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "UnicodeBrew.h"
+
+#include <wchar.h>
+#include <wctype.h>
+
+namespace WTF {
+namespace Unicode {
+
+UChar toLower(UChar c)
+{
+    return towlower(c);
+}
+
+UChar toUpper(UChar c)
+{
+    return towupper(c);
+}
+
+UChar foldCase(UChar c)
+{
+    return towlower(c);
+}
+
+bool isPrintableChar(UChar c)
+{
+    return !!iswprint(c);
+}
+
+bool isUpper(UChar c)
+{
+    return !!iswupper(c);
+}
+
+bool isLower(UChar c)
+{
+    return !!iswlower(c);
+}
+
+bool isDigit(UChar c)
+{
+    return !!iswdigit(c);
+}
+
+bool isPunct(UChar c)
+{
+    return !!iswpunct(c);
+}
+
+bool isAlphanumeric(UChar c)
+{
+    return !!iswalnum(c);
+}
+
+int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    const UChar* sourceIterator = source;
+    const UChar* sourceEnd = source + sourceLength;
+    UChar* resultIterator = result;
+    UChar* resultEnd = result + resultLength;
+
+    if (sourceLength <= resultLength) {
+        while (sourceIterator < sourceEnd)
+            *resultIterator++ = towlower(*sourceIterator++);
+    } else {
+        while (resultIterator < resultEnd)
+            *resultIterator++ = towlower(*sourceIterator++);
+    }
+
+    int remainingCharacters = sourceIterator < sourceEnd ? sourceEnd - sourceIterator : 0;
+    *isError = !!remainingCharacters;
+    if (resultIterator < resultEnd)
+        *resultIterator = 0;
+
+    return (resultIterator - result) + remainingCharacters;
+}
+
+int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    const UChar* sourceIterator = source;
+    const UChar* sourceEnd = source + sourceLength;
+    UChar* resultIterator = result;
+    UChar* resultEnd = result + resultLength;
+
+    if (sourceLength <= resultLength) {
+        while (sourceIterator < sourceEnd)
+            *resultIterator++ = towupper(*sourceIterator++);
+    } else {
+        while (resultIterator < resultEnd)
+            *resultIterator++ = towupper(*sourceIterator++);
+    }
+
+    int remainingCharacters = sourceIterator < sourceEnd ? sourceEnd - sourceIterator : 0;
+    *isError = !!remainingCharacters;
+    if (resultIterator < resultEnd)
+        *resultIterator = 0;
+
+    return (resultIterator - result) + remainingCharacters;
+}
+
+int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
+{
+    *isError = false;
+    if (resultLength < sourceLength) {
+        *isError = true;
+        return sourceLength;
+    }
+    for (int i = 0; i < sourceLength; ++i)
+        result[i] = foldCase(source[i]);
+    return sourceLength;
+}
+
+UChar toTitleCase(UChar c)
+{
+    return towupper(c);
+}
+
+Direction direction(UChar32 c)
+{
+    return static_cast<Direction>(ICU::direction(c));
+}
+
+CharCategory category(unsigned int c)
+{
+    return static_cast<CharCategory>(TO_MASK((int8_t) ICU::category(c)));
+}
+
+DecompositionType decompositionType(UChar32 c)
+{
+    return static_cast<DecompositionType>(ICU::decompositionType(c));
+}
+
+unsigned char combiningClass(UChar32 c)
+{
+    return ICU::combiningClass(c);
+}
+
+UChar mirroredChar(UChar32 c)
+{
+    return ICU::mirroredChar(c);
+}
+
+int digitValue(UChar c)
+{
+    return ICU::digitValue(c);
+}
+
+bool isSpace(UChar c)
+{
+    return !!iswspace(c);
+}
+
+bool isLetter(UChar c)
+{
+    return !!iswalpha(c);
+}
+
+} // namespace Unicode
+} // namespace WTF
diff --git a/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.h b/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.h
new file mode 100644
index 0000000..1d7576f
--- /dev/null
+++ b/JavaScriptCore/wtf/unicode/brew/UnicodeBrew.h
@@ -0,0 +1,194 @@
+/*
+ *  Copyright (C) 2006 George Staikos <staikos@kde.org>
+ *  Copyright (C) 2006 Alexey Proskuryakov <ap@nypop.com>
+ *  Copyright (C) 2007 Apple Computer, Inc. All rights reserved.
+ *  Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *  Copyright (C) 2010 Company 100, Inc.
+ *
+ *  This library is free software; you can redistribute it and/or
+ *  modify it under the terms of the GNU Library General Public
+ *  License as published by the Free Software Foundation; either
+ *  version 2 of the License, or (at your option) any later version.
+ *
+ *  This library is distributed in the hope that it will be useful,
+ *  but WITHOUT ANY WARRANTY; without even the implied warranty of
+ *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ *  Library General Public License for more details.
+ *
+ *  You should have received a copy of the GNU Library General Public License
+ *  along with this library; see the file COPYING.LIB.  If not, write to
+ *  the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ *  Boston, MA 02110-1301, USA.
+ *
+ */
+
+#ifndef UnicodeBrew_h
+#define UnicodeBrew_h
+
+#include "UnicodeFromICU.h"
+#include "UnicodeMacrosFromICU.h"
+
+namespace WTF {
+namespace Unicode {
+
+enum Direction {
+    LeftToRight = ICU::U_LEFT_TO_RIGHT,
+    RightToLeft = ICU::U_RIGHT_TO_LEFT,
+    EuropeanNumber = ICU::U_EUROPEAN_NUMBER,
+    EuropeanNumberSeparator = ICU::U_EUROPEAN_NUMBER_SEPARATOR,
+    EuropeanNumberTerminator = ICU::U_EUROPEAN_NUMBER_TERMINATOR,
+    ArabicNumber = ICU::U_ARABIC_NUMBER,
+    CommonNumberSeparator = ICU::U_COMMON_NUMBER_SEPARATOR,
+    BlockSeparator = ICU::U_BLOCK_SEPARATOR,
+    SegmentSeparator = ICU::U_SEGMENT_SEPARATOR,
+    WhiteSpaceNeutral = ICU::U_WHITE_SPACE_NEUTRAL,
+    OtherNeutral = ICU::U_OTHER_NEUTRAL,
+    LeftToRightEmbedding = ICU::U_LEFT_TO_RIGHT_EMBEDDING,
+    LeftToRightOverride = ICU::U_LEFT_TO_RIGHT_OVERRIDE,
+    RightToLeftArabic = ICU::U_RIGHT_TO_LEFT_ARABIC,
+    RightToLeftEmbedding = ICU::U_RIGHT_TO_LEFT_EMBEDDING,
+    RightToLeftOverride = ICU::U_RIGHT_TO_LEFT_OVERRIDE,
+    PopDirectionalFormat = ICU::U_POP_DIRECTIONAL_FORMAT,
+    NonSpacingMark = ICU::U_DIR_NON_SPACING_MARK,
+    BoundaryNeutral = ICU::U_BOUNDARY_NEUTRAL
+};
+
+enum DecompositionType {
+    DecompositionNone = ICU::U_DT_NONE,
+    DecompositionCanonical = ICU::U_DT_CANONICAL,
+    DecompositionCompat = ICU::U_DT_COMPAT,
+    DecompositionCircle = ICU::U_DT_CIRCLE,
+    DecompositionFinal = ICU::U_DT_FINAL,
+    DecompositionFont = ICU::U_DT_FONT,
+    DecompositionFraction = ICU::U_DT_FRACTION,
+    DecompositionInitial = ICU::U_DT_INITIAL,
+    DecompositionIsolated = ICU::U_DT_ISOLATED,
+    DecompositionMedial = ICU::U_DT_MEDIAL,
+    DecompositionNarrow = ICU::U_DT_NARROW,
+    DecompositionNoBreak = ICU::U_DT_NOBREAK,
+    DecompositionSmall = ICU::U_DT_SMALL,
+    DecompositionSquare = ICU::U_DT_SQUARE,
+    DecompositionSub = ICU::U_DT_SUB,
+    DecompositionSuper = ICU::U_DT_SUPER,
+    DecompositionVertical = ICU::U_DT_VERTICAL,
+    DecompositionWide = ICU::U_DT_WIDE,
+};
+
+enum CharCategory {
+    NoCategory =  0,
+    Other_NotAssigned = TO_MASK(ICU::U_GENERAL_OTHER_TYPES),
+    Letter_Uppercase = TO_MASK(ICU::U_UPPERCASE_LETTER),
+    Letter_Lowercase = TO_MASK(ICU::U_LOWERCASE_LETTER),
+    Letter_Titlecase = TO_MASK(ICU::U_TITLECASE_LETTER),
+    Letter_Modifier = TO_MASK(ICU::U_MODIFIER_LETTER),
+    Letter_Other = TO_MASK(ICU::U_OTHER_LETTER),
+
+    Mark_NonSpacing = TO_MASK(ICU::U_NON_SPACING_MARK),
+    Mark_Enclosing = TO_MASK(ICU::U_ENCLOSING_MARK),
+    Mark_SpacingCombining = TO_MASK(ICU::U_COMBINING_SPACING_MARK),
+
+    Number_DecimalDigit = TO_MASK(ICU::U_DECIMAL_DIGIT_NUMBER),
+    Number_Letter = TO_MASK(ICU::U_LETTER_NUMBER),
+    Number_Other = TO_MASK(ICU::U_OTHER_NUMBER),
+
+    Separator_Space = TO_MASK(ICU::U_SPACE_SEPARATOR),
+    Separator_Line = TO_MASK(ICU::U_LINE_SEPARATOR),
+    Separator_Paragraph = TO_MASK(ICU::U_PARAGRAPH_SEPARATOR),
+
+    Other_Control = TO_MASK(ICU::U_CONTROL_CHAR),
+    Other_Format = TO_MASK(ICU::U_FORMAT_CHAR),
+    Other_PrivateUse = TO_MASK(ICU::U_PRIVATE_USE_CHAR),
+    Other_Surrogate = TO_MASK(ICU::U_SURROGATE),
+
+    Punctuation_Dash = TO_MASK(ICU::U_DASH_PUNCTUATION),
+    Punctuation_Open = TO_MASK(ICU::U_START_PUNCTUATION),
+    Punctuation_Close = TO_MASK(ICU::U_END_PUNCTUATION),
+    Punctuation_Connector = TO_MASK(ICU::U_CONNECTOR_PUNCTUATION),
+    Punctuation_Other = TO_MASK(ICU::U_OTHER_PUNCTUATION),
+
+    Symbol_Math = TO_MASK(ICU::U_MATH_SYMBOL),
+    Symbol_Currency = TO_MASK(ICU::U_CURRENCY_SYMBOL),
+    Symbol_Modifier = TO_MASK(ICU::U_MODIFIER_SYMBOL),
+    Symbol_Other = TO_MASK(ICU::U_OTHER_SYMBOL),
+
+    Punctuation_InitialQuote = TO_MASK(ICU::U_INITIAL_PUNCTUATION),
+    Punctuation_FinalQuote = TO_MASK(ICU::U_FINAL_PUNCTUATION)
+};
+
+UChar foldCase(UChar);
+
+int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+
+int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+
+UChar toUpper(UChar);
+UChar toLower(UChar);
+
+bool isUpper(UChar);
+
+int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+
+UChar toTitleCase(UChar);
+
+inline bool isArabicChar(UChar32 c)
+{
+    return c >= 0x0600 && c <= 0x06FF;
+}
+
+bool isAlphanumeric(UChar);
+
+CharCategory category(unsigned int);
+
+inline bool isSeparatorSpace(UChar c)
+{
+    return category(c) == Separator_Space;
+}
+
+bool isPrintableChar(UChar);
+
+bool isDigit(UChar);
+
+bool isPunct(UChar);
+
+inline bool hasLineBreakingPropertyComplexContext(UChar32)
+{
+    // FIXME: implement!
+    return false;
+}
+
+inline bool hasLineBreakingPropertyComplexContextOrIdeographic(UChar32 c)
+{
+    // FIXME
+    return false;
+}
+
+UChar mirroredChar(UChar32);
+
+Direction direction(UChar32);
+
+bool isLower(UChar);
+
+int digitValue(UChar);
+
+unsigned char combiningClass(UChar32);
+
+DecompositionType decompositionType(UChar32);
+
+inline int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    for (int i = 0; i < len; ++i) {
+        UChar c1 = foldCase(a[i]);
+        UChar c2 = foldCase(b[i]);
+        if (c1 != c2)
+            return c1 - c2;
+    }
+    return 0;
+}
+
+bool isSpace(UChar);
+bool isLetter(UChar);
+
+} // namespace Unicode
+} // namespace WTF
+
+#endif
diff --git a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
index 547ed32..eaa7a07 100644
--- a/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
+++ b/JavaScriptCore/wtf/unicode/qt4/UnicodeQt4.h
@@ -31,6 +31,9 @@
 #include <config.h>
 
 #include <stdint.h>
+#if USE(QT_ICU_TEXT_BREAKING)
+#include <unicode/ubrk.h>
+#endif
 
 QT_BEGIN_NAMESPACE
 namespace QUnicodeTables {
@@ -63,7 +66,10 @@ typedef wchar_t UChar;
 #else
 typedef uint16_t UChar;
 #endif
+
+#if !USE(QT_ICU_TEXT_BREAKING)
 typedef uint32_t UChar32;
+#endif
 
 namespace WTF {
 namespace Unicode {
@@ -150,7 +156,7 @@ enum CharCategory {
 
 inline UChar32 toLower(UChar32 ch)
 {
-    return QChar::toLower(ch);
+    return QChar::toLower(uint32_t(ch));
 }
 
 inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
@@ -206,9 +212,9 @@ inline int toLower(UChar* result, int resultLength, const UChar* src, int srcLen
     return rindex + needed;
 }
 
-inline UChar32 toUpper(UChar32 ch)
+inline UChar32 toUpper(UChar32 c)
 {
-    return QChar::toUpper(ch);
+    return QChar::toUpper(uint32_t(c));
 }
 
 inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
@@ -266,12 +272,12 @@ inline int toUpper(UChar* result, int resultLength, const UChar* src, int srcLen
 
 inline int toTitleCase(UChar32 c)
 {
-    return QChar::toTitleCase(c);
+    return QChar::toTitleCase(uint32_t(c));
 }
 
 inline UChar32 foldCase(UChar32 c)
 {
-    return QChar::toCaseFolded(c);
+    return QChar::toCaseFolded(uint32_t(c));
 }
 
 inline int foldCase(UChar* result, int resultLength, const UChar* src, int srcLength,  bool* error)
@@ -296,12 +302,12 @@ inline bool isPrintableChar(UChar32 c)
 {
     const uint test = U_MASK(QChar::Other_Control) |
                       U_MASK(QChar::Other_NotAssigned);
-    return !(U_MASK(QChar::category(c)) & test);
+    return !(U_MASK(QChar::category(uint32_t(c))) & test);
 }
 
 inline bool isSeparatorSpace(UChar32 c)
 {
-    return QChar::category(c) == QChar::Separator_Space;
+    return QChar::category(uint32_t(c)) == QChar::Separator_Space;
 }
 
 inline bool isPunct(UChar32 c)
@@ -313,12 +319,12 @@ inline bool isPunct(UChar32 c)
                       U_MASK(QChar::Punctuation_InitialQuote) |
                       U_MASK(QChar::Punctuation_FinalQuote) |
                       U_MASK(QChar::Punctuation_Other);
-    return U_MASK(QChar::category(c)) & test;
+    return U_MASK(QChar::category(uint32_t(c))) & test;
 }
 
 inline bool isLower(UChar32 c)
 {
-    return QChar::category(c) == QChar::Letter_Lowercase;
+    return QChar::category(uint32_t(c)) == QChar::Letter_Lowercase;
 }
 
 inline bool hasLineBreakingPropertyComplexContext(UChar32)
@@ -329,12 +335,12 @@ inline bool hasLineBreakingPropertyComplexContext(UChar32)
 
 inline UChar32 mirroredChar(UChar32 c)
 {
-    return QChar::mirroredChar(c);
+    return QChar::mirroredChar(uint32_t(c));
 }
 
 inline uint8_t combiningClass(UChar32 c)
 {
-    return QChar::combiningClass(c);
+    return QChar::combiningClass(uint32_t(c));
 }
 
 inline DecompositionType decompositionType(UChar32 c)
@@ -356,12 +362,12 @@ inline int umemcasecmp(const UChar* a, const UChar* b, int len)
 
 inline Direction direction(UChar32 c)
 {
-    return (Direction)QChar::direction(c);
+    return (Direction)QChar::direction(uint32_t(c));
 }
 
 inline CharCategory category(UChar32 c)
 {
-    return (CharCategory) U_MASK(QChar::category(c));
+    return (CharCategory) U_MASK(QChar::category(uint32_t(c)));
 }
 
 } }
diff --git a/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.cpp b/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.cpp
index b52b05c..96dac7d 100644
--- a/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.cpp
+++ b/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.cpp
@@ -27,62 +27,62 @@
 namespace WTF {
 namespace Unicode {
 
-wchar_t toLower(wchar_t c)
+UChar toLower(UChar c)
 {
     return towlower(c);
 }
 
-wchar_t toUpper(wchar_t c)
+UChar toUpper(UChar c)
 {
     return towupper(c);
 }
 
-wchar_t foldCase(wchar_t c)
+UChar foldCase(UChar c)
 {
     return towlower(c);
 }
 
-bool isPrintableChar(wchar_t c)
+bool isPrintableChar(UChar c)
 {
     return !!iswprint(c);
 }
 
-bool isSpace(wchar_t c)
+bool isSpace(UChar c)
 {
     return !!iswspace(c);
 }
 
-bool isLetter(wchar_t c)
+bool isLetter(UChar c)
 {
     return !!iswalpha(c);
 }
 
-bool isUpper(wchar_t c)
+bool isUpper(UChar c)
 {
     return !!iswupper(c);
 }
 
-bool isLower(wchar_t c)
+bool isLower(UChar c)
 {
     return !!iswlower(c);
 }
 
-bool isDigit(wchar_t c)
+bool isDigit(UChar c)
 {
     return !!iswdigit(c);
 }
 
-bool isPunct(wchar_t c)
+bool isPunct(UChar c)
 {
     return !!iswpunct(c);
 }
 
-bool isAlphanumeric(wchar_t c)
+bool isAlphanumeric(UChar c)
 {
     return !!iswalnum(c);
 }
 
-int toLower(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
 {
     const UChar* sourceIterator = source;
     const UChar* sourceEnd = source + sourceLength;
@@ -99,14 +99,14 @@ int toLower(wchar_t* result, int resultLength, const wchar_t* source, int source
 
     if (sourceIterator < sourceEnd)
         remainingCharacters += sourceEnd - sourceIterator;
-    *isError = (remainingCharacters != 0);
+    *isError = !!remainingCharacters;
     if (resultIterator < resultEnd)
         *resultIterator = 0;
 
     return (resultIterator - result) + remainingCharacters;
 }
 
-int toUpper(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
 {
     const UChar* sourceIterator = source;
     const UChar* sourceEnd = source + sourceLength;
@@ -123,14 +123,14 @@ int toUpper(wchar_t* result, int resultLength, const wchar_t* source, int source
 
     if (sourceIterator < sourceEnd)
         remainingCharacters += sourceEnd - sourceIterator;
-    *isError = (remainingCharacters != 0);
+    *isError = !!remainingCharacters;
     if (resultIterator < resultEnd)
         *resultIterator = 0;
 
     return (resultIterator - result) + remainingCharacters;
 }
 
-int foldCase(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError)
+int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError)
 {
     *isError = false;
     if (resultLength < sourceLength) {
@@ -142,7 +142,7 @@ int foldCase(wchar_t* result, int resultLength, const wchar_t* source, int sourc
     return sourceLength;
 }
 
-wchar_t toTitleCase(wchar_t c)
+UChar toTitleCase(UChar c)
 {
     return towupper(c);
 }
@@ -167,12 +167,12 @@ unsigned char combiningClass(UChar32 c)
     return UnicodeCE::combiningClass(c);
 }
 
-wchar_t mirroredChar(UChar32 c)
+UChar mirroredChar(UChar32 c)
 {
     return UnicodeCE::mirroredChar(c);
 }
 
-int digitValue(wchar_t c)
+int digitValue(UChar c)
 {
     return UnicodeCE::digitValue(c);
 }
diff --git a/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h b/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
index 8cc9580..2688aa9 100644
--- a/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
+++ b/JavaScriptCore/wtf/unicode/wince/UnicodeWinCE.h
@@ -31,149 +31,147 @@
 #define TO_MASK(x) (1 << (x))
 
 namespace WTF {
-
-    namespace Unicode {
-
-        enum Direction {
-            LeftToRight = UnicodeCE::U_LEFT_TO_RIGHT,
-            RightToLeft = UnicodeCE::U_RIGHT_TO_LEFT,
-            EuropeanNumber = UnicodeCE::U_EUROPEAN_NUMBER,
-            EuropeanNumberSeparator = UnicodeCE::U_EUROPEAN_NUMBER_SEPARATOR,
-            EuropeanNumberTerminator = UnicodeCE::U_EUROPEAN_NUMBER_TERMINATOR,
-            ArabicNumber = UnicodeCE::U_ARABIC_NUMBER,
-            CommonNumberSeparator = UnicodeCE::U_COMMON_NUMBER_SEPARATOR,
-            BlockSeparator = UnicodeCE::U_BLOCK_SEPARATOR,
-            SegmentSeparator = UnicodeCE::U_SEGMENT_SEPARATOR,
-            WhiteSpaceNeutral = UnicodeCE::U_WHITE_SPACE_NEUTRAL,
-            OtherNeutral = UnicodeCE::U_OTHER_NEUTRAL,
-            LeftToRightEmbedding = UnicodeCE::U_LEFT_TO_RIGHT_EMBEDDING,
-            LeftToRightOverride = UnicodeCE::U_LEFT_TO_RIGHT_OVERRIDE,
-            RightToLeftArabic = UnicodeCE::U_RIGHT_TO_LEFT_ARABIC,
-            RightToLeftEmbedding = UnicodeCE::U_RIGHT_TO_LEFT_EMBEDDING,
-            RightToLeftOverride = UnicodeCE::U_RIGHT_TO_LEFT_OVERRIDE,
-            PopDirectionalFormat = UnicodeCE::U_POP_DIRECTIONAL_FORMAT,
-            NonSpacingMark = UnicodeCE::U_DIR_NON_SPACING_MARK,
-            BoundaryNeutral = UnicodeCE::U_BOUNDARY_NEUTRAL
-        };
-
-        enum DecompositionType {
-          DecompositionNone = UnicodeCE::U_DT_NONE,
-          DecompositionCanonical = UnicodeCE::U_DT_CANONICAL,
-          DecompositionCompat = UnicodeCE::U_DT_COMPAT,
-          DecompositionCircle = UnicodeCE::U_DT_CIRCLE,
-          DecompositionFinal = UnicodeCE::U_DT_FINAL,
-          DecompositionFont = UnicodeCE::U_DT_FONT,
-          DecompositionFraction = UnicodeCE::U_DT_FRACTION,
-          DecompositionInitial = UnicodeCE::U_DT_INITIAL,
-          DecompositionIsolated = UnicodeCE::U_DT_ISOLATED,
-          DecompositionMedial = UnicodeCE::U_DT_MEDIAL,
-          DecompositionNarrow = UnicodeCE::U_DT_NARROW,
-          DecompositionNoBreak = UnicodeCE::U_DT_NOBREAK,
-          DecompositionSmall = UnicodeCE::U_DT_SMALL,
-          DecompositionSquare = UnicodeCE::U_DT_SQUARE,
-          DecompositionSub = UnicodeCE::U_DT_SUB,
-          DecompositionSuper = UnicodeCE::U_DT_SUPER,
-          DecompositionVertical = UnicodeCE::U_DT_VERTICAL,
-          DecompositionWide = UnicodeCE::U_DT_WIDE,
-        };
-
-        enum CharCategory {
-          NoCategory =  0,
-          Other_NotAssigned = TO_MASK(UnicodeCE::U_GENERAL_OTHER_TYPES),
-          Letter_Uppercase = TO_MASK(UnicodeCE::U_UPPERCASE_LETTER),
-          Letter_Lowercase = TO_MASK(UnicodeCE::U_LOWERCASE_LETTER),
-          Letter_Titlecase = TO_MASK(UnicodeCE::U_TITLECASE_LETTER),
-          Letter_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_LETTER),
-          Letter_Other = TO_MASK(UnicodeCE::U_OTHER_LETTER),
-
-          Mark_NonSpacing = TO_MASK(UnicodeCE::U_NON_SPACING_MARK),
-          Mark_Enclosing = TO_MASK(UnicodeCE::U_ENCLOSING_MARK),
-          Mark_SpacingCombining = TO_MASK(UnicodeCE::U_COMBINING_SPACING_MARK),
-
-          Number_DecimalDigit = TO_MASK(UnicodeCE::U_DECIMAL_DIGIT_NUMBER),
-          Number_Letter = TO_MASK(UnicodeCE::U_LETTER_NUMBER),
-          Number_Other = TO_MASK(UnicodeCE::U_OTHER_NUMBER),
-
-          Separator_Space = TO_MASK(UnicodeCE::U_SPACE_SEPARATOR),
-          Separator_Line = TO_MASK(UnicodeCE::U_LINE_SEPARATOR),
-          Separator_Paragraph = TO_MASK(UnicodeCE::U_PARAGRAPH_SEPARATOR),
-
-          Other_Control = TO_MASK(UnicodeCE::U_CONTROL_CHAR),
-          Other_Format = TO_MASK(UnicodeCE::U_FORMAT_CHAR),
-          Other_PrivateUse = TO_MASK(UnicodeCE::U_PRIVATE_USE_CHAR),
-          Other_Surrogate = TO_MASK(UnicodeCE::U_SURROGATE),
-
-          Punctuation_Dash = TO_MASK(UnicodeCE::U_DASH_PUNCTUATION),
-          Punctuation_Open = TO_MASK(UnicodeCE::U_START_PUNCTUATION),
-          Punctuation_Close = TO_MASK(UnicodeCE::U_END_PUNCTUATION),
-          Punctuation_Connector = TO_MASK(UnicodeCE::U_CONNECTOR_PUNCTUATION),
-          Punctuation_Other = TO_MASK(UnicodeCE::U_OTHER_PUNCTUATION),
-
-          Symbol_Math = TO_MASK(UnicodeCE::U_MATH_SYMBOL),
-          Symbol_Currency = TO_MASK(UnicodeCE::U_CURRENCY_SYMBOL),
-          Symbol_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_SYMBOL),
-          Symbol_Other = TO_MASK(UnicodeCE::U_OTHER_SYMBOL),
-
-          Punctuation_InitialQuote = TO_MASK(UnicodeCE::U_INITIAL_PUNCTUATION),
-          Punctuation_FinalQuote = TO_MASK(UnicodeCE::U_FINAL_PUNCTUATION)
-        };
-
-        CharCategory category(unsigned int);
-
-        bool isSpace(wchar_t);
-        bool isLetter(wchar_t);
-        bool isPrintableChar(wchar_t);
-        bool isUpper(wchar_t);
-        bool isLower(wchar_t);
-        bool isPunct(wchar_t);
-        bool isDigit(wchar_t);
-        bool isAlphanumeric(wchar_t);
-        inline bool isSeparatorSpace(wchar_t c) { return category(c) == Separator_Space; }
-        inline bool isHighSurrogate(wchar_t c) { return (c & 0xfc00) == 0xd800; }
-        inline bool isLowSurrogate(wchar_t c) { return (c & 0xfc00) == 0xdc00; }
-
-        wchar_t toLower(wchar_t);
-        wchar_t toUpper(wchar_t);
-        wchar_t foldCase(wchar_t);
-        wchar_t toTitleCase(wchar_t);
-        int toLower(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
-        int toUpper(wchar_t* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
-        int foldCase(UChar* result, int resultLength, const wchar_t* source, int sourceLength, bool* isError);
-
-        int digitValue(wchar_t);
-
-        wchar_t mirroredChar(UChar32);
-        unsigned char combiningClass(UChar32);
-        DecompositionType decompositionType(UChar32);
-        Direction direction(UChar32);
-        inline bool isArabicChar(UChar32 c)
-        {
-            return c >= 0x0600 && c <= 0x06FF;
-        }
-
-        inline bool hasLineBreakingPropertyComplexContext(UChar32)
-        {
-            return false; // FIXME: implement!
-        }
-
-        inline int umemcasecmp(const wchar_t* a, const wchar_t* b, int len)
-        {
-            for (int i = 0; i < len; ++i) {
-                wchar_t c1 = foldCase(a[i]);
-                wchar_t c2 = foldCase(b[i]);
-                if (c1 != c2)
-                    return c1 - c2;
-            }
-            return 0;
-        }
-
-        inline UChar32 surrogateToUcs4(wchar_t high, wchar_t low)
-        {
-            return (UChar32(high) << 10) + low - 0x35fdc00;
-        }
-
-    }   // namespace Unicode
-
-}   // namespace WTF
+namespace Unicode {
+
+enum Direction {
+    LeftToRight = UnicodeCE::U_LEFT_TO_RIGHT,
+    RightToLeft = UnicodeCE::U_RIGHT_TO_LEFT,
+    EuropeanNumber = UnicodeCE::U_EUROPEAN_NUMBER,
+    EuropeanNumberSeparator = UnicodeCE::U_EUROPEAN_NUMBER_SEPARATOR,
+    EuropeanNumberTerminator = UnicodeCE::U_EUROPEAN_NUMBER_TERMINATOR,
+    ArabicNumber = UnicodeCE::U_ARABIC_NUMBER,
+    CommonNumberSeparator = UnicodeCE::U_COMMON_NUMBER_SEPARATOR,
+    BlockSeparator = UnicodeCE::U_BLOCK_SEPARATOR,
+    SegmentSeparator = UnicodeCE::U_SEGMENT_SEPARATOR,
+    WhiteSpaceNeutral = UnicodeCE::U_WHITE_SPACE_NEUTRAL,
+    OtherNeutral = UnicodeCE::U_OTHER_NEUTRAL,
+    LeftToRightEmbedding = UnicodeCE::U_LEFT_TO_RIGHT_EMBEDDING,
+    LeftToRightOverride = UnicodeCE::U_LEFT_TO_RIGHT_OVERRIDE,
+    RightToLeftArabic = UnicodeCE::U_RIGHT_TO_LEFT_ARABIC,
+    RightToLeftEmbedding = UnicodeCE::U_RIGHT_TO_LEFT_EMBEDDING,
+    RightToLeftOverride = UnicodeCE::U_RIGHT_TO_LEFT_OVERRIDE,
+    PopDirectionalFormat = UnicodeCE::U_POP_DIRECTIONAL_FORMAT,
+    NonSpacingMark = UnicodeCE::U_DIR_NON_SPACING_MARK,
+    BoundaryNeutral = UnicodeCE::U_BOUNDARY_NEUTRAL
+};
+
+enum DecompositionType {
+    DecompositionNone = UnicodeCE::U_DT_NONE,
+    DecompositionCanonical = UnicodeCE::U_DT_CANONICAL,
+    DecompositionCompat = UnicodeCE::U_DT_COMPAT,
+    DecompositionCircle = UnicodeCE::U_DT_CIRCLE,
+    DecompositionFinal = UnicodeCE::U_DT_FINAL,
+    DecompositionFont = UnicodeCE::U_DT_FONT,
+    DecompositionFraction = UnicodeCE::U_DT_FRACTION,
+    DecompositionInitial = UnicodeCE::U_DT_INITIAL,
+    DecompositionIsolated = UnicodeCE::U_DT_ISOLATED,
+    DecompositionMedial = UnicodeCE::U_DT_MEDIAL,
+    DecompositionNarrow = UnicodeCE::U_DT_NARROW,
+    DecompositionNoBreak = UnicodeCE::U_DT_NOBREAK,
+    DecompositionSmall = UnicodeCE::U_DT_SMALL,
+    DecompositionSquare = UnicodeCE::U_DT_SQUARE,
+    DecompositionSub = UnicodeCE::U_DT_SUB,
+    DecompositionSuper = UnicodeCE::U_DT_SUPER,
+    DecompositionVertical = UnicodeCE::U_DT_VERTICAL,
+    DecompositionWide = UnicodeCE::U_DT_WIDE
+};
+
+enum CharCategory {
+    NoCategory =  0,
+    Other_NotAssigned = TO_MASK(UnicodeCE::U_GENERAL_OTHER_TYPES),
+    Letter_Uppercase = TO_MASK(UnicodeCE::U_UPPERCASE_LETTER),
+    Letter_Lowercase = TO_MASK(UnicodeCE::U_LOWERCASE_LETTER),
+    Letter_Titlecase = TO_MASK(UnicodeCE::U_TITLECASE_LETTER),
+    Letter_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_LETTER),
+    Letter_Other = TO_MASK(UnicodeCE::U_OTHER_LETTER),
+
+    Mark_NonSpacing = TO_MASK(UnicodeCE::U_NON_SPACING_MARK),
+    Mark_Enclosing = TO_MASK(UnicodeCE::U_ENCLOSING_MARK),
+    Mark_SpacingCombining = TO_MASK(UnicodeCE::U_COMBINING_SPACING_MARK),
+
+    Number_DecimalDigit = TO_MASK(UnicodeCE::U_DECIMAL_DIGIT_NUMBER),
+    Number_Letter = TO_MASK(UnicodeCE::U_LETTER_NUMBER),
+    Number_Other = TO_MASK(UnicodeCE::U_OTHER_NUMBER),
+
+    Separator_Space = TO_MASK(UnicodeCE::U_SPACE_SEPARATOR),
+    Separator_Line = TO_MASK(UnicodeCE::U_LINE_SEPARATOR),
+    Separator_Paragraph = TO_MASK(UnicodeCE::U_PARAGRAPH_SEPARATOR),
+
+    Other_Control = TO_MASK(UnicodeCE::U_CONTROL_CHAR),
+    Other_Format = TO_MASK(UnicodeCE::U_FORMAT_CHAR),
+    Other_PrivateUse = TO_MASK(UnicodeCE::U_PRIVATE_USE_CHAR),
+    Other_Surrogate = TO_MASK(UnicodeCE::U_SURROGATE),
+
+    Punctuation_Dash = TO_MASK(UnicodeCE::U_DASH_PUNCTUATION),
+    Punctuation_Open = TO_MASK(UnicodeCE::U_START_PUNCTUATION),
+    Punctuation_Close = TO_MASK(UnicodeCE::U_END_PUNCTUATION),
+    Punctuation_Connector = TO_MASK(UnicodeCE::U_CONNECTOR_PUNCTUATION),
+    Punctuation_Other = TO_MASK(UnicodeCE::U_OTHER_PUNCTUATION),
+
+    Symbol_Math = TO_MASK(UnicodeCE::U_MATH_SYMBOL),
+    Symbol_Currency = TO_MASK(UnicodeCE::U_CURRENCY_SYMBOL),
+    Symbol_Modifier = TO_MASK(UnicodeCE::U_MODIFIER_SYMBOL),
+    Symbol_Other = TO_MASK(UnicodeCE::U_OTHER_SYMBOL),
+
+    Punctuation_InitialQuote = TO_MASK(UnicodeCE::U_INITIAL_PUNCTUATION),
+    Punctuation_FinalQuote = TO_MASK(UnicodeCE::U_FINAL_PUNCTUATION)
+};
+
+CharCategory category(unsigned int);
+
+bool isSpace(UChar);
+bool isLetter(UChar);
+bool isPrintableChar(UChar);
+bool isUpper(UChar);
+bool isLower(UChar);
+bool isPunct(UChar);
+bool isDigit(UChar);
+bool isAlphanumeric(UChar);
+inline bool isSeparatorSpace(UChar c) { return category(c) == Separator_Space; }
+inline bool isHighSurrogate(UChar c) { return (c & 0xfc00) == 0xd800; }
+inline bool isLowSurrogate(UChar c) { return (c & 0xfc00) == 0xdc00; }
+
+UChar toLower(UChar);
+UChar toUpper(UChar);
+UChar foldCase(UChar);
+UChar toTitleCase(UChar);
+int toLower(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+int toUpper(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+int foldCase(UChar* result, int resultLength, const UChar* source, int sourceLength, bool* isError);
+
+int digitValue(UChar);
+
+UChar mirroredChar(UChar32);
+unsigned char combiningClass(UChar32);
+DecompositionType decompositionType(UChar32);
+Direction direction(UChar32);
+inline bool isArabicChar(UChar32 c)
+{
+    return c >= 0x0600 && c <= 0x06FF;
+}
+
+inline bool hasLineBreakingPropertyComplexContext(UChar32)
+{
+    return false; // FIXME: implement!
+}
+
+inline int umemcasecmp(const UChar* a, const UChar* b, int len)
+{
+    for (int i = 0; i < len; ++i) {
+        UChar c1 = foldCase(a[i]);
+        UChar c2 = foldCase(b[i]);
+        if (c1 != c2)
+            return c1 - c2;
+    }
+    return 0;
+}
+
+inline UChar32 surrogateToUcs4(UChar high, UChar low)
+{
+    return (UChar32(high) << 10) + low - 0x35fdc00;
+}
+
+} // namespace Unicode
+} // namespace WTF
 
 #endif // WTF_UnicodeWinCE_h
diff --git a/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp b/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp
new file mode 100644
index 0000000..ee2014e
--- /dev/null
+++ b/JavaScriptCore/wtf/url/src/URLCharacterTypes.cpp
@@ -0,0 +1,173 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "config.h"
+#include "URLCharacterTypes.h"
+
+namespace WTF {
+
+const unsigned char URLCharacterTypes::characterTypeTable[0x100] = {
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x00 - 0x0f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x10 - 0x1f
+    InvalidCharacter, // 0x20  ' ' (escape spaces in queries)
+    QueryCharacter | UserInfoCharacter, // 0x21  !
+    InvalidCharacter, // 0x22  "
+    InvalidCharacter, // 0x23  #  (invalid in query since it marks the ref)
+    QueryCharacter | UserInfoCharacter, // 0x24  $
+    QueryCharacter | UserInfoCharacter, // 0x25  %
+    QueryCharacter | UserInfoCharacter, // 0x26  &
+    QueryCharacter | UserInfoCharacter, // 0x27  '
+    QueryCharacter | UserInfoCharacter, // 0x28  (
+    QueryCharacter | UserInfoCharacter, // 0x29  )
+    QueryCharacter | UserInfoCharacter, // 0x2a  *
+    QueryCharacter | UserInfoCharacter, // 0x2b  +
+    QueryCharacter | UserInfoCharacter, // 0x2c  ,
+    QueryCharacter | UserInfoCharacter, // 0x2d  -
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x2e  .
+    QueryCharacter, // 0x2f  /
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x30  0
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x31  1
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x32  2
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x33  3
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x34  4
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x35  5
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x36  6
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter | OctalCharacter, // 0x37  7
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter, // 0x38  8
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter | DecimalCharacter, // 0x39  9
+    QueryCharacter, // 0x3a  :
+    QueryCharacter, // 0x3b  ;
+    InvalidCharacter, // 0x3c  <
+    QueryCharacter, // 0x3d  =
+    InvalidCharacter, // 0x3e  >
+    QueryCharacter, // 0x3f  ?
+    QueryCharacter, // 0x40  @
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x41  A
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x42  B
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x43  C
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x44  D
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x45  E
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x46  F
+    QueryCharacter | UserInfoCharacter, // 0x47  G
+    QueryCharacter | UserInfoCharacter, // 0x48  H
+    QueryCharacter | UserInfoCharacter, // 0x49  I
+    QueryCharacter | UserInfoCharacter, // 0x4a  J
+    QueryCharacter | UserInfoCharacter, // 0x4b  K
+    QueryCharacter | UserInfoCharacter, // 0x4c  L
+    QueryCharacter | UserInfoCharacter, // 0x4d  M
+    QueryCharacter | UserInfoCharacter, // 0x4e  N
+    QueryCharacter | UserInfoCharacter, // 0x4f  O
+    QueryCharacter | UserInfoCharacter, // 0x50  P
+    QueryCharacter | UserInfoCharacter, // 0x51  Q
+    QueryCharacter | UserInfoCharacter, // 0x52  R
+    QueryCharacter | UserInfoCharacter, // 0x53  S
+    QueryCharacter | UserInfoCharacter, // 0x54  T
+    QueryCharacter | UserInfoCharacter, // 0x55  U
+    QueryCharacter | UserInfoCharacter, // 0x56  V
+    QueryCharacter | UserInfoCharacter, // 0x57  W
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x58  X
+    QueryCharacter | UserInfoCharacter, // 0x59  Y
+    QueryCharacter | UserInfoCharacter, // 0x5a  Z
+    QueryCharacter, // 0x5b  [
+    QueryCharacter, // 0x5c  '\'
+    QueryCharacter, // 0x5d  ]
+    QueryCharacter, // 0x5e  ^
+    QueryCharacter | UserInfoCharacter, // 0x5f  _
+    QueryCharacter, // 0x60  `
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x61  a
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x62  b
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x63  c
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x64  d
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x65  e
+    QueryCharacter | UserInfoCharacter | IPv4Character | HexCharacter, // 0x66  f
+    QueryCharacter | UserInfoCharacter, // 0x67  g
+    QueryCharacter | UserInfoCharacter, // 0x68  h
+    QueryCharacter | UserInfoCharacter, // 0x69  i
+    QueryCharacter | UserInfoCharacter, // 0x6a  j
+    QueryCharacter | UserInfoCharacter, // 0x6b  k
+    QueryCharacter | UserInfoCharacter, // 0x6c  l
+    QueryCharacter | UserInfoCharacter, // 0x6d  m
+    QueryCharacter | UserInfoCharacter, // 0x6e  n
+    QueryCharacter | UserInfoCharacter, // 0x6f  o
+    QueryCharacter | UserInfoCharacter, // 0x70  p
+    QueryCharacter | UserInfoCharacter, // 0x71  q
+    QueryCharacter | UserInfoCharacter, // 0x72  r
+    QueryCharacter | UserInfoCharacter, // 0x73  s
+    QueryCharacter | UserInfoCharacter, // 0x74  t
+    QueryCharacter | UserInfoCharacter, // 0x75  u
+    QueryCharacter | UserInfoCharacter, // 0x76  v
+    QueryCharacter | UserInfoCharacter, // 0x77  w
+    QueryCharacter | UserInfoCharacter | IPv4Character, // 0x78  x
+    QueryCharacter | UserInfoCharacter, // 0x79  y
+    QueryCharacter | UserInfoCharacter, // 0x7a  z
+    QueryCharacter, // 0x7b  {
+    QueryCharacter, // 0x7c  |
+    QueryCharacter, // 0x7d  }
+    QueryCharacter | UserInfoCharacter, // 0x7e  ~
+    InvalidCharacter, // 0x7f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x80 - 0x8f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0x90 - 0x9f
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xa0 - 0xaf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xb0 - 0xbf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xc0 - 0xcf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xd0 - 0xdf
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xe0 - 0xef
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter,
+    InvalidCharacter, InvalidCharacter, InvalidCharacter, InvalidCharacter, // 0xf0 - 0xff
+};
+
+}
diff --git a/JavaScriptCore/wtf/url/src/URLCharacterTypes.h b/JavaScriptCore/wtf/url/src/URLCharacterTypes.h
new file mode 100644
index 0000000..194f6b0
--- /dev/null
+++ b/JavaScriptCore/wtf/url/src/URLCharacterTypes.h
@@ -0,0 +1,61 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef URLCharacterTypes_h
+#define URLCharacterTypes_h
+
+namespace WTF {
+
+class URLCharacterTypes {
+public:
+    static inline bool isQueryChar(unsigned char c) { return isCharOfType(c, QueryCharacter); }
+    static inline bool isIPv4Char(unsigned char c) { return isCharOfType(c, IPv4Character); }
+    static inline bool isHexChar(unsigned char c) { return isCharOfType(c, HexCharacter); }
+
+private:
+    enum CharTypes {
+        InvalidCharacter = 0,
+        QueryCharacter = 1 << 0,
+        UserInfoCharacter = 1 << 1,
+        IPv4Character = 1 << 2,
+        HexCharacter = 1 << 3,
+        DecimalCharacter = 1 << 4,
+        OctalCharacter = 1 << 5,
+    };
+
+    static const unsigned char characterTypeTable[0x100];
+
+    static inline bool isCharOfType(unsigned char c, CharTypes type)
+    {
+        return !!(characterTypeTable[c] & type);
+    }
+};
+
+}
+
+#endif
diff --git a/JavaScriptCore/wtf/url/src/URLEscape.cpp b/JavaScriptCore/wtf/url/src/URLEscape.cpp
new file mode 100644
index 0000000..2987343
--- /dev/null
+++ b/JavaScriptCore/wtf/url/src/URLEscape.cpp
@@ -0,0 +1,39 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "config.h"
+#include "URLEscape.h"
+
+namespace WTF {
+
+const char hexCharacterTable[16] = {
+    '0', '1', '2', '3', '4', '5', '6', '7',
+    '8', '9', 'A', 'B', 'C', 'D', 'E', 'F',
+};
+
+}
diff --git a/JavaScriptCore/wtf/url/src/URLEscape.h b/JavaScriptCore/wtf/url/src/URLEscape.h
new file mode 100644
index 0000000..cc2b77f
--- /dev/null
+++ b/JavaScriptCore/wtf/url/src/URLEscape.h
@@ -0,0 +1,49 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#ifndef URLEscape_h
+#define URLEscape_h
+
+#include "URLBuffer.h"
+
+namespace WTF {
+
+extern const char hexCharacterTable[16];
+
+template<typename InChar, typename OutChar>
+inline void appendURLEscapedCharacter(InChar ch, URLBuffer<OutChar>& buffer)
+{
+    buffer.append('%');
+    buffer.append(hexCharacterTable[ch >> 4]);
+    buffer.append(hexCharacterTable[ch & 0xf]);
+}
+
+}
+
+#endif
diff --git a/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h b/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h
new file mode 100644
index 0000000..7740200
--- /dev/null
+++ b/JavaScriptCore/wtf/url/src/URLQueryCanonicalizer.h
@@ -0,0 +1,107 @@
+// Copyright 2010, Google Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following disclaimer
+// in the documentation and/or other materials provided with the
+// distribution.
+//     * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived from
+// this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#ifndef URLQueryCanonicalizer_h
+#define URLQueryCanonicalizer_h
+
+#include "RawURLBuffer.h"
+#include "URLBuffer.h"
+#include "URLCharacterTypes.h"
+#include "URLComponent.h"
+#include "URLEscape.h"
+
+namespace WTF {
+
+template<typename InChar, typename OutChar, void convertCharset(const InChar*, int length, URLBuffer<char>&)>
+class URLQueryCanonicalizer {
+public:
+    static void canonicalize(const InChar* spec, const URLComponent& query, URLBuffer<OutChar>& buffer, URLComponent& resultQuery)
+    {
+        if (query.length() < 0) {
+            resultQuery = URLComponent();
+            return;
+        }
+
+        buffer->append('?');
+        resultQuery.setBegin(buffer->length());
+        convertToQueryEncoding(spec, query, buffer);
+        resultQuery.setLength(buffer->length() - resultQuery.begin());
+    }
+
+private:
+    static bool isAllASCII(const InChar* spec, const URLComponent& query)
+    {
+        int end = query.end();
+        for (int i = query.begin(); i < end; ++i) {
+            if (static_cast<unsigned>(spec[i]) >= 0x80)
+                return false;
+        }
+        return true;
+    }
+
+#ifndef NDEBUG
+    static bool isRaw8Bit(const InChar* source, int length)
+    {
+        for (int i = source; i < length; ++i) {
+            if (source[i] & 0xFF != source[i])
+                return false;
+        }
+        return true;
+    }
+#endif
+
+    static void appendRaw8BitQueryString(const InChar* source, int length, URLBuffer<OutChar>* buffer)
+    {
+        ASSERT(isRaw8Bit(source, length));
+        for (int i = 0; i < length; ++i) {
+            if (!URLCharacterTypes::isQueryChar(source[i]))
+                appendURLEscapedCharacter(static_cast<unsigned char>(source[i]), buffer);
+            else
+                buffer->append(static_cast<char>(source[i]));
+        }
+    }
+
+    static void convertToQueryEncoding(const InChar* spec, const URLComponent& query, URLBuffer<OutChar>& buffer)
+    {
+        if (isAllASCII(spec, query)) {
+            appendRaw8BitQueryString(&spec[query.begin()], query.length(), buffer);
+            return;
+        }
+
+        RawURLBuffer<char, 1024> convertedQuery;
+        convertCharset(spec, query, convertedQuery);
+        appendRaw8BitQueryString(convertedQuery.data(), convertedQuery.length(), buffer);
+    }
+};
+
+}
+
+#endif
+
+
diff --git a/JavaScriptCore/wtf/wtf.pri b/JavaScriptCore/wtf/wtf.pri
index 84ac20e..83e71d8 100644
--- a/JavaScriptCore/wtf/wtf.pri
+++ b/JavaScriptCore/wtf/wtf.pri
@@ -6,6 +6,7 @@ SOURCES += \
     wtf/CurrentTime.cpp \
     wtf/DateMath.cpp \
     wtf/dtoa.cpp \
+    wtf/DecimalNumber.cpp \
     wtf/FastMalloc.cpp \
     wtf/HashTable.cpp \
     wtf/MD5.cpp \
@@ -22,6 +23,7 @@ SOURCES += \
     wtf/WTFThreadData.cpp \
     wtf/text/AtomicString.cpp \
     wtf/text/CString.cpp \
+    wtf/text/StringBuilder.cpp \
     wtf/text/StringImpl.cpp \
     wtf/text/StringStatics.cpp \
     wtf/text/WTFString.cpp \
diff --git a/JavaScriptCore/yarr/RegexInterpreter.cpp b/JavaScriptCore/yarr/RegexInterpreter.cpp
index 17ffd8f..33f3c89 100644
--- a/JavaScriptCore/yarr/RegexInterpreter.cpp
+++ b/JavaScriptCore/yarr/RegexInterpreter.cpp
@@ -313,10 +313,24 @@ public:
         if (!input.checkInput(matchSize))
             return false;
 
-        for (int i = 0; i < matchSize; ++i) {
-            if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
-                input.uncheckInput(matchSize);
-                return false;
+        if (pattern->m_ignoreCase) {
+            for (int i = 0; i < matchSize; ++i) {
+                int ch = input.reread(matchBegin + i);
+
+                int lo = Unicode::toLower(ch);
+                int hi = Unicode::toUpper(ch);
+
+                if ((lo != hi) ? (!checkCasedCharacter(lo, hi, inputOffset - matchSize + i)) : (!checkCharacter(ch, inputOffset - matchSize + i))) {
+                    input.uncheckInput(matchSize);
+                    return false;
+                }
+            }
+        } else {
+            for (int i = 0; i < matchSize; ++i) {
+                if (!checkCharacter(input.reread(matchBegin + i), inputOffset - matchSize + i)) {
+                    input.uncheckInput(matchSize);
+                    return false;
+                }
             }
         }
 
@@ -481,6 +495,13 @@ public:
 
         int matchBegin = output[(term.atom.subpatternId << 1)];
         int matchEnd = output[(term.atom.subpatternId << 1) + 1];
+
+        // If the end position of the referenced match hasn't set yet then the backreference in the same parentheses where it references to that.
+        // In this case the result of match is empty string like when it references to a parentheses with zero-width match.
+        // Eg.: /(a\1)/
+        if (matchEnd == -1)
+            return true;
+
         ASSERT((matchBegin == -1) == (matchEnd == -1));
         ASSERT(matchBegin <= matchEnd);
 
@@ -1497,7 +1518,7 @@ public:
         m_currentAlternativeIndex = newAlternativeIndex;
     }
 
-    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0)
+    void emitDisjunction(PatternDisjunction* disjunction, unsigned inputCountAlreadyChecked = 0, unsigned parenthesesInputCountAlreadyChecked = 0, bool isParentheticalAssertion = false)
     {
         for (unsigned alt = 0; alt < disjunction->m_alternatives.size(); ++alt) {
             unsigned currentCountAlreadyChecked = inputCountAlreadyChecked;
@@ -1512,12 +1533,18 @@ public:
             }
 
             unsigned minimumSize = alternative->m_minimumSize;
+            int countToCheck;
 
-            ASSERT(minimumSize >= parenthesesInputCountAlreadyChecked);
-            unsigned countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
-            if (countToCheck)
+            if (isParentheticalAssertion && parenthesesInputCountAlreadyChecked > minimumSize)
+                countToCheck = 0;
+            else
+                countToCheck = minimumSize - parenthesesInputCountAlreadyChecked;
+
+            ASSERT(countToCheck >= 0);
+            if (countToCheck) {
                 checkInput(countToCheck);
-            currentCountAlreadyChecked += countToCheck;
+                currentCountAlreadyChecked += countToCheck;
+            }
 
             for (unsigned i = 0; i < alternative->m_terms.size(); ++i) {
                 PatternTerm& term = alternative->m_terms[i];
@@ -1577,8 +1604,11 @@ public:
                 case PatternTerm::TypeParentheticalAssertion: {
                     unsigned alternativeFrameLocation = term.frameLocation + RegexStackSpaceForBackTrackInfoParentheticalAssertion;
 
+                    ASSERT(currentCountAlreadyChecked >= (unsigned)term.inputPosition);
+                    int positiveInputOffset = currentCountAlreadyChecked - term.inputPosition;
+
                     atomParentheticalAssertionBegin(term.parentheses.subpatternId, term.invertOrCapture, term.frameLocation, alternativeFrameLocation);
-                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, 0);
+                    emitDisjunction(term.parentheses.disjunction, currentCountAlreadyChecked, positiveInputOffset, true);
                     atomParenthesesEnd(true, term.parentheses.lastSubpatternId, 0, term.frameLocation, term.quantityCount, term.quantityType);
                     break;
                 }
diff --git a/JavaScriptGlue/ChangeLog b/JavaScriptGlue/ChangeLog
index 3a50e56..4da0a9b 100644
--- a/JavaScriptGlue/ChangeLog
+++ b/JavaScriptGlue/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename StringHasherFunctions.h to StringHasher.h
+        https://bugs.webkit.org/show_bug.cgi?id=47200
+
+        * ForwardingHeaders/wtf/StringHashFunctions.h: Removed.
+        * ForwardingHeaders/wtf/StringHasher.h: Copied from JavaScriptGlue/ForwardingHeaders/wtf/StringHashFunctions.h.
+
 2010-09-09  Michael Saboff  <msaboff@apple.com>
 
         Reviewed by Gavin Barraclough.
diff --git a/JavaScriptGlue/Configurations/Version.xcconfig b/JavaScriptGlue/Configurations/Version.xcconfig
index f688ea8..35ae251 100644
--- a/JavaScriptGlue/Configurations/Version.xcconfig
+++ b/JavaScriptGlue/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 10;
+MINOR_VERSION = 11;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/StringHashFunctions.h b/JavaScriptGlue/ForwardingHeaders/wtf/StringHashFunctions.h
deleted file mode 100644
index e903ddd..0000000
--- a/JavaScriptGlue/ForwardingHeaders/wtf/StringHashFunctions.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/StringHashFunctions.h>
diff --git a/JavaScriptGlue/ForwardingHeaders/wtf/StringHasher.h b/JavaScriptGlue/ForwardingHeaders/wtf/StringHasher.h
new file mode 100644
index 0000000..1380335
--- /dev/null
+++ b/JavaScriptGlue/ForwardingHeaders/wtf/StringHasher.h
@@ -0,0 +1 @@
+#include <JavaScriptCore/StringHasher.h>
diff --git a/LayoutTests/fast/dom/DeviceMotion/no-page-cache-expected.txt b/LayoutTests/fast/dom/DeviceMotion/no-page-cache-expected.txt
new file mode 100644
index 0000000..1dee7cd
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceMotion/no-page-cache-expected.txt
@@ -0,0 +1,14 @@
+Tests that pages that use DeviceMotion are not put in the page cache.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Main page opening resources/cached-page-1.html
+resources/cached-page-1.html onload fired, count = 1
+resources/cached-page-1.html about to navigate to resources/cached-page-2.html
+resources/cached-page-2.html about to go back to resources/cached-page-1.html
+resources/cached-page-1.html onload fired, count = 2
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/DeviceMotion/no-page-cache.html b/LayoutTests/fast/dom/DeviceMotion/no-page-cache.html
new file mode 100644
index 0000000..2e09eac
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceMotion/no-page-cache.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/no-page-cache.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-1.html b/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-1.html
new file mode 100644
index 0000000..759fbf9
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-1.html
@@ -0,0 +1,11 @@
+<script>
+function loadNext() {
+    window.addEventListener('devicemotion', function() {});
+    if (window.opener.reportPageOneOnload() == 1) {
+        window.opener.debug('resources/cached-page-1.html about to navigate to resources/cached-page-2.html')
+        // Location changes need to happen outside the onload handler to generate history entries.
+        setTimeout(function() { location.href = 'cached-page-2.html'; }, 0);
+    }
+}
+</script>
+<body onload="loadNext()"></body>
diff --git a/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-2.html b/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-2.html
new file mode 100644
index 0000000..5478f9c
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceMotion/resources/cached-page-2.html
@@ -0,0 +1,8 @@
+<script>
+function init() {
+    window.opener.pageTwoLoaded = true;
+    window.opener.debug('resources/cached-page-2.html about to go back to resources/cached-page-1.html');
+    history.back();
+}
+</script>
+<body onload="init()"></body>
diff --git a/LayoutTests/fast/dom/DeviceMotion/script-tests/no-page-cache.js b/LayoutTests/fast/dom/DeviceMotion/script-tests/no-page-cache.js
new file mode 100644
index 0000000..67cfcf6
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceMotion/script-tests/no-page-cache.js
@@ -0,0 +1,24 @@
+description('Tests that pages that use DeviceMotion are not put in the page cache.');
+
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.overridePreference('WebKitUsesPageCachePreferenceKey', 1);
+} else
+    debug('This test can not be run without the LayoutTestController');
+
+var pageOneOnloadCount = 0;
+function reportPageOneOnload() {
+    ++pageOneOnloadCount;
+    debug('resources/cached-page-1.html onload fired, count = ' + pageOneOnloadCount);
+    if (pageOneOnloadCount == 2) {
+        finishJSTest();
+    }
+    return pageOneOnloadCount;
+}
+
+debug("Main page opening resources/cached-page-1.html");
+window.open("resources/cached-page-1.html");
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange-expected.txt b/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange-expected.txt
new file mode 100644
index 0000000..0f0aac6
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange-expected.txt
@@ -0,0 +1,16 @@
+Tests that document.createEvent() works with orientationChange
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+
+FAIL... orientationChange event doesn't appear to be enabled or implemented.
+
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
+
+
+
diff --git a/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange.html b/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange.html
new file mode 100644
index 0000000..7a033e0
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/create-event-onorientationchange.html
@@ -0,0 +1,13 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></p>
+<div id="result"></div>
+<script src="script-tests/create-event-onorientationchange.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation-expected.txt b/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation-expected.txt
new file mode 100644
index 0000000..8e6bc39
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation-expected.txt
@@ -0,0 +1,3 @@
+Tests for a crash where an event is fired after the page has been navigated away when the original page is in the page cache.
+
+SUCCESS
diff --git a/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation.html b/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation.html
new file mode 100644
index 0000000..ced3703
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/event-after-navigation.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/event-after-navigation.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/no-page-cache-expected.txt b/LayoutTests/fast/dom/DeviceOrientation/no-page-cache-expected.txt
new file mode 100644
index 0000000..0217208
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/no-page-cache-expected.txt
@@ -0,0 +1,14 @@
+Tests that pages that use DeviceOrientation are not put in the page cache.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Main page opening resources/cached-page-1.html
+resources/cached-page-1.html onload fired, count = 1
+resources/cached-page-1.html about to navigate to resources/cached-page-2.html
+resources/cached-page-2.html about to go back to resources/cached-page-1.html
+resources/cached-page-1.html onload fired, count = 2
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/DeviceOrientation/no-page-cache.html b/LayoutTests/fast/dom/DeviceOrientation/no-page-cache.html
new file mode 100644
index 0000000..2e09eac
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/no-page-cache.html
@@ -0,0 +1,12 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/no-page-cache.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-1.html b/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-1.html
new file mode 100644
index 0000000..2d76889
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-1.html
@@ -0,0 +1,11 @@
+<script>
+function loadNext() {
+    window.addEventListener('deviceorientation', function() {});
+    if (window.opener.reportPageOneOnload() == 1) {
+        window.opener.debug('resources/cached-page-1.html about to navigate to resources/cached-page-2.html')
+        // Location changes need to happen outside the onload handler to generate history entries.
+        setTimeout(function() { location.href = 'cached-page-2.html'; }, 0);
+    }
+}
+</script>
+<body onload="loadNext()"></body>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-2.html b/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-2.html
new file mode 100644
index 0000000..5478f9c
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/resources/cached-page-2.html
@@ -0,0 +1,8 @@
+<script>
+function init() {
+    window.opener.pageTwoLoaded = true;
+    window.opener.debug('resources/cached-page-2.html about to go back to resources/cached-page-1.html');
+    history.back();
+}
+</script>
+<body onload="init()"></body>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/resources/event-after-navigation-new.html b/LayoutTests/fast/dom/DeviceOrientation/resources/event-after-navigation-new.html
new file mode 100644
index 0000000..157e050
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/resources/event-after-navigation-new.html
@@ -0,0 +1,15 @@
+<html>
+  <head>
+  </head>
+  <body>
+    Tests for a crash where an event is fired after the page has been navigated
+    away when the original page is in the page cache.<br><br>
+    SUCCESS
+    <script>
+      if (window.layoutTestController) {
+          layoutTestController.setMockDeviceOrientation(true, 1.1, true, 2.2, true, 3.3);
+          layoutTestController.notifyDone();
+      }
+    </script>
+  </body>
+</html>
diff --git a/LayoutTests/fast/dom/DeviceOrientation/script-tests/create-event-onorientationchange.js b/LayoutTests/fast/dom/DeviceOrientation/script-tests/create-event-onorientationchange.js
new file mode 100644
index 0000000..a63685b
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/script-tests/create-event-onorientationchange.js
@@ -0,0 +1,18 @@
+description('Tests that document.createEvent() works with orientationChange')
+
+function handleOrientationChange()
+{
+    document.getElementById('result').innerHTML = "PASS";
+}
+
+window.addEventListener('onorientationchange', handleOrientationChange, false);
+
+try {
+    var event = document.createEvent("OrientationEvent");
+    event.initEvent("orientationchange", false, false);
+    window.dispatchEvent(event);
+} catch(e) {
+    document.getElementById('result').innerHTML = "FAIL... orientationChange event doesn't appear to be enabled or implemented.";
+}
+
+window.successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/DeviceOrientation/script-tests/event-after-navigation.js b/LayoutTests/fast/dom/DeviceOrientation/script-tests/event-after-navigation.js
new file mode 100644
index 0000000..2756e55
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/script-tests/event-after-navigation.js
@@ -0,0 +1,12 @@
+description('Tests for a crash where an event is fired after the page has been navigated away when the original page is in the page cache.');
+
+if (window.layoutTestController)
+    layoutTestController.overridePreference('WebKitUsesPageCachePreferenceKey', 1);
+else
+    debug('This test can not be run without the LayoutTestController');
+
+window.addEventListener('deviceorientation', function() { } );
+window.location = "resources/event-after-navigation-new.html";
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/DeviceOrientation/script-tests/no-page-cache.js b/LayoutTests/fast/dom/DeviceOrientation/script-tests/no-page-cache.js
new file mode 100644
index 0000000..cbfb501
--- /dev/null
+++ b/LayoutTests/fast/dom/DeviceOrientation/script-tests/no-page-cache.js
@@ -0,0 +1,24 @@
+description('Tests that pages that use DeviceOrientation are not put in the page cache.');
+
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.setCanOpenWindows();
+    layoutTestController.overridePreference('WebKitUsesPageCachePreferenceKey', 1);
+} else
+    debug('This test can not be run without the LayoutTestController');
+
+var pageOneOnloadCount = 0;
+function reportPageOneOnload() {
+    ++pageOneOnloadCount;
+    debug('resources/cached-page-1.html onload fired, count = ' + pageOneOnloadCount);
+    if (pageOneOnloadCount == 2) {
+        finishJSTest();
+    }
+    return pageOneOnloadCount;
+}
+
+debug("Main page opening resources/cached-page-1.html");
+window.open("resources/cached-page-1.html");
+
+window.jsTestIsAsync = true;
+window.successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-prevents-rebase.js b/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-prevents-rebase.js
new file mode 100644
index 0000000..139a9e5
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLAnchorElement/script-tests/set-href-attribute-prevents-rebase.js
@@ -0,0 +1,118 @@
+description('Tests that when an href attribute is set, the href is no longer subject to updates to the document base URI.');
+
+var a = document.createElement('a');
+var base = document.createElement('base');
+document.head.appendChild(base);
+
+
+debug("Search attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "?search";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://new_base/?search'");
+
+debug("Search attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "?foo";
+a.search = "search";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://old_base/?search'");
+debug('');
+
+
+debug("Pathname attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "path";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://new_base/path'");
+
+debug("Pathname attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "foo";
+a.pathname = "path";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://old_base/path'");
+debug('');
+
+
+debug("Hash attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "#hash";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://new_base/#hash'");
+
+debug("Pathname attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "#foo";
+a.hash = "hash";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://old_base/#hash'");
+debug('');
+
+
+debug('Note that for the following attributes, updating the document base URI has no effect because we have to use an abosulte URL for the href in order to set an initial value for the attribute we wish to update. They are included for completeness.');
+debug('');
+
+
+debug("Host attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "http://host:0";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host:0/'");
+
+debug("Host attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "http://foo:80";
+a.host = "host:0";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host:0/'");
+debug('');
+
+
+debug("Hostname attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "http://host";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host/'");
+
+debug("Hostname attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "http://foo";
+a.hostname = "host";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host/'");
+debug('');
+
+
+debug("Protocol attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "protocol:";
+base.href = "http://new_base/";
+shouldBe("a.href", "'protocol:'");
+
+debug("Protocol attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "foo:";
+a.protocol = "protocol:";
+base.href = "http://new_base/";
+shouldBe("a.href", "'protocol:'");
+debug('');
+
+
+debug("Port attribute, update document base URI without attribute having been set");
+base.href = "http://old_base/";
+a.href = "http://host:0";
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host:0/'");
+
+debug("Port attribute, update document base URI after attribute has been set");
+base.href = "http://old_base/";
+a.href = "http://host:80";
+a.port = 0;
+base.href = "http://new_base/";
+shouldBe("a.href", "'http://host:0/'");
+debug('');
+
+
+base.href = '';
+var successfullyParsed = true;
diff --git a/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase-expected.txt b/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase-expected.txt
new file mode 100644
index 0000000..c7de5cb
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase-expected.txt
@@ -0,0 +1,46 @@
+Tests that when an href attribute is set, the href is no longer subject to updates to the document base URI.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+Search attribute, update document base URI without attribute having been set
+PASS a.href is 'http://new_base/?search'
+Search attribute, update document base URI after attribute has been set
+PASS a.href is 'http://old_base/?search'
+
+Pathname attribute, update document base URI without attribute having been set
+PASS a.href is 'http://new_base/path'
+Pathname attribute, update document base URI after attribute has been set
+PASS a.href is 'http://old_base/path'
+
+Hash attribute, update document base URI without attribute having been set
+PASS a.href is 'http://new_base/#hash'
+Pathname attribute, update document base URI after attribute has been set
+PASS a.href is 'http://old_base/#hash'
+
+Note that for the following attributes, updating the document base URI has no effect because we have to use an abosulte URL for the href in order to set an initial value for the attribute we wish to update. They are included for completeness.
+
+Host attribute, update document base URI without attribute having been set
+PASS a.href is 'http://host:0/'
+Host attribute, update document base URI after attribute has been set
+PASS a.href is 'http://host:0/'
+
+Hostname attribute, update document base URI without attribute having been set
+PASS a.href is 'http://host/'
+Hostname attribute, update document base URI after attribute has been set
+PASS a.href is 'http://host/'
+
+Protocol attribute, update document base URI without attribute having been set
+PASS a.href is 'protocol:'
+Protocol attribute, update document base URI after attribute has been set
+PASS a.href is 'protocol:'
+
+Port attribute, update document base URI without attribute having been set
+PASS a.href is 'http://host:0/'
+Port attribute, update document base URI after attribute has been set
+PASS a.href is 'http://host:0/'
+
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase.html b/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase.html
new file mode 100644
index 0000000..bfc1c29
--- /dev/null
+++ b/LayoutTests/fast/dom/HTMLAnchorElement/set-href-attribute-prevents-rebase.html
@@ -0,0 +1,13 @@
+<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
+<html>
+<head>
+<link rel="stylesheet" href="../../js/resources/js-test-style.css">
+<script src="../../js/resources/js-test-pre.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script src="script-tests/set-href-attribute-prevents-rebase.js"></script>
+<script src="../../js/resources/js-test-post.js"></script>
+</body>
+</html>
diff --git a/LayoutTests/fast/js/resources/fs-test-post.js b/LayoutTests/fast/js/resources/fs-test-post.js
new file mode 100644
index 0000000..6d84656
--- /dev/null
+++ b/LayoutTests/fast/js/resources/fs-test-post.js
@@ -0,0 +1,6 @@
+wasPostTestScriptParsed = true;
+
+if (window.layoutTestController)
+    layoutTestController.waitUntilDone();
+if (window.wasFinishJSTestCalled)
+    finishJSTest();
diff --git a/LayoutTests/fast/js/resources/js-test-pre.js b/LayoutTests/fast/js/resources/js-test-pre.js
index 87db5d4..3536a89 100644
--- a/LayoutTests/fast/js/resources/js-test-pre.js
+++ b/LayoutTests/fast/js/resources/js-test-pre.js
@@ -124,7 +124,7 @@ function shouldBeNull(_a) { shouldBe(_a, "null"); }
 
 function shouldBeEqualToString(a, b)
 {
-  var unevaledString = '"' + b.replace(/\\/g, "\\\\").replace(/"/g, "\"") + '"';
+  var unevaledString = '"' + b.replace(/\\/g, "\\\\").replace(/"/g, "\"").replace(/\n/g, "\\n").replace(/\r/g, "\\r") + '"';
   shouldBe(a, unevaledString);
 }
 
diff --git a/LayoutTests/fast/url/query-expected.txt b/LayoutTests/fast/url/query-expected.txt
index 9941416..e4816a5 100644
--- a/LayoutTests/fast/url/query-expected.txt
+++ b/LayoutTests/fast/url/query-expected.txt
@@ -5,7 +5,7 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 PASS canonicalize('http://www.example.com/?foo=bar') is 'http://www.example.com/?foo=bar'
 PASS canonicalize('http://www.example.com/?as?df') is 'http://www.example.com/?as?df'
-FAIL canonicalize('http://www.example.com/?\x02hello bye') should be http://www.example.com/?%02hello%7F%20bye. Was http://www.example.com/?hello%7F%20bye.
+PASS canonicalize('http://www.example.com/?\x02hello bye') is 'http://www.example.com/?%02hello%7F%20bye'
 PASS canonicalize('http://www.example.com/?%40%41123') is 'http://www.example.com/?%40%41123'
 PASS canonicalize('http://www.example.com/?q=你好') is 'http://www.example.com/?q=%26%2320320%3B%26%2322909%3B'
 PASS canonicalize('http://www.example.com/?q=\ud800\ud800') is 'http://www.example.com/?q=%26%2355296%3B%26%2355296%3B'
diff --git a/LayoutTests/fast/url/script-tests/segments-from-data-url.js b/LayoutTests/fast/url/script-tests/segments-from-data-url.js
index 8fc3013..5c4ae02 100644
--- a/LayoutTests/fast/url/script-tests/segments-from-data-url.js
+++ b/LayoutTests/fast/url/script-tests/segments-from-data-url.js
@@ -14,7 +14,7 @@ cases = [
   ["http://f:00000000000000000000080/c",     ["http:","f","0","/c","",""]],
   ["http://f:b/c",                           [":","","0","","",""]],
   ["http://f: /c",                           [":","","0","","",""]],
-  ["http://f:\\n/c",                         ["http:","f","0","/c","",""]],
+  ["http://f:\\n/c",                         [":","","0","","",""]],
   ["http://f:fifty-two/c",                   [":","","0","","",""]],
   ["http://f:999999/c",                      [":","","0","","",""]],
   ["http://f: 21 / b ? d # e ",              [":","","0","","",""]],
diff --git a/LayoutTests/fast/url/script-tests/segments.js b/LayoutTests/fast/url/script-tests/segments.js
index c0c6fa1..c621da1 100644
--- a/LayoutTests/fast/url/script-tests/segments.js
+++ b/LayoutTests/fast/url/script-tests/segments.js
@@ -14,7 +14,7 @@ cases = [
   ["http://f:00000000000000000000080/c",     ["http:","f","0","/c","",""]],
   ["http://f:b/c",                           [":","","0","","",""]],
   ["http://f: /c",                           [":","","0","","",""]],
-  ["http://f:\\n/c",                         ["http:","f","0","/c","",""]],
+  ["http://f:\\n/c",                         [":","","0","","",""]],
   ["http://f:fifty-two/c",                   [":","","0","","",""]],
   ["http://f:999999/c",                      [":","","0","","",""]],
   ["http://f: 21 / b ? d # e ",              [":","","0","","",""]],
diff --git a/LayoutTests/fast/url/segments-expected.txt b/LayoutTests/fast/url/segments-expected.txt
index 3833f36..2da6912 100644
--- a/LayoutTests/fast/url/segments-expected.txt
+++ b/LayoutTests/fast/url/segments-expected.txt
@@ -15,7 +15,7 @@ PASS segments('http://f:00000000000000/c') is '["http:","f","0","/c","",""]'
 FAIL segments('http://f:00000000000000000000080/c') should be ["http:","f","0","/c","",""]. Was ["http:","f","80","/c","",""].
 PASS segments('http://f:b/c') is '[":","","0","","",""]'
 PASS segments('http://f: /c') is '[":","","0","","",""]'
-PASS segments('http://f:\n/c') is '["http:","f","0","/c","",""]'
+PASS segments('http://f:\n/c') is '[":","","0","","",""]'
 PASS segments('http://f:fifty-two/c') is '[":","","0","","",""]'
 FAIL segments('http://f:999999/c') should be [":","","0","","",""]. Was ["http:","f","65535","/c","",""].
 PASS segments('http://f: 21 / b ? d # e ') is '[":","","0","","",""]'
diff --git a/LayoutTests/fast/url/segments-from-data-url-expected.txt b/LayoutTests/fast/url/segments-from-data-url-expected.txt
index 5d102ef..6e1853e 100644
--- a/LayoutTests/fast/url/segments-from-data-url-expected.txt
+++ b/LayoutTests/fast/url/segments-from-data-url-expected.txt
@@ -15,7 +15,7 @@ PASS segments('http://f:00000000000000/c') is '["http:","f","0","/c","",""]'
 FAIL segments('http://f:00000000000000000000080/c') should be ["http:","f","0","/c","",""]. Was ["http:","f","80","/c","",""].
 PASS segments('http://f:b/c') is '[":","","0","","",""]'
 PASS segments('http://f: /c') is '[":","","0","","",""]'
-PASS segments('http://f:\n/c') is '["http:","f","0","/c","",""]'
+PASS segments('http://f:\n/c') is '[":","","0","","",""]'
 PASS segments('http://f:fifty-two/c') is '[":","","0","","",""]'
 FAIL segments('http://f:999999/c') should be [":","","0","","",""]. Was ["http:","f","65535","/c","",""].
 PASS segments('http://f: 21 / b ? d # e ') is '[":","","0","","",""]'
diff --git a/LayoutTests/http/tests/appcache/document-write-html-element-2-expected.txt b/LayoutTests/http/tests/appcache/document-write-html-element-2-expected.txt
new file mode 100644
index 0000000..32581f4
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/document-write-html-element-2-expected.txt
@@ -0,0 +1,2 @@
+SUCCESS, no assertion failure
+applicationCache.status == 1
diff --git a/LayoutTests/http/tests/appcache/document-write-html-element-2.html b/LayoutTests/http/tests/appcache/document-write-html-element-2.html
new file mode 100644
index 0000000..bee9fe0
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/document-write-html-element-2.html
@@ -0,0 +1,19 @@
+<html manifest="resources/document-write-html-element.manifest">
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function test()
+{
+    document.write("SUCCESS, no assertion failure");
+    document.write("<br>applicationCache.status == " + applicationCache.status);
+
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+}
+
+applicationCache.oncached = test;
+applicationCache.onnoupdate = test;
+</script>
diff --git a/LayoutTests/http/tests/appcache/document-write-html-element-expected.txt b/LayoutTests/http/tests/appcache/document-write-html-element-expected.txt
new file mode 100644
index 0000000..08dccd3
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/document-write-html-element-expected.txt
@@ -0,0 +1 @@
+DONE. Passed if there were no alerts displayed.
diff --git a/LayoutTests/http/tests/appcache/document-write-html-element.html b/LayoutTests/http/tests/appcache/document-write-html-element.html
new file mode 100644
index 0000000..83954bb
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/document-write-html-element.html
@@ -0,0 +1,26 @@
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+window.onload = function()
+{
+    document.write("<html manifest='resources/document-write-html-element.manifest'>");
+    applicationCache.oncached = function() {
+        alert("FAIL: appcache cached");
+    }
+    applicationCache.onnoupdate = function() {
+        alert("FAIL: appcache noupdate");
+    }
+    applicationCache.onerror = function() {
+        alert("FAIL: appcache error");
+    }
+
+    setTimeout(function() {
+        document.write("DONE. Passed if there were no alerts displayed.");
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }, 100);
+}
+</script>
diff --git a/LayoutTests/http/tests/appcache/fail-on-update-2-expected.txt b/LayoutTests/http/tests/appcache/fail-on-update-2-expected.txt
new file mode 100644
index 0000000..cd15247
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/fail-on-update-2-expected.txt
@@ -0,0 +1 @@
+SUCCESS: No crash.
diff --git a/LayoutTests/http/tests/appcache/fail-on-update-2.html b/LayoutTests/http/tests/appcache/fail-on-update-2.html
new file mode 100644
index 0000000..fcbc3dd
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/fail-on-update-2.html
@@ -0,0 +1,64 @@
+<html manifest="resources/fail-on-update-2.php">
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+function setManifestDeleted(state)
+{
+    var req = new XMLHttpRequest;
+    req.open("GET", "resources/fail-on-update.php?command=" + (state ? "delete" : "reset"), false);
+    req.send(null);
+}
+
+function test()
+{
+    clearTimeout(timeoutId);
+
+    setManifestDeleted(true);
+    applicationCache.update();
+    
+    // Create two subframes at different times to make hitting the race condition more likely.
+    var ifr = document.createElement("iframe");
+    ifr.setAttribute("src", 'resources/fail-on-update-2.html');
+    document.body.appendChild(ifr);
+
+    setTimeout(function() {
+        var ifr = document.createElement("iframe");
+        ifr.setAttribute("src", 'resources/fail-on-update-2.html');
+        document.body.appendChild(ifr);
+    }, 0);
+}
+
+var subframesLeft = 2;
+function subframeLoaded()
+{
+    if (!--subframesLeft) {
+        document.write('<p>SUCCESS: No crash.</p>');
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }
+}
+
+function resetManifest()
+{
+    if (applicationCache.status != applicationCache.UNCACHED && applicationCache.status != applicationCache.OBSOLETE) {
+        timeoutId = setTimeout(resetManifest, 100);
+        return;
+    }
+
+    setManifestDeleted(false);
+    location.reload();
+}
+
+applicationCache.addEventListener('noupdate', function() { setTimeout(test, 0) }, false);
+applicationCache.addEventListener('cached', function() { setTimeout(test, 0) }, false);
+
+// If the manifest script happened to be in a wrong state, reset it.
+var timeoutId = setTimeout(resetManifest, 100);
+
+</script>
+<p>Test for a particular incorrect assertion failure.</p>
+
+</html>
diff --git a/LayoutTests/http/tests/appcache/foreign-fallback-expected.txt b/LayoutTests/http/tests/appcache/foreign-fallback-expected.txt
new file mode 100644
index 0000000..dded924
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/foreign-fallback-expected.txt
@@ -0,0 +1,6 @@
+Test for bug 44406: Application Cache crash when a fallback document has a manifest URL.
+
+PASS
+The frame below should display a Not Found error - the fallback entry is foreign, so it shouldn't be used for main resource.
+
+
diff --git a/LayoutTests/http/tests/appcache/foreign-fallback.html b/LayoutTests/http/tests/appcache/foreign-fallback.html
new file mode 100644
index 0000000..7a80046
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/foreign-fallback.html
@@ -0,0 +1,48 @@
+<html manifest="resources/foreign-fallback.manifest">
+<body>
+<p>Test for <a href="https://bugs.webkit.org/show_bug.cgi?id=44406">bug 44406</a>:
+Application Cache crash when a fallback document has a manifest URL.</p>
+<div id="result">Testing...</div>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+
+applicationCache.addEventListener('cached', test, false);
+applicationCache.addEventListener('noupdate', test, false);
+
+function test()
+{
+    var ifr = document.createElement("iframe");
+    ifr.setAttribute("src", "resources/foreign-fallback/does-not-exist.html");
+    document.body.appendChild(ifr);
+
+    // I couldn't find any event that would fire on frame loading failure, so let's poll.
+    setTimeout(frameDone, 100);
+}
+
+function frameDone()
+{
+    try {
+        var frameContent = frames[0].document.documentElement.innerHTML;
+        if (frameContent.match("Not Found"))
+            document.getElementById("result").innerHTML = "PASS";
+        else if (frameContent.match("FAIL"))
+            document.getElementById("result").innerHTML = "FAIL";
+        else
+            throw "Try again";
+
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    } catch (ex) {
+        // Not done yet.
+        setTimeout(frameDone, 100);
+    }
+}
+
+</script>
+<p>The frame below should display a Not Found error - the fallback entry is foreign, so it shouldn't be used for main resource.</p>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2-expected.txt b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2-expected.txt
new file mode 100644
index 0000000..08dccd3
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2-expected.txt
@@ -0,0 +1 @@
+DONE. Passed if there were no alerts displayed.
diff --git a/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2.html b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2.html
new file mode 100644
index 0000000..539d28b
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-2.html
@@ -0,0 +1,30 @@
+<html>
+<div></div>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+var div = document.getElementsByTagName("div")[0];
+div.innerHTML = '<html manifest="resources/insert-html-element-with-manifest.manifest">'
+
+window.onload = function()
+{
+    applicationCache.oncached = function() {
+        alert("FAIL: appcache cached");
+    }
+    applicationCache.onnoupdate = function() {
+        alert("FAIL: appcache noupdate");
+    }
+    applicationCache.onerror = function() {
+        alert("FAIL: appcache error");
+    }
+
+    setTimeout(function() {
+        document.write("DONE. Passed if there were no alerts displayed.");
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }, 100);
+}
+</script>
diff --git a/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-expected.txt b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-expected.txt
new file mode 100644
index 0000000..08dccd3
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest-expected.txt
@@ -0,0 +1 @@
+DONE. Passed if there were no alerts displayed.
diff --git a/LayoutTests/http/tests/appcache/insert-html-element-with-manifest.html b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest.html
new file mode 100644
index 0000000..694392c
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/insert-html-element-with-manifest.html
@@ -0,0 +1,31 @@
+<html>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.dumpAsText();
+    layoutTestController.waitUntilDone();
+}
+
+document.removeChild(document.documentElement);
+var newHTML = document.createElement("html");
+newHTML.setAttribute("manifest", "resources/insert-html-element-with-manifest.manifest");
+document.appendChild(newHTML);
+
+window.onload = function()
+{
+    applicationCache.oncached = function() {
+        alert("FAIL: appcache cached");
+    }
+    applicationCache.onnoupdate = function() {
+        alert("FAIL: appcache noupdate");
+    }
+    applicationCache.onerror = function() {
+        alert("FAIL: appcache error");
+    }
+
+    setTimeout(function() {
+        document.write("DONE. Passed if there were no alerts displayed.");
+        if (window.layoutTestController)
+            layoutTestController.notifyDone();
+    }, 100);
+}
+</script>
diff --git a/LayoutTests/http/tests/appcache/main-resource-redirect-expected.txt b/LayoutTests/http/tests/appcache/main-resource-redirect-expected.txt
new file mode 100644
index 0000000..0a727f5
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/main-resource-redirect-expected.txt
@@ -0,0 +1,4 @@
+Test that application cache is consulted again after a redirect response.
+
+PASS
+
diff --git a/LayoutTests/http/tests/appcache/main-resource-redirect.html b/LayoutTests/http/tests/appcache/main-resource-redirect.html
new file mode 100644
index 0000000..3ede636
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/main-resource-redirect.html
@@ -0,0 +1,39 @@
+<html manifest="resources/main-resource-redirect.manifest">
+<body>
+<p>Test that application cache is consulted again after a redirect response.</p>
+<div id="result">Testing...</div>
+<script>
+if (window.layoutTestController) {
+    layoutTestController.waitUntilDone();
+    layoutTestController.dumpAsText();
+}
+
+function setNetworkEnabled(state)
+{
+    var req = new XMLHttpRequest;
+    req.open("GET", "/resources/network-simulator.php?command=" + (state ? "connect" : "disconnect"), false);
+    req.send("");
+}
+
+function test()
+{
+    applicationCache.oncached = null;
+    applicationCache.onnoupdate = null;
+    setNetworkEnabled(false);
+    var ifr = document.createElement("iframe");
+    ifr.setAttribute("src", "resources/main-resource-redirect-frame.php");
+    document.body.appendChild(ifr);
+}
+
+function done()
+{
+    if (window.layoutTestController)
+        layoutTestController.notifyDone();
+    setNetworkEnabled(true);
+}
+
+applicationCache.oncached=test;
+applicationCache.onnoupdate=test;
+applicationCache.onerror = function() { setNetworkEnabled(true); window.location.reload(); }
+</script>
+</body>
diff --git a/LayoutTests/http/tests/appcache/resources/document-write-html-element.manifest b/LayoutTests/http/tests/appcache/resources/document-write-html-element.manifest
new file mode 100644
index 0000000..af16a0e
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/document-write-html-element.manifest
@@ -0,0 +1 @@
+CACHE MANIFEST
diff --git a/LayoutTests/http/tests/appcache/resources/fail-on-update-2.html b/LayoutTests/http/tests/appcache/resources/fail-on-update-2.html
new file mode 100644
index 0000000..7e78de7
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/fail-on-update-2.html
@@ -0,0 +1,7 @@
+<html manifest="fail-on-update-2.php">
+<body>
+<script>
+    top.subframeLoaded();
+</script>
+</body>
+</html>
diff --git a/LayoutTests/http/tests/appcache/resources/fail-on-update-2.php b/LayoutTests/http/tests/appcache/resources/fail-on-update-2.php
new file mode 100644
index 0000000..4e11735
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/fail-on-update-2.php
@@ -0,0 +1,39 @@
+<?php
+require_once '../../resources/portabilityLayer.php';
+
+$tmpFile = sys_get_temp_dir() . "/" . "fail_on_update_state";
+
+function setState($newState, $file)
+{
+    file_put_contents($file, $newState);
+}
+
+function getState($file)
+{
+    if (!file_exists($file)) {
+        return "Uninitialized";
+    }
+    return file_get_contents($file);
+}
+
+$command = $_GET['command'];
+$state = getState($tmpFile);
+
+header("Expires: Thu, 01 Dec 2003 16:00:00 GMT");
+header("Cache-Control: no-cache, must-revalidate");
+header("Pragma: no-cache");
+
+if ($command == "reset") {
+    unlink($tmpFile);
+} else if ($command == "delete") {
+    setState("Deleted", $tmpFile);
+} else if ($state == "Uninitialized") {
+    header("Content-Type: text/cache-manifest");
+    print("CACHE MANIFEST\n");
+    print("fail-on-update-2.html\n");
+    print("NETWORK:\n");
+    print("fail-on-update.php?command=\n");
+} else if ($state == "Deleted") {
+    header('HTTP/1.0 404 Not Found');
+}
+?>
diff --git a/LayoutTests/http/tests/appcache/resources/foreign-fallback-fallback.html b/LayoutTests/http/tests/appcache/resources/foreign-fallback-fallback.html
new file mode 100644
index 0000000..9996bf6
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/foreign-fallback-fallback.html
@@ -0,0 +1,2 @@
+<html manifest="foobar.manifest">
+FAIL
diff --git a/LayoutTests/http/tests/appcache/resources/foreign-fallback.manifest b/LayoutTests/http/tests/appcache/resources/foreign-fallback.manifest
new file mode 100644
index 0000000..ddaf602
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/foreign-fallback.manifest
@@ -0,0 +1,4 @@
+CACHE MANIFEST
+
+FALLBACK:
+/appcache/resources/foreign-fallback/ foreign-fallback-fallback.html
diff --git a/LayoutTests/http/tests/appcache/resources/insert-html-element-with-manifest.manifest b/LayoutTests/http/tests/appcache/resources/insert-html-element-with-manifest.manifest
new file mode 100644
index 0000000..af16a0e
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/insert-html-element-with-manifest.manifest
@@ -0,0 +1 @@
+CACHE MANIFEST
diff --git a/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame-2.html b/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame-2.html
new file mode 100644
index 0000000..0acc1e2
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame-2.html
@@ -0,0 +1,6 @@
+<html manifest="http://127.0.0.1:8000/appcache/resources/main-resource-redirect.manifest">
+<script>
+parent.document.getElementById("result").innerHTML = (applicationCache.status) > 0 ? "PASS" : "FAIL: child frame status is UNCACHED";
+parent.done();
+
+</script>
diff --git a/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame.php b/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame.php
new file mode 100644
index 0000000..638057b
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/main-resource-redirect-frame.php
@@ -0,0 +1,4 @@
+<?php
+  header('HTTP/1.0 302 Found');
+  header('Location: http://127.0.0.1:8000/resources/network-simulator.php?path=/appcache/resources/main-resource-redirect-frame-2.html');
+?>
diff --git a/LayoutTests/http/tests/appcache/resources/main-resource-redirect.manifest b/LayoutTests/http/tests/appcache/resources/main-resource-redirect.manifest
new file mode 100644
index 0000000..beffe84
--- /dev/null
+++ b/LayoutTests/http/tests/appcache/resources/main-resource-redirect.manifest
@@ -0,0 +1,4 @@
+CACHE MANIFEST
+http://127.0.0.1:8000/resources/network-simulator.php?path=/appcache/resources/main-resource-redirect-frame-2.html
+NETWORK:
+http://127.0.0.1:8000/resources/network-simulator.php?command
diff --git a/LayoutTests/storage/indexeddb/basics-expected.txt b/LayoutTests/storage/indexeddb/basics-expected.txt
index 7632e40..b7b8b94 100644
--- a/LayoutTests/storage/indexeddb/basics-expected.txt
+++ b/LayoutTests/storage/indexeddb/basics-expected.txt
@@ -3,9 +3,9 @@ Test IndexedDB's basics.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS 'indexedDB' in window is true
-PASS indexedDB == null is false
-indexedDB.open('name', 'description')
+PASS 'webkitIndexedDB' in window is true
+PASS webkitIndexedDB == null is false
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -22,6 +22,12 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
+webkitIndexedDB.open('name');
+PASS Exception thrown.
+webkitIndexedDB.open('name', null);
+PASS Exception thrown.
+webkitIndexedDB.open('name', undefined);
+PASS Exception thrown.
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/LayoutTests/storage/indexeddb/basics.html b/LayoutTests/storage/indexeddb/basics.html
index 9f5f20f..2e382b2 100644
--- a/LayoutTests/storage/indexeddb/basics.html
+++ b/LayoutTests/storage/indexeddb/basics.html
@@ -14,25 +14,47 @@ description("Test IndexedDB's basics.");
 if (window.layoutTestController)
     layoutTestController.waitUntilDone();
 
-function openCallback()
-{
-    verifySuccessEvent(event);
-    done();
-}
-
 function test()
 {
-    shouldBeTrue("'indexedDB' in window");
-    shouldBeFalse("indexedDB == null");
+    shouldBeTrue("'webkitIndexedDB' in window");
+    shouldBeFalse("webkitIndexedDB == null");
 
     // FIXME: Verify other IndexedDatabaseRequest constructors, once they're implemented.
 
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
     result.onsuccess = openCallback;
-    result.onerror = unexpectedErrorCallback;
+    result.onerror = unexpectedErrorCallback;

+}

+

+function openCallback()

+{

+    verifySuccessEvent(event);

+    try {

+        debug("webkitIndexedDB.open('name');");

+        webkitIndexedDB.open('name');

+        testFailed("Calling IDBFactory::open without a description should have thrown.");

+    } catch (err) {

+        testPassed("Exception thrown.");

+    }

+    try {

+        debug("webkitIndexedDB.open('name', null);");

+        webkitIndexedDB.open('name', null);

+        testFailed("Calling IDBFactory::open with a null description should have thrown.");

+    } catch (err) {

+        testPassed("Exception thrown.");

+    }

+    try {

+        debug("webkitIndexedDB.open('name', undefined);");

+        webkitIndexedDB.open('name', undefined);

+        testFailed("Calling IDBFactory::open with an undefined description should have thrown.");

+    } catch (err) {

+        testPassed("Exception thrown.");

+    }

+    done();

 }
 
+
 test();
 
 var successfullyParsed = true;
diff --git a/LayoutTests/storage/indexeddb/constants-expected.txt b/LayoutTests/storage/indexeddb/constants-expected.txt
index ff47655..15a2df7 100644
--- a/LayoutTests/storage/indexeddb/constants-expected.txt
+++ b/LayoutTests/storage/indexeddb/constants-expected.txt
@@ -3,32 +3,32 @@ Test IndexedDB's constants.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS IDBKeyRange.SINGLE is 0
-PASS IDBKeyRange.LEFT_OPEN is 1
-PASS IDBKeyRange.RIGHT_OPEN is 2
-PASS IDBKeyRange.LEFT_BOUND is 4
-PASS IDBKeyRange.RIGHT_BOUND is 8
-PASS IDBDatabaseException.UNKNOWN_ERR is 0
-PASS IDBDatabaseException.NON_TRANSIENT_ERR is 1
-PASS IDBDatabaseException.NOT_FOUND_ERR is 2
-PASS IDBDatabaseException.CONSTRAINT_ERR is 3
-PASS IDBDatabaseException.DATA_ERR is 4
-PASS IDBDatabaseException.NOT_ALLOWED_ERR is 5
-PASS IDBDatabaseException.SERIAL_ERR is 11
-PASS IDBDatabaseException.RECOVERABLE_ERR is 21
-PASS IDBDatabaseException.TRANSIENT_ERR is 31
-PASS IDBDatabaseException.TIMEOUT_ERR is 32
-PASS IDBDatabaseException.DEADLOCK_ERR is 33
-PASS IDBRequest.LOADING is 1
-PASS IDBRequest.DONE is 2
-PASS IDBCursor.NEXT is 0
-PASS IDBCursor.NEXT_NO_DUPLICATE is 1
-PASS IDBCursor.PREV is 2
-PASS IDBCursor.PREV_NO_DUPLICATE is 3
-PASS IDBTransaction.READ_WRITE is 0
-PASS IDBTransaction.READ_ONLY is 1
-PASS IDBTransaction.SNAPSHOT_READ is 2
-PASS IDBTransaction.VERSION_CHANGE is 3
+PASS webkitIDBKeyRange.SINGLE is 0
+PASS webkitIDBKeyRange.LEFT_OPEN is 1
+PASS webkitIDBKeyRange.RIGHT_OPEN is 2
+PASS webkitIDBKeyRange.LEFT_BOUND is 4
+PASS webkitIDBKeyRange.RIGHT_BOUND is 8
+PASS webkitIDBDatabaseException.UNKNOWN_ERR is 0
+PASS webkitIDBDatabaseException.NON_TRANSIENT_ERR is 1
+PASS webkitIDBDatabaseException.NOT_FOUND_ERR is 2
+PASS webkitIDBDatabaseException.CONSTRAINT_ERR is 3
+PASS webkitIDBDatabaseException.DATA_ERR is 4
+PASS webkitIDBDatabaseException.NOT_ALLOWED_ERR is 5
+PASS webkitIDBDatabaseException.SERIAL_ERR is 11
+PASS webkitIDBDatabaseException.RECOVERABLE_ERR is 21
+PASS webkitIDBDatabaseException.TRANSIENT_ERR is 31
+PASS webkitIDBDatabaseException.TIMEOUT_ERR is 32
+PASS webkitIDBDatabaseException.DEADLOCK_ERR is 33
+PASS webkitIDBRequest.LOADING is 1
+PASS webkitIDBRequest.DONE is 2
+PASS webkitIDBCursor.NEXT is 0
+PASS webkitIDBCursor.NEXT_NO_DUPLICATE is 1
+PASS webkitIDBCursor.PREV is 2
+PASS webkitIDBCursor.PREV_NO_DUPLICATE is 3
+PASS webkitIDBTransaction.READ_WRITE is 0
+PASS webkitIDBTransaction.READ_ONLY is 1
+PASS webkitIDBTransaction.SNAPSHOT_READ is 2
+PASS webkitIDBTransaction.VERSION_CHANGE is 3
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/LayoutTests/storage/indexeddb/constants.html b/LayoutTests/storage/indexeddb/constants.html
index dd24917..813fe7a 100644
--- a/LayoutTests/storage/indexeddb/constants.html
+++ b/LayoutTests/storage/indexeddb/constants.html
@@ -16,36 +16,36 @@ if (window.layoutTestController)
 
 function test()
 {
-    shouldBe("IDBKeyRange.SINGLE", "0");
-    shouldBe("IDBKeyRange.LEFT_OPEN", "1");
-    shouldBe("IDBKeyRange.RIGHT_OPEN", "2");
-    shouldBe("IDBKeyRange.LEFT_BOUND", "4");
-    shouldBe("IDBKeyRange.RIGHT_BOUND", "8");
-
-    shouldBe("IDBDatabaseException.UNKNOWN_ERR", "0");
-    shouldBe("IDBDatabaseException.NON_TRANSIENT_ERR", "1");
-    shouldBe("IDBDatabaseException.NOT_FOUND_ERR", "2");
-    shouldBe("IDBDatabaseException.CONSTRAINT_ERR", "3");
-    shouldBe("IDBDatabaseException.DATA_ERR", "4");
-    shouldBe("IDBDatabaseException.NOT_ALLOWED_ERR", "5");
-    shouldBe("IDBDatabaseException.SERIAL_ERR", "11");
-    shouldBe("IDBDatabaseException.RECOVERABLE_ERR", "21");
-    shouldBe("IDBDatabaseException.TRANSIENT_ERR", "31");
-    shouldBe("IDBDatabaseException.TIMEOUT_ERR", "32");
-    shouldBe("IDBDatabaseException.DEADLOCK_ERR", "33");
-
-    shouldBe("IDBRequest.LOADING", "1");
-    shouldBe("IDBRequest.DONE", "2");
-
-    shouldBe("IDBCursor.NEXT", "0");
-    shouldBe("IDBCursor.NEXT_NO_DUPLICATE", "1");
-    shouldBe("IDBCursor.PREV", "2");
-    shouldBe("IDBCursor.PREV_NO_DUPLICATE", "3");
-
-    shouldBe("IDBTransaction.READ_WRITE", "0");
-    shouldBe("IDBTransaction.READ_ONLY", "1");
-    shouldBe("IDBTransaction.SNAPSHOT_READ", "2");
-    shouldBe("IDBTransaction.VERSION_CHANGE", "3");
+    shouldBe("webkitIDBKeyRange.SINGLE", "0");
+    shouldBe("webkitIDBKeyRange.LEFT_OPEN", "1");
+    shouldBe("webkitIDBKeyRange.RIGHT_OPEN", "2");
+    shouldBe("webkitIDBKeyRange.LEFT_BOUND", "4");
+    shouldBe("webkitIDBKeyRange.RIGHT_BOUND", "8");
+
+    shouldBe("webkitIDBDatabaseException.UNKNOWN_ERR", "0");
+    shouldBe("webkitIDBDatabaseException.NON_TRANSIENT_ERR", "1");
+    shouldBe("webkitIDBDatabaseException.NOT_FOUND_ERR", "2");
+    shouldBe("webkitIDBDatabaseException.CONSTRAINT_ERR", "3");
+    shouldBe("webkitIDBDatabaseException.DATA_ERR", "4");
+    shouldBe("webkitIDBDatabaseException.NOT_ALLOWED_ERR", "5");
+    shouldBe("webkitIDBDatabaseException.SERIAL_ERR", "11");
+    shouldBe("webkitIDBDatabaseException.RECOVERABLE_ERR", "21");
+    shouldBe("webkitIDBDatabaseException.TRANSIENT_ERR", "31");
+    shouldBe("webkitIDBDatabaseException.TIMEOUT_ERR", "32");
+    shouldBe("webkitIDBDatabaseException.DEADLOCK_ERR", "33");
+
+    shouldBe("webkitIDBRequest.LOADING", "1");
+    shouldBe("webkitIDBRequest.DONE", "2");
+
+    shouldBe("webkitIDBCursor.NEXT", "0");
+    shouldBe("webkitIDBCursor.NEXT_NO_DUPLICATE", "1");
+    shouldBe("webkitIDBCursor.PREV", "2");
+    shouldBe("webkitIDBCursor.PREV_NO_DUPLICATE", "3");
+
+    shouldBe("webkitIDBTransaction.READ_WRITE", "0");
+    shouldBe("webkitIDBTransaction.READ_ONLY", "1");
+    shouldBe("webkitIDBTransaction.SNAPSHOT_READ", "2");
+    shouldBe("webkitIDBTransaction.VERSION_CHANGE", "3");
 }
 
 test();
diff --git a/LayoutTests/storage/indexeddb/database-basics-expected.txt b/LayoutTests/storage/indexeddb/database-basics-expected.txt
index 42c9879..2a5fa2f 100644
--- a/LayoutTests/storage/indexeddb/database-basics-expected.txt
+++ b/LayoutTests/storage/indexeddb/database-basics-expected.txt
@@ -3,7 +3,7 @@ Test the basics of IndexedDB's IDBDatabase.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('name', 'description')
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,6 +21,27 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
+db.setVersion('new version')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+setVersionSuccess():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
 Testing setVersion.
 db.setVersion("version a")
 PASS 'onsuccess' in result is true
@@ -61,7 +82,15 @@ PASS db.name is "name"
 PASS db.objectStores is []
 PASS db.objectStores.length is 0
 PASS db.objectStores.contains('') is false
+PASS db.objectStores[0] is null
+PASS db.objectStores.item(0) is null
 db.createObjectStore("test123")
+PASS db.objectStores is ['test123']
+PASS db.objectStores.length is 1
+PASS db.objectStores.contains('') is false
+PASS db.objectStores.contains('test456') is false
+PASS db.objectStores.contains('test123') is true
+db.setVersion("version c")
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -78,6 +107,17 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
+PASS db.version is "version c"
+PASS db.name is "name"
+PASS db.objectStores is ['test123']
+PASS db.objectStores.length is 1
+PASS db.objectStores.contains('') is false
+PASS db.objectStores.contains('test456') is false
+PASS db.objectStores.contains('test123') is true
+db.createObjectStore("test456")
+setVersionTrans = event.result
+PASS setVersionTrans !== null is true
+PASS db.version is "version b"
 PASS db.objectStores is ['test123']
 PASS db.objectStores.length is 1
 PASS db.objectStores.contains('') is false
diff --git a/LayoutTests/storage/indexeddb/database-basics.html b/LayoutTests/storage/indexeddb/database-basics.html
index b099a49..31c887b 100644
--- a/LayoutTests/storage/indexeddb/database-basics.html
+++ b/LayoutTests/storage/indexeddb/database-basics.html
@@ -14,23 +14,43 @@ description("Test the basics of IndexedDB's IDBDatabase.");
 if (window.layoutTestController) 
     layoutTestController.waitUntilDone();
 
+function test()
+{
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
+    verifyResult(result);
+    result.onsuccess = openSuccess;
+    result.onerror = unexpectedErrorCallback;
+}
+
 function openSuccess()
 {
     verifySuccessEvent(event);
+    window.db = evalAndLog("db = event.result");
+
+    result = evalAndLog("db.setVersion('new version')");
+    verifyResult(result);
+    result.onsuccess = setVersionSuccess;
+    result.onerror = unexpectedErrorCallback;
+}
 
-    var db = evalAndLog("db = event.result");
-    deleteAllObjectStores(db);
+function setVersionSuccess()
+{
+    debug("setVersionSuccess():");
+    verifySuccessEvent(event);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
 
-    // We must do something asynchronous before anything synchronous since
-    // deleteAllObjectStores only schedules the object stores to be removed.
-    // We don't know for sure whether it's happened until an IDBRequest object
-    // that was created after the removes fires.
+    deleteAllObjectStores(db, testSetVersion);
+}
 
+function testSetVersion()
+{
     debug("Testing setVersion.");
     result = evalAndLog('db.setVersion("version a")');
     verifyResult(result);
     result.onsuccess = setVersionAgain;
-    result.onError = unexpectedErrorCallback;
+    result.onerror = unexpectedErrorCallback;
 }
 
 function setVersionAgain()
@@ -40,7 +60,7 @@ function setVersionAgain()
     result = evalAndLog('db.setVersion("version b")');
     verifyResult(result);
     result.onsuccess = createObjectStore;
-    result.onError = unexpectedErrorCallback;
+    result.onerror = unexpectedErrorCallback;
 }
 
 function createObjectStore()
@@ -51,33 +71,58 @@ function createObjectStore()
     shouldBe("db.objectStores", "[]");
     shouldBe("db.objectStores.length", "0");
     shouldBe("db.objectStores.contains('')", "false");
+    shouldBeNull("db.objectStores[0]");
+    shouldBeNull("db.objectStores.item(0)");
 
-    result = evalAndLog('db.createObjectStore("test123")');
-    verifyResult(result);
-    result.onsuccess = checkObjectStore;
-    result.onError = unexpectedErrorCallback;
+    objectStore = evalAndLog('db.createObjectStore("test123")');
+    checkObjectStore();
+    commitAndContinue();
 }
 
 function checkObjectStore()
 {
-    verifySuccessEvent(event);
     shouldBe("db.objectStores", "['test123']");
     shouldBe("db.objectStores.length", "1");
     shouldBe("db.objectStores.contains('')", "false");
     shouldBe("db.objectStores.contains('test456')", "false");
     shouldBe("db.objectStores.contains('test123')", "true");
+}
 
-    done();
+function commitAndContinue()
+{
+    window.setTimeout(testSetVersionAbort, 0);
 }
 
-function test()
+function testSetVersionAbort()
 {
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog('db.setVersion("version c")');
     verifyResult(result);
-    result.onsuccess = openSuccess;
+    result.onsuccess = createAnotherObjectStore;
     result.onerror = unexpectedErrorCallback;
 }
 
+function createAnotherObjectStore()
+{
+    verifySuccessEvent(event);
+    shouldBeEqualToString("db.version", "version c");
+    shouldBeEqualToString("db.name", "name");
+    checkObjectStore();
+
+    objectStore = evalAndLog('db.createObjectStore("test456")');
+    var setVersionTrans = evalAndLog("setVersionTrans = event.result");
+    shouldBeTrue("setVersionTrans !== null");
+    setVersionTrans.oncomplete = unexpectedCompleteCallback;
+    setVersionTrans.onabort = checkMetadata;
+    setVersionTrans.abort();
+}
+
+function checkMetadata()
+{
+    shouldBeEqualToString("db.version", "version b");
+    checkObjectStore();
+    done();
+}
+
 test();
 
 var successfullyParsed = true;
diff --git a/LayoutTests/storage/indexeddb/database-quota-expected.txt b/LayoutTests/storage/indexeddb/database-quota-expected.txt
new file mode 100644
index 0000000..b6ea505
--- /dev/null
+++ b/LayoutTests/storage/indexeddb/database-quota-expected.txt
@@ -0,0 +1,1115 @@
+Tests IndexedDB's quota enforcing mechanism.
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+webkitIndexedDB.open('name', 'description')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+db = event.result
+db.setVersion('new version')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+setVersionSuccess():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+PASS db.version is "new version"
+PASS db.name is "name"
+PASS db.objectStores is []
+PASS db.objectStores.length is 0
+PASS db.objectStores.contains('') is false
+db.createObjectStore("test123")
+PASS db.objectStores is ['test123']
+PASS db.objectStores.length is 1
+PASS db.objectStores.contains('') is false
+PASS db.objectStores.contains('test456') is false
+PASS db.objectStores.contains('test123') is true
+trans = db.transaction()
+Creating 'data' which contains 64K of data
+PASS data.length is 65536
+store = trans.objectStore('test123')
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+store = event.source
+store.add({x: data}, dataAdded)
+Error function called: (0) Error writing data to stable storage.
+Error event fired:
+PASS 'result' in event is false
+PASS 'code' in event is true
+PASS 'message' in event is true
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+PASS Adding data failed due to quota error. Data added was: 5120 KB
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/indexeddb/database-quota.html b/LayoutTests/storage/indexeddb/database-quota.html
new file mode 100644
index 0000000..45ce709
--- /dev/null
+++ b/LayoutTests/storage/indexeddb/database-quota.html
@@ -0,0 +1,126 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../fast/js/resources/js-test-post-function.js"></script>
+<script src="resources/shared.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+
+description("Tests IndexedDB's quota enforcing mechanism.");
+if (window.layoutTestController) 
+    layoutTestController.waitUntilDone();
+
+function test()
+{
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
+    verifyResult(result);
+    result.onsuccess = openSuccess;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function openSuccess()
+{
+    verifySuccessEvent(event);
+    window.db = evalAndLog("db = event.result");
+
+    result = evalAndLog("db.setVersion('new version')");
+    verifyResult(result);
+    result.onsuccess = setVersionSuccess;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function setVersionSuccess()
+{
+    debug("setVersionSuccess():");
+    verifySuccessEvent(event);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
+
+    deleteAllObjectStores(db, createNewObjectStore);
+}
+
+function createNewObjectStore()
+{
+    verifySuccessEvent(event);
+    shouldBeEqualToString("db.version", "new version");
+    shouldBeEqualToString("db.name", "name");
+    shouldBe("db.objectStores", "[]");
+    shouldBe("db.objectStores.length", "0");
+    shouldBe("db.objectStores.contains('')", "false");
+
+    objectStore = evalAndLog('db.createObjectStore("test123")');

+    checkObjectStore();

+    commitAndContinue();
+}
+
+function checkObjectStore()
+{
+    shouldBe("db.objectStores", "['test123']");
+    shouldBe("db.objectStores.length", "1");
+    shouldBe("db.objectStores.contains('')", "false");
+    shouldBe("db.objectStores.contains('test456')", "false");
+    shouldBe("db.objectStores.contains('test123')", "true");

+}

+

+function commitAndContinue()

+{

+    window.setTimeout(checkQuotaEnforcing, 0);
+}

+

+function checkQuotaEnforcing()

+{

+    var trans = evalAndLog("trans = db.transaction()");

+    trans.onabort = testComplete;

+    trans.oncomplete = unexpectedCompleteCallback;

+    debug("Creating 'data' which contains 64K of data");

+    window.data = "X";

+    for (var i = 0; i < 16; i++)

+        data += data;

+    shouldBe("data.length", "65536");

+    window.dataAdded = 0;

+    window.store = evalAndLog("store = trans.objectStore('test123')");

+    addData();

+}

+

+function addData()

+{

+    if (dataAdded < 5 * 1024 * 1024) {

+        if (dataAdded > 0) {

+            verifySuccessEvent(event);

+            store = evalAndLog("store = event.source");

+        }

+    } else {

+        testFailed("added more than quota");

+        done();

+        return;

+    }

+    dataAdded += 65536;

+    result = evalAndLog("store.add({x: data}, dataAdded)");

+    result.onsuccess = addData;

+    result.onerror = logError;

+}

+

+function logError()

+{

+    debug("Error function called: (" + event.code + ") " + event.message);

+    verifyErrorEvent(event);

+}

+

+function testComplete()

+{

+    testPassed("Adding data failed due to quota error. Data added was: " + dataAdded / 1024 + " KB");

+    done();
+}
+
+test();
+
+var successfullyParsed = true;
+
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/indexeddb/index-basics-expected.txt b/LayoutTests/storage/indexeddb/index-basics-expected.txt
index 564bdc8..0869d95 100644
--- a/LayoutTests/storage/indexeddb/index-basics-expected.txt
+++ b/LayoutTests/storage/indexeddb/index-basics-expected.txt
@@ -1,9 +1,9 @@
-Test the basics of IndexedDB's IDBIndex.
+Test the basics of IndexedDB's webkitIDBIndex.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('name', 'description')
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,12 +21,13 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('storeName', null)
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
+setVersionSuccess():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -38,8 +39,25 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-store = event.result
-event.result.createIndex('indexName', 'x')
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+db.createObjectStore('storeName', null)
+store.createIndex('indexName', 'x')
+store.createIndex('indexName2', 'y', false)
+PASS 'name' in indexObject is true
+PASS indexObject.name is "indexName"
+PASS 'storeName' in indexObject is true
+PASS indexObject.storeName is "storeName"
+PASS 'keyPath' in indexObject is true
+PASS indexObject.keyPath is "x"
+PASS 'unique' in indexObject is true
+PASS indexObject.unique is false
+PASS 'openKeyCursor' in indexObject is true
+PASS 'openCursor' in indexObject is true
+PASS 'getKey' in indexObject is true
+PASS 'get' in indexObject is true
+store.add({x: 'value', y: 'zzz'}, 'key')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -56,21 +74,7 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.result === null is false
-indexObject = event.result
-PASS 'name' in indexObject is true
-PASS indexObject.name is "indexName"
-PASS 'storeName' in indexObject is true
-PASS indexObject.storeName is "storeName"
-PASS 'keyPath' in indexObject is true
-PASS indexObject.keyPath is "x"
-PASS 'unique' in indexObject is true
-PASS indexObject.unique is false
-PASS 'openObjectCursor' in indexObject is true
-PASS 'openCursor' in indexObject is true
-PASS 'getObject' in indexObject is true
-PASS 'get' in indexObject is true
-event.source.add({x: 'value', y: 'zzz'}, 'key')
+event.source.add({x: 'value2', y: 'zzz2'}, 'key2')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -87,7 +91,7 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-event.source.add({x: 'value2', y: 'zzz2'}, 'key2')
+indexObject.getKey('value')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -104,7 +108,8 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-indexObject.get('value')
+PASS event.result is "key"
+indexObject2.getKey('zzz')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -122,7 +127,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 PASS event.result is "key"
-indexObject.getObject('value')
+indexObject.get('value')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -141,7 +146,7 @@ PASS event.target.readyState is event.target.DONE
 
 PASS event.result.x is "value"
 PASS event.result.y is "zzz"
-indexObject.get('does not exist')
+indexObject.getKey('does not exist')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -158,8 +163,8 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.code is IDBDatabaseException.NOT_FOUND_ERR
-indexObject.getObject('does not exist')
+PASS event.code is webkitIDBDatabaseException.NOT_FOUND_ERR
+indexObject.get('does not exist')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -176,8 +181,8 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.code is IDBDatabaseException.NOT_FOUND_ERR
-indexObject.openCursor()
+PASS event.code is webkitIDBDatabaseException.NOT_FOUND_ERR
+indexObject.openKeyCursor()
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -235,7 +240,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 PASS event.result === null is true
-indexObject.openObjectCursor()
+indexObject.openCursor()
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
diff --git a/LayoutTests/storage/indexeddb/index-basics.html b/LayoutTests/storage/indexeddb/index-basics.html
index c23f141..f7257f1 100644
--- a/LayoutTests/storage/indexeddb/index-basics.html
+++ b/LayoutTests/storage/indexeddb/index-basics.html
@@ -10,47 +10,50 @@
 <div id="console"></div>
 <script>
 
-description("Test the basics of IndexedDB's IDBIndex.");
+description("Test the basics of IndexedDB's webkitIDBIndex.");
 if (window.layoutTestController) 
     layoutTestController.waitUntilDone();
 
 function test()
 {
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
-    result.onsuccess = createObjectStore;
+    result.onsuccess = setVersion;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createObjectStore()
+function setVersion()
 {
     verifySuccessEvent(event);
     db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('storeName', null)");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = createIndex;
+    result.onsuccess = deleteExisting;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createIndex()
+function deleteExisting()
 {
+    debug("setVersionSuccess():");
     verifySuccessEvent(event);
-    window.store = evalAndLog("store = event.result");
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
 
-    result = evalAndLog("event.result.createIndex('indexName', 'x')");
-    verifyResult(result);
-    result.onsuccess = addData;
-    result.onerror = unexpectedErrorCallback;
+    deleteAllObjectStores(db, createIndex);
+}
+
+function createIndex()
+{
+    window.store = evalAndLog("db.createObjectStore('storeName', null)");
+    window.indexObject = evalAndLog("store.createIndex('indexName', 'x')");
+    window.indexObject2 = evalAndLog("store.createIndex('indexName2', 'y', false)");
+    addData();
 }
 
 function addData()
 {
-    verifySuccessEvent(event);
-    shouldBeFalse("event.result === null");
-    window.indexObject = evalAndLog("indexObject = event.result");
     shouldBeTrue("'name' in indexObject");
     shouldBeEqualToString("indexObject.name", "indexName");
     shouldBeTrue("'storeName' in indexObject");
@@ -59,12 +62,12 @@ function addData()
     shouldBeEqualToString("indexObject.keyPath", "x");
     shouldBeTrue("'unique' in indexObject");
     shouldBeFalse("indexObject.unique");
-    shouldBeTrue("'openObjectCursor' in indexObject");
+    shouldBeTrue("'openKeyCursor' in indexObject");
     shouldBeTrue("'openCursor' in indexObject");
-    shouldBeTrue("'getObject' in indexObject");
+    shouldBeTrue("'getKey' in indexObject");
     shouldBeTrue("'get' in indexObject");
 
-    result = evalAndLog("event.source.add({x: 'value', y: 'zzz'}, 'key')");
+    result = evalAndLog("store.add({x: 'value', y: 'zzz'}, 'key')");
     verifyResult(result);
     result.onsuccess = addMore;
     result.onerror = unexpectedErrorCallback;
@@ -84,7 +87,7 @@ function getData()
 {
     verifySuccessEvent(event);
 
-    result = evalAndLog("indexObject.get('value')");
+    result = evalAndLog("indexObject.getKey('value')");
     verifyResult(result);
     result.onsuccess = getObjectData;
     result.onerror = unexpectedErrorCallback;
@@ -95,7 +98,18 @@ function getObjectData()
     verifySuccessEvent(event);
     shouldBeEqualToString("event.result", "key");
 
-    result = evalAndLog("indexObject.getObject('value')");
+    result = evalAndLog("indexObject2.getKey('zzz')");
+    verifyResult(result);
+    result.onsuccess = getObjectData2;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function getObjectData2()
+{
+    verifySuccessEvent(event);
+    shouldBeEqualToString("event.result", "key");
+
+    result = evalAndLog("indexObject.get('value')");
     verifyResult(result);
     result.onsuccess = getDataFail;
     result.onerror = unexpectedErrorCallback;
@@ -107,7 +121,7 @@ function getDataFail()
     shouldBeEqualToString("event.result.x", "value");
     shouldBeEqualToString("event.result.y", "zzz");
 
-    result = evalAndLog("indexObject.get('does not exist')");
+    result = evalAndLog("indexObject.getKey('does not exist')");
     verifyResult(result);
     result.onsuccess = unexpectedSuccessCallback;
     result.onerror = getObjectDataFail;
@@ -116,20 +130,20 @@ function getDataFail()
 function getObjectDataFail()
 {
     verifyErrorEvent(event);
-    shouldBe("event.code", "IDBDatabaseException.NOT_FOUND_ERR");
+    shouldBe("event.code", "webkitIDBDatabaseException.NOT_FOUND_ERR");
 
-    result = evalAndLog("indexObject.getObject('does not exist')");
+    result = evalAndLog("indexObject.get('does not exist')");
     verifyResult(result);
     result.onsuccess = unexpectedSuccessCallback;
-    result.onerror = openCursor;
+    result.onerror = openKeyCursor;
 }
 
-function openCursor()
+function openKeyCursor()
 {
     verifyErrorEvent(event);
-    shouldBe("event.code", "IDBDatabaseException.NOT_FOUND_ERR");
+    shouldBe("event.code", "webkitIDBDatabaseException.NOT_FOUND_ERR");
 
-    window.result = evalAndLog("indexObject.openCursor()");
+    window.result = evalAndLog("indexObject.openKeyCursor()");
     verifyResult(result);
     result.onsuccess = cursor1Continue;
     result.onerror = unexpectedErrorCallback;
@@ -166,7 +180,7 @@ function openObjectCursor()
     verifySuccessEvent(event);
     shouldBeTrue("event.result === null");
 
-    window.result = evalAndLog("indexObject.openObjectCursor()");
+    window.result = evalAndLog("indexObject.openCursor()");
     verifyResult(result);
     result.onsuccess = cursor2Continue;
     result.onerror = unexpectedErrorCallback;
diff --git a/LayoutTests/storage/indexeddb/index-cursor-expected.txt b/LayoutTests/storage/indexeddb/index-cursor-expected.txt
index 6d1417f..88b96ff 100644
--- a/LayoutTests/storage/indexeddb/index-cursor-expected.txt
+++ b/LayoutTests/storage/indexeddb/index-cursor-expected.txt
@@ -1,9 +1,9 @@
-Test IndexedDB's IDBIndex.openCursor + the cursor it produces in depth.
+Test IndexedDB's webkitIDBIndex.openCursor + the cursor it produces in depth.
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('someDB', 'some description')
+webkitIndexedDB.open('someDB', 'some description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,7 +21,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('someObjectStore')
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -38,36 +38,11 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-objectStore = event.result
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+db.createObjectStore('someObjectStore')
 objectStore.createIndex('someIndex', 'x')
-PASS 'onsuccess' in result is true
-PASS 'onerror' in result is true
-PASS 'readyState' in result is true
-An event should fire shortly...
-
-Success event fired:
-PASS 'result' in event is true
-PASS 'code' in event is false
-PASS 'message' in event is false
-PASS 'source' in event is true
-PASS event.source != null is true
-PASS 'onsuccess' in event.target is true
-PASS 'onerror' in event.target is true
-PASS 'readyState' in event.target is true
-PASS event.target.readyState is event.target.DONE
-
-indexObject = event.result
-Success event fired:
-PASS 'result' in event is true
-PASS 'code' in event is false
-PASS 'message' in event is false
-PASS 'source' in event is true
-PASS event.source != null is true
-PASS 'onsuccess' in event.target is true
-PASS 'onerror' in event.target is true
-PASS 'readyState' in event.target is true
-PASS event.target.readyState is event.target.DONE
-
 objectStore.add({'x': testData[nextToAdd]}, nextToAdd)
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
diff --git a/LayoutTests/storage/indexeddb/index-cursor.html b/LayoutTests/storage/indexeddb/index-cursor.html
index 9541d60..5aab4f8 100644
--- a/LayoutTests/storage/indexeddb/index-cursor.html
+++ b/LayoutTests/storage/indexeddb/index-cursor.html
@@ -10,7 +10,7 @@
 <div id="console"></div>
 <script> 
 
-description("Test IndexedDB's IDBIndex.openCursor + the cursor it produces in depth.");
+description("Test IndexedDB's webkitIDBIndex.openCursor + the cursor it produces in depth.");
 if (window.layoutTestController)
     layoutTestController.waitUntilDone();
  
@@ -29,49 +29,45 @@ window.testData = [
  
 function openDatabase()
 {
-    result = evalAndLog("indexedDB.open('someDB', 'some description')");
+    result = evalAndLog("webkitIndexedDB.open('someDB', 'some description')");
     verifyResult(result);
-    result.onsuccess = openObjectStore;
+    result.onsuccess = setVersion;
     result.onerror = unexpectedErrorCallback;
 }
  
-function openObjectStore()
+function setVersion()
 {
     verifySuccessEvent(event);
     window.db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('someObjectStore')");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = openIndex;
+    result.onsuccess = deleteExisting;
     result.onerror = unexpectedErrorCallback;
 }
 
-function openIndex()
+function deleteExisting()
 {
     verifySuccessEvent(event);
-    window.objectStore = evalAndLog("objectStore = event.result");
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
 
-    result = evalAndLog("objectStore.createIndex('someIndex', 'x')");
-    verifyResult(result);
-    result.onsuccess = startAddingData;
-    result.onerror = unexpectedErrorCallback;
+    deleteAllObjectStores(db, startAddingData);
 }
  
 function startAddingData()
 {
-    verifySuccessEvent(event);
-    window.indexObject = evalAndLog("indexObject = event.result");
-
+    window.objectStore = evalAndLog("db.createObjectStore('someObjectStore')");
+    window.indexObject = evalAndLog("objectStore.createIndex('someIndex', 'x')");
     window.nextToAdd = 0;
     addData();
 }
 
 function addData()
 {
-    // We cheat when called for the first time; we're in the context of the objectStore success event.
-    verifySuccessEvent(event);
+    if (window.nextToAdd > 0)
+        verifySuccessEvent(event);
 
     result = evalAndLog("objectStore.add({'x': testData[nextToAdd]}, nextToAdd)");
     verifyResult(result);
@@ -105,7 +101,7 @@ function scheduleTests()
     }
  
     debug("Running tests...");
-    setTimeout(runNextTest, 0);
+    runNextTest();
 }
  
 function runNextTest()
@@ -184,13 +180,13 @@ function runNextTest()
  
     var keyRange;
     if (lower !== null && upper !== null)
-        keyRange = IDBKeyRange.bound(testData[lower], testData[upper], lowerIsOpen, upperIsOpen);
+        keyRange = webkitIDBKeyRange.bound(testData[lower], testData[upper], lowerIsOpen, upperIsOpen);
     else if (lower !== null)
-        keyRange = IDBKeyRange.leftBound(testData[lower], lowerIsOpen);
+        keyRange = webkitIDBKeyRange.leftBound(testData[lower], lowerIsOpen);
     else
-        keyRange = IDBKeyRange.rightBound(testData[upper], upperIsOpen);
+        keyRange = webkitIDBKeyRange.rightBound(testData[upper], upperIsOpen);
  
-    var request = indexObject.openCursor(keyRange, ascending ? IDBCursor.NEXT : IDBCursor.PREV);
+    var request = indexObject.openKeyCursor(keyRange, ascending ? webkitIDBCursor.NEXT : webkitIDBCursor.PREV);
     request.onsuccess = cursorIteration;
     request.onerror = unexpectedErrorCallback;
 }
@@ -213,12 +209,12 @@ function cursorIteration()
 {
     if (expectedIndex === null) {
         shouldBeNull("event.result");
-        setTimeout(runNextTest, 0);
+        runNextTest();
         return;
     }
     if (event.result === null) {
-        testFailed("Event.result should not be null.")
-        setTimeout(runNextTest, 0);
+        testFailed("Event.result should not be null.");
+        runNextTest();
         return;
     }
  
diff --git a/LayoutTests/storage/indexeddb/keyrange-expected.txt b/LayoutTests/storage/indexeddb/keyrange-expected.txt
index 6528a11..8d6bf86 100644
--- a/LayoutTests/storage/indexeddb/keyrange-expected.txt
+++ b/LayoutTests/storage/indexeddb/keyrange-expected.txt
@@ -3,20 +3,20 @@ Test IndexedDB's KeyRange.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS 'SINGLE' in IDBKeyRange is true
-PASS 'LEFT_OPEN' in IDBKeyRange is true
-PASS 'RIGHT_OPEN' in IDBKeyRange is true
-PASS 'LEFT_BOUND' in IDBKeyRange is true
-PASS 'RIGHT_BOUND' in IDBKeyRange is true
-PASS 'left' in IDBKeyRange is false
-PASS 'right' in IDBKeyRange is false
-PASS 'flags' in IDBKeyRange is false
-PASS 'only' in IDBKeyRange is true
-PASS 'leftBound' in IDBKeyRange is true
-PASS 'rightBound' in IDBKeyRange is true
-PASS 'bound' in IDBKeyRange is true
+PASS 'SINGLE' in webkitIDBKeyRange is true
+PASS 'LEFT_OPEN' in webkitIDBKeyRange is true
+PASS 'RIGHT_OPEN' in webkitIDBKeyRange is true
+PASS 'LEFT_BOUND' in webkitIDBKeyRange is true
+PASS 'RIGHT_BOUND' in webkitIDBKeyRange is true
+PASS 'left' in webkitIDBKeyRange is false
+PASS 'right' in webkitIDBKeyRange is false
+PASS 'flags' in webkitIDBKeyRange is false
+PASS 'only' in webkitIDBKeyRange is true
+PASS 'leftBound' in webkitIDBKeyRange is true
+PASS 'rightBound' in webkitIDBKeyRange is true
+PASS 'bound' in webkitIDBKeyRange is true
 
-instance = IDBKeyRange.only(1)
+instance = webkitIDBKeyRange.only(1)
 PASS 'SINGLE' in instance is true
 PASS 'LEFT_OPEN' in instance is true
 PASS 'RIGHT_OPEN' in instance is true
@@ -30,113 +30,113 @@ PASS 'leftBound' in instance is false
 PASS 'rightBound' in instance is false
 PASS 'bound' in instance is false
 
-IDBKeyRange.only(1)
+webkitIDBKeyRange.only(1)
 PASS keyRange.left is 1
 PASS keyRange.right is 1
 PASS keyRange.flags is keyRange.SINGLE
-IDBKeyRange.only('a')
+webkitIDBKeyRange.only('a')
 PASS keyRange.left is 'a'
 PASS keyRange.right is 'a'
 PASS keyRange.flags is keyRange.SINGLE
-IDBKeyRange.leftBound(10,true)
+webkitIDBKeyRange.leftBound(10,true)
 PASS keyRange.left is 10
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
-IDBKeyRange.leftBound(11,false)
+webkitIDBKeyRange.leftBound(11,false)
 PASS keyRange.left is 11
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_BOUND
-IDBKeyRange.leftBound(12,undefined)
+webkitIDBKeyRange.leftBound(12,undefined)
 PASS keyRange.left is 12
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_BOUND
-IDBKeyRange.leftBound('aa',true)
+webkitIDBKeyRange.leftBound('aa',true)
 PASS keyRange.left is 'aa'
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
-IDBKeyRange.leftBound('ab',false)
+webkitIDBKeyRange.leftBound('ab',false)
 PASS keyRange.left is 'ab'
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_BOUND
-IDBKeyRange.leftBound('ac',undefined)
+webkitIDBKeyRange.leftBound('ac',undefined)
 PASS keyRange.left is 'ac'
 PASS keyRange.right is null
 PASS keyRange.flags is keyRange.LEFT_BOUND
-IDBKeyRange.rightBound(20,true)
+webkitIDBKeyRange.rightBound(20,true)
 PASS keyRange.right is 20
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND
-IDBKeyRange.rightBound(21,false)
+webkitIDBKeyRange.rightBound(21,false)
 PASS keyRange.right is 21
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_BOUND
-IDBKeyRange.rightBound(22,undefined)
+webkitIDBKeyRange.rightBound(22,undefined)
 PASS keyRange.right is 22
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_BOUND
-IDBKeyRange.rightBound('ba',true)
+webkitIDBKeyRange.rightBound('ba',true)
 PASS keyRange.right is 'ba'
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND
-IDBKeyRange.rightBound('bb',false)
+webkitIDBKeyRange.rightBound('bb',false)
 PASS keyRange.right is 'bb'
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_BOUND
-IDBKeyRange.rightBound('bc',undefined)
+webkitIDBKeyRange.rightBound('bc',undefined)
 PASS keyRange.right is 'bc'
 PASS keyRange.left is null
 PASS keyRange.flags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound(30,40,undefined,undefined)
+webkitIDBKeyRange.bound(30,40,undefined,undefined)
 PASS keyRange.left is 30
 PASS keyRange.right is 40
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound(31,41,false,false)
+webkitIDBKeyRange.bound(31,41,false,false)
 PASS keyRange.left is 31
 PASS keyRange.right is 41
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound(32,42,false,true)
+webkitIDBKeyRange.bound(32,42,false,true)
 PASS keyRange.left is 32
 PASS keyRange.right is 42
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND
-IDBKeyRange.bound(33,43,true,false)
+webkitIDBKeyRange.bound(33,43,true,false)
 PASS keyRange.left is 33
 PASS keyRange.right is 43
 PASS leftFlags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound(34,44,true,true)
+webkitIDBKeyRange.bound(34,44,true,true)
 PASS keyRange.left is 34
 PASS keyRange.right is 44
 PASS leftFlags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aaa','aba',false,false)
+webkitIDBKeyRange.bound('aaa','aba',false,false)
 PASS keyRange.left is 'aaa'
 PASS keyRange.right is 'aba'
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aab','abb',undefined,undefined)
+webkitIDBKeyRange.bound('aab','abb',undefined,undefined)
 PASS keyRange.left is 'aab'
 PASS keyRange.right is 'abb'
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aac','abc',false,false)
+webkitIDBKeyRange.bound('aac','abc',false,false)
 PASS keyRange.left is 'aac'
 PASS keyRange.right is 'abc'
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aad','abd',false,true)
+webkitIDBKeyRange.bound('aad','abd',false,true)
 PASS keyRange.left is 'aad'
 PASS keyRange.right is 'abd'
 PASS leftFlags is keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aae','abe',true,false)
+webkitIDBKeyRange.bound('aae','abe',true,false)
 PASS keyRange.left is 'aae'
 PASS keyRange.right is 'abe'
 PASS leftFlags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
 PASS rightFlags is keyRange.RIGHT_BOUND
-IDBKeyRange.bound('aaf','abf',true,true)
+webkitIDBKeyRange.bound('aaf','abf',true,true)
 PASS keyRange.left is 'aaf'
 PASS keyRange.right is 'abf'
 PASS leftFlags is keyRange.LEFT_OPEN | keyRange.LEFT_BOUND
diff --git a/LayoutTests/storage/indexeddb/keyrange.html b/LayoutTests/storage/indexeddb/keyrange.html
index d60cb15..c3885fc 100644
--- a/LayoutTests/storage/indexeddb/keyrange.html
+++ b/LayoutTests/storage/indexeddb/keyrange.html
@@ -16,7 +16,7 @@ if (window.layoutTestController)
 
 function checkSingleKeyRange(value)
 {
-    keyRange = evalAndLog("IDBKeyRange.only(" + value + ")");
+    keyRange = evalAndLog("webkitIDBKeyRange.only(" + value + ")");
     shouldBe("keyRange.left", "" + value);
     shouldBe("keyRange.right", "" + value);
     shouldBe("keyRange.flags", "keyRange.SINGLE");
@@ -24,7 +24,7 @@ function checkSingleKeyRange(value)
 
 function checkLeftBoundKeyRange(value, open)
 {
-    keyRange = evalAndLog("IDBKeyRange.leftBound(" + value + "," + open + ")");
+    keyRange = evalAndLog("webkitIDBKeyRange.leftBound(" + value + "," + open + ")");
     shouldBe("keyRange.left", "" + value);
     shouldBeNull("keyRange.right");
     shouldBe("keyRange.flags", open ? "keyRange.LEFT_OPEN | keyRange.LEFT_BOUND" : "keyRange.LEFT_BOUND");
@@ -32,7 +32,7 @@ function checkLeftBoundKeyRange(value, open)
 
 function checkRightBoundKeyRange(value, open)
 {
-    keyRange = evalAndLog("IDBKeyRange.rightBound(" + value + "," + open + ")");
+    keyRange = evalAndLog("webkitIDBKeyRange.rightBound(" + value + "," + open + ")");
     shouldBe("keyRange.right", "" + value);
     shouldBeNull("keyRange.left");
     shouldBe("keyRange.flags", open ? "keyRange.RIGHT_OPEN | keyRange.RIGHT_BOUND" : "keyRange.RIGHT_BOUND");
@@ -40,7 +40,7 @@ function checkRightBoundKeyRange(value, open)
 
 function checkBoundKeyRange(left, right, openLeft, openRight)
 {
-    keyRange = evalAndLog("IDBKeyRange.bound(" + left + "," + right + "," + openLeft + "," + openRight + ")");
+    keyRange = evalAndLog("webkitIDBKeyRange.bound(" + left + "," + right + "," + openLeft + "," + openRight + ")");
     shouldBe("keyRange.left", "" + left);
     shouldBe("keyRange.right", "" + right);
     leftFlags = keyRange.flags & (keyRange.LEFT_OPEN | keyRange.LEFT_BOUND);
@@ -51,22 +51,22 @@ function checkBoundKeyRange(left, right, openLeft, openRight)
 
 function test()
 {
-    shouldBeTrue("'SINGLE' in IDBKeyRange");
-    shouldBeTrue("'LEFT_OPEN' in IDBKeyRange");
-    shouldBeTrue("'RIGHT_OPEN' in IDBKeyRange");
-    shouldBeTrue("'LEFT_BOUND' in IDBKeyRange");
-    shouldBeTrue("'RIGHT_BOUND' in IDBKeyRange");
-    shouldBeFalse("'left' in IDBKeyRange");
-    shouldBeFalse("'right' in IDBKeyRange");
-    shouldBeFalse("'flags' in IDBKeyRange");
-    shouldBeTrue("'only' in IDBKeyRange");
-    shouldBeTrue("'leftBound' in IDBKeyRange");
-    shouldBeTrue("'rightBound' in IDBKeyRange");
-    shouldBeTrue("'bound' in IDBKeyRange");
+    shouldBeTrue("'SINGLE' in webkitIDBKeyRange");
+    shouldBeTrue("'LEFT_OPEN' in webkitIDBKeyRange");
+    shouldBeTrue("'RIGHT_OPEN' in webkitIDBKeyRange");
+    shouldBeTrue("'LEFT_BOUND' in webkitIDBKeyRange");
+    shouldBeTrue("'RIGHT_BOUND' in webkitIDBKeyRange");
+    shouldBeFalse("'left' in webkitIDBKeyRange");
+    shouldBeFalse("'right' in webkitIDBKeyRange");
+    shouldBeFalse("'flags' in webkitIDBKeyRange");
+    shouldBeTrue("'only' in webkitIDBKeyRange");
+    shouldBeTrue("'leftBound' in webkitIDBKeyRange");
+    shouldBeTrue("'rightBound' in webkitIDBKeyRange");
+    shouldBeTrue("'bound' in webkitIDBKeyRange");
 
     debug("");
 
-    var instance = evalAndLog("instance = IDBKeyRange.only(1)");
+    var instance = evalAndLog("instance = webkitIDBKeyRange.only(1)");
     shouldBeTrue("'SINGLE' in instance");
     shouldBeTrue("'LEFT_OPEN' in instance");
     shouldBeTrue("'RIGHT_OPEN' in instance");
diff --git a/LayoutTests/storage/indexeddb/objectstore-basics-expected.txt b/LayoutTests/storage/indexeddb/objectstore-basics-expected.txt
index 7b5439a..d22e6f0 100644
--- a/LayoutTests/storage/indexeddb/objectstore-basics-expected.txt
+++ b/LayoutTests/storage/indexeddb/objectstore-basics-expected.txt
@@ -3,7 +3,7 @@ Test the basics of IndexedDB's IDBObjectStore.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('name', 'description')
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -22,13 +22,13 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('storeName', null)
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
-createSuccess():
+setVersionSuccess():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -40,23 +40,34 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-store = event.result
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+creatObjectStore():
+store = db.createObjectStore('storeName', null)
 storeNames = db.objectStores
 PASS store.name is "storeName"
 PASS store.keyPath is null
 PASS storeNames.contains('storeName') is true
 PASS storeNames.length is 1
-Ask for a store that doesn't exist:
+Ask for an index that doesn't exist:
 index = store.index('asdf')
-PASS index is null
-FAIL Asking for a store that doesn't exist should have thrown.
-event.result.createIndex('indexName', 'x', true)
+PASS Exception thrown.
+createIndex():
+index = store.createIndex('indexName', 'x', true)
+PASS index !== null is true
+PASS store.indexNames.contains('indexName') is true
+index = store.index('indexName')
+PASS index !== null is true
+Ask for an index that doesn't exist:
+index = store.index('asdf')
+PASS Exception thrown.
+db.setVersion("version fail")
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
-addIndexSuccess():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -68,15 +79,25 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.result !== null is true
-PASS event.source.indexNames.contains('indexName') is true
-index = event.source.index('indexName')
-PASS index !== null is true
-Ask for a store that doesn't exist:
-index = store.index('asdf')
-PASS index is null
-FAIL Asking for a store that doesn't exist should have thrown.
-event.source.add({x: 'value'}, 'key')
+PASS db.version is "version fail"
+setVersionTrans = event.result
+PASS setVersionTrans !== null is true
+store = setVersionTrans.objectStore('storeName')
+index = store.createIndex('indexFail', 'x')
+PASS db.version is "new version"
+PASS store.indexNames is ['indexName']
+PASS store.indexNames.length is 1
+PASS store.indexNames.contains('') is false
+PASS store.indexNames.contains('indexFail') is false
+PASS store.indexNames.contains('indexName') is true
+PASS store.indexNames[0] is "indexName"
+PASS store.indexNames[1] is null
+PASS store.indexNames[100] is null
+PASS store.indexNames.item(1) is null
+PASS store.indexNames.item(100) is null
+transaction = db.transaction()
+store = transaction.objectStore('storeName')
+store.add({x: 'value'}, 'key')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -113,7 +134,7 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.code is IDBDatabaseException.UNKNOWN_ERR
+PASS event.code is webkitIDBDatabaseException.UNKNOWN_ERR
 db.transaction()
 store = transaction.objectStore('storeName')
 store.get('key')
diff --git a/LayoutTests/storage/indexeddb/objectstore-basics.html b/LayoutTests/storage/indexeddb/objectstore-basics.html
index b2d383a..9730db8 100644
--- a/LayoutTests/storage/indexeddb/objectstore-basics.html
+++ b/LayoutTests/storage/indexeddb/objectstore-basics.html
@@ -16,7 +16,7 @@ if (window.layoutTestController)
 
 function test()
 {
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
     result.onsuccess = openSuccess;
     result.onerror = unexpectedErrorCallback;
@@ -26,21 +26,29 @@ function openSuccess()
 {
     debug("openSuccess():");
     verifySuccessEvent(event);
-    db = evalAndLog("db = event.result");
+    window.db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('storeName', null)");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = createSuccess;
+    result.onsuccess = setVersionSuccess;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createSuccess()
+function setVersionSuccess()
 {
-    debug("createSuccess():");
+    debug("setVersionSuccess():");
     verifySuccessEvent(event);
-    var store = evalAndLog("store = event.result");
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
+
+    deleteAllObjectStores(db, createObjectStore);
+}
+
+function createObjectStore()
+{
+    debug("creatObjectStore():");
+    window.store = evalAndLog("store = db.createObjectStore('storeName', null)");
     var storeNames = evalAndLog("storeNames = db.objectStores");
 
     shouldBeEqualToString("store.name", "storeName");
@@ -49,42 +57,92 @@ function createSuccess()
     shouldBe("storeNames.length", "1");
     // FIXME: test all of object store's methods.
 
-    debug("Ask for a store that doesn't exist:");
+    debug("Ask for an index that doesn't exist:");
     try {
-        index = evalAndLog("index = store.index('asdf')");
-        shouldBeNull("index"); // Returning null is wrong, but less wrong than returning an actual object!
+        debug("index = store.index('asdf')");
+        index = store.index('asdf');
         testFailed("Asking for a store that doesn't exist should have thrown.");
     } catch (err) {
-        testPassed("Error thrown.");
+        testPassed("Exception thrown.");
         // FIXME: Verify the correct exception thrown.
     }
 
-    result = evalAndLog("event.result.createIndex('indexName', 'x', true)"); // true == unique requirement.
-    verifyResult(result);
-    result.onsuccess = addIndexSuccess;
-    result.onerror = unexpectedErrorCallback;
+    createIndex();
 }
 
-function addIndexSuccess()
+function createIndex()
 {
-    debug("addIndexSuccess():");
-    verifySuccessEvent(event);
-    shouldBeTrue("event.result !== null");
-    shouldBeTrue("event.source.indexNames.contains('indexName')");
-    index = evalAndLog("index = event.source.index('indexName')");
+    debug("createIndex():");
+    var index = evalAndLog("index = store.createIndex('indexName', 'x', true)"); // true == unique requirement.
     shouldBeTrue("index !== null");
-
-    debug("Ask for a store that doesn't exist:");
+    shouldBeTrue("store.indexNames.contains('indexName')");
+    index = evalAndLog("index = store.index('indexName')");
+    shouldBeTrue("index !== null");
+ 
+    debug("Ask for an index that doesn't exist:");
     try {
-        index = evalAndLog("index = store.index('asdf')");
-        shouldBeNull("index"); // Returning null is wrong, but less wrong than returning an actual object!
+        debug("index = store.index('asdf')");
+        index = store.index('asdf');
         testFailed("Asking for a store that doesn't exist should have thrown.");
     } catch (err) {
-        testPassed("Error thrown.");
+        testPassed("Exception thrown.");
         // FIXME: Verify the correct exception thrown.
     }
 
-    result = evalAndLog("event.source.add({x: 'value'}, 'key')");
+    commitAndContinue();    
+}
+
+function commitAndContinue()
+{
+    window.setTimeout(testSetVersionAbort, 0);
+}
+
+function testSetVersionAbort()
+{
+    result = evalAndLog('db.setVersion("version fail")');
+    verifyResult(result);
+    result.onsuccess = createAnotherIndex;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function createAnotherIndex()
+{
+    verifySuccessEvent(event);
+    shouldBeEqualToString("db.version", "version fail");
+
+    var setVersionTrans = evalAndLog("setVersionTrans = event.result");
+    shouldBeTrue("setVersionTrans !== null");
+    setVersionTrans.oncomplete = unexpectedCompleteCallback;
+    setVersionTrans.onabort = checkMetadata;
+    window.store = evalAndLog("store = setVersionTrans.objectStore('storeName')");
+    var index = evalAndLog("index = store.createIndex('indexFail', 'x')");
+
+    setVersionTrans.abort();
+}
+
+function checkMetadata()
+{
+    shouldBeEqualToString("db.version", "new version");
+    shouldBe("store.indexNames", "['indexName']");
+    shouldBe("store.indexNames.length", "1");
+    shouldBe("store.indexNames.contains('')", "false");
+    shouldBe("store.indexNames.contains('indexFail')", "false");
+    shouldBe("store.indexNames.contains('indexName')", "true");
+    shouldBeEqualToString("store.indexNames[0]", "indexName");
+    shouldBeNull("store.indexNames[1]");
+    shouldBeNull("store.indexNames[100]");
+    shouldBeNull("store.indexNames.item(1)");
+    shouldBeNull("store.indexNames.item(100)");
+    addData();
+}
+
+
+function addData()
+{
+    var transaction = evalAndLog("transaction = db.transaction()");
+    transaction.onabort = unexpectedAbortCallback;
+    window.store = evalAndLog("store = transaction.objectStore('storeName')");
+    result = evalAndLog("store.add({x: 'value'}, 'key')");
     verifyResult(result);
     result.onsuccess = addSuccess;
     result.onerror = unexpectedErrorCallback;
@@ -107,7 +165,7 @@ function addAgainFailure()
     debug("addAgainFailure():");
     verifyErrorEvent(event);
     // FIXME: This error code needs to be specced.
-    shouldBe("event.code", "IDBDatabaseException.UNKNOWN_ERR");
+    shouldBe("event.code", "webkitIDBDatabaseException.UNKNOWN_ERR");
 
     transaction = evalAndLog("db.transaction()");
     transaction.onabort = unexpectedErrorCallback;
diff --git a/LayoutTests/storage/indexeddb/objectstore-cursor-expected.txt b/LayoutTests/storage/indexeddb/objectstore-cursor-expected.txt
index e7211f6..881fe92 100644
--- a/LayoutTests/storage/indexeddb/objectstore-cursor-expected.txt
+++ b/LayoutTests/storage/indexeddb/objectstore-cursor-expected.txt
@@ -3,7 +3,7 @@ Test IndexedDB's objectStore.openCursor + the cursor it produces in depth.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('someDB', 'some description')
+webkitIndexedDB.open('someDB', 'some description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,7 +21,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('someObjectStore')
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -38,18 +38,10 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-objectStore = event.result
-Success event fired:
-PASS 'result' in event is true
-PASS 'code' in event is false
-PASS 'message' in event is false
-PASS 'source' in event is true
-PASS event.source != null is true
-PASS 'onsuccess' in event.target is true
-PASS 'onerror' in event.target is true
-PASS 'readyState' in event.target is true
-PASS event.target.readyState is event.target.DONE
-
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+db.createObjectStore('someObjectStore')
 objectStore.add('', testData[nextToAdd])
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
diff --git a/LayoutTests/storage/indexeddb/objectstore-cursor.html b/LayoutTests/storage/indexeddb/objectstore-cursor.html
index 25e9456..d9ad805 100644
--- a/LayoutTests/storage/indexeddb/objectstore-cursor.html
+++ b/LayoutTests/storage/indexeddb/objectstore-cursor.html
@@ -28,38 +28,44 @@ window.testData = [
  
 function openDatabase()
 {
-    result = evalAndLog("indexedDB.open('someDB', 'some description')");
+    result = evalAndLog("webkitIndexedDB.open('someDB', 'some description')");
     verifyResult(result);
-    result.onsuccess = openObjectStore;
+    result.onsuccess = setVersion;
     result.onerror = unexpectedErrorCallback;
 }
  
-function openObjectStore()
+function setVersion()
 {
     verifySuccessEvent(event);
     window.db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('someObjectStore')");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = startAddingData;
+    result.onsuccess = deleteExisting;
     result.onerror = unexpectedErrorCallback;
 }
- 
-function startAddingData()
+
+function deleteExisting()
 {
     verifySuccessEvent(event);
-    window.objectStore = evalAndLog("objectStore = event.result");
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
 
+    deleteAllObjectStores(db, startAddingData);
+}
+ 
+function startAddingData()
+{
+    window.objectStore = evalAndLog("db.createObjectStore('someObjectStore')");
     window.nextToAdd = 0;
     addData();
 }
 
 function addData()
 {
-    // We cheat when called for the first time; we're in the context of the objectStore success event.
-    verifySuccessEvent(event);
+    if (window.nextToAdd > 0)
+        verifySuccessEvent(event);
 
     result = evalAndLog("objectStore.add('', testData[nextToAdd])");
     verifyResult(result);
@@ -93,7 +99,7 @@ function scheduleTests()
     }
  
     debug("Running tests...");
-    setTimeout(runNextTest, 0);
+    runNextTest();
 }
  
 function runNextTest()
@@ -152,13 +158,13 @@ function runNextTest()
  
     var keyRange;
     if (lower !== null && upper !== null)
-        keyRange = IDBKeyRange.bound(testData[lower], testData[upper], lowerIsOpen, upperIsOpen);
+        keyRange = webkitIDBKeyRange.bound(testData[lower], testData[upper], lowerIsOpen, upperIsOpen);
     else if (lower !== null)
-        keyRange = IDBKeyRange.leftBound(testData[lower], lowerIsOpen);
+        keyRange = webkitIDBKeyRange.leftBound(testData[lower], lowerIsOpen);
     else
-        keyRange = IDBKeyRange.rightBound(testData[upper], upperIsOpen);
+        keyRange = webkitIDBKeyRange.rightBound(testData[upper], upperIsOpen);
  
-    // FIXME: Should be IDBCursor.NEXT : IDBCursor.PREV, but we can't do that yet.
+    // FIXME: Should be webkitIDBCursor.NEXT : webkitIDBCursor.PREV, but we can't do that yet.
     var request = objectStore.openCursor(keyRange, ascending ? 0 : 2);
     request.onsuccess = cursorIteration;
     request.onerror = unexpectedErrorCallback;
@@ -182,12 +188,12 @@ function cursorIteration()
 {
     if (expectedIndex === null) {
         shouldBeNull("event.result");
-        setTimeout(runNextTest, 0);
+        runNextTest();
         return;
     }
     if (event.result === null) {
-        testFailed("Event.result should not be null.")
-        setTimeout(runNextTest, 0);
+        testFailed("Event.result should not be null.");
+        runNextTest();
         return;
     }
  
diff --git a/LayoutTests/storage/indexeddb/objectstore-removeobjectstore-expected.txt b/LayoutTests/storage/indexeddb/objectstore-removeobjectstore-expected.txt
index b7ba473..b6b20a2 100644
--- a/LayoutTests/storage/indexeddb/objectstore-removeobjectstore-expected.txt
+++ b/LayoutTests/storage/indexeddb/objectstore-removeobjectstore-expected.txt
@@ -1,9 +1,9 @@
-Test IndexedDB's IDBObjectStore.removeObjectStore().
+Test IndexedDB's webkitIDBObjectStore.removeObjectStore().
 
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('name', 'description')
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,7 +21,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('storeName', null)
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -38,7 +38,13 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-event.result.add('value', 'key')
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+store = db.createObjectStore('storeName', null)
+store.createIndex('indexName', '')
+PASS store.indexNames.contains('indexName') is true
+store.add('value', 'key')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -75,7 +81,7 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 PASS event.result is "value"
-event.source.createIndex('indexName', '')
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -92,41 +98,10 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-PASS event.source.indexNames.contains('indexName') is true
+trans = event.result
+PASS trans !== null is true
 db.removeObjectStore('storeName')
-PASS 'onsuccess' in result is true
-PASS 'onerror' in result is true
-PASS 'readyState' in result is true
-An event should fire shortly...
-
-Success event fired:
-PASS 'result' in event is true
-PASS 'code' in event is false
-PASS 'message' in event is false
-PASS 'source' in event is true
-PASS event.source != null is true
-PASS 'onsuccess' in event.target is true
-PASS 'onerror' in event.target is true
-PASS 'readyState' in event.target is true
-PASS event.target.readyState is event.target.DONE
-
 db.createObjectStore('storeName', null)
-PASS 'onsuccess' in result is true
-PASS 'onerror' in result is true
-PASS 'readyState' in result is true
-An event should fire shortly...
-
-Success event fired:
-PASS 'result' in event is true
-PASS 'code' in event is false
-PASS 'message' in event is false
-PASS 'source' in event is true
-PASS event.source != null is true
-PASS 'onsuccess' in event.target is true
-PASS 'onerror' in event.target is true
-PASS 'readyState' in event.target is true
-PASS event.target.readyState is event.target.DONE
-
 db.transaction()
 store = transaction.objectStore('storeName')
 store.get('key')
diff --git a/LayoutTests/storage/indexeddb/objectstore-removeobjectstore.html b/LayoutTests/storage/indexeddb/objectstore-removeobjectstore.html
index 7878c7f..c4418bc 100644
--- a/LayoutTests/storage/indexeddb/objectstore-removeobjectstore.html
+++ b/LayoutTests/storage/indexeddb/objectstore-removeobjectstore.html
@@ -10,36 +10,46 @@
 <div id="console"></div>
 <script>
 
-description("Test IndexedDB's IDBObjectStore.removeObjectStore().");
+description("Test IndexedDB's webkitIDBObjectStore.removeObjectStore().");
 if (window.layoutTestController) 
     layoutTestController.waitUntilDone();
 
 function test()
 {
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
-    result.onsuccess = createObjectStore;
+    result.onsuccess = startSetVersion;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createObjectStore()
+function startSetVersion()
 {
     verifySuccessEvent(event);
     db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('storeName', null)");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = addValue;
+    result.onsuccess = deleteExisting;
     result.onerror = unexpectedErrorCallback;
 }
 
-function addValue()
+function deleteExisting()
 {
     verifySuccessEvent(event);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+
+    deleteAllObjectStores(db, createObjectStoreAndAddValue);
+}
+
+function createObjectStoreAndAddValue()
+{
+    store = evalAndLog("store = db.createObjectStore('storeName', null)");
 
-    result = evalAndLog("event.result.add('value', 'key')");
+    window.index = evalAndLog("store.createIndex('indexName', '')");
+    shouldBeTrue("store.indexNames.contains('indexName')");
+
+    result = evalAndLog("store.add('value', 'key')");
     verifyResult(result);
     result.onsuccess = getValue;
     result.onerror = unexpectedErrorCallback;
@@ -64,42 +74,31 @@ function addIndex()
     verifySuccessEvent(event);
     shouldBeEqualToString("event.result", "value");
 
-    result = evalAndLog("event.source.createIndex('indexName', '')");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = commitTransaction;
+    result.onsuccess = removeObjectStore;
     result.onerror = unexpectedErrorCallback;
 }
 
-function commitTransaction()
+function removeObjectStore()
 {
     verifySuccessEvent(event);
-    shouldBeTrue("event.source.indexNames.contains('indexName')");
-    // Let the transaction commit.
-    window.setTimeout('removeObjectStore()', 0);
-}
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
 
-function removeObjectStore()
-{
-    result = evalAndLog("db.removeObjectStore('storeName')");
-    verifyResult(result);
-    result.onsuccess = createObjectStoreAgain;
-    result.onerror = unexpectedErrorCallback;
+    evalAndLog("db.removeObjectStore('storeName')");
+    createObjectStoreAgain();
 }
 
 function createObjectStoreAgain()
 {
-    verifySuccessEvent(event);
-
-    result = evalAndLog("db.createObjectStore('storeName', null)");
-    verifyResult(result);
-    result.onsuccess = getValueAgain;
-    result.onerror = unexpectedErrorCallback;
+    evalAndLog("db.createObjectStore('storeName', null)");
+    getValueAgain();
 }
 
 function getValueAgain()
 {
-    verifySuccessEvent(event);
-
     transaction = evalAndLog("db.transaction()");
     transaction.onabort = unexpectedErrorCallback;
     var store = evalAndLog("store = transaction.objectStore('storeName')");
diff --git a/LayoutTests/storage/indexeddb/open-cursor-expected.txt b/LayoutTests/storage/indexeddb/open-cursor-expected.txt
index bda103f..1bca527 100644
--- a/LayoutTests/storage/indexeddb/open-cursor-expected.txt
+++ b/LayoutTests/storage/indexeddb/open-cursor-expected.txt
@@ -3,7 +3,7 @@ Test IndexedDB's openCursor.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-indexedDB.open('name', 'description')
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
@@ -21,12 +21,13 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('test')
+db.setVersion('new version')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
+setVersionSuccess():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -38,7 +39,10 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
-objectStore = event.result
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+objectStore = db.createObjectStore('test')
 objectStore.add('myValue', 'myKey')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
@@ -46,7 +50,7 @@ PASS 'readyState' in result is true
 An event should fire shortly...
 
 Opening cursor
-objectStore.openCursor(keyRange)
+event.source.openCursor(keyRange)
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
diff --git a/LayoutTests/storage/indexeddb/open-cursor.html b/LayoutTests/storage/indexeddb/open-cursor.html
index 03d1da0..ec62f2c 100644
--- a/LayoutTests/storage/indexeddb/open-cursor.html
+++ b/LayoutTests/storage/indexeddb/open-cursor.html
@@ -25,7 +25,7 @@ function emptyCursorSuccess()
 function openEmptyCursor()
 {
     debug("Opening an empty cursor.");
-    keyRange = IDBKeyRange.leftBound("InexistentKey");
+    keyRange = webkitIDBKeyRange.leftBound("InexistentKey");
     result = evalAndLog("objectStore.openCursor(keyRange)");
     verifyResult(result);
     result.onsuccess = emptyCursorSuccess;
@@ -47,26 +47,31 @@ function cursorSuccess()
 function openCursor()
 {
     debug("Opening cursor");
-    keyRange = IDBKeyRange.leftBound("myKey");
-    result = evalAndLog("objectStore.openCursor(keyRange)");
+    keyRange = webkitIDBKeyRange.leftBound("myKey");
+    result = evalAndLog("event.source.openCursor(keyRange)");
     verifyResult(result);
     result.onsuccess = cursorSuccess;
     result.onerror = unexpectedErrorCallback;
-}
-
-function populateObjectStore(objectStore)
-{
+}

+

+function createAndPopulateObjectStore() 
+{

+    var objectStore = evalAndLog("objectStore = db.createObjectStore('test')");
     result = evalAndLog("objectStore.add('myValue', 'myKey')");
     verifyResult(result);
     result.onsuccess = openCursor;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createObjectStoreSuccess()
+function setVersionSuccess()
 {
+    debug("setVersionSuccess():");
     verifySuccessEvent(event);
-    var objectStore = evalAndLog("objectStore = event.result");
-    populateObjectStore(objectStore);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
+
+    deleteAllObjectStores(db, createAndPopulateObjectStore);
 }
 
 function openSuccess()
@@ -74,17 +79,15 @@ function openSuccess()
     verifySuccessEvent(event);
     var db = evalAndLog("db = event.result");
 
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('test')");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = createObjectStoreSuccess;
+    result.onsuccess = setVersionSuccess;
     result.onerror = unexpectedErrorCallback;
 }
 
 function test()
 {
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
     result.onsuccess = openSuccess;
     result.onerror = unexpectedErrorCallback;
diff --git a/LayoutTests/storage/indexeddb/queued-commands-expected.txt b/LayoutTests/storage/indexeddb/queued-commands-expected.txt
new file mode 100644
index 0000000..e2e20af
--- /dev/null
+++ b/LayoutTests/storage/indexeddb/queued-commands-expected.txt
@@ -0,0 +1,104 @@
+Verify that queuing up several commands works (and they all fire).
+
+On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
+
+
+webkitIndexedDB.open('name', 'description')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+db = event.result
+db.setVersion('new version')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+setVersionSuccess():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+db.createObjectStore('storeName', null)
+store.createIndex('indexName', 'x')
+store.add({x: 'value', y: 'zzz'}, 'key')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+store.add({x: 'value2', y: 'zzz2'}, 'key2')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+store.put({x: 'valu2', y: 'zz2'}, 'ky2')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+PASS 0 is 0
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+PASS 1 is 1
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+PASS 2 is 2
+PASS successfullyParsed is true
+
+TEST COMPLETE
+
diff --git a/LayoutTests/storage/indexeddb/queued-commands.html b/LayoutTests/storage/indexeddb/queued-commands.html
new file mode 100644
index 0000000..7dc94c3
--- /dev/null
+++ b/LayoutTests/storage/indexeddb/queued-commands.html
@@ -0,0 +1,87 @@
+<html>
+<head>
+<link rel="stylesheet" href="../../fast/js/resources/js-test-style.css">
+<script src="../../fast/js/resources/js-test-pre.js"></script>
+<script src="../../fast/js/resources/js-test-post-function.js"></script>
+<script src="resources/shared.js"></script>
+</head>
+<body>
+<p id="description"></p>
+<div id="console"></div>
+<script>
+
+description("Verify that queuing up several commands works (and they all fire).");
+if (window.layoutTestController) 
+    layoutTestController.waitUntilDone();
+
+function test()
+{
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
+    verifyResult(result);
+    result.onsuccess = setVersion;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function setVersion()
+{
+    verifySuccessEvent(event);
+    db = evalAndLog("db = event.result");
+
+    result = evalAndLog("db.setVersion('new version')");
+    verifyResult(result);
+    result.onsuccess = deleteExisting;
+    result.onerror = unexpectedErrorCallback;
+}
+
+function deleteExisting()
+{
+    debug("setVersionSuccess():");
+    verifySuccessEvent(event);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
+
+    deleteAllObjectStores(db, createIndex);
+}
+
+function createIndex()
+{
+    window.store = evalAndLog("db.createObjectStore('storeName', null)");
+    window.indexObject = evalAndLog("store.createIndex('indexName', 'x')");
+
+    result = evalAndLog("store.add({x: 'value', y: 'zzz'}, 'key')");
+    verifyResult(result);
+    result.onsuccess = function() { verifyAdd(0); };
+    result.onerror = unexpectedErrorCallback;
+
+    result = evalAndLog("store.add({x: 'value2', y: 'zzz2'}, 'key2')");
+    verifyResult(result);
+    result.onsuccess = function() { verifyAdd(1); };
+    result.onerror = unexpectedErrorCallback;
+
+    result = evalAndLog("store.put({x: 'valu2', y: 'zz2'}, 'ky2')");
+    verifyResult(result);
+    result.onsuccess = function() { verifyAdd(2); };
+    result.onerror = unexpectedErrorCallback;
+
+    window.addCount = 0;
+}
+
+function verifyAdd(expected)
+{
+    verifySuccessEvent(event);
+    shouldBe("" + addCount++, "" + expected);
+
+    if (addCount == 3)
+        done();
+    if (addCount > 3)
+        testFailed("Unexpected call to verifyAdd!");
+}
+
+test();
+
+var successfullyParsed = true;
+
+</script>
+</body>
+</html>
diff --git a/LayoutTests/storage/indexeddb/resources/shared.js b/LayoutTests/storage/indexeddb/resources/shared.js
index 65da3bf..01ec606 100644
--- a/LayoutTests/storage/indexeddb/resources/shared.js
+++ b/LayoutTests/storage/indexeddb/resources/shared.js
@@ -40,6 +40,12 @@ function verifyAbortEvent(event)
     shouldBeEqualToString("event.type", "abort");
 }
 
+function verifyCompleteEvent(event)
+{
+    debug("Complete event fired:");
+    shouldBeEqualToString("event.type", "complete");
+}
+
 function verifyResult(result)
 {
     shouldBeTrue("'onsuccess' in result");
@@ -65,9 +71,28 @@ function unexpectedErrorCallback()
     done();
 }
 
-function deleteAllObjectStores(db)
+function unexpectedAbortCallback()
+{
+    testFailed("Abort function called unexpectedly!");
+    debug("");
+    verifyAbortEvent(event);
+    done();
+}
+
+function unexpectedCompleteCallback()
 {
-    objectStores = db.objectStores;
-    for (var i = 0; i < objectStores.length; ++i)
-        db.removeObjectStore(objectStores[i]);
+    testFailed("oncomplete function called unexpectedly!");
+    debug("");
+    verifyCompleteEvent(event);
+    done();
+}
+
+// FIXME: remove the onfinished parameter.
+function deleteAllObjectStores(db, onfinished)
+{
+    while (db.objectStores.length)
+        db.removeObjectStore(db.objectStores.item(0));
+
+    debug("Deleted all object stores.");
+    onfinished();
 }
diff --git a/LayoutTests/storage/indexeddb/transaction-basics-expected.txt b/LayoutTests/storage/indexeddb/transaction-basics-expected.txt
index bba62f0..b493946 100644
--- a/LayoutTests/storage/indexeddb/transaction-basics-expected.txt
+++ b/LayoutTests/storage/indexeddb/transaction-basics-expected.txt
@@ -3,15 +3,15 @@ Test IndexedDB transaction basics.
 On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE".
 
 
-PASS 'indexedDB' in window is true
-PASS indexedDB == null is false
-indexedDB.open('name', 'description')
+PASS 'webkitIndexedDB' in window is true
+PASS webkitIndexedDB == null is false
+webkitIndexedDB.open('name', 'description')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
-createObjectStoreCallback():
+openSuccess():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -24,12 +24,32 @@ PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
 db = event.result
-db.createObjectStore('storeName', null)
+result = db.setVersion('version 1')
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+Deleted all object stores.
+PASS window.db.objectStores is []
+PASS window.db.objectStores.length is 0
+PASS window.db.objectStores.contains('storeFail') is false
+PASS window.db.objectStores is []
+PASS window.db.objectStores.length is 0
+PASS window.db.objectStores.contains('storeFail') is false
+result = startSetVersion('version fail')
 PASS 'onsuccess' in result is true
 PASS 'onerror' in result is true
 PASS 'readyState' in result is true
 An event should fire shortly...
 
+addRemoveIDBObjects():
 Success event fired:
 PASS 'result' in event is true
 PASS 'code' in event is false
@@ -41,11 +61,125 @@ PASS 'onerror' in event.target is true
 PASS 'readyState' in event.target is true
 PASS event.target.readyState is event.target.DONE
 
+trans = event.result
+PASS trans !== null is true
+store = db.createObjectStore('storeFail', null)
+index = store.createIndex('indexFail', 'x', false)
+db.removeObjectStore('storeFail')
+store.removeIndex('indexFail')
+PASS window.db.objectStores is []
+PASS window.db.objectStores.length is 0
+PASS window.db.objectStores.contains('storeFail') is false
+result = startSetVersion('version fail')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+addRemoveAddIDBObjects():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+store = db.createObjectStore('storeFail', null)
+index = store.createIndex('indexFail', 'x', false)
+db.removeObjectStore('storeFail')
+store.removeIndex('indexFail')
+store = db.createObjectStore('storeFail', null)
+index = store.createIndex('indexFail', 'x', false)
+PASS window.db.objectStores is []
+PASS window.db.objectStores.length is 0
+PASS window.db.objectStores.contains('storeFail') is false
+result = startSetVersion('version fail')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+addIDBObjects():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+store = db.createObjectStore('storeFail', null)
+index = store.createIndex('indexFail', 'x', false)
+PASS db.objectStores is ['storeFail']
+PASS db.objectStores.length is 1
+PASS db.objectStores.contains('storeFail') is true
+result = startSetVersion('version fail')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+removeIDBObjects():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+store = trans.objectStore('storeFail')
+store.removeIndex('indexFail')
+db.removeObjectStore('storeFail')
+PASS db.objectStores is ['storeFail']
+PASS db.objectStores.length is 1
+PASS db.objectStores.contains('storeFail') is true
+db.setVersion('new version')
+PASS 'onsuccess' in result is true
+PASS 'onerror' in result is true
+PASS 'readyState' in result is true
+An event should fire shortly...
+
+setVersionSuccess():
+Success event fired:
+PASS 'result' in event is true
+PASS 'code' in event is false
+PASS 'message' in event is false
+PASS 'source' in event is true
+PASS event.source != null is true
+PASS 'onsuccess' in event.target is true
+PASS 'onerror' in event.target is true
+PASS 'readyState' in event.target is true
+PASS event.target.readyState is event.target.DONE
+
+trans = event.result
+PASS trans !== null is true
+Deleted all object stores.
+db.createObjectStore('storeName', null)
 db.transaction()
 store = transaction.objectStore('storeName')
 PASS store.name is "storeName"
 Abort event fired:
 PASS event.type is "abort"
+Complete event fired:
+PASS event.type is "complete"
+PASS oncomplete event had fired
 PASS successfullyParsed is true
 
 TEST COMPLETE
diff --git a/LayoutTests/storage/indexeddb/transaction-basics.html b/LayoutTests/storage/indexeddb/transaction-basics.html
index cea5d5d..07fc685 100644
--- a/LayoutTests/storage/indexeddb/transaction-basics.html
+++ b/LayoutTests/storage/indexeddb/transaction-basics.html
@@ -16,48 +16,239 @@ if (window.layoutTestController)
 
 function test()
 {
-    shouldBeTrue("'indexedDB' in window");
-    shouldBeFalse("indexedDB == null");
+    shouldBeTrue("'webkitIndexedDB' in window");
+    shouldBeFalse("webkitIndexedDB == null");
 
-    result = evalAndLog("indexedDB.open('name', 'description')");
+    result = evalAndLog("webkitIndexedDB.open('name', 'description')");
     verifyResult(result);
     result.onsuccess = openSuccess;
     result.onerror = unexpectedErrorCallback;
+}

+

+function openSuccess()

+{

+    debug("openSuccess():");

+    verifySuccessEvent(event);

+    window.db = evalAndLog("db = event.result");

+    result = evalAndLog("result = db.setVersion('version 1')");

+    result.onsuccess = cleanDatabase;

+    result.onerror = unexpectedErrorCallback;

+}

+

+function cleanDatabase()

+{

+    verifySuccessEvent(event);

+    deleteAllObjectStores(db, checkMetadataEmpty);

+    commitAndContinue(testSetVersionAbort1);

+}

+

+function testSetVersionAbort1()

+{

+    checkMetadataEmpty();

+    result = evalAndLog("result = startSetVersion('version fail')");

+    result.onsuccess = addRemoveIDBObjects;

+}

+

+function addRemoveIDBObjects()

+{

+    debug("addRemoveIDBObjects():");

+    verifySuccessEvent(event);

+    var trans = evalAndLog("trans = event.result");

+    shouldBeTrue("trans !== null");

+    trans.onabort = testSetVersionAbort2;

+    trans.oncomplete = unexpectedCompleteCallback;

+

+    var store = evalAndLog("store = db.createObjectStore('storeFail', null)");

+    var index = evalAndLog("index = store.createIndex('indexFail', 'x', false)");

+

+    evalAndLog("db.removeObjectStore('storeFail')");

+    evalAndLog("store.removeIndex('indexFail')");

+

+    trans.abort();

+}

+

+function testSetVersionAbort2()

+{

+    checkMetadataEmpty();

+    result = evalAndLog("result = startSetVersion('version fail')");

+    result.onsuccess = addRemoveAddIDBObjects;

+}

+

+function addRemoveAddIDBObjects()

+{

+    debug("addRemoveAddIDBObjects():");

+    verifySuccessEvent(event);

+    var trans = evalAndLog("trans = event.result");

+    shouldBeTrue("trans !== null");

+    trans.onabort = testSetVersionAbort3;

+    trans.oncomplete = unexpectedCompleteCallback;

+

+    var store = evalAndLog("store = db.createObjectStore('storeFail', null)");

+    var index = evalAndLog("index = store.createIndex('indexFail', 'x', false)");

+

+    evalAndLog("db.removeObjectStore('storeFail')");

+    evalAndLog("store.removeIndex('indexFail')");

+

+    var store = evalAndLog("store = db.createObjectStore('storeFail', null)");

+    var index = evalAndLog("index = store.createIndex('indexFail', 'x', false)");

+

+    trans.abort();

+}

+

+function testSetVersionAbort3()

+{

+    checkMetadataEmpty();

+    result = evalAndLog("result = startSetVersion('version fail')");

+    result.onsuccess = addIDBObjects;

+}

+

+function addIDBObjects()

+{

+    debug("addIDBObjects():");

+    verifySuccessEvent(event);

+    var trans = evalAndLog("trans = event.result");

+    shouldBeTrue("trans !== null");

+    trans.onabort = testSetVersionAbort4;

+    trans.oncomplete = unexpectedCompleteCallback;

+

+    var store = evalAndLog("store = db.createObjectStore('storeFail', null)");

+    var index = evalAndLog("index = store.createIndex('indexFail', 'x', false)");

+

+    trans.abort();

+}

+

+function testSetVersionAbort4()

+{

+    checkMetadataEmpty();

+    result = evalAndLog("result = startSetVersion('version fail')");

+    result.onsuccess = addIDBObjectsAndCommit;

+}

+

+function addIDBObjects()

+{

+    debug("addIDBObjects():");

+    verifySuccessEvent(event);

+    var trans = evalAndLog("trans = event.result");

+    shouldBeTrue("trans !== null");

+    trans.onabort = unexpectedAbortCallback;

+

+    var store = evalAndLog("store = db.createObjectStore('storeFail', null)");

+    var index = evalAndLog("index = store.createIndex('indexFail', 'x', false)");

+

+    commitAndContinue(testSetVersionAbort5);

+}

+

+function commitAndContinue(continueFunction)

+{

+    window.setTimeout(continueFunction, 0);

+}

+

+function testSetVersionAbort5()

+{

+    checkMetadataExistingObjectStore();

+    result = evalAndLog("result = startSetVersion('version fail')");

+    result.onsuccess = removeIDBObjects;

+}

+

+function removeIDBObjects()

+{

+    debug("removeIDBObjects():");

+    verifySuccessEvent(event);

+    var trans = evalAndLog("trans = event.result");

+    shouldBeTrue("trans !== null");

+    trans.onabort = testSetVersionAbort6;

+    trans.oncomplete = unexpectedCompleteCallback;

+

+    var store = evalAndLog("store = trans.objectStore('storeFail')");

+    evalAndLog("store.removeIndex('indexFail')");

+    evalAndLog("db.removeObjectStore('storeFail')");

+

+    trans.abort();

+}

+

+function testSetVersionAbort6()

+{

+    checkMetadataExistingObjectStore();

+    setNewVersion();

+}

+

+function startSetVersion(versionName)

+{

+    result = db.setVersion(versionName);

+    verifyResult(result);

+    result.onerror = unexpectedErrorCallback;

+    return result;

+}

+

+function checkMetadataEmpty()

+{

+    shouldBe("window.db.objectStores", "[]");

+    shouldBe("window.db.objectStores.length", "0");

+    shouldBe("window.db.objectStores.contains('storeFail')", "false");
+}

+

+function checkMetadataExistingObjectStore()

+{

+    shouldBe("db.objectStores", "['storeFail']");

+    shouldBe("db.objectStores.length", "1");

+    shouldBe("db.objectStores.contains('storeFail')", "true");

 }
 
-function openSuccess()
+function setNewVersion()
 {
-    debug("createObjectStoreCallback():");
-    verifySuccessEvent(event);
-    db = evalAndLog("db = event.result");
-
-    deleteAllObjectStores(db);
-
-    result = evalAndLog("db.createObjectStore('storeName', null)");
+    result = evalAndLog("db.setVersion('new version')");
     verifyResult(result);
-    result.onsuccess = createSuccess;
+    result.onsuccess = setVersionSuccess;
     result.onerror = unexpectedErrorCallback;
 }
 
-function createSuccess()
+function setVersionSuccess()
 {
+    debug("setVersionSuccess():");
     verifySuccessEvent(event);
+    window.trans = evalAndLog("trans = event.result");
+    shouldBeTrue("trans !== null");
+    trans.onabort = unexpectedAbortCallback;
+    trans.oncomplete = completeCallback;
+    window.completeEventFired = false;
+
+    deleteAllObjectStores(db, createObjectStoreAndStartTransaction);
+}

+

+function createObjectStoreAndStartTransaction()

+{

+    evalAndLog("db.createObjectStore('storeName', null)");
     transaction = evalAndLog("db.transaction()");
     transaction.onabort = abortCallback;
     var store = evalAndLog("store = transaction.objectStore('storeName')");
     shouldBeEqualToString("store.name", "storeName");
 }
 
+function completeCallback()
+{
+    verifyCompleteEvent(event);
+    window.completeEventFired = true;
+}
+
 function abortCallback()
 {
     verifyAbortEvent(event);
-    done();
+    checkForCompleteEvent();
 }
 
-test();
+function checkForCompleteEvent()
+{
+    if (completeEventFired) {
+        testPassed("oncomplete event had fired");
+        done();
+    } else
+        setTimeout(checkForCompleteEvent, 1);
+}
 
 var successfullyParsed = true;
 
+test();
+
 </script>
 </body>
 </html>
diff --git a/WebCore/Android.mk b/WebCore/Android.mk
index 50a4b33..0d78865 100644
--- a/WebCore/Android.mk
+++ b/WebCore/Android.mk
@@ -40,7 +40,6 @@ LOCAL_SRC_FILES := \
 	css/CSSFontSelector.cpp \
 	css/CSSFunctionValue.cpp \
 	css/CSSGradientValue.cpp \
-	css/CSSHelper.cpp \
 	css/CSSImageGeneratorValue.cpp \
 	css/CSSImageValue.cpp \
 	css/CSSImportRule.cpp \
@@ -208,6 +207,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	dom/default/PlatformMessagePortChannel.cpp \
 	\
 	editing/AppendNodeCommand.cpp \
+	editing/ApplyBlockElementCommand.cpp \
 	editing/ApplyStyleCommand.cpp \
 	editing/BreakBlockquoteCommand.cpp \
 	editing/CompositeEditCommand.cpp \
@@ -229,6 +229,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	editing/InsertParagraphSeparatorCommand.cpp \
 	editing/InsertTextCommand.cpp \
 	editing/JoinTextNodesCommand.cpp \
+	editing/MarkupAccumulator.cpp \
 	editing/MergeIdenticalElementsCommand.cpp \
 	editing/ModifySelectionListLevel.cpp \
 	editing/MoveSelectionCommand.cpp \
@@ -275,6 +276,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	history/android/HistoryItemAndroid.cpp \
 	\
 	html/AsyncImageResizer.cpp \
+	html/BaseDateAndTimeInputType.cpp \
 	html/BaseTextInputType.cpp \
 	html/ButtonInputType.cpp \
 	html/CheckboxInputType.cpp \
@@ -384,7 +386,7 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	loader/PolicyCallback.cpp \
 	loader/PolicyChecker.cpp \
 	loader/ProgressTracker.cpp \
-	loader/RedirectScheduler.cpp \
+	loader/NavigationScheduler.cpp \
 	loader/Request.cpp \
 	loader/ResourceLoadNotifier.cpp \
 	loader/ResourceLoader.cpp \
@@ -673,8 +675,11 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	platform/text/RegularExpression.cpp \
 	platform/text/SegmentedString.cpp \
 	platform/text/String.cpp \
+<<<<<<< HEAD
 	platform/text/StringBuilder.cpp \
 	platform/text/TextBoundaries.cpp \
+=======
+>>>>>>> webkit.org at r70209
 	platform/text/TextBreakIteratorICU.cpp \
 	platform/text/TextCodec.cpp \
 	platform/text/TextCodecICU.cpp \
@@ -756,7 +761,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	rendering/RenderObject.cpp \
 	rendering/RenderObjectChildList.cpp \
 	rendering/RenderPart.cpp \
-	rendering/RenderPath.cpp \
 	rendering/RenderReplaced.cpp \
 	rendering/RenderReplica.cpp \
 	rendering/RenderRuby.cpp \
@@ -771,8 +775,6 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	rendering/RenderSVGGradientStop.cpp \
 	rendering/RenderSVGHiddenContainer.cpp \
 	rendering/RenderSVGImage.cpp \
-	rendering/RenderSVGInline.cpp \
-	rendering/RenderSVGInlineText.cpp \
 	rendering/RenderSVGModelObject.cpp \
 	rendering/RenderSVGResource.cpp \
 	rendering/RenderSVGResourceClipper.cpp \
@@ -788,13 +790,26 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 	rendering/RenderSVGResourceSolidColor.cpp \
 	rendering/RenderSVGRoot.cpp \
 	rendering/RenderSVGShadowTreeRootContainer.cpp \
-	rendering/RenderSVGTSpan.cpp \
-	rendering/RenderSVGText.cpp \
-	rendering/RenderSVGTextPath.cpp \
 	rendering/RenderSVGTransformableContainer.cpp \
 	rendering/RenderSVGViewportContainer.cpp \
+	rendering/svg/RenderSVGInline.cpp \
+	rendering/svg/RenderSVGInlineText.cpp \
+	rendering/svg/RenderSVGPath.cpp \
+	rendering/svg/RenderSVGTSpan.cpp \
+	rendering/svg/RenderSVGText.cpp \
+	rendering/svg/RenderSVGTextPath.cpp \
+	rendering/svg/SVGInlineFlowBox.cpp \
+	rendering/svg/SVGInlineTextBox.cpp \
+	rendering/svg/SVGRootInlineBox.cpp \
+	rendering/svg/SVGTextChunk.cpp \
+	rendering/svg/SVGTextChunkBuilder.cpp \
 	rendering/svg/SVGTextLayoutAttributes.cpp \
-	rendering/svg/SVGTextLayoutBuilder.cpp
+	rendering/svg/SVGTextLayoutAttributesBuilder.cpp \
+	rendering/svg/SVGTextLayoutEngine.cpp \
+	rendering/svg/SVGTextLayoutEngineBaseline.cpp \
+	rendering/svg/SVGTextLayoutEngineSpacing.cpp \
+	rendering/svg/SVGTextMetrics.cpp \
+	rendering/svg/SVGTextQuery.cpp
 endif
 
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
@@ -822,22 +837,14 @@ LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
 
 ifeq ($(ENABLE_SVG), true)
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
-	rendering/SVGCharacterData.cpp \
-	rendering/SVGCharacterLayoutInfo.cpp \
 	rendering/SVGImageBufferTools.cpp \
-	rendering/SVGInlineFlowBox.cpp \
-	rendering/SVGInlineTextBox.cpp \
 	rendering/SVGMarkerLayoutInfo.cpp \
 	rendering/SVGRenderSupport.cpp \
 	rendering/SVGRenderTreeAsText.cpp \
 	rendering/SVGResources.cpp \
 	rendering/SVGResourcesCache.cpp \
 	rendering/SVGResourcesCycleSolver.cpp \
-	rendering/SVGRootInlineBox.cpp \
-	rendering/SVGShadowTreeElements.cpp \
-	rendering/SVGTextChunkLayoutInfo.cpp \
-	rendering/SVGTextLayoutUtilities.cpp \
-	rendering/SVGTextQuery.cpp
+	rendering/SVGShadowTreeElements.cpp
 endif
 
 LOCAL_SRC_FILES := $(LOCAL_SRC_FILES) \
diff --git a/WebCore/Android.v8bindings.mk b/WebCore/Android.v8bindings.mk
index aa85532..e10adb7 100644
--- a/WebCore/Android.v8bindings.mk
+++ b/WebCore/Android.v8bindings.mk
@@ -123,7 +123,12 @@ LOCAL_SRC_FILES += \
 	bindings/v8/custom/V8ElementCustom.cpp \
 	bindings/v8/custom/V8EventCustom.cpp \
 	bindings/v8/custom/V8EventSourceConstructor.cpp \
+<<<<<<< HEAD
 	bindings/v8/custom/V8Float32ArrayCustom.cpp \
+=======
+	bindings/v8/custom/V8FileListCustom.cpp \
+    bindings/v8/custom/V8FileReaderCustom.cpp \
+>>>>>>> webkit.org at r70209
 	bindings/v8/custom/V8GeolocationCustom.cpp \
 	bindings/v8/custom/V8HistoryCustom.cpp \
 	bindings/v8/custom/V8HTMLAllCollectionCustom.cpp \
diff --git a/WebCore/CMakeLists.txt b/WebCore/CMakeLists.txt
index 2219e4f..42e344a 100644
--- a/WebCore/CMakeLists.txt
+++ b/WebCore/CMakeLists.txt
@@ -38,6 +38,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/image-decoders/ico"
     "${WEBCORE_DIR}/platform/image-decoders/jpeg"
     "${WEBCORE_DIR}/platform/image-decoders/png"
+    "${WEBCORE_DIR}/platform/image-decoders/webp"
     "${WEBCORE_DIR}/platform/mock"
     "${WEBCORE_DIR}/platform/network"
     "${WEBCORE_DIR}/platform/sql"
@@ -52,6 +53,7 @@ SET(WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/svg/animation"
     "${WEBCORE_DIR}/svg/graphics"
     "${WEBCORE_DIR}/svg/graphics/filters"
+    "${WEBCORE_DIR}/svg/properties"
     "${WEBCORE_DIR}/websockets"
     "${WEBCORE_DIR}/wml"
     "${WEBCORE_DIR}/workers"
@@ -727,7 +729,6 @@ SET(WebCore_SOURCES
     css/CSSFontSelector.cpp
     css/CSSFunctionValue.cpp
     css/CSSGradientValue.cpp
-    css/CSSHelper.cpp
     css/CSSImageGeneratorValue.cpp
     css/CSSImageValue.cpp
     css/CSSImportRule.cpp
@@ -885,6 +886,7 @@ SET(WebCore_SOURCES
     dom/default/PlatformMessagePortChannel.cpp
 
     editing/AppendNodeCommand.cpp
+    editing/ApplyBlockElementCommand.cpp
     editing/ApplyStyleCommand.cpp
     editing/BreakBlockquoteCommand.cpp
     editing/CompositeEditCommand.cpp
@@ -906,6 +908,7 @@ SET(WebCore_SOURCES
     editing/InsertParagraphSeparatorCommand.cpp
     editing/InsertTextCommand.cpp
     editing/JoinTextNodesCommand.cpp
+    editing/MarkupAccumulator.cpp
     editing/MergeIdenticalElementsCommand.cpp
     editing/ModifySelectionListLevel.cpp
     editing/MoveSelectionCommand.cpp
@@ -946,6 +949,7 @@ SET(WebCore_SOURCES
     history/PageCache.cpp
 
     html/AsyncImageResizer.cpp
+    html/BaseDateAndTimeInputType.cpp
     html/BaseTextInputType.cpp
     html/ButtonInputType.cpp
     html/CheckboxInputType.cpp
@@ -1100,7 +1104,9 @@ SET(WebCore_SOURCES
     inspector/InjectedScriptHost.cpp
     inspector/InspectorApplicationCacheAgent.cpp
     inspector/InspectorBackend.cpp
+    inspector/InspectorCSSAgent.cpp
     inspector/InspectorCSSStore.cpp
+    inspector/InspectorClient.cpp
     inspector/InspectorController.cpp
     inspector/InspectorDOMAgent.cpp
     inspector/InspectorDOMStorageResource.cpp
@@ -1108,9 +1114,13 @@ SET(WebCore_SOURCES
     inspector/InspectorDebuggerAgent.cpp
     inspector/InspectorFrontendClientLocal.cpp
     inspector/InspectorFrontendHost.cpp
+    inspector/InspectorInstrumentation.cpp
     inspector/InspectorProfilerAgent.cpp
     inspector/InspectorResource.cpp
+    inspector/InspectorResourceAgent.cpp
+    inspector/InspectorStyleSheet.cpp
     inspector/InspectorValues.cpp
+    inspector/InspectorState.cpp
     inspector/InspectorStorageAgent.cpp
     inspector/InspectorTimelineAgent.cpp
     inspector/ScriptBreakpoint.cpp
@@ -1146,7 +1156,7 @@ SET(WebCore_SOURCES
     loader/PolicyCallback.cpp
     loader/PolicyChecker.cpp
     loader/ProgressTracker.cpp
-    loader/RedirectScheduler.cpp
+    loader/NavigationScheduler.cpp
     loader/Request.cpp
     loader/ResourceLoadNotifier.cpp
     loader/ResourceLoader.cpp
@@ -1236,6 +1246,7 @@ SET(WebCore_SOURCES
     platform/GeolocationService.cpp
     platform/KURL.cpp
     platform/KillRingNone.cpp
+    platform/Language.cpp
     platform/Length.cpp
     platform/LinkHash.cpp
     platform/Logging.cpp
@@ -1258,6 +1269,7 @@ SET(WebCore_SOURCES
 
     platform/graphics/BitmapImage.cpp
     platform/graphics/Color.cpp
+    platform/graphics/ContextShadow.cpp
     platform/graphics/FloatPoint.cpp
     platform/graphics/FloatPoint3D.cpp
     platform/graphics/FloatQuad.cpp
@@ -1305,7 +1317,6 @@ SET(WebCore_SOURCES
     platform/graphics/filters/FETile.cpp
     platform/graphics/filters/FETurbulence.cpp
     platform/graphics/filters/FilterEffect.cpp
-    platform/graphics/filters/ImageBufferFilter.cpp
     platform/graphics/filters/LightSource.cpp
     platform/graphics/filters/SourceAlpha.cpp
     platform/graphics/filters/SourceGraphic.cpp
@@ -1329,6 +1340,7 @@ SET(WebCore_SOURCES
     platform/image-decoders/ico/ICOImageDecoder.cpp
     platform/image-decoders/jpeg/JPEGImageDecoder.cpp
     platform/image-decoders/png/PNGImageDecoder.cpp
+    platform/image-decoders/webp/WEBPImageDecoder.cpp
 
     platform/mock/DeviceOrientationClientMock.cpp
     platform/mock/GeolocationServiceMock.cpp
@@ -1338,6 +1350,7 @@ SET(WebCore_SOURCES
     platform/network/BlobRegistryImpl.cpp
     platform/network/BlobResourceHandle.cpp
     platform/network/Credential.cpp
+    platform/network/DataURL.cpp
     platform/network/FormDataBuilder.cpp
     platform/network/FormData.cpp
     platform/network/HTTPHeaderMap.cpp
@@ -1357,7 +1370,6 @@ SET(WebCore_SOURCES
     platform/text/RegularExpression.cpp
     platform/text/SegmentedString.cpp
     platform/text/String.cpp
-    platform/text/StringBuilder.cpp
     platform/text/TextBoundaries.cpp
     platform/text/TextCodec.cpp
     platform/text/TextCodecLatin1.cpp
@@ -1614,17 +1626,41 @@ IF (ENABLE_MATHML)
     )
 ENDIF ()
 
+IF (ENABLE_NETSCAPE_PLUGIN_API)
+    LIST(APPEND WebCore_SOURCES
+        plugins/PluginDebug.cpp
+        plugins/PluginStream.cpp
+        plugins/PluginPackage.cpp
+        plugins/PluginView.cpp
+        plugins/npapi.cpp
+    )
+ELSE ()
+    LIST(APPEND WebCore_SOURCES
+        plugins/PluginPackageNone.cpp
+        plugins/PluginViewNone.cpp
+    )
+ENDIF ()
+
 if (ENABLE_FILE_SYSTEM)
     LIST(APPEND WebCore_SOURCES
         bindings/js/JSDirectoryEntryCustom.cpp
+        bindings/js/JSDirectoryEntrySyncCustom.cpp
         bindings/js/JSEntryCustom.cpp
+        bindings/js/JSEntrySyncCustom.cpp
         fileapi/DirectoryEntry.cpp
+        fileapi/DirectoryEntrySync.cpp
         fileapi/DirectoryReader.cpp
+        fileapi/DirectoryReaderSync.cpp
         fileapi/DOMFilePath.cpp
         fileapi/DOMFileSystem.cpp
+        fileapi/DOMFileSystemBase.cpp
+        fileapi/DOMFileSystemSync.cpp
         fileapi/Entry.cpp
         fileapi/EntryArray.cpp
+        fileapi/EntryArraySync.cpp
+        fileapi/EntrySync.cpp
         fileapi/FileEntry.cpp
+        fileapi/FileEntrySync.cpp
         fileapi/FileSystemCallbacks.cpp
         fileapi/FileWriter.cpp
         fileapi/LocalFileSystem.cpp
@@ -1632,15 +1668,21 @@ if (ENABLE_FILE_SYSTEM)
     )
     LIST(APPEND WebCore_IDL_FILES
         fileapi/DirectoryEntry.idl
+        fileapi/DirectoryEntrySync.idl
         fileapi/DirectoryReader.idl
+        fileapi/DirectoryReaderSync.idl
         fileapi/DOMFileSystem.idl
+        fileapi/DOMFileSystemSync.idl
         fileapi/EntriesCallback.idl
         fileapi/Entry.idl
+        fileapi/EntrySync.idl
         fileapi/EntryArray.idl
+        fileapi/EntryArraySync.idl
         fileapi/EntryCallback.idl
         fileapi/ErrorCallback.idl
         fileapi/FileCallback.idl
         fileapi/FileEntry.idl
+        fileapi/FileEntrySync.idl
         fileapi/FileSystemCallback.idl
         fileapi/FileWriterCallback.idl
         fileapi/FileWriter.idl
@@ -1662,14 +1704,11 @@ IF (ENABLE_SVG)
         css/SVGCSSStyleSelector.cpp
         rendering/PointerEventsHitRules.cpp
         rendering/RenderForeignObject.cpp
-        rendering/RenderPath.cpp
         rendering/RenderSVGBlock.cpp
         rendering/RenderSVGContainer.cpp
         rendering/RenderSVGGradientStop.cpp
         rendering/RenderSVGHiddenContainer.cpp
         rendering/RenderSVGImage.cpp
-        rendering/RenderSVGInline.cpp
-        rendering/RenderSVGInlineText.cpp
         rendering/RenderSVGModelObject.cpp
         rendering/RenderSVGResource.cpp
         rendering/RenderSVGResourceClipper.cpp
@@ -1685,31 +1724,36 @@ IF (ENABLE_SVG)
         rendering/RenderSVGResourceSolidColor.cpp
         rendering/RenderSVGRoot.cpp
         rendering/RenderSVGShadowTreeRootContainer.cpp
-        rendering/RenderSVGTSpan.cpp
-        rendering/RenderSVGText.cpp
-        rendering/RenderSVGTextPath.cpp
         rendering/RenderSVGTransformableContainer.cpp
         rendering/RenderSVGViewportContainer.cpp
-        rendering/SVGCharacterData.cpp
-        rendering/SVGCharacterLayoutInfo.cpp
         rendering/SVGImageBufferTools.cpp
-        rendering/SVGInlineFlowBox.cpp
-        rendering/SVGInlineTextBox.cpp
         rendering/SVGMarkerLayoutInfo.cpp
         rendering/SVGRenderSupport.cpp
         rendering/SVGRenderTreeAsText.cpp
         rendering/SVGResources.cpp
         rendering/SVGResourcesCache.cpp
         rendering/SVGResourcesCycleSolver.cpp
-        rendering/SVGRootInlineBox.cpp
         rendering/SVGShadowTreeElements.cpp
-        rendering/SVGTextChunkLayoutInfo.cpp
-        rendering/SVGTextLayoutUtilities.cpp
-        rendering/SVGTextQuery.cpp
         rendering/style/SVGRenderStyle.cpp
         rendering/style/SVGRenderStyleDefs.cpp
+        rendering/svg/RenderSVGInline.cpp
+        rendering/svg/RenderSVGInlineText.cpp
+        rendering/svg/RenderSVGPath.cpp
+        rendering/svg/RenderSVGTSpan.cpp
+        rendering/svg/RenderSVGText.cpp
+        rendering/svg/RenderSVGTextPath.cpp
+        rendering/svg/SVGInlineFlowBox.cpp
+        rendering/svg/SVGInlineTextBox.cpp
+        rendering/svg/SVGRootInlineBox.cpp
+        rendering/svg/SVGTextChunk.cpp
+        rendering/svg/SVGTextChunkBuilder.cpp
         rendering/svg/SVGTextLayoutAttributes.cpp
-        rendering/svg/SVGTextLayoutBuilder.cpp
+        rendering/svg/SVGTextLayoutAttributesBuilder.cpp
+        rendering/svg/SVGTextLayoutEngine.cpp
+        rendering/svg/SVGTextLayoutEngineBaseline.cpp
+        rendering/svg/SVGTextLayoutEngineSpacing.cpp
+        rendering/svg/SVGTextMetrics.cpp
+        rendering/svg/SVGTextQuery.cpp
         svg/ColorDistance.cpp
         svg/SVGAElement.cpp
         svg/SVGAltGlyphElement.cpp
diff --git a/WebCore/CMakeListsEfl.txt b/WebCore/CMakeListsEfl.txt
index a4d4a60..e44dfd4 100644
--- a/WebCore/CMakeListsEfl.txt
+++ b/WebCore/CMakeListsEfl.txt
@@ -31,7 +31,7 @@ LIST(APPEND WebCore_SOURCES
   platform/efl/FileChooserEfl.cpp
   platform/efl/FileSystemEfl.cpp
   platform/efl/KURLEfl.cpp
-  platform/efl/Language.cpp
+  platform/efl/LanguageEfl.cpp
   platform/efl/LocalizedStringsEfl.cpp
   platform/efl/LoggingEfl.cpp
   platform/efl/MIMETypeRegistryEfl.cpp
@@ -56,10 +56,10 @@ LIST(APPEND WebCore_SOURCES
   platform/graphics/efl/IconEfl.cpp
   platform/graphics/efl/ImageEfl.cpp
   platform/graphics/efl/IntPointEfl.cpp
+  platform/graphics/efl/IntRectEfl.cpp
   platform/posix/FileSystemPOSIX.cpp
   platform/text/efl/TextBreakIteratorInternalICUEfl.cpp
   plugins/PluginDataNone.cpp
-  plugins/PluginViewNone.cpp
 )
 
 IF (WTF_PLATFORM_CAIRO)
@@ -68,19 +68,20 @@ IF (WTF_PLATFORM_CAIRO)
   )
   LIST(APPEND WebCore_SOURCES
     platform/graphics/cairo/CairoUtilities.cpp
+    platform/graphics/cairo/ContextShadowCairo.cpp
     platform/graphics/cairo/FontCacheFreeType.cpp
     platform/graphics/cairo/FontCairo.cpp
     platform/graphics/cairo/FontCustomPlatformData.cpp
     platform/graphics/cairo/FontPlatformDataFreeType.cpp
-    platform/graphics/cairo/OwnPtrCairo.cpp
-    platform/graphics/cairo/PlatformRefPtrCairo.cpp
     platform/graphics/cairo/GlyphPageTreeNodeCairo.cpp
     platform/graphics/cairo/GradientCairo.cpp
     platform/graphics/cairo/GraphicsContextCairo.cpp
     platform/graphics/cairo/ImageBufferCairo.cpp
     platform/graphics/cairo/ImageCairo.cpp
+    platform/graphics/cairo/OwnPtrCairo.cpp
     platform/graphics/cairo/PathCairo.cpp
     platform/graphics/cairo/PatternCairo.cpp
+    platform/graphics/cairo/PlatformRefPtrCairo.cpp
     platform/graphics/cairo/SimpleFontDataCairo.cpp
     platform/graphics/cairo/TransformationMatrixCairo.cpp
 
@@ -91,6 +92,8 @@ ENDIF ()
 IF (WTF_USE_SOUP)
   LIST(APPEND WebCore_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/platform/network/soup"
+    "${WEBCORE_DIR}/platform/network/soup/cache"
+    "${WEBCORE_DIR}/platform/network/soup/cache/webkit"
   )
   LIST(APPEND WebCore_SOURCES
     platform/network/soup/CookieJarSoup.cpp
@@ -99,6 +102,16 @@ IF (WTF_USE_SOUP)
     platform/network/soup/ResourceRequestSoup.cpp
     platform/network/soup/ResourceResponseSoup.cpp
     platform/network/soup/SocketStreamHandleSoup.cpp
+
+    platform/network/soup/cache/soup-directory-input-stream.c
+    platform/network/soup/cache/soup-http-input-stream.c
+    platform/network/soup/cache/soup-request-data.c
+    platform/network/soup/cache/soup-request-file.c
+    platform/network/soup/cache/soup-request-http.c
+    platform/network/soup/cache/soup-request.c
+    platform/network/soup/cache/soup-requester.c
+
+    platform/network/soup/cache/webkit/soup-cache.c
   )
 ENDIF ()
 
diff --git a/WebCore/ChangeLog b/WebCore/ChangeLog
index c660e9d..83f63cc 100644
--- a/WebCore/ChangeLog
+++ b/WebCore/ChangeLog
@@ -1,3 +1,14428 @@
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70040.
+        http://trac.webkit.org/changeset/70040
+        https://bugs.webkit.org/show_bug.cgi?id=48042
+
+        "Reverting a performance regression detected by page_cycler"
+        (Requested by hayato on #webkit).
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::checkSelector):
+        * css/CSSStyleSelector.h:
+
+2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47851
+        
+        Avoid buffer overflows in CSSPrimitiveValue's use of 
+        DecimalNumber, and pass the buffer size in InspectorBasicValue.
+
+        Test: fast/css/large-value-csstext.html
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::formatNumber):
+        * inspector/InspectorValues.cpp:
+        (WebCore::InspectorBasicValue::writeJSON):
+
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add SecurityOrigin::threadsafeCopy() to the list of exported symbols.
+        https://bugs.webkit.org/show_bug.cgi?id=40655
+
+        * WebCore.exp.in:
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70165.
+        http://trac.webkit.org/changeset/70165
+        https://bugs.webkit.org/show_bug.cgi?id=48007
+
+        It broke tests on Qt bot (Requested by Ossy on #webkit).
+
+        * ForwardingHeaders/wtf/text/TextPosition.h: Removed.
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::eventHandlerLineNumber):
+        (WebCore::ScriptController::eventHandlerColumnNumber):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/PendingScript.cpp:
+        (WebCore::PendingScript::releaseElementAndClear):
+        * dom/PendingScript.h:
+        (WebCore::PendingScript::PendingScript):
+        (WebCore::PendingScript::operator=):
+        (WebCore::PendingScript::startingLineNumber):
+        * dom/ScriptableDocumentParser.h:
+        * dom/XMLDocumentParser.h:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        (WebCore::XMLDocumentParser::startElementNs):
+        (WebCore::XMLDocumentParser::endElementNs):
+        (WebCore::XMLDocumentParser::lineNumber):
+        (WebCore::XMLDocumentParser::columnNumber):
+        * dom/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        (WebCore::XMLDocumentParser::parseStartElement):
+        (WebCore::XMLDocumentParser::parseEndElement):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
+        (WebCore::HTMLDocumentParser::columnNumber):
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::sourceFromPendingScript):
+        (WebCore::HTMLScriptRunner::execute):
+        (WebCore::HTMLScriptRunner::runScript):
+        * html/parser/HTMLScriptRunner.h:
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::takeScriptToProcess):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/parser/HTMLTreeBuilder.h:
+
+2010-10-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48001
+
+        Make boxes place themselves properly in the block direction.  Get basic painting working for spans and add a test that
+        verifies that span painting and replaced element painting (like images) works correctly.
+        
+        Added fast/blockflow/basic-vertical-line.html
+
+        * rendering/InlineBox.cpp:
+        (WebCore::InlineBox::logicalHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::verticalPositionForBox):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        (WebCore::InlineFlowBox::flipLinesInBlockDirection):
+        (WebCore::InlineFlowBox::paintBoxDecorations):
+        (WebCore::InlineFlowBox::paintMask):
+        * rendering/InlineFlowBox.h:
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::isFlippedLinesWritingMode):
+
+2010-10-20  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        Fix for https://bugs.webkit.org/show_bug.cgi?id=47514 CSS 
+        transforms should affect scrolling
+
+        This patch causes topmostPosition, lowestPosition, 
+        leftmostPosition, and rightmostPosition to take transforms into 
+        account.
+
+        Compute the topmost/lowest/leftmost/rightmost position without 
+        factoring in the block's transform until the end.
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::topmostPosition):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        * rendering/RenderBlock.h:
+
+        transformedFrameRect() returns the frameRect() transformed to the 
+        layer's transform. applyLayerTransformToRect() does the same thing 
+        for the input rect.
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::applyLayerTransformToRect):
+        (WebCore::RenderBox::transformedFrameRect):
+        (WebCore::RenderBox::topmostPosition):
+        (WebCore::RenderBox::lowestPosition):
+        (WebCore::RenderBox::rightmostPosition):
+        (WebCore::RenderBox::leftmostPosition):
+        * rendering/RenderBox.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::topmostPosition):
+        (WebCore::RenderMedia::lowestPosition):
+        (WebCore::RenderMedia::rightmostPosition):
+        (WebCore::RenderMedia::leftmostPosition):
+        * rendering/RenderMedia.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::topmostPosition):
+        (WebCore::RenderTableSection::lowestPosition):
+        (WebCore::RenderTableSection::rightmostPosition):
+        (WebCore::RenderTableSection::leftmostPosition):
+        * rendering/RenderTableSection.h:
+
+2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Rename SVGAnimatedProperty* -> DeprecatedSVGAnimatedProperty*
+        https://bugs.webkit.org/show_bug.cgi?id=47973
+
+        Copy headers from svg/properties, otherwhise builds from scratch on win are broken.
+
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+
+2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Replaces line number with TextPosition struct so that script engine
+        gets script starting line/column.
+
+        * ForwardingHeaders/wtf/text/TextPosition.h: Added.
+        * bindings/js/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        * bindings/v8/ScheduledAction.cpp:
+        (WebCore::ScheduledAction::ScheduledAction):
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::eventHandlerPosition):
+        * bindings/v8/ScriptController.h:
+        * bindings/v8/ScriptEventListener.cpp:
+        (WebCore::createAttributeEventListener):
+        * bindings/v8/ScriptSourceCode.h:
+        (WebCore::ScriptSourceCode::ScriptSourceCode):
+        (WebCore::ScriptSourceCode::startLine):
+        (WebCore::ScriptSourceCode::startPosition):
+        * bindings/v8/V8LazyEventListener.cpp:
+        (WebCore::V8LazyEventListener::V8LazyEventListener):
+        (WebCore::V8LazyEventListener::prepareListenerObject):
+        * bindings/v8/V8LazyEventListener.h:
+        (WebCore::V8LazyEventListener::create):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::compileScript):
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::runScript):
+        * bindings/v8/V8Proxy.h:
+        * bindings/v8/WorkerContextExecutionProxy.cpp:
+        (WebCore::WorkerContextExecutionProxy::evaluate):
+        (WebCore::WorkerContextExecutionProxy::runScript):
+        * bindings/v8/WorkerContextExecutionProxy.h:
+        * bindings/v8/WorkerScriptController.cpp:
+        (WebCore::WorkerScriptController::evaluate):
+        * dom/PendingScript.cpp:
+        (WebCore::PendingScript::releaseElementAndClear):
+        * dom/PendingScript.h:
+        (WebCore::PendingScript::PendingScript):
+        (WebCore::PendingScript::operator=):
+        (WebCore::PendingScript::startingPosition):
+        * dom/ScriptableDocumentParser.h:
+        * dom/XMLDocumentParser.h:
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        (WebCore::XMLDocumentParser::startElementNs):
+        (WebCore::XMLDocumentParser::endElementNs):
+        (WebCore::XMLDocumentParser::lineNumber):
+        (WebCore::XMLDocumentParser::columnNumber):
+        (WebCore::XMLDocumentParser::textPosition):
+        (WebCore::XMLDocumentParser::textPositionOneBased):
+        * dom/XMLDocumentParserQt.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        (WebCore::XMLDocumentParser::textPosition):
+        (WebCore::XMLDocumentParser::parseStartElement):
+        (WebCore::XMLDocumentParser::parseEndElement):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::runScriptsForPausedTreeBuilder):
+        (WebCore::HTMLDocumentParser::textPosition):
+        * html/parser/HTMLDocumentParser.h:
+        * html/parser/HTMLScriptRunner.cpp:
+        (WebCore::HTMLScriptRunner::sourceFromPendingScript):
+        (WebCore::HTMLScriptRunner::execute):
+        (WebCore::HTMLScriptRunner::runScript):
+        * html/parser/HTMLScriptRunner.h:
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::uninitializedPositionValue1):
+        (WebCore::HTMLTreeBuilder::HTMLTreeBuilder):
+        (WebCore::HTMLTreeBuilder::takeScriptToProcess):
+        (WebCore::HTMLTreeBuilder::processEndTag):
+        (WebCore::HTMLTreeBuilder::processScriptStartTag):
+        * html/parser/HTMLTreeBuilder.h:
+
+2010-10-20  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47994
+        
+        Make computeBlockDirectionPositionsForLine writing-mode-aware.  None of the functions it calls are patched yet.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeBlockDirectionPositionsForLine):
+
+2010-10-20  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Fix crash when mousing over scrollview
+        https://bugs.webkit.org/show_bug.cgi?id=47956
+
+        Test: plugins/mouse-move-over-plugin-in-frame.html
+
+        * platform/Widget.h:
+        (WebCore::Widget::isPluginContainer):
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70149.
+        http://trac.webkit.org/changeset/70149
+        https://bugs.webkit.org/show_bug.cgi?id=47989
+
+        "Build breaks in mac and win" (Requested by satish on
+        #webkit).
+
+        * dom/Element.cpp:
+        (WebCore::Element::computeInheritedLanguage):
+        * page/SpeechInput.cpp:
+        (WebCore::SpeechInput::startRecognition):
+        * page/SpeechInput.h:
+        * page/SpeechInputClient.h:
+        * platform/mock/SpeechInputClientMock.cpp:
+        (WebCore::SpeechInputClientMock::startRecognition):
+        (WebCore::SpeechInputClientMock::setRecognitionResult):
+        (WebCore::SpeechInputClientMock::timerFired):
+        * platform/mock/SpeechInputClientMock.h:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::attachInnerElement):
+        (WebCore::SearchFieldCancelButtonElement::detach):
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::detach):
+
+2010-10-19  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Patch the current speech input implementation to use and validate the
+        nearest language tag. The language is now passed to the startRecognition
+        methods so that language-specific recognition could be used. Also added
+        a second parameter to setMockSpeechInputResult for the language used in
+        speech recognition.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        This is the 2nd of a 4-sided patch in Chromium and WebKit. For more
+        details see http://codereview.chromium.org/3615005/show and
+        http://codereview.chromium.org/3595018/show.
+
+        Test: fast/speech/input-text-language-tag.html
+
+        * dom/Element.cpp:
+        (WebCore::Element::computeInheritedLanguage): includes a brief character
+          validation for the BCP 47 language tag.
+        * page/SpeechInput.cpp:
+        (WebCore::SpeechInput::startRecognition):
+        * page/SpeechInput.h:
+        * page/SpeechInputClient.h:
+        * platform/mock/SpeechInputClientMock.cpp:
+        (WebCore::SpeechInputClientMock::startRecognition):
+        (WebCore::SpeechInputClientMock::setRecognitionResult): results are now
+          stored by language using a hash map.
+        (WebCore::SpeechInputClientMock::timerFired):
+        * platform/mock/SpeechInputClientMock.h:
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::TextControlInnerElement::attachInnerElement):
+        (WebCore::SearchFieldCancelButtonElement::detach):
+        (WebCore::SpinButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::defaultEventHandler):
+        (WebCore::InputFieldSpeechButtonElement::detach):
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Merge ColorSpace and ImageColorSpace enums
+        https://bugs.webkit.org/show_bug.cgi?id=47922
+
+        Merging these two enums makes it easier to implement color-interpolation as well as
+        color-interpolation-filter for SVG.
+        Added ColorSpaceLinearRGB to the ColorSpace enum and changed ImageColorSpace to ColorSpace in all related
+        files. Renamed enum entries DeviceColorSpace and sRGBColorSpace to ColorSpaceDeviceRGB and ColorSpaceSRGB
+        to follow webkit style rules.
+        Removed gray scale support in ImageBuffer since it is not used anymore on WebKit.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ColorSpace):
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::paintCaret):
+        * html/HTMLCanvasElement.cpp:
+        (WebCore::HTMLCanvasElement::paint):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setAllAttributesToDefault):
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        (WebCore::CanvasRenderingContext2D::applyShadow):
+        (WebCore::CanvasRenderingContext2D::drawImage):
+        (WebCore::CanvasRenderingContext2D::drawImageFromRect):
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * inspector/InspectorController.cpp:
+        (WebCore::drawOutlinedQuad):
+        (WebCore::InspectorController::drawElementTitle):
+        * mathml/RenderMathMLBlock.cpp:
+        (WebCore::RenderMathMLBlock::paint):
+        * mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::paint):
+        * mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::paint):
+        * mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::paint):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::paintContents):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::spoolAllPagesWithBoundaries):
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+        * platform/ScrollbarTheme.h:
+        (WebCore::ScrollbarTheme::paintScrollCorner):
+        * platform/ScrollbarThemeComposite.cpp:
+        (WebCore::ScrollbarThemeComposite::paintScrollCorner):
+        * platform/chromium/PopupMenuChromium.cpp:
+        (WebCore::PopupContainer::paintBorder):
+        (WebCore::PopupListBox::paint):
+        (WebCore::PopupListBox::paintRow):
+        * platform/chromium/ScrollbarThemeChromium.cpp:
+        (WebCore::ScrollbarThemeChromium::paintTickmarks):
+        * platform/chromium/ScrollbarThemeChromiumMac.mm:
+        (WebCore::ScrollbarThemeChromiumMac::paint):
+        * platform/graphics/ColorSpace.h:
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::setStrokePattern):
+        (WebCore::GraphicsContext::setFillPattern):
+        (WebCore::GraphicsContext::setStrokeGradient):
+        (WebCore::GraphicsContext::setFillGradient):
+        * platform/graphics/GraphicsContextPrivate.h:
+        (WebCore::GraphicsContextState::GraphicsContextState):
+        * platform/graphics/ImageBuffer.cpp:
+        (WebCore::ImageBuffer::transformColorSpace):
+        * platform/graphics/ImageBuffer.h:
+        (WebCore::ImageBuffer::create):
+        * platform/graphics/cairo/ImageBufferCairo.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::cachedCGColorSpace):
+        (WebCore::cachedCGColor):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::linearRGBColorSpaceRef):
+        * platform/graphics/cg/GraphicsContextCG.h:
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::cgImage):
+        (WebCore::ImageBuffer::draw):
+        * platform/graphics/cg/ImageBufferData.h:
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::imageWithColorSpace):
+        * platform/graphics/chromium/GLES2Canvas.cpp:
+        (WebCore::GLES2Canvas::clearRect):
+        (WebCore::GLES2Canvas::fillRect):
+        * platform/graphics/chromium/TransparencyWin.cpp:
+        (WebCore::TransparencyWin::setupLayerForWhiteLayer):
+        * platform/graphics/filters/FEColorMatrix.cpp:
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComposite.cpp:
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEFlood.cpp:
+        (WebCore::FEFlood::apply):
+        * platform/graphics/filters/FEMerge.cpp:
+        (WebCore::FEMerge::apply):
+        * platform/graphics/filters/FEOffset.cpp:
+        (WebCore::FEOffset::apply):
+        * platform/graphics/filters/FETile.cpp:
+        (WebCore::FETile::apply):
+        * platform/graphics/filters/FilterEffect.cpp:
+        (WebCore::FilterEffect::effectContext):
+        * platform/graphics/filters/SourceAlpha.cpp:
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceGraphic.cpp:
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp:
+        (WebCore::MediaPlayerPrivateGStreamer::paint):
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText):
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::setLayerBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        (WebCore::ImageBuffer::draw):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::ImageBuffer):
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::uploadSoftwareToHardware):
+        * platform/graphics/win/FontCGWin.cpp:
+        (WebCore::Font::drawGlyphs):
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        (WebCore::GraphicsContext::drawFocusRing):
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::setLayerBorderColor):
+        (WebCore::setLayerBackgroundColor):
+        * platform/graphics/win/ImageCGWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        * platform/graphics/win/ImageCairoWin.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        (WebCore::BitmapImage::drawFrameMatchingSourceSize):
+        * platform/graphics/win/WebLayer.cpp:
+        (WebCore::WebLayer::drawInContext):
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContext::clearRect):
+        (WebCore::GraphicsContext::fillRect):
+        * platform/graphics/wince/ImageWinCE.cpp:
+        (WebCore::BitmapImage::getHBITMAPOfSize):
+        * platform/graphics/wx/GraphicsContextWx.cpp:
+        (WebCore::GraphicsContext::GraphicsContext):
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration):
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton):
+        (WebCore::paintMediaButton):
+        (WebCore::RenderThemeGtk::paintMediaSliderTrack):
+        (WebCore::RenderThemeGtk::paintMediaSliderThumb):
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+        * platform/win/PopupMenuWin.cpp:
+        (WebCore::PopupMenuWin::paint):
+        * platform/win/WebCoreTextRenderer.cpp:
+        (WebCore::doDrawTextAtPoint):
+        * platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp:
+        (WebCore::drawTextWithSpacing):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::paintMissingPluginIcon):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::beginTransparencyLayers):
+        (WebCore::RenderLayer::paintResizer):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        * rendering/RenderMediaControlsChromium.cpp:
+        (WebCore::paintMediaButton):
+        (WebCore::paintMediaSlider):
+        (WebCore::paintMediaVolumeSlider):
+        (WebCore::paintMediaTimelineContainer):
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::paint):
+        * rendering/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::applyClippingToContext):
+        * rendering/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::applyResource):
+        (WebCore::RenderSVGResourceFilter::postApplyResource):
+        * rendering/RenderSVGResourceGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient):
+        * rendering/RenderSVGResourceMasker.cpp:
+        (WebCore::RenderSVGResourceMasker::applyResource):
+        (WebCore::RenderSVGResourceMasker::drawContentIntoMaskImage):
+        * rendering/RenderSVGResourcePattern.cpp:
+        (WebCore::RenderSVGResourcePattern::createTileImage):
+        * rendering/RenderSVGResourceSolidColor.cpp:
+        (WebCore::RenderSVGResourceSolidColor::applyResource):
+        * rendering/RenderScrollbarTheme.cpp:
+        (WebCore::RenderScrollbarTheme::paintScrollCorner):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::paintProgressBar):
+        (WebCore::RenderThemeMac::paintMenuListButton):
+        * rendering/RenderThemeSafari.cpp:
+        (WebCore::RenderThemeSafari::paintMenuListButton):
+        * rendering/RenderThemeWinCE.cpp:
+        (WebCore::RenderThemeWinCE::paintSearchFieldCancelButton):
+        (WebCore::RenderThemeWinCE::paintSliderTrack):
+        (WebCore::RenderThemeWinCE::paintSliderThumb):
+        * rendering/SVGImageBufferTools.cpp:
+        (WebCore::SVGImageBufferTools::createImageBuffer):
+        * rendering/SVGImageBufferTools.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        * svg/SVGFEImageElement.cpp:
+        (WebCore::SVGFEImageElement::build):
+        * svg/graphics/SVGImage.cpp:
+        (WebCore::SVGImage::nativeImageForCurrentFrame):
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::apply):
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Remove left over code after moving Cairo port to ShadowContext
+        https://bugs.webkit.org/show_bug.cgi?id=47929
+
+        ImageBufferFilter is not needed anymore, since Cairo is using ShadowContext now.
+        Made kernelPosition() in FEGaussianBlur a inline function instead of a static function.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/graphics/filters/FEGaussianBlur.cpp:
+        (WebCore::kernelPosition):
+        * platform/graphics/filters/FEGaussianBlur.h:
+        * platform/graphics/filters/ImageBufferFilter.cpp: Removed.
+        * platform/graphics/filters/ImageBufferFilter.h: Removed.
+
+2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Fix efl build, by adding the new svg/properties include directory.
+
+        * CMakeLists.txt:
+
+2010-10-19  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: expose request/response cookies in HAR
+        https://bugs.webkit.org/show_bug.cgi?id=47894
+
+        Test: inspector/cookie-parser.html
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/front-end/CookieParser.js: Added.
+        * inspector/front-end/HAREntry.js:
+        (WebInspector.HAREntry.prototype._buildRequest):
+        (WebInspector.HAREntry.prototype._buildResponse):
+        (WebInspector.HAREntry.prototype._buildCookies):
+        (WebInspector.HAREntry.prototype._buildCookie):
+        * inspector/front-end/Resource.js: Parse Cookie/Set-Cookie headers and expose cookies.
+        (WebInspector.Resource.prototype.set requestHeaders):
+        (WebInspector.Resource.prototype.get requestCookies):
+        (WebInspector.Resource.prototype.set responseHeaders):
+        (WebInspector.Resource.prototype.get responseCookies):
+        (WebInspector.Resource.prototype._parseRequestCookies):
+        (WebInspector.Resource.prototype._parseResponseCookies):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.html:
+
+2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Fix non-mac builds, by adding the new svg/properties include directory.
+
+        * GNUmakefile.am:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCoreCommon.vsprops:
+
+2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Adam Roben.
+
+        Rename SVGAnimatedProperty* -> DeprecatedSVGAnimatedProperty*
+        https://bugs.webkit.org/show_bug.cgi?id=47973
+
+        Prepare fixing bug 47905, redesigning SVGAnimatedProperty. As we're going to move type by type
+        to the new animated property concept, keep the old one around, marked deprecated, until the
+        transition is finished.
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/scripts/CodeGeneratorObjC.pm:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * svg/DeprecatedSVGAnimatedProperty.h: Copied from svg/SVGAnimatedProperty.h.
+        (WebCore::DeprecatedSVGAnimatedPropertyTearOff::DeprecatedSVGAnimatedPropertyTearOff):
+        (WebCore::DeprecatedSVGAnimatedPropertyTearOff::~DeprecatedSVGAnimatedPropertyTearOff):
+        (WebCore::DeprecatedSVGAnimatedProperty::~DeprecatedSVGAnimatedProperty):
+        (WebCore::DeprecatedSVGAnimatedProperty::DeprecatedSVGAnimatedProperty):
+        (WebCore::DeprecatedSVGAnimatedProperty::value):
+        (WebCore::DeprecatedSVGAnimatedProperty::baseValue):
+        * svg/DeprecatedSVGAnimatedPropertyTraits.h: Copied from svg/SVGAnimatedPropertyTraits.h.
+        * svg/DeprecatedSVGAnimatedTemplate.h: Copied from svg/SVGAnimatedTemplate.h.
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKey::DeprecatedSVGAnimatedTypeWrapperKey):
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKey::operator==):
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKeyHash::hash):
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKeyHash::equal):
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKeyHashTraits::constructDeletedValue):
+        (WebCore::DeprecatedSVGAnimatedTypeWrapperKeyHashTraits::isDeletedValue):
+        (WebCore::DeprecatedSVGAnimatedTemplate::~DeprecatedSVGAnimatedTemplate):
+        (WebCore::DeprecatedSVGAnimatedTemplate::forgetWrapper):
+        (WebCore::lookupOrCreateWrapper):
+        * svg/SVGAnimatedProperty.h: Removed.
+        * svg/SVGAnimatedPropertySynchronizer.h: Removed.
+        * svg/SVGAnimatedPropertyTraits.h: Removed.
+        * svg/SVGAnimatedTemplate.h: Removed.
+        * svg/SVGElement.h:
+        * svg/SVGExternalResourcesRequired.h:
+        * svg/SVGFitToViewBox.h:
+        * svg/SVGURIReference.h:
+        * svg/properties: Added.
+        * svg/properties/SVGAnimatedPropertySynchronizer.h: Copied from svg/SVGAnimatedPropertySynchronizer.h.
+
+2010-10-20  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        absolutely positioned list in inline element crashes
+        https://bugs.webkit.org/show_bug.cgi?id=45095
+
+        Add a NULL check to avoid crash. The rendering result isn't ideal yet.
+
+        Test: fast/lists/positioned-count-crash.html
+
+        * rendering/RenderListItem.cpp:
+        (WebCore::previousListItem):
+
+2010-10-19  Adam Roben  <aroben@apple.com>
+
+        Remove uses of CACFContextRef and CARender* from WebCore
+
+        These types are now wrapped in a WKCACFContext type exported by
+        WebKitSystemInterface.
+
+        Fixes <http://webkit.org/b/43244>.
+
+        Reviewed by Sam Weinig.
+
+        * platform/graphics/win/WKCACFContextFlusher.cpp:
+        (WebCore::WKCACFContextFlusher::addContext):
+        (WebCore::WKCACFContextFlusher::removeContext):
+        (WebCore::WKCACFContextFlusher::flushAllContexts):
+        * platform/graphics/win/WKCACFContextFlusher.h:
+        Changed to use WKCACFContext. We don't retain/release the context when
+        putting it into/taking it out of the set. WKCACFContext is not a
+        ref-counted type, so we can't retain/release it, but the
+        retain/release was also unnecessary as WKCACFLayerRenderer calls
+        removeContext before the context is destroyed.
+
+        * platform/graphics/win/WKCACFLayer.cpp:
+        (WebCore::WKCACFLayer::becomeRootLayerForContext):
+        * platform/graphics/win/WKCACFLayer.h:
+        Changed to use WKCACFContext.
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::didFlushContext):
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::~WKCACFLayerRenderer):
+        (WebCore::WKCACFLayerRenderer::layerTreeDidChange):
+        (WebCore::WKCACFLayerRenderer::createRenderer):
+        (WebCore::WKCACFLayerRenderer::destroyRenderer):
+        (WebCore::WKCACFLayerRenderer::render): Also replaced uses of
+        CGSRegion with WebKitSystemInterface functions/types.
+        (WebCore::WKCACFLayerRenderer::resetDevice):
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        Replaced our CACFContextRef, CARenderContext, and CARenderOGLContext
+        with a single WKCACFContext, which wraps all three. We hold a bare
+        pointer to it and destroy it in our destructor.
+
+2010-10-19  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Pixel cracks when using background image sprite on transformed element at certain scales.
+        https://bugs.webkit.org/show_bug.cgi?id=47868
+
+        The pixel bleeding happens when the current context has scale and interpolation is kCGInterpolationHigh
+        or kCGInterpolationDefault.  If the source rect size is smaller than the intrinsic image size,  some
+        pixels outside of the clip rect will also be used to interpolate the color value for clip edges, which
+        results in unwanted thin lines around the painted area.  We need to use sub-image patch to get rid of
+        the artifacts in this case.
+
+        Test: fast/images/pixel-crack-image-background-webkit-transform-scale.html
+
+        * platform/graphics/cg/ImageCG.cpp:
+        (WebCore::BitmapImage::draw):
+
+2010-10-19  Evan Martin  <evan@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        sqlite: remove unused member variable
+        https://bugs.webkit.org/show_bug.cgi?id=47957
+
+        There's no need to save the error code into a member variable
+        because nobody ever looks at it.
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::open):
+        * platform/sql/SQLiteDatabase.h:
+
+2010-10-19  Jia Pu  <jpu@apple.com>
+
+        Reviewed by James Robinson.
+
+        Moving cursor back to autocorrected word in the same line shouldn't remove the underline
+        https://bugs.webkit.org/show_bug.cgi?id=47629
+        <rdar://problem/8546758>
+        
+        Patch <http://trac.webkit.org/changeset/70071> breaks some Chromium Mac hehavior. This patch
+        fixes that.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection): Add "!PLATFORM(MAC)" to make sure nothing changes
+          on non-Mac platforms.
+
+2010-10-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Build fix (EFL, maybe more).
+
+        * CMakeLists.txt: Added platform/Language.cpp here, too.
+
+2010-10-19  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Rename createBlobURL to createObjectURL and revokeBlobURL to
+        revokeObjectURL per the latest File API spec.
+        https://bugs.webkit.org/show_bug.cgi?id=47934
+
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._contextMenu):
+        * inspector/front-end/utilities.js:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::createObjectURL):
+        (WebCore::DOMWindow::revokeObjectURL):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::createObjectURL):
+        (WebCore::WorkerContext::revokeObjectURL):
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2010-10-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47933
+        <rdar://problem/8494337> navigator.language doesn't work in WebKit2
+
+        * CMakeListsEfl.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/chromium/Language.cpp: Removed.
+        * platform/chromium/LanguageChromium.cpp: Copied from WebCore/platform/chromium/Language.cpp.
+        * platform/efl/Language.cpp: Removed.
+        * platform/efl/LanguageEfl.cpp: Copied from WebCore/platform/efl/Language.cpp.
+        * platform/gtk/Language.cpp: Removed.
+        * platform/gtk/LanguageGtk.cpp: Copied from WebCore/platform/gtk/Language.cpp.
+        * platform/qt/Language.cpp: Removed.
+        * platform/qt/LanguageQt.cpp: Copied from WebCore/platform/qt/Language.cpp.
+        * platform/win/Language.cpp: Removed.
+        * platform/win/LanguageWin.cpp: Copied from WebCore/platform/win/Language.cpp.
+        * platform/Language.cpp: Added.
+        Cross platform code is now in platform/Language.cpp. So, I renamed platform files to match
+        the common pattern.
+
+        * WebCore.exp.in: Exported new functions.
+
+        * platform/Language.h: Added an ability to force the language, and an ability to set up
+        listeners for changes (if the platform implements that). Web process will always use the
+        forced language, as sent to it from UI process.
+
+        * platform/mac/Language.mm: Moved code from WebKit.
+        (WebCore::platformDefaultLanguage): Added code to synchronize user defaults. For some reason,
+        they come unsynchronized in WebKit2 here, unlike WebKit1.
+
+        * page/mac/WebCoreViewFactory.h: Removed defaultLanguageCode. WebCore no longer goes to WebKit
+        to ask for that.
+
+        * platform/mac/WebCoreSystemInterface.h:
+        * platform/mac/WebCoreSystemInterface.mm:
+        Added wkCopyCFLocalizationPreferredName().
+
+2010-10-19  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add "in select" insertion mode to parser.
+
+        This was added to the spec in:
+        http://html5.org/tools/web-apps-tracker?from=5520&to=5522
+
+        And as a result of:
+        http://www.w3.org/Bugs/Public/show_bug.cgi?id=10314
+
+        https://bugs.webkit.org/show_bug.cgi?id=47706
+
+        No new tests. Open to ideas.
+
+        * html/parser/HTMLElementStack.cpp: Added "in select" mode.
+        (WebCore::HTMLNames::isSelectScopeMarker): Ditto.
+        (WebCore::HTMLElementStack::inSelectScope): Ditto.
+        * html/parser/HTMLElementStack.h: Ditto.
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processStartTag): Use "in select" instead of "in table."
+        (WebCore::HTMLTreeBuilder::processEndTag): Ditto.
+
+2010-10-19  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Fix multiple index support in IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=47919
+
+        Fix 2 bugs that caused the IndexData of all but the last index to be
+        properly updated:
+        * The objectStoreDataId is NOT unique if there are multiple indexes. So
+          remove the constraint.
+        * Do not delete all existing entries with that objectStoreDataId before
+          adding an entry for each index. Only do it once at the beginning.
+
+        Test: storage/indexeddb/queued-commands.html
+            + index-basics.html modified
+
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::createTables):
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::deleteIndexData):
+        (WebCore::putIndexData):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+
+2010-10-19  Martin Robinson  <mrobinson@igalia.com>
+
+        Fix the GTK+ build after r70072. The logic looks incorrect, but
+        this fix tries to preserves it, even so.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (baselinePositionForAccessibilityRenderObject):
+        (getAttributeSetForAccessibilityObject):
+
+2010-10-06  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Eric Carlson.
+
+        Windows: Implement 'preload=none'
+        https://bugs.webkit.org/show_bug.cgi?id=47317
+        <rdar://problem/7718442>
+        
+        Implement the 'preload=none' identically to the mac implementation. Add three new
+        ivars: m_preload, m_delayLoad and m_movieURL; and override the MediaPlayerPrivate
+        functions: prepareToPlay() and setPreload().
+
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp:
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::MediaPlayerPrivateQuickTimeVisualContext):
+            Initialize new ivars m_delayLoad and m_preload.
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::resumeLoad): Added; new.
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::load): Split contents between
+            load and loadInternal.
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::loadInternal): Added; new.
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::prepareToPlay): Added; overrides MediaPlayerPrivate.
+        (WebCore::MediaPlayerPrivateQuickTimeVisualContext::setPreload): Added; overrides MediaPlayerPrivate.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h:
+        
+2010-10-19  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Upstream support of KeyCodes for iOS
+        https://bugs.webkit.org/show_bug.cgi?id=47857
+        
+        * platform/cocoa/KeyEventCocoa.mm:
+        (WebCore::windowsKeyCodeForCharCode): Added special handling of keyCodes for iOS.
+
+2010-10-19  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by David Kilzer.
+
+        iOS: ASSERT in Cache::adjustSize running layout tests
+        https://bugs.webkit.org/show_bug.cgi?id=47873
+
+        Inside Cache::pruneDeadResources we loop over the LRU lists and make resources purgeable
+        with Cache::makeResourcePurgeable(). This wasn't taking into account whether the resource
+        was already purgeable or not, and the makeResourcePurgeable call was always calling
+        adjustSize(). Now we make sure makeResourcePurgable only adjusts the size of the Cache's
+        dead sizes when it first marks the resource purgeable. Likewise, if a resource is marked
+        as purgeable and then evicted, we should not adjust the size again.
+
+        The balancing call is when we have a resource that has been marked as purgeable and we
+        successfully mark it as no longer purgeable in Cache::resourceForURL.
+
+        No test added because this requires testing purgeable memory.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::makeResourcePurgeable):
+        (WebCore::Cache::evict):
+
+2010-10-19  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Disable mipmapping for ImageLayer's to prevent memory use and
+        performance regression.
+        https://bugs.webkit.org/show_bug.cgi?id=47913
+        
+        This patch is a straight revert of the patch committed with issue 46493
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::SharedValues::SharedValues):
+        (WebCore::ContentLayerChromium::updateTextureRect):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore::ContentLayerChromium::SharedValues::initialized):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::updateContents):
+
+2010-10-18  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        gl-teximage.html fails on chromium webkit mac bot
+        https://bugs.webkit.org/show_bug.cgi?id=47034
+
+        * platform/graphics/GraphicsContext3D.cpp: Deal with endians in 16 bit image data.
+        (WebCore::convertColor16LittleTo8):
+        (WebCore::convertColor16BigTo8):
+        (WebCore::doPacking):
+        * platform/graphics/GraphicsContext3D.h: Ditto.
+        * platform/graphics/cg/GraphicsContext3DCG.cpp: Ditto.
+        (WebCore::GraphicsContext3D::getImageData):
+
+2010-10-19  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47841
+
+        Rework baselinePosition and lineHeight to be writing-mode-aware.  There's a lot of refactoring here to clean up
+        the method parameters to be more readable and to simplify the subclassing of the various methods in order to 
+        keep the horizontal/vertical querying to a minimum.
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * mathml/RenderMathMLFraction.cpp:
+        (WebCore::RenderMathMLFraction::baselinePosition):
+        * mathml/RenderMathMLFraction.h:
+        * mathml/RenderMathMLOperator.cpp:
+        (WebCore::RenderMathMLOperator::baselinePosition):
+        * mathml/RenderMathMLOperator.h:
+        * mathml/RenderMathMLRow.cpp:
+        (WebCore::RenderMathMLRow::baselinePosition):
+        * mathml/RenderMathMLRow.h:
+        * mathml/RenderMathMLSubSup.cpp:
+        (WebCore::RenderMathMLSubSup::baselinePosition):
+        * mathml/RenderMathMLSubSup.h:
+        * mathml/RenderMathMLUnderOver.cpp:
+        (WebCore::RenderMathMLUnderOver::layout):
+        (WebCore::RenderMathMLUnderOver::baselinePosition):
+        * mathml/RenderMathMLUnderOver.h:
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::baselinePosition):
+        (WebCore::InlineBox::lineHeight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::adjustMaxAscentAndDescent):
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::baselinePosition):
+        (WebCore::InlineTextBox::lineHeight):
+        * rendering/InlineTextBox.h:
+        * rendering/RenderBR.cpp:
+        (WebCore::RenderBR::lineHeight):
+        * rendering/RenderBR.h:
+        (WebCore::toRenderBR):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::lineHeight):
+        (WebCore::RenderBlock::baselinePosition):
+        (WebCore::RenderBlock::firstLineBoxBaseline):
+        (WebCore::RenderBlock::lastLineBoxBaseline):
+        (WebCore::RenderBlock::localCaretRect):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::lineHeight):
+        (WebCore::RenderBox::baselinePosition):
+        * rendering/RenderBox.h:
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::verticalPosition):
+        * rendering/RenderBoxModelObject.h:
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::lineHeight):
+        (WebCore::RenderInline::baselinePosition):
+        * rendering/RenderInline.h:
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::baselinePosition):
+        * rendering/RenderListBox.h:
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::lineHeight):
+        (WebCore::RenderListMarker::baselinePosition):
+        * rendering/RenderListMarker.h:
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.h:
+        * rendering/RenderReplaced.cpp:
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGRoot.cpp:
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSlider.cpp:
+        (WebCore::RenderSlider::baselinePosition):
+        * rendering/RenderSlider.h:
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::baselinePosition):
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.h:
+        (WebCore::RenderTableCol::isTableCol):
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTableSection.h:
+        * rendering/RenderText.cpp:
+        * rendering/RenderText.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::computeLogicalHeight):
+        * rendering/RenderTextControlMultiLine.cpp:
+        (WebCore::RenderTextControlMultiLine::baselinePosition):
+        * rendering/RenderTextControlMultiLine.h:
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::createInnerTextStyle):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::baselinePosition):
+        (WebCore::RootInlineBox::lineHeight):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::calculateBoundaries):
+
+2010-10-19  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Moving cursor back to autocorrected word in the same line shouldn't remove the underline
+        https://bugs.webkit.org/show_bug.cgi?id=47629
+        <rdar://problem/8546758>
+
+        Tests: platform/mac/editing/spelling/click-autocorrected-word.html
+               platform/mac/editing/spelling/delete-into-autocorrected-word.html
+               platform/mac/editing/spelling/delete-into-misspelled-word.html
+               platform/mac/editing/spelling/forward-delete-into-autocorrected-word.html
+               platform/mac/editing/spelling/move-cursor-around-misspelled-word.html
+               platform/mac/editing/spelling/move-cursor-to-autocorrected-word.html
+               platform/mac/editing/spelling/move-cursor-to-beginning-of-autocorrected-word.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection): Don't remove misspelling or autocorrection
+          underlines when cursor is moved onto a word.
+
+2010-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Not reviewed. Build fix.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::selectNextSourceChild): Initialize variable to avoid Windows
+        "potentially uninitialized local variable" warning.
+
+2010-10-19  Eric Carlson  <eric.carlson@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46763
+        CRASH in WebCore::ThreadTimers::sharedTimerFiredInternal
+
+        Fix crashes caused by moving and deleting <source> element(s) of active media element.
+
+        Tests: media/video-source-moved.html
+               media/video-source-removed.html
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement): Add logging. Initialize selectNextSourceChild.
+        (WebCore::HTMLMediaElement::~HTMLMediaElement): Ditto.
+        (WebCore::HTMLMediaElement::insertedIntoDocument): Ditto.
+        (WebCore::HTMLMediaElement::removedFromDocument): Ditto.
+        (WebCore::HTMLMediaElement::scheduleLoad): Ditto.
+        (WebCore::HTMLMediaElement::setNetworkState): Deal with m_currentSourceNode being null when
+        the media engine signals a failure by skipping the error message and continuing as usual.
+        (WebCore::HTMLMediaElement::setVolume): Fix logging typo.
+        (WebCore::HTMLMediaElement::havePotentialSourceChild): Save and restore m_nextChildNodeToConsider
+        around call to selectNextSourceChild because they are both significant.
+        (WebCore::HTMLMediaElement::selectNextSourceChild): Use m_nextChildNodeToConsider to pick
+        the first node to consider. Bail immediately if it signals that we have already processed 
+        every <source> node. Stach the node following the current source element in m_nextChildNodeToConsider
+        so we can resume the search even if m_currentSourceNode is removed while it is being processed.
+        (WebCore::HTMLMediaElement::sourceWasAdded): New, move logic from HTMLSourceElement::insertedIntoTree
+        here and correct it to deal with a <source> node being inserted immediately after the
+        current <source> node and a new <source> node being inserted at the end of the list after
+        all candidates have failed.
+        (WebCore::HTMLMediaElement::sourceWillBeRemoved): New, deal with current source node and next
+        potential node being removed.
+        * html/HTMLMediaElement.h:
+        (WebCore::HTMLMediaElement::sourceChildEndOfListValue): New, define sentinal value used to indicate
+        that all nodes have been processed.
+
+        * html/HTMLSourceElement.cpp:
+        (WebCore::HTMLSourceElement::HTMLSourceElement): Add logging.
+        (WebCore::HTMLSourceElement::insertedIntoTree): Call mediaElement->sourceWasAdded instead
+        of having logic here.
+        (WebCore::HTMLSourceElement::willRemove): New, call mediaElement->sourceWillBeRemoved
+        (WebCore::HTMLSourceElement::scheduleErrorEvent): Add logging.
+        (WebCore::HTMLSourceElement::cancelPendingErrorEvent): Add logging.
+        * html/HTMLSourceElement.h:
+
+2010-10-19  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] WebKit2 MacOS build fix
+        https://bugs.webkit.org/show_bug.cgi?id=47897
+
+        Qt WebKit2 MacOS build fix.
+
+        * bridge/npapi.h:
+
+2010-10-19  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Soup cache code still has some warnings
+        https://bugs.webkit.org/show_bug.cgi?id=47733
+
+        Fixed some compilation warnings happening with gcc 4.4.5 on
+        64-bits architecture.
+
+        * platform/network/soup/cache/webkit/soup-cache.c:
+        (webkit_soup_cache_entry_set_freshness):
+        (close_ready_cb):
+
+2010-10-19  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: crash while trying to step over a function using inspector
+        https://bugs.webkit.org/show_bug.cgi?id=47902
+
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.reset): reset scripts panel to resumed state on navigation.
+
+2010-10-19  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed attempt to remove warning in EFL build.
+
+        Fix #if to #ifdef.
+
+        No new features, so no tests added.
+
+        * platform/efl/WidgetEfl.cpp:
+        (WebCore::Widget::applyFallbackCursor):
+
+2010-10-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] getImageData returns wrong data for non-0,0 source offset
+        https://bugs.webkit.org/show_bug.cgi?id=47898
+
+        Test: fast/canvas/canvas-getImageData-negative-source.html
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::getImageData): Add missing *4's to get correct pixel offset.
+
+2010-10-19  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Correct initial state of ImageBuffer QPen
+        https://bugs.webkit.org/show_bug.cgi?id=47804
+
+        Have the QPen on ImageBuffers start in Qt::SvgMiterJoin mode.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBufferData::ImageBufferData):
+
+2010-10-19  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        GStreamer PlatformVideoWindow needs an API to prepare the widget before applying the overlay
+        https://bugs.webkit.org/show_bug.cgi?id=46790
+
+        Simple API addition to PlatformVideoWindow to allow
+        implementations to optionally prepare their own PlatformWidget
+        before applying the GStreamer XOverlay to it. This will likely be
+        needed on Mac OSX only.
+
+        * platform/graphics/gstreamer/GStreamerGWorld.cpp:
+        (WebCore::GStreamerGWorld::setWindowOverlay):
+        * platform/graphics/gstreamer/PlatformVideoWindow.h:
+        * platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp:
+        (PlatformVideoWindow::prepareForOverlay):
+        * platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp:
+        (PlatformVideoWindow::prepareForOverlay):
+
+2010-10-19  Ben Murdoch  <benm@google.com>
+
+        Reviewed by Steve Block.
+
+        Missing support for document.createTouch and document.createTouchList
+        https://bugs.webkit.org/show_bug.cgi?id=47676
+
+        These APIs are used by many sites to detect support for touch events.
+
+        Implement the APIs according to the documentation at:
+        http://developer.apple.com/library/safari/#documentation/UserExperience/Reference/DocumentAdditionsReference/DocumentAdditions/DocumentAdditions.html
+
+        Tests: fast/events/touch/document-create-touch-list.html
+               fast/events/touch/document-create-touch.html
+
+        * bindings/js/JSBindingsAllInOne.cpp: Add new files to list.
+        * bindings/js/JSTouchCustom.cpp: Added.
+        (WebCore::toJSNewlyCreated):
+        * bindings/js/JSTouchListCustom.cpp: Added.
+        (WebCore::toJSNewlyCreated):
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * dom/Document.cpp:
+        (WebCore::Document::createTouch):
+        (WebCore::Document::createTouchList):
+        * dom/Document.h:
+        * dom/Document.idl: Add createTouch and createTouchList functions.
+        * Android.jscbindings.mk: Update makefiles.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+
+
+2010-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: migrate from legacy Object.properties to Object.keys, remove dead code.
+        https://bugs.webkit.org/show_bug.cgi?id=47890
+
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.prototype._reportCompletions):
+        * inspector/front-end/ElementsPanel.js:
+        (WebInspector.ElementsPanel):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onGetResources):
+        * inspector/front-end/HAREntry.js:
+        (WebInspector.HARLog.prototype.build):
+        * inspector/front-end/StylesSidebarPane.js:
+        (WebInspector.StylePropertyTreeElement.prototype.):
+        (WebInspector.StylePropertyTreeElement.prototype):
+        * inspector/front-end/utilities.js:
+
+2010-10-19  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: do not access ResourcePanel from resources directly.
+        https://bugs.webkit.org/show_bug.cgi?id=47892
+
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.set documentURL):
+        (WebInspector.Resource.prototype.set startTime):
+        (WebInspector.Resource.prototype.set responseReceivedTime):
+        (WebInspector.Resource.prototype.set endTime):
+        (WebInspector.Resource.prototype.set resourceSize):
+        (WebInspector.Resource.prototype.set expectedContentLength):
+        (WebInspector.Resource.prototype.set category):
+        (WebInspector.Resource.prototype.set cached):
+        (WebInspector.Resource.prototype.set mimeType):
+        (WebInspector.Resource.prototype.get requestHeaders):
+        (WebInspector.Resource.prototype.set requestHeaders):
+        (WebInspector.Resource.prototype.get responseHeaders):
+        (WebInspector.Resource.prototype.set responseHeaders):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.addResource):
+        (WebInspector.ResourcesPanel.prototype.refreshResource):
+        (WebInspector.ResourcesPanel.prototype._recreateViewForResourceIfNeeded):
+        (WebInspector.ResourcesPanel.prototype._resourceViewIsConsistentWithCategory):
+        (WebInspector.ResourceGraph):
+        (WebInspector.ResourceGraph.prototype.refresh):
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+
+2010-10-19  Yuta Kitamura  <yutak@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Make sure WebSocket resource has the url field when it is created.
+
+        Web Inspector: Uncaught TypeError when connection to WebSocket server is refused
+        https://bugs.webkit.org/show_bug.cgi?id=47891
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::createWebSocket):
+
+2010-10-19  Hayato Ito  <hayato@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Make CSS style selector non-recursive.
+        https://bugs.webkit.org/show_bug.cgi?id=43783
+
+        This change is one of the required changes to fix the following master bug:
+        https://bugs.webkit.org/show_bug.cgi?id=42806
+
+        To avoid recursion, we prepare a call stack and maintain a list of
+        function call state by ourselves and try matching iteratively.
+
+        Test: fast/css/long-css-selector-matches.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        (WebCore::CSSStyleSelector::checkSelector):
+        * css/CSSStyleSelector.h:
+
+2010-10-19  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70034.
+        http://trac.webkit.org/changeset/70034
+        https://bugs.webkit.org/show_bug.cgi?id=47889
+
+        "Gustavo's bot is lame" (Requested by xan_ on #webkit).
+
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
+        (WebCore::setCookies):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2010-10-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Bump minimum requirement for libsoup to 2.30
+        https://bugs.webkit.org/show_bug.cgi?id=46176
+
+        Bump minimum required libsoup version to 2.30.
+
+        * platform/network/soup/CookieJarSoup.cpp:
+        (WebCore::defaultCookieJar):
+        (WebCore::setCookies):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandle::prepareForURL):
+        (WebCore::restartedCallback):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::toSoupMessage):
+        (WebCore::ResourceRequest::updateFromSoupMessage):
+
+2010-10-19  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fix distcheck, take 2.
+
+        * GNUmakefile.am: also move the generated CSS hash files to the
+        build dir.
+
+2010-10-18  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Should not save state of a detached form control.
+        https://bugs.webkit.org/show_bug.cgi?id=47811
+
+        Test: fast/forms/state-save-of-detached-control.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElementWithState::shouldSaveAndRestoreFormControlState):
+          If the node is detached, don't save the state.
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * GNUmakefile.am: add missing files.
+
+2010-10-18  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION: Feedly extension crashes Webkit
+        https://bugs.webkit.org/show_bug.cgi?id=45811
+
+        The basic problem was the deserializer was holding a pointer into
+        the constant pool, but if you were sufficiently unlucky then the
+        constant pool would be moved while still relying on the pointer,
+        which leads to badness.
+
+        I looked at just making all the sites this could happen extract the
+        right string/jsstring before any possible allocations, but it seemed
+        too fragile so i've gone for a forwarding object as the solution.
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::CachedStringRef::CachedStringRef):
+        (WebCore::CloneDeserializer::CachedStringRef::operator->):
+        (WebCore::CloneDeserializer::readStringData):
+        (WebCore::CloneDeserializer::readFile):
+        (WebCore::CloneDeserializer::readTerminal):
+        (WebCore::CloneDeserializer::deserialize):
+
+2010-10-18  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Add AudioResampler files
+        https://bugs.webkit.org/show_bug.cgi?id=47623
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/AudioResampler.cpp: Added.
+        (WebCore::AudioResampler::AudioResampler):
+        (WebCore::AudioResampler::configureChannels):
+        (WebCore::AudioResampler::process):
+        (WebCore::AudioResampler::setRate):
+        (WebCore::AudioResampler::reset):
+        * platform/audio/AudioResampler.h: Added.
+        (WebCore::AudioResampler::~AudioResampler):
+        (WebCore::AudioResampler::rate):
+
+2010-10-18  Vangelis Kokkevis  <vangelis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Prevent the creation of very large textures for layers by switching
+        to "large layer" mode when a texture is larger than some fixed reasonable size
+        (set to 2000 pixels for now).
+        https://bugs.webkit.org/show_bug.cgi?id=47751
+
+        The code also changes the large layer logic to use the current scissor rect used
+        by the compositor instead of the visible rect to determine how to clip large layers.
+        This will provide additional texture savings. In addition, the various layer rects
+        have been converted to use integers instead of floats to preserve uniformity in the code.
+        
+        Tests: Existing large layer layout tests including huge-layer and huge-layer-img
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::requiresClippedUpdateRect):
+        (WebCore::ContentLayerChromium::calculateClippedUpdateRect):
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::getDrawRect):
+        * platform/graphics/chromium/LayerChromium.h:
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayers):
+        (WebCore::LayerRendererChromium::drawLayersRecursive):
+        (WebCore::LayerRendererChromium::scissorToRect):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::currentScissorRect):
+
+2010-10-18  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Stephanie Lewis.
+
+        Correct the description of manual test: autocorrection-cancelled-by-typing-1.html
+        https://bugs.webkit.org/show_bug.cgi?id=47722
+        <rdar://problem/8556206>
+
+        * manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html: Update description
+          to match the test content.
+
+2010-10-18  Martin Robinson  <mrobinson@igalia.com>
+
+        Build fix for newer versions of GTK+ 2.0. Instead of using GDK_DISPLAY()
+        use GDK_DRAWABLE_XDISPLAY(gdk_display_get_default()). GDK_DISPLAY() was
+        recently deprecated and the latter method has been available since GTK+
+        2.2.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::initXEvent):
+        (WebCore::PluginView::platformGetValue):
+        (WebCore::getVisualAndColormap):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformDestroy):
+
+2010-10-18  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        elementCannotHaveEndTag should be a member function of MarkupAccumulator
+        https://bugs.webkit.org/show_bug.cgi?id=47846
+
+        Moved elementCannotHaveEndTag into MarkupAccumulator.
+
+        No new tests are added since this is a cleanup.
+
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::elementCannotHaveEndTag): Added.
+        * editing/MarkupAccumulator.h: Added MarkupAccumulator::elementCannotHaveEndTag.
+        * editing/markup.cpp: Removed elementCannotHaveEndTag.
+        * editing/markup.h: Removed elementCannotHaveEndTag.
+
+2010-10-18  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Set the right referent sourceURL for the script with force user gesture.
+        https://bugs.webkit.org/show_bug.cgi?id=37138
+
+        Because empty sourceURL indicates running script with force user gesture,
+        make WebKit use document.url() as referent sourceURL (Since it uses blank
+        URL instead empty if the input URL is empty) if WebKit isn't running the
+        script from a hyper-link.
+
+        Test: fast/events/popup-blocked-from-window-open.html
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeScript):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::executeScriptInWorld):
+
+2010-10-18  Darin Adler  <darin@apple.com>
+
+        * dom/Node.h: Fix ancient typo in just-modified comment.
+
+2010-10-18  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Remove some functions from class Node and make a few others non-virtual
+        https://bugs.webkit.org/show_bug.cgi?id=47735
+
+        Refactoring. No new tests.
+
+        * bindings/js/JSNodeCustom.cpp:
+        (WebCore::JSNode::markChildren): Added a FIXME about the use of the virtual
+        ownerDocument function.
+
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::removeChildren): Removed the unused return value.
+
+        * dom/ContainerNode.h: Made insertBefore, replaceChild, removeChild, and
+        appendChild non-virtual for clarity and performance. Made removeChildren
+        non-virtual and removed its return value. Moved the inline Node functions
+        that call through to ContainerNode into this file since the old way involved
+        an extra level of inline function but otherwise had no advantages.
+
+        * dom/Element.h: Moved isMathMLElement here because there is no call site
+        that needs to call it on a Node*. We can always move it back if we need to,
+        but it's better to have less in the Node class.
+
+        * dom/Node.cpp:
+        (WebCore::Node::insertBefore): Added an isContainerNode check so this can
+        be non-virtual. There are very few callers who call this function on Node.
+        If we want to optimize them further we can make the isContainerNode check
+        inline in the future.
+        (WebCore::Node::replaceChild): Ditto.
+        (WebCore::Node::removeChild): Ditto.
+        (WebCore::Node::appendChild): Ditto.
+        (WebCore::Node::remove): Removed unneeded ref/unref because
+        ContainerNode::removeChild already does this.
+        (WebCore::Node::createRendererIfNeeded): Removed #if around call to
+        childShouldCreateRenderer since it's needed even without SVG and XHTMLMP.
+
+        * dom/Node.h: Moved definitions of inline functions that depend on
+        ContainerNode to the ContainerNode.h header. They already required inclusion
+        of that header, so there is no functional change. Made insertBefore,
+        replaceChild, removeChild, and appendChild non-virtual. There are very few
+        callers of these functions on this class. Moved isMathMLElement to Element.
+        Added a FIXME about the name of eventAncestors. Fixed comment formatting.
+        Eliminated unused isEditableBlock function. Moved the body of the
+        enclosingInlineElement function to the editing file that was the only
+        call site. Removed the previousEditable and nextEditable functions,
+        incorporating their bodies into the one place they were called.
+        Took the childShouldCreateRenderer function out of #if since it's
+        now used by the implementation of the <noscript> element.
+
+        * dom/Position.cpp:
+        (WebCore::nextRenderedEditable): Rewrote the function to use nextLeafNode
+        instead of nextEditable.
+        (WebCore::previousRenderedEditable): Rewrote the function to use
+        previousLeafNode instead of previousEditable.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::enclosingInline): Moved function here from the Node class. Also
+        fixed an incorrect cast this function did, which assumed the function
+        result was always an element, which the function does not guarantee.
+        (WebCore::ReplaceSelectionCommand::doApply): Call the function above.
+
+        * history/HistoryItem.cpp: Added include of MathExtras.h.
+
+2010-10-18  Yongjun Zhang  <yongjun_zhang@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Missing support for document.createEvent("OrientationEvent")
+        https://bugs.webkit.org/show_bug.cgi?id=32492
+
+        Add support for document.createEvent("OrientationEvent") to help unit testing of
+        onOrientationChange event.
+
+        Test: fast/dom/DeviceOrientation/create-event-onorientationchange.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::createEvent):
+
+2010-10-18  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        DOMStringList should return null if the index is out of range
+        https://bugs.webkit.org/show_bug.cgi?id=47829
+
+        When item() returns a null string, it needs to be passed to JS as
+        null. The indexed getter will then magically do the right thing.
+        So all that's left is having DOMStringList::item() return null when
+        the index is out of bounds.
+
+        * dom/DOMStringList.cpp:
+        (WebCore::DOMStringList::item):
+        * dom/DOMStringList.h:
+        * dom/DOMStringList.idl:
+
+2010-10-18  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Implement Accelerated Composition for NPAPI Plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35524
+
+        * plugins/PluginView.h:
+        (WebCore::PluginView::platformLayer):
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginGraphicsLayerQt::PluginGraphicsLayerQt):
+        (WebCore::PluginGraphicsLayerQt::~PluginGraphicsLayerQt):
+        (WebCore::PluginGraphicsLayerQt::paint):
+        (WebCore::PluginView::updatePluginWidget):
+        (WebCore::PluginView::paint):
+        (WebCore::PluginView::invalidateRect):
+        (WebCore::PluginView::invalidateRegion):
+        (WebCore::PluginView::platformStart):
+        (WebCore::PluginView::platformLayer):
+
+2010-10-18  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch to using the new Carbon NPAPI event declarations, and remove
+        the old ones.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40784
+
+        * bridge/npapi.h:
+        * plugins/mac/PluginViewMac.mm:
+        (WebCore::PluginView::setFocus):
+        (WebCore::PluginView::handleMouseEvent):
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: comment out resource manager instantiation on front-end side.
+        https://bugs.webkit.org/show_bug.cgi?id=47823
+
+        * inspector/front-end/inspector.js:
+
+2010-10-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        The description parameter of IDBFactory::open() should be mandatory.
+        https://bugs.webkit.org/show_bug.cgi?id=47835
+
+        Makes the description parameter mandatory, as per the IndexedDatabase specification.
+        Modified existing tests to cover this change.
+
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::extractMetaData):
+        (WebCore::setMetaData):
+        (WebCore::IDBDatabaseBackendImpl::IDBDatabaseBackendImpl):
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactory.h:
+        * storage/IDBFactory.idl:
+
+2010-10-18  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Code cleanup: Move most function members in TextRunWorker from inlined.
+        https://bugs.webkit.org/show_bug.cgi?id=47732
+
+        No functionality change, so no tests added.
+
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::setWordSpacingAdjustment):
+        (WebCore::TextRunWalker::setLetterSpacingAdjustment):
+        (WebCore::TextRunWalker::setXOffsetToZero):
+        (WebCore::TextRunWalker::rtl):
+        (WebCore::TextRunWalker::glyphs):
+        (WebCore::TextRunWalker::length):
+        (WebCore::TextRunWalker::xPositions):
+        (WebCore::TextRunWalker::advances):
+        (WebCore::TextRunWalker::width):
+        (WebCore::TextRunWalker::logClusters):
+        (WebCore::TextRunWalker::numCodePoints):
+        (WebCore::TextRunWalker::fontPlatformDataForScriptRun):
+        (WebCore::TextRunWalker::isCodepointSpace):
+        (WebCore::TextRunWalker::TextRunWalker):
+        (WebCore::TextRunWalker::~TextRunWalker):
+        (WebCore::TextRunWalker::isWordBreak):
+        (WebCore::TextRunWalker::setPadding):
+        (WebCore::TextRunWalker::reset):
+        (WebCore::TextRunWalker::setBackwardsIteration):
+        (WebCore::TextRunWalker::nextScriptRun):
+        (WebCore::TextRunWalker::widthOfFullRun):
+        (WebCore::TextRunWalker::getTextRun):
+        (WebCore::TextRunWalker::getNormalizedTextRun):
+        (WebCore::TextRunWalker::setupFontForScriptRun):
+        (WebCore::TextRunWalker::allocHarfbuzzFont):
+        (WebCore::TextRunWalker::deleteGlyphArrays):
+        (WebCore::TextRunWalker::createGlyphArrays):
+        (WebCore::TextRunWalker::resetGlyphArrays):
+        (WebCore::TextRunWalker::shapeGlyphs):
+        (WebCore::TextRunWalker::setGlyphXPositions):
+        (WebCore::TextRunWalker::mirrorCharacters):
+
+2010-10-18  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] AC rendering bugs
+        There were a few missing connections in Qt AC between GraphicsLayer and plugins, like changing the plugin's geometry to the layer's
+        contentsRect, and making sure media layers handle ParentChange events and setContentsNeedsDisplay. Now media layers behave correctly.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47571
+
+        No new tests. This is in preparation for fixing AC+plugins, which already has tests that don't work yet with Qt.
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+        (WebCore::GraphicsLayerQt::setContentsNeedsDisplay):
+        * platform/graphics/qt/GraphicsLayerQt.h:
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: [crash] when Inspector Open in CSSStyleSelector::loadPendingImages().
+        https://bugs.webkit.org/show_bug.cgi?id=46224
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorClient.cpp: Added.
+        (WebCore::InspectorClient::doDispatchMessageOnFrontendPage):
+        * inspector/InspectorClient.h:
+        (WebCore::InspectorClient::InspectorClient):
+
+2010-10-18  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IDBKeyTree.h is no longer used.
+        https://bugs.webkit.org/show_bug.cgi?id=47824
+
+        No new tests, just removing unused files.
+
+        * WebCore.gypi:
+        * WebCore.xcodeproj/project.pbxproj:
+        * storage/IDBKeyTree.h: Removed.
+
+2010-10-18  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed buildfix for Qt + V8.
+        Add missing <wtf/text/CString.h> include.
+
+        * inspector/InspectorInstrumentation.cpp:
+
+2010-10-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: toJSON serialization for Numbers should be fixed.
+        DecimalNumber is used instead of printf.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43832
+
+        * inspector/InspectorValues.cpp:
+        (WebCore::InspectorBasicValue::writeJSON):
+
+2010-10-18  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [REGRESSION] Inspector window visible during run-webkit-tests.
+        The initial state of an inspector setting should stay untouched
+        if the profile has no value for it.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47785
+
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::loadFromSettings):
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: tab headers on resource panel are 1px off on Mac.
+        https://bugs.webkit.org/show_bug.cgi?id=47798
+
+        * inspector/front-end/inspector.css:
+        (.tabbed-pane-header li):
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Build fix.
+
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::cachedResourceTypeString):
+
+2010-10-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Introduce InspectorResourceAgent.h/cpp and ResourceManager.js to
+        fill network panel with data.
+        https://bugs.webkit.org/show_bug.cgi?id=47779
+        
+        InspectorResourceAgent instance / JS part are introduced in this patch. Agent's lifetime is equal
+        to the front-end's. This new resource agent does not have state, instead it covers two functions:
+         1) forwards loader client messages to the front-end 2) is capable of building a tree of cached resources.
+        (1) feeds network panel with data, (2) shows the resource tree in the new ResourcesPanel concept.
+        This bug is for extracting this new InspectorResourceAgent class and its javascript counterpart.
+        Once resources panel is refactored for the new concept, InspectorResource, InspectorController's
+        resource-related routines, inspector.js's code dealing with resources, they all will be gone.
+
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.idl:
+        * inspector/InspectorApplicationCacheAgent.cpp:
+        (WebCore::InspectorApplicationCacheAgent::didReceiveManifestResponse):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::releaseFrontendLifetimeAgents):
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::frameDetachedFromParent):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::willSendRequest):
+        (WebCore::InspectorController::markResourceAsCached):
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::didReceiveContentLength):
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::didCreateWebSocket):
+        (WebCore::InspectorController::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorController::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorController::didCloseWebSocket):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        (WebCore::cachedResourceType):
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::sourceBytes):
+        (WebCore::InspectorResource::endTiming):
+        * inspector/InspectorResourceAgent.cpp:
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        (WebCore::InspectorResourceAgent::resourceData):
+        (WebCore::InspectorResourceAgent::cachedResource):
+        (WebCore::buildObjectForHeaders):
+        (WebCore::buildObjectForTiming):
+        (WebCore::buildObjectForResourceRequest):
+        (WebCore::buildObjectForResourceResponse):
+        (WebCore::buildObjectForMainResource):
+        (WebCore::cachedResourceTypeString):
+        (WebCore::buildObjectForCachedResource):
+        (WebCore::buildObjectForFrameResources):
+        (WebCore::InspectorResourceAgent::~InspectorResourceAgent):
+        (WebCore::InspectorResourceAgent::identifierForInitialRequest):
+        (WebCore::InspectorResourceAgent::willSendRequest):
+        (WebCore::InspectorResourceAgent::markResourceAsCached):
+        (WebCore::InspectorResourceAgent::didReceiveResponse):
+        (WebCore::InspectorResourceAgent::didReceiveContentLength):
+        (WebCore::InspectorResourceAgent::didFinishLoading):
+        (WebCore::InspectorResourceAgent::didFailLoading):
+        (WebCore::InspectorResourceAgent::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorResourceAgent::setOverrideContent):
+        (WebCore::InspectorResourceAgent::didCommitLoad):
+        (WebCore::InspectorResourceAgent::frameDetachedFromParent):
+        (WebCore::createReadableStringFromBinary):
+        (WebCore::InspectorResourceAgent::didCreateWebSocket):
+        (WebCore::InspectorResourceAgent::willSendWebSocketHandshakeRequest):
+        (WebCore::InspectorResourceAgent::didReceiveWebSocketHandshakeResponse):
+        (WebCore::InspectorResourceAgent::didCloseWebSocket):
+        (WebCore::InspectorResourceAgent::cachedResources):
+        (WebCore::InspectorResourceAgent::InspectorResourceAgent):
+        * inspector/InspectorResourceAgent.h:
+        (WebCore::InspectorResourceAgent::create):
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer.prototype._onRevealAndSelectResource):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource.prototype.get responseReceivedTime):
+        (WebInspector.Resource.prototype.set endTime):
+        * inspector/front-end/Settings.js:
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.setupSourceFrameIfNeeded):
+        * inspector/front-end/WebKit.qrc:
+        * inspector/front-end/inspector.css:
+        (.tabbed-pane-header li):
+        * inspector/front-end/inspector.html:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        * loader/ResourceLoadNotifier.cpp:
+        (WebCore::ResourceLoadNotifier::dispatchDidReceiveResponse):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::didReceiveResponse):
+
+2010-10-16  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: brush up URL parsing on the front-end.
+        https://bugs.webkit.org/show_bug.cgi?id=47772
+
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/front-end/AuditRules.js:
+        (WebInspector.AuditRules.getDomainToResourcesMap):
+        (WebInspector.AuditRules.CombineExternalResourcesRule.prototype.doRun):
+        (WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype.doRun):
+        (WebInspector.AuditRules.ParallelizeDownloadRule.prototype.doRun):
+        (WebInspector.AuditRules.ImageDimensionsRule.prototype.doRun):
+        (WebInspector.AuditRules.CookieSizeRule.prototype.processCookies):
+        (WebInspector.AuditRules.StaticCookielessRule.prototype.processCookies):
+        * inspector/front-end/CookieItemsView.js:
+        (WebInspector.CookieItemsView.prototype._filterCookiesForDomain):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.Cookies.cookieMatchesResourceURL):
+        * inspector/front-end/Resource.js:
+        (WebInspector.Resource):
+        (WebInspector.Resource.prototype.set url):
+        (WebInspector.Resource.prototype.get displayName):
+        * inspector/front-end/ResourceCategory.js:
+        (WebInspector.ResourceCategory.prototype.addResource):
+        * inspector/front-end/ResourceView.js:
+        (WebInspector.ResourceView):
+        * inspector/front-end/inspector.js:
+        (WebInspector.documentClick.followLink):
+        (WebInspector.documentClick):
+        (WebInspector.updateResource):
+        (WebInspector.linkifyStringAsFragment):
+        (WebInspector.resourceURLForRelatedNode):
+        (WebInspector.completeURL):
+        * inspector/front-end/utilities.js:
+        (String.prototype.asParsedURL):
+
+2010-10-17  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Support custom open() verbs/methods in XMLHttpRequest
+        https://bugs.webkit.org/show_bug.cgi?id=40476
+
+        Fall back to QNetworkAccessManager::CustomOperation for any HTTP verb
+        that's not specifically supported by QNetworkAccessManager.
+
+        This prevents the infinite loop that otherwise occurs after sending
+        an UnknownOperation request.
+
+        This change is covered by existing (skipped) tests that will be
+        unskipped once the Qt bots are running Qt 4.7.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::httpMethod):
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2010-10-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Remove explicit passing of user gesture in NavigationScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=47786
+
+        As requested by Mr. Glazkov, remove more explicit passing of the user
+        gesture state.  We now use a static to pass this information around.
+
+        * bindings/generic/BindingFrame.h:
+        (WebCore::::navigateIfAllowed):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::reload):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::reloadCallback):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setResourceTrackingEnabled):
+        (WebCore::InspectorController::reloadPage):
+        * loader/NavigationScheduler.cpp:
+        (WebCore::ScheduledNavigation::ScheduledNavigation):
+        (WebCore::ScheduledURLNavigation::ScheduledURLNavigation):
+        (WebCore::ScheduledRedirect::ScheduledRedirect):
+        (WebCore::ScheduledLocationChange::ScheduledLocationChange):
+        (WebCore::ScheduledRefresh::ScheduledRefresh):
+        (WebCore::ScheduledHistoryNavigation::ScheduledHistoryNavigation):
+        (WebCore::ScheduledFormSubmission::ScheduledFormSubmission):
+        (WebCore::NavigationScheduler::scheduleRedirect):
+        (WebCore::NavigationScheduler::mustLockBackForwardList):
+        (WebCore::NavigationScheduler::scheduleLocationChange):
+        (WebCore::NavigationScheduler::scheduleFormSubmission):
+        (WebCore::NavigationScheduler::scheduleRefresh):
+        (WebCore::NavigationScheduler::scheduleHistoryNavigation):
+        * loader/NavigationScheduler.h:
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::loadOrRedirectSubframe):
+
+2010-10-17  Julien Chaffraix  <jchaffraix@codeaurora.org>
+
+        Reviewed by Andreas Kling.
+
+        'transparent' should be a valid color
+        https://bugs.webkit.org/show_bug.cgi?id=45482
+
+        Test: svg/animations/svg-animate-color-transparent.svg
+
+        Based on previous work by Jan Erik Hanssen  <jhanssen@codeaurora.org>
+
+        * platform/ColorData.gperf: Added 'transparent' to the list of colors.
+        Added the alpha to all the colors as it was needed to support the new color.
+
+        * platform/graphics/Color.cpp:
+        (WebCore::Color::Color):
+        (WebCore::Color::setNamedColor): Avoid setting the alpha as now it is not
+        always 0xFF.
+
+2010-10-17  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Duplicate use element children in shadow tree.
+        https://bugs.webkit.org/show_bug.cgi?id=47561
+
+        Test: svg/custom/use-nested-children.svg
+
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::expandUseElementsInShadowTree):
+
+2010-10-17  Hyung Song  <beergun@company100.net>
+
+        Reviewed by David Levin.
+
+        Add !SINGLE_THREADED guard.
+        https://bugs.webkit.org/show_bug.cgi?id=47608
+
+        For SINGLE_THREADED ports LockingMutex.tryLock() returns false.
+        This will prevent interrupt() from falling into infinite loop.
+
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::interrupt):
+
+2010-10-17  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Very large and small numbers fail to round-trip through CSS
+        https://bugs.webkit.org/show_bug.cgi?id=20674
+        
+        Use the new DecimalNumber functionality to convert CSS numberic values to strings
+        using decimal notation, rather than %g (which can output scientific notation).
+
+        Test: fast/css/round-trip-values.html
+
+        * css/CSSPrimitiveValue.cpp:
+        (WebCore::formatNumber):
+        (WebCore::CSSPrimitiveValue::cssText):
+
+2010-10-17  Cosmin Truta  <ctruta@chromium.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Crash while processing ill-formed SVG with cycles
+        https://bugs.webkit.org/show_bug.cgi?id=47498
+
+        Test: svg/custom/invalid-paint-shape-mask.svg
+
+        * rendering/SVGResources.cpp:
+        (paintingResourceFromSVGPaint): Ensured that the painting resource is
+        either a pattern resource or a gradient resource.
+        (SVGResources::setClipper):
+        (SVGResources::setFilter):
+        (SVGResources::setMarkerStart):
+        (SVGResources::setMarkerMid):
+        (SVGResources::setMarkerEnd):
+        (SVGResources::setMasker):
+        (SVGResources::setFill):
+        (SVGResources::setStroke): Added ASSERT statements for previously-unchecked
+        preconditions.
+
+2010-10-17  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fixed extra whitespace above operators when they aren't stretched
+        yet the stretch height is large.  Also, the baseline alignment
+        was changed so that rows and operators interact appropriately now
+        that operators don't have the extra white space.
+
+        * mathml/RenderMathMLOperator.cpp:
+        * mathml/RenderMathMLRow.cpp:
+
+2010-10-17  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix focusing of control elements on mouse click.
+        Brings GTK fix to Qt platform.
+        https://bugs.webkit.org/show_bug.cgi?id=40641
+                        
+        Test: fast/events/click-focus-control.html
+
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLFormControlElement::isMouseFocusable):
+
+2010-10-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        FrameLoader doesn't need an explicit userGesture parameter
+        https://bugs.webkit.org/show_bug.cgi?id=47777
+
+        We used to pass around the user gesture state explicitly.  Now we use
+        static state.  Explicitly passing the user gesture state to FrameLoader
+        in these methods is pretty out-dated.
+
+        * bindings/ScriptControllerBase.cpp:
+        (WebCore::ScriptController::executeIfJavaScriptURL):
+        * bindings/generic/BindingDOMWindow.h:
+        (WebCore::::createWindow):
+        (WebCore::::open):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/ScriptController.h:
+        * bindings/v8/ScriptController.h:
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::handleLinkClick):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::openInInspectedWindow):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::changeLocation):
+        (WebCore::FrameLoader::urlSelected):
+        (WebCore::FrameLoader::submitForm):
+        * loader/FrameLoader.h:
+        * loader/NavigationScheduler.cpp:
+        (WebCore::ScheduledURLNavigation::fire):
+        (WebCore::ScheduledRefresh::fire):
+        (WebCore::ScheduledHistoryNavigation::fire):
+        (WebCore::NavigationScheduler::scheduleLocationChange):
+
+2010-10-17  Sergey A. Sukiyazov  <sergey.sukiyazov@gmail.com>
+
+        Reviewed by Andreas Kling
+
+        [Qt] Hovering the mouse over links produce a trail of underlined links (X11 paint engine)
+        https://bugs.webkit.org/show_bug.cgi?id=42248
+
+        The problem will appear because coordinates of points may increase by 0.05f (if line width is odd) inside
+        method GraphicsContext::adjustLineToPixelBoundaries(...) and become outside of text bounding rect htere,
+        then the new point coordinates will be passed to Qt graphics engine.
+
+        The solution decreases Y cordinates of points inside drawLineForText(...) method only if Qt graphics engine
+        is X11. The Y coordinates will be increase by 0.5f inside method adjustLineToPixelBoundaries(...),  which
+        called from drawLine(...), and then inside Qt painting engine will be rounded to next greater integer value.
+
+        NOTE: This changes will affect only Qt X11 verision and if only X11 Painting Engine will be used.
+
+        No new tests.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::drawLineForText):
+
+2010-10-17  Rob Buis  <rwlbuis@gmail.com>
+
+        Reviewed by Dirk Schulze.
+
+        Text under nested link dropped
+        https://bugs.webkit.org/show_bug.cgi?id=46460
+
+        Allow links inside of tspan and textPath elements.
+
+        * svg/SVGTSpanElement.cpp:
+        (WebCore::SVGTSpanElement::childShouldCreateRenderer):
+        * svg/SVGTextPathElement.cpp:
+        (WebCore::SVGTextPathElement::childShouldCreateRenderer):
+
+2010-10-16  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Port TextCodec
+        https://bugs.webkit.org/show_bug.cgi?id=45797
+
+        Implement TextCodec with Brew MP's ICharsetConv.
+        Only UTF-8 is supported for now.
+
+        * platform/text/TextEncoding.cpp:
+        (WebCore::TextEncoding::encode):
+        * platform/text/TextEncodingRegistry.cpp:
+        (WebCore::buildBaseTextCodecMaps):
+        * platform/text/brew/TextCodecBrew.cpp: Added.
+        (WebCore::newTextCodecBrew):
+        (WebCore::TextCodecBrew::registerBaseEncodingNames):
+        (WebCore::TextCodecBrew::registerBaseCodecs):
+        (WebCore::TextCodecBrew::registerExtendedEncodingNames):
+        (WebCore::TextCodecBrew::registerExtendedCodecs):
+        (WebCore::TextCodecBrew::TextCodecBrew):
+        (WebCore::TextCodecBrew::~TextCodecBrew):
+        (WebCore::TextCodecBrew::decode):
+        (WebCore::TextCodecBrew::encode):
+        * platform/text/brew/TextCodecBrew.h: Added.
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed.
+
+        Build fix for !ENABLE(INSPECTOR) after r69844.
+
+        * inspector/InspectorState.h: Added ENABLE(INSPECTOR) guard.
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Unreviewed, build fix.
+
+        WinCE build fix for r69798.
+
+        * platform/text/wince/TextCodecWinCE.cpp: Added missing include.
+
+2010-10-16  Johnny Ding  <jnd@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Requires a user gesture when opening file choose dialog.
+        https://bugs.webkit.org/show_bug.cgi?id=47593
+
+        Test: fast/forms/input-file-not-open-without-gesture.html
+
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::click):
+
+2010-10-16  Alex Milowski  <alex@milowski.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Changed the vertical alignment within mfenced to baseline to
+        match the rest of the containers (e.g. mrow) and adjusted the
+        operator spacing to 0.1em.
+
+        Test: mathml/presentation/fenced-mi.xhtml
+
+        * css/mathml.css:
+        * mathml/RenderMathMLFenced.cpp:
+
+2010-10-16  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Rename StringHasherFunctions.h to StringHasher.h
+        https://bugs.webkit.org/show_bug.cgi?id=47200
+
+        * ForwardingHeaders/wtf/StringHashFunctions.h: Removed.
+        * ForwardingHeaders/wtf/StringHasher.h: Copied from WebCore/ForwardingHeaders/wtf/StringHashFunctions.h. 
+ 
+2010-10-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        unlink removes inline style of anchor elements
+        https://bugs.webkit.org/show_bug.cgi?id=47424
+
+        The bug was caused by our not extracting styles when the anchor element is removed by removeInlineStyle.
+        Because we removed the element without pushing its inline style down, we lost style information.
+
+        Fixed the bug by pushing down styles in removeInlineStyle as done in pushDownInlineStyleAroundNode.
+        Also fixed a bug in addInlineStyleIfNeeded where StyleChange incorrectly removed styles of the container
+        node as supposed to that of startNode from the style to apply when startNode is not an element.
+
+        Test: editing/execCommand/toggle-unlink.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement): To prevent a similar bug in the future,
+        added an assert that extractedStyle is specified whenever we're removing a styled element.
+        (WebCore::ApplyStyleCommand::removeInlineStyle):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+
+2010-10-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        serializeNodesWithNamespaces should be in MarkupAccumulator
+        https://bugs.webkit.org/show_bug.cgi?id=47749
+
+        Moved serializeNodesWithNamespaces to MarkupAccumulator, and renamed it to serializeNodes.
+        MarkupAccumulator::serializeNode now returns the resultant string instead of having a separate takeResults().
+        Added several helper functions to MarkupAccumulator.
+
+        No new tests are added since this is a cleanup.
+
+        * editing/MarkupAccumulator.cpp:
+        (WebCore::MarkupAccumulator::serializeNodes): Wrapper for serializeNodes and concatenateMarkup.
+        (WebCore::MarkupAccumulator::serializeNodesWithNamespaces): Moved from markup.cpp
+        (WebCore::MarkupAccumulator::appendStartTag): Calls appendString instead of appending into m_succeedingMarkup directly.
+        (WebCore::MarkupAccumulator::appendEndTag): Ditto.
+        (WebCore::MarkupAccumulator::totalLength): Added; extracted from takeResults.
+        (WebCore::MarkupAccumulator::concatenateMarkup): Ditto.
+        * editing/MarkupAccumulator.h:
+        (WebCore::MarkupAccumulator::length): Added; calls totalLength.
+        * editing/markup.cpp:
+        (WebCore::StyledMarkupAccumulator::appendString): Added; calls MarkupAccumulator's appendString.
+        (WebCore::StyledMarkupAccumulator::wrapWithStyleNode): Calls appendString.
+        (WebCore::StyledMarkupAccumulator::takeResults): Calls length, totalLength, and concatenateMarkup.
+        (WebCore::StyledMarkupAccumulator::serializeNodes): Became a member function.
+        (WebCore::createMarkup): Uses MarkupAccumulator.
+
+2010-10-15  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by Jian Li.
+
+        Implement FileEntrySync.file() in FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=47310
+
+        Tests: fast/filesystem/workers/file-from-file-entry-sync.html
+               fast/filesystem/workers/file-from-file-entry.html
+
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::createFile): Added.
+        * fileapi/DOMFileSystem.h:
+        * fileapi/DOMFileSystemSync.cpp:
+        (WebCore::DOMFileSystemSync::createFile): Added.
+        * fileapi/DOMFileSystemSync.h:
+        * fileapi/DirectoryReaderBase.h: Added 'virtual path' comment.
+        * fileapi/EntryBase.h: Added 'virtual path' comment.
+        * fileapi/FileEntry.cpp:
+        (WebCore::FileEntry::file): Changed to use DOMFileSystem::createFile.
+        * fileapi/FileEntrySync.cpp:
+        (WebCore::FileEntrySync::file): Implemented.
+        * fileapi/FileEntrySync.h:
+        * fileapi/FileEntrySync.idl: Added file().
+
+2010-10-15  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Eric Carlson.
+
+        Make sure to update the current graphics context when calling out to AppKit.
+        https://bugs.webkit.org/show_bug.cgi?id=47757
+
+        Like r57741, but for the spellchecking highlight
+
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::GraphicsContext::drawLineForTextChecking):
+
+2010-10-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r69850) Loading apple.com/startpage in WebKit on Windows gets a bad request.
+        https://bugs.webkit.org/show_bug.cgi?id=47753
+        <rdar://problem/8558242>
+        
+        r69850 switched over to a different way of concatenating WebCore strings, but ran into an issue
+        where some Windows calls were returning null terminated strings, and this breaks the new
+        method of concatenation.
+        
+        GetLocaleInfo returns a null-terminated string, but WebCore strings are non-null terminated,
+        so once we create our WebCore string, we want to trim off the null terminating character before
+        we return the localeInfo.
+
+        Test: fast/dom/navigator-userAgent.html
+
+        * platform/win/Language.cpp:
+        (WebCore::localeInfo):
+
+2010-10-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Trying to fix crashes on Leopard buildbot.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::didFinishLoading):
+        (WebCore::Loader::Host::didFail):
+        Moved logging higher in the function - it seems that CachedResource can be already destroyed.
+
+        * platform/Logging.cpp: (WebCore::getChannelFromName):
+        * platform/mac/LoggingMac.mm: (WebCore::InitializeLoggingChannelsIfNecessary):
+        Initialize the new channel (oops).
+
+2010-10-15  Mike Lawther  <mikelawther@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Prevent scrollbars from appearing in iframes with scrolling=no
+        when the embedded content has overflow:scroll set on the html
+        or body tags.
+
+        iframes keep getting scrollbars with scrolling="no"
+        https://bugs.webkit.org/show_bug.cgi?id=29240
+
+        Test: fast/frames/iframe-scrolling-attribute-overflowscroll.html
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::calculateScrollbarModesForLayout)
+        (WebCore::FrameView::updateCanHaveScrollbars):
+        (WebCore::FrameView::layout):
+        * page/FrameView.h:
+        (WebCore::FrameView::calculateScrollbarModesForLayout)
+
+2010-10-15  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Clean up RenderFlexibleBox::applyLineClamp()
+        https://bugs.webkit.org/show_bug.cgi?id=47743
+
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::applyLineClamp):
+
+2010-10-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47736
+        <rdar://problem/8429396> WebCore cache gets corrupted if revalidation request starts at an inopportune time
+
+        Test: http/tests/cache/stopped-revalidation.html
+
+        * loader/loader.cpp: (WebCore::Loader::Host::servePendingRequests): Copied logic for
+        revalidation requests from didFail().
+
+2010-10-15  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Darin Adler in <https://bugs.webkit.org/show_bug.cgi?id=47736>.
+
+        Add a logging channel for WebCore cache and resource loading.
+
+        Test: http/tests/cache/stopped-revalidation.html
+
+        * platform/Logging.cpp:
+        * platform/Logging.h:
+        Added a logging channel for Cache and Loader.
+
+        * loader/Cache.cpp:
+        (WebCore::Cache::requestResource):
+        (WebCore::Cache::revalidateResource):
+        (WebCore::Cache::revalidationFailed):
+        (WebCore::Cache::evict):
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::setResourceToRevalidate):
+        (WebCore::CachedResource::switchClientsToRevalidatedResource):
+        (WebCore::CachedResource::mustRevalidate):
+        Added logging.
+
+        * loader/loader.cpp:
+        (WebCore::Loader::load): Added logging.
+        (WebCore::Loader::scheduleServePendingRequests): Ditto.
+        (WebCore::Loader::requestTimerFired): Ditto.
+        (WebCore::Loader::servePendingRequests): Ditto.
+        (WebCore::Loader::Host::servePendingRequests):  Changed logging to use the new channel.
+        (WebCore::Loader::Host::didFinishLoading): Changed logging to use the new channel.
+        (WebCore::Loader::Host::didFail): Added logging.
+
+2010-10-15  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Simon Fraser.
+
+        Add public functions to serialize TransformOperations.
+        https://bugs.webkit.org/show_bug.cgi?id=47728
+
+        Added public accessors to the internal data of the TransformOperations.
+
+        No new tests. These functions are enablers for WebKit2.
+
+        * platform/graphics/transforms/Matrix3DTransformOperation.h:
+        (WebCore::Matrix3DTransformOperation::matrix):
+        * platform/graphics/transforms/MatrixTransformOperation.h:
+        (WebCore::MatrixTransformOperation::matrix):
+        * platform/graphics/transforms/PerspectiveTransformOperation.h:
+        (WebCore::PerspectiveTransformOperation::perspective):
+        * platform/graphics/transforms/RotateTransformOperation.h:
+        (WebCore::RotateTransformOperation::x):
+        (WebCore::RotateTransformOperation::y):
+        (WebCore::RotateTransformOperation::z):
+        * platform/graphics/transforms/SkewTransformOperation.h:
+        (WebCore::SkewTransformOperation::angleX):
+        (WebCore::SkewTransformOperation::angleY):
+        * platform/graphics/transforms/TranslateTransformOperation.h:
+        (WebCore::TranslateTransformOperation::x):
+        (WebCore::TranslateTransformOperation::y):
+        (WebCore::TranslateTransformOperation::z):
+
+2010-10-15  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        FileReader.readAsDataURL should take Blob object
+        https://bugs.webkit.org/show_bug.cgi?id=47679
+
+        Test cases have been added into read-blob-test-cases.js.
+
+        * fileapi/FileReader.idl: Update per the latest File API spec.
+
+2010-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move MarkupAccumulator from markup.cpp to its own file
+        https://bugs.webkit.org/show_bug.cgi?id=47734
+
+        This patch moves the MarkupAccumulator class into its own file.
+        There's a lot of clean up left to do, but this patch is a step in the
+        right direction.
+
+        No behavior change.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * editing/markup.cpp:
+        (WebCore::elementCannotHaveEndTag):
+        * editing/markup.h:
+        * editing/MarkupAccumulator.h: Added.
+        * editing/MarkupAccumulator.cpp: Added.
+
+2010-10-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Match the elements supported by execCommand('formatBlock') and queryCommandValue('formatBlock')
+        https://bugs.webkit.org/show_bug.cgi?id=47712
+
+        Extended queryCommandValue('formatBlock', false, null) to support article, aside, blockquote, dd, dl,
+        div, dl, dt, dl, footer, header, hgroup, nav, and section. Because this makes isElementForFormatBlockCommand
+        in Editor.cpp and FormatBlockCommand::isElementToApplyInFormatBlockCommand identical, they are merged and moved
+        to FormatBlockCommand.cpp
+
+        Tests are added to editing/execCommand/query-format-block.html
+
+        * editing/Editor.cpp: Removed isElementForFormatBlockCommand and Editor::elementForFormatBlockCommand.
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::executeFormatBlock): Removed the check of tag name; the check is moved into FormatBlockCommand.
+        (WebCore::valueFormatBlock): Calls FormatBlockCommand::elementForFormatBlockCommand.
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::isElementForFormatBlock):
+        (WebCore::FormatBlockCommand::FormatBlockCommand):
+        (WebCore::FormatBlockCommand::formatSelection): Added to check the tag name. Exit early if the specified tag name
+        is not what FormatBlock should apply. Set m_didApply true if m_didApply did apply the element.
+        (WebCore::FormatBlockCommand::formatRange): Moved from Editor.cpp.  Takes Range* instead of accessing selection directly.
+        (WebCore::FormatBlockCommand::elementForFormatBlockCommand): Moved from Editor.cpp
+        (WebCore::enclosingBlockToSplitTreeTo): Calls isElementForFormatBlock.
+        * editing/FormatBlockCommand.h:
+        (WebCore::FormatBlockCommand::didApply): Added.
+
+2010-10-15  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        carto.net Dock example redraws *way* too often
+        https://bugs.webkit.org/show_bug.cgi?id=16090
+
+        Setting the attributes x, y, width or height shouldn't cause a repaint if the image boundaries don't change.
+        Added updateFromElement() to RenderSVGImage that checks if the old boundaries match the new boundaries after
+        setting one of the attributes of above. Mark renderer for layout (and therefore repaint) if the boundaries
+        differ, do nothing if not.
+        Also added caching of the repaint rect to avoid multiple calculations.
+
+        Test: svg/custom/repaint-on-constant-size-change.svg
+
+        * rendering/RenderSVGImage.cpp:
+        (WebCore::RenderSVGImage::RenderSVGImage):
+        (WebCore::RenderSVGImage::layout): Update repaint rect on layout.
+        (WebCore::RenderSVGImage::updateFromElement): Check SVGImageElement for boundaries update.
+        * rendering/RenderSVGImage.h:
+        (WebCore::RenderSVGImage::repaintRectInLocalCoordinates): Return the cached repaint rect.
+        * svg/SVGImageElement.cpp:
+        (WebCore::SVGImageElement::svgAttributeChanged): Call updateFromElement() on changes to x, y, width or height.
+
+2010-10-15  Martin Robinson  <mrobinson@igalia.com>
+
+        Build fix for GTK+.
+
+        * platform/network/soup/cache/webkit/soup-cache.h: Do not use PLATFORM(...) macro
+        in a file that does not include config.h
+
+2010-10-15  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add FindIndicatorWindow class
+        https://bugs.webkit.org/show_bug.cgi?id=47731
+
+        Export symbols needed by the FindIndicator in WebKit2.
+
+        * WebCore.exp.in:
+
+2010-10-15  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed. Build fix.
+
+        Add new files needed by the Soup network backend, and #ifdef a
+        GTK+-port only include in soup-cache.h.
+
+        * CMakeListsEfl.txt:
+        * platform/network/soup/cache/webkit/soup-cache.h:
+
+2010-10-14  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Use more specific types for node pointers, especially when calling node insertion and removal functions
+        https://bugs.webkit.org/show_bug.cgi?id=47702
+
+        Refactoring. No new tests.
+
+        While developing this patch I temporarily removed the node insertion and
+        removal member functions from the Node class and fixed almost all call sites
+        so they call it directly on the ContainerNode class, which will be important
+        once we make the functions non-virtual.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::SelectorChecker::checkSelector):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        * dom/Document.cpp:
+        (WebCore::Document::caretRangeFromPoint):
+        * dom/DynamicNodeList.cpp:
+        (WebCore::DynamicNodeList::itemWithName):
+        * dom/Position.cpp:
+        (WebCore::Position::previous):
+        (WebCore::Position::next):
+        * dom/Text.cpp:
+        (WebCore::Text::replaceWholeText):
+        * dom/TreeWalker.cpp:
+        (WebCore::TreeWalker::firstChild):
+        (WebCore::TreeWalker::lastChild):
+        (WebCore::TreeWalker::previousNode):
+        * dom/XMLDocumentParserLibxml2.cpp:
+        (WebCore::XMLDocumentParser::XMLDocumentParser):
+        * editing/BreakBlockquoteCommand.cpp:
+        (WebCore::BreakBlockquoteCommand::doApply):
+        * editing/CompositeEditCommand.h:
+        * editing/DeleteButtonController.cpp:
+        (WebCore::isDeletableElement):
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::outdentParagraph):
+        * editing/InsertNodeBeforeCommand.cpp:
+        (WebCore::InsertNodeBeforeCommand::doApply):
+        * editing/JoinTextNodesCommand.cpp:
+        (WebCore::JoinTextNodesCommand::doApply):
+        (WebCore::JoinTextNodesCommand::doUnapply):
+        * editing/MergeIdenticalElementsCommand.cpp:
+        (WebCore::MergeIdenticalElementsCommand::doUnapply):
+        * editing/RemoveNodeCommand.cpp:
+        (WebCore::RemoveNodeCommand::doApply):
+        (WebCore::RemoveNodeCommand::doUnapply):
+        * editing/RemoveNodeCommand.h:
+        * editing/SplitElementCommand.cpp:
+        (WebCore::SplitElementCommand::executeApply):
+        * editing/SplitTextNodeCommand.cpp:
+        (WebCore::SplitTextNodeCommand::doApply):
+        (WebCore::SplitTextNodeCommand::doReapply):
+        * editing/TextIterator.cpp:
+        (WebCore::parentCrossingShadowBoundaries):
+        * editing/htmlediting.cpp:
+        (WebCore::enclosingList):
+        * editing/markup.cpp:
+        (WebCore::serializeNodes):
+        (WebCore::ancestorToRetainStructureAndAppearance):
+        (WebCore::createMarkup):
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::updateFocusAppearance):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::rendererIsNeeded):
+        * html/HTMLFormElement.cpp:
+        (WebCore::HTMLFormElement::rendererIsNeeded):
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::attach):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::insertedIntoTree):
+        * html/HTMLLegendElement.cpp:
+        (WebCore::HTMLLegendElement::associatedControl):
+        * html/HTMLOptGroupElement.cpp:
+        (WebCore::HTMLOptGroupElement::recalcSelectOptions):
+        (WebCore::HTMLOptGroupElement::ownerSelectElement):
+        * html/HTMLOptionElement.cpp:
+        (WebCore::HTMLOptionElement::ownerSelectElement):
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::additionalAttributeStyleDecls):
+        * html/HTMLTableColElement.cpp:
+        (WebCore::HTMLTableColElement::additionalAttributeStyleDecls):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::insertRow):
+        * html/HTMLTableRowElement.cpp:
+        (WebCore::HTMLTableRowElement::rowIndex):
+        * html/HTMLTableSectionElement.cpp:
+        (WebCore::HTMLTableSectionElement::additionalAttributeStyleDecls):
+        * page/DOMSelection.cpp:
+        (WebCore::DOMSelection::getRangeAt):
+        (WebCore::DOMSelection::containsNode):
+        * rendering/RenderSVGGradientStop.cpp:
+        (WebCore::RenderSVGGradientStop::gradientElement):
+        * svg/SVGElement.cpp:
+        (WebCore::SVGElement::ownerSVGElement):
+        (WebCore::SVGElement::viewportElement):
+        * svg/SVGFELightElement.cpp:
+        (WebCore::SVGFELightElement::svgAttributeChanged):
+        (WebCore::SVGFELightElement::childrenChanged):
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::svgAttributeChanged):
+        * svg/SVGFontFaceFormatElement.cpp:
+        (WebCore::SVGFontFaceFormatElement::childrenChanged):
+        * svg/SVGFontFaceUriElement.cpp:
+        (WebCore::SVGFontFaceUriElement::childrenChanged):
+        * svg/SVGGlyphElement.cpp:
+        (WebCore::SVGGlyphElement::invalidateGlyphCache):
+        * svg/SVGHKernElement.cpp:
+        (WebCore::SVGHKernElement::insertedIntoDocument):
+        (WebCore::SVGHKernElement::removedFromDocument):
+        * svg/SVGLocatable.cpp:
+        (WebCore::SVGLocatable::nearestViewportElement):
+        (WebCore::SVGLocatable::farthestViewportElement):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::updateContainerOffsets):
+        * svg/SVGVKernElement.cpp:
+        (WebCore::SVGVKernElement::insertedIntoDocument):
+        (WebCore::SVGVKernElement::removedFromDocument):
+        * svg/animation/SVGSMILElement.cpp:
+        (WebCore::SVGSMILElement::targetElement):
+        * wml/WMLDoElement.cpp:
+        (WebCore::WMLDoElement::insertedIntoDocument):
+        (WebCore::WMLDoElement::removedFromDocument):
+        * wml/WMLNoopElement.cpp:
+        (WebCore::WMLNoopElement::insertedIntoDocument):
+        * wml/WMLOptionElement.cpp:
+        (WebCore::ownerSelectElement):
+        * wml/WMLPostfieldElement.cpp:
+        (WebCore::WMLPostfieldElement::insertedIntoDocument):
+        (WebCore::WMLPostfieldElement::removedFromDocument):
+        * wml/WMLSetvarElement.cpp:
+        (WebCore::WMLSetvarElement::insertedIntoDocument):
+        (WebCore::WMLSetvarElement::removedFromDocument):
+        * wml/WMLTaskElement.cpp:
+        (WebCore::WMLTaskElement::insertedIntoDocument):
+        (WebCore::WMLTaskElement::removedFromDocument):
+        * wml/WMLTimerElement.cpp:
+        (WebCore::WMLTimerElement::insertedIntoDocument):
+        (WebCore::WMLTimerElement::removedFromDocument):
+        * xml/XPathStep.cpp:
+        (WebCore::XPath::Step::nodesInAxis):
+        Use ContainerNode* for the result of the parentNode function now that
+        it returns a ContainerNode*. In the past it used to return just Node*.
+
+        * dom/ContainerNode.h: Added toContainerNode.
+
+        * dom/Element.h: Use ContainerNode*. Added toElement.
+
+        * dom/Element.cpp:
+        (WebCore::Element::deprecatedCreateContextualFragment): Explcitly
+        cast to HTMLElement* in the case that handles <html> and <body>
+        elements.
+        (WebCore::Element::baseURI): Use ContainerNode*.
+
+        * dom/Node.cpp:
+        (WebCore::Node::markAncestorsWithChildNeedsStyleRecalc): Use ContainerNode*.
+        (WebCore::Node::isDescendantOf): Ditto.
+        (WebCore::Node::createRendererIfNeeded): Ditto.
+        (WebCore::Node::setTextContent): Use already-typecast pointer in a call to
+        appendChild.
+        (WebCore::Node::ancestorElement): Use ContainerNode*.
+
+        * dom/Range.cpp:
+        (WebCore::Range::compareNode): Use ContainerNode*.
+        (WebCore::Range::intersectsNode): Ditto.
+        (WebCore::Range::processContents): Cast to ContainerNode* in a couple cases
+        where we previously checked that the node in question has a child. Any node
+        that returns a non-zero value for firstChild is a ContainerNode.
+        (WebCore::Range::checkNodeBA): Ditto.
+        (WebCore::Range::selectNode): Ditto.
+        (WebCore::Range::surroundContents): Ditto.
+
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::insertErrorMessageBlock): Rewrote code to use
+        more specific types, document instead of doc, and paragraph instead of par.
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
+        Use ContainerNode*.
+        (WebCore::ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes):
+        Use replaceElementWithSpanPreservingChildrenAndAttributes; the old function
+        took a Node argument and had Node in its name.
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::removeNodeAndPruneAncestors): Use ContainerNode.
+        (WebCore::CompositeEditCommand::replaceElementWithSpanPreservingChildrenAndAttributes):
+        Renamed and changed to take HTMLElement. Also use ContainerNode.
+        (WebCore::CompositeEditCommand::prune): Ditto.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyListItem): Ditto.
+        (WebCore::CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph): Ditto.
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand): Take an
+        HTMLElement instead of a Node. Call it m_elementToReplace instead of m_node.
+        (WebCore::swapInNodePreservingAttributesAndChildren): Take HTMLElement.
+        (WebCore::ReplaceNodeWithSpanCommand::doApply): Updated for name changes.
+        (WebCore::ReplaceNodeWithSpanCommand::doUnapply): Ditto.
+        * editing/ReplaceNodeWithSpanCommand.h: Ditto.
+
+        * editing/ReplaceSelectionCommand.cpp:
+        (WebCore::ReplacementFragment::ReplacementFragment): Use StyledElement for result
+        of insertFragmentForTestRendering since that's what it returns.
+        (WebCore::ReplacementFragment::removeNode): Use ContainerNode.
+        (WebCore::ReplacementFragment::insertNodeBefore): Ditto.
+        (WebCore::ReplacementFragment::insertFragmentForTestRendering): Return StyledElement.
+        Use HTMLElement for body.
+        (WebCore::ReplacementFragment::restoreTestRenderingNodesToFragment): Take
+        StyledElement.
+        (WebCore::ReplaceSelectionCommand::handleStyleSpans): Use ContainerNode.
+        (WebCore::ReplaceSelectionCommand::copyStyleToChildren): Use HTMLElement for
+        the cloned span, since the clone will be a sspan too.
+        (WebCore::ReplaceSelectionCommand::insertAsListItems): Use ContainerNode since
+        the list item has a child, and that proves it is a ContainerNode.
+
+        * editing/SelectionController.cpp:
+        (WebCore::SelectionController::selectFrameElementInParentIfFullySelected):
+        Use ContainerNode and also removed an unnneded local variable.
+
+        * html/HTMLElement.cpp:
+        (WebCore::HTMLElement::setOuterText): Use ContainerNode.
+        (WebCore::HTMLElement::insertAdjacent): Use ContainerNode and also use && to make
+        the logic a little simpler.
+        (WebCore::contextElementForInsertion): Use ContainerNode.
+        (WebCore::HTMLElement::findFormAncestor): Ditto.
+
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::removeNode): Use ContainerNode.
+        (WebCore::InspectorDOMAgent::changeTagName): Ditto.
+        (WebCore::InspectorDOMAgent::setOuterHTML): Ditto.
+        (WebCore::InspectorDOMAgent::innerParentNode): Use isDocumentNode instead of
+        nodeType. We should almost never use nodeType inside the engine.
+        (WebCore::InspectorDOMAgent::didInsertDOMNode): Use ContainerNode.
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode): Ditto.
+
+        * wml/WMLOptGroupElement.cpp: Removed unneeded overrides of insertBefore,
+        replaceChild, removeChild, appendChild, and removeChildren functions.
+        Ths already overrides childrenChanged, that is called by all of the above,
+        and it does the same thing these functions did.
+        (WebCore::ownerSelectElement): Use ContainerNode.
+        * wml/WMLOptGroupElement.h: Ditto.
+
+2010-10-15  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Crash in WebCore::ApplyStyleCommand::applyBlockStyle
+        https://bugs.webkit.org/show_bug.cgi?id=47699
+
+        The crash was caused by applyBlockStyle's invalidly assuming that visibleStart and visibleEnd always exist.
+        Added an early exit to the function when either visibleStart or visibleEnd is null or orphaned.
+
+        Test: editing/style/block-style-progress-crash.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::applyBlockStyle):
+
+2010-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a FindIndicator class
+        https://bugs.webkit.org/show_bug.cgi?id=47635
+
+        Make Gradient.h and Generator.h private headers; they're used by WebKit2.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-10-15  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [Soup] Should not ignore body for redirection responses
+        https://bugs.webkit.org/show_bug.cgi?id=29299
+
+        Body is now provided to WebKitGtk+ in some redirections (like 302)
+        because it could be used by servers to perform clunky redirections
+        for example using http-equiv=REFRESH
+
+        Test: http/tests/navigation/redirect302-metaredirect.html
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::gotHeadersCallback):
+        (WebCore::finishedCallback):
+
+2010-10-15  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Fix introspection support
+        https://bugs.webkit.org/show_bug.cgi?id=47723
+
+        WebKitSoupCacheType was incorrectly registered twice. Renamed to
+        WebKitSoupCacheTypeType for the enumerated type.
+
+        * platform/network/soup/cache/webkit/soup-cache.c:
+        (webkit_soup_cache_type_get_type):
+
+2010-10-15  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: extract consoleMessages related stuff from populateScriptObjects into separate function.
+
+        This is a part of Inspector protocol sanitization activity.
+        We want to populate console messages only if it is required by frontend.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46802
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setConsoleMessagesEnabled):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::populateScriptObjects):
+        * inspector/InspectorController.h:
+        * inspector/InspectorState.cpp:
+        (WebCore::InspectorState::InspectorState):
+        * inspector/InspectorState.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.doLoadedDone):
+
+2010-10-15  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        [EFL] REGRESSION(69798) UCHAR can't be converted to String.
+        https://bugs.webkit.org/show_bug.cgi?id=47698
+
+        Create String value using String(const char*, 1) instead of operator[].
+
+        No tests. No functionality changed.
+
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::createWindowsKeyMap):
+
+2010-10-15  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Do a stricter check for invalid base64 dataURLs
+        https://bugs.webkit.org/show_bug.cgi?id=47717
+
+        Restore the strict base64 decoding we added in
+        https://bugs.webkit.org/show_bug.cgi?id=44261 and then rolled back
+        in https://bugs.webkit.org/show_bug.cgi?id=47666 due to a failing
+        test. The actual issue was that we were not finishing the load of
+        the resource gracefully when an error happened.
+
+        Loading invalid base64-encoded data:// URLs are now handled
+        properly.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::parseDataUrl):
+        * platform/network/soup/cache/soup-request-data.c:
+        (webkit_soup_request_data_send):
+
+2010-10-15  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        compile fail with gtk >= 2.22
+        https://bugs.webkit.org/show_bug.cgi?id=47483
+
+        * platform/graphics/gtk/FontGtk.cpp: Removed the shrink operation,
+        it was added long time ago and currently it is not adding any real
+        area to the clip vertically, actually the gtk3 shrink version did
+        not work.
+        (WebCore::Font::drawComplexText):
+        * platform/gtk/gtk2drawing.c: Undef the deprecation flags, this
+        file is full of gtk2 stuff, and it does not seem interesting to
+        upgrade because we are already creating a new version of the file
+        for gtk3.
+
+2010-10-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: inspector settings/properties/states management
+        should be extracted into separate class.
+
+        We have a lot of flags/values in InspectorController.
+        Some flags are persisting into profile.
+        Others are part of inspector state for frontend.
+        All these flags should keep their values after navigation.
+        It'd be better to extract these flags/values into separate
+        class which will care about theirs lifetime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47275
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::inspectorStartsAttached):
+        (WebCore::InspectorController::setInspectorStartsAttached):
+        (WebCore::InspectorController::setInspectorAttachedHeight):
+        (WebCore::InspectorController::inspectorAttachedHeight):
+        (WebCore::InspectorController::searchingForNodeInPage):
+        (WebCore::InspectorController::resourceTrackingEnabled):
+        (WebCore::InspectorController::saveApplicationSettings):
+        (WebCore::InspectorController::getInspectorState):
+        (WebCore::InspectorController::restoreInspectorStateFromCookie):
+        (WebCore::InspectorController::getSettings):
+        (WebCore::InspectorController::storeLastActivePanel):
+        (WebCore::InspectorController::mouseDidMoveOverElement):
+        (WebCore::InspectorController::handleMousePress):
+        (WebCore::InspectorController::setSearchingForNode):
+        (WebCore::InspectorController::setMonitoringXHREnabled):
+        (WebCore::InspectorController::showPanel):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::restoreDebugger):
+        (WebCore::InspectorController::restoreProfiler):
+        (WebCore::InspectorController::getTrackedResource):
+        (WebCore::InspectorController::didLoadResourceFromMemoryCache):
+        (WebCore::InspectorController::identifierForInitialRequest):
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        (WebCore::InspectorController::setResourceTrackingEnabled):
+        (WebCore::InspectorController::ensureSettingsLoaded):
+        (WebCore::InspectorController::startTimelineProfiler):
+        (WebCore::InspectorController::stopTimelineProfiler):
+        (WebCore::InspectorController::enableProfiler):
+        (WebCore::InspectorController::disableProfiler):
+        (WebCore::InspectorController::enableDebuggerFromFrontend):
+        (WebCore::InspectorController::disableDebugger):
+        (WebCore::InspectorController::loadBreakpoints):
+        (WebCore::InspectorController::saveBreakpoints):
+        * inspector/InspectorController.h:
+        * inspector/InspectorFrontendClientLocal.cpp:
+        (WebCore::InspectorFrontendClientLocal::changeAttachedWindowHeight):
+        (WebCore::InspectorFrontendClientLocal::restoreAttachedWindowHeight):
+        * inspector/InspectorState.cpp: Added.
+        (WebCore::InspectorState::InspectorState):
+        (WebCore::InspectorState::restoreFromInspectorCookie):
+        (WebCore::InspectorState::generateStateObjectForFrontend):
+        (WebCore::InspectorState::loadFromSettings):
+        (WebCore::InspectorState::updateCookie):
+        (WebCore::InspectorState::setValue):
+        (WebCore::InspectorState::getBoolean):
+        (WebCore::InspectorState::getString):
+        (WebCore::InspectorState::getLong):
+        (WebCore::InspectorState::registerBoolean):
+        (WebCore::InspectorState::registerString):
+        (WebCore::InspectorState::registerLong):
+        (WebCore::InspectorState::Property::create):
+        * inspector/InspectorState.h: Added.
+        (WebCore::InspectorState::setBoolean):
+        (WebCore::InspectorState::setString):
+        (WebCore::InspectorState::setLong):
+
+2010-10-14  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        REGRESSION (r69548): Autocorrections are applied even after typing further characters in the word
+        https://bugs.webkit.org/show_bug.cgi?id=47689
+        <rdar://problem/8552250>
+
+        The test requires using setTimeout(). So we put it in manual-tests.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition): Relpace release() with clear().
+        (WebCore::Editor::startCorrectionPanelTimer): Release previously set correction range before
+          start timer for next autocorrection check.
+        * manual-tests/autocorrection: Added.
+        * manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html: Added.
+
+2010-10-14  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang and Darin Adler.
+
+        execCommand FormatBlock creates lots of blockquotes
+        https://bugs.webkit.org/show_bug.cgi?id=19795
+
+        The bug was caused by WebKit's not reusing the block node added by previous iteration
+        and its inserting block node at wrong places.
+
+        Fixed the bug by rewriting FormatBlockCommand::formatRange.  New code resembles that of
+        IndentOutdentCommand::indentIntoBlockquote.  The difference between two is that formatRange
+        avoids the existing block elements when replacing blocks and it also adds a placeholder
+        when removing the existing block caused paragraphs to collapse.
+
+        Also fixed a bug in moveParagraphWithClones where erroneous br is added to the start of
+        the block element to which the paragraph is moved if the block element is the start of a paragraph
+        and not the end of a paragraph.
+
+        Tests: editing/execCommand/format-block-multiple-paragraphs.html
+               editing/execCommand/format-block-table.html
+
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::moveParagraphWithClones): No longer adds erroneous br.
+        * editing/EditorCommand.cpp:
+        (WebCore::executeFormatBlock):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::formatRange): Rewritten; see above.
+        (WebCore::FormatBlockCommand::isElementToApplyInFormatBlockCommand): Renamed from validBlockElement
+        and moved from htmlediting.cpp.
+        (WebCore::enclosingBlockToSplitTreeTo): Added.
+        * editing/FormatBlockCommand.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::enclosingBlockFlowElement): Changed the return type to Element*
+        * editing/VisiblePosition.h:
+
+2010-10-14  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Crash in HTMLTextFormControlElement::selection()
+        https://bugs.webkit.org/show_bug.cgi?id=47522
+
+        Patch by Ryosuke Niwa  <rniwa@webkit.org>
+
+        The bug was caused by our triggering layout inside RenderTextControl::selection.
+        Fixed it by changing the return type of RenderTextControl::selection to PassRefPtr<Range> from VisibleSelection.
+
+        Test: fast/forms/render-text-crash.html
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::selectionForCommand): Calls HTMLTextFormControlElement::selection.
+        * html/HTMLFormControlElement.cpp:
+        (WebCore::HTMLTextFormControlElement::selection): Calls RenderTextControl::selection.
+        * html/HTMLFormControlElement.h:
+        * rendering/RenderTextControl.cpp:
+        (WebCore::RenderTextControl::selection): Changed the return type.
+        * rendering/RenderTextControl.h:
+
+2010-10-14  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        SelectElement should check if its renderer exists after calling Element::focus()
+        https://bugs.webkit.org/show_bug.cgi?id=47696
+
+        Adds null checks for element->renderer() after calling element->focus(), since focus()
+        can dispatch an event and run arbitrary javascript that may cause the select element
+        to lose its renderer.
+
+        Test: fast/forms/select-listbox-focus-displaynone.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2010-10-14  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Dave Hyatt.
+
+        This patch lays the groundwork for 
+        https://bugs.webkit.org/show_bug.cgi?id=47514 CSS transforms should 
+        affect scrolling
+        by adding topmostPosition().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::topmostPosition):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::topmostPosition):
+        * rendering/RenderBox.h:
+        * rendering/RenderMedia.cpp:
+        (WebCore::RenderMedia::topmostPosition):
+        * rendering/RenderMedia.h:
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::topmostPosition):
+        * rendering/RenderTableSection.h:
+
+2010-10-14  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] fix compilation warnings in imported libsoup code
+        https://bugs.webkit.org/show_bug.cgi?id=47674
+
+        Fixed some warnings caused by comparisons between signed and
+        unsigned integer expressions
+
+        * platform/network/soup/cache/soup-directory-input-stream.c:
+        (webkit_soup_directory_input_stream_read):
+        * platform/network/soup/cache/soup-request-data.c:
+        (webkit_soup_request_data_send):
+        * platform/network/soup/cache/soup-request-file.c:
+        (webkit_soup_request_file_ensure_file):
+        * platform/network/soup/cache/webkit/soup-cache.c:
+        (webkit_soup_cache_entry_is_fresh_enough):
+        (webkit_soup_cache_has_response):
+
+2010-10-14  Andreas Kling  <kling@webkit.org>
+
+        Unreviewed buildfix, RetainPtr is a mac thing..
+
+        * platform/network/soup/ProxyServerSoup.cpp:
+
+2010-10-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Form controls do not respect GTK+ font size
+        https://bugs.webkit.org/show_bug.cgi?id=47134
+
+        Have form controls use the font specified in GtkSettings. This font is
+        the default control font in GTK+ applications and Firefox. We need to
+        pass the string through Pango to get a valid font name and size.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::getScreenDPI): A helper function which returns
+        the DPI of the default screen or 96 as a fallback.
+        (WebCore::RenderThemeGtk::systemFont): Calculate the system font
+        by looking at the GtkSettings value and pushing it through Pango
+        to get the font family and font size.
+
+2010-10-14  Andreas Kling  <kling@webkit.org>
+
+        Soup buildfix for r69808: add ProxyServer stub.
+
+        * GNUmakefile.am:
+        * platform/network/soup/ProxyServerSoup.cpp: Added.
+        (WebCore::proxyServersForURL):
+
+2010-10-14  Andreas Kling  <kling@webkit.org>
+
+        Fix GTK+ build after r69808.
+
+        * GNUmakefile.am:
+        * platform/network/curl/ProxyServerCurl.cpp:
+        (WebCore::proxyServersForURL):
+
+2010-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Another build fix. Export FrameLoader::networkingContext()
+
+        * WebCore.exp.in:
+
+2010-10-14  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build after r69808.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::proxyServersForURL):
+
+2010-10-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix following r69806.
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::markupToCFHTML):
+
+2010-10-14  Dawit Alemayehu  <adawit@kde.org>
+
+        Reviewed by Andreas Kling
+
+        Implemented NPN_GetValueForURL and NPN_SetValueForURL and NPN_GetAuthenticationInfo.
+        https://bugs.webkit.org/show_bug.cgi?id=34539
+
+        These missing NPN functions cause Java applets to crash in ports such
+        as QtWebkit that rely on webkit for Java applet support.
+
+        * plugins/PluginDebug.cpp:
+        (WebCore::prettyNameForNPNURLVariable):
+        * plugins/PluginDebug.h:
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::initializeBrowserFuncs):
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::getValueForURL):
+        (WebCore::PluginView::setValueForURL):
+        (WebCore::PluginView::getAuthenticationInfo):
+        * plugins/PluginView.h:
+        * plugins/npapi.cpp:
+        (NPN_GetValueForURL):
+        (NPN_SetValueForURL):
+        (NPN_GetAuthenticationInfo):
+        * platform/network/ProxyServer.h:
+        * platform/network/cf/ProxyServerCFNet.cpp:
+        (WebCore::proxyServersForURL):
+        * platform/network/qt/ProxyServerQt.cpp:
+        (WebCore::proxyServersForURL):
+ 
+2010-10-14  Gavin Barraclough  <barraclough@apple.com>
+
+        Windows build fix following r69806.
+
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::markupToCFHTML):
+
+2010-10-14  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Cache link status at linkProgram and use it in useProgram instead of querying GPU
+        https://bugs.webkit.org/show_bug.cgi?id=47685
+
+        * html/canvas/WebGLProgram.cpp: Always cache link status at linkStatus and use it upon query.
+        (WebCore::WebGLProgram::WebGLProgram):
+        * html/canvas/WebGLProgram.h: Ditto.
+        (WebCore::WebGLProgram::getLinkStatus):
+        (WebCore::WebGLProgram::setLinkStatus):
+        * html/canvas/WebGLRenderingContext.cpp: Ditto.
+        (WebCore::WebGLRenderingContext::getProgramParameter):
+        (WebCore::WebGLRenderingContext::linkProgram):
+        (WebCore::WebGLRenderingContext::useProgram):
+
+2010-10-14  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Style fix for r69735
+        https://bugs.webkit.org/show_bug.cgi?id=47684
+
+        No logic change. Existing tests apply.
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+
+2010-10-14  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: encapsulate ScriptState into ConsoleMessage instead of passing it as additional parameter
+        https://bugs.webkit.org/show_bug.cgi?id=47675
+
+        No new tests. This refactoring is covered by existing inspector tests.
+
+        * bindings/js/JSConsoleCustom.cpp:
+        * bindings/js/ScriptCallFrame.cpp:
+        * bindings/js/ScriptCallFrame.h:
+        (WebCore::ScriptCallFrame::functionName):
+        (WebCore::ScriptCallFrame::sourceURL):
+        (WebCore::ScriptCallFrame::lineNumber):
+        (WebCore::ScriptCallFrame::argumentCount):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::isEqual):
+        * inspector/ConsoleMessage.h:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::addMessageToConsole):
+        (WebCore::InspectorController::addConsoleMessage):
+        (WebCore::InspectorController::startGroup):
+        (WebCore::InspectorController::endGroup):
+        * inspector/InspectorController.h:
+
+2010-10-14  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Replace lots of String::format() usages by StringConcatenate
+        https://bugs.webkit.org/show_bug.cgi?id=47664
+
+        * ForwardingHeaders/wtf/text/StringConcatenate.h: Added.
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::crossDomainAccessErrorMessage):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::reportUnsafeAccessTo):
+        * dom/ExceptionBase.cpp:
+        (WebCore::ExceptionBase::ExceptionBase):
+        * dom/XMLDocumentParser.cpp:
+        (WebCore::XMLDocumentParser::handleError):
+        * history/PageCache.cpp:
+        (WebCore::logCanCacheFrameDecision):
+        * html/FTPDirectoryDocument.cpp:
+        (WebCore::processFileDateString):
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didReceiveResponse):
+        (WebCore::InspectorController::count):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::createBreakpointId):
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::formatBreakpointId):
+        * inspector/InspectorProfilerAgent.cpp:
+        (WebCore::InspectorProfilerAgent::addProfileFinishedMessageToConsole):
+        (WebCore::InspectorProfilerAgent::addStartProfilingMessageToConsole):
+        (WebCore::InspectorProfilerAgent::getCurrentUserInitiatedProfileName):
+        (WebCore::InspectorProfilerAgent::takeHeapSnapshot):
+        * loader/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::printAccessDeniedMessage):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::checkIfDisplayInsecureContent):
+        (WebCore::FrameLoader::checkIfRunInsecureContent):
+        (WebCore::FrameLoader::shouldAllowNavigation):
+        * loader/archive/cf/LegacyWebArchive.cpp:
+        (WebCore::LegacyWebArchive::createFromSelection):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::postMessageTimerFired):
+        * page/PrintContext.cpp:
+        (WebCore::PrintContext::pageProperty):
+        (WebCore::PrintContext::pageSizeAndMarginsInPixels):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::canLoadObject):
+        * platform/efl/PlatformKeyboardEventEfl.cpp:
+        (WebCore::createKeyMap):
+        (WebCore::createWindowsKeyMap):
+        * platform/graphics/GraphicsLayer.cpp:
+        (WebCore::GraphicsLayer::animationNameForTransition):
+        * platform/graphics/brew/ImageBrew.cpp:
+        (WebCore::Image::loadPlatformResource):
+        * platform/graphics/cg/ImageBufferCG.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/efl/ImageEfl.cpp:
+        (WebCore::loadResourceSharedBuffer):
+        * platform/graphics/gtk/ImageBufferGtk.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/haiku/ImageBufferHaiku.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::animationIdentifier):
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::toDataURL):
+        * platform/graphics/win/WebLayer.cpp:
+        (WebCore::WebLayer::drawInContext):
+        * platform/network/CredentialStorage.cpp:
+        (WebCore::originStringFromURL):
+        * platform/sql/SQLiteDatabase.cpp:
+        (WebCore::SQLiteDatabase::setSynchronous):
+        * platform/text/wince/TextCodecWinCE.cpp:
+        (WebCore::LanguageManager::LanguageManager):
+        * platform/win/ClipboardUtilitiesWin.cpp:
+        (WebCore::markupToCFHTML):
+        * platform/win/Language.cpp:
+        (WebCore::defaultLanguage):
+        * plugins/PluginStream.cpp:
+        (WebCore::PluginStream::startStream):
+        * svg/SVGUseElement.cpp:
+        (WebCore::dumpInstanceTree):
+        * websockets/WebSocket.cpp:
+        (WebCore::WebSocket::connect):
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::appendToBuffer):
+        * websockets/WebSocketHandshake.cpp:
+        (WebCore::WebSocketHandshake::readServerHandshake):
+
+2010-10-14  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Small cleanup in PluginViewGtk
+        https://bugs.webkit.org/show_bug.cgi?id=47588
+
+        Remove some dead code and use PlatformRefPtr for cairo surfaces.
+
+        No new tests, only refactoring.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint):
+
+2010-10-14  Dawit Alemayehu  <adawit@kde.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix compile error when bulding webkit's Qt port using the "--v8" option.
+        https://bugs.webkit.org/show_bug.cgi?id=47455
+
+        * platform/qt/PlatformBridge.h:
+
+2010-10-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] REGRESSION: FreeType backend does not respect XSettings font settings after r68558
+        https://bugs.webkit.org/show_bug.cgi?id=47033
+
+        Fix logic that merges XSettings defaults and FontConfig settings. If
+        FontConfig or XSettings specifies a subpixel order, we force subpixel
+        anti-aliasing on. If anti-aliasing is turned on explicitly, only
+        override the setting if it was previously off, otherwise we ignore
+        the user's preference for subpixel or gray antialiasing.
+
+        Test: platform/gtk/fonts/xsettings_antialias_settings.html
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::setCairoFontOptionsFromFontConfigPattern): Fix merging of XSettings
+        and FontConfig anti-aliasing settings.
+        (WebCore::getDefaultFontOptions): Added this helper.
+        (WebCore::FontPlatformData::FontPlatformData): Use the getDefaultFontOptions helper.
+
+2010-10-14  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Support typed arrays in workers
+        https://bugs.webkit.org/show_bug.cgi?id=47616
+
+        To support typed arrays in workers, we need to expose constructors in
+        WorkerContext and add NoStaticTables attribute.
+
+        I also add File API feature guard to the constructors defined in
+        DOMWindow.
+
+        * bindings/js/JSDOMWindowCustom.cpp: Add File API feature guard to the
+        constructors defined in DOMWindow.
+        * html/canvas/ArrayBuffer.idl: Add NoStaticTables attribute.
+        * html/canvas/ArrayBufferView.idl: Add NoStaticTables attribute.
+        * html/canvas/Float32Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Int16Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Int32Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Int8Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Uint16Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Uint32Array.idl: Add NoStaticTables attribute.
+        * html/canvas/Uint8Array.idl: Add NoStaticTables attribute.
+        * page/DOMWindow.idl: Add File API feature guard to the constructors
+        defined in DOMWindow.
+        * workers/WorkerContext.idl: Expose type array constructors.
+
+2010-10-14  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Avoid creating empty transparency layers in ImageBuffer::clip()
+
+        We were creating empty layers for sub-1 height/width clips due to
+        using IntRect(FloatRect) instead of enclosingIntRect().
+        This lead to a bunch of QPainter warnings on the console since you
+        can't draw on an empty QPixmap.
+
+        * platform/graphics/qt/ImageBufferQt.cpp:
+        (WebCore::ImageBuffer::clip):
+
+2010-10-14  Holger Hans Peter Freyther  <holger@moiji-mobile.com>
+
+        Reviewed by Martin Robinson.
+
+        [cairo] Typo in determining fixed width fonts
+        https://bugs.webkit.org/show_bug.cgi?id=47470
+
+        It must be a single ampersand otherwise the
+        && FT_FACE_FLAG_FIXED_WIDTH will always be true.
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::FontPlatformData):
+
+2010-10-14  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Failing test LayoutTests/editing/undo/orphaned-selection-crash-bug32823-2.html
+        https://bugs.webkit.org/show_bug.cgi?id=47666
+
+        Do a less strict decoding of base64 data url's as it was done
+        before. The actual problem is most likely
+        https://bugs.webkit.org/show_bug.cgi?id=47661 tough.
+
+        * platform/network/soup/cache/soup-request-data.c:
+        (webkit_soup_request_data_send):
+
+2010-10-14  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        SVGFEConvolveMatrixElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=47660
+
+        The dynamic changes are captured by the svgAttributeChange function, and invalidate the filter primitive if necessary.
+        The patch also implements the simple setOrder and setKernelUnitLength methods.
+
+        Tests: svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-bias-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-divisor-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-edgeMode-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-kernelMatrix-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-kernelUnitLength-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-order-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-preserveAlpha-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-targetX-attr.html
+               svg/dynamic-updates/SVGFEConvolveMatrixElement-dom-targetY-attr.html
+
+        * svg/SVGFEConvolveMatrixElement.cpp:
+        (WebCore::SVGFEConvolveMatrixElement::setOrder):
+        (WebCore::SVGFEConvolveMatrixElement::setKernelUnitLength):
+        (WebCore::SVGFEConvolveMatrixElement::svgAttributeChanged):
+        * svg/SVGFEConvolveMatrixElement.h:
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Text breaking is slow: enable ICU as an opt-in
+        https://bugs.webkit.org/show_bug.cgi?id=40332
+
+        Added a config flag that enables ICU as an opt-in instead of the Qt specific code.
+
+        No new tests, this should be covered by existing tests.
+
+        * WebCore.pro:
+        * platform/text/qt/TextBreakIteratorQt.cpp:
+        (WebCore::currentTextBreakLocaleID):
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        This patch enables compilation of TextureMapper with Media. It has an initial non-working implementation of a video layer, to be integrated
+        once other parts of TextureMapper are fully working.
+
+        No new tests: this is new implementation that's not enabled yet.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::TextureMapperVideoLayerQt::TextureMapperVideoLayerQt):
+        (WebCore::TextureMapperVideoLayerQt::setPlatformLayerClient):
+        (WebCore::TextureMapperVideoLayerQt::paint):
+        (WebCore::TextureMapperVideoLayerQt::size):
+        (WebCore::MediaPlayerPrivateQt::acceleratedRenderingStateChanged):
+        (WebCore::MediaPlayerPrivateQt::platformLayer):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+        (WebCore::MediaPlayerPrivateQt::supportsAcceleratedRendering):
+        (WebCore::MediaPlayerPrivateQt::acceleratedRenderingStateChanged):
+        (WebCore::MediaPlayerPrivateQt::platformLayer):
+
+2010-10-14  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        Fixed crashes in the GTK 64bits bot, we have to use NULL instead
+        of 0 when calling these glib APIs, 0 is compiled as a char and in
+        64bits systems it is not correct.
+
+        * platform/network/soup/cache/soup-requester.c:
+        (webkit_soup_requester_new):
+        (webkit_soup_requester_request_uri):
+
+2010-10-14  Daniel Bates  <dbates@rim.com>
+
+        Attempt to fix the Qt and GTK builds based on the build bot results from <http://webkit.sed.hu>.
+
+        * rendering/RenderInline.cpp: Include header "RenderTheme.h"
+
+2010-10-14  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        Only draw focus ring in RenderInline and RenderImage if the theme
+        is not able to draw a focus ring
+        https://bugs.webkit.org/show_bug.cgi?id=47632
+
+        Fixes an issue where RenderInline::paintOutline() and RenderImage::paintFocusRings()
+        would draw a focus ring regardless of whether the port-specific theme is able to
+        draw a focus ring. Instead, these methods should only draw a focus ring if the
+        theme is unable to draw a focus ring.
+
+        Also, extracted common focus ring drawing code from RenderObject::paintOutline()
+        and RenderInline::paintOutline() into RenderObject::paintFocusRing().
+
+        Tests: fast/forms/textfield-focus-ring.html
+               fast/images/imagemap-focus-ring.html
+               fast/inline/inline-focus-ring.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::paintFocusRings): Modified to only draw a focus ring if the
+        the theme does not draw one.
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::paintOutline): Modified to call RenderObject::paintFocusRing().
+        * rendering/RenderObject.cpp:
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::paintFocusRing): Added.
+        (WebCore::RenderObject::paintOutline): Modified to call RenderObject::paintFocusRing().
+        * rendering/RenderObject.h:
+
+2010-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Move load and dom content event timers into InspectorController.
+        https://bugs.webkit.org/show_bug.cgi?id=47668
+
+        * inspector/CodeGeneratorInspector.pm:
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::populateScriptObjects):
+        (WebCore::InspectorController::mainResourceFiredDOMContentEvent):
+        (WebCore::InspectorController::mainResourceFiredLoadEvent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::InspectorResource):
+        (WebCore::InspectorResource::updateScriptObject):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/inspector.js:
+        (WebInspector.updateResource):
+        (WebInspector.domContentEventFired):
+        (WebInspector.loadEventFired):
+
+2010-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Re-landing r69757.
+
+2010-10-14  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: implement pausing on window events and timeouts
+        https://bugs.webkit.org/show_bug.cgi?id=47542
+
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::didInstallTimerImpl):
+        (WebCore::InspectorInstrumentation::didRemoveTimerImpl):
+        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
+        (WebCore::InspectorInstrumentation::didDispatchEventImpl):
+        (WebCore::InspectorInstrumentation::willDispatchEventOnWindowImpl):
+        (WebCore::InspectorInstrumentation::didDispatchEventOnWindowImpl):
+        (WebCore::InspectorInstrumentation::willFireTimerImpl):
+        (WebCore::InspectorInstrumentation::didFireTimerImpl):
+        (WebCore::InspectorInstrumentation::pauseOnNativeEventIfNeeded):
+        (WebCore::InspectorInstrumentation::cancelPauseOnNativeEvent):
+        * inspector/InspectorInstrumentation.h:
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.EventListenerBreakpoint.prototype.populateLabelElement):
+        (WebInspector.EventListenerBreakpoint.prototype.populateStatusMessageElement):
+        (WebInspector.EventListenerBreakpoint.prototype._condition):
+        (WebInspector.EventListenerBreakpoint.prototype._uiEventName):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._populate):
+
+2010-10-14  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        Canvas: "currentColor" should inherit the canvas element's color
+        https://bugs.webkit.org/show_bug.cgi?id=40273
+
+        Warning fix after r69755. Missing default cases added.
+
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::parseColorOrCurrentColor):
+        (WebCore::CanvasStyle::createFromString):
+        (WebCore::CanvasStyle::createFromStringWithOverrideAlpha):
+
+2010-10-14  Pavel Feldman  <pfeldman@chromium.org>
+
+        Not reviewed. Rolling out r69757.
+
+2010-10-08  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: extract content-related methods into InspectorResourceAgent.
+        https://bugs.webkit.org/show_bug.cgi?id=47415
+
+        This is needed for resource-tracking-less operation of resources panel.
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * inspector/InspectorCSSAgent.cpp:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::type):
+        (WebCore::InspectorResource::sourceString):
+        (WebCore::InspectorResource::sourceBytes):
+        * inspector/InspectorResource.h:
+        * inspector/InspectorResourceAgent.cpp: Added.
+        (WebCore::InspectorResourceAgent::resourceContent):
+        (WebCore::InspectorResourceAgent::resourceContentBase64):
+        (WebCore::InspectorResourceAgent::resourceData):
+        (WebCore::InspectorResourceAgent::cachedResourceType):
+        (WebCore::InspectorResourceAgent::cachedResource):
+        * inspector/InspectorResourceAgent.h: Added.
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+        * inspector/InspectorUtilities.cpp: Removed.
+        * inspector/InspectorUtilities.h: Removed.
+
+2010-10-14  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Canvas: "currentColor" should inherit the canvas element's color
+        https://bugs.webkit.org/show_bug.cgi?id=40273
+
+        Add support for "currentColor" in CanvasRenderingContext2D APIs.
+        If the canvas is in-document, "currentColor" is replaced by canvas.style.color,
+        otherwise we use fully opaque black.
+
+        For gradient addColorStop(), "currentColor" always means fully opaque black.
+
+        Spec link:
+        http://www.whatwg.org/specs/web-apps/current-work/#2dcontext
+
+        Test: fast/canvas/canvas-currentColor.html
+
+        * html/canvas/CanvasGradient.cpp:
+        (WebCore::CanvasGradient::addColorStop):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::setStrokeStyle):
+        (WebCore::CanvasRenderingContext2D::setFillStyle):
+        (WebCore::CanvasRenderingContext2D::setShadowColor):
+        (WebCore::CanvasRenderingContext2D::setShadow):
+        * html/canvas/CanvasStyle.cpp:
+        (WebCore::parseColor):
+        (WebCore::currentColor):
+        (WebCore::parseColorOrCurrentColor):
+        (WebCore::CanvasStyle::CanvasStyle):
+        (WebCore::CanvasStyle::createFromString):
+        (WebCore::CanvasStyle::createFromStringWithOverrideAlpha):
+        (WebCore::CanvasStyle::isEquivalentColor):
+        (WebCore::CanvasStyle::applyStrokeColor):
+        (WebCore::CanvasStyle::applyFillColor):
+        * html/canvas/CanvasStyle.h:
+        (WebCore::CanvasStyle::isCurrentColor):
+        (WebCore::CanvasStyle::hasOverrideAlpha):
+        (WebCore::CanvasStyle::overrideAlpha):
+
+2010-10-08  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [REGRESSION] Scripts panel: the bubble shows wrong values
+        https://bugs.webkit.org/show_bug.cgi?id=47358
+
+        Test: inspector/debugger-eval-on-call-frame.html
+
+        * inspector/front-end/InjectedScript.js:
+        (injectedScriptConstructor.): don't embrace expression evaluated in the local scope
+        of a call frame into with(window) to avoid shadowing local variables by global ones.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement getParameter from the URL API
+        https://bugs.webkit.org/show_bug.cgi?id=46610
+
+        Another API from
+        https://docs.google.com/document/edit?id=1r_VTFKApVOaNIkocrg0z-t7lZgzisTuGTXkdzAk4gLU&hl=en#
+        getParameter lets a web site easily read the value of a URL parameter.
+        This API is for the simple case of a non-repeated parameter name.
+        getParameterAll will handle repeated parameter names in a future patch.
+
+        Tests: fast/dom/anchor-getParameter.html
+               http/tests/misc/location-getParameter.html
+
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::getParameter):
+        * html/HTMLAnchorElement.h:
+        * html/HTMLAnchorElement.idl:
+        * page/Location.cpp:
+        (WebCore::Location::getParameter):
+        * page/Location.h:
+        * page/Location.idl:
+        * platform/KURL.cpp:
+        (WebCore::KURL::copyParsedQueryTo):
+        * platform/KURLGoogle.cpp:
+        (WebCore::KURL::copyParsedQueryTo):
+        * platform/KURL.h:
+
+2010-10-14  Alejandro G. Castro  <alex@igalia.com>
+
+        Unreviewed. GTK build fix.
+
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::sendRequestCallback):
+
+2010-10-14  Adrienne Walker  <enne@google.com>
+
+        Reviewed by James Robinson.
+
+        Add a short-term solution for large layers.  Layers that are too
+        large to be contained in a single texture just upload the portion of
+        the layer that is within the content rect.  A longer-term solution
+        is still tiling with proper memory management.  Layers that have full
+        3D transforms (more than just translations) are still not drawn.
+        https://bugs.webkit.org/show_bug.cgi?id=47016
+
+        Test: compositing/tiling
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::ContentLayerChromium):
+        (WebCore::ContentLayerChromium::requiresClippedUpdateRect):
+        (WebCore::ContentLayerChromium::calculateClippedUpdateRect):
+        (WebCore::ContentLayerChromium::updateContents):
+        (WebCore::ContentLayerChromium::updateTextureRect):
+        (WebCore::ContentLayerChromium::draw):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::updateContents):
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayers):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+        (WebCore::LayerRendererChromium::rootLayerContentRect):
+
+2010-10-14  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Add DelayDSPKernel files
+        https://bugs.webkit.org/show_bug.cgi?id=47518
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/DelayDSPKernel.cpp: Added.
+        (WebCore::DelayDSPKernel::DelayDSPKernel):
+        (WebCore::DelayDSPKernel::process):
+        (WebCore::DelayDSPKernel::reset):
+        * webaudio/DelayDSPKernel.h: Added.
+        (WebCore::DelayDSPKernel::maxDelayTime):
+        (WebCore::DelayDSPKernel::setDelayFrames):
+        (WebCore::DelayDSPKernel::delayProcessor):
+
+2010-10-13  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        WebKitGtk+ to use the new API from the imported SoupURILoader code
+
+        [GTK] Add HTTP caching support
+        https://bugs.webkit.org/show_bug.cgi?id=44261
+
+        ResourceHandleSoup now does everything via SoupURILoader. This means
+        that all URLs are handled via the same code path, where WebCore simply
+        asks libsoup for a WebKitSoupRequest and the request returns an input
+        stream. Many of ResourceHandleSoup's data members are now PlatformRefPtr
+        as well, to simplify reference counting
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::restartedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::parseDataUrl):
+        (WebCore::cleanupSoupRequestOperation):
+        (WebCore::sendRequestCallback):
+        (WebCore::startHttp):
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::cancel):
+        (WebCore::closeCallback):
+        (WebCore::readCallback):
+        (WebCore::startGio):
+        * platform/network/soup/ResourceRequest.h:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+        (WebCore::ResourceRequest::updateSoupMessage):
+
+2010-10-12  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Prevent block logical height of a root inline box from overflowing by clamping it
+        at INT_MAX. Otherwise, we will not be able to properly dirty the set of lines during
+        removal a floating object.
+        https://bugs.webkit.org/show_bug.cgi?id=45611        
+
+        Test: fast/overflow/overflow-block-logical-height-crash.html
+
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::alignBoxesInBlockDirection):
+
+2010-10-13  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Throw INDEX_SIZE_ERR exception if createRadialGradient is called with a negative radius
+        Canvas: radialGradient with negative radius should throw exception
+        https://bugs.webkit.org/show_bug.cgi?id=37176
+
+        This matches the canvas 2d specification, Opera, IE9 beta and our behavior for arc()
+        and arcTo().  Also fixes some PassRefPtr/RefPtr errors in this file.
+
+        Test: canvas/philip/tests/2d.gradient.radial.negative.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::createLinearGradient):
+        (WebCore::CanvasRenderingContext2D::createRadialGradient):
+        (WebCore::createEmptyImageData):
+        (WebCore::CanvasRenderingContext2D::measureText):
+
+2010-10-13  Fridrich Strba  <fridrich.strba@bluewin.ch>
+
+        Reviewed by Darin Adler.
+
+        Add WebCore/plugins/win directory to CFLAGS
+        https://bugs.webkit.org/show_bug.cgi?id=45547
+
+        * GNUmakefile.am:
+
+2010-10-13  Martin Robinson  <mrobinson@igalia.com>
+
+        Build fix for older versions of libsoup.
+
+        * platform/network/soup/cache/soup-request-file.c:
+        (webkit_soup_request_file_ensure_file): Access the path member of the SoupURI directly.
+
+2010-10-13  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Add TextBoundaries and TextBreakIterator
+        https://bugs.webkit.org/show_bug.cgi?id=46105
+
+        Copy the implementation of WinCE port.
+
+        * platform/text/brew/TextBoundariesBrew.cpp: Added.
+        (WebCore::findNextWordFromIndex):
+        (WebCore::findWordBoundary):
+        * platform/text/brew/TextBreakIteratorBrew.cpp: Added.
+        (WebCore::isCharStop):
+        (WebCore::isLineStop):
+        (WebCore::isSentenceStop):
+        (WebCore::TextBreakIterator::reset):
+        (WebCore::TextBreakIterator::following):
+        (WebCore::TextBreakIterator::preceding):
+        (WebCore::WordBreakIterator::first):
+        (WebCore::WordBreakIterator::next):
+        (WebCore::WordBreakIterator::previous):
+        (WebCore::CharBreakIterator::first):
+        (WebCore::CharBreakIterator::next):
+        (WebCore::CharBreakIterator::previous):
+        (WebCore::LineBreakIterator::first):
+        (WebCore::LineBreakIterator::next):
+        (WebCore::LineBreakIterator::previous):
+        (WebCore::SentenceBreakIterator::first):
+        (WebCore::SentenceBreakIterator::next):
+        (WebCore::SentenceBreakIterator::previous):
+        (WebCore::wordBreakIterator):
+        (WebCore::characterBreakIterator):
+        (WebCore::lineBreakIterator):
+        (WebCore::sentenceBreakIterator):
+        (WebCore::textBreakFirst):
+        (WebCore::textBreakNext):
+        (WebCore::textBreakPreceding):
+        (WebCore::textBreakFollowing):
+        (WebCore::textBreakCurrent):
+        (WebCore::isTextBreak):
+        (WebCore::cursorMovementIterator):
+
+2010-10-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        IndexedDB should fire some errors synchronously
+        https://bugs.webkit.org/show_bug.cgi?id=47530
+
+        Add dumb plumbing to pass around exception codes.
+        Utilize that plumbing in the backend to fire some
+        errors synchronously.
+        Verify that create/remove* functions are only called
+        in setVersionTransactions (and raise when not).
+        Remove plumbing for obsolete IDBDatabase.objectStore
+        Remove obsolete mode param.
+
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::continueFunction):
+        (WebCore::IDBCursor::remove):
+        * storage/IDBCursor.h:
+        (WebCore::IDBCursor::continueFunction):
+        * storage/IDBCursor.idl:
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::update):
+        (WebCore::IDBCursorBackendImpl::continueFunction):
+        (WebCore::IDBCursorBackendImpl::remove):
+        * storage/IDBCursorBackendImpl.h:
+        * storage/IDBCursorBackendInterface.h:
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::IDBDatabase):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::removeObjectStore):
+        (WebCore::IDBDatabase::setVersion):
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.h:
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::transaction):
+        * storage/IDBDatabase.idl:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::objectStore):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::transaction):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactory.h:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactory.idl:
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        * storage/IDBIndex.idl:
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::openKeyCursor):
+        (WebCore::IDBIndexBackendImpl::get):
+        (WebCore::IDBIndexBackendImpl::getKey):
+        * storage/IDBIndexBackendImpl.h:
+        * storage/IDBIndexBackendInterface.h:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::get):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::remove):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::removeIndex):
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.h:
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::get):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::remove):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::index):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndex):
+        (WebCore::IDBObjectStoreBackendImpl::openCursor):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::name):
+        (WebCore::IDBObjectStoreBackendImpl::keyPath):
+        (WebCore::IDBObjectStoreBackendImpl::autoIncrement):
+        * storage/IDBObjectStoreBackendInterface.h:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::objectStore):
+        * storage/IDBTransaction.h:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+
+2010-10-13  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add HTTP caching support
+        https://bugs.webkit.org/show_bug.cgi?id=44261
+
+        This patch adds HTTP caching support to libsoup networking backend.
+        This code will eventually be part of libsoup, but has been temporarily
+        imported into the WebCore tree for testing purposes. All libsoup code
+        is located in WebCore/platform/network/soup/cache. The webkit prefix
+        was added to all the symbols to prevent problems when this lands in
+        libsoup. Some external API was also added under webkit/ directory and
+        will be used by library clients to enable HTTP caching.
+
+        There are two parts to this imported code, the first one is the code
+        under WebCore/platform/network/soup/cache/ that contains all the
+        SoupURILoader code that supports the development of the cache. The
+        second part is the HTTP cache implementation located in
+        WebCore/platform/network/soup/cache/webkit/.
+
+        * GNUmakefile.am:
+        * platform/network/soup/cache/soup-directory-input-stream.c: Added.
+        (webkit_soup_directory_input_stream_parse_info):
+        (webkit_soup_directory_input_stream_read_next_file):
+        (webkit_soup_directory_input_stream_read):
+        (webkit_soup_directory_input_stream_close):
+        (webkit_soup_directory_input_stream_class_init):
+        (webkit_soup_directory_input_stream_init):
+        (webkit_soup_directory_input_stream_new):
+        * platform/network/soup/cache/soup-directory-input-stream.h: Added.
+        * platform/network/soup/cache/soup-http-input-stream.c: Added.
+        (webkit_soup_http_input_stream_finalize):
+        (webkit_soup_http_input_stream_class_init):
+        (webkit_soup_http_input_stream_seekable_iface_init):
+        (webkit_soup_http_input_stream_init):
+        (webkit_soup_http_input_stream_queue_message):
+        (webkit_soup_http_input_stream_new):
+        (webkit_soup_http_input_stream_got_headers):
+        (webkit_soup_http_input_stream_got_chunk):
+        (webkit_soup_http_input_stream_finished):
+        (webkit_soup_http_input_stream_cancelled):
+        (webkit_soup_http_input_stream_prepare_for_io):
+        (webkit_soup_http_input_stream_done_io):
+        (set_error_if_http_failed):
+        (read_from_leftover):
+        (webkit_soup_http_input_stream_send_internal):
+        (send_sync_finished):
+        (webkit_soup_http_input_stream_send):
+        (webkit_soup_http_input_stream_read):
+        (webkit_soup_http_input_stream_close):
+        (wrapper_callback):
+        (send_async_thread):
+        (webkit_soup_http_input_stream_send_async_in_thread):
+        (send_async_finished):
+        (webkit_soup_http_input_stream_send_async_internal):
+        (webkit_soup_http_input_stream_send_async):
+        (webkit_soup_http_input_stream_send_finish):
+        (read_async_done):
+        (webkit_soup_http_input_stream_read_async):
+        (webkit_soup_http_input_stream_read_finish):
+        (webkit_soup_http_input_stream_close_async):
+        (webkit_soup_http_input_stream_close_finish):
+        (webkit_soup_http_input_stream_tell):
+        (webkit_soup_http_input_stream_can_seek):
+        (webkit_soup_http_input_stream_seek):
+        (webkit_soup_http_input_stream_can_truncate):
+        (webkit_soup_http_input_stream_truncate):
+        (webkit_soup_http_input_stream_get_message):
+        * platform/network/soup/cache/soup-http-input-stream.h: Added.
+        * platform/network/soup/cache/soup-request-data.c: Added.
+        (webkit_soup_request_data_init):
+        (webkit_soup_request_data_finalize):
+        (webkit_soup_request_data_check_uri):
+        (uri_decoded_copy):
+        (webkit_soup_request_data_send):
+        (webkit_soup_request_data_get_content_length):
+        (webkit_soup_request_data_get_content_type):
+        (webkit_soup_request_data_class_init):
+        * platform/network/soup/cache/soup-request-data.h: Added.
+        * platform/network/soup/cache/soup-request-file.c: Added.
+        (webkit_soup_request_file_get_file):
+        (webkit_soup_request_file_init):
+        (webkit_soup_request_file_finalize):
+        (webkit_soup_request_file_check_uri):
+        (webkit_soup_request_file_ftp_main_loop_quit):
+        (webkit_soup_request_file_ensure_file_ftp):
+        (webkit_soup_request_file_ensure_file):
+        (webkit_soup_request_file_send):
+        (webkit_soup_request_file_send_async_thread):
+        (webkit_soup_request_file_send_async):
+        (webkit_soup_request_file_send_finish):
+        (webkit_soup_request_file_get_content_length):
+        (webkit_soup_request_file_get_content_type):
+        (webkit_soup_request_file_class_init):
+        * platform/network/soup/cache/soup-request-file.h: Added.
+        * platform/network/soup/cache/soup-request-http.c: Added.
+        (webkit_soup_request_http_get_message):
+        (webkit_soup_request_http_init):
+        (webkit_soup_request_http_check_uri):
+        (webkit_soup_request_http_finalize):
+        (webkit_soup_request_http_send):
+        (sent_async):
+        (conditional_get_ready_cb):
+        (send_async_cb):
+        (webkit_soup_request_http_send_async):
+        (webkit_soup_request_http_send_finish):
+        (webkit_soup_request_http_get_content_length):
+        (webkit_soup_request_http_get_content_type):
+        (webkit_soup_request_http_class_init):
+        * platform/network/soup/cache/soup-request-http.h: Added.
+        * platform/network/soup/cache/soup-request.c: Added.
+        (webkit_soup_request_init):
+        (webkit_soup_request_finalize):
+        (webkit_soup_request_set_property):
+        (webkit_soup_request_get_property):
+        (webkit_soup_request_initable_init):
+        (webkit_soup_request_default_check_uri):
+        (webkit_soup_request_default_send_async):
+        (webkit_soup_request_default_send_finish):
+        (webkit_soup_request_send):
+        (webkit_soup_request_send_async):
+        (webkit_soup_request_send_finish):
+        (webkit_soup_request_class_init):
+        (webkit_soup_request_initable_interface_init):
+        (webkit_soup_request_get_uri):
+        (webkit_soup_request_get_session):
+        (webkit_soup_request_get_content_length):
+        (webkit_soup_request_get_content_type):
+        * platform/network/soup/cache/soup-request.h: Added.
+        * platform/network/soup/cache/soup-requester.c: Added.
+        (webkit_soup_requester_init):
+        (finalize):
+        (webkit_soup_requester_class_init):
+        (init_request_types):
+        (webkit_soup_requester_new):
+        (webkit_soup_requester_request):
+        (webkit_soup_requester_request_uri):
+        (webkit_soup_scheme_is_valid):
+        (webkit_soup_requester_add_protocol):
+        (webkit_soup_requester_remove_protocol):
+        (webkit_soup_error_quark):
+        * platform/network/soup/cache/soup-requester.h: Added.
+        * platform/network/soup/cache/webkit/soup-cache-private.h: Added.
+        * platform/network/soup/cache/webkit/soup-cache.c: Added.
+        (get_cacheability):
+        (webkit_soup_cache_entry_free):
+        (copy_headers):
+        (update_headers):
+        (webkit_soup_cache_entry_get_current_age):
+        (webkit_soup_cache_entry_is_fresh_enough):
+        (webkit_soup_message_get_cache_key):
+        (webkit_soup_cache_entry_set_freshness):
+        (webkit_soup_cache_entry_new):
+        (webkit_soup_cache_writing_fixture_free):
+        (close_ready_cb):
+        (write_ready_cb):
+        (msg_got_chunk_cb):
+        (msg_got_body_cb):
+        (webkit_soup_cache_entry_delete):
+        (lru_compare_func):
+        (cache_accepts_entries_of_size):
+        (make_room_for_new_entry):
+        (webkit_soup_cache_entry_insert_by_key):
+        (msg_restarted_cb):
+        (append_to_ready_cb):
+        (msg_got_headers_cb):
+        (webkit_soup_cache_send_response):
+        (request_started):
+        (attach):
+        (webkit_soup_cache_session_feature_init):
+        (webkit_soup_cache_init):
+        (webkit_soup_cache_finalize):
+        (webkit_soup_cache_set_property):
+        (webkit_soup_cache_get_property):
+        (webkit_soup_cache_constructed):
+        (webkit_soup_cache_type_get_type):
+        (webkit_soup_cache_class_init):
+        (webkit_soup_cache_new):
+        (webkit_soup_cache_has_response):
+        (webkit_soup_cache_get_cacheability):
+        (force_flush_timeout):
+        (webkit_soup_cache_flush):
+        (remove_cache_item):
+        (webkit_soup_cache_clear):
+        (webkit_soup_cache_generate_conditional_request):
+        (pack_entry):
+        (webkit_soup_cache_dump):
+        (webkit_soup_cache_load):
+        (webkit_soup_cache_set_max_size):
+        (webkit_soup_cache_get_max_size):
+        * platform/network/soup/cache/webkit/soup-cache.h: Added.
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Chromium build fix.
+
+        * bindings/v8/ScriptProfiler.cpp:
+
+2010-10-13  Chris Evans  <cevans@google.com>
+
+        Reviewed by Jian Li.
+
+        Blob / BlobBuilder can be put into bad state with wild integers and strings, due to integer overflows
+        https://bugs.webkit.org/show_bug.cgi?id=47382
+
+        Fix integer overflow errors in Blob.slice and BlobBuilder.append.
+
+        Test: fast/files/blob-slice-overflow.html
+
+        * fileapi/Blob.cpp:
+        (WebCore::Blob::slice): handle integer overflow properly.
+        * fileapi/BlobBuilder.cpp:
+        (WebCore::BlobBuilder::append): use correct type for vector length.
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Build fix - remove some redundant references to ScriptString.
+
+        * WebCore.gypi:
+        * WebCore.pro:
+        * bindings/v8/ScriptProfiler.cpp:
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 47621 - Remove bindings/v8/ScriptString
+        This is now redundant.
+
+        * bindings/v8/ScriptCallFrame.h:
+        (WebCore::ScriptCallFrame::functionName):
+        * bindings/v8/ScriptFunctionCall.cpp:
+        * bindings/v8/ScriptFunctionCall.h:
+        * bindings/v8/ScriptString.h: Removed.
+        * bindings/v8/ScriptStringImpl.cpp: Removed.
+        * bindings/v8/ScriptStringImpl.h: Removed.
+
+2010-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Draw the find overlay holes
+        https://bugs.webkit.org/show_bug.cgi?id=47631
+
+        Export symbols needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2010-10-13  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Implement onreadystatechange event handler for Documents
+        https://bugs.webkit.org/show_bug.cgi?id=26140
+
+        Test: fast/dom/Document/readystate.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::setReadyState): Fire readystatechangeevent.
+        (WebCore::Document::open): Clear event listeners.
+        * dom/Document.h: Add readystatechange event.
+        * dom/Document.idl: Ditto.
+
+2010-10-13  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: accessibilityIsIgnored not respected on ARIA tables
+        https://bugs.webkit.org/show_bug.cgi?id=47564
+
+        For platforms that ignore column headers and header container objects (everything
+        except Mac) on accessibility tables, that choice needs to be respected in 
+        ARIA tables as well.
+
+        GTK is the only open platform doing this, so I'll have to collect the result of this 
+        test. It was copied from table-hierarchy.html, but changed to use ARIA tables.
+
+        Test: platform/gtk/accessibility/aria-table-hierarchy.html
+
+        * accessibility/AccessibilityARIAGrid.cpp:
+        (WebCore::AccessibilityARIAGrid::addChildren):
+
+2010-10-13  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        No longer ASSERT for LayerRenderer in VideoLayerChromium destructor
+        https://bugs.webkit.org/show_bug.cgi?id=47432
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::cleanupResources):
+
+2010-10-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed. Build fix.
+
+        * CMakeLists.txt: Add ContextShadow.cpp.
+        * CMakeListsEfl.txt: Add ContextShadowCairo.cpp.
+
+2010-10-13  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] r69681 caused some tests to crash
+        https://bugs.webkit.org/show_bug.cgi?id=47622
+
+        Properly initialize m_layerContext on the ContextShadow so that in situations
+        where beginShadowLayer bails out early with a null return value, it is set
+        to null. This may happen when the first call to beginShadowLayer on a particular
+        ContextShadow uses a region which is entirely outside the clip region or which
+        is empty.
+
+        * platform/graphics/cairo/ContextShadow.cpp:
+        (WebCore::ContextShadow::ContextShadow): Properly initialize m_layerContext.
+
+2010-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Don't set the fill/stroke colorspace before filling/stroking
+        https://bugs.webkit.org/show_bug.cgi?id=47619
+
+        Setting the colorspace has the side-effect of setting the color to black, which is
+        not what we want. When fill/stroke is called, a fill/stroke color should already have been set.
+
+        Pixel tests show no regressions from this change.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::fillRect):
+        (WebCore::GraphicsContext::strokeRect):
+
+2010-10-13  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed WinCairo build fix.
+        New ContextShadow class not built for Windows builds.
+
+        * WebCore.vcproj/WebCore.vcproj: Add missing files for
+        building ContextShadow on WinCairo.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        Add missing include for ContextShadow definition.
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Chromium build fix pt1.
+
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::responseTextAccessorGetter):
+
+2010-10-13  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Send over find indicator information to the UI process
+        https://bugs.webkit.org/show_bug.cgi?id=47612
+
+        Export symbols needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::jsOwnedStringOrNull):
+        * bindings/js/JSDOMBinding.h:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::responseText):
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/js/ScriptCallFrame.h:
+        (WebCore::ScriptCallFrame::functionName):
+        * bindings/js/ScriptCallStack.h:
+        * bindings/js/ScriptFunctionCall.cpp:
+        * bindings/js/ScriptFunctionCall.h:
+        * bindings/js/ScriptString.h: Removed.
+        * dom/ScriptExecutionContext.h:
+        * fileapi/FileReader.cpp:
+        (WebCore::FileReader::FileReader):
+        (WebCore::FileReader::abort):
+        (WebCore::FileReader::didReceiveData):
+        (WebCore::FileReader::result):
+        (WebCore::FileReader::convertToText):
+        (WebCore::FileReader::convertToDataURL):
+        * fileapi/FileReader.h:
+        * fileapi/FileReaderSync.cpp:
+        (WebCore::FileReaderSyncLoader::FileReaderSyncLoader):
+        (WebCore::FileReaderSyncLoader::didReceiveData):
+        (WebCore::FileReaderSync::readAsBinaryString):
+        (WebCore::FileReaderSync::readAsText):
+        (WebCore::FileReaderSync::readAsDataURL):
+        (WebCore::FileReaderSync::read):
+        (WebCore::FileReaderSync::convertToText):
+        * fileapi/FileReaderSync.h:
+        (WebCore::FileReaderSync::readAsText):
+        (WebCore::FileReaderSync::FileReaderSync):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::resourceRetrievedByXMLHttpRequest):
+        (WebCore::InspectorController::scriptImported):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::setOverrideContent):
+        * inspector/InspectorResource.h:
+        * loader/FrameLoader.cpp:
+        * loader/FrameLoader.h:
+        * loader/FrameLoaderClient.h:
+        * loader/ResourceLoadNotifier.h:
+        * workers/WorkerScriptLoader.h:
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::XMLHttpRequest):
+        (WebCore::XMLHttpRequest::responseText):
+        (WebCore::XMLHttpRequest::responseXML):
+        (WebCore::XMLHttpRequest::abort):
+        (WebCore::XMLHttpRequest::clearResponse):
+        (WebCore::XMLHttpRequest::dropProtection):
+        (WebCore::XMLHttpRequest::didFinishLoading):
+        (WebCore::XMLHttpRequest::didReceiveData):
+        * xml/XMLHttpRequest.h:
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43987 - Downloading using XHR is much slower than before
+
+        * svg/SVGPathStringBuilder.cpp:
+        (WebCore::SVGPathStringBuilder::result):
+            StringBuilder::size() -> StringBuilder::length().
+
+2010-10-13  Yong Li  <yoli@rim.com>
+
+        Reviewed by Oliver Hunt.
+
+        Fix potential misaligned memory access in CloneDeserializer::readLittleEndian and readString
+        that can result crash on ARM (<v6).
+        https://bugs.webkit.org/show_bug.cgi?id=47594
+
+        No new test added, because the crash can be produced by existing tests like:
+        LayoutTests/fast/events/message-channel-gc-4.html
+
+        * bindings/js/SerializedScriptValue.cpp:
+        (WebCore::CloneDeserializer::readLittleEndian):
+        (WebCore::CloneDeserializer::readString):
+
+2010-10-06  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        [Cairo] Activate ContextShadow in all places where shadows are drawn
+        https://bugs.webkit.org/show_bug.cgi?id=46475
+
+        Turn on ContextShadow for the Cairo port and remove all old shadow code.
+        Shadow tiling optimizations will be added in a followup patch to ContextShadowCairo.
+
+        * platform/graphics/GraphicsContext.h: Add a ContextShadow forward declaration for Cairo.
+        * platform/graphics/cairo/FontCairo.cpp: Switch to using ContextShadow.
+        (WebCore::prepareContextForGlyphDrawing): Added this helper which sets up the translation
+        on the specified cairo_t to prepare for drawing glyphs.
+        (WebCore::drawGlyphsToContext): Added this helper which draws the glyphs to a cairo_t,
+        while properly handling glyphs with synthetic bold.
+        (WebCore::Font::drawGlyphs): Removed old shadow code and replaced it with ContextShadow usage.
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::drawPathShadow): Modified this to use ContextShadow and to take an enum
+        argument specifying whether to fill or stroke the solid figure for the shadow.
+        (WebCore::fillCurrentCairoPath): Updated drawPathShadow call.
+        (WebCore::strokeCurrentCairoPath): Ditto.
+        (WebCore::GraphicsContext::savePlatformState): Save the ContextShadow.
+        (WebCore::GraphicsContext::restorePlatformState): Restore the ContextShadow.
+        (WebCore::GraphicsContext::drawPath): Updated drawPathShadow call.
+        (WebCore::GraphicsContext::fillRect): Uses ContextShadow now.
+        (WebCore::GraphicsContext::setPlatformShadow): Uses ContextShadow now.
+        (WebCore::GraphicsContext::contextShadow): Added.
+        (WebCore::GraphicsContext::clearPlatformShadow): Clears the ContextShadow member.
+        (WebCore::GraphicsContext::fillRoundedRect): Updated drawPathShadow call.
+        * platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h:
+        (WebCore::GraphicsContextPlatformPrivate::hasShadow): Added.
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::BitmapImage::draw): Updated to use ContextShadow.
+
+2010-10-13  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        First step towards client-based Geolocation in Chromium. Build
+        fixes for CLIENT_BASED_GEOLOCATION preprocessor feature define.
+        https://bugs.webkit.org/show_bug.cgi?id=47586
+
+        * WebCore.gyp/WebCore.gyp:
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/GeolocationServiceChromium.cpp:
+
+2010-10-13  Steve Block  <steveblock@google.com>
+
+        Unreviewed fix
+
+        Need to check for the existence of DeviceOrientation and DeviceMotion controllers
+
+        These features can be disabled at run time, so an enable guard is not sufficient.
+        This bug was introduced in http://trac.webkit.org/changeset/69646
+
+        Tested with existing tests.
+
+        * history/PageCache.cpp:
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+
+2010-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: stack information is inconsistent between console.trace and runtime errors.
+        https://bugs.webkit.org/show_bug.cgi?id=47252
+
+        * console.trace() is now formatted the same way as other stack traces
+
+        * If there is //@ sourceURL=url line at the end of eval'ed script source
+        the url will be shown in the stack traces for script. That is why ScriptCallFrame::sourceURL
+        type has changed from KURL to String.
+
+        Tests: inspector/console-trace-in-eval.html
+               inspector/console-uncaught-exception-in-eval.html
+
+        * bindings/js/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/js/ScriptCallFrame.h:
+        (WebCore::ScriptCallFrame::sourceURL):
+        * bindings/v8/ScriptCallFrame.cpp:
+        (WebCore::ScriptCallFrame::ScriptCallFrame):
+        * bindings/v8/ScriptCallFrame.h:
+        (WebCore::ScriptCallFrame::sourceURL):
+        * bindings/v8/ScriptCallStack.cpp:
+        (WebCore::getFrameLocation):
+        (WebCore::ScriptCallStack::create):
+        * bindings/v8/ScriptCallStack.h:
+        * bindings/v8/ScriptController.cpp:
+        (WebCore::ScriptController::setCaptureCallStackForUncaughtExceptions):
+        * bindings/v8/custom/V8ConsoleCustom.cpp:
+        (WebCore::V8Console::traceCallback):
+        * inspector/ConsoleMessage.cpp:
+        (WebCore::ConsoleMessage::CallFrame::buildInspectorObject):
+        (WebCore::ConsoleMessage::ConsoleMessage):
+        * inspector/ConsoleMessage.h:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleMessage.prototype._formatMessage):
+        * page/Console.cpp:
+        (WebCore::Console::addMessage):
+        (WebCore::Console::count):
+        (WebCore::Console::timeEnd):
+
+2010-10-13  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, a trivial change.
+
+        Run sort-Xcode-project-file.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-10-13  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Wrong ASSERT when select element has size 0
+        https://bugs.webkit.org/show_bug.cgi?id=47567
+
+        Keep the ASSERT only if the size of the element list is more than 0
+        Test: fast/dom/HTMLSelectElement/click-size-zero-no-crash.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::updateListBoxSelection):
+        (WebCore::SelectElement::listBoxDefaultEventHandler):
+
+2010-10-13  Steve Block  <steveblock@google.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Pages using DeviceOrientation and DeviceMotion should not go into the page cache
+        https://bugs.webkit.org/show_bug.cgi?id=47408
+
+        Tests: fast/dom/DeviceMotion/no-page-cache.html
+               fast/dom/DeviceOrientation/no-page-cache.html
+
+        * dom/DeviceMotionController.h:
+        (WebCore::DeviceMotionController::isActive):
+        * dom/DeviceOrientationController.h:
+        (WebCore::DeviceOrientationController::isActive):
+        * history/PageCache.cpp:
+        (WebCore::logCanCachePageDecision):
+        (WebCore::PageCache::canCache):
+        * page/Page.cpp:
+
+2010-10-13  Jenn Braithwaite  <jennb@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Make resource identifiers unique across pages
+        https://bugs.webkit.org/show_bug.cgi?id=47002
+
+        Test: http/tests/misc/iframe-reparenting-id-collision.html
+
+        * loader/ProgressTracker.cpp:
+        (WebCore::ProgressTracker::ProgressTracker):
+        (WebCore::ProgressTracker::createUniqueIdentifier):
+        * loader/ProgressTracker.h:
+
+2010-10-12  Roland Steiner  <rolandsteiner@chromium.org>
+
+        Reviewed by David Hyatt.
+
+        Bug 41040 - :before/:after content should not become part of a ruby base
+        https://bugs.webkit.org/show_bug.cgi?id=41040
+
+        Also related to:
+        https://bugs.webkit.org/show_bug.cgi?id=40895.
+        https://bugs.webkit.org/show_bug.cgi?id=43722.
+
+        Explicitly handle :before and :after content in the default way.
+
+        Test: fast/ruby/ruby-beforeafter.html
+              fast/ruby/after-doesnt-crash.html
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isBeforeContent):
+        * rendering/RenderRuby.cpp:
+        (WebCore::lastRubyRun):
+        (WebCore::RenderRubyAsInline::addChild):
+        (WebCore::RenderRubyAsInline::removeChild):
+        (WebCore::RenderRubyAsBlock::addChild):
+        (WebCore::RenderRubyAsBlock::removeChild):
+
+2010-10-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69639.
+        http://trac.webkit.org/changeset/69639
+        https://bugs.webkit.org/show_bug.cgi?id=47575
+
+        "regressed nav-element.html" (Requested by rniwa on #webkit).
+
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::formatSelection):
+        * editing/EditorCommand.cpp:
+        (WebCore::executeFormatBlock):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::formatRange):
+        * editing/FormatBlockCommand.h:
+        (WebCore::FormatBlockCommand::editingAction):
+        * editing/VisiblePosition.cpp:
+        (WebCore::enclosingBlockFlowElement):
+        * editing/VisiblePosition.h:
+        * editing/htmlediting.cpp:
+        (WebCore::validBlockTag):
+        * editing/htmlediting.h:
+
+2010-10-12  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        execCommand FormatBlock creates lots of blockquotes
+        https://bugs.webkit.org/show_bug.cgi?id=19795
+
+        The bug was caused by WebKit's not reusing the block node added by previous iteration
+        and its inserting block node at wrong places.
+
+        Fixed the bug by rewriting FormatBlockCommand::formatRange.  New code resembles that of
+        IndentOutdentCommand::indentIntoBlockquote.  The difference between two is that formatRange
+        avoids the existing block elements when replacing blocks and it also adds a placeholder
+        when removing the existing block caused paragraphs to collapse.
+
+        Tests: editing/execCommand/format-block-multiple-paragraphs.html
+               editing/execCommand/format-block-table.html
+
+        * editing/EditorCommand.cpp:
+        (WebCore::executeFormatBlock):
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::formatRange): Rewritten; see above.
+        (WebCore::FormatBlockCommand::isElementToApplyInFormatBlockCommand): Renamed from validBlockElement
+        and moved from htmlediting.cpp.
+        (WebCore::FormatBlockCommand::enclosingBlockToSplitTreeTo): Added.
+        * editing/FormatBlockCommand.h:
+        * editing/VisiblePosition.cpp:
+        (WebCore::enclosingBlockFlowElement): Changed the return type to Element*
+        * editing/VisiblePosition.h:
+
+2010-10-11  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Anders Carlsson.
+
+        Make PluginView inherit from PluginViewBase.
+
+        This change is a precursor to adding accelerated compositing support
+        for NPAPI plugins.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47418
+
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged):
+        * plugins/PluginView.h:
+        * plugins/PluginViewBase.h:
+        (WebCore::PluginViewBase::PluginViewBase):
+
+2010-10-12  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Jian Li.
+
+        Pass platform path (rather than virtual path) when creating File from FileEntry
+        https://bugs.webkit.org/show_bug.cgi?id=47563
+
+        No new tests, the new test for FileWriter will be verifying this.
+
+        * fileapi/FileEntry.cpp:
+        (WebCore::FileEntry::file):
+
+2010-10-12 David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein
+
+        <rdar://problem/8488444> REGRESSION (r67771)
+        https://bugs.webkit.org/show_bug.cgi?id=47434
+        Crash when printing in RenderBlock::markDescendantBlocksAndLinesForLayout
+        
+        Added printing/simultaneous-position-float-change.html
+
+        Remove the markDescendantBlocksAndLinesForLayout method since it can walk m_floatingObjects lists with deleted
+        objects in them.  Make the mechanism for relayout when the page height changes the same as the one when pageY
+        changes and just tie a concept of pageHeightChanged to the layout state.  If that is set, blocks will just
+        automatically mark themselves as needing layout.
+
+        * rendering/LayoutState.cpp:
+        (WebCore::LayoutState::LayoutState):
+        * rendering/LayoutState.h:
+        (WebCore::LayoutState::LayoutState):
+        (WebCore::LayoutState::pageHeight):
+        (WebCore::LayoutState::pageHeightChanged):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::layoutPositionedObjects):
+        (WebCore::RenderBlock::markForPaginationRelayoutIfNeeded):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::positionNewFloats):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.cpp:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::markForPaginationRelayoutIfNeeded):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderView.cpp:
+        (WebCore::RenderView::RenderView):
+        (WebCore::RenderView::layout):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::setPageHeight):
+        (WebCore::RenderView::pushLayoutState):
+        (WebCore::LayoutStateMaintainer::LayoutStateMaintainer):
+        (WebCore::LayoutStateMaintainer::push):
+
+2010-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Paint the find overlay background
+        https://bugs.webkit.org/show_bug.cgi?id=47565
+
+        Export symbols required by WebKit2.
+
+        * WebCore.exp.in:
+
+2010-10-12  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed chromium compile fixes for http://trac.webkit.org/changeset/69619
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::create):
+        (WebCore::LayerRendererChromium::LayerRendererChromium):
+        * platform/graphics/chromium/LayerRendererChromium.h:
+
+2010-10-12  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Manage DrawingBuffer lifetime in GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=47501
+
+        GraphicsContext3D and DrawingBuffer are now Refcounted. DrawingBuffer
+        has a RefPtr to GraphicsContext3D to ensure the proper lifetime. 
+        DrawingBuffer is now created by GraphicsContext3D. Also DrawingBuffer
+        refers to GraphicsContext3D rather than SharedGraphicsContext3D.
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        * html/canvas/CanvasRenderingContext2D.h:
+        * html/canvas/WebGLRenderingContext.cpp:
+        (WebCore::WebGLRenderingContext::create):
+        (WebCore::WebGLRenderingContext::WebGLRenderingContext):
+        * html/canvas/WebGLRenderingContext.h:
+        * platform/graphics/GraphicsContext3D.cpp:
+        (WebCore::GraphicsContext3D::createDrawingBuffer):
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/chromium/DrawingBufferChromium.cpp:
+        (WebCore::generateColorTexture):
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::publishToPlatformLayer):
+        (WebCore::DrawingBuffer::reset):
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        (WebCore::DrawingBuffer::create):
+        (WebCore::DrawingBuffer::clear):
+        (WebCore::DrawingBuffer::bind):
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::graphicsContext3D):
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+        (WebCore::SharedGraphicsContext3D::graphicsContext3D):
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm:
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::reset):
+        * platform/graphics/mac/GraphicsContext3DMac.mm:
+        (WebCore::GraphicsContext3D::create):
+
+2010-10-12  Jian Li  <jianli@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix passing blob data with string data item between threads.
+        https://bugs.webkit.org/show_bug.cgi?id=46543
+
+        The fix is to use a thread-safe ref-counted Vector<char> to store the
+        string data. This also makes us be able to store any binary data in it.
+
+        I've also fix BlobBuilder and BlobRegistryImpl to avoid some additional
+        copies to make blob handling faster.
+
+        * fileapi/BlobBuilder.cpp:
+        (WebCore::BlobBuilder::append):
+        * fileapi/ThreadableBlobRegistry.cpp:
+        (WebCore::BlobRegistryContext::BlobRegistryContext):
+        * platform/network/BlobData.cpp:
+        (WebCore::BlobDataItem::RawData::RawData):
+        (WebCore::BlobDataItem::RawData::detachFromCurrentThread):
+        (WebCore::BlobDataItem::detachFromCurrentThread):
+        (WebCore::BlobData::create):
+        (WebCore::BlobData::detachFromCurrentThread):
+        (WebCore::BlobData::appendData):
+        * platform/network/BlobData.h:
+        (WebCore::BlobDataItem::RawData::create):
+        (WebCore::BlobDataItem::RawData::data):
+        (WebCore::BlobDataItem::RawData::length):
+        (WebCore::BlobDataItem::RawData::mutableData):
+        (WebCore::BlobDataItem::BlobDataItem):
+        * platform/network/BlobRegistryImpl.cpp:
+        (WebCore::BlobRegistryImpl::registerBlobURL):
+        * platform/network/BlobResourceHandle.cpp:
+        (WebCore::BlobResourceHandle::readDataSync):
+        (WebCore::BlobResourceHandle::readDataAsync):
+        * platform/network/mac/FormDataStreamMac.mm:
+        (WebCore::setHTTPBody):
+        * platform/text/LineEnding.cpp:
+        (OutputBuffer::CStringBuffer::CStringBuffer):
+        (OutputBuffer::CStringBuffer::~CStringBuffer):
+        (OutputBuffer::CStringBuffer::allocate):
+        (OutputBuffer::CStringBuffer::copy):
+        (OutputBuffer::CStringBuffer::buffer):
+        (OutputBuffer::VectorCharAppendBuffer::VectorCharAppendBuffer):
+        (OutputBuffer::VectorCharAppendBuffer::~VectorCharAppendBuffer):
+        (OutputBuffer::VectorCharAppendBuffer::allocate):
+        (OutputBuffer::VectorCharAppendBuffer::copy):
+        (OutputBuffer::internalNormalizeLineEndingsToCRLF):
+        (WebCore::normalizeToCROrLF):
+        (WebCore::normalizeLineEndingsToCRLF):
+        (WebCore::normalizeLineEndingsToCR):
+        (WebCore::normalizeLineEndingsToLF):
+        (WebCore::normalizeLineEndingsToNative):
+        * platform/text/LineEnding.h:
+
+2010-10-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69589.
+        http://trac.webkit.org/changeset/69589
+        https://bugs.webkit.org/show_bug.cgi?id=47547
+
+        Wrong patch landed from a bug with two patches (Requested by
+        mrobinson on #webkit).
+
+        * platform/network/ResourceHandleInternal.h:
+        (WebCore::ResourceHandleInternal::ResourceHandleInternal):
+        * platform/network/soup/ResourceHandleSoup.cpp:
+        (WebCore::ResourceHandleInternal::~ResourceHandleInternal):
+        (WebCore::ResourceHandle::~ResourceHandle):
+        (WebCore::restartedCallback):
+        (WebCore::gotChunkCallback):
+        (WebCore::finishedCallback):
+        (WebCore::parseDataUrl):
+        (WebCore::startHttp):
+        * platform/network/soup/ResourceRequest.h:
+        * platform/network/soup/ResourceRequestSoup.cpp:
+
+2010-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Screen.availLeft should be signed
+        https://bugs.webkit.org/show_bug.cgi?id=34397
+        
+        Add the manual test missed in r69599.
+
+        * manual-tests/screen-availLeft.html: Added.
+
+2010-10-12  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Windowless mode 64-bit Flash/X11 freezes when right-click is sent.
+
+        Adds a new quirk PluginQuirkIgnoreRightClickInWindowlessMode. This
+        quirk is enabled only for 64-bit Flash/X11 and should not affect other
+        plugins. The freeze itself is in Flash code and the backtrace is not
+        useful.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47545
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+        * plugins/PluginQuirkSet.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::handleMouseEvent):
+
+2010-10-08  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Screen.availLeft should be signed
+        https://bugs.webkit.org/show_bug.cgi?id=34397
+
+        For the screen to the left of the main screen, screen.availLeft
+        can be negative, so the Screen API needs to use signed numbers
+        for availLeft and availTop.
+
+        * manual-tests/screen-availLeft.html: Added.
+        * page/Screen.cpp:
+        (WebCore::Screen::availLeft):
+        (WebCore::Screen::availTop):
+        * page/Screen.h:
+        * page/Screen.idl:
+
+2010-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add FindController class
+        https://bugs.webkit.org/show_bug.cgi?id=47555
+
+        Export Page::findString.
+
+        * WebCore.exp.in:
+
+2010-10-12  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47550
+        <rdar://problem/8353386> For WebKit plug-ins, beforeload can be called recursively
+        (esp. with AdBlock style extensions)
+
+        No test - we don't have a WebKit-style plugin in DRT, and don't care enough to add one.
+
+        The fix is to block plug-in scripting while in beforeload event - the plug-in is obviously
+        not available yet, so scripting could only attempt to load it recursively.
+
+        This didn't affect NPAPI plug-ins, because of a completely different code path taken in
+        updateWidget(), see <https://bugs.webkit.org/show_bug.cgi?id=44575#c8>.
+
+        * html/HTMLEmbedElement.cpp: (WebCore::HTMLEmbedElement::updateWidget):
+        * html/HTMLObjectElement.cpp: (WebCore::HTMLObjectElement::updateWidget):
+        * html/HTMLPlugInElement.cpp:
+        (WebCore::HTMLPlugInElement::HTMLPlugInElement):
+        (WebCore::HTMLPlugInElement::pluginWidget):
+        * html/HTMLPlugInElement.h:
+
+2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Unify JSC::StringBuilder & WebCore::StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=47538
+
+        JSC::StringBuilder operates on a Vector<UChar, 64> and allows to build a string based on a stream of characters in an efficient manner.
+        WebCore::StringBuilder operates on a Vector<String, 16> and allows to concat an arbitary number of Strings. It's not efficient in handling single
+        characters, as a String with length=1 has to be constructed for those. An analysis of the callers of WebCore::StringBuilder shows that
+        most callsites actually combine Strings and single characters, so using a Vector<UChar> would be more efficient. Those who only combine large
+        strings are only used for debugging purposes, so it's fine to switch them to a Vector<UChar> approach as well.
+
+        Replace WebCore::StringBuilder with JSC::StringBuilder, and move it to wtf/text/StringBuilder.h into the WTF namespace.
+        While I was at it remove platform/text/StringBuffer.h, as it was only including wtf/text/StringBuffer.h.
+
+        No change in functionality, thus no new tests.
+
+        * Android.mk: Remove platform/text/StringBuilder.* and platform/text/StringBuffer.h.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto. 
+        * WebCore.gypi: Ditto.
+        * WebCore.order: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * ForwardingHeaders/runtime/StringBuilder.h: Removed.
+        * ForwardingHeaders/runtime/UStringBuilder.h: Added.
+        * ForwardingHeaders/wtf/text/StringBuilder.h: Added.
+        * bindings/js/ScriptString.h: Don't include PlatformString.h but wtf/text/WTFString.h.
+        (WebCore::ScriptString::operator+=): Use JSC::UStringBuilder instead of JSC::StringBuilder.
+        * bridge/jni/JNIBridge.cpp: Use WTF::StringBuilder (+ use append(const UChar) for single characters).
+        * css/MediaQuery.cpp: Ditto.
+        * css/MediaQueryExp.cpp: Ditto.
+        * dom/Node.cpp: Ditto.
+        (WebCore::Node::appendTextContent): Manually track wheter the StringBuilder content is empty or null, the new StringBuilder doesn't differentiate between null & empty strings.
+        * dom/Node.h: Remove appendTextContent definition, it's not needed to be exported, removes the need for a StringBuilder.h include or forward declaration.
+        * html/DOMTokenList.cpp: Use WTF::StringBuilder.
+        * inspector/InspectorResource.cpp: Remove useless StringBuffer.h include.
+        * platform/android/FileSystemAndroid.cpp: Use WTF::StringBuilder.
+        * platform/brew/FileSystemBrew.cpp: Ditto.
+        * platform/chromium/ClipboardChromium.cpp: Ditto (+ use append(const UChar) for single characters).
+        * platform/graphics/gpu/PODInterval.h: Ditto (Only used as debugging helper here, in debug builds).
+        * platform/graphics/gpu/PODRedBlackTree.h: Ditto (Only used as debugging helper here, in debug builds).
+        * platform/graphics/mac/GraphicsLayerCA.mm: Remove useless StringBuilder.h include.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp: Use WTF::StringBuilder, and use append(const UChar) for single characters.
+        * platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp: Ditto.
+        * platform/network/ProxyServer.cpp:
+        (WebCore::appendProxyServerString): Use WTF::StringBuilder.
+        * platform/text/StringBuffer.h: Removed.
+        * platform/text/StringBuilder.cpp: Removed.
+        * platform/text/StringBuilder.h: Removed.
+        * plugins/DOMMimeType.cpp: Use WTF::StringBuilder.
+        * svg/SVGPathParserFactory.cpp: Ditto.
+        * svg/SVGPathStringBuilder.cpp: SVGPathStringBuilder used stringBuilder.toString(ConcatAddingSpacesBetweenIndividualStrings), adapt to the change, that this mode is gone now.
+        (WebCore::SVGPathStringBuilder::result): Just use toString(), append a space to the end of each command, when building the string. Remove the last trailing space before building the result.
+        (WebCore::SVGPathStringBuilder::moveTo):
+        (WebCore::SVGPathStringBuilder::lineTo):
+        (WebCore::SVGPathStringBuilder::lineToHorizontal):
+        (WebCore::SVGPathStringBuilder::lineToVertical):
+        (WebCore::SVGPathStringBuilder::curveToCubic):
+        (WebCore::SVGPathStringBuilder::curveToCubicSmooth):
+        (WebCore::SVGPathStringBuilder::curveToQuadratic):
+        (WebCore::SVGPathStringBuilder::curveToQuadraticSmooth):
+        (WebCore::SVGPathStringBuilder::arcTo):
+        (WebCore::SVGPathStringBuilder::closePath):
+        * svg/SVGPathStringBuilder.h:
+        (WebCore::SVGPathStringBuilder::cleanup): StringBuilder::clear() is gone, just cleanup by assigning StringBuilder().
+        * websockets/WebSocket.cpp: Use WTF::StringBuilder.
+        * websockets/WebSocketHandshake.cpp: Ditto (+ use append(const UChar) for single characters).
+
+2010-10-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Add a missing file in CMakeListEfl.txt
+        https://bugs.webkit.org/show_bug.cgi?id=47480
+
+        IntRectEfl.cpp was missing in CMakeListEfl.txt. So, IntRectEfl.cpp is added.
+
+        * CMakeListsEfl.txt:
+
+2010-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Need WebKit2 API to get the cell above a table cell
+        <rdar://problem/8537111>
+        https://bugs.webkit.org/show_bug.cgi?id=47532
+
+        Re-factor functionality to get the cell above a table cell
+        into a function on HTMLTableCellElement and export it for use
+        as SPI.
+
+        * WebCore.exp.in:
+        * WebCore.xcodeproj/project.pbxproj:
+        * html/HTMLTableCellElement.cpp:
+        (WebCore::HTMLTableCellElement::cellAbove): Move implementation here...
+        * html/HTMLTableCellElement.h:
+        * page/Frame.cpp:
+        (WebCore::Frame::searchForLabelsAboveCell): ...from here.
+
+2010-10-12  Dave Moore  <davemoore@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Use new WebThemeEngine api on chromium / linux to draw scrollbars.
+        https://bugs.webkit.org/show_bug.cgi?id=47473
+
+        * platform/chromium/ChromiumBridge.h:
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+
+2010-10-12  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Clipping problem viewing SVG with WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=29596
+
+        SVG path clipping (via GraphicsContext::clipPath()) was done using the
+        Qt::ReplaceClip mode (default) instead of Qt::IntersectClip. This led
+        to misrenderings when nesting multiple clip paths.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::clipPath):
+
+2010-10-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: refactoring of native breakpoints.
+        https://bugs.webkit.org/show_bug.cgi?id=47360
+
+        Make DOM, EventListener and XHR breakpoints subclasses of NativeBreakpoint class.
+        Move stuff that depends on breakpoint type to corresponding subclass.
+
+        * inspector/Inspector.idl:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::setNativeBreakpoint):
+        (WebCore::InspectorController::removeNativeBreakpoint):
+        (WebCore::InspectorController::findEventListenerBreakpoint):
+        (WebCore::InspectorController::findXHRBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::setDOMBreakpoint):
+        (WebCore::InspectorDOMAgent::removeDOMBreakpoint):
+        (WebCore::InspectorDOMAgent::descriptionForDOMEvent):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::removeBreakpointsForNode):
+        (WebCore::InspectorDOMAgent::createBreakpointId):
+        * inspector/InspectorDOMAgent.h:
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::willInsertDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willRemoveDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::willSendXMLHttpRequestImpl):
+        (WebCore::InspectorInstrumentation::willDispatchEventImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager):
+        (WebInspector.BreakpointManager.prototype.reset):
+        (WebInspector.BreakpointManager.prototype.createDOMBreakpoint):
+        (WebInspector.BreakpointManager.prototype.createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype._removeNativeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setNativeBreakpointOnBackend.didSetNativeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setNativeBreakpointOnBackend):
+        (WebInspector.BreakpointManager.prototype.debuggerPaused):
+        (WebInspector.BreakpointManager.prototype.debuggerResumed):
+        (WebInspector.BreakpointManager.prototype.restoreDOMBreakpoints.restoreBreakpointsForNode):
+        (WebInspector.BreakpointManager.prototype.restoreDOMBreakpoints):
+        (WebInspector.NativeBreakpoint):
+        (WebInspector.NativeBreakpoint.prototype.remove):
+        (WebInspector.NativeBreakpoint.prototype.get _frontendId):
+        (WebInspector.NativeBreakpoint.prototype.get _type):
+        (WebInspector.NativeBreakpoint.prototype._compare):
+        (WebInspector.NativeBreakpoint.prototype._onRemove):
+        (WebInspector.DOMBreakpoint):
+        (WebInspector.DOMBreakpoint.prototype.click):
+        (WebInspector.DOMBreakpoint.prototype.compareTo):
+        (WebInspector.DOMBreakpoint.prototype.populateLabelElement):
+        (WebInspector.DOMBreakpoint.prototype.populateStatusMessageElement.formatters.s):
+        (WebInspector.DOMBreakpoint.prototype.populateStatusMessageElement.append):
+        (WebInspector.DOMBreakpoint.prototype.populateStatusMessageElement):
+        (WebInspector.DOMBreakpoint.prototype._condition):
+        (WebInspector.DOMBreakpoint.prototype._onRemove):
+        (WebInspector.EventListenerBreakpoint):
+        (WebInspector.EventListenerBreakpoint.prototype.compareTo):
+        (WebInspector.EventListenerBreakpoint.prototype.label):
+        (WebInspector.EventListenerBreakpoint.prototype.populateStatusMessageElement):
+        (WebInspector.EventListenerBreakpoint.prototype._condition):
+        (WebInspector.XHRBreakpoint):
+        (WebInspector.XHRBreakpoint.prototype.compareTo):
+        (WebInspector.XHRBreakpoint.prototype.populateLabelElement):
+        (WebInspector.XHRBreakpoint.prototype.populateStatusMessageElement):
+        (WebInspector.XHRBreakpoint.prototype._condition):
+        (WebInspector.domBreakpointTypeLabel):
+        (WebInspector.domBreakpointTypeContextMenuLabel):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointItem):
+        (WebInspector.BreakpointItem.prototype._breakpointClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._populate):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane):
+        (WebInspector.CallStackSidebarPane.prototype.registerShortcuts):
+        (WebInspector.CallStackSidebarPane.prototype._breakpointHit):
+        * inspector/front-end/DOMAgent.js:
+        (WebInspector.DOMNode):
+        (WebInspector.DOMAgent.prototype._setDocument):
+        (WebInspector.DOMAgent.prototype._removeBreakpoints):
+        (WebInspector.childNodeRemoved):
+        * inspector/front-end/ElementsTreeOutline.js:
+        (WebInspector.ElementsTreeElement.prototype._populateTagContextMenu):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel.prototype.debuggerPaused):
+        * inspector/front-end/inspector.js:
+        (WebInspector.createDOMBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createDOMBreakpointsSidebarPane):
+        (WebInspector.reset):
+
+2010-10-11  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        FileWriter should hold a reference to a Blob during write
+        https://bugs.webkit.org/show_bug.cgi?id=47318
+
+        Without this reference, the Blob might get garbage-collected from JS
+        before the write has completed, which would be quite unintuitive to the
+        user.  I just grab a RefPtr to the Blob at write(), then clear it when
+        we're done.
+
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::stop):
+        (WebCore::FileWriter::write):
+        (WebCore::FileWriter::didWrite):
+        (WebCore::FileWriter::didFail):
+        * fileapi/FileWriter.h:
+
+2010-10-11  Michael Saboff  <msaboff@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Changed DOMWindow to have a constructor.  Updated the code generator
+        to add security checks to the constructors if CheckDomainSecurity is 
+        set.  Also changed the constructor generation code to use 
+        globalObject->prototype() for DOMWindow object prototypes instead
+        of "self".
+        https://bugs.webkit.org/show_bug.cgi?id=47422
+
+        Test: fast/dom/Window/window-constructor.html
+
+        * bindings/scripts/CodeGeneratorJS.pm:
+        * page/DOMWindow.idl:
+
+2010-10-11  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Prepare Clipboard/DragData for transition to new drag-and-drop interface.
+        https://bugs.webkit.org/show_bug.cgi?id=44992
+
+        In order to allow a graceful transition, ChromiumDataObject has been
+        reimplemented as a wrapper around the three different types of data
+        objects that the Chrome port uses:
+        1. ChromiumDataObjectLegacy -- this is the original ChromiumDataObject.
+           All the data that ClipboardChromium/DragDataChromium can potentially
+           use is copied over, regardless of whether or not it is needed.
+        2. ReadableDataObject -- used for dragging in and pasting into WebKit.
+           For efficiency, it caches an optimistic list of types it believes it
+           can handle. When getData() is called, a browser IPC is called to
+           retrieve the appropriate data.
+        3. WritableDataObject -- similar to ChromiumDataObjectLegacy in that it
+           buffers all data when dragging out of WebKit or copying/cutting.
+           Unfortunately, there is a difference between dragging out and
+           copying/cutting--on drag outs, the data is buffered and flushed out
+           when startDrag() is called. For copy/cut, any calls to setData()
+           result in a browser IPC right away, so calls to setData() in one
+           copy/cut event are not atomic.
+
+        Copy and paste has been changed to use the new data objects. Dragging
+        out uses the legacy data object, and dragging in now has two potential
+        entry points--one using the legacy data object, and one using
+        ReadableDataObject. Once Chromium transitions to using the new drag-in
+        interface, the old interface will be removed.
+
+        This change is covered by existing tests.
+
+        * WebCore.gypi:
+        * editing/chromium/EditorChromium.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        (WebCore::ChromiumDataObject::create):
+        (WebCore::ChromiumDataObject::createReadable):
+        (WebCore::ChromiumDataObject::createWritable):
+        (WebCore::ChromiumDataObject::clearData):
+        (WebCore::ChromiumDataObject::clearAll):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::types):
+        (WebCore::ChromiumDataObject::getData):
+        (WebCore::ChromiumDataObject::setData):
+        (WebCore::ChromiumDataObject::urlTitle):
+        (WebCore::ChromiumDataObject::setUrlTitle):
+        (WebCore::ChromiumDataObject::htmlBaseUrl):
+        (WebCore::ChromiumDataObject::setHtmlBaseUrl):
+        (WebCore::ChromiumDataObject::containsFilenames):
+        (WebCore::ChromiumDataObject::filenames):
+        (WebCore::ChromiumDataObject::setFilenames):
+        (WebCore::ChromiumDataObject::fileExtension):
+        (WebCore::ChromiumDataObject::setFileExtension):
+        (WebCore::ChromiumDataObject::fileContentFilename):
+        (WebCore::ChromiumDataObject::setFileContentFilename):
+        (WebCore::ChromiumDataObject::fileContent):
+        (WebCore::ChromiumDataObject::setFileContent):
+        * platform/chromium/ChromiumDataObject.h:
+        * platform/chromium/ChromiumDataObjectLegacy.cpp: Copied from ChromiumDataObject.cpp
+        (WebCore::ChromiumDataObjectLegacy::clearData):
+        (WebCore::ChromiumDataObjectLegacy::clearAll):
+        (WebCore::ChromiumDataObjectLegacy::clearAllExceptFiles):
+        (WebCore::ChromiumDataObjectLegacy::hasData):
+        (WebCore::ChromiumDataObjectLegacy::types):
+        (WebCore::ChromiumDataObjectLegacy::getData):
+        (WebCore::ChromiumDataObjectLegacy::setData):
+        (WebCore::ChromiumDataObjectLegacy::ChromiumDataObjectLegacy):
+        * platform/chromium/ChromiumDataObjectLegacy.h: Copied from ChromiumDataObject.h
+        (WebCore::ChromiumDataObjectLegacy::create):
+        (WebCore::ChromiumDataObjectLegacy::copy):
+        (WebCore::ChromiumDataObjectLegacy::urlTitle):
+        (WebCore::ChromiumDataObjectLegacy::setUrlTitle):
+        (WebCore::ChromiumDataObjectLegacy::htmlBaseUrl):
+        (WebCore::ChromiumDataObjectLegacy::setHtmlBaseUrl):
+        (WebCore::ChromiumDataObjectLegacy::containsFilenames):
+        (WebCore::ChromiumDataObjectLegacy::filenames):
+        (WebCore::ChromiumDataObjectLegacy::setFilenames):
+        (WebCore::ChromiumDataObjectLegacy::fileExtension):
+        (WebCore::ChromiumDataObjectLegacy::setFileExtension):
+        (WebCore::ChromiumDataObjectLegacy::fileContentFilename):
+        (WebCore::ChromiumDataObjectLegacy::setFileContentFilename):
+        (WebCore::ChromiumDataObjectLegacy::fileContent):
+        (WebCore::ChromiumDataObjectLegacy::setFileContent):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::create):
+        * platform/chromium/ClipboardChromium.h:
+        * platform/chromium/ReadableDataObject.cpp:
+        (WebCore::ReadableDataObject::getData):
+        * platform/chromium/WritableDataObject.cpp:
+        (WebCore::WritableDataObject::setData):
+
+2010-10-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WebIconFetcher from WebKit and IconFetcher from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=47523
+
+        Remove all traces of the WebCore IconFetcher class. It's SPI that nobody uses.
+
+        * GNUmakefile.am:
+        * WebCore.exp.in:
+        * WebCore.gyp/WebCore.gyp:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * loader/icon/IconFetcher.cpp: Removed.
+        * loader/icon/IconFetcher.h: Removed.
+
+2010-10-11  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        Should commit pending autocorrection before next round of text checking.
+        https://bugs.webkit.org/show_bug.cgi?id=46986
+        <rdar://problem/8424535>
+
+        1. Apply pending autocorrection before calling markAllMisspellingsAndBadGrammarInRanges().
+        2. Remove unneccessary calls to dismissCorrectionPanel(), since the panel is dismissed when
+           selection changes, which occurs after every typing command.
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::markMisspellingsAfterTypingToPosition): Apply pending autocorrection.
+        (WebCore::Editor::markAllMisspellingsAndBadGrammarInRanges): Store current correction replacement
+          in m_correctionReplacementString.
+        (WebCore::Editor::startCorrectionPanelTimer): Remove call to dismissCorrectionPanel().
+        * editing/Editor.h: Add m_correctionReplacementString to store proposed autocorrection string.
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Adam Barth.
+
+        Make fast/canvas/webgl/glsl-conformance pass again
+        https://bugs.webkit.org/show_bug.cgi?id=47525
+
+        Remove incorrect call to glGetShaderiv, so it is only
+        called in the case where we don't have our own simulated
+        log.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+
+2010-10-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add WebKit2 equivalents for setValueForUser and setAutoFilled
+        <rdar://problem/8475934>
+        https://bugs.webkit.org/show_bug.cgi?id=47524
+
+        * WebCore.exp.in: Add needed export.
+
+2010-10-11  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        The names of IndexedDB-specific attributes of DOMWindow should be prefixed with 'webkit'.
+        https://bugs.webkit.org/show_bug.cgi?id=47508
+
+        * bindings/generic/RuntimeEnabledFeatures.h:
+        (WebCore::RuntimeEnabledFeatures::setWebkitIndexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIndexedDBEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBCursorEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBDatabaseEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBDatabaseErrorEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBDatabaseExceptionEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBErrorEventEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBEventEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBFactoryEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBIndexEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBKeyRangeEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBObjectStoreEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBRequestEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBSuccessEventEnabled):
+        (WebCore::RuntimeEnabledFeatures::webkitIDBTransactionEnabled):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::webkitIndexedDB):
+        * page/DOMWindow.h:
+        * page/DOMWindow.idl:
+
+2010-10-11  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ability to convert from a JSObjectRef back to a WKBundleNodeHandleRef
+        https://bugs.webkit.org/show_bug.cgi?id=47509
+
+        * WebCore.exp.in: Export toNode.
+
+2010-10-11  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Tony Chang.
+
+        [GTK] editing/pasteboard/dataTransfer-setData-getData.html fails on GTK+
+        https://bugs.webkit.org/show_bug.cgi?id=47244
+
+        Store the URI list as a String in DataObjectGtk, so that non-URI elements
+        are preserved when getData(...) is called. This necessitates some other
+        changes, including adding a m_filenames member to DataObjectGtk to store
+        filenames extracted during setURIList(...). The logic in getData(...) has
+        also changed to set success = true no matter what to match the spec. A
+        followup patch will remove this parameter completely for all platforms.
+
+        * platform/gtk/ClipboardGtk.cpp:
+        (WebCore::ClipboardGtk::getData): Always succeed to match the HTML5
+        spec and Firefox. Simply return the uriList string from the DataObject
+        instead of reconstructing it from a vector of KURLs.
+        (WebCore::ClipboardGtk::setData): The DataObject now accepts a string
+        for the uriList parameter.
+        (WebCore::ClipboardGtk::types): Predicate the "Files" member on 
+        DataObjectGtk::hasFilenames().
+        (WebCore::ClipboardGtk::files): Update to reflect the change from
+        DataObjectGtk::files() to DataObjectGtk::filenames().
+        * platform/gtk/DataObjectGtk.cpp:
+        (WebCore::DataObjectGtk::setURIList): Expanded this setter to find the
+        first valid URL to use as the m_url member and also extract a list of filenames
+        from the URI list.
+        (WebCore::DataObjectGtk::setURL): Updated to reflect changes to m_uriList.
+        (WebCore::DataObjectGtk::clear): Updated to reflect changes to m_uriList and
+        also leave a comment explaining why we do not clear filenames here.
+        * platform/gtk/DataObjectGtk.h:
+        (WebCore::DataObjectGtk::url): This implementation is now a simple getter.
+        (WebCore::DataObjectGtk::uriList): Ditto.
+        (WebCore::DataObjectGtk::filenames): Added.
+        (WebCore::DataObjectGtk::hasURL): Now a simple check.
+        (WebCore::DataObjectGtk::hasFilenames): Added.
+        (WebCore::DataObjectGtk::clearURIList): Simple setter.
+        (WebCore::DataObjectGtk::clearURL): Ditto.
+        * platform/gtk/DragDataGtk.cpp:
+        (WebCore::DragData::containsFiles): Updated to access DataObjectGtk::hasFilenames().
+        (WebCore::DragData::asFilenames): Updated to access DataObjectGtk::filenames().
+        * platform/gtk/PasteboardHelper.cpp:
+        (WebCore::PasteboardHelper::getClipboardContents): Use the uriList as a string now.
+        (WebCore::PasteboardHelper::fillSelectionData):  Ditto.
+        (WebCore::PasteboardHelper::fillDataObjectFromDropData): Ditto.
+
+2010-10-11  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] DRT crash in fast/canvas tests w/accel 2D canvas due to NULL DrawingBuffer
+        https://bugs.webkit.org/show_bug.cgi?id=47241
+
+        Avoid initializing accelerated graphics objects on CanvasRenderingContext2D
+        if there is no drawingContext associated with the canvas.
+
+        Test: fast/canvas/access-zero-sized-canvas.html
+              fast/canvas/canvas-skia-excessive-size.html
+              fast/canvas/toDataURL-noData.html
+        with --accelerated-compositing and --accelerated-2d-canvas
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        (WebCore::CanvasRenderingContext2D::reset):
+
+2010-10-11  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Cleanup font selection code for the Freetype backend
+        https://bugs.webkit.org/show_bug.cgi?id=47503
+
+        Do some miscellaneous cleanup work in the Freetype font font selection backend.
+
+        * platform/graphics/cairo/FontCacheFreeType.cpp:
+        (WebCore::getFamilyNameStringFromFontDescriptionAndFamily): Modified this method to return
+        a WebCore String.
+        (WebCore::FontCache::createFontPlatformData): Do a bit of cleanup in this method: properly
+        handle cursive and fantasy as fallback-like fonts. Instead of using raw CStrings do string
+        comparisons using WebCore Strings. Remove a large block comment that originated from a
+        Apache-licensed file.
+
+2010-10-11  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Buttons activated with the keyboard should be painted as clicked
+        https://bugs.webkit.org/show_bug.cgi?id=18364
+
+        When a button is pressed, force it into the hovered state as far as the
+        Mozilla theme drawing code is concerned. This bug also seems to be an
+        issue for Firefox. When we switch away from the Mozilla theme drawing
+        code this work-around should no longer be necessary.
+
+        No new tests. I was not able to generate a pixel test for this issue. It
+        seems that our DRT does not have the necessary infrastructure to generate a
+        pixel dump while a button is in the pressed state.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintRenderObject):
+
+2010-10-11  Jian Li  <jianli@chromium.org>
+
+        Unreviewed. Build fix.
+
+        * bindings/js/JSArrayBufferCustom.cpp:
+        * bindings/js/JSArrayBufferViewCustom.cpp:
+        * bindings/js/JSFloat32ArrayCustom.cpp:
+        * bindings/js/JSInt16ArrayCustom.cpp:
+        * bindings/js/JSInt32ArrayCustom.cpp:
+        * bindings/js/JSInt8ArrayCustom.cpp:
+        * bindings/js/JSUint16ArrayCustom.cpp:
+        * bindings/js/JSUint32ArrayCustom.cpp:
+        * bindings/js/JSUint8ArrayCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferCustom.cpp:
+        * bindings/v8/custom/V8ArrayBufferViewCustom.cpp:
+        * bindings/v8/custom/V8Float32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Int8ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint16ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint32ArrayCustom.cpp:
+        * bindings/v8/custom/V8Uint8ArrayCustom.cpp:
+
+2010-10-11  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed WinCairo build fixes.
+
+        * platform/network/curl/ResourceResponse.h: Correct forward declaration
+        for CFURLResponseRef.
+        * rendering/RenderMediaControls.h: Add ENABLE(VIDEO) guard to new
+        header file to avoid build failure on non-VIDEO builds.
+
+2010-10-11  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Add File API feature guard to all typed array files
+        https://bugs.webkit.org/show_bug.cgi?id=47437
+
+        Since we're going to add ArrayBuffer support to FileReader and BlobBuilder,
+        we need to update all type array files to include File API feature guard
+        in addition to the existing 3D_CANVAS guard. When ArrayBuffer is used in
+        XMLHttpRequest, we will then remove all the guards. This is per the
+        discussion on webkit-dev mailing list:
+        https://lists.webkit.org/pipermail/webkit-dev/2010-October/014716.html
+
+        * html/canvas/ArrayBuffer.cpp:
+        * html/canvas/ArrayBuffer.idl:
+        * html/canvas/ArrayBufferView.cpp:
+        * html/canvas/ArrayBufferView.idl:
+        * html/canvas/Float32Array.cpp:
+        * html/canvas/Float32Array.idl:
+        * html/canvas/Int16Array.cpp:
+        * html/canvas/Int16Array.idl:
+        * html/canvas/Int32Array.cpp:
+        * html/canvas/Int32Array.idl:
+        * html/canvas/Int8Array.cpp:
+        * html/canvas/Int8Array.idl:
+        * html/canvas/Uint16Array.cpp:
+        * html/canvas/Uint16Array.idl:
+        * html/canvas/Uint32Array.cpp:
+        * html/canvas/Uint32Array.idl:
+        * html/canvas/Uint8Array.cpp:
+        * html/canvas/Uint8Array.idl:
+
+2010-10-11  Andreas Kling  <kling@webkit.org>
+
+        Build fix (implicit float conversion in Path.cpp)
+
+        * platform/graphics/Path.cpp:
+
+2010-10-11  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Refactor Plugin X Pixmap painting code to a separate function
+
+        The refactored function will be used for rendering by the Accelerated
+        Composition enabled graphics layer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=35524
+
+        * plugins/PluginView.h:
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::PluginView::paintUsingXPixmap):
+        (WebCore::PluginView::paint):
+
+2010-10-11  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Dirk Schulze.
+
+        SVG: Remove "create" methods and use port-specific "add" counterparts
+        https://bugs.webkit.org/show_bug.cgi?id=46052
+
+        Circles and ellipses will be significantly faster on platforms that
+        implement Path::addEllipse() in a sane fashion.
+
+        Also, a lot of Path copying has been factored out by changing functions
+        that would return Paths to take Path& arguments instead (toPathData, toClipPath)
+
+        * mathml/RenderMathMLRoot.cpp:
+        (WebCore::RenderMathMLRoot::paint):
+        * mathml/RenderMathMLSquareRoot.cpp:
+        (WebCore::RenderMathMLSquareRoot::paint):
+        * platform/graphics/GraphicsContext.cpp:
+        (WebCore::GraphicsContext::addRoundedRectClip):
+        (WebCore::GraphicsContext::clipOutRoundedRect):
+        * platform/graphics/Path.cpp:
+        (WebCore::pathLengthApplierFunction):
+        (WebCore::Path::addRoundedRect):
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/ContextShadowCairo.cpp:
+        (WebCore::ContextShadow::drawRectShadowWithoutTiling):
+        (WebCore::ContextShadow::drawRectShadow):
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::GraphicsContext::drawFocusRing):
+        (WebCore::GraphicsContext::drawTiledShadow):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::paintBorder):
+        (WebCore::RenderBoxModelObject::paintBoxShadow):
+        * rendering/RenderEmbeddedObject.cpp:
+        (WebCore::RenderEmbeddedObject::getReplacementTextGeometry):
+        * rendering/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::pathOnlyClipping):
+        * rendering/svg/RenderSVGPath.cpp:
+        (WebCore::RenderSVGPath::layout):
+        * rendering/svg/RenderSVGTextPath.cpp:
+        (WebCore::RenderSVGTextPath::layoutPath):
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::paintDecorationWithStyle):
+        * svg/SVGAnimateMotionElement.cpp:
+        (WebCore::SVGAnimateMotionElement::animationPath):
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::toPathData):
+        * svg/SVGCircleElement.h:
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::toPathData):
+        * svg/SVGEllipseElement.h:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::toPathData):
+        * svg/SVGLineElement.h:
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::getTotalLength):
+        (WebCore::SVGPathElement::getPointAtLength):
+        (WebCore::SVGPathElement::toPathData):
+        * svg/SVGPathElement.h:
+        * svg/SVGPolygonElement.cpp:
+        (WebCore::SVGPolygonElement::toPathData):
+        * svg/SVGPolygonElement.h:
+        * svg/SVGPolylineElement.cpp:
+        (WebCore::SVGPolylineElement::toPathData):
+        * svg/SVGPolylineElement.h:
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::toPathData):
+        * svg/SVGRectElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::toClipPath):
+        * svg/SVGStyledTransformableElement.h:
+        (WebCore::SVGStyledTransformableElement::toPathData):
+        * svg/SVGUseElement.cpp:
+        (WebCore::SVGUseElement::toClipPath):
+        * svg/SVGUseElement.h:
+
+2010-10-01  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Gavin Barraclough.
+
+        [ES5] Implement strict mode
+        https://bugs.webkit.org/show_bug.cgi?id=10701
+
+        Test: fast/js/basic-strict-mode.html
+
+        Override toStrictThisObject on the domwindow so that
+        it correctly provides the shell object when used as this
+        in a strict mode function.
+
+        * bindings/js/JSDOMWindowBase.cpp:
+        (WebCore::JSDOMWindowBase::toStrictThisObject):
+        * bindings/js/JSDOMWindowBase.h:
+
+2010-10-11  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Eric Carlson.
+
+        CRASH at WebCore::HTMLSourceElement::scheduleErrorEvent
+        https://bugs.webkit.org/show_bug.cgi?id=46777
+
+        Another case that could lead to an improper set of states between
+        m_currentNode and m_loadingState. Also added an ASSERT and early
+        return to prevent crashes if this case can still happen in other ways.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::prepareForLoad):
+
+2010-10-11  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        spellcheck="false" not respected in designMode
+        https://bugs.webkit.org/show_bug.cgi?id=39978
+
+        The bug was caused by WebKit's setting focus to html element rather than body element in design mode.
+        Because we disable spell-check only if ancestor nodes of the focused element had spellcheck=false,
+        this caused us to ignore body element's spellcheck attribute.
+
+        Fixed the bug by overriding supportsFocus in HTMLBodyElement to make body element focusable
+        when the parent node of body elements (namely html element) is editable.
+
+        Test: editing/spelling/design-mode-spellcheck-off.html
+
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::supportsFocus): Added.
+        * html/HTMLBodyElement.h:
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Build fix -- I thought i had killed the prior commit in time to have this be part of the commit.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+
+2010-10-11  Oliver Hunt  <oliver@apple.com>
+
+        Reviewed by Andreas Kling.
+
+        Incorrect handling of 0 length logs in GraphicsContext3DOpenGL.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47494
+
+        Working on another patch I found that there was some screwy behaviour
+        when dealing with logs from GL.  GL_INFO_LOG_LENGTH is defined as being
+        zero if there is no log message, but we did not check for that case and
+        simply perfomed a zero sized alloc and passed the resultant buffer to
+        glGetShaderInfoLog, etc.  glGetShaderInfoLog would then write a null
+        terminator to the buffer, thus causing an overflow.  This is obviously
+        not a problem in practice as allocations are at least 4 bytes long in
+        all common allocators, but it is still a bug.
+
+        I also removed some unnecessary null checks following calls to fastMalloc.
+
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getProgramInfoLog):
+        (WebCore::GraphicsContext3D::getShaderInfoLog):
+
+2010-10-11  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Kill Path::debugString()
+        https://bugs.webkit.org/show_bug.cgi?id=47493
+
+        Remove the obsolete Path::debugString() method. DRT now dumps paths in a platform independant way.
+
+        * platform/graphics/Path.h:
+        * platform/graphics/cairo/PathCairo.cpp:
+        * platform/graphics/cg/PathCG.cpp:
+        * platform/graphics/haiku/PathHaiku.cpp:
+        * platform/graphics/openvg/PathOpenVG.cpp:
+        * platform/graphics/qt/PathQt.cpp:
+        * platform/graphics/skia/PathSkia.cpp:
+        * platform/graphics/wince/PathWinCE.cpp:
+        * platform/graphics/wince/PlatformPathWinCE.cpp:
+        * platform/graphics/wince/PlatformPathWinCE.h:
+        * platform/graphics/wx/PathWx.cpp:
+        * svg/SVGGlyphElement.h:
+        (WebCore::SVGGlyphIdentifier::operator==):
+
+2010-10-11  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Search field icons should be centered vertically in the field
+        https://bugs.webkit.org/show_bug.cgi?id=47441
+
+        Center search field icons vertically in the search field.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::centerRectVerticallyInParentInputElement): Added this helper.
+        (WebCore::RenderThemeGtk::paintSearchFieldResultsDecoration): Center the search
+        field icon by adjusting its drawing rect relative to the containing search field.
+        (WebCore::RenderThemeGtk::paintSearchFieldCancelButton): Ditto.
+
+2010-10-11  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: fix event listener breakpoints sidebar pane style
+        https://bugs.webkit.org/show_bug.cgi?id=47487
+
+        * inspector/front-end/inspector.css:
+        (.section .properties, .event-bar .event-properties):
+        (.section.expanded .properties, .event-bar.expanded .event-properties):
+        (.properties-tree):
+        (.properties-tree li):
+        (.properties-tree li.parent):
+        (.properties-tree li.parent::before):
+        (.properties-tree li.parent.expanded::before):
+        (.properties-tree li .info):
+        (.properties-tree ol, .stack-trace ol, ol.stack-trace):
+        (.properties-tree ol.expanded, .stack-trace ol, ol.stack-trace):
+        (ol.stack-trace):
+        (.event-listener-breakpoints .event-category):
+        (.event-listener-breakpoints.properties-tree .children li):
+        (.event-listener-breakpoints .checkbox-elem):
+        (.breakpoint-list .breakpoint-hit):
+
+2010-10-11  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Avoid QPainterPath::operator=(QPainterPath()) when possible
+
+        Same concept as <http://trac.webkit.org/changeset/69462>, do nothing
+        when clearing an already empty QPainterPath. Avoids one delete+new.
+
+        * platform/graphics/qt/GraphicsContextQt.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::clearCurrentPath):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+        (WebCore::GraphicsContext::beginPath):
+
+2010-10-11  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Unreviewed. Remove unnecessary GTK+ and Pango includes.
+
+        * platform/gtk/FileChooserGtk.cpp:
+        * platform/gtk/Language.cpp:
+
+2010-10-11  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Support DirectoryEntry.removeRecursively for FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=47400
+
+        Also disallows remove/removeRecursively on the root directory.
+
+        Test: fast/filesystem/op-remove.html
+
+        * fileapi/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::removeRecursively): Added.
+        * fileapi/DOMFileSystemBase.h:
+        * fileapi/DirectoryEntry.cpp:
+        (WebCore::DirectoryEntry::removeRecursively): Added.
+        * fileapi/DirectoryEntry.h:
+        * fileapi/DirectoryEntry.idl:
+        * fileapi/DirectoryEntrySync.cpp:
+        (WebCore::DirectoryEntrySync::removeRecursively): Added.
+        * fileapi/DirectoryEntrySync.h:
+        * fileapi/DirectoryEntrySync.idl:
+        * platform/AsyncFileSystem.h:
+
+2010-10-11  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feImage take preserveAspectRatio into account for absolute paint rect
+        https://bugs.webkit.org/show_bug.cgi?id=47464
+
+        Determine the smallest effect region for SVGFEImage by taking preserveAspectRatio into account.
+
+        * svg/graphics/filters/SVGFEImage.cpp:
+        (WebCore::FEImage::determineAbsolutePaintRect):
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+
+2010-10-10  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/8510200> Lines flow around a float that has been removed 
+
+        Overhanging floats are not added to flexible boxes since they behave like
+        block formatting contexts. This causes the intruding floats added in siblings
+        to not get cleared. Enforce the float release by checking if the parent is a
+        flexible box and if yes, use that as the outermost block.
+        
+        https://bugs.webkit.org/show_bug.cgi?id=47104
+
+        Test: fast/flexbox/overhanging-floats-removed.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::removeFloatingOrPositionedChildFromBlockLists):
+
+2010-10-10  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: if aria-live is on a <span> or ignored element, live regions don't work
+        https://bugs.webkit.org/show_bug.cgi?id=47443
+
+        If an element has aria attributes, but has no other native role associated with it,
+        accessibility should fallback to exposing that element as an AXGroup.
+
+        Test: platform/mac/accessibility/live-region-on-span.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::determineAccessibilityRole):
+
+2010-10-10  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Clipboard no longer accepts 'text' as a synonym for 'text/plain'
+        https://bugs.webkit.org/show_bug.cgi?id=47419
+
+        This was a regression introduced in r68807. mimeTypeText had the incorrect
+        value.
+
+        Test: editing/pasteboard/dataTransfer-setData-getData.html
+
+        * platform/chromium/ClipboardMimeTypes.cpp:
+
+2010-10-09  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        FileWriter sends write event instead of progress event
+        https://bugs.webkit.org/show_bug.cgi?id=47454
+
+        No new tests; FileWriter tests will be added shortly, but currently
+        there's no implementation capable of running them.
+
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::didWrite):
+
+2010-10-09  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Fast-path in Path::clear() for already empty paths
+        https://bugs.webkit.org/show_bug.cgi?id=47460
+
+        The only way to clear a QPainterPath is to assign QPainterPath() to it.
+        Avoid creating a temporary object etc if the path is already empty.
+
+        * platform/graphics/qt/PathQt.cpp:
+        (WebCore::Path::clear):
+
+2010-10-08  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Redo in ReplaceNodeWithSpanCommand is broken
+        https://bugs.webkit.org/show_bug.cgi?id=47428
+
+        The bug was caused by ReplaceNodeWithSpanCommand's inheriting from CompositeEditCommand,
+        and ReplaceNodeWithSpanCommand's not implementing doReapply. Because ReplaceNodeWithSpanCommand's doApply
+        directly modifies DOM and does not use simple edit commands while CompositeEditCommand's doReapply
+        only calls reapply of compositing simple edit commands, ReplaceNodeWithSpanCommand's doReapply was no-op.
+
+        Fixed the bug by changing the base class of ReplaceNodeWithSpanCommand to SimpleEditCommand.
+        This allows ReplaceNodeWithSpanCommand's doReapply to call its doApply, which already supports redo operation.
+
+        Test: editing/undo/replace-by-span-then-remove.html
+
+        * editing/ReplaceNodeWithSpanCommand.cpp:
+        (WebCore::ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand):
+        * editing/ReplaceNodeWithSpanCommand.h:
+
+2010-10-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement subregion rendering in WebView when using gtk3
+        https://bugs.webkit.org/show_bug.cgi?id=47411
+
+        * GNUmakefile.am:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/cairo/FloatRectCairo.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator cairo_rectangle_t):
+
+2010-10-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Implement subregion rendering in WebView when using gtk3
+        https://bugs.webkit.org/show_bug.cgi?id=47411
+
+        * GNUmakefile.am:
+        * platform/graphics/FloatRect.h:
+        * platform/graphics/cairo/FloatRectCairo.cpp: Added.
+        (WebCore::FloatRect::FloatRect):
+        (WebCore::FloatRect::operator cairo_rectangle_t):
+
+2010-10-09  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Andreas Kling.
+
+        Add ENABLE(ACCELERATED_2D_CANVAS) guard for m_uploadTexture
+        https://bugs.webkit.org/show_bug.cgi?id=47114
+
+        PlatformContextSkia's m_uploadTexture is used only in code guarded with ENABLE(ACCELERATED_2D_CANVAS).
+
+        * platform/graphics/skia/PlatformContextSkia.h:
+
+2010-10-09  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Use WTF::StringHasher for hashing MappedAttributeKey
+        https://bugs.webkit.org/show_bug.cgi?id=46516
+
+        * dom/StyledElement.cpp:
+        (WebCore::MappedAttributeHash::hash):
+
+2010-10-09  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [Gtk] Non-rectangular buttons have a square background behind them
+        https://bugs.webkit.org/show_bug.cgi?id=23569
+
+        Remove some code which was clearing pieces of the GdkDrawable if it was
+        currently mapped to a window. In our case it is unnecessary, because the
+        platform-independent parts of the render have already cleared this section
+        if it is needed.
+
+        Mozilla must not trip this code path, which means they are probably rendering
+        most often to a non-mapped GdkPixmap.
+
+        No new tests as some themed rendering is covered by existing tests that
+        render buttons. This particular bug is very hard to test as it only appears
+        with certain GTK+ themes and we currently have no mechanism to test different
+        themes in DRT.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_button_paint): Remove unnecessary code.
+
+2010-10-09  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Slider padding translate into a larger track rect
+        https://bugs.webkit.org/show_bug.cgi?id=47435
+
+        Instead of painting the track rectangle for ranges onto the entire RenderBox
+        rectangle, simply paint it on the content rectangle. This prevents misrendering
+        sliders with padding.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::paintSliderTrack): Paint onto the absoluteContentRect
+        of the slider instead of the entire area (which includes padding).
+
+2010-10-09  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, trivial regression fix for r69445.
+
+        RangeInputType::supportsRequired() should return false.
+        https://bugs.webkit.org/show_bug.cgi?id=47405
+
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::supportsRequired):
+        * html/RangeInputType.h:
+
+2010-10-09  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Move typeMismatch(), valueMissing(),
+        isRequiredFormControl(), and recalcWillValidate()
+        https://bugs.webkit.org/show_bug.cgi?id=47405
+
+        Also make checkedRadioButtons() an inline member function of
+        HTMLInputElement in order that RadioInputType can use it.
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::typeMismatchFor):
+        (WebCore::BaseDateAndTimeInputType::typeMismatch):
+        * html/BaseDateAndTimeInputType.h:
+        * html/ButtonInputType.cpp:
+        (WebCore::ButtonInputType::supportsValidation):
+        * html/ButtonInputType.h:
+        * html/CheckboxInputType.cpp:
+        (WebCore::CheckboxInputType::valueMissing):
+        * html/CheckboxInputType.h:
+        * html/ColorInputType.cpp:
+        (WebCore::isValidColorString):
+        (WebCore::ColorInputType::typeMismatchFor):
+        (WebCore::ColorInputType::typeMismatch):
+        (WebCore::ColorInputType::supportsRequired):
+        * html/ColorInputType.h:
+        * html/EmailInputType.cpp:
+        (WebCore::isValidEmailAddress):
+        (WebCore::EmailInputType::typeMismatchFor):
+        (WebCore::EmailInputType::typeMismatch):
+        * html/EmailInputType.h:
+        * html/FileInputType.cpp:
+        (WebCore::FileInputType::valueMissing):
+        * html/FileInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::updateCheckedRadioButtons):
+        (WebCore::HTMLInputElement::isValidValue):
+        (WebCore::HTMLInputElement::typeMismatch):
+        (WebCore::HTMLInputElement::valueMissing):
+        (WebCore::HTMLInputElement::isKeyboardFocusable):
+        (WebCore::HTMLInputElement::updateType):
+        (WebCore::HTMLInputElement::parseMappedAttribute):
+        (WebCore::HTMLInputElement::setChecked):
+        (WebCore::HTMLInputElement::preDispatchEventHandler):
+        (WebCore::HTMLInputElement::isRequiredFormControl):
+        (WebCore::HTMLInputElement::recalcWillValidate):
+        * html/HTMLInputElement.h:
+        (WebCore::HTMLInputElement::checkedRadioButtons):
+        * html/HiddenInputType.cpp:
+        (WebCore::HiddenInputType::supportsValidation):
+        * html/HiddenInputType.h:
+        * html/ImageInputType.cpp:
+        (WebCore::ImageInputType::supportsValidation):
+        * html/ImageInputType.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::supportsValidation):
+        (WebCore::InputType::typeMismatchFor):
+        (WebCore::InputType::typeMismatch):
+        (WebCore::InputType::supportsRequired):
+        (WebCore::InputType::valueMissing):
+        * html/InputType.h:
+        * html/IsIndexInputType.cpp:
+        (WebCore::IsIndexInputType::supportsRequired):
+        * html/IsIndexInputType.h:
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::typeMismatchFor):
+        (WebCore::NumberInputType::typeMismatch):
+        * html/NumberInputType.h:
+        * html/RadioInputType.cpp:
+        (WebCore::RadioInputType::valueMissing):
+        * html/RadioInputType.h:
+        * html/ResetInputType.cpp:
+        (WebCore::ResetInputType::supportsValidation):
+        * html/ResetInputType.h:
+        * html/SubmitInputType.cpp:
+        (WebCore::SubmitInputType::supportsValidation):
+        * html/SubmitInputType.h:
+        * html/TextFieldInputType.cpp:
+        (WebCore::TextFieldInputType::valueMissing):
+        * html/TextFieldInputType.h:
+        * html/URLInputType.cpp:
+        (WebCore::URLInputType::typeMismatchFor):
+        (WebCore::URLInputType::typeMismatch):
+        * html/URLInputType.h:
+        * html/ValidityState.cpp:
+        (WebCore::ValidityState::typeMismatch):
+
+2010-10-09  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47450
+        Crash in WebCore::SocketStreamHandle::chooseProxyFromArray because proxyArray passed is nil
+        <rdar://problem/8244376>
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::chooseProxyFromArray): If proxyArray is
+        NULL, return early to avoid crash.
+
+2010-10-08  Chris Rogers  <crogers@google.com>
+
+        Reviewed by James Robinson.
+
+        Add HRTFPanner files
+        https://bugs.webkit.org/show_bug.cgi?id=46299
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/HRTFPanner.cpp: Added.
+        (WebCore::HRTFPanner::HRTFPanner):
+        (WebCore::HRTFPanner::~HRTFPanner):
+        (WebCore::HRTFPanner::fftSizeForSampleRate):
+        (WebCore::HRTFPanner::reset):
+        (WebCore::wrapDistance):
+        (WebCore::HRTFPanner::calculateDesiredAzimuthIndexAndBlend):
+        (WebCore::HRTFPanner::pan):
+        * platform/audio/HRTFPanner.h: Added.
+        (WebCore::HRTFPanner::fftSize):
+        (WebCore::HRTFPanner::sampleRate):
+
+2010-10-08  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Avoid inlining large and/or virtual functions in widely included header files
+        https://bugs.webkit.org/show_bug.cgi?id=47230
+
+        Functions with very large bodies should not be included in widely included header files.
+        This results in the function's code ending up included in hundreds of object files that
+        the linker has to discard, at a cost of linker memory use, link time, and disk space. This
+        is a particular problem in the Chromium windows build where MSVC often exhausts its 32-bit
+        virtual address space and completely fails to link.
+
+        This patch moves function definitions from the .h to the corresponding .cpp when the function
+        is large and not a candidate for inlining either because it is virtual or because its size is
+        above any reasonable compiler's threshhold for inlining.  The most common case by far in this
+        patch is changing a class' implicitly defined destructor to an explicitly declared d'tor in
+        the header and an explicitly defined d'tor in the .cpp.  This is important since many of our
+        container and utility classes (especially Vector, String, and HashSet) have quite large
+        destructors.
+
+        This patch removes 22.4MB of object file size in a debug 64 bit compile.
+
+        * css/CSSBorderImageValue.cpp:
+        (WebCore::CSSBorderImageValue::~CSSBorderImageValue):
+        * css/CSSBorderImageValue.h:
+        * css/CSSFontFaceSrcValue.cpp:
+        (WebCore::CSSFontFaceSrcValue::~CSSFontFaceSrcValue):
+        * css/CSSFontFaceSrcValue.h:
+        * css/CSSFunctionValue.h:
+        * dom/BeforeTextInsertedEvent.cpp:
+        (WebCore::BeforeTextInsertedEvent::~BeforeTextInsertedEvent):
+        * dom/BeforeTextInsertedEvent.h:
+        * dom/BeforeUnloadEvent.cpp:
+        (WebCore::BeforeUnloadEvent::~BeforeUnloadEvent):
+        * dom/BeforeUnloadEvent.h:
+        * dom/ClassNodeList.h:
+        * dom/ClipboardEvent.cpp:
+        (WebCore::ClipboardEvent::~ClipboardEvent):
+        * dom/ClipboardEvent.h:
+        * dom/CustomEvent.cpp:
+        (WebCore::CustomEvent::~CustomEvent):
+        * dom/CustomEvent.h:
+        * dom/Element.cpp:
+        * dom/Element.h:
+        * dom/EventTarget.cpp:
+        (WebCore::EventTargetData::EventTargetData):
+        * dom/EventTarget.h:
+        * dom/InputElement.cpp:
+        (WebCore::InputElementData::~InputElementData):
+        * dom/InputElement.h:
+        * dom/MutationEvent.cpp:
+        (WebCore::MutationEvent::~MutationEvent):
+        * dom/MutationEvent.h:
+        * dom/Node.cpp:
+        (WebCore::Node::refEventTarget):
+        (WebCore::Node::derefEventTarget):
+        * dom/Node.h:
+        * dom/OptionElement.cpp:
+        (WebCore::OptionElementData::~OptionElementData):
+        * dom/OptionElement.h:
+        * dom/PopStateEvent.cpp:
+        (WebCore::PopStateEvent::~PopStateEvent):
+        * dom/PopStateEvent.h:
+        * dom/QualifiedName.cpp:
+        (WebCore::QualifiedName::~QualifiedName):
+        * dom/QualifiedName.h:
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElementData::~SelectElementData):
+        * dom/SelectElement.h:
+        * dom/StaticHashSetNodeList.cpp:
+        (WebCore::StaticHashSetNodeList::StaticHashSetNodeList):
+        (WebCore::StaticHashSetNodeList::~StaticHashSetNodeList):
+        * dom/StaticHashSetNodeList.h:
+        * dom/StyleElement.cpp:
+        (WebCore::StyleElement::~StyleElement):
+        * dom/StyleElement.h:
+        * dom/TouchEvent.cpp:
+        (WebCore::TouchEvent::TouchEvent):
+        (WebCore::TouchEvent::~TouchEvent):
+        * dom/TouchEvent.h:
+        * editing/CompositeEditCommand.cpp:
+        (WebCore::CompositeEditCommand::~CompositeEditCommand):
+        * editing/CompositeEditCommand.h:
+        * editing/TextIterator.cpp:
+        (WebCore::BitStack::~BitStack):
+        (WebCore::TextIterator::~TextIterator):
+        (WebCore::WordAwareIterator::~WordAwareIterator):
+        * editing/TextIterator.h:
+        * inspector/InspectorValues.cpp:
+        (WebCore::InspectorObject::~InspectorObject):
+        (WebCore::InspectorObject::InspectorObject):
+        (WebCore::InspectorArray::~InspectorArray):
+        (WebCore::InspectorArray::InspectorArray):
+        * inspector/InspectorValues.h:
+        * loader/CachedResource.cpp:
+        (WebCore::CachedResource::registerHandle):
+        (WebCore::CachedResource::unregisterHandle):
+        * loader/CachedResource.h:
+        * platform/network/HTTPHeaderMap.cpp:
+        (WebCore::HTTPHeaderMap::HTTPHeaderMap):
+        (WebCore::HTTPHeaderMap::~HTTPHeaderMap):
+        (WebCore::HTTPHeaderMap::get):
+        (WebCore::HTTPHeaderMap::add):
+        * platform/network/HTTPHeaderMap.h:
+        * rendering/RenderApplet.cpp:
+        (WebCore::RenderApplet::~RenderApplet):
+        * rendering/RenderApplet.h:
+        * rendering/RenderButton.cpp:
+        (WebCore::RenderButton::~RenderButton):
+        * rendering/RenderButton.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::RenderCounter::~RenderCounter):
+        * rendering/RenderCounter.h:
+        * rendering/RenderFieldset.h:
+        * rendering/RenderForeignObject.cpp:
+        (WebCore::RenderForeignObject::~RenderForeignObject):
+        * rendering/RenderForeignObject.h:
+        * rendering/RenderFrame.h:
+        * rendering/RenderFrameBase.h:
+        * rendering/RenderHTMLCanvas.h:
+        * rendering/RenderIFrame.h:
+        * rendering/RenderInline.h:
+        * rendering/RenderListItem.h:
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::~RenderMarquee):
+        * rendering/RenderMarquee.h:
+        * rendering/RenderPath.cpp:
+        (WebCore::RenderPath::~RenderPath):
+        * rendering/RenderPath.h:
+        * rendering/RenderSVGBlock.h:
+        * rendering/RenderSVGContainer.cpp:
+        (WebCore::RenderSVGContainer::~RenderSVGContainer):
+        * rendering/RenderSVGContainer.h:
+        * rendering/RenderSVGHiddenContainer.h:
+        * rendering/RenderSVGInline.h:
+        * rendering/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::~RenderSVGInlineText):
+        * rendering/RenderSVGInlineText.h:
+        * rendering/RenderSVGModelObject.h:
+        * rendering/RenderSVGResourceFilterPrimitive.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::~RenderSVGRoot):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderSVGTSpan.h:
+        * rendering/RenderSVGText.h:
+        * rendering/RenderSVGTextPath.h:
+        * rendering/RenderSVGTransformableContainer.h:
+        * rendering/RenderSVGViewportContainer.h:
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::~RenderTable):
+        * rendering/RenderTable.h:
+        * rendering/RenderTableCell.h:
+        * rendering/RenderTableCol.h:
+        * rendering/RenderTableRow.h:
+        * rendering/RenderTextFragment.cpp:
+        (WebCore::RenderTextFragment::~RenderTextFragment):
+        * rendering/RenderTextFragment.h:
+        * rendering/RenderWordBreak.h:
+        * svg/SVGStyledElement.cpp:
+        (WebCore::SVGStyledElement::~SVGStyledElement):
+        * svg/SVGStyledElement.h:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::~SVGStyledTransformableElement):
+        * svg/SVGStyledTransformableElement.h:
+        * xml/XPathParser.cpp:
+        (WebCore::XPath::Parser::~Parser):
+        * xml/XPathParser.h:
+
+2010-10-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Daniel Bates.
+
+        [GTK] Fails /LayoutTests/fast/css/button-height.html
+        https://bugs.webkit.org/show_bug.cgi?id=33936
+
+        GTK buttons honor height property set via CSS. The code for the method
+        adjustButtonStyle originates from the original GTK+ theme drawing code
+        and is clearly just a copy-paste from the Safari theme drawing code. The
+        Safari theme drawing code does quite a bit of work to ensure that button
+        fonts are consistent with the system theme, which is not something the GTK+
+        port does.
+
+        This change brings the method more in line with the Chromium port, which
+        allows CSS to style buttons, only overriding the line-height property,
+        which is required for layout tests to pass.
+
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::adjustButtonStyle): No longer override most CSS
+        properties for button styling.
+
+2010-10-08  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        popstate events are lost when network connection is in progress
+        https://bugs.webkit.org/show_bug.cgi?id=42940
+        
+        Instead of checking FrameLoader::isComplete() (which isn't true if the
+        document's resource loader has requests outstanding), check that the
+        document's readyState is complete, as the spec says.
+
+        Test: http/tests/history/popstate-fires-with-pending-requests.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::statePopped):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::didBeginDocument): Added call to set readyState
+        to Loading earlier. Otherwise, readyState's initial value is Complete,
+        and we only set it to Loading in Document::implicitOpen (which is called
+        after FrameLoader::didBeginDocument by DocumentWriter::begin), so we 
+        could end up in Document::statePopped and have the readyState be
+        Complete, even if we hadn't even begin loading the document.
+
+2010-10-08  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Update ReadableDataObject/WritableDataObject interface for ChromiumDataObject change
+        https://bugs.webkit.org/show_bug.cgi?id=47394
+
+        Minor cleanup--these classes have suffered from bit rot since they aren't
+        actively used at the moment. The three main changes are to:
+        1) Condense getURL, setURL, getHTML, setHTML, urlTitle, htmlBaseUrl,
+           setUrlTitle, and sethtmlBaseUrl into setters/getters for just the URL
+           title and HTML base URL.
+        2) Use Clipboard::ClipboardType instead of a bool.
+        3) Remove the use of virtuals, as they are no longer needed..
+
+        * platform/chromium/ReadableDataObject.cpp:
+        (WebCore::clipboardBuffer):
+        (WebCore::ReadableDataObject::create):
+        (WebCore::ReadableDataObject::ReadableDataObject):
+        (WebCore::ReadableDataObject::getData):
+        (WebCore::ReadableDataObject::urlTitle): renamed from getURL
+        (WebCore::ReadableDataObject::htmlBaseUrl): renamed from getHTML
+        (WebCore::ReadableDataObject::containsFilenames):
+        (WebCore::ReadableDataObject::filenames):
+        (WebCore::ReadableDataObject::ensureTypeCacheInitialized):
+        * platform/chromium/ReadableDataObject.h:
+        * platform/chromium/WritableDataObject.cpp:
+        (WebCore::WritableDataObject::create):
+        (WebCore::WritableDataObject::WritableDataObject):
+        (WebCore::WritableDataObject::setData):
+        * platform/chromium/WritableDataObject.h:
+        (WebCore::WritableDataObject::setUrlTitle): renamed from setURL
+        (WebCore::WritableDataObject::setHtmlBaseUrl): renamed from setHTML
+        (WebCore::WritableDataObject::dataMap):
+        (WebCore::WritableDataObject::urlTitle):
+        (WebCore::WritableDataObject::htmlBaseURL):
+        (WebCore::WritableDataObject::fileExtension):
+        (WebCore::WritableDataObject::fileContentFilename):
+        (WebCore::WritableDataObject::fileContent):
+        (WebCore::WritableDataObject::setFileExtension):
+        (WebCore::WritableDataObject::setFileContentFilename):
+        (WebCore::WritableDataObject::setFileContent):
+
+2010-10-08  Abhishek Arya  <inferno@chromium.org>
+
+        Unreviewed, rolling out r69360.
+        http://trac.webkit.org/changeset/69360
+        https://bugs.webkit.org/show_bug.cgi?id=46921
+
+        Test still crashing on chromium test_shell
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderFallbackContent):
+
+2010-10-08  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r68574.
+        http://trac.webkit.org/changeset/68574
+        https://bugs.webkit.org/show_bug.cgi?id=47433
+
+        [chromium] Breaks partial repaint of images while scrolling
+        (Requested by jamesr on #webkit).
+
+        * platform/graphics/skia/ImageSkia.cpp:
+        (WebCore::computeResamplingMode):
+        (WebCore::drawResampledBitmap):
+
+2010-10-08  Andy Estes  <aestes@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r66223): Crash when using CSS content and -webkit-mask-box-image properties containing cached images.
+        https://bugs.webkit.org/show_bug.cgi?id=47430
+
+        Test: fast/replaced/css-content-and-webkit-mask-box-image-crash.html
+
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::imageChanged): imageChanged() can be called prior
+        to m_imageResource being set. The appropriate thing to do in this case
+        is to return early.
+        (WebCore::RenderImage::notifyFinished): Ditto.
+
+2010-10-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB does not have a quota mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=47389
+
+        Test: storage/indexeddb/database-quota.html
+
+        Add a simple mechanism for enforcing a maximum size
+        for each origin using IndexedDB. Note that this depends
+        on having one SQLite database file per origin, which is
+        addressed in a separate patch.
+
+        * page/GroupSettings.cpp:
+        (WebCore::GroupSettings::GroupSettings):
+        (WebCore::GroupSettings::setIndexedDBQuotaBytes):
+        * page/GroupSettings.h:
+        (WebCore::GroupSettings::indexedDBQuotaBytes):
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBFactoryBackendImpl.cpp:
+        (WebCore::openSQLiteDatabase):
+        (WebCore::IDBFactoryBackendImpl::open):
+        * storage/IDBFactoryBackendImpl.h:
+        * storage/IDBFactoryBackendInterface.h:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::putObjectStoreData):
+        (WebCore::putIndexData):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+
+2010-10-08  Gavin Peters  <gavinp@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Output X-Purpose header for prefetch requests
+        https://bugs.webkit.org/show_bug.cgi?id=46529
+
+        Test: http/tests/misc/prefetch-purpose.html
+
+        * loader/loader.cpp:
+        (WebCore::Loader::Host::servePendingRequests):
+
+2010-10-08  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Crash on reload when CSS property 'content' has malformed URL.
+        https://bugs.webkit.org/show_bug.cgi?id=47322
+
+        Make CSSStyleSelector handle the case where a cached image can't be
+        produced due to a malformed URL.
+
+        Test: fast/css-generated-content/malformed-url.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::loadPendingImages):
+
+2010-10-08  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feImage needs absolute subregion for preserveAspectRatio
+        https://bugs.webkit.org/show_bug.cgi?id=47409
+
+        PreserverAspectRatio needs the subregion in absolute coordinates to determine
+        the destination position and size of the input image. The maxEffectRect() already
+        stores the absolute subregion, but clipped to the filter region.
+
+        Test: svg/W3C-SVG-1.1se/filters-image-03-f.svg
+
+        * platform/graphics/filters/FETile.cpp:
+        (WebCore::FETile::apply):
+        * platform/graphics/filters/FilterEffect.h: Added enum to differentate sourece inputs, feTile and feImage.
+        (WebCore::FilterEffect::filterEffectType):
+        * platform/graphics/filters/SourceAlpha.h: Make use of the new enum in FilterEffect
+        (WebCore::SourceAlpha::filterEffectType):
+        * platform/graphics/filters/SourceGraphic.h: Ditto.
+        (WebCore::SourceGraphic::filterEffectType):
+        * svg/graphics/filters/SVGFEImage.cpp: Take the absolute subregion to determine the destination rect for input image.
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h: Ditto.
+        (WebCore::FEImage::setAbsoluteSubregion):
+        (WebCore::FEImage::filterEffectType):
+        * svg/graphics/filters/SVGFilter.cpp: Give over subregion in absolute coordinates to feImage. Just feImage makes use of it.
+        (WebCore::SVGFilter::determineFilterPrimitiveSubregion):
+
+2010-10-08  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        gradient stroke on lines does not work
+        https://bugs.webkit.org/show_bug.cgi?id=40985
+
+        Correct handling of invalid fill/stroke paint servers / colors according to SVG 1.1 2nd Edition.
+        Perfectly matches Opera, and now lets us pass three of the new tests.
+
+        Fix incorrect svg/custom/invalid-fill* tests:
+        -> If there's an invalid fill URI, but no fallback specified, it is as if fill="black" was specified. (invalid-fill.svg)
+        -> If there's an invalid fill color, but no fallback specified, it is as if fill="none" was specified. (invalid-fill-hex.svg)
+
+        Needed to refactor some of the gradient/pattern code to properly handle fallback paint servers.
+        As side effect, we're allowing gradients with gradientUnits="userSpaceOnUse" to apply on 1d objects (lines) again, per SVG 1.1 2nd edition.
+
+        Tests: svg/W3C-SVG-1.1-SE/pservers-pattern-03-f.svg
+               svg/W3C-SVG-1.1-SE/pservers-grad-17-b.svg
+               svg/W3C-SVG-1.1-SE/pservers-grad-20-b.svg
+
+        * rendering/RenderSVGResource.cpp: Rewrite fill/stroke paint resource requests, share all code between the similar functions.
+        (WebCore::requestPaintingResource):
+        (WebCore::RenderSVGResource::fillPaintingResource):
+        (WebCore::RenderSVGResource::strokePaintingResource):
+        * rendering/RenderSVGResource.h:
+        * rendering/RenderSVGResourceGradient.cpp: Split collecting gradient properties from building the gradient. We don't need to build it, if it's not applyable (eg. on 1d lines).
+        (WebCore::RenderSVGResourceGradient::RenderSVGResourceGradient):
+        (WebCore::RenderSVGResourceGradient::removeAllClientsFromCache):
+        (WebCore::clipToTextMask):
+        (WebCore::RenderSVGResourceGradient::applyResource):
+        * rendering/RenderSVGResourceGradient.h: Stop storing boundingBoxMode & gradientTransform in each GradientData object, it's enough to just store it in the gradient resource, once.
+        * rendering/RenderSVGResourceLinearGradient.cpp:
+        (WebCore::RenderSVGResourceLinearGradient::collectGradientAttributes): Splitted from buildGradient.
+        (WebCore::RenderSVGResourceLinearGradient::buildGradient):
+        * rendering/RenderSVGResourceLinearGradient.h:
+        (WebCore::RenderSVGResourceLinearGradient::boundingBoxMode): Return bounding box mode information, from m_attributes instead of storing in gradientData.
+        (WebCore::RenderSVGResourceLinearGradient::calculateGradientTransform): Ditto.
+        * rendering/RenderSVGResourcePattern.cpp: Split collecting pattern properties from building the pattern. We don't need to build it, if it's not applyable (eg. on 1d lines).
+        (WebCore::RenderSVGResourcePattern::RenderSVGResourcePattern):
+        (WebCore::RenderSVGResourcePattern::removeAllClientsFromCache):
+        (WebCore::RenderSVGResourcePattern::applyResource):
+        (WebCore::RenderSVGResourcePattern::buildTileImageTransform):
+        * rendering/RenderSVGResourcePattern.h:
+        * rendering/RenderSVGResourceRadialGradient.cpp:
+        (WebCore::RenderSVGResourceRadialGradient::collectGradientAttributes):
+        (WebCore::RenderSVGResourceRadialGradient::buildGradient):
+        * rendering/RenderSVGResourceRadialGradient.h:
+        (WebCore::RenderSVGResourceRadialGradient::boundingBoxMode):
+        (WebCore::RenderSVGResourceRadialGradient::calculateGradientTransform):
+        * rendering/SVGRenderTreeAsText.cpp: Adapt to change, that fill/strokePaintingResource now take a Color& fallbackColor parameter.
+        (WebCore::writeStyle):
+        (WebCore::writeSVGResourceContainer):
+        * rendering/svg/RenderSVGPath.cpp: 
+        (WebCore::RenderSVGPath::fillContains): Ditto.
+        (WebCore::RenderSVGPath::strokeContains): Ditto.
+        (WebCore::RenderSVGPath::fillAndStrokePath): Properly handle fallback color, if an existing (!) paint server failed to apply.
+        * rendering/svg/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::acquirePaintingResource): Ditto.
+        * svg/SVGLinearGradientElement.cpp:
+        (WebCore::SVGLinearGradientElement::collectGradientAttributes): Pass LinearGradientAttributes by reference, instead of returning a copy.
+        * svg/SVGLinearGradientElement.h: Rename collectGradientProperties to collectGradientAttributes.
+        * svg/SVGPatternElement.cpp:
+        (WebCore::SVGPatternElement::collectPatternAttributes): Pass PatternAttributes by reference, instead of returning.
+        * svg/SVGPatternElement.h: Rename collectPatternProperties to collectPatternAttributes.
+        * svg/SVGRadialGradientElement.cpp:
+        (WebCore::SVGRadialGradientElement::collectGradientAttributes): Pass RadialGradientAttributes by reference, instead of returning a copy.
+        * svg/SVGRadialGradientElement.h: Rename collectGradientProperties to collectGradientAttributes.
+
+2010-10-08  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Slider widgets looks bad on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=47421
+
+        This patch change the rendering of the slider to only have the
+        subcontrols that would be defined by default on a QSlider.
+
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::paintSliderTrack):
+
+2010-10-08  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        SVGFEColorMatrixElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=47342
+
+        The dynamic changes are captured by the svgAttributeChange function, and invalidate the filter primitive if necessary.
+
+        Tests: svg/dynamic-updates/SVGFEColorMatrixElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFEColorMatrixElement-dom-type-attr.html
+               svg/dynamic-updates/SVGFEColorMatrixElement-dom-values-attr.html
+               svg/dynamic-updates/SVGFEColorMatrixElement-svgdom-in-prop.html
+               svg/dynamic-updates/SVGFEColorMatrixElement-svgdom-type-prop.html
+               svg/dynamic-updates/SVGFEColorMatrixElement-svgdom-values-prop.html
+
+        * svg/SVGFEColorMatrixElement.cpp:
+        (WebCore::SVGFEColorMatrixElement::svgAttributeChanged):
+        * svg/SVGFEColorMatrixElement.h:
+
+2010-10-08  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: save InspectorController in instrumentation cookie
+        https://bugs.webkit.org/show_bug.cgi?id=47406
+
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::callFunction):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        * inspector/InspectorInstrumentation.cpp:
+        * inspector/InspectorInstrumentation.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::fired):
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2010-10-08  Adam Roben  <aroben@apple.com>
+
+        Windows Release build fix for 32-bit systems
+
+        WebCore had once again grown too large for the linker's virtual
+        address space on 32-bit systems. I combined WebCore/rendering,
+        WebCore/rendering/style, and WebCore/dom into new *AllInOne.cpp files,
+        and added a few more files to RenderSVGAllInOne.cpp.
+
+        Fixes <http://webkit.org/b/47417> <rdar://problem/8529362>
+
+        * WebCore.vcproj/WebCore.vcproj: Added new *AllInOne.cpp files and
+        excluded the individual files they contain from the build.
+
+        * rendering/RenderSVGAllInOne.cpp: Added a few more files to this.
+
+        * dom/DOMAllInOne.cpp: Added.
+        * rendering/RenderingAllInOne.cpp: Added.
+        * rendering/style/StyleAllInOne.cpp: Added.
+
+2010-10-08  Girish Ramakrishnan  <girish@forwardbias.in>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Use constBegin and constEnd when using const iterators
+
+        * platform/graphics/qt/GraphicsLayerQt.cpp:
+        (WebCore::GraphicsLayerQtImpl::~GraphicsLayerQtImpl):
+        (WebCore::GraphicsLayerQtImpl::updateTransform):
+        (WebCore::GraphicsLayerQtImpl::flushChanges):
+
+2010-10-07  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add resource viewer to the network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=47346
+
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.autoSizeColumns):
+        (WebInspector.DataGrid.prototype.updateWidths):
+        (WebInspector.DataGrid.prototype.columnWidthsMap):
+        (WebInspector.DataGrid.prototype.applyColumnWidthsMap):
+        (WebInspector.DataGrid.prototype.isColumnVisible):
+        (WebInspector.DataGrid.prototype.showColumn):
+        (WebInspector.DataGrid.prototype.hideColumn):
+        (WebInspector.DataGrid.prototype._positionResizers):
+        (WebInspector.DataGrid.prototype._resizerDragging):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype.updateSidebarWidth):
+        (WebInspector.NetworkPanel.prototype.updateMainViewWidth):
+        (WebInspector.NetworkPanel.prototype.handleShortcut):
+        (WebInspector.NetworkPanel.prototype._createTable):
+        (WebInspector.NetworkPanel.prototype._sortItems):
+        (WebInspector.NetworkPanel.prototype._sortByTimeline):
+        (WebInspector.NetworkPanel.prototype._createSummaryBar):
+        (WebInspector.NetworkPanel.prototype._updateDividersIfNeeded):
+        (WebInspector.NetworkPanel.prototype.hide):
+        (WebInspector.NetworkPanel.prototype.get searchableViews):
+        (WebInspector.NetworkPanel.prototype.refresh):
+        (WebInspector.NetworkPanel.prototype.reset):
+        (WebInspector.NetworkPanel.prototype.refreshResource):
+        (WebInspector.NetworkPanel.prototype.canShowSourceLine):
+        (WebInspector.NetworkPanel.prototype.showSourceLine):
+        (WebInspector.NetworkPanel.prototype._showResource):
+        (WebInspector.NetworkPanel.prototype._closeVisibleResource):
+        (WebInspector.NetworkPanel.prototype._resourceViewForResource):
+        (WebInspector.NetworkPanel.prototype._resourceViewTypeMatchesResource):
+        (WebInspector.NetworkPanel.prototype._toggleGridMode):
+        (WebInspector.NetworkPanel.prototype._toggleViewingResourceMode):
+        (WebInspector.NetworkDataGridNode):
+        (WebInspector.NetworkDataGridNode.prototype.select):
+        (WebInspector.NetworkDataGridNode.prototype._createTimelineCell):
+        * inspector/front-end/networkPanel.css:
+        (#network-container):
+        (#network-views):
+        (.network.panel .data-grid.full-grid-mode .viewer-column):
+        (.network.panel .data-grid.brief-grid-mode .time-column):
+        (.network.panel.viewing-resource .network-timeline-grid):
+        (.network.panel .data-grid.viewing-resource-mode .timeline-column):
+        (.network.panel .network-sidebar):
+        (.network.panel:not(.viewing-resource) .sidebar-resizer-vertical):
+        (.network.panel.viewing-resource .data-grid-resizer):
+        (.network.panel .scope-bar):
+        (.network.panel .resource-view.headers-visible .resource-view-content):
+        (.network.panel:not(.viewing-resource) .data-grid tr.selected):
+
+2010-10-08  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGTextLayoutAttributesBuilder: "XValue" and "YValue" clash with X11 macros
+        https://bugs.webkit.org/show_bug.cgi?id=47180
+
+        Rename *Value to *ValueAttribute
+
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp:
+        (WebCore::SVGTextLayoutAttributesBuilder::nextLayoutValue):
+        (WebCore::SVGTextLayoutAttributesBuilder::assignLayoutAttributesForCharacter):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+
+2010-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Don't use -whole-archive to link-in libWebKit2.a except for libQtWebKit.so
+        https://bugs.webkit.org/show_bug.cgi?id=47347
+
+        * WebCore.pro:
+
+2010-10-08  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Implement IntRectEfl.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47403
+
+        Implement IntRect for Efl Port using Eina_Rectangle.
+
+        * platform/graphics/IntRect.h:
+        * platform/graphics/efl/IntRectEfl.cpp:
+        (WebCore::IntRect::IntRect):
+        (WebCore::IntRect::operator Eina_Rectangle):
+
+2010-10-08  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG: Make RenderPath DRT output platform-independent
+        https://bugs.webkit.org/show_bug.cgi?id=46051
+
+        Move away from using the port-specific Path::debugString() to dump
+        RenderPath objects. This shrinks the DRT output delta between platforms
+        and makes it more readable as we now dump only the relevant,
+        element-specific properties of each object.
+
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::operator<<):
+        Generate DRT output for RenderPaths in a platform-independent manner,
+        dumping the relevant element properties.
+
+2010-10-08  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix FileSystem path validation order to normalize '..' and '.' before restriction checks
+        https://bugs.webkit.org/show_bug.cgi?id=47309
+
+        Test: fast/filesystem/op-get-entry.html
+
+        * fileapi/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::getFile): Fixed the path validation order.
+        (WebCore::DOMFileSystemBase::getDirectory): Fixed the path validation order.
+
+2010-10-08  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Port GTK+ theming code to GTK+ 3.x APIs
+        https://bugs.webkit.org/show_bug.cgi?id=47398
+
+        Create a new gtk3drawing file for the widget drawing primitives in
+        WebKit, using the GTK+ 3.x APIs. It's very similar to the GTK+ 2.x
+        code at the moment, but we'll evolve it incrementally from here.
+
+        * GNUmakefile.am:
+        * platform/gtk/RenderThemeGtk.cpp:
+        (WebCore::RenderThemeGtk::partsForDrawable):
+        (WebCore::RenderThemeGtk::paintMozillaGtkWidget):
+        * platform/gtk/gtk2drawing.c:
+        (TSOffsetStyleGCArray):
+        (TSOffsetStyleGCs):
+        (moz_gtk_button_paint):
+        (moz_gtk_scrollbar_thumb_paint):
+        (moz_gtk_entry_paint):
+        (moz_gtk_combo_box_paint):
+        (moz_gtk_get_widget_border):
+        * platform/gtk/gtk3drawing.c: Added.
+        * platform/gtk/gtkdrawing.h:
+
+2010-10-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] Fix indentation in ChromiumDataObject.h 
+        https://bugs.webkit.org/show_bug.cgi?id=47396
+
+        Just a cleanup patch to make followup diffs smaller.
+
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::create):
+        (WebCore::ChromiumDataObject::copy):
+        (WebCore::ChromiumDataObject::urlTitle):
+        (WebCore::ChromiumDataObject::setUrlTitle):
+        (WebCore::ChromiumDataObject::htmlBaseUrl):
+        (WebCore::ChromiumDataObject::setHtmlBaseUrl):
+        (WebCore::ChromiumDataObject::containsFilenames):
+        (WebCore::ChromiumDataObject::filenames):
+        (WebCore::ChromiumDataObject::setFilenames):
+        (WebCore::ChromiumDataObject::fileExtension):
+        (WebCore::ChromiumDataObject::setFileExtension):
+        (WebCore::ChromiumDataObject::fileContentFilename):
+        (WebCore::ChromiumDataObject::setFileContentFilename):
+        (WebCore::ChromiumDataObject::fileContent):
+        (WebCore::ChromiumDataObject::setFileContent):
+
+2010-10-07  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Move valueAsDate and valueAsNumber implementations
+        https://bugs.webkit.org/show_bug.cgi?id=47327
+
+        Move the content of HTMLInputElement::valueAsDate(), setValueAsDate(),
+        valueAsNumber(), and setValueAsNumber() to InputType, and move
+        serialize() and serializeForDateTimeTypes() too
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::valueAsDate):
+        (WebCore::BaseDateAndTimeInputType::setValueAsDate):
+        (WebCore::BaseDateAndTimeInputType::valueAsNumber):
+        (WebCore::BaseDateAndTimeInputType::setValueAsNumber):
+        (WebCore::BaseDateAndTimeInputType::serialize):
+        * html/BaseDateAndTimeInputType.h:
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::setMillisecondToDateComponents):
+        * html/DateInputType.h:
+        * html/DateTimeInputType.cpp:
+        (WebCore::DateTimeInputType::setMillisecondToDateComponents):
+        * html/DateTimeInputType.h:
+        * html/DateTimeLocalInputType.cpp:
+        (WebCore::DateTimeLocalInputType::valueAsDate):
+        (WebCore::DateTimeLocalInputType::setValueAsDate):
+        (WebCore::DateTimeLocalInputType::setMillisecondToDateComponents):
+        * html/DateTimeLocalInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::setValueAsDate):
+        (WebCore::HTMLInputElement::valueAsNumber):
+        (WebCore::HTMLInputElement::setValueAsNumber):
+        (WebCore::HTMLInputElement::stepUpFromRenderer):
+        * html/HTMLInputElement.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::valueAsDate):
+        (WebCore::InputType::setValueAsDate):
+        (WebCore::InputType::valueAsNumber):
+        (WebCore::InputType::setValueAsNumber):
+        (WebCore::InputType::serialize):
+        * html/InputType.h:
+        * html/MonthInputType.cpp:
+        (WebCore::MonthInputType::valueAsDate):
+        (WebCore::MonthInputType::setValueAsDate):
+        (WebCore::MonthInputType::setMillisecondToDateComponents):
+        * html/MonthInputType.h:
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::valueAsNumber):
+        (WebCore::NumberInputType::setValueAsNumber):
+        (WebCore::NumberInputType::serialize):
+        * html/NumberInputType.h:
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::valueAsNumber):
+        (WebCore::RangeInputType::setValueAsNumber):
+        (WebCore::RangeInputType::serialize):
+        * html/RangeInputType.h:
+        * html/TimeInputType.cpp:
+        (WebCore::TimeInputType::setMillisecondToDateComponents):
+        * html/TimeInputType.h:
+        * html/WeekInputType.cpp:
+        (WebCore::WeekInputType::setMillisecondToDateComponents):
+        * html/WeekInputType.h:
+
+2010-10-07  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        Texture Mapper is an implementation of accelerated compositing that doesn't require a
+        platform specific scenegraph library like CA or QGraphicsView. The idea is that with
+        time this would replace GraphicsLayerQt, and could serve as an implementation for other
+        platforms that don't have a scenegraph library. The first stage of this is to add all the code to trunk,
+        and enable it in Qt with an opt-in build flag so that it can be easily tested. Once it reaches
+        an adequate level of stability, we can enable it by default and eventually have it replace GraphicsLayerQt.
+
+        This change includes only the common new files and the Qt backend; Still to come: the GL backend and integration layer.
+
+        * platform/graphics/qt/TextureMapperQt.cpp: Added.
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.cpp: Added.
+        * platform/graphics/texmap/GraphicsLayerTextureMapper.h: Added.
+        * platform/graphics/texmap/TextureMapper.h: Added.
+        * platform/graphics/texmap/TextureMapperPlatformLayer.h: Added.
+
+2010-10-07  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        [Mac] [DRT] implement setSpatialNavigationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=47291
+
+        Added Settings::setSpatialNavigationEnabled symbols to WebKit.exp.in
+        so it can be used from WebKit/mac.
+
+        * WebCore.exp.in:
+
+2010-10-07  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Jian Li
+
+        [V8] Add FileWriter to active DOM map
+        https://bugs.webkit.org/show_bug.cgi?id=47380
+
+        It's an ActiveDOMObject; it needs to be in the map.
+
+        * bindings/scripts/CodeGeneratorV8.pm:
+
+2010-10-07  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Make sure to update the current graphics context when calling out to AppKit.
+        https://bugs.webkit.org/show_bug.cgi?id=47387
+
+        This ports r57741 to ThemeChromiumMac. It also reverts r66975, which is
+        now no longer necessary.
+
+        Should be covered by existing tests. The checkbox at
+        http://webkit.org/blog-files/3d-transforms/morphing-cubes.html should
+        now show up correctly.
+
+        * platform/chromium/ThemeChromiumMac.mm:
+        (WebCore::paintCheckbox):
+        (WebCore::paintRadio):
+        Create current context.
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::updateContents):
+        Remove LocalCurrentContext, it's now no longer necessary.
+
+2010-10-07  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Postpone clearing the imageLoader when rendering certain fallback content for objects until after the attach().
+        https://bugs.webkit.org/show_bug.cgi?id=46921
+
+        Test: fast/html/object-image-nested-fallback.html
+
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::renderFallbackContent):
+
+2010-10-07  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Fix shared timers on EFL port - make them thread safe.
+        https://bugs.webkit.org/show_bug.cgi?id=47383
+
+        Using ecore_timer_add to create a timer from a thread that is
+        not the main thread isn't safe. Now we add a pipe that is used
+        to request a timer to be added in the main thread.
+
+        In order to reduce some delay on timers that are added with a
+        very small interval, the timer callback is called immediately
+        if the interval is smaller than the mainloop frame time.
+
+        No new features, so no tests added.
+
+        * platform/efl/SharedTimerEfl.cpp:
+        (WebCore::setSharedTimerFiredFunction):
+        (WebCore::timerEvent):
+        (WebCore::processTimers):
+        (WebCore::pipeHandlerCb):
+        (WebCore::stopSharedTimer):
+        (WebCore::addNewTimer):
+        (WebCore::setSharedTimerFireTime):
+
+2010-10-07  James Kozianski  <koz@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        getPropertyValue('border') is incorrect after border-top-width is set
+        https://bugs.webkit.org/show_bug.cgi?id=45949
+
+        Test: fast/dom/css-shorthand-common-value.html
+
+        CSSMutableStyleDeclaration::getCommonValue() was ignoring values from
+        properties that were implicitly set, which led to erroneous results
+        from getPropertyValue().
+
+        * css/CSSMutableStyleDeclaration.cpp:
+        (WebCore::CSSMutableStyleDeclaration::getCommonValue):
+
+2010-10-07  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        REGRESSION: Indenting pre duplicates content
+        https://bugs.webkit.org/show_bug.cgi?id=47233
+
+        The bug was caused by our not splitting text nodes properly.
+
+        In new approach, we split text nodes in each iteration. Added rangeForParagraphSplitingTextNodesIfNeeded
+        to split text nodes at the start and at the end of paragraph, which also adjusts start and end positions
+        for moveParagraphWithClones. Added endOfNextParagrahSplittingTextNodesIfNeeded to adjust endOfNextParagraph,
+        start, and end to work-around moveParagraphWithClones's removing a line feed.
+
+        Tests: editing/execCommand/indent-pre-list.html
+               editing/execCommand/indent-pre-paragraphs.html
+
+        * editing/ApplyBlockElementCommand.cpp:
+        (WebCore::ApplyBlockElementCommand::formatSelection): See above.
+        (WebCore::isNewLineAtPosition):
+        (WebCore::renderStyleOfEnclosingTextNode): Added.
+        (WebCore::ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded): Added.
+        (WebCore::ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfNeeded): Added.
+        * editing/ApplyBlockElementCommand.h:
+        * editing/FormatBlockCommand.cpp:
+        (WebCore::FormatBlockCommand::formatRange): Takes two Positions instead of one VisiblePosition.
+        * editing/FormatBlockCommand.h:
+        * editing/IndentOutdentCommand.cpp:
+        (WebCore::IndentOutdentCommand::tryIndentingAsListItem): Ditto.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): Ditto.
+        (WebCore::IndentOutdentCommand::formatRange): Ditto.
+        * editing/IndentOutdentCommand.h:
+
+2010-10-07  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Support generating a FormData object based on the data in an existing <form>.
+        https://bugs.webkit.org/show_bug.cgi?id=45929
+
+        Test: http/tests/local/formdata/send-form-data-constructed-from-form.html
+
+        * bindings/js/JSDOMFormDataCustom.cpp:
+        (WebCore::toHTMLFormElement):
+        (WebCore::JSDOMFormDataConstructor::constructJSDOMFormData):
+        * bindings/v8/custom/V8DOMFormDataCustom.cpp:
+        (WebCore::V8DOMFormData::constructorCallback):
+        * html/DOMFormData.cpp:
+        (WebCore::DOMFormData::DOMFormData):
+        * html/DOMFormData.h:
+        (WebCore::DOMFormData::create):
+        * html/DOMFormData.idl:
+
+2010-10-07  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dave Hyatt.
+
+        Set the m_selectedChildren flag on the root inline box if one of the leaf 
+        inline box from the bidi runs walk has a selection state. Remove the flag
+        setting logic from addToLine, since line boxes created in createLinesBoxes
+        should not be propagating selection state to root inline box.
+        https://bugs.webkit.org/show_bug.cgi?id=47201
+
+        Test: editing/selection/root-inlinebox-selected-children-crash.html
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::addToLine):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::constructLine):
+
+2010-10-07  Benjamin Otte  <otte@gnome.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Code cleanup in PluginViewGtk.cpp for transparent plugins
+        https://bugs.webkit.org/show_bug.cgi?id=47361
+
+        Reduce some code in PluginViewGtk.cpp by doing things with Cairo instead
+        of directly with X11. This should work fine with GDK double-buffering, but
+        if we ever disable it, we'll need to verify that this is still functioning
+        properly.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::paint): Do a bit of code cleanup.
+
+2010-10-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a WKPageFindClient, hook up WKPageCountStringMatches
+        https://bugs.webkit.org/show_bug.cgi?id=47373
+
+        Export find related symbols needed by WebKit2.
+
+        * WebCore.exp.in:
+
+2010-10-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47370
+        
+        Make line box placement in the inline direction writing-mode-aware.  Lines now set their y-position instead of x-position
+        when vertical.
+        
+        Refactored shadow overflow to give text-shadow the same helpers in RenderStyle that box-shadow has so that the shadow-walking loop in
+        placeBoxesInInlineDirection can be replaced with the helper.
+
+        Overflow had to be patched to be writing-mode-aware so that the correct physical directions would be set for vertical line
+        boxes.
+
+        Vertical lines are still not testable until they can be placed in the block direction.  Then the render tree dumps
+        become meaningful (even if the pixel results look horrible).
+
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::logicalRight):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        * rendering/InlineFlowBox.h:
+        (WebCore::InlineFlowBox::logicalLeftLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalRightLayoutOverflow):
+        (WebCore::InlineFlowBox::logicalLeftVisualOverflow):
+        (WebCore::InlineFlowBox::logicalRightVisualOverflow):
+        (WebCore::InlineFlowBox::setInlineDirectionOverflowPositions):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::getShadowExtent):
+        (WebCore::RenderStyle::getShadowHorizontalExtent):
+        (WebCore::RenderStyle::getShadowVerticalExtent):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::getTextShadowExtent):
+        (WebCore::InheritedFlags::getTextShadowHorizontalExtent):
+        (WebCore::InheritedFlags::getTextShadowVerticalExtent):
+        (WebCore::InheritedFlags::getTextShadowInlineDirectionExtent):
+        (WebCore::InheritedFlags::getBoxShadowExtent):
+        (WebCore::InheritedFlags::getBoxShadowHorizontalExtent):
+        (WebCore::InheritedFlags::getBoxShadowVerticalExtent):
+        (WebCore::InheritedFlags::getBoxShadowInlineDirectionExtent):
+        (WebCore::InheritedFlags::getShadowInlineDirectionExtent):
+
+2010-10-07  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        <rdar://problem/8142645> REGRESSION (r47440): Printing Mail messages with large fonts does not fill page
+        https://bugs.webkit.org/show_bug.cgi?id=47374
+
+        In the legacy (paint-time pagination) printing model, when there are overlapping lines,
+        adjustPageHeightDeprecated() was not idempotent, since the truncation point imposed by line n,
+        namely the top of line n, was above the bottom of line n-1, so in the next round, line n-1
+        moved the truncation point up again.
+
+        * rendering/RenderLineBoxList.cpp:
+        (WebCore::RenderLineBoxList::paint): Consider the top of the next line when deciding if the
+        current line extends below the truncation point.
+
+2010-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Use isIdentityOrTranslationOrFlipped() in scrollbar code
+        https://bugs.webkit.org/show_bug.cgi?id=47378
+
+        Replace old code that looked at values in the CGAffineTransform
+        with nicely named method that does the same test.
+
+        * platform/mac/ScrollbarThemeMac.mm:
+        (WebCore::ScrollbarThemeMac::paint):
+
+2010-10-07  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        Edge fringe artifact with transformed, masked elements (including reflections)
+        https://bugs.webkit.org/show_bug.cgi?id=19179
+        
+        When drawing the mask images, use a transparency layer if the CTM
+        has a rotation, scale or skew in it to avoid antialiasing issues at
+        the edges.
+
+        Test: fast/css/transformed-mask.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::paintMask): Don't bother painting the mask if
+        painting is disabled, which also avoids an assertion in getCTM().
+        (WebCore::RenderBox::paintMaskImages):
+
+2010-10-07  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Map non-alphabet key code to Unicode value
+        https://bugs.webkit.org/show_bug.cgi?id=46002
+
+        Non-alphabet key codes are not equal to the unicode values. Add conversion.
+
+        * platform/brew/PlatformKeyboardEventBrew.cpp:
+        (WebCore::singleCharacterString):
+
+2010-10-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] The FreeType backend does not respect the FC_EMBOLDEN property
+        https://bugs.webkit.org/show_bug.cgi?id=46216
+
+        Look for the FC_EMBOLDEN property of the FcPattern when constructing
+        FontPlatformData and use it to enable synthetic bold fonts when necessary.
+
+        Test: platform/gtk/fonts/fontconfig-synthetic-bold.html
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Properly handle the FC_EMBOLDEN property.
+
+2010-10-07  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        [Web Timing] Use platform definition of responseEnd
+        https://bugs.webkit.org/show_bug.cgi?id=46306
+
+        No new tests. Used existing webtiming test.
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::didFinishLoading):
+
+2010-10-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [Gtk] CSS font-style: italic behavior
+        https://bugs.webkit.org/show_bug.cgi?id=33299
+
+        Properly interpret the FC_MATRIX property from a FontConfig pattern.
+        FontConfig will use this property when returning fonts which have a
+        synthetic oblique variant configured in the fonts.conf configuration
+        file.
+
+        Test: platform/gtk/fonts/fontconfig-synthetic-oblique.html
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Added a constructor that
+        takes an existing FontPlatformData and a font size.
+        (WebCore::FontPlatformData::initializeWithFontFace): Added this helper
+        intialization method that properly handles the FC_MATRIX property from
+        the FcPattern.
+        * platform/graphics/cairo/FontPlatformDataFreeType.h: Added a declaration
+        to the new constructor and the initializeWithFontFace.
+        * platform/graphics/cairo/SimpleFontDataCairo.cpp:
+        (WebCore::SimpleFontData::smallCapsFontData): Use the new FontPlatformData
+        constructor.
+
+2010-10-07  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47357
+        
+        Make findNextLineBreak and some of the helper functions it also calls writing-mode-aware.
+
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::computeLogicalBoxHeights):
+        (WebCore::InlineFlowBox::placeBoxesInBlockDirection):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::inlineLogicalWidth):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::inlineFlowRequiresLineBox):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::fitBelowFloats):
+        (WebCore::RenderBlock::findNextLineBreak):
+        * rendering/RenderBoxModelObject.h:
+        (WebCore::RenderBoxModelObject::hasInlineDirectionBordersPaddingOrMargin):
+        (WebCore::RenderBoxModelObject::hasInlineDirectionBordersOrPadding):
+
+2010-10-07  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fixing viewport meta tag user-scalable handling
+        https://bugs.webkit.org/show_bug.cgi?id=47330
+
+        user-scalable attribute was not considered in viewport meta tag handling.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::findConfigurationForViewportData):
+        * dom/ViewportArguments.h:
+
+2010-10-05  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Hook up accelerometer data via Qt DeviceMotion
+        https://bugs.webkit.org/show_bug.cgi?id=47105
+
+        Get accelerometer necessary data via Qt mobility library using a
+        provider class. Enable, also the RotationRate using the current device
+        orientation provider.
+
+        * WebCore.pro:
+
+2010-10-07  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Some viewport meta tag api refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=47334
+
+        WebCore::findConfigurationForViewportData renamed to computeViewportAttributes.
+        WebCore::ViewportAttributes::layoutViewport renamed to layoutSize.
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::computeViewportAttributes):
+        * dom/ViewportArguments.h:
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Don't use GtkObject
+        https://bugs.webkit.org/show_bug.cgi?id=47090
+
+        GtkObject has been removed in gtk3.
+
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_class_init):
+        (gtk_xtbin_dispose):
+
+2010-10-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: highlight XHR breakpoint when hit.
+        https://bugs.webkit.org/show_bug.cgi?id=47253
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::setNativeBreakpoint):
+        (WebCore::InspectorController::removeNativeBreakpoint):
+        (WebCore::InspectorController::findEventListenerBreakpoint):
+        (WebCore::InspectorController::findXHRBreakpoint):
+        * inspector/InspectorController.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::instrumentWillDispatchEventImpl):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequestImpl):
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint):
+        (WebInspector.BreakpointManager.prototype._xhrBreakpointRemoved):
+        (WebInspector.BreakpointManager.prototype._removeNativeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setNativeBreakpointEnabled):
+        (WebInspector.BreakpointManager.prototype._setNativeBreakpointOnBackend.didSetNativeBreakpoint):
+        (WebInspector.BreakpointManager.prototype._setNativeBreakpointOnBackend):
+        (WebInspector.BreakpointManager.prototype._removeNativeBreakpointFromBackend):
+        (WebInspector.BreakpointManager.prototype.debuggerPaused):
+        (WebInspector.BreakpointManager.prototype.debuggerResumed):
+        (WebInspector.NativeBreakpoint):
+        (WebInspector.NativeBreakpoint.prototype.get enabled):
+        (WebInspector.NativeBreakpoint.prototype.set enabled):
+        (WebInspector.NativeBreakpoint.prototype.remove):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.BreakpointItem):
+        (WebInspector.BreakpointItem.prototype._breakpointClicked):
+        (WebInspector.BreakpointItem.prototype._hitStateChanged):
+        * inspector/front-end/CallStackSidebarPane.js:
+        (WebInspector.CallStackSidebarPane.prototype.updateStatus):
+        * inspector/front-end/inspector.css:
+        (.breakpoint-list .breakpoint-hit):
+        * inspector/front-end/inspector.js:
+        (WebInspector.pausedScript):
+        (WebInspector.resumedScript):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Use GdkVisual instead of GdkColormap. GdkColormap has been removed
+        in gtk3.
+
+        * plugins/gtk/PluginViewGtk.cpp:
+        (WebCore::PluginView::platformStart):
+        * plugins/gtk/gtk2xtbin.c:
+        (gtk_xtbin_new):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Do not use GdkDrawable deprecated API. Some methods of GdkDrawable
+        are deprecated in gtk2 and have been removed in gtk3. Equivalent
+        API has been added to GdkWindow.
+
+        * platform/gtk/GtkVersioning.c:
+        (getDefaultGDKPointerDevice):
+        * platform/gtk/GtkVersioning.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenAvailableRect):
+
+2010-10-06  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Disconnect signals before destroying MediaPlayerPrivateQt
+
+        https://bugs.webkit.org/show_bug.cgi?id=47073
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+
+2010-10-07  Alexander Pavlov  <apavlov@chromium.org>
+
+        Unreviewed, release build fix.
+
+        * inspector/InspectorStyleSheet.cpp:
+        (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):
+        * inspector/InspectorStyleSheet.h:
+        (WebCore::InspectorStyleSheetForInlineStyle::styleForId):
+        (WebCore::InspectorStyleSheetForInlineStyle::ruleSourceDataFor):
+
+2010-10-07  Pavel Podivilov  <podivilov@chromium.org>
+
+        Unreviewed, build fix.
+
+        Build fix for r69283.
+
+        * dom/Document.cpp:
+        (WebCore::Document::inspectorController):
+        * dom/Document.h:
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Don't use gtk_size_request_get_size(). It has been removed,
+        gtk_widget_get_preferred_size() should be used instead
+
+        * platform/gtk/PopupMenuGtk.cpp:
+        (WebCore::PopupMenuGtk::show):
+
+2010-10-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: Implement handling of CSS operations in InspectorCSSAgent.
+        Property toggling not implemented yet. The code is not going live.
+        https://bugs.webkit.org/show_bug.cgi?id=45825
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * inspector/InspectorCSSAgent.cpp: Added.
+        (WebCore::InspectorCSSAgent::buildObjectForStyle):
+        (WebCore::InspectorCSSAgent::parentStyleSheet):
+        (WebCore::InspectorCSSAgent::asCSSStyleRule):
+        (WebCore::InspectorCSSAgent::InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::~InspectorCSSAgent):
+        (WebCore::InspectorCSSAgent::reset):
+        (WebCore::InspectorCSSAgent::getMatchedRulesForNode2):
+        (WebCore::InspectorCSSAgent::getMatchedPseudoRulesForNode2):
+        (WebCore::InspectorCSSAgent::getAttributeStylesForNode2):
+        (WebCore::InspectorCSSAgent::getInlineStyleForNode2):
+        (WebCore::InspectorCSSAgent::getComputedStyleForNode2):
+        (WebCore::InspectorCSSAgent::getInheritedStylesForNode2):
+        (WebCore::InspectorCSSAgent::getAllStyles2):
+        (WebCore::InspectorCSSAgent::getStyleSheet2):
+        (WebCore::InspectorCSSAgent::setStyleSheetText2):
+        (WebCore::InspectorCSSAgent::setStyleText2):
+        (WebCore::InspectorCSSAgent::toggleProperty2):
+        (WebCore::InspectorCSSAgent::setRuleSelector2):
+        (WebCore::InspectorCSSAgent::addRule2):
+        (WebCore::InspectorCSSAgent::getSupportedCSSProperties):
+        (WebCore::InspectorCSSAgent::inlineStyleElement):
+        (WebCore::InspectorCSSAgent::populateObjectWithStyleProperties):
+        (WebCore::InspectorCSSAgent::shorthandValue):
+        (WebCore::InspectorCSSAgent::shorthandPriority):
+        (WebCore::InspectorCSSAgent::longhandProperties):
+        (WebCore::InspectorCSSAgent::asInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::elementForId):
+        (WebCore::InspectorCSSAgent::bindStyleSheet):
+        (WebCore::InspectorCSSAgent::viaInspectorStyleSheet):
+        (WebCore::InspectorCSSAgent::styleSheetForId):
+        (WebCore::InspectorCSSAgent::detectOrigin):
+        (WebCore::InspectorCSSAgent::buildArrayForRuleList):
+        (WebCore::InspectorCSSAgent::buildObjectForAttributeStyles):
+        (WebCore::InspectorCSSAgent::didRemoveDocument):
+        (WebCore::InspectorCSSAgent::didRemoveDOMNode):
+        * inspector/InspectorCSSAgent.h: Added.
+        (WebCore::InspectorCSSAgent::create):
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::InspectorDOMAgent):
+        (WebCore::InspectorDOMAgent::setDOMListener):
+        (WebCore::InspectorDOMAgent::unbind):
+        (WebCore::InspectorDOMAgent::didRemoveDOMNode):
+        (WebCore::InspectorDOMAgent::getSupportedCSSProperties):
+        * inspector/InspectorDOMAgent.h:
+        (WebCore::InspectorDOMAgent::DOMListener::~DOMListener):
+        (WebCore::InspectorDOMAgent::documents):
+        * inspector/InspectorStyleSheet.cpp: Added.
+        (ParsedStyleSheet::cssStyleSheet):
+        (ParsedStyleSheet::text):
+        (ParsedStyleSheet::hasText):
+        (ParsedStyleSheet::sourceData):
+        (ParsedStyleSheet::hasSourceData):
+        (ParsedStyleSheet::ParsedStyleSheet):
+        (ParsedStyleSheet::setText):
+        (ParsedStyleSheet::setSourceData):
+        (ParsedStyleSheet::ruleSourceDataAt):
+        (WebCore::InspectorStyleSheet::InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::~InspectorStyleSheet):
+        (WebCore::InspectorStyleSheet::setText):
+        (WebCore::InspectorStyleSheet::setRuleSelector):
+        (WebCore::InspectorStyleSheet::addRule):
+        (WebCore::InspectorStyleSheet::ruleForId):
+        (WebCore::InspectorStyleSheet::buildObjectForStyleSheet):
+        (WebCore::InspectorStyleSheet::buildObjectForRule):
+        (WebCore::InspectorStyleSheet::buildObjectForStyle):
+        (WebCore::InspectorStyleSheet::styleForId):
+        (WebCore::InspectorStyleSheet::setStyleText):
+        (WebCore::InspectorStyleSheet::ownerDocument):
+        (WebCore::InspectorStyleSheet::ruleSourceDataFor):
+        (WebCore::InspectorStyleSheet::ruleIndexByStyle):
+        (WebCore::InspectorStyleSheet::ensureParsedDataReady):
+        (WebCore::InspectorStyleSheet::text):
+        (WebCore::InspectorStyleSheet::ensureText):
+        (WebCore::InspectorStyleSheet::ensureSourceData):
+        (WebCore::InspectorStyleSheet::innerSetStyleSheetText):
+        (WebCore::InspectorStyleSheet::innerSetStyleText):
+        (WebCore::InspectorStyleSheet::styleSheetTextWithChangedStyle):
+        (WebCore::InspectorStyleSheet::findPageRuleWithStyle):
+        (WebCore::InspectorStyleSheet::fullRuleId):
+        (WebCore::InspectorStyleSheet::revalidateStyle):
+        (WebCore::InspectorStyleSheet::styleSheetText):
+        (WebCore::InspectorStyleSheet::resourceStyleSheetText):
+        (WebCore::InspectorStyleSheet::inlineStyleSheetText):
+        (WebCore::InspectorStyleSheet::buildArrayForRuleList):
+        (WebCore::InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle):
+        (WebCore::InspectorStyleSheetForInlineStyle::setStyleText):
+        (WebCore::InspectorStyleSheetForInlineStyle::ownerDocument):
+        (WebCore::InspectorStyleSheetForInlineStyle::ensureParsedDataReady):
+        (WebCore::InspectorStyleSheetForInlineStyle::inlineStyle):
+        (WebCore::InspectorStyleSheetForInlineStyle::getStyleAttributeRanges):
+        * inspector/InspectorStyleSheet.h: Added.
+        (WebCore::InspectorStyleSheet::create):
+        (WebCore::InspectorStyleSheet::id):
+        (WebCore::InspectorStyleSheet::pageStyleSheet):
+        (WebCore::InspectorStyleSheet::canBind):
+        (WebCore::InspectorStyleSheet::fullRuleOrStyleId):
+        (WebCore::InspectorStyleSheet::ruleOrStyleId):
+        (WebCore::InspectorStyleSheet::fullStyleId):
+        (WebCore::InspectorStyleSheetForInlineStyle::create):
+        (WebCore::InspectorStyleSheetForInlineStyle::styleForId):
+        (WebCore::InspectorStyleSheetForInlineStyle::ruleSourceDataFor):
+        (WebCore::InspectorStyleSheetForInlineStyle::ruleIndexByStyle):
+        * inspector/InspectorUtilities.cpp: Added.
+        (WebCore::InspectorUtilities::resourceContentForURL):
+        * inspector/InspectorUtilities.h: Added.
+
+2010-10-05  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract Inspector Instrumentation API as a class
+        https://bugs.webkit.org/show_bug.cgi?id=47173
+
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/js/ScriptController.cpp:
+        (WebCore::ScriptController::evaluateInWorld):
+        * bindings/v8/V8DOMWindowShell.cpp:
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::evaluate):
+        (WebCore::V8Proxy::callFunction):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * dom/Document.cpp:
+        (WebCore::Document::recalcStyle):
+        * dom/Document.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * html/parser/HTMLDocumentParser.cpp:
+        (WebCore::HTMLDocumentParser::pumpTokenizer):
+        * html/parser/HTMLDocumentParser.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::InspectorInstrumentation::hasFrontend):
+        (WebCore::InspectorInstrumentation::retrieveTimelineAgent):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::hasFrontends):
+        (WebCore::InspectorInstrumentation::inspectorControllerForContext):
+        (WebCore::InspectorInstrumentation::inspectorControllerForDocument):
+        (WebCore::InspectorInstrumentation::inspectorControllerForFrame):
+        (WebCore::InspectorInstrumentation::inspectorControllerForPage):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        (WebCore::InspectorTimelineAgent::~InspectorTimelineAgent):
+        * inspector/InspectorTimelineAgent.h:
+        * loader/ResourceLoader.cpp:
+        (WebCore::ResourceLoader::didReceiveResponse):
+        (WebCore::ResourceLoader::didReceiveData):
+        * loader/loader.cpp:
+        (WebCore::Loader::load):
+        * page/DOMTimer.cpp:
+        (WebCore::DOMTimer::install):
+        (WebCore::DOMTimer::removeById):
+        (WebCore::DOMTimer::fired):
+        * page/DOMTimer.h:
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::dispatchEvent):
+        * page/DOMWindow.h:
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        (WebCore::FrameView::paintContents):
+        * page/FrameView.h:
+        * page/Page.cpp:
+        * page/Page.h:
+        * rendering/RenderLayerBacking.cpp:
+        (WebCore::RenderLayerBacking::paintContents):
+        * xml/XMLHttpRequest.cpp:
+        (WebCore::XMLHttpRequest::callReadyStateChangeListener):
+
+2010-10-07  Zraly Mike  <mike.zraly@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        Windowless flash plugin is not rendered in Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=47172
+
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::platformStart):
+        Add call to updatePluginWidget() following changes to
+        platform widget.  This is needed to set PluginView's
+        m_windowRect and m_clipRect members properly after
+        the proxy widget and its container get created.
+
+2010-10-07  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Rename (and move) RenderPath to svg/RenderSVGPath
+        https://bugs.webkit.org/show_bug.cgi?id=47053
+
+        Also renamed RenderObject::isRenderPath() to isSVGPath()
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.order:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGPath):
+        * rendering/RenderPath.cpp: Removed.
+        * rendering/RenderPath.h: Removed.
+        * rendering/RenderSVGHiddenContainer.cpp:
+        * rendering/RenderSVGResourceClipper.cpp:
+        (WebCore::RenderSVGResourceClipper::drawContentIntoMaskImage):
+        (WebCore::RenderSVGResourceClipper::calculateClipContentRepaintRect):
+        (WebCore::RenderSVGResourceClipper::hitTestClipContent):
+        * rendering/RenderSVGResourceContainer.cpp:
+        (WebCore::RenderSVGResourceContainer::transformOnNonScalingStroke):
+        * rendering/RenderSVGResourceSolidColor.cpp:
+        (WebCore::RenderSVGResourceSolidColor::postApplyResource):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::write):
+        * rendering/SVGRenderSupport.cpp:
+        (WebCore::SVGRenderSupport::layoutChildren):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeStyle):
+        (WebCore::operator<<):
+        (WebCore::write):
+        * rendering/SVGRenderTreeAsText.h:
+        * rendering/style/SVGRenderStyle.cpp:
+        (WebCore::SVGRenderStyle::diff):
+        * rendering/svg/RenderSVGPath.cpp: Copied from WebCore/rendering/RenderPath.cpp.
+        (WebCore::RenderSVGPath::RenderSVGPath):
+        (WebCore::RenderSVGPath::fillContains):
+        (WebCore::RenderSVGPath::strokeContains):
+        (WebCore::RenderSVGPath::layout):
+        (WebCore::RenderSVGPath::fillAndStrokePath):
+        (WebCore::RenderSVGPath::paint):
+        (WebCore::RenderSVGPath::addFocusRingRects):
+        (WebCore::RenderSVGPath::nodeAtFloatPoint):
+        (WebCore::RenderSVGPath::calculateMarkerBoundsIfNeeded):
+        (WebCore::RenderSVGPath::updateCachedBoundaries):
+        * rendering/svg/RenderSVGPath.h: Copied from WebCore/rendering/RenderPath.h.
+        (WebCore::RenderSVGPath::isSVGPath):
+        (WebCore::RenderSVGPath::renderName):
+        (WebCore::toRenderSVGPath):
+        * svg/SVGCircleElement.cpp:
+        (WebCore::SVGCircleElement::svgAttributeChanged):
+        * svg/SVGEllipseElement.cpp:
+        (WebCore::SVGEllipseElement::svgAttributeChanged):
+        * svg/SVGGradientElement.cpp:
+        * svg/SVGLineElement.cpp:
+        (WebCore::SVGLineElement::svgAttributeChanged):
+        * svg/SVGPathElement.cpp:
+        (WebCore::SVGPathElement::svgAttributeChanged):
+        * svg/SVGPolyElement.cpp:
+        (WebCore::SVGPolyElement::svgAttributeChanged):
+        * svg/SVGRectElement.cpp:
+        (WebCore::SVGRectElement::svgAttributeChanged):
+        * svg/SVGStyledLocatableElement.cpp:
+        * svg/SVGStyledTransformableElement.cpp:
+        (WebCore::SVGStyledTransformableElement::createRenderer):
+
+2010-10-06  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: clear line highlight when switching current view
+        https://bugs.webkit.org/show_bug.cgi?id=47262
+
+        * inspector/front-end/SourceFrame.js:
+        (WebInspector.SourceFrame.prototype.clearLineHighlight):
+        * inspector/front-end/SourceView.js:
+        (WebInspector.SourceView.prototype.hide):
+        * inspector/front-end/TextViewer.js:
+        (WebInspector.TextViewer.prototype.highlightLine):
+        (WebInspector.TextViewer.prototype.clearLineHighlight):
+
+2010-10-06  Chris Evans  <cevans@google.com>
+
+        Reviewed by David Levin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47313
+
+        Fix integer errors with enormous input strings to newline normalization APIs.
+
+        * platform/text/LineEnding.cpp:
+        (WebCore::normalizeLineEndingsToCRLF): return the empty string upon huge input strings. (Behaves similarly to base64Encode now).
+        (WebCore::normalizeToCROrLF): use the correct type for a string length.
+
+2010-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, build fix.
+
+        Windows build fix for r69272.
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::stepBase):
+         Use defaultStepBase() instead of defaultStepBase.
+        * html/InputType.h:
+        (WebCore::InputType::defaultStepBase):
+         Make defaultStepBase static function.
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::stepBase):
+         Use defaultStepBase() instead of defaultStepBase.
+
+2010-10-06  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Move range/step related functions
+        https://bugs.webkit.org/show_bug.cgi?id=47251
+
+        Move the content of the following functions:
+         - rangeUnderflow()
+         - rangeOverflow()
+         - minimum()
+         - maximum()
+         - stepMismatch()
+         - stepBase()
+
+        getStepParameters() was split into InputType::defaultStep() and
+        stepScaleFactor().
+
+        * html/BaseDateAndTimeInputType.cpp:
+        (WebCore::BaseDateAndTimeInputType::rangeUnderflow):
+        (WebCore::BaseDateAndTimeInputType::rangeOverflow):
+        (WebCore::BaseDateAndTimeInputType::stepMismatch):
+        (WebCore::BaseDateAndTimeInputType::stepBase):
+        * html/BaseDateAndTimeInputType.h:
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::minimum):
+        (WebCore::DateInputType::maximum):
+        (WebCore::DateInputType::defaultStep):
+        (WebCore::DateInputType::stepScaleFactor):
+        (WebCore::DateInputType::parsedStepValueShouldBeInteger):
+        * html/DateInputType.h:
+        * html/DateTimeInputType.cpp:
+        (WebCore::DateTimeInputType::minimum):
+        (WebCore::DateTimeInputType::maximum):
+        (WebCore::DateTimeInputType::defaultStep):
+        (WebCore::DateTimeInputType::stepScaleFactor):
+        (WebCore::DateTimeInputType::scaledStepValeuShouldBeInteger):
+        * html/DateTimeInputType.h:
+        * html/DateTimeLocalInputType.cpp:
+        (WebCore::DateTimeLocalInputType::minimum):
+        (WebCore::DateTimeLocalInputType::maximum):
+        (WebCore::DateTimeLocalInputType::defaultStep):
+        (WebCore::DateTimeLocalInputType::stepScaleFactor):
+        (WebCore::DateTimeLocalInputType::scaledStepValeuShouldBeInteger):
+        * html/DateTimeLocalInputType.h:
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::minimum):
+        (WebCore::HTMLInputElement::maximum):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::getAllowedValueStep):
+        (WebCore::HTMLInputElement::applyStep):
+        (WebCore::HTMLInputElement::handleKeyEventForRange):
+        (WebCore::HTMLInputElement::stepUpFromRenderer):
+        * html/HTMLInputElement.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::patternMismatch):
+        (WebCore::InputType::rangeUnderflow):
+        (WebCore::InputType::rangeOverflow):
+        (WebCore::InputType::minimum):
+        (WebCore::InputType::maximum):
+        (WebCore::InputType::stepMismatch):
+        (WebCore::InputType::stepBase):
+        (WebCore::InputType::defaultStep):
+        (WebCore::InputType::stepScaleFactor):
+        (WebCore::InputType::parsedStepValueShouldBeInteger):
+        (WebCore::InputType::scaledStepValeuShouldBeInteger):
+        * html/InputType.h:
+        * html/MonthInputType.cpp:
+        (WebCore::MonthInputType::minimum):
+        (WebCore::MonthInputType::maximum):
+        (WebCore::MonthInputType::defaultStep):
+        (WebCore::MonthInputType::stepScaleFactor):
+        (WebCore::MonthInputType::parsedStepValueShouldBeInteger):
+        * html/MonthInputType.h:
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::rangeUnderflow):
+        (WebCore::NumberInputType::rangeOverflow):
+        (WebCore::NumberInputType::minimum):
+        (WebCore::NumberInputType::maximum):
+        (WebCore::NumberInputType::stepMismatch):
+        (WebCore::NumberInputType::stepBase):
+        (WebCore::NumberInputType::defaultStep):
+        (WebCore::NumberInputType::stepScaleFactor):
+        * html/NumberInputType.h:
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::rangeUnderflow):
+        (WebCore::RangeInputType::rangeOverflow):
+        (WebCore::RangeInputType::minimum):
+        (WebCore::RangeInputType::maximum):
+        (WebCore::RangeInputType::stepMismatch):
+        (WebCore::RangeInputType::stepBase):
+        (WebCore::RangeInputType::defaultStep):
+        (WebCore::RangeInputType::stepScaleFactor):
+        * html/RangeInputType.h:
+        * html/TimeInputType.cpp:
+        (WebCore::TimeInputType::minimum):
+        (WebCore::TimeInputType::maximum):
+        (WebCore::TimeInputType::defaultStep):
+        (WebCore::TimeInputType::stepScaleFactor):
+        (WebCore::TimeInputType::scaledStepValeuShouldBeInteger):
+        * html/TimeInputType.h:
+        * html/WeekInputType.cpp:
+        (WebCore::WeekInputType::minimum):
+        (WebCore::WeekInputType::maximum):
+        (WebCore::WeekInputType::stepBase):
+        (WebCore::WeekInputType::defaultStep):
+        (WebCore::WeekInputType::stepScaleFactor):
+        (WebCore::WeekInputType::parsedStepValueShouldBeInteger):
+        * html/WeekInputType.h:
+
+2010-10-06  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein, Darin Adler.
+
+        :first-letter should apply to "punctuation" after the first letter
+        https://bugs.webkit.org/show_bug.cgi?id=45986
+        
+        Follow the CSS 2.1 spec by allow certain kinds of punctuation before and after
+        the :first-letter character.
+        
+        The spec does not describe whitespace behavior, and browsers are inconsistent.
+        This patch allows whitespace (including non-breaking spaces) before and after the
+        leading punctuation, and before the trailing punctuation.
+
+        Test: fast/css/first-letter-punctuation.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::isPunctuationForFirstLetter):
+        (WebCore::shouldSkipForFirstLetter):
+        (WebCore::RenderBlock::updateFirstLetter):
+
+2010-10-06  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Released the pluginNode in PluginDocument::detach() and prevents a memory leak.
+        https://bugs.webkit.org/show_bug.cgi?id=47129
+
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocument::detach):
+        * html/PluginDocument.h:
+
+2010-10-06  Vincent Scheib  <scheib@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] Thumbnail generation asserts on zero alpha values.
+        https://bugs.webkit.org/show_bug.cgi?id=47292
+
+        Test: Tested manually by running debug mode, and analyzing in PIX.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::drawLayers):
+
+2010-10-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed, trying to fix chromium Windows build.
+
+        Explicitly give the parameter value that has a default parameter value.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::requestFileSystem):
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::requestFileSystem):
+
+2010-10-06  Darin Adler  <darin@apple.com>
+
+        Try to fix Windows build.
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::cachedCGColor): Put in braces to make the Windows compiler
+        happy with this file.
+
+        * platform/graphics/cg/ImageCG.cpp: Added include of RetainPtr.h.
+
+2010-10-06  Darin Adler  <darin@apple.com>
+
+        Reviewed by Alexey Proskuryakov.
+
+        Cache CGColor as we do NSColor
+        https://bugs.webkit.org/show_bug.cgi?id=47226
+
+        This fixes performance problems on certain web pages that use
+        multiple colors. Once in the past we were using NSColor. Now that
+        we are using CGColor, we need the same sort of caching that we have
+        for NSColor.
+
+        One example: <http://results.active.com/uploads/html/100759.html>.
+
+        * WebCore.xcodeproj/project.pbxproj: Add GraphicsContextCG.h.
+
+        * platform/graphics/Color.h: Replace createCGColor with cachedCGColor.
+
+        * platform/graphics/cg/ColorCG.cpp:
+        (WebCore::cachedCGColorSpace): Added.
+        (WebCore::leakCGColor): Added. 
+        (WebCore::cachedCGColor): Added.
+
+        * platform/graphics/cg/GraphicsContextCG.cpp:
+        (WebCore::setCGFillColor): Use cachedCGColor.
+        (WebCore::setCGStrokeColor): Ditto.
+        (WebCore::GraphicsContext::fillRect): Ditto.
+        (WebCore::GraphicsContext::setPlatformShadow): Ditto.
+
+        * platform/graphics/cg/GraphicsContextCG.h: Added.
+        * platform/graphics/cg/GraphicsContextPlatformPrivateCG.h:
+        Moved the color space functions here.
+
+        * platform/graphics/cg/ImageCG.cpp: Tweaked headers and formatting.
+
+        * platform/graphics/mac/ColorMac.mm: Removed the createCGColor
+        function.
+
+        * platform/graphics/mac/GraphicsContextMac.mm:
+        (WebCore::drawFocusRingToContext): Removed innappropriate use of
+        RetainPtr for the arguments to this function.
+        (WebCore::GraphicsContext::drawFocusRing): Use cachedCGColor.
+
+        * platform/graphics/mac/GraphicsLayerCA.mm:
+        (WebCore::setLayerBorderColor): Use cachedCGColor.
+        (WebCore::setLayerBackgroundColor): Ditto.
+        * platform/graphics/win/GraphicsContextCGWin.cpp:
+        (WebCore::GraphicsContext::drawFocusRing): Ditto.
+        * platform/graphics/win/GraphicsLayerCACF.cpp:
+        (WebCore::setLayerBorderColor): Ditto.
+        (WebCore::setLayerBackgroundColor): Ditto.
+
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        (WebCore::WKCACFLayerRenderer::WKCACFLayerRenderer): Use
+        CGColorCreateGenericRGB for color used only for debugging.
+        * platform/graphics/win/WebTiledLayer.cpp:
+        (WebCore::WebTiledLayer::addTile): Ditto.
+
+2010-10-06  Peter Kasting  <pkasting@google.com>
+
+        Reviewed by James Robinson
+
+        ScrollViews without scrollbars should not eat scroll events
+        https://bugs.webkit.org/show_bug.cgi?id=47036
+
+        * platform/ScrollView.cpp:
+        (WebCore::ScrollView::wheelEvent):
+
+2010-10-06  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Darin Adler.
+
+        ASSERTION FAILURE: Attempt to cast RenderObject to RenderFrameSet
+        when <frameset> has CSS content property
+        https://bugs.webkit.org/show_bug.cgi?id=47314
+
+        Fixes an issue where sending a mouse event to an HTML Frameset Element that
+        whose content was replaced via the CSS content property causes an assertion
+        failure.
+
+        By default, HTMLFrameSetElement forwards mouse events to RenderFrameSet so as
+        to support resizing a frame within the set. When a <frameset> specifies an
+        image in its CSS content property we create a generic render object (RenderObject)
+        for the frame set instead of a RenderFrameSet object. The event handler code
+        in HTMLFrameSetElement calls WebCore::toRenderFrameSet() to cast its renderer
+        to type RenderFrameSet, which fails. To correct this, HTMLFrameSetElement
+        must check that its renderer is of type RenderFrameSet before casting to this type.
+
+        Test: fast/frames/crash-frameset-CSS-content-property.html
+
+        * html/HTMLFrameSetElement.cpp:
+        (WebCore::HTMLFrameSetElement::defaultEventHandler): Check that our renderer is
+        of type RenderFrameSet before casting it as such.
+
+2010-10-06  Albert J. Wong  <ajwong@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        r69181 breaks compilation of WebCore/platform/graphics/filters/FETile.cpp if ENABLE(SVG) is false.
+        https://bugs.webkit.org/show_bug.cgi?id=47315
+
+        Compile fix. No tests.
+
+        * platform/graphics/filters/FETile.cpp:
+        (WebCore::FETile::apply):
+
+2010-10-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed, fixing screwed up ChangeLogs.
+
+2010-10-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add FileSystemSync implementation for Worker
+        https://bugs.webkit.org/show_bug.cgi?id=47044
+
+        Tests: fast/filesystem/async-operations.html
+               fast/filesystem/workers/async-operations.html
+               fast/filesystem/workers/sync-operations.html
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/RuntimeEnabledFeatures.h: Removed
+        requestFileSystemEnabled() as I changed the idl/generator to
+        use fileSystemEnabled for all the FileSystem related features.
+        * fileapi/DOMFileSystem.cpp:
+        * fileapi/DOMFileSystem.h:
+        * fileapi/DOMFileSystemBase.cpp:
+        (WebCore::DOMFileSystemBase::getMetadata): Moved from DOMFileSystem.
+        (WebCore::checkValidityForForCopyOrMove): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::move): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::copy): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::remove): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::getParent): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::getFile): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::getDirectory): Moved from DOMFileSystem.
+        (WebCore::DOMFileSystemBase::readDirectory): Moved from DOMFileSystem.
+        * fileapi/DOMFileSystemBase.h:
+        * fileapi/DOMFileSystemSync.h:
+        * fileapi/DirectoryEntry.cpp:
+        (WebCore::DirectoryEntry::DirectoryEntry): Updated to call
+        DOMFileSystemBase's method instead of DOMFileSystem's one.
+        (WebCore::DirectoryEntry::getFile): Ditto.
+        (WebCore::DirectoryEntry::getDirectory): Ditto.
+        * fileapi/DirectoryEntry.h:
+        * fileapi/DirectoryEntrySync.cpp:
+        (WebCore::DirectoryEntrySync::getFile): Implemented.
+        (WebCore::DirectoryEntrySync::getDirectory): Implemented.
+        * fileapi/DirectoryReader.h:
+        * fileapi/DirectoryReaderSync.cpp:
+        (WebCore::DirectoryReaderSync::readEntries): Implemented.
+        * fileapi/Entry.cpp:
+        (WebCore::Entry::Entry): Updated to call DOMFileSystemBase's method.
+        (WebCore::Entry::getMetadata): Ditto.
+        (WebCore::Entry::moveTo): Ditto.
+        (WebCore::Entry::copyTo): Ditto.
+        (WebCore::Entry::remove): Ditto.
+        (WebCore::Entry::getParent): Ditto.
+        * fileapi/Entry.h:
+        * fileapi/Entry.idl:
+        * fileapi/EntryArraySync.cpp:
+        (WebCore::EntryArraySync::create): Added.
+        * fileapi/EntryArraySync.h:
+        * fileapi/EntryBase.h:
+        (WebCore::EntryBase::filesystem): Added.
+        * fileapi/EntrySync.cpp:
+        (WebCore::EntrySync::create): Implemented.
+        (WebCore::EntrySync::getMetadata): Implemented.
+        (WebCore::EntrySync::moveTo): Implemented.
+        (WebCore::EntrySync::copyTo): Implemented.
+        (WebCore::EntrySync::remove): Implemented.
+        * fileapi/EntrySync.h:
+        * fileapi/FileEntry.cpp:
+        * fileapi/FileEntry.h:
+        * fileapi/FileSystemCallbacks.cpp:
+        (WebCore::EntryCallbacks::create): Updated to take DOMFileSystemBase
+        instead of DOMFileSystem.
+        (WebCore::EntryCallbacks::EntryCallbacks): Ditto.
+        (WebCore::EntriesCallbacks::create): Ditto.
+        (WebCore::EntriesCallbacks::EntriesCallbacks): Ditto.
+        * fileapi/FileSystemCallbacks.h:
+        * fileapi/LocalFileSystem.cpp:
+        (WebCore::LocalFileSystem::requestFileSystem): Added synchronous
+        parameter.
+        * fileapi/LocalFileSystem.h:
+        * fileapi/Metadata.h:
+        * fileapi/SyncCallbackHelper.h: Added. This defines a helper template
+        for synchronous implementation.
+        * page/DOMWindow.idl:
+        * platform/AsyncFileSystem.h:
+        (WebCore::AsyncFileSystem::waitCompletion): Added.
+        * workers/WorkerContext.cpp:
+        (WebCore::WorkerContext::requestFileSystemSync): Added.
+        * workers/WorkerContext.h:
+        * workers/WorkerContext.idl:
+
+2010-10-06  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IDBDatabase and IDBObjectStore metadata is not recovered correctly when the setVersion transactions aborts.
+        https://bugs.webkit.org/show_bug.cgi?id=47245
+
+        Recover metadata properly by adding abort tasks that
+        are run when a transaction aborts.
+ 
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::removeObjectStore):
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreFromMap):
+        (WebCore::IDBDatabaseBackendImpl::addObjectStoreToMap):
+        (WebCore::IDBDatabaseBackendImpl::resetVersion):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndex):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexFromMap):
+        (WebCore::IDBObjectStoreBackendImpl::addIndexToMap):
+        * storage/IDBObjectStoreBackendImpl.h:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        (WebCore::IDBTransactionBackendImpl::abort):
+        * storage/IDBTransactionBackendImpl.h:
+        * storage/IDBTransactionBackendInterface.h:
+        * storage/IDBTransactionCoordinator.h:
+
+2010-10-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47306
+        
+        Convert determineStart/EndPosition and matchedEndLine to be writing-mode-aware.
+
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::determineEndPosition):
+        (WebCore::RenderBlock::matchedEndLine):
+
+22010-10-06  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        REGRESSION (r53857): AREA tag with tabindex="-1" displays focus ring after multiple mouse clicks.
+        https://bugs.webkit.org/show_bug.cgi?id=45832
+
+        Test: fast/events/mouse-focus-imagemap.html
+
+        * html/HTMLAreaElement.cpp:
+        (WebCore::HTMLAreaElement::isKeyboardFocusable):
+        (WebCore::HTMLAreaElement::isMouseFocusable):
+        (WebCore::HTMLAreaElement::isFocusable):
+        (WebCore::HTMLAreaElement::updateFocusAppearance):
+        * html/HTMLAreaElement.h:
+
+010-10-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47303
+
+        Convert layoutInlineChildren to be block-flow-aware.  None of the functions it calls are patched yet.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::forceLayoutInlineChildren):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::beforeSideVisibleOverflowForLine):
+        (WebCore::RenderBlock::afterSideVisibleOverflowForLine):
+        (WebCore::RenderBlock::beforeSideLayoutOverflowForLine):
+        (WebCore::RenderBlock::afterSideLayoutOverflowForLine):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::logicalLeftLayoutOverflow):
+        (WebCore::RenderBox::logicalRightLayoutOverflow):
+        (WebCore::RenderBox::logicalLeftVisualOverflow):
+        (WebCore::RenderBox::logicalRightVisualOverflow):
+
+2010-10-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47298
+        
+        Rename blockHeight to blockLogicalHeight.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::markLinesDirtyInBlockRange):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::computeBlockDirectionPositionsForLine):
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::determineEndPosition):
+        (WebCore::RenderBlock::matchedEndLine):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        (WebCore::RootInlineBox::adjustPosition):
+        * rendering/RootInlineBox.h:
+        (WebCore::RootInlineBox::blockLogicalHeight):
+        (WebCore::RootInlineBox::setBlockLogicalHeight):
+        * rendering/svg/SVGRootInlineBox.cpp:
+        (WebCore::SVGRootInlineBox::layoutRootBox):
+
+2010-10-05  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] DRT assertion w/accel 2D canvas in PlatformContextSkia
+        https://bugs.webkit.org/show_bug.cgi?id=47242
+
+        Call PlatformContextSkia::prepareForSoftwareDraw before doing putImageData
+        since that call mutates the software backing store.
+
+        Test: fast/canvas/canvas-putImageData.html
+
+        * platform/graphics/skia/ImageBufferSkia.cpp:
+        (WebCore::ImageBuffer::putUnmultipliedImageData):
+
+2010-10-06  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47294
+        <rdar://problem/8425647>Application cache isn't consulted on redirect
+
+        Test: http/tests/appcache/main-resource-redirect.html
+
+        * loader/MainResourceLoader.cpp:
+        (WebCore::MainResourceLoader::continueAfterNavigationPolicy): If we have substitute data now
+        (presumably after a redirect is served by appcache), switch to it.
+        (WebCore::MainResourceLoader::willSendRequest): Check appcache for the new URL.
+
+        * loader/MainResourceLoader.h: Made handleDataLoadSoon() take a const ResourceRequest
+        reference - it doesn't ever modify it, and we can call it from continueAfterNavigationPolicy() now.
+
+2010-10-06  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        ContextShadow should not use the blur radius as kernel size of the
+        box blurs
+        https://bugs.webkit.org/show_bug.cgi?id=46918
+
+        Calculate the size of the kernel in the blur algorithm using the radius instead
+        of using the blur distance directly. Change the name of the variables to match the
+        terminology in the spec.
+
+        * platform/graphics/ContextShadow.cpp:
+        (WebCore::ContextShadow::ContextShadow):
+        (WebCore::ContextShadow::clear):
+        (WebCore::ContextShadow::blurLayerImage):
+        (WebCore::ContextShadow::calculateLayerBoundingRect):
+        * platform/graphics/ContextShadow.h:
+
+2010-10-06  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Correct CamelCase of socketSentdata() in SocketStreamHandlePrivate 
+        to fix "QMetaObject::invokeMethod: No such method" warnings in layout tests.
+        https://bugs.webkit.org/show_bug.cgi?id=47284
+
+        No new tests needed.
+
+        * platform/network/qt/SocketStreamHandlePrivate.h:
+        * platform/network/qt/SocketStreamHandleQt.cpp:
+        (WebCore::SocketStreamHandlePrivate::socketSentData):
+
+2010-10-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47285
+
+        Update to the latest writing-mode draft. The block-flow property is gone and has been replaced with writing-mode.
+        Change all the code to use writingMode() instead of blockFlow() and rename all functions that referred to block flow
+        as appropriate.
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator WritingMode):
+        (WebCore::CSSPrimitiveValue::operator SVGWritingMode):
+        * css/CSSProperty.cpp:
+        (WebCore::resolveToPhysicalProperty):
+        (WebCore::CSSProperty::resolveDirectionAwareProperty):
+        * css/CSSProperty.h:
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        (WebCore::CSSStyleSelector::adjustRenderStyle):
+        (WebCore::CSSStyleSelector::applyDeclarations):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::expandsToEncloseOverhangingFloats):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::collapsedMarginBeforeForChild):
+        (WebCore::RenderBlock::collapsedMarginAfterForChild):
+        (WebCore::RenderBlock::marginBeforeForChild):
+        (WebCore::RenderBlock::marginAfterForChild):
+        (WebCore::RenderBlock::marginStartForChild):
+        (WebCore::RenderBlock::marginEndForChild):
+        (WebCore::RenderBlock::setMarginStartForChild):
+        (WebCore::RenderBlock::setMarginEndForChild):
+        (WebCore::RenderBlock::setMarginBeforeForChild):
+        (WebCore::RenderBlock::setMarginAfterForChild):
+        (WebCore::RenderBlock::marginValuesForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalWidthForChild):
+        (WebCore::RenderBlock::logicalHeightForChild):
+        (WebCore::RenderBlock::logicalTopForChild):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+        (WebCore::RenderBlock::logicalTopForFloat):
+        (WebCore::RenderBlock::logicalBottomForFloat):
+        (WebCore::RenderBlock::logicalLeftForFloat):
+        (WebCore::RenderBlock::logicalRightForFloat):
+        (WebCore::RenderBlock::logicalWidthForFloat):
+        (WebCore::RenderBlock::setLogicalTopForFloat):
+        (WebCore::RenderBlock::setLogicalLeftForFloat):
+        (WebCore::RenderBlock::setLogicalHeightForFloat):
+        (WebCore::RenderBlock::setLogicalWidthForFloat):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::marginBefore):
+        (WebCore::RenderBox::marginAfter):
+        (WebCore::RenderBox::marginStart):
+        (WebCore::RenderBox::marginEnd):
+        (WebCore::RenderBox::setMarginStart):
+        (WebCore::RenderBox::setMarginEnd):
+        (WebCore::RenderBox::setMarginBefore):
+        (WebCore::RenderBox::setMarginAfter):
+        (WebCore::RenderBox::styleDidChange):
+        (WebCore::RenderBox::perpendicularContainingBlockLogicalHeight):
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::availableLogicalHeightUsing):
+        (WebCore::RenderBox::avoidsFloats):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::logicalLeft):
+        (WebCore::RenderBox::logicalTop):
+        (WebCore::RenderBox::logicalWidth):
+        (WebCore::RenderBox::logicalHeight):
+        (WebCore::RenderBox::setLogicalLeft):
+        (WebCore::RenderBox::setLogicalTop):
+        (WebCore::RenderBox::setLogicalWidth):
+        (WebCore::RenderBox::setLogicalHeight):
+        (WebCore::RenderBox::setLogicalLocation):
+        (WebCore::RenderBox::contentLogicalWidth):
+        (WebCore::RenderBox::contentLogicalHeight):
+        (WebCore::RenderBox::stretchesToViewport):
+        (WebCore::RenderBox::intrinsicLogicalWidth):
+        (WebCore::RenderBox::intrinsicLogicalHeight):
+        (WebCore::RenderBox::availableWidth):
+        (WebCore::RenderBox::availableHeight):
+        (WebCore::RenderBox::scrollbarLogicalHeight):
+        (WebCore::RenderBox::isWritingModeRoot):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::computeReplacedLogicalWidth):
+        (WebCore::RenderImage::computeReplacedLogicalHeight):
+        * rendering/RenderInline.cpp:
+        (WebCore::RenderInline::marginLeft):
+        (WebCore::RenderInline::marginRight):
+        (WebCore::RenderInline::marginTop):
+        (WebCore::RenderInline::marginBottom):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::paddingTop):
+        (WebCore::RenderTableCell::paddingBottom):
+        (WebCore::RenderTableCell::paddingLeft):
+        (WebCore::RenderTableCell::paddingRight):
+        * rendering/RenderView.h:
+        (WebCore::RenderView::viewLogicalWidth):
+        (WebCore::RenderView::viewLogicalHeight):
+        * rendering/RootInlineBox.cpp:
+        (WebCore::RootInlineBox::RootInlineBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff):
+        (WebCore::RenderStyle::logicalWidth):
+        (WebCore::RenderStyle::logicalHeight):
+        (WebCore::RenderStyle::logicalMinWidth):
+        (WebCore::RenderStyle::logicalMaxWidth):
+        (WebCore::RenderStyle::logicalMinHeight):
+        (WebCore::RenderStyle::logicalMaxHeight):
+        (WebCore::RenderStyle::borderBeforeWidth):
+        (WebCore::RenderStyle::borderAfterWidth):
+        (WebCore::RenderStyle::borderStartWidth):
+        (WebCore::RenderStyle::borderEndWidth):
+        (WebCore::RenderStyle::marginBefore):
+        (WebCore::RenderStyle::marginAfter):
+        (WebCore::RenderStyle::marginBeforeUsing):
+        (WebCore::RenderStyle::marginAfterUsing):
+        (WebCore::RenderStyle::marginStart):
+        (WebCore::RenderStyle::marginEnd):
+        (WebCore::RenderStyle::marginStartUsing):
+        (WebCore::RenderStyle::marginEndUsing):
+        (WebCore::RenderStyle::paddingBefore):
+        (WebCore::RenderStyle::paddingAfter):
+        (WebCore::RenderStyle::paddingStart):
+        (WebCore::RenderStyle::paddingEnd):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::setBitDefaults):
+        (WebCore::InheritedFlags::writingMode):
+        (WebCore::InheritedFlags::isHorizontalWritingMode):
+        (WebCore::InheritedFlags::setWritingMode):
+        (WebCore::InheritedFlags::initialWritingMode):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::initialWritingMode):
+        (WebCore::SVGRenderStyle::setWritingMode):
+        (WebCore::SVGRenderStyle::writingMode):
+        * rendering/style/SVGRenderStyleDefs.h:
+
+2010-10-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69201.
+        http://trac.webkit.org/changeset/69201
+        https://bugs.webkit.org/show_bug.cgi?id=47279
+
+        This change broke the WebKitGTK+ build for GTK+ 2.0.
+        (Requested by mrobinson on #webkit).
+
+        * platform/gtk/GtkVersioning.c:
+        (getDefaultGDKPointerDevice):
+        * platform/gtk/GtkVersioning.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenAvailableRect):
+
+2010-10-06  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by James Robinson.
+        https://bugs.webkit.org/show_bug.cgi?id=47282
+
+        Robustify the creation of SharedGraphicsContext3D against shader
+        compilation failures.
+
+        Covered by any canvas 2D layout test, when opened in chrome with 
+        --enable-accelerated-2d-canvas --in-process-webgl.
+
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        (WebCore::SharedGraphicsContext3D::SharedGraphicsContext3D):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+
+2010-10-06  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Renaming WebCore::ViewportConfiguration to WebCore::ViewportAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=47268
+
+        Renaming WebCore::ViewportConfiguration to WebCore::ViewportAttributes
+
+        * dom/ViewportArguments.cpp:
+        (WebCore::findConfigurationForViewportData):
+        * dom/ViewportArguments.h:
+
+2010-10-06  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGFEMergeNodeElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=47181
+
+        Since feMergeNode doesn't have own renderer, we have to call the invalidation via its parent.
+
+        Tests: svg/dynamic-updates/SVGFEMergeNodeElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFEMergeNodeElement-svgdom-in-prop.html
+
+        * svg/SVGFEMergeNodeElement.cpp:
+        (WebCore::SVGFEMergeNodeElement::svgAttributeChanged):
+        * svg/SVGFEMergeNodeElement.h:
+
+2010-10-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Remove unused code from gtk2drawing.c
+        https://bugs.webkit.org/show_bug.cgi?id=47086
+
+        gtk2drawing.c was copied from mozilla and contains a lot of code that is not
+        used by WebKit. Most of that unused code is uncompatible with gtk3, so
+        removing it will make easier porting to gtk3.
+
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_get_widget_border):
+        (moz_gtk_widget_paint):
+        (moz_gtk_destroy_theme_parts_widgets):
+        * platform/gtk/gtkdrawing.h:
+
+2010-10-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use pixbufs instead of pixmaps when creating platform cursors
+        https://bugs.webkit.org/show_bug.cgi?id=47087
+
+        gdk_cursor_new_from_pixmap() has been removed in gtk3. We can use a
+        pixbuf instead of a pixman and use gdk_cursor_new_from_pixbuf() instead
+        for both gtk2 and gtk3.
+
+        * platform/gtk/CursorGtk.cpp:
+        (WebCore::createNamedCursor):
+        * platform/gtk/GtkVersioning.c:
+        (gdk_cairo_format_for_content):
+        (gdk_cairo_surface_coerce_to_image):
+        (convert_alpha):
+        (convert_no_alpha):
+        (gdk_pixbuf_get_from_surface):
+        * platform/gtk/GtkVersioning.h:
+
+2010-10-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add event listener breakpoints sidebar pane
+        https://bugs.webkit.org/show_bug.cgi?id=46738
+
+        * inspector/front-end/BreakpointManager.js:
+        (WebInspector.BreakpointManager.prototype.createEventListenerBreakpoint):
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint.breakpoint.compareTo):
+        (WebInspector.BreakpointManager.prototype.createXHRBreakpoint):
+        (WebInspector.NativeBreakpoint):
+        (WebInspector.NativeBreakpoint.prototype._setOnBackend.didSet):
+        (WebInspector.NativeBreakpoint.prototype._setOnBackend):
+        * inspector/front-end/BreakpointsSidebarPane.js:
+        (WebInspector.XHRBreakpointsSidebarPane.prototype._showEditBreakpointDialog):
+        (WebInspector.BreakpointItem):
+        (WebInspector.EventListenerBreakpointsSidebarPane):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._populate):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._createCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._categoryCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._eventNameCheckboxClicked):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._breakpointEnableChanged):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype._updateCategoryCheckbox):
+        (WebInspector.EventListenerBreakpointsSidebarPane.prototype.reset):
+        * inspector/front-end/EventListenersSidebarPane.js:
+        ():
+        * inspector/front-end/PropertiesSection.js:
+        (WebInspector.PropertiesSection):
+        * inspector/front-end/ScriptsPanel.js:
+        (WebInspector.ScriptsPanel):
+        (WebInspector.ScriptsPanel.prototype.reset):
+        * inspector/front-end/inspector.css:
+        (.section .properties, .event-bar .event-properties):
+        (.section.expanded .properties, .event-bar.expanded .event-properties):
+        (ol.properties-tree):
+        (ol.properties-tree li):
+        (ol.properties-tree li.parent):
+        (ol.properties-tree li.parent::before):
+        (ol.properties-tree li.parent.expanded::before):
+        (ol.properties-tree li .info):
+        (ol.properties-tree ol, .stack-trace ol, ol.stack-trace):
+        (ol.properties-tree ol.expanded, .stack-trace ol, ol.stack-trace):
+        (ol.stack-trace):
+        (.event-listener-breakpoints .event-category):
+        (ol.event-listener-breakpoints.properties-tree .children li):
+        (.event-listener-breakpoints .checkbox-elem):
+        * inspector/front-end/inspector.js:
+        (WebInspector.createXHRBreakpointsSidebarPane.breakpointAdded):
+        (WebInspector.createXHRBreakpointsSidebarPane):
+
+2010-10-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Port to gtk+3 (2.91.0)
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Do not use GdkDrawable deprecated API
+
+        Some methods of GdkDrawable are deprecated in gtk2 and have been
+        remmoved in gtk3. Equivalent API has been added to GdkWindow.
+
+        * platform/gtk/GtkVersioning.c:
+        (getDefaultGDKPointerDevice):
+        * platform/gtk/GtkVersioning.h:
+        * platform/gtk/PlatformScreenGtk.cpp:
+        (WebCore::getVisual):
+        (WebCore::screenAvailableRect):
+
+2010-10-06  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Support Progress Tag
+        https://bugs.webkit.org/show_bug.cgi?id=45951
+
+        Implement to render progress tag.
+
+        No new tests. Existing tests in fast/dom/HTMLProgressElement.
+
+        * platform/efl/RenderThemeEfl.cpp:
+        (WebCore::RenderThemeEfl::paintThemePart):
+        (WebCore::RenderThemeEfl::edjeGroupFromFormType):
+        (WebCore::RenderThemeEfl::adjustProgressBarStyle):
+        (WebCore::RenderThemeEfl::paintProgressBar):
+        * platform/efl/RenderThemeEfl.h:
+
+2010-10-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add KURL::protocolIsData()
+        https://bugs.webkit.org/show_bug.cgi?id=47219
+
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * page/SecurityOrigin.cpp:
+        (WebCore::SecurityOrigin::taintsCanvas):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+        * platform/KURL.h:
+        (WebCore::KURL::protocolIsData):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::dispatchSynchronousJob):
+        (WebCore::ResourceHandleManager::startJob):
+        * platform/network/win/ResourceHandleWin.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::fileLoadTimer):
+
+2010-10-06  Alexander Pavlov  <apavlov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        CSSParser: Enable rule selector source range extraction.
+        API modification followed by clients.
+        https://bugs.webkit.org/show_bug.cgi?id=46367
+
+        Some code removal suggested by Darin Adler.
+
+        * css/CSSGrammar.y:
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::CSSParser):
+        (WebCore::CSSParser::parseSheet):
+        (WebCore::CSSParser::parseDeclaration):
+        (WebCore::CSSParser::createStyleRule):
+        (WebCore::CSSParser::markSelectorListStart):
+        (WebCore::CSSParser::markSelectorListEnd):
+        (WebCore::CSSParser::markRuleBodyStart):
+        (WebCore::CSSParser::markRuleBodyEnd):
+        (WebCore::CSSParser::markPropertyStart):
+        (WebCore::CSSParser::markPropertyEnd):
+        * css/CSSParser.h:
+        (WebCore::CSSParser::resetSelectorListMarks):
+        (WebCore::CSSParser::resetRuleBodyMarks):
+        (WebCore::CSSParser::resetPropertyMarks):
+        * css/CSSPropertySourceData.cpp:
+        * css/CSSPropertySourceData.h:
+        (WebCore::CSSRuleSourceData::create):
+        * inspector/InspectorCSSStore.cpp:
+        (WebCore::InspectorCSSStore::getRuleSourceData):
+        (WebCore::InspectorCSSStore::extractRanges):
+        (WebCore::InspectorCSSStore::getStyleAttributeRanges):
+        * inspector/InspectorCSSStore.h:
+        * inspector/InspectorDOMAgent.cpp:
+        (WebCore::InspectorDOMAgent::getStyleSourceData):
+
+2010-10-06  Dirk Schulze  <krit@webkit.org>
+
+        Added reviewer to commit r69187.
+
+2010-10-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVG feMorphology - big radii cause huge ImageBuffer sizes
+        https://bugs.webkit.org/show_bug.cgi?id=47263
+
+        The current code in FEMorphology::determineAbsolutePaintRect calculates the smallest paint rect by inflate the paint rect
+        of a previous effect with the radius. This was meant as an optimization, but I forgot to clip the calculated image size
+        by the maximal effect size. This caused huge image sizes for big radii.
+
+        This is covered by svg/filters/feMorphology-invalid-radius.svg and fixes the crashes on Windows and Snow Leopard bots.
+
+        * platform/graphics/filters/FEMorphology.cpp:
+        (WebCore::FEMorphology::determineAbsolutePaintRect):
+
+2010-10-06  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Dirk Schulze.
+
+        Fixed crash in gtk bots (filter-empty-g.svg) after r69181.
+
+        * rendering/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::postApplyResource):
+
+2010-10-06  Antonio Gomes  <agomes@rim.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Rename HitTestResult::rectFromPoint to rectForPoint
+        https://bugs.webkit.org/show_bug.cgi?id=47261
+
+        As per Kenneth Christiansen request inhttps://bugs.webkit.org/show_bug.cgi?id=46336#c20.
+
+        * WebCore.exp.in:
+        * dom/Document.cpp:
+        (WebCore::Document::nodesFromRect):
+        * rendering/EllipsisBox.cpp:
+        (WebCore::EllipsisBox::nodeAtPoint):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::addNodeToRectBasedTestResult):
+        (WebCore::HitTestResult::rectForPoint):
+        * rendering/HitTestResult.h:
+        (WebCore::HitTestResult::rectForPoint):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::nodeAtPoint):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::nodeAtPoint):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::nodeAtPoint):
+        (WebCore::RenderBlock::hitTestColumns):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::nodeAtPoint):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::hitTestLayer):
+        (WebCore::RenderLayer::hitTestChildLayerColumns):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::nodeAtPoint):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::nodeAtPoint):
+
+2010-10-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Martin Robinson.
+
+        SVGs with filters look grainy when scaled
+        https://bugs.webkit.org/show_bug.cgi?id=5526
+
+        Fixed issues on Cairos shadow implementation after the changes to FilterEffects.
+        Cairo calculates the inflation of the effect rect itself. Respect this for FEGaussianBlur.
+        This is just a temporary solution, since Cairo and Qt will use ContextShadow soon.
+
+        * platform/graphics/GraphicsContext.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        (WebCore::drawBorderlessRectShadow):
+        (WebCore::GraphicsContext::applyPlatformShadow):
+        (WebCore::GraphicsContext::createShadowMask):
+        (WebCore::GraphicsContext::drawTiledShadow):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        * platform/graphics/filters/ImageBufferFilter.cpp:
+        (WebCore::ImageBufferFilter::ImageBufferFilter):
+        (WebCore::ImageBufferFilter::create):
+        * platform/graphics/filters/ImageBufferFilter.h:
+        (WebCore::ImageBufferFilter::filterRegion):
+        (WebCore::ImageBufferFilter::sourceImageRect):
+
+2010-10-06  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Only execute first SVG text layout phase if needed
+        https://bugs.webkit.org/show_bug.cgi?id=47254
+
+        The first SVG text layout phase which computes the per-character metrics and extracts
+        the x/y/dx/dy/rotate values from the SVG DOM is currently executed upon every RenderSVGText::layout() call.
+
+        Optimize this, by only calling it:
+        - if x/y/dx/dy/rotate value lists change
+        - the style of a RenderSVGInlineText changes (eg. font-size changes influence metrics)
+        - the text content of any of the children in the <text> subtree change
+
+        No change in layout tests, a pure performance change - covered by existing tests.
+
+        * rendering/RenderSVGResourceGradient.cpp:
+        (WebCore::createMaskAndSwapContextForTextGradient): Adapt to renames, use RenderSVGText::locateRenderSVGTextAncestor().
+        (WebCore::clipToTextMask): Ditto.
+        * rendering/SVGRenderSupport.cpp:
+        * rendering/SVGRenderSupport.h: Move findTreeRootObject to RenderSVGText::locateRenderSVGTextAncestor().
+        * rendering/svg/RenderSVGInline.cpp:
+        (WebCore::RenderSVGInline::objectBoundingBox): adapt to renames, use RenderSVGText::locateRenderSVGTextAncestor().
+        (WebCore::RenderSVGInline::strokeBoundingBox): Ditto.
+        (WebCore::RenderSVGInline::repaintRectInLocalCoordinates): Ditto.
+        (WebCore::RenderSVGInline::absoluteQuads): Ditto.
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::RenderSVGInlineText::styleDidChange): Call setNeedsPositioningValuesUpdate() on the RenderSVGText root object, if diff == StyleDifferenceLayout.
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::RenderSVGText): Initialize m_needsPositioningValuesUpdate.
+        (WebCore::RenderSVGText::locateRenderSVGTextAncestor): New helper function, moved from SVGRenderSupport, to a more sensible place.
+        (WebCore::RenderSVGText::layout): Only execute the first SVG text layout phase, if m_needsPositioningValuesUpdate=true.
+        * rendering/svg/RenderSVGText.h:
+        (WebCore::RenderSVGText::setNeedsPositioningValuesUpdate):
+        (WebCore::toRenderSVGText): Add new helper casting methods, like most other renderers have.
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::updatePositioningValuesInRenderer):
+        (WebCore::SVGTextPositioningElement::svgAttributeChanged): If x/y/dx/dy/rotate changes, call setNeedsPositioningValuesUpdate on the RenderSVGText root object.
+        (WebCore::SVGTextPositioningElement::childrenChanged): If any children changes (addition, removal), do the same.
+        * svg/SVGTextPositioningElement.h:
+
+2010-10-05  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Extensions API] Expose access to resource bodies
+        Added support for encoding resource in WebInspector.getResourceContent()
+        https://bugs.webkit.org/show_bug.cgi?id=45953
+
+        * inspector/Inspector.idl: Added encoding parameter to getResourceContent()
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::getResourceContent):
+        * inspector/InspectorController.h:
+        * inspector/InspectorResource.cpp: Added sourceBytes() to return encoded representation of resource's binary body.
+        (WebCore::InspectorResource::sourceBytes):
+        * inspector/InspectorResource.h:
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.Resources.prototype.getContent):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent):
+        (WebInspector.ExtensionServer.prototype._onGetResourceContent.onContentAvailable):
+        (WebInspector.getEncodedResourceContent):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.getResourceContent):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.getResourceContent):
+
+2010-10-06  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47235
+        
+        Make "lr" block-flow fieldsets work.
+        
+        (1) Patched html.css rules for legends and fieldsets to use logical margins and padding.
+        (2) Converted just enough of computePreferredLogicalWidths to make basic examples work.
+        (3) Removed the extra border drawing code from fieldsets so that the "clip out the legend" approach
+        is now just always used.  It's silly to keep the old border drawing code in (which has already gotten out
+        of sync with the base class) just to avoid a save/restore and some clipping.
+        (4) Modified the layout/painting routines to place the legend properly and to be able to draw it in
+        both the top and the left borders.
+
+        Added fast/blockflow/fieldsets.html
+
+        * css/html.css:
+        (legend):
+        (fieldset):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::computePreferredLogicalWidths):
+        * rendering/RenderBlock.h:
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::layoutLegend):
+        (WebCore::RenderFieldset::paintBoxDecorations):
+        (WebCore::RenderFieldset::paintMask):
+        * rendering/RenderFieldset.h:
+
+2010-10-06  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Move parseDataUrl() from CURL into own file
+        https://bugs.webkit.org/show_bug.cgi?id=41462
+
+        Move the data URL parsing algorithm into a new file to use it in ResourceHandleWin too.
+
+        * CMakeLists.txt:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * platform/network/DataURL.cpp: Added.
+        (WebCore::handleDataURL):
+        * platform/network/DataURL.h: Added.
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::dispatchSynchronousJob):
+        (WebCore::ResourceHandleManager::startJob):
+        * platform/network/win/ResourceHandleWin.cpp:
+        (WebCore::ResourceHandle::start):
+        (WebCore::ResourceHandle::fileLoadTimer):
+
+2010-10-06  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        SVGs with filters look grainy when scaled
+        https://bugs.webkit.org/show_bug.cgi?id=5526
+
+        SVG filter effects need smarter size calculation
+        https://bugs.webkit.org/show_bug.cgi?id=31370
+
+        SVG elements use Filters before own transformations
+        https://bugs.webkit.org/show_bug.cgi?id=32486
+
+        Calculate all filter results in device space instead of the filtered objects user space. This change is similar to
+        the patches for SVG Pattern and SVG Masker before. It avoids pixelation and guarantees smooth filter results for
+        every scale level and is independent of any transformation to the target element or any ancester of the target.
+        The second part of this patch reduces the size of every effect to the smallest affected region instead of the complete
+        filter primitive subregion (http://www.w3.org/TR/SVG/filters.html#FilterPrimitiveSubRegion). We just use the subregion
+        as clipping region, like mentioned in the SVG specification, to make the affected region even smaller now.
+
+        This is a huge speed up. The ECMA cloud (http://ejohn.org/files/ecma-cloud.svg) is more than 100 times faster on Gtk and
+        renders in less than a second.
+        Some examples on svg-wow.org can be viewed the first time now, since the subregions were much bigger than the affected
+        region.
+        There's still more potential to speed up filters, by further reducing the ImageBuffer sizes.
+        Renamed repaintRectInLocalCoordinates to absolutePaintRect, since all coordinates are in device space instead of the
+        user space now.
+        The absolute paint rect is calculated by determineAbsolutePaintRect() and gets called by FilterEffect::effectContext() on
+        applying the effect.
+        Partly rewrote filter resolution (http://www.w3.org/TR/SVG/filters.html#FilterElementFilterResAttribute) to work with the
+        new concept. This also corrects the old behavior to match the SVG specification.
+
+        Tests: svg/filters/filterRes1.svg
+               svg/filters/filterRes2.svg
+               svg/filters/filterRes3.svg
+
+        * platform/graphics/cairo/GraphicsContextCairo.cpp: Call setAbsolutePaintRect instead of setRepaintRectInLocalCoordinates.
+        (WebCore::GraphicsContext::createShadowMask):
+        * platform/graphics/filters/FEBlend.cpp: Renamed repaintRectInLocalCoordinates to absolutePaintRect.
+        (WebCore::FEBlend::apply):
+        * platform/graphics/filters/FEColorMatrix.cpp: Ditto.
+        (WebCore::FEColorMatrix::apply):
+        * platform/graphics/filters/FEComponentTransfer.cpp: Ditto.
+        (WebCore::FEComponentTransfer::apply):
+        * platform/graphics/filters/FEComposite.cpp: Ditto.
+        (WebCore::FEComposite::determineAbsolutePaintRect):
+        (WebCore::FEComposite::apply):
+        * platform/graphics/filters/FEComposite.h:
+        * platform/graphics/filters/FEConvolveMatrix.cpp: Ditto.
+        (WebCore::FEConvolveMatrix::apply):
+        * platform/graphics/filters/FEConvolveMatrix.h:
+        (WebCore::FEConvolveMatrix::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEDisplacementMap.cpp: Ditto.
+        (WebCore::FEDisplacementMap::apply):
+        * platform/graphics/filters/FEDisplacementMap.h:
+        (WebCore::FEDisplacementMap::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEFlood.cpp: Ditto.
+        (WebCore::FEFlood::apply):
+        * platform/graphics/filters/FEFlood.h:
+        (WebCore::FEFlood::determineAbsolutePaintRect):
+        * platform/graphics/filters/FEGaussianBlur.cpp: Ditto.
+        (WebCore::calculateKernelSize):
+        (WebCore::FEGaussianBlur::determineAbsolutePaintRect):
+        (WebCore::FEGaussianBlur::apply):
+        * platform/graphics/filters/FEGaussianBlur.h:
+        * platform/graphics/filters/FELighting.cpp: Ditto.
+        (WebCore::FELighting::apply):
+        * platform/graphics/filters/FEMerge.cpp: Ditto.
+        (WebCore::FEMerge::apply):
+        * platform/graphics/filters/FEMorphology.cpp: Ditto.
+        (WebCore::FEMorphology::determineAbsolutePaintRect):
+        (WebCore::FEMorphology::apply):
+        * platform/graphics/filters/FEMorphology.h:
+        * platform/graphics/filters/FEOffset.cpp: Ditto.
+        (WebCore::FEOffset::determineAbsolutePaintRect):
+        (WebCore::FEOffset::apply):
+        * platform/graphics/filters/FEOffset.h:
+        * platform/graphics/filters/FETile.cpp: Ditto.
+        (WebCore::FETile::determineFilterPrimitiveSubregion):
+        (WebCore::FETile::apply):
+        * platform/graphics/filters/FETile.h:
+        (WebCore::FETile::determineAbsolutePaintRect):
+        * platform/graphics/filters/FETurbulence.cpp: Ditto.
+        (WebCore::FETurbulence::apply):
+        * platform/graphics/filters/FETurbulence.h:
+        (WebCore::FETurbulence::determineAbsolutePaintRect):
+        * platform/graphics/filters/Filter.h:
+        (WebCore::Filter::applyHorizontalScale): Map horizontal effect values to absolute coordinates.
+        (WebCore::Filter::applyVerticalScale): Map vertical effect values to absolute coordinates.
+        (WebCore::Filter::mapAbsolutePointToLocalPoint):
+        (WebCore::Filter::filterRegionInUserSpace):
+        * platform/graphics/filters/FilterEffect.cpp: Ditto.
+        (WebCore::FilterEffect::determineFilterPrimitiveSubregion):
+        (WebCore::FilterEffect::determineAbsolutePaintRect):
+        (WebCore::FilterEffect::requestedRegionOfInputImageData):
+        (WebCore::FilterEffect::drawingRegionOfInputImage):
+        (WebCore::FilterEffect::effectContext):
+        * platform/graphics/filters/FilterEffect.h:
+        (WebCore::FilterEffect::absolutePaintRect):
+        (WebCore::FilterEffect::setAbsolutePaintRect):
+        (WebCore::FilterEffect::maxEffectRect): The subregion in absolute coordinates for SVG.
+        (WebCore::FilterEffect::setMaxEffectRect):
+        * platform/graphics/filters/SourceAlpha.cpp: Ditto.
+        (WebCore::SourceAlpha::determineAbsolutePaintRect):
+        (WebCore::SourceAlpha::apply):
+        * platform/graphics/filters/SourceAlpha.h:
+        * platform/graphics/filters/SourceGraphic.cpp: Ditto.
+        (WebCore::SourceGraphic::determineAbsolutePaintRect):
+        (WebCore::SourceGraphic::apply):
+        * platform/graphics/filters/SourceGraphic.h:
+        * rendering/RenderSVGResourceFilter.cpp:
+        (WebCore::RenderSVGResourceFilter::applyResource):
+        (WebCore::RenderSVGResourceFilter::postApplyResource):
+        * rendering/RenderSVGResourceFilter.h:
+        (WebCore::FilterData::FilterData):
+        * svg/graphics/filters/SVGFEImage.cpp: Ditto.
+        (WebCore::FEImage::apply):
+        * svg/graphics/filters/SVGFEImage.h:
+        (WebCore::FEImage::determineAbsolutePaintRect):
+        * svg/graphics/filters/SVGFilter.cpp:
+        (WebCore::SVGFilter::SVGFilter):
+        (WebCore::SVGFilter::determineFilterPrimitiveSubregion):
+        (WebCore::SVGFilter::applyHorizontalScale):
+        (WebCore::SVGFilter::applyVerticalScale):
+        (WebCore::SVGFilter::create):
+        * svg/graphics/filters/SVGFilter.h:
+        (WebCore::SVGFilter::effectBoundingBoxMode):
+        (WebCore::SVGFilter::filterRegionInUserSpace):
+        (WebCore::SVGFilter::filterRegion):
+        (WebCore::SVGFilter::mapAbsolutePointToLocalPoint): Map absolute point to local point in userspace.
+        (WebCore::SVGFilter::sourceImageRect):
+        (WebCore::SVGFilter::maxImageSize):
+
+2010-10-06  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add "Set Breakpoint" item to XHR resource context menu.
+        https://bugs.webkit.org/show_bug.cgi?id=47085
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype._contextMenu):
+
+2010-10-05  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add idl and mock classes for FileSystemSync for FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=46405
+
+        Added bunch of *Sync classes, plus refactored some classes:
+        Added DOMFileSystemBase as a common base class for DOMFileSystem and
+        DOMFileSystemSync.
+        Added EntryBase as a common base class for Entry and EntrySync.
+        Added DirectoryReaderBase as a common base class for DirectoryReader and
+        DirectoryReaderSync.
+
+        Test: fast/filesystem/workers/
+
+        * CMakeLists.txt: Added new files.
+        * DerivedSources.cpp: Added new files.
+        * DerivedSources.make: Added new files.
+        * GNUmakefile.am: Added new files.
+        * WebCore.gypi: Added new files.
+        * WebCore.pri: Added new files.
+        * WebCore.pro: Added new files.
+        * WebCore.vcproj/WebCore.vcproj: Added new files. Also removed the duplicated fileapi\FileEntry.cpp entry.
+        * WebCore.xcodeproj/project.pbxproj: Added new files.
+        * bindings/js/JSDirectoryEntrySyncCustom.cpp: Added.
+        * bindings/js/JSEntrySyncCustom.cpp: Added.
+        * bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp: Added.
+        * bindings/v8/custom/V8EntrySyncCustom.cpp: Added.
+        * fileapi/DOMFileSystemBase.cpp: Added.
+        * fileapi/DOMFileSystemBase.h: Added.
+        * fileapi/DOMFileSystemSync.cpp: Added.
+        * fileapi/DOMFileSystemSync.h: Added.
+        * fileapi/DOMFileSystemSync.idl: Added.
+        * fileapi/DirectoryEntrySync.cpp: Added.
+        * fileapi/DirectoryEntrySync.h: Added.
+        * fileapi/DirectoryEntrySync.idl: Added.
+        * fileapi/DirectoryReaderBase.h: Added.
+        * fileapi/DirectoryReaderSync.cpp: Added.
+        * fileapi/DirectoryReaderSync.h: Added.
+        * fileapi/DirectoryReaderSync.idl: Added.
+        * fileapi/EntryArraySync.cpp: Added.
+        * fileapi/EntryArraySync.h: Added.
+        * fileapi/EntryArraySync.idl: Added.
+        * fileapi/EntryBase.h: Added.
+        * fileapi/EntrySync.cpp: Added.
+        * fileapi/EntrySync.h: Added.
+        * fileapi/EntrySync.idl: Added.
+        * fileapi/FileEntrySync.cpp: Added.
+        * fileapi/FileEntrySync.h: Added.
+        * fileapi/FileEntrySync.idl: Added.
+
+2010-10-05  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        REGRESSION (r67166): "Placeholder" text remains in input box after 2nd focus()
+        https://bugs.webkit.org/show_bug.cgi?id=45940
+
+        Test: fast/forms/input-placeholder-focus-twice.html
+
+        * html/HTMLFormControlElement.h: Make supportsPlaceholder() public.
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::updateFromElement):
+         We always need to update the renderer value with the DOM value if
+         the element supports the placeholder feature.
+         Note: the placeholder feature and "unacceptable renderer value"
+         are exclusive.
+
+2010-10-05  Kyusun Kim  <maniagoon@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Translate key code in PlatformKeyboardEvent with IKeysMapping
+        https://bugs.webkit.org/show_bug.cgi?id=47234
+
+        Brew MP devices have a variey of key configurations and use modifiers to
+        input capital letters, symbols and special characters. Use IKeysMapping to translate key code.
+
+        * platform/brew/PlatformKeyboardEventBrew.cpp:
+        (WebCore::PlatformKeyboardEvent::PlatformKeyboardEvent):
+
+2010-10-05  W. James MacLean  <wjmaclean@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Add mipmap support for ImageLayerChromium
+        https://bugs.webkit.org/show_bug.cgi?id=46493
+
+        Mipmap behaviour can be tested with existing tests.
+        Tests in LayoutTests/compositing/images/ will detect if
+        mipmaps fail.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        (WebCore::ContentLayerChromium::SharedValues::SharedValues):
+        (WebCore::isPowerOfTwo):
+        (WebCore::ContentLayerChromium::updateTextureRect):
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        (WebCore::ContentLayerChromium::SharedValues::npotSupported):
+        * platform/graphics/chromium/ImageLayerChromium.cpp:
+        (WebCore::ImageLayerChromium::updateContents):
+
+2010-10-05  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Issue in treebuilder parsing related to table tags
+        https://bugs.webkit.org/show_bug.cgi?id=47190
+
+        Update ASSERT to match the spec and our behavior.
+
+        * html/parser/HTMLTreeBuilder.cpp:
+        (WebCore::HTMLTreeBuilder::processEndTagForInCell):
+
+2010-10-05  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        VideoLayerChromium releases old resources if the LayerRenderer changes.
+        https://bugs.webkit.org/show_bug.cgi?id=47030
+
+        Refactored LayerChromium to have a virtual cleanupResources() method
+        that will release textures/other context-dependent resources when a
+        LayerRenderer changes. ContentLayerChromium and VideoLayerChromium now
+        override this method to perform cleanup.
+
+        * platform/graphics/chromium/ContentLayerChromium.cpp:
+        * platform/graphics/chromium/ContentLayerChromium.h:
+        * platform/graphics/chromium/LayerChromium.cpp:
+        (WebCore::LayerChromium::setLayerRenderer):
+        * platform/graphics/chromium/LayerChromium.h:
+        (WebCore::LayerChromium::cleanupResources):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+        (WebCore::VideoLayerChromium::cleanupResources):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+
+2010-10-05  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Jian Li.
+
+        FileEntry::file needs to be implemented
+        https://bugs.webkit.org/show_bug.cgi?id=47192
+
+        Test: fast/filesystem/file-from-file-entry.html
+
+        * fileapi/FileEntry.cpp:
+        (WebCore::FileEntry::file): Implemented.
+
+2010-09-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Render textures in video frame directly.
+        https://bugs.webkit.org/show_bug.cgi?id=46765
+
+        Render textures in VideoLayerChromium directly if the video frame type
+        is GL texture. In the future VideoLayerChromium will not allocate
+        textures and perform textures upload as those operations will be done
+        in Chromium to minimize memory copy. This patch will help moving toward
+        this direction and facilitate hardware video decoding.
+
+        * platform/graphics/chromium/VideoFrameChromium.h:
+        * platform/graphics/chromium/VideoFrameProvider.h:
+        (WebCore::VideoFrameProvider::~VideoFrameProvider):
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::VideoLayerChromium):
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+        (WebCore::VideoLayerChromium::updateContents):
+        (WebCore::VideoLayerChromium::draw):
+        (WebCore::VideoLayerChromium::releaseCurrentFrame):
+        (WebCore::VideoLayerChromium::resetFrameParameters):
+        (WebCore::VideoLayerChromium::saveCurrentFrame):
+        * platform/graphics/chromium/VideoLayerChromium.h:
+        (WebCore::VideoLayerChromium::SharedValues::initialized):
+
+2010-10-05  Fady Samuel  <fsamuel@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (r65539): One pixel white gaps when scrolling Trac changeset pages
+        https://bugs.webkit.org/show_bug.cgi?id=45131
+
+        When border-collapse: separate property is set on the table, paintObject
+        may skip repainting cells, if the dirty region only touches one row/col of pixels.
+
+        Test: fast/table/simple_paint_separate_borders.html
+
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::paintObject):  
+            Don't subtract one from the right and bottom of the dirty paint rect.
+
+2010-10-05  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        PluginDocument now holds on to the created plugin node so that the pluginNode() and pluginWidget() methods can return the correct node.
+        https://bugs.webkit.org/show_bug.cgi?id=47129
+
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::createDocumentStructure):
+        (WebCore::PluginDocument::pluginWidget):
+        (WebCore::PluginDocument::pluginNode):
+        * html/PluginDocument.h:
+        (WebCore::PluginDocument::setPluginNode):
+
+2010-10-05  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] Re-enable single-NPP_SetWindow quirk for 64-bit
+        https://bugs.webkit.org/show_bug.cgi?id=45363
+
+        This is still causing trouble for people, so let's put the
+        quirk back until we can figure this out properly.
+
+        * plugins/PluginPackage.cpp:
+        (WebCore::PluginPackage::determineQuirks):
+
+2010-10-05  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [V8] Add FileReader to active DOM map
+        https://bugs.webkit.org/show_bug.cgi?id=47205
+
+        We need to have a custom FileReader V8 constructor in order to add object
+        into active DOM map to prevent it from GC-ed when it is still in-use.
+
+        * Android.v8bindings.mk:
+        * WebCore.gypi:
+        * bindings/scripts/CodeGeneratorV8.pm:
+        * bindings/v8/custom/V8FileReaderCustom.cpp: Added.
+        (WebCore::V8FileReader::constructorCallback):
+        * fileapi/FileReader.idl:
+
+2010-10-05  Vincent Scheib  <scheib@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        [chromium] 51304 GPU compositor resorts to "slow" text rendering for base page layer
+        https://bugs.webkit.org/show_bug.cgi?id=47193
+
+        Test: Accelerated compositor test infrastructure still coming online. Tested manually.
+
+        * platform/graphics/chromium/LayerRendererChromium.cpp:
+        (WebCore::LayerRendererChromium::setRootLayerCanvasSize):
+        (WebCore::LayerRendererChromium::prepareToDrawLayers):
+        (WebCore::LayerRendererChromium::drawLayers):
+
+2010-10-05  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Fix clang build
+        https://bugs.webkit.org/show_bug.cgi?id=47198
+
+        * page/Chrome.h:
+        Declare ViewportArguments as struct, not as class.
+
+2010-10-05  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47204
+        
+        Make isSelfCollapsingBlock use logical height instead of height in all its checks.
+
+        Added fast/blockflow/self-collapsing-block.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::isSelfCollapsingBlock):
+
+2010-10-05  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        Relax restrictions on FileWriter::didWrite calls
+        https://bugs.webkit.org/show_bug.cgi?id=47139
+
+        No new tests; they're still waiting on the first implementation.
+
+        * fileapi/FileWriter.cpp:
+        (WebCore::FileWriter::FileWriter):
+        (WebCore::FileWriter::write):
+        (WebCore::FileWriter::didWrite):
+        * fileapi/FileWriter.h:
+
+2010-10-05  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] getData('text/uri-list') should return the same thing that was passed to setData('text/uri-list')
+        https://bugs.webkit.org/show_bug.cgi?id=46943
+
+        We no longer parse the input of setData('text/uri-list') and only store
+        the valid URLs that were parsed out.
+
+        Test: editing/pasteboard/dataTransfer-setData-getData.html
+
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clearData):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::types):
+        (WebCore::ChromiumDataObject::getData):
+        (WebCore::ChromiumDataObject::setData):
+        * platform/chromium/ChromiumDataObject.h:
+
+2010-10-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Support FontPlatformData::isFixedPitch for custom fonts
+        https://bugs.webkit.org/show_bug.cgi?id=47124
+
+        Instead of determining whether or not a font is a fixed-width font
+        lazily, do it up front. For fonts not backed by Fontconfig patterns,
+        fetch information about whether or not the font is fixed-width from
+        the FreeType face.
+
+        No new tests as this should not change functionality.
+
+        * platform/graphics/cairo/FontPlatformDataFreeType.cpp:
+        (WebCore::FontPlatformData::FontPlatformData): Initialize the m_fixedWidth member
+        from the Fontconfig pattern or the FreeType face.
+        (WebCore::FontPlatformData::operator=): Copy over the m_fixedWidth member.
+        (WebCore::FontPlatformData::isFixedPitch): Just return the value of the m_fixedWidth member.
+        * platform/graphics/cairo/FontPlatformDataFreeType.h: Added an m_fixedWidth member.
+
+2010-10-05  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47199
+        
+        Make float positioning work in block layout with block children.
+        It doesn't work yet from inside line layout, since line layout is unpatched.
+
+        Added fast/blockflow/floats-in-block-layout.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustFloatingBlock):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatingObject::type):
+        (WebCore::RenderBlock::FloatingObject::renderer):
+        (WebCore::RenderBlock::logicalRightForFloat):
+        (WebCore::RenderBlock::setLogicalTopForFloat):
+        (WebCore::RenderBlock::setLogicalLeftForFloat):
+        (WebCore::RenderBlock::setLogicalHeightForFloat):
+        (WebCore::RenderBlock::setLogicalWidthForFloat):
+
+2010-10-05  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Web process crash when pressing modifiers in input field
+        https://bugs.webkit.org/show_bug.cgi?id=44935
+
+        Revert part of the http://trac.webkit.org/changeset/69105 due to a
+        test regression.  Unix: Add ASSERTs to plugin related code. These
+        will fail if Qt WebKit2 is used with plugins, unless code is not
+        fixed before.
+
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXKeyEventSpecificFields): Use qKeyEvent, Use ASSERT as a reminder.
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioBasicProcessorNode files
+        https://bugs.webkit.org/show_bug.cgi?id=46495
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioBasicProcessorNode.cpp: Added.
+        (WebCore::AudioBasicProcessorNode::AudioBasicProcessorNode):
+        (WebCore::AudioBasicProcessorNode::initialize):
+        (WebCore::AudioBasicProcessorNode::uninitialize):
+        (WebCore::AudioBasicProcessorNode::process):
+        (WebCore::AudioBasicProcessorNode::pullInputs):
+        (WebCore::AudioBasicProcessorNode::reset):
+        (WebCore::AudioBasicProcessorNode::checkNumberOfChannelsForInput):
+        (WebCore::AudioBasicProcessorNode::numberOfChannels):
+        * webaudio/AudioBasicProcessorNode.h: Added.
+        (WebCore::AudioBasicProcessorNode::processor):
+
+2010-10-05  Chris Marrin  <cmarrin@apple.com>
+
+        Unreviewed.
+
+        The platform/graphics/gpu folder was mistakenly inside the filters folder.
+        I moved it to the right place in the Group Tree.
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-10-05  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix ownership of GraphicsContext3D in SharedGraphicsContext3D to prevent early deallocation and crash
+        https://bugs.webkit.org/show_bug.cgi?id=47197
+
+        This is work in progress and the crash only happens with ACCELERATED_2D_CANVAS turned on (which is off
+        by default). Many existing test cases will crash before and after this patch.
+
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+
+2010-10-05  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] properly paint really small scrollbar arrows on linux
+        https://bugs.webkit.org/show_bug.cgi?id=47109
+
+        * platform/chromium/ScrollbarThemeChromiumLinux.cpp:
+        (WebCore::ScrollbarThemeChromiumLinux::buttonSize): Clamp button size based on available size.  This matches what
+            we do on Win.
+
+2010-10-05  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by David Levin.
+
+        Remove unused CachedResource::Status values (New and NotCached).
+        https://bugs.webkit.org/show_bug.cgi?id=47132
+
+        Refactor only, no new tests.
+
+        * loader/CachedResource.h:
+        * loader/CachedResourceLoader.cpp:
+        (WebCore::CachedResourceLoader::checkCacheObjectStatus):
+
+2010-10-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Rename get* and open*Cursor per the spec on IDBIndex
+        https://bugs.webkit.org/show_bug.cgi?id=46906
+
+        The spec changed so that:
+        IDBIndex.get -> getKey
+        IDBIndex.getObject -> get
+        IDBIndex.openCursor -> openKeyCursor
+        IDBIndex.openObjectCursor -> openCursor
+
+        Existing tests cover since this is just renaming stuff.
+
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::openKeyCursor):
+        (WebCore::IDBIndex::get):
+        (WebCore::IDBIndex::getKey):
+        * storage/IDBIndex.h:
+        * storage/IDBIndex.idl:
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::openKeyCursor):
+        (WebCore::IDBIndexBackendImpl::get):
+        (WebCore::IDBIndexBackendImpl::getKey):
+        * storage/IDBIndexBackendImpl.h:
+        * storage/IDBIndexBackendInterface.h:
+
+2010-10-05  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Fix breakage in RVCT 2.2 compile
+        https://bugs.webkit.org/show_bug.cgi?id=47187
+
+        Fix bug in RVCT 2.2 compile for Symbian^3 in html/canvas/Int32Array.h and 
+        html/canvas/Uin8Array.h
+        For RVCT2.2, the using clause is unneeded, and can be omitted.
+
+        A Test case cannot be made for this since this is a build-related issue.
+
+        * html/canvas/Int32Array.h:
+        * html/canvas/Uint8Array.h:
+
+2010-10-04  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IDBDatabase::createObjectStore/removeObjectStore and IDBObjectStore::createIndex/removeIndex should be synchronous.
+        https://bugs.webkit.org/show_bug.cgi?id=46883
+
+        Makes the schema manipulation methods synchronous. Modifies the transaction
+        logic to support tasks that may have pending events as well as tasks that
+        don't have such events.
+
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::removeObjectStore):
+        * storage/IDBDatabase.h:
+        * storage/IDBDatabase.idl:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreInternal):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::IDBIndexBackendImpl):
+        * storage/IDBIndexBackendImpl.h:
+        (WebCore::IDBIndexBackendImpl::create):
+        (WebCore::IDBIndexBackendImpl::id):
+        (WebCore::IDBIndexBackendImpl::setId):
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::removeIndex):
+        * storage/IDBObjectStore.h:
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndex):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        (WebCore::IDBObjectStoreBackendImpl::create):
+        (WebCore::IDBObjectStoreBackendImpl::id):
+        (WebCore::IDBObjectStoreBackendImpl::setId):
+        (WebCore::IDBObjectStoreBackendImpl::autoIncrement):
+        * storage/IDBObjectStoreBackendInterface.h:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::objectStore):
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        (WebCore::IDBTransactionBackendImpl::abort):
+        (WebCore::IDBTransactionBackendImpl::didCompleteTaskEvents):
+        (WebCore::IDBTransactionBackendImpl::run):
+        (WebCore::IDBTransactionBackendImpl::taskTimerFired):
+        (WebCore::IDBTransactionBackendImpl::taskEventTimerFired):
+        * storage/IDBTransactionBackendImpl.h:
+
+2010-10-05  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        WAI-ARIA 'marquee' role live region uses aria-live="polite", should use aria-live="off"
+        https://bugs.webkit.org/show_bug.cgi?id=47185
+
+        Test: platform/mac/accessibility/aria-liveregion-marquee-default.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::ariaLiveRegionStatus):
+
+2010-10-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Interior scrollbars do not draw their background properly
+        https://bugs.webkit.org/show_bug.cgi?id=47096
+
+        Correct the method that the GTK+ theme drawing code uses to
+        draw scrolled window backgrounds. Now it uses gtk_paint_shadow,
+        the same as the actual code from GTK+.
+
+        No new tests as this is very hard to write tests for. The bug only
+        manifests on some GTK+ themes and we have no test harness mechanism
+        for testing rendering with non-default GTK+ themes.
+
+        * platform/gtk/ScrollbarThemeGtk.cpp:
+        (WebCore::ScrollbarThemeGtk::paintScrollbarBackground): No longer
+        initialize the widget state, as it's unused by the callee.
+        (WebCore::ScrollbarThemeGtk::paint): Remove an inaccurate comment.
+        * platform/gtk/gtk2drawing.c:
+        (moz_gtk_scrolled_window_paint): Paint scrolled window backgrounds
+        with gtk_paint_shadow instead of gtk_paint_box.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use PlatformRefPtr instead of OwnPtr in FileSystem
+        https://bugs.webkit.org/show_bug.cgi?id=47025
+
+        PlatformRefPtr is a better choice here because all Brew MP instances are
+        reference counted.
+
+        * platform/brew/FileSystemBrew.cpp:
+        (WebCore::getFileSize):
+        (WebCore::fileExists):
+        (WebCore::deleteFile):
+        (WebCore::deleteEmptyDirectory):
+        (WebCore::canonicalPath):
+        (WebCore::makeAllDirectories):
+        (WebCore::openTemporaryFile):
+
+2010-10-05  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Complex text rendering does not render custom fonts
+        https://bugs.webkit.org/show_bug.cgi?id=41091
+
+        For fonts that do not have a FontConfig pattern (including custom
+        fonts), fall back to the simple text rendering path. This is a work-
+        -around for not supporting Pango rendering with non-FontConfig fonts.
+
+        Test: platform/gtk/fonts/font-face-with-complex-text.html
+
+        * platform/graphics/gtk/FontGtk.cpp:
+        (WebCore::Font::drawComplexText): Fall back to the simple path for custom fonts.
+        (WebCore::Font::floatWidthForComplexText): Ditto.
+        (WebCore::Font::offsetForPositionForComplexText): Ditto.
+        (WebCore::Font::selectionRectForComplexText): Ditto.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Kent Tamura.
+
+        [BREWMP] Use PlatformRefPtr in getDisplayInfo
+        https://bugs.webkit.org/show_bug.cgi?id=47023
+
+        Use PlatformRefPtr to release IBitmap* automatically.
+
+        * platform/brew/ScreenBrew.cpp:
+        (WebCore::getDisplayInfo):
+
+2010-10-05  Kristian Monsen  <kristianm@google.com>
+
+        Reviewed by Steve Block.
+
+        Including JavaScriptCore/config.h from WebCore/config.h
+        instead of from WebCorePrefix.h.
+        https://bugs.webkit.org/show_bug.cgi?id=47179
+
+        No new tests, just changing where files are included.
+
+        * WebCorePrefix.h:
+        * config.h:
+
+2010-10-05  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Make build work with QT_NO_CURSOR
+        https://bugs.webkit.org/show_bug.cgi?id=46097
+
+        Add a missing include.
+
+        * platform/qt/QWebPageClient.h:
+
+2010-10-05  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Make build work with QT_NO_CURSOR
+        https://bugs.webkit.org/show_bug.cgi?id=46097
+
+        createCustomCursor() is a static function and not used
+        in that file if QT_NO_CURSOR is defined, so rather than
+        making it return 0, it should not exist altogether.
+
+        * platform/qt/CursorQt.cpp:
+        (WebCore::createCustomCursor):
+
+2010-10-05  Adam Roben  <aroben@apple.com>
+
+        Windows linker warning fix
+
+        * WebCore.vcproj/WebCore.vcproj: Exclude JSDOMTokenList.cpp from the
+        build, since it is already being compiled via DerivedSources.cpp. Also
+        let VS reorder some files.
+
+2010-10-05  Kimmo Kinnunen  <kimmo.t.kinnunen@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Web process crash when pressing modifiers in input field
+        https://bugs.webkit.org/show_bug.cgi?id=44935
+
+        Fix null pointer dereference by not using
+        PlatformKeyboardEvent::m_qtEvent. This member is not set when
+        event comes from WebKit2.  Unix: Add ASSERTs to plugin related
+        code. These will fail if WebKit2 is used with plugins, unless code
+        is not fixed before.  Symbian: Add ASSERT to code which uses
+        qtEvent(). It will fail when WebKit2 is enabled for Symbian, if
+        code is not fixed before.
+
+        * platform/PlatformKeyboardEvent.h:
+        * platform/qt/PlatformKeyboardEventQt.cpp:
+        (WebCore::isVirtualKeyCodeRepresentingCharacter): Added.
+        (WebCore::PlatformKeyboardEvent::disambiguateKeyDownEvent): Avoid using m_qtEvent.
+        (WebCore::PlatformKeyboardEvent::nativeModifiers): Added. Use ASSERT as a reminder.
+        (WebCore::PlatformKeyboardEvent::nativeScanCode): Added. Use ASSERT as a reminder.
+        * plugins/qt/PluginViewQt.cpp:
+        (WebCore::setXKeyEventSpecificFields):
+        * plugins/symbian/PluginViewSymbian.cpp:
+        (WebCore::PluginView::handleKeyboardEvent): Add ASSERT as a reminder.
+
+2010-10-05  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Csaba Osztrogonác.
+
+        Add ENABLE(ACCELERATED_2D_CANVAS) guard to LoopBlinnLocalTriangulator.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47115
+
+        LoopBlinnLocalTriangulator.cpp depends on LoopBlinnMathUtils.cpp which is guarded by
+        ENABLE(ACCELERATED_2D_CANVAS).
+
+        * platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp:
+
+2010-10-05  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Added event onwebkitspeechchange to invoke on new speech input results.
+        https://bugs.webkit.org/show_bug.cgi?id=47127
+
+        * dom/EventNames.h: Added webkitspeechchange event name.
+        * html/HTMLAttributeNames.in: Added onwebkitspeechchange attribute name.
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::parseMappedAttribute): Handle new attribute set.
+        (WebCore::HTMLInputElement::dispatchWebkitSpeechChangeEvent): Invoke the event handler.
+        * html/HTMLInputElement.h:
+        * html/HTMLInputElement.idl: Added attribute to IDL.
+        * rendering/TextControlInnerElements.cpp:
+        (WebCore::InputFieldSpeechButtonElement::setRecognitionResult): Invoke new event handler instead of onChange
+
+2010-10-05  Satish Sampath  <satish@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Rename @webkitspeech to @x-webkit-speech to follow HTML5 convention
+        https://bugs.webkit.org/show_bug.cgi?id=46873
+
+        The @webkitspeech attribute is renamed to @x-webkit-speech per the HTML5 spec for extension
+        attributes. The DOM attribute in IDL was renamed to 'webkitSpeech' as well. But the generated
+        code for the attribute did not match the generated code for the IDL, so I modified
+        dom/make_names.pl to generate the appropriate name for such extension attributes.
+
+        * bindings/generic/RuntimeEnabledFeatures.h: Rename flag accessor to match IDL attribute name.
+        (WebCore::RuntimeEnabledFeatures::webkitSpeechEnabled):
+        * dom/make_names.pl: Additions to generate names for x-webkit-xxxx attributes that match the
+        generated code from IDL and remember the original names including the x- prefix when writing
+        out the cpp files.
+        * html/HTMLAttributeNames.in: Rename @webkitspeech to @x-webkit-speech
+        * html/HTMLInputElement.idl: Rename @webkitspeech to @webkitSpeech
+
+2010-10-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Chromium][Extension API] provide tab id of inspected tab in extension API
+        https://bugs.webkit.org/show_bug.cgi?id=47080
+
+        * inspector/front-end/ExtensionServer.js: Added support for platform-specific extensions API.
+        (WebInspector.ExtensionServer.prototype._buildExtensionAPIInjectedScript):
+
+2010-10-05  Sanjeev Radhakrishnan  <sanjeevr@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Fixed implementation of pluginWidgetFromDocument to search for the "embed" element rather than just use the first child.
+        https://bugs.webkit.org/show_bug.cgi?id=47129
+
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::pluginWidgetFromDocument):
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add BiquadDSPKernel files
+        https://bugs.webkit.org/show_bug.cgi?id=46528
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/BiquadDSPKernel.cpp: Added.
+        (WebCore::BiquadDSPKernel::process):
+        * webaudio/BiquadDSPKernel.h: Added.
+        (WebCore::BiquadDSPKernel::BiquadDSPKernel):
+        (WebCore::BiquadDSPKernel::reset):
+        (WebCore::BiquadDSPKernel::biquadProcessor):
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by James Robinson.
+
+        Fix AudioContext to use new HRTFDatabaseLoader API
+        https://bugs.webkit.org/show_bug.cgi?id=46858
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::AudioContext):
+        (WebCore::AudioContext::isRunnable):
+        * webaudio/AudioContext.h:
+        * webaudio/AudioContext.idl:
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioPannerNode files
+        https://bugs.webkit.org/show_bug.cgi?id=46505
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioPannerNode.cpp: Added.
+        (WebCore::fixNANs):
+        (WebCore::AudioPannerNode::AudioPannerNode):
+        (WebCore::AudioPannerNode::~AudioPannerNode):
+        (WebCore::AudioPannerNode::pullInputs):
+        (WebCore::AudioPannerNode::process):
+        (WebCore::AudioPannerNode::reset):
+        (WebCore::AudioPannerNode::initialize):
+        (WebCore::AudioPannerNode::uninitialize):
+        (WebCore::AudioPannerNode::listener):
+        (WebCore::AudioPannerNode::setPanningModel):
+        (WebCore::AudioPannerNode::getAzimuthElevation):
+        (WebCore::AudioPannerNode::dopplerRate):
+        (WebCore::AudioPannerNode::distanceConeGain):
+        (WebCore::AudioPannerNode::notifyAudioSourcesConnectedToNode):
+        * webaudio/AudioPannerNode.h: Added.
+        (WebCore::AudioPannerNode::create):
+        (WebCore::AudioPannerNode::panningModel):
+        (WebCore::AudioPannerNode::position):
+        (WebCore::AudioPannerNode::setPosition):
+        (WebCore::AudioPannerNode::orientation):
+        (WebCore::AudioPannerNode::setOrientation):
+        (WebCore::AudioPannerNode::velocity):
+        (WebCore::AudioPannerNode::setVelocity):
+        (WebCore::AudioPannerNode::distanceModel):
+        (WebCore::AudioPannerNode::setDistanceModel):
+        (WebCore::AudioPannerNode::refDistance):
+        (WebCore::AudioPannerNode::setRefDistance):
+        (WebCore::AudioPannerNode::maxDistance):
+        (WebCore::AudioPannerNode::setMaxDistance):
+        (WebCore::AudioPannerNode::rolloffFactor):
+        (WebCore::AudioPannerNode::setRolloffFactor):
+        (WebCore::AudioPannerNode::coneInnerAngle):
+        (WebCore::AudioPannerNode::setConeInnerAngle):
+        (WebCore::AudioPannerNode::coneOuterAngle):
+        (WebCore::AudioPannerNode::setConeOuterAngle):
+        (WebCore::AudioPannerNode::coneOuterGain):
+        (WebCore::AudioPannerNode::setConeOuterGain):
+        (WebCore::AudioPannerNode::distanceGain):
+        (WebCore::AudioPannerNode::coneGain):
+        * webaudio/AudioPannerNode.idl: Added.
+
+2010-10-04  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [Cairo] Port drawTiledShadow to the new ContextShadow
+        https://bugs.webkit.org/show_bug.cgi?id=45902
+
+        Ported the drawTiledShadow function to the ContextShadow, it
+        renders shadows for rects faster than the simple blurring using
+        tiling of a smaller rect. We will remove the old function in a
+        next patch when starting to use ContextShadows for cairo
+        rendering.
+
+        * platform/graphics/ContextShadow.h:
+        * platform/graphics/cairo/ContextShadowCairo.cpp:
+        (WebCore::ContextShadow::drawRectShadowWithoutTiling):
+        (WebCore::ContextShadow::drawRectShadow):
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add BiquadProcessor files
+        https://bugs.webkit.org/show_bug.cgi?id=46527
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/BiquadProcessor.cpp: Added.
+        (WebCore::BiquadProcessor::BiquadProcessor):
+        (WebCore::BiquadProcessor::~BiquadProcessor):
+        (WebCore::BiquadProcessor::createKernel):
+        (WebCore::BiquadProcessor::process):
+        * webaudio/BiquadProcessor.h: Added.
+        (WebCore::BiquadProcessor::filterCoefficientsDirty):
+        (WebCore::BiquadProcessor::parameter1):
+        (WebCore::BiquadProcessor::parameter2):
+        (WebCore::BiquadProcessor::parameter3):
+        (WebCore::BiquadProcessor::type):
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add EqualPowerPanner files
+        https://bugs.webkit.org/show_bug.cgi?id=45077
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/EqualPowerPanner.cpp: Added.
+        (WebCore::EqualPowerPanner::EqualPowerPanner):
+        (WebCore::EqualPowerPanner::pan):
+        * platform/audio/EqualPowerPanner.h: Added.
+        (WebCore::EqualPowerPanner::reset):
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add HighPass2FilterNode files
+        https://bugs.webkit.org/show_bug.cgi?id=46533
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/HighPass2FilterNode.cpp: Added.
+        (WebCore::HighPass2FilterNode::HighPass2FilterNode):
+        * webaudio/HighPass2FilterNode.h: Added.
+        (WebCore::HighPass2FilterNode::create):
+        (WebCore::HighPass2FilterNode::cutoff):
+        (WebCore::HighPass2FilterNode::resonance):
+        (WebCore::HighPass2FilterNode::biquadProcessor):
+        * webaudio/HighPass2FilterNode.idl: Added.
+
+2010-10-05  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add LowPass2FilterNode files
+        https://bugs.webkit.org/show_bug.cgi?id=46532
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/LowPass2FilterNode.cpp: Added.
+        (WebCore::LowPass2FilterNode::LowPass2FilterNode):
+        * webaudio/LowPass2FilterNode.h: Added.
+        (WebCore::LowPass2FilterNode::create):
+        (WebCore::LowPass2FilterNode::cutoff):
+        (WebCore::LowPass2FilterNode::resonance):
+        (WebCore::LowPass2FilterNode::biquadProcessor):
+        * webaudio/LowPass2FilterNode.idl: Added.
+
+2010-10-04  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Kent Tamura.
+
+        Fixed compilation problem added in commit 69082. The interface of
+        the function has two parameters with the same name.
+
+        * rendering/RenderBlock.h:
+
+2010-10-04  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioUtilities files
+        https://bugs.webkit.org/show_bug.cgi?id=47011
+
+        No new tests since audio API is not yet implemented.
+
+        * platform/audio/AudioUtilities.cpp: Added.
+        (WebCore::AudioUtilities::decibelsToLinear):
+        (WebCore::AudioUtilities::linearToDecibels):
+        (WebCore::AudioUtilities::discreteTimeConstantForSampleRate):
+        * platform/audio/AudioUtilities.h: Added.
+
+2010-10-04  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47112
+
+        Convert addOverhangingFloats and addIntrudingFloats to be block-flow-aware.
+        
+        Also clean up how floats are placed to use a bit instead of the magic -1 value on top().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObjectsBelow):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::markLinesDirtyInBlockRange):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatingObject::FloatingObject):
+        (WebCore::RenderBlock::FloatingObject::isPlaced):
+        (WebCore::RenderBlock::FloatingObject::setIsPlaced):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::determineStartPosition):
+
+2010-10-04  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Fix broken C++ in PODInterval and PODIntervalTree
+        https://bugs.webkit.org/show_bug.cgi?id=47063
+
+        See http://clang.llvm.org/compatibility.html#dep_lookup . Since
+        valueToString needs to work with non-class types, it needs to be
+        declared before it's used. And since it needs to handle many types, it
+        needs to be a template function, for which clients will need to
+        provide specializations for the types they care about. Partial template
+        specialization is only supported for structs, so wrap the function in
+        a struct, too.
+
+        * platform/graphics/gpu/PODInterval.h:
+        (WebCore::PODInterval::toString):
+        * platform/graphics/gpu/PODIntervalTree.h:
+        (WebCore::PODIntervalTree::checkInvariantsFromNode):
+        * platform/graphics/gpu/PODRedBlackTree.h:
+        (WebCore::PODRedBlackTree::dumpFromNode):
+
+2010-10-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Spatial Navigation: Add support for <input type="radio">
+        https://bugs.webkit.org/show_bug.cgi?id=46993
+
+        When using Spatial Navigation, every radio button should be focusable and 
+        users should be able to navigate from one button to the next without moving the selection. 
+
+        Tests: fast/events/spatial-navigation/snav-radio-group.html
+               fast/events/spatial-navigation/snav-radio.html
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::isKeyboardFocusable):
+        Every radio button should be keyboard focusable, if using Spatial Navigation.
+        (WebCore::HTMLInputElement::defaultEventHandler):
+        Disable the algorithm for selecting the next radio button within a group, if using Spatial Navigation.
+
+2010-10-04  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Andreas Kling.
+
+        SVGFEGaussianBlurElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=47074
+        The patch also implements the simple setStdDeviation method.
+
+        Tests: svg/dynamic-updates/SVGFEGaussianBlurElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFEGaussianBlurElement-dom-stdDeviation-attr.html
+               svg/dynamic-updates/SVGFEGaussianBlurElement-dom-stdDeviation-call.html
+               svg/dynamic-updates/SVGFEGaussianBlurElement-svgdom-in-prop.html
+
+        * svg/SVGFEGaussianBlurElement.cpp:
+        (WebCore::SVGFEGaussianBlurElement::setStdDeviation):
+        (WebCore::SVGFEGaussianBlurElement::svgAttributeChanged):
+        * svg/SVGFEGaussianBlurElement.h:
+
+2010-10-04  Patrick Gansterer  <paroga@paroga.com>
+
+        Reviewed by Darin Adler.
+
+        Add Base64DecodePolicy option at base64Decode()
+        https://bugs.webkit.org/show_bug.cgi?id=41510
+
+        Add an option for ignoring characters in base64 data.
+        This is necessary for decoding data urls.
+
+        Also add an overload to decode WebCore::String directly.
+
+        * page/DOMWindow.cpp:
+        (WebCore::DOMWindow::atob):
+        * page/Page.cpp:
+        (WebCore::Page::userStyleSheetLocationChanged):
+        * platform/text/Base64.cpp:
+        (WebCore::base64Encode):
+        (WebCore::base64Decode):
+        (WebCore::base64DecodeInternal):
+        * platform/text/Base64.h:
+        (WebCore::):
+
+2010-10-04  Ryuan Choi  <bunhere@gmail.com>
+
+        Unreviewed build fix.
+
+        [WML] Build fix for r68854
+        https://bugs.webkit.org/show_bug.cgi?id=47043
+
+        Include HTMLParserIdioms.h.
+
+        No features added, so no new tests.
+
+        * wml/WMLAElement.cpp:
+        * wml/WMLImageLoader.cpp:
+
+2010-10-04  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Unreviewed build fix.
+
+        [CMAKE] Build fix for r68901
+        https://bugs.webkit.org/show_bug.cgi?id=47042
+
+        Move plugins/PluginPackage.cpp
+
+        No features added, so no new tests.
+
+        * CMakeLists.txt:
+
+2010-10-04  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by David Levin.
+
+        Hook FileEntry::createWriter to DOMFileSystem::createWriter
+        https://bugs.webkit.org/show_bug.cgi?id=46908
+
+        No new tests--still waiting for the first complete implementation.
+
+        * fileapi/FileEntry.cpp:
+        (WebCore::FileEntry::createWriter):
+
+2010-10-04  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Spatial Navigation: select element does not release focus with Spatial Navigation
+        https://bugs.webkit.org/show_bug.cgi?id=46896
+
+        When using Spatial Navigation, once a select element is focused, you cannot use arrow keys
+        to navigate out of the select element. That is because select element currently uses the
+        arrow keys to change the selected element.
+        Change the behavior of select element so it does not change selection, if Spatial Navigation
+        is on.
+
+        This patch is addressing the case where Spatial Navigation is used 
+        in a mobile device, and the flag ENABLE_NO_LISTBOX_RENDERING is on.
+        In the future we can add support for the case where the flag is off, and
+        the user needs to traverse the select element inline.
+
+        Tests: fast/events/spatial-navigation/snav-multiple-select.html
+               fast/events/spatial-navigation/snav-single-select.html
+
+        * dom/SelectElement.cpp:
+        (WebCore::SelectElement::menuListDefaultEventHandler):
+
+2010-10-04  Sriram Neelakandan  <sriram.neelakandan@gmail.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QNetworkReplyHandler forces buffered output for FormData with files
+        https://bugs.webkit.org/show_bug.cgi?id=46259
+
+        No new tests. Existing form submit tests should cover this change.
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::FormDataIODevice::FormDataIODevice):
+        (WebCore::FormDataIODevice::computeSize):
+         Add computeSize() for computing form device size
+        (WebCore::QNetworkReplyHandler::start):
+         Call computeSize(), fill Content-Length and prevent UploadData buffering
+        * platform/network/qt/QNetworkReplyHandler.h:
+        (WebCore::FormDataIODevice::getFormDataSize):
+
+2010-10-04  Chang Shu  <chang.shu@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        Fixed the typo that searches the wrong direction in the no-focus-node case.
+        As a result, after page is loaded, pressing key "arrowdown" will bring the
+        focus to the 1st element instead of the last element.
+        https://bugs.webkit.org/show_bug.cgi?id=46901
+
+        Test: fast/events/spatial-navigation/snav-1st-stop.html
+
+        * page/FocusController.cpp:
+        (WebCore::FocusController::advanceFocusDirectionally):
+
+2010-10-04  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+        
+        Touch cf/SocketStreamHandle.h and add an #ifdef to qt/SocketStreamHandle.h
+        to fail at compile time if Mac includes that header.
+
+        * platform/network/cf/SocketStreamHandle.h:
+        * platform/network/qt/SocketStreamHandle.h:
+
+2010-10-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47136
+        WebSocket tests are crashing
+
+        The Mac xcode project was finding qt/SocketStreamHandle.h because of
+        an inadvertent change in r68951. Thus the header and implementation didn't match,
+        and memory corruption ensued.
+        
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-10-04  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by James Robinson.
+
+        Move SharedGraphicsContext3D from ChromeClient to Page
+        https://bugs.webkit.org/show_bug.cgi?id=47113
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::CanvasRenderingContext2D):
+        * page/ChromeClient.h:
+        * page/Page.cpp:
+        (WebCore::Page::sharedGraphicsContext3D):
+        * page/Page.h:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::create):
+        * platform/graphics/gpu/SharedGraphicsContext3D.h:
+
+2010-10-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Implement IndexedDB's oncomplete and ontimeout.
+        https://bugs.webkit.org/show_bug.cgi?id=47106
+
+        Add ontimeout and oncomplete to IDBTransaction and plumb
+        them.  Test this behavior in the existing IDBTransaction-basics
+        test.
+
+        * WebCore.gypi:
+        * storage/IDBTransaction.cpp:
+        (WebCore::IDBTransaction::IDBTransaction):
+        (WebCore::IDBTransaction::mode):
+        (WebCore::IDBTransaction::objectStore):
+        (WebCore::IDBTransaction::abort):
+        (WebCore::IDBTransaction::onAbort):
+        (WebCore::IDBTransaction::onComplete):
+        (WebCore::IDBTransaction::onTimeout):
+        (WebCore::IDBTransaction::stop):
+        (WebCore::IDBTransaction::onAbortTimerFired):
+        (WebCore::IDBTransaction::onCompleteTimerFired):
+        (WebCore::IDBTransaction::onTimeoutTimerFired):
+        * storage/IDBTransaction.h:
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::commit):
+        * storage/IDBTransactionCallbacks.h:
+
+2010-10-04  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash at WebCore::nextCandidate + 27
+        https://bugs.webkit.org/show_bug.cgi?id=47118
+        <rdar://problem/7282934>
+
+        When we canonicalize a Position to create a VisiblePosition, the position
+        is passed by reference. In canonicalPosition we call updateLayoutIgnorePendingStylesheets
+        that can produce a lot of side effects, including changing the selection.
+        This becomes a serious problem whne the position passed as reference is one of
+        the selection endpoints.
+        
+        Test: editing/selection/focus-crash.html
+
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::canonicalPosition):
+
+2010-10-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=37812
+        Assertion failure when appcache/fail-on-update.html is run twice in a row
+
+        Test: http/tests/appcache/fail-on-update-2.html
+
+        For some reason, I can't reproduce this assertion failure with ToT, but the fixes I made
+        previously are still good, and covered by the new test.
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
+        Handle the case when the cache is already obsolete by the time cache selection occurs.
+
+        * loader/appcache/ApplicationCacheHost.cpp: (WebCore::ApplicationCacheHost::failedLoadingMainResource):
+        It's not true that loading from appcache always succeeds - it can be aborted.
+
+        * loader/appcache/ApplicationCacheStorage.cpp: (WebCore::ApplicationCacheStorage::store):
+        Calling ensureOriginRecord(group->origin()) can change lastInsertRowID!
+
+2010-10-04  Erik Arvidsson  <arv@chromium.org>
+
+        Reviewed by James Robinson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47122
+        Crash in classList when class attribute is empty.
+
+        Tests: fast/dom/HTMLElement/class-list.html
+
+        * html/DOMTokenList.cpp:
+        (WebCore::DOMTokenList::length):
+        (WebCore::DOMTokenList::containsInternal):
+        (WebCore::DOMTokenList::classNames):
+
+2010-10-04  Darin Adler  <darin@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Use isHTMLSpace in more places, and optimize it
+        https://bugs.webkit.org/show_bug.cgi?id=47103
+
+        * css/CSSParser.cpp:
+        (WebCore::parseColorInt): Use isHTMLSpace instead of a separate isCSSWhitespace function.
+        (WebCore::parseAlphaValue): Ditto.
+        (WebCore::CSSParser::text): Ditto.
+
+        * dom/SpaceSplitString.h: Removed isClassWhitespace.
+
+        * dom/SpaceSplitString.cpp:
+        (WebCore::SpaceSplitStringData::createVector): Use isHTMLSpace instead of isClassWhitespace.
+        * dom/StyledElement.cpp:
+        (WebCore::StyledElement::classAttributeChanged): Ditto.
+        * html/DOMTokenList.cpp:
+        (WebCore::validateToken): Ditto.
+        (WebCore::DOMTokenList::removeInternal): Ditto.
+
+        * html/parser/HTMLParserIdioms.h: Added histogram data an changed so that non-spaces take
+        only a single branch and plain old spaces take only two branches.
+
+2010-10-04  Justin Schuh  <jschuh@chromium.org>
+
+        Reviewed by James Robinson.
+
+        HTMLMediaElement delayed load should fire asynchronously
+        https://bugs.webkit.org/show_bug.cgi?id=45765
+
+        Test: media/remove-from-document-before-load.html
+
+        * dom/Document.cpp:
+        (WebCore::Document::Document):
+        (WebCore::Document::decrementLoadEventDelayCount):
+        (WebCore::Document::loadEventDelayTimerFired):
+        * dom/Document.h:
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::HTMLMediaElement):
+        (WebCore::HTMLMediaElement::asyncEventTimerFired):
+        (WebCore::HTMLMediaElement::setShouldDelayLoadEvent):
+        * html/HTMLMediaElement.h:
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        ResourceHandle's public/protected/private sections are fragmented
+        https://bugs.webkit.org/show_bug.cgi?id=47038
+
+        Minor cleanup.
+
+        * platform/network/ResourceHandle.h:
+
+2010-10-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43506
+        <rdar://problem/8289284> foreign-iframe-main.html occasionally crashes (during the next test,
+        idempotent-update.html)
+
+        Application cache doesn't use ResourceLoader machinery (for better or worse), so we need to
+        abort update process explicitly.
+
+        Note that in principle, update could piggyback on any other existing frame - or even run
+        frameless - but currently, it's tied to the first frame that requested update.
+
+        * loader/DocumentLoader.cpp:
+        (WebCore::DocumentLoader::stopLoading):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::stopLoadingInFrame):
+        * loader/appcache/ApplicationCacheGroup.h:
+        * loader/appcache/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::~ApplicationCacheHost):
+        (WebCore::ApplicationCacheHost::stopLoadingInFrame):
+        * loader/appcache/ApplicationCacheHost.h:
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename RedirectScheduler to NavigationScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=47037
+
+        This class schedules more than just redirects.  In fact, it schedules
+        most kinds of navigations.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/generic/BindingDOMWindow.h:
+        (WebCore::::createWindow):
+        (WebCore::::open):
+        * bindings/generic/BindingFrame.h:
+        (WebCore::::navigateIfAllowed):
+        * bindings/js/JSDOMWindowCustom.cpp:
+        (WebCore::JSDOMWindow::setLocation):
+        (WebCore::createWindow):
+        (WebCore::JSDOMWindow::open):
+        * bindings/js/JSDocumentCustom.cpp:
+        (WebCore::JSDocument::setLocation):
+        * bindings/js/JSLocationCustom.cpp:
+        (WebCore::JSLocation::reload):
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        (WebCore::V8Location::reloadCallback):
+        * dom/Document.cpp:
+        (WebCore::Document::implicitClose):
+        (WebCore::Document::processHttpEquiv):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::setResourceTrackingEnabled):
+        (WebCore::InspectorController::reloadPage):
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::setDefersLoading):
+        (WebCore::FrameLoader::submitForm):
+        (WebCore::FrameLoader::stopLoading):
+        (WebCore::FrameLoader::didOpenURL):
+        (WebCore::FrameLoader::didExplicitOpen):
+        (WebCore::FrameLoader::cancelAndClear):
+        (WebCore::FrameLoader::clear):
+        (WebCore::FrameLoader::receivedFirstData):
+        (WebCore::FrameLoader::checkCompleted):
+        (WebCore::FrameLoader::provisionalLoadStarted):
+        (WebCore::FrameLoader::completed):
+        (WebCore::FrameLoader::prepareForCachedPageRestore):
+        * loader/FrameLoader.h:
+        * loader/NavigationScheduler.cpp: Added.
+        (WebCore::ScheduledNavigation::ScheduledNavigation):
+        (WebCore::ScheduledNavigation::~ScheduledNavigation):
+        (WebCore::ScheduledNavigation::shouldStartTimer):
+        (WebCore::ScheduledNavigation::didStartTimer):
+        (WebCore::ScheduledNavigation::didStopTimer):
+        (WebCore::ScheduledNavigation::delay):
+        (WebCore::ScheduledNavigation::lockHistory):
+        (WebCore::ScheduledNavigation::lockBackForwardList):
+        (WebCore::ScheduledNavigation::wasDuringLoad):
+        (WebCore::ScheduledNavigation::isLocationChange):
+        (WebCore::ScheduledNavigation::wasUserGesture):
+        (WebCore::ScheduledURLNavigation::ScheduledURLNavigation):
+        (WebCore::ScheduledURLNavigation::fire):
+        (WebCore::ScheduledURLNavigation::didStartTimer):
+        (WebCore::ScheduledURLNavigation::didStopTimer):
+        (WebCore::ScheduledURLNavigation::url):
+        (WebCore::ScheduledURLNavigation::referrer):
+        (WebCore::ScheduledRedirect::ScheduledRedirect):
+        (WebCore::ScheduledRedirect::shouldStartTimer):
+        (WebCore::ScheduledLocationChange::ScheduledLocationChange):
+        (WebCore::ScheduledRefresh::ScheduledRefresh):
+        (WebCore::ScheduledRefresh::fire):
+        (WebCore::ScheduledHistoryNavigation::ScheduledHistoryNavigation):
+        (WebCore::ScheduledHistoryNavigation::fire):
+        (WebCore::ScheduledFormSubmission::ScheduledFormSubmission):
+        (WebCore::ScheduledFormSubmission::fire):
+        (WebCore::ScheduledFormSubmission::didStartTimer):
+        (WebCore::ScheduledFormSubmission::didStopTimer):
+        (WebCore::NavigationScheduler::NavigationScheduler):
+        (WebCore::NavigationScheduler::~NavigationScheduler):
+        (WebCore::NavigationScheduler::redirectScheduledDuringLoad):
+        (WebCore::NavigationScheduler::locationChangePending):
+        (WebCore::NavigationScheduler::clear):
+        (WebCore::NavigationScheduler::scheduleRedirect):
+        (WebCore::NavigationScheduler::mustLockBackForwardList):
+        (WebCore::NavigationScheduler::scheduleLocationChange):
+        (WebCore::NavigationScheduler::scheduleFormSubmission):
+        (WebCore::NavigationScheduler::scheduleRefresh):
+        (WebCore::NavigationScheduler::scheduleHistoryNavigation):
+        (WebCore::NavigationScheduler::timerFired):
+        (WebCore::NavigationScheduler::schedule):
+        (WebCore::NavigationScheduler::startTimer):
+        (WebCore::NavigationScheduler::cancel):
+        * loader/NavigationScheduler.h: Added.
+        * loader/RedirectScheduler.cpp: Removed.
+        * loader/RedirectScheduler.h: Removed.
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::loadOrRedirectSubframe):
+        * loader/appcache/ApplicationCacheGroup.cpp:
+        (WebCore::ApplicationCacheGroup::selectCache):
+        * page/Frame.cpp:
+        (WebCore::Frame::Frame):
+        * page/Frame.h:
+        (WebCore::Frame::navigationScheduler):
+        * page/History.cpp:
+        (WebCore::History::back):
+        (WebCore::History::forward):
+        (WebCore::History::go):
+        * page/XSSAuditor.cpp:
+        (WebCore::XSSAuditor::findInRequest):
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Sam Weinig.
+
+        Remove ENABLE_SANDBOX
+        https://bugs.webkit.org/show_bug.cgi?id=47032
+
+        I'm not sure there's a reason for this to be behind a compile flag
+        anymore.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * GNUmakefile.am:
+        * features.pri:
+        * html/HTMLIFrameElement.cpp:
+        (WebCore::parseSandboxAttribute):
+        (WebCore::HTMLIFrameElement::parseMappedAttribute):
+
+2010-10-04  Huahui Wu  <mediadependent@gmail.com>
+
+        Reviewed by Darin Adler.
+
+        Fix a compiler error for ANDROID introduced by bug 45221.
+        https://bugs.webkit.org/show_bug.cgi?id=47095
+
+        It's a small fix for a compiler error, so there is no new test.
+
+        * platform/android/PlatformTouchEventAndroid.cpp:
+        (WebCore::PlatformTouchEvent::PlatformTouchEvent):
+
+2010-10-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: doAXRangeForLine does not work
+        https://bugs.webkit.org/show_bug.cgi?id=47101
+
+        Asking for NSAccessibilityRangeForLine was returning a null range for any line number > 0.
+        The code was using a SelectionController to extend to the next line. Rather than change the implementation
+        of that core functionality, it is cleaner to use endOfLine to find the end of the line.
+
+        Test: platform/mac/accessibility/range-for-line-textarea.html
+
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::doAXRangeForLine):
+
+2010-10-04  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed, build fix for r68951.
+
+        Add stub implementation for ProxyServer logic.
+
+        * WebCore.vcproj/WebCore.vcproj: Add new WinCairo file.
+        * WebCore/platform/network/curl/ProxyServerCurl.cpp: Added
+
+2010-10-04  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Adam Barth.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47035
+        Application cache selection algorithm should only be invoked after navigation
+
+        Tests: http/tests/appcache/document-write-html-element-2.html
+               http/tests/appcache/document-write-html-element.html
+               http/tests/appcache/insert-html-element-with-manifest-2.html
+               http/tests/appcache/insert-html-element-with-manifest.html
+
+        * dom/DocumentParser.cpp: (WebCore::DocumentParser::DocumentParser):
+        * dom/DocumentParser.h:
+        (WebCore::DocumentParser::setDocumentWasLoadedAsPartOfNavigation):
+        (WebCore::DocumentParser::documentWasLoadedAsPartOfNavigation):
+        Track whether the document being parsed is being loaded as part of navigation.
+
+        * html/HTMLHtmlElement.cpp: (WebCore::HTMLHtmlElement::insertedByParser): Only run the
+        cache selection algorithm if the document is being loaded as part of navigation. We don't 
+        want to switch associated appcache is someone document.writes <html manifest=...>.
+
+        * html/HTMLHtmlElement.h: We need to differentiate between parsing and DOM manipulation, so
+        this code can't be in HTMLHtmlElement::insertedIntoDocument().
+
+        * dom/XMLDocumentParserLibxml2.cpp: (WebCore::XMLDocumentParser::startElementNs):
+        * dom/XMLDocumentParserQt.cpp: (WebCore::XMLDocumentParser::parseStartElement):
+        * html/ImageDocument.cpp: (WebCore::ImageDocument::createDocumentStructure):
+        * html/MediaDocument.cpp: (WebCore::MediaDocumentParser::createDocumentStructure):
+        * html/PluginDocument.cpp: (WebCore::PluginDocumentParser::createDocumentStructure):
+        * html/parser/HTMLConstructionSite.cpp: (WebCore::HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML):
+        Check for manifest attribute in cases specified by HTML5.
+
+        * html/parser/HTMLConstructionSite.h: Removed unused insertHTMLHtmlElement().
+
+        * loader/DocumentWriter.cpp: (WebCore::DocumentWriter::setDocumentWasLoadedAsPartOfNavigation):
+        * loader/DocumentWriter.h:
+        Forward this call to DocumentParser, since DocumentWriter is supposed to encapsulate it.
+
+        * loader/FrameLoader.cpp: (WebCore::FrameLoader::receivedFirstData): Receiving data from
+        loader means being loaded as part of navigation. This notion is used in HTML5 without a rigorous
+        definition that I could find - this seems to be a meaningful formalization.
+
+2010-10-04  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47100
+
+        Convert clearFloats() to be block-flow-aware.  Helpers that it calls have not been patched though.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::clearFloats):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalTopForFloat):
+        (WebCore::RenderBlock::logicalLeftForFloat):
+        (WebCore::RenderBlock::logicalWidthForFloat):
+
+2010-10-04  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Hook up DeviceOrientation data for Qt support
+        https://bugs.webkit.org/show_bug.cgi?id=47052
+
+        Get DeviceOrientation necessary data via Qt mobility library
+        using a provider class.
+
+        * WebCore.pro:
+
+2010-10-01  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        Fixing crash when audio media player is destructed
+        https://bugs.webkit.org/show_bug.cgi?id=47020
+
+        Adds assert for LayerRenderer in destructor.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+
+2010-10-04  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: do not show breakpoint in front-end if it was not set in v8
+        https://bugs.webkit.org/show_bug.cgi?id=46749
+
+        * bindings/v8/DebuggerScript.js:
+        ():
+
+2010-10-04  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [cairo] Context shadow modifies the data of the surface without
+        flushing and marking as dirty
+        https://bugs.webkit.org/show_bug.cgi?id=47079
+
+        Added the cairo_surface_flush and cairo_surface_mark_dirty before
+        and after modifying the image pixels directly.
+
+        * platform/graphics/cairo/ContextShadowCairo.cpp:
+        (WebCore::ContextShadow::endShadowLayer):
+
+2010-10-04  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Crashed caused by missing OwnPtrCairo include, for more
+        information check the issue in the bug 46268.
+
+        * platform/graphics/cairo/CairoUtilities.cpp:
+
+2010-10-04  Alejandro G. Castro  <alex@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [cairo] Move some cairo functions to the CairoUtilities
+        https://bugs.webkit.org/show_bug.cgi?id=47076
+
+        Moved some cairo functions to the CairoUtilities so we can use
+        them outside GraphicsContextCairo.
+
+        * platform/graphics/cairo/CairoUtilities.cpp:
+        (WebCore::appendPathToCairoContext):
+        (WebCore::setPathOnCairoContext):
+        (WebCore::appendWebCorePathToCairoContext):
+        (WebCore::toCairoOperator):
+        (WebCore::drawPatternToCairoContext):
+        * platform/graphics/cairo/CairoUtilities.h:
+        * platform/graphics/cairo/GraphicsContextCairo.cpp:
+        * platform/graphics/cairo/ImageCairo.cpp:
+        (WebCore::Image::drawPattern):
+
+2010-10-04  podivilov@chromium.org  <podivilov@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: implement pausing on event listeners (back-end part)
+        https://bugs.webkit.org/show_bug.cgi?id=46624
+
+        * bindings/js/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        * bindings/js/ScriptDebugServer.h:
+        * bindings/v8/ScriptDebugServer.cpp:
+        (WebCore::ScriptDebugServer::setPauseOnNextStatement):
+        * bindings/v8/ScriptDebugServer.h:
+        * dom/Node.cpp:
+        (WebCore::Node::dispatchGenericEvent):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didCommitLoad):
+        (WebCore::InspectorController::setNativeBreakpoint):
+        (WebCore::InspectorController::removeNativeBreakpoint):
+        (WebCore::InspectorController::shouldBreakOnEvent):
+        (WebCore::InspectorController::shouldBreakOnXMLHttpRequest):
+        * inspector/InspectorController.h:
+        * inspector/InspectorDebuggerAgent.cpp:
+        (WebCore::InspectorDebuggerAgent::~InspectorDebuggerAgent):
+        (WebCore::InspectorDebuggerAgent::schedulePauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::cancelPauseOnNextStatement):
+        (WebCore::InspectorDebuggerAgent::pause):
+        (WebCore::InspectorDebuggerAgent::didContinue):
+        (WebCore::InspectorDebuggerAgent::breakProgram):
+        * inspector/InspectorDebuggerAgent.h:
+        * inspector/InspectorInstrumentation.cpp:
+        (WebCore::eventHasListeners):
+        (WebCore::InspectorInstrumentation::instrumentWillDispatchEventImpl):
+        (WebCore::InspectorInstrumentation::instrumentDidDispatchEventImpl):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequestImpl):
+        * inspector/InspectorInstrumentation.h:
+        (WebCore::InspectorInstrumentation::instrumentWillDispatchEvent):
+        (WebCore::InspectorInstrumentation::instrumentDidDispatchEvent):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequest):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::InspectorTimelineAgent):
+        * inspector/InspectorTimelineAgent.h:
+        (WebCore::InspectorTimelineAgent::id):
+        * inspector/front-end/CallStackSidebarPane.js:
+
+2010-10-04  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: add total bar to the network panel.
+        https://bugs.webkit.org/show_bug.cgi?id=47081
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/ConsoleView.js:
+        (WebInspector.ConsoleView.createDividerElement):
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid.prototype.removeChild):
+        (WebInspector.DataGrid.prototype.sortNodes):
+        (WebInspector.DataGrid.prototype._clickInHeaderCell):
+        (WebInspector.DataGrid.prototype.markColumnAsSortedBy):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype.resize):
+        (WebInspector.NetworkPanel.prototype._positionSummaryBar):
+        (WebInspector.NetworkPanel.prototype._createTimelineGrid):
+        (WebInspector.NetworkPanel.prototype._createSortingFunctions):
+        (WebInspector.NetworkPanel.prototype._sortItems):
+        (WebInspector.NetworkPanel.prototype._sortByTimeline):
+        (WebInspector.NetworkPanel.prototype._createFilterStatusBarItems):
+        (WebInspector.NetworkPanel.prototype._createSummaryBar):
+        (WebInspector.NetworkPanel.prototype._updateSummaryBar):
+        (WebInspector.NetworkPanel.prototype._updateFilter):
+        (WebInspector.NetworkPanel.prototype.show):
+        (WebInspector.NetworkPanel.prototype.refresh):
+        (WebInspector.NetworkPanel.prototype.reset):
+        (WebInspector.NetworkDataGridNode.SizeComparator):
+        (WebInspector.NetworkDataGridNode.ResourcePropertyComparator):
+        (WebInspector.NetworkTotalGridNode):
+        (WebInspector.NetworkTotalGridNode.prototype.createCells):
+        * inspector/front-end/ResourcesPanel.js:
+        (WebInspector.ResourcesPanel.prototype.createFilterPanel):
+        * inspector/front-end/inspector.css:
+        (.scope-bar-divider):
+        * inspector/front-end/networkPanel.css:
+        (.network-timeline-grid):
+        (.network-summary-bar):
+        (.network-summary-bar-bottom):
+        (.data-grid td .network-summary-bar):
+
+2010-09-28  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport data change notifications
+        https://bugs.webkit.org/show_bug.cgi?id=46755
+
+        Regarding viewport meta tags, what matters for browser developers is to know when the viewport data has
+        changed and its current value. Viewport data belongs to the document, but it is useful to keep the current
+        viewport data in Page as a reference, to be able to send notifications only when the current viewport
+        has changed.
+
+        * dom/Document.cpp:
+        (WebCore::Document::processViewport):
+        (WebCore::Document::setInPageCache):
+        * dom/ViewportArguments.h:
+        (WebCore::ViewportArguments::operator==):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::HTMLBodyElement):
+        * page/Chrome.cpp:
+        (WebCore::Chrome::viewportDataChanged):
+        * page/Chrome.h:
+        * page/ChromeClient.h:
+        (WebCore::ChromeClient::viewportDataChanged):
+        * page/Page.cpp:
+        (WebCore::Page::updateViewportArguments):
+        * page/Page.h:
+        (WebCore::Page::viewportArguments):
+
+2010-10-03  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, build fix for r68996.
+
+        * html/BaseDateAndTimeInputType.cpp: Includes <wtf/MathExtras.h> for isfinite().
+        * html/MonthInputType.cpp: ditto.
+        * html/NumberInputType.cpp: ditto.
+        * html/RangeInputType.cpp: ditto.
+
+2010-10-03  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Move parseToDouble() and
+        parseToDateComponents() to InputType.
+        https://bugs.webkit.org/show_bug.cgi?id=46965
+
+        Introduce BaseDateAndTimeInputType, which is a super class of
+        date, datetime, datetime-local, month, time, and week types.
+
+        No new tests. Just a refactoring.
+
+        * Android.mk: Add BaseDateAndTimeInputType.
+        * CMakeLists.txt: ditto.
+        * GNUmakefile.am: ditto.
+        * WebCore.gypi: ditto.
+        * WebCore.pro: ditto.
+        * WebCore.vcproj/WebCore.vcproj: ditto.
+        * WebCore.xcodeproj/project.pbxproj: ditto.
+        * html/BaseDateAndTimeInputType.cpp: Added.
+        (WebCore::BaseDateAndTimeInputType::parseToDouble):
+        (WebCore::BaseDateAndTimeInputType::parseToDateComponents):
+        * html/BaseDateAndTimeInputType.h: Added.
+        (WebCore::BaseDateAndTimeInputType::BaseDateAndTimeInputType):
+        * html/DateInputType.cpp:
+        (WebCore::DateInputType::parseToDateComponentsInternal):
+        * html/DateInputType.h:
+        (WebCore::DateInputType::DateInputType):
+        * html/DateTimeInputType.cpp:
+        (WebCore::DateTimeInputType::parseToDateComponentsInternal):
+        * html/DateTimeInputType.h:
+        (WebCore::DateTimeInputType::DateTimeInputType):
+        * html/DateTimeLocalInputType.cpp:
+        (WebCore::DateTimeLocalInputType::parseToDateComponentsInternal):
+        * html/DateTimeLocalInputType.h:
+        (WebCore::DateTimeLocalInputType::DateTimeLocalInputType):
+        * html/HTMLInputElement.cpp: Replace parseToD* calls with m_inputType->parseToD*.
+        (WebCore::HTMLInputElement::typeMismatch):
+        (WebCore::HTMLInputElement::rangeUnderflow):
+        (WebCore::HTMLInputElement::rangeOverflow):
+        (WebCore::HTMLInputElement::minimum):
+        (WebCore::HTMLInputElement::maximum):
+        (WebCore::HTMLInputElement::stepBase):
+        (WebCore::HTMLInputElement::stepMismatch):
+        (WebCore::HTMLInputElement::applyStep):
+        (WebCore::HTMLInputElement::valueAsDate):
+        (WebCore::HTMLInputElement::valueAsNumber):
+        (WebCore::HTMLInputElement::handleKeyEventForRange):
+        (WebCore::HTMLInputElement::stepUpFromRenderer):
+        * html/HTMLInputElement.h:
+        * html/InputType.cpp:
+        (WebCore::InputType::parseToDouble):
+        (WebCore::InputType::parseToDateComponents):
+        * html/InputType.h:
+        * html/MonthInputType.cpp:
+        (WebCore::MonthInputType::parseToDouble):
+        (WebCore::MonthInputType::parseToDateComponentsInternal):
+        * html/MonthInputType.h:
+        (WebCore::MonthInputType::MonthInputType):
+        * html/NumberInputType.cpp:
+        (WebCore::NumberInputType::parseToDouble):
+        * html/NumberInputType.h:
+        * html/RangeInputType.cpp:
+        (WebCore::RangeInputType::parseToDouble):
+        * html/RangeInputType.h:
+        * html/TimeInputType.cpp:
+        (WebCore::TimeInputType::parseToDateComponentsInternal):
+        * html/TimeInputType.h:
+        (WebCore::TimeInputType::TimeInputType):
+        * html/WeekInputType.cpp:
+        (WebCore::WeekInputType::parseToDateComponentsInternal):
+        * html/WeekInputType.h:
+        (WebCore::WeekInputType::WeekInputType):
+
+2010-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        ASSERT(m_state = Open); is bad news bears
+        https://bugs.webkit.org/show_bug.cgi?id=47057
+
+        Added by ap (review by darin) in http://trac.webkit.org/changeset/50951
+        Too bad the compiler doesn't catch these errors.  I don't believe this
+        is possible to test.
+
+        * platform/network/cf/SocketStreamHandleCFNet.cpp:
+        (WebCore::SocketStreamHandle::writeStreamCallback):
+
+2010-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        All the WebSocket tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=47056
+
+        More code that tries to hold onto temporaries with references.
+
+        * websockets/WebSocketChannel.cpp:
+        (WebCore::WebSocketChannel::didOpen):
+
+2010-10-03  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Holger Freyther.
+
+        All the WebSocket tests crash
+        https://bugs.webkit.org/show_bug.cgi?id=47055
+
+        This code attempts to hold onto temporary objects using references.
+        That doesn't work in C++. Instead, we need to actually store the
+        objects somewhere.
+
+        * bindings/js/JSWebSocketCustom.cpp:
+        (WebCore::JSWebSocketConstructor::constructJSWebSocket):
+
+2010-10-02  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Provide Qt support for DeviceMotion/Orientation clients
+        https://bugs.webkit.org/show_bug.cgi?id=47051
+
+        Add Qt DeviceMotion/Orientation dummy clients in build system.
+
+        * WebCore.pro:
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Rewrite SVG text layout code
+        https://bugs.webkit.org/show_bug.cgi?id=45532
+
+        Modernize SVG text layout engine, split the layout process into three phases, so that each results can be cached (which will be done in a follow-up patch).
+
+        Phase #1) - SVGTextLayoutAttributesBuilder
+        ------------------------------------------
+
+        Parse x/y/dx/dy/rotate values of the <text> subtree (<text x="30 40">A<tspan>B<tspan x="50">C</tspan></tspan></text>)
+        This is done by SVGTextLayoutAttributesBuilder. It builds a SVGTextLayoutAttributes object for each RenderSVGInlineText renderer, and stores it there.
+        Phase #1 is started from RenderSVGText::layout(), before RenderBlockLineLayout is laying out the inline children, and thus before the InlineBox tree is created.
+
+        Now we know which character has an associated absolute x or y position, denoting the start of a new text chunk. Whenever we encounter a new text chunk
+        RenderBlockLineLayout should create a new SVGInlineTextBox. This is very important, as BiDi reordering shouldn't happen across text chunks, as well as ligature detection.
+
+        The text chunk concept is now merged right into the InlineBox tree, so we don't need to hack around the lack of that, as done for the previous years.
+
+        Phase #2) - SVGTextLayoutEngine
+        ------------------------------------------
+
+        RenderSVGText::layout() calls RenderBlock::layoutInlineChildren() right after phase #1 ends. The InlineBox tree is created. During that process findNextLineBreak()
+        decides how to split up the text into InlineTextBoxes. It has already been patched, to ask RenderSVGInlineText::characterStartsNewTextChunk(int position), whether the
+        current character should go in a new SVGInlineTextBox or not. This requires that phase #1 already stored these information in the RenderSVGInlineText objects.
+
+        For each <text> object a SVGRootInlineBox is created (in constructLine()) and all child boxes are added. After that SVGRootInlineBox::computePerCharacterLayoutInformation()
+        is called (unlike HTML text, which splits the vertical & horizontal layout in two phases, it's just one single phase for SVG). This function invokes SVGTextLayoutEngine
+        and starts phase #2 of the layout process.
+
+        SVGTextLayoutEngine lays out the content of each SVGInlineTextBox either on a line or a path. It contains all the logic handling, alignment-baseline, dominant-baseline,
+        letter-spacing, word-spacing, kerning, glyph-orientation-(horizontal|vertical), rotation, etc. etc.
+
+        As result it generates a set of SVGTextFragment objects which are stored in each SVGInlineTextBox. Each SVGTextFragment is a portion of text that can be rendered/measured
+        at once. Some examples to illustrate what's going on:
+
+        <text x="20">ABCD</text>:
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 4, "ABCD" (x=20)
+
+        <text x="20 100">ABCD</text>:
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 1, "A" (x=20)
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 1, "B" (x=100)
+          - SVGTextFragment, start 1 length 2, "CD" (x=100 + advance_of_last)
+
+        <text><textPath xlink:href="#somePath">ABCD</textPath></text>:
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 1, "A" (rotated!)
+          - SVGTextFragment, start 1 length 1, "B" (rotated!)
+          - SVGTextFragment, start 2 length 1, "C" (rotated!)
+          - SVGTextFragment, start 3 length 1, "D" (rotated!)
+
+        <text x="0 50 100">A<tspan>B</tspan>C</text>
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 1, "A" (x=0)
+        - SVGInlineFlowBox
+          - SVGInlineTextBox
+            - SVGTextFragment, start 0 length 1, "B" (x=50)
+        - SVGInlineTextBox
+          - SVGTextFragment, start 0 length 1, "C" (x=100)
+
+        When painting text SVGInlineTextBox just walks its fragments and paints them. Text selection works the same.
+        All text measurements (width/height etc.) have already been done in phase #2 and aren't required anymore while painting/selecting.
+        This is one of the main benefits of the new text layout engine, painting & selection is cheap now, compared to the layout process.
+
+        We're now doing phase #1 everytime RenderSVGText::layout() is called. This is not necessary, we only have to recompute these information
+        if the x/y/dx/dy or rotate list of an element in the <text> subtree changes or the text content itself -> this will be done in a follow-up patch.
+        It's likely that we'll also find ways to skip phase #2 in certain situations.
+
+        Phase #3) - SVGTextChunkBuilder
+        ------------------------------------------
+
+        After phase #2 finished, we can post-process the text fragments. Certain operations have to be applied on a "per chunk" basis.
+        text-anchor should be applied to individual text chunks, as well as textLength corrections (lengthAdjust="spacing" / lengthAdjust="spacingAndGlyphs").
+
+        SVGTextChunkBuilder just walks the SVGInlineTextBox, and collects all boxes belonging to a certain chunk. For each of the chunks all fragments
+        are post-processed. For instance for text-anchor="middle", all x positions of all fragments are shifted by -fragmentWidth/2 (for horizonal text).
+
+        After phase #1 - #3 finished, SVGRootInlineBox::computePerCharacterLayoutInformation() utilizies the stored SVGTextFragments to lay out all child
+        boxes in the InlineBox tree (setWidth/Height, etc.), the size and position of the SVGRootInlineBox and it's parent RenderSVGText object.
+
+        This should give interessted readers a good summary of how the new text layout engine works.
+        See LayoutTests/ChangeLog for more details on test progression.
+
+        Tests: svg/custom/text-rotation.svg
+               svg/custom/text-x-dy-lists.svg
+
+        * Android.mk: Add SVGTextLayoutEngine.* / SVGTextChunkBuilder.* to build. Remove SVGCharacterData.* / SVGTextChunkLayoutInfo.* / SVGTextLayoutUtilities.* from build.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::isSVGInlineFlowBox): Add helper function to identify SVGInlineFlowBoxes. The variants for SVGInlineTextBox etc. already exist.
+        * rendering/InlineTextBox.h: Devirtualize selectionStartEnd, SVG is no longer overriding it.
+        * rendering/RenderSVGAllInOne.cpp: removes
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::setTextInternal): Remove SVG specific hacks, moved to RenderSVGInlineText.
+        * rendering/SVGCharacterData.cpp: Removed.
+        * rendering/SVGCharacterData.h: Removed.
+        * rendering/SVGCharacterLayoutInfo.cpp: Removed.
+        * rendering/SVGCharacterLayoutInfo.h: Removed.
+        * rendering/SVGRenderTreeAsText.cpp: Hack DRT output to be somewhat compatible with the current output, the plan is to change it completly after this patch.
+        (WebCore::writeRenderSVGTextBox):
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/SVGTextChunkLayoutInfo.cpp: Removed.
+        * rendering/SVGTextChunkLayoutInfo.h: Removed.
+        * rendering/SVGTextLayoutUtilities.cpp: Removed.
+        * rendering/SVGTextLayoutUtilities.h: Removed.
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::diff): Only return immediately if SVGRenderStyle::diff produced StyleDifferenceLayout, it it's sth. else be sure to ask RenderStyle itself what to do.
+        * rendering/style/SVGRenderStyle.h:
+        (WebCore::SVGRenderStyle::isVerticalWritingMode): New helper method, moved from SVGTextLayoutUtilities.
+        * rendering/svg/RenderSVGInlineText.cpp:
+        (WebCore::applySVGWhitespaceRules): Moved from RenderText into a SVG specific place.
+        (WebCore::RenderSVGInlineText::RenderSVGInlineText): Use applySVGWhitespaceRules on the incoming text.
+        (WebCore::RenderSVGInlineText::styleDidChange): Only apply SVG white space rules, when using xml:space="preserve", otherwhise the constructor already handled it.
+        (WebCore::RenderSVGInlineText::characterStartsNewTextChunk): Create text chunks for absolute y values as well, SVG 1.1 2nd Edition demands that.
+        (WebCore::RenderSVGInlineText::positionForPoint): New function operating on all SVGInlineTextBoxes and their SVGTextFragments.
+        * rendering/svg/RenderSVGInlineText.h:
+        (WebCore::RenderSVGInlineText::layoutAttributes): Stores the layout attributes generated by SVGTextLayoutAttributesBuilder.
+        (WebCore::toRenderSVGInlineText): New helper methods for casting.
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout): Add comment, that SVGTextLayoutAttributesBuilder is just phase one of the layout process.
+        (WebCore::RenderSVGText::positionForPoint): Simplified implementation for SVGs needs.
+        * rendering/svg/RenderSVGText.h:
+        * rendering/svg/SVGInlineFlowBox.cpp:
+        (WebCore::SVGInlineFlowBox::paintSelectionBackground): Seperated selection background drawing from actual text rendering, to make sure selection is always in background for SVG.
+        (WebCore::SVGInlineFlowBox::paint): Call computetextMatchMarkerRectForRenderer, before painting.
+        (WebCore::SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer): New method.
+        * rendering/svg/SVGInlineFlowBox.h:
+        (WebCore::SVGInlineFlowBox::isSVGInlineFlowBox):
+        * rendering/svg/SVGInlineTextBox.cpp: Completly rewritten, operates on SVGTextFragments, produced by the SVGTextLayoutEngine. Whole new concept, compared to the old hack.
+        * rendering/svg/SVGInlineTextBox.h:
+        (WebCore::SVGInlineTextBox::clearTextFragments): Only used by SVGTextLayoutEngine, to clean up previously computed fragments.
+        (WebCore::SVGInlineTextBox::textFragments): Offers access to the fragments in the box.
+        (WebCore::SVGInlineTextBox::startsNewTextChunk): Does this box start a new text chunk?
+        (WebCore::SVGInlineTextBox::setStartsNewTextChunk): SVGTextLayoutEngine marks this box, if it starts a new text chunk.
+        * rendering/svg/SVGRootInlineBox.cpp: Remove old code regarding text chunk parts.
+        (WebCore::SVGRootInlineBox::paint): Selection is now painted before text, to assure it's really in the background.
+        (WebCore::SVGRootInlineBox::computePerCharacterLayoutInformation): Use new SVGTextLayoutEngine.
+        (WebCore::SVGRootInlineBox::layoutCharactersInTextBoxes): Feed SVGTextLayoutEngine with SVGInlineTextBoxes, detect the begin/end of path layouts.
+        (WebCore::SVGRootInlineBox::layoutChildBoxes): Use new isSVGInlineTextBox() helper method.
+        (WebCore::SVGRootInlineBox::closestLeafChildForPosition): Simplified version for SVG.
+        * rendering/svg/SVGRootInlineBox.h: Remove access to text chunks, they're now longer stored in the SVGRootInlineBox.
+        * rendering/svg/SVGTextChunk.cpp: s/SVGTextChunkNew/SVGTextChunk/
+        * rendering/svg/SVGTextChunk.h:
+        * rendering/svg/SVGTextChunkBuilder.cpp: Added.
+        * rendering/svg/SVGTextChunkBuilder.h: Added.
+        * rendering/svg/SVGTextLayoutAttributes.cpp: Constify dump() method.
+        * rendering/svg/SVGTextLayoutAttributes.h:
+        (WebCore::SVGTextLayoutAttributes::textMetricsValues):
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Rewritten, consume less memory, while building the layout attributes.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h:
+        * rendering/svg/SVGTextLayoutEngine.cpp: Added.
+        * rendering/svg/SVGTextLayoutEngine.h: Added.
+        * rendering/svg/SVGTextQuery.cpp: Rewritten to deal with the new SVGTextFragment/SVGTextLayoutAttributes logic.
+        * rendering/svg/SVGTextQuery.h:
+
+2010-10-02  Alpha Lam  <hclam@chromium.org>
+
+        Build fix. Not reviewed.
+
+        An adhoc fix for a crash found by reliability bot. This will make the
+        reliability bot happy. A proper fix is pending commit.
+
+        * platform/graphics/chromium/VideoLayerChromium.cpp:
+        (WebCore::VideoLayerChromium::~VideoLayerChromium):
+
+2010-10-01  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        FormatBlockCommand and IndentOutdentCommand should use the same code to iterate paragraphs
+        https://bugs.webkit.org/show_bug.cgi?id=46840
+
+        Added ApplyBlockElementCommand, which is an abstract class inherited by FormatBlockCommand
+        and IndentOutdentCommand.  It is intended to be inherited by InsertListCommand as well.
+
+        ApplyBlockElementCommand's doApply verifies the current selection and exits early
+        if it's invalid or orphaned or if the current selection is outside editable region.
+        It then calls formatSelection to apply the block element after which doApply restores the selection.
+        formatSelection iterates through paragraphs and calls formatParagraph, a pure virtual function
+        implemented by FormatBlockCommand and IndentOutdentCommand, on each paragraph.
+
+        No new tests are added since this is a refactoring.
+
+        * Android.mk: Added ApplyBlockElementCommand.cpp.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Added ApplyBlockElementCommand.cpp and ApplyBlockElementCommand.h.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * editing/ApplyBlockElementCommand.cpp: Added.
+        (WebCore::countParagraphs): Moved from IndentOutdentCommand.cpp
+        (WebCore::ApplyBlockElementCommand::ApplyBlockElementCommand): Added.
+        (WebCore::ApplyBlockElementCommand::doApply): Moved from IndentOutdentCommand::doApply.
+        (WebCore::ApplyBlockElementCommand::formatSelection): Moved from IndentOutdentCommand::indentRegion.
+        (WebCore::ApplyBlockElementCommand::createBlockElement): Added.
+        (WebCore::ApplyBlockElementCommand::splitTextNodes): Moved from IndentOutdentCommand::splitTextNodes.
+        * editing/ApplyBlockElementCommand.h: Added.
+        * editing/EditingAllInOne.cpp:
+        * editing/EditorCommand.cpp:
+        (WebCore::executeFormatBlock):
+        * editing/FormatBlockCommand.cpp: Removed doApply.
+        (WebCore::FormatBlockCommand::FormatBlockCommand): Calls ApplyBlockElementCommand's constructor.
+        (WebCore::FormatBlockCommand::formatParagraph): Renamed from doApplyForSingleParagraph.
+        * editing/FormatBlockCommand.h: FormatBlockCommand inherits from ApplyBlockElementCommand.
+        (WebCore::FormatBlockCommand::create): Uses QualifiedName for the tag name instead of AtomicString.
+        * editing/IndentOutdentCommand.cpp: Removed doApply, indentIntoBlockquote, and splitTextNodes.
+        (WebCore::IndentOutdentCommand::IndentOutdentCommand): Calls ApplyBlockElementCommand's constructor.
+        (WebCore::IndentOutdentCommand::indentIntoBlockquote): The code to nullify targetBlockquote
+        when the next paragraph is in a different table cell is moved to ApplyBlockElementCommand::formatSelection.
+        (WebCore::IndentOutdentCommand::formatSelection): Added. Calls outdentRegion when outdenting.
+        (WebCore::IndentOutdentCommand::formatParagraph): Added. Calls tryIndentingAsListItem and indentIntoBlockquote.
+        * editing/IndentOutdentCommand.h: IndentOutdentCommand inherits from ApplyBlockElementCommand.
+
+2010-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        Clear the executable bit from a number of source files.
+
+        * page/Frame.cpp:
+        * platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.cpp:
+        * platform/graphics/win/WKCACFLayerRenderer.h:
+        * platform/network/ResourceRawHeaders.h:
+        * rendering/RenderLayerCompositor.cpp:
+        * rendering/RenderLayerCompositor.h:
+
+2010-10-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Adam Barth.
+
+        [GTK] r68923 broke some plugin tests
+        https://bugs.webkit.org/show_bug.cgi?id=47040
+
+        No longer pass focus and blur events to plugins when the "old" DOM Level
+        2 DOMFocusIn/DOMFocusOut events occur. r68923 made a change which means
+        that the DOM Level 3 version is always fired for this event. 
+
+        No new tests, as this should cause the failing tests to pass.
+
+        * plugins/PluginView.cpp:
+        (WebCore::PluginView::handleEvent): No longer pass focus and blur events to
+        plugins when DOMFocusIn / DOMFocusOut events occur.
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Plug-ins should have access to the private browsing state.
+        https://bugs.webkit.org/show_bug.cgi?id=47031
+        <rdar://problem/8505405>
+
+        * page/Page.cpp:
+        (WebCore::Page::privateBrowsingStateChanged):
+        When iterating over all widgets, also look for PluginViewBase classes and invoke their 
+        privateBrowsingStateChange member function.
+
+        * plugins/PluginViewBase.h:
+        (WebCore::PluginViewBase::privateBrowsingStateChanged):
+        Add function.
+
+2010-10-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Build Fix for Windows.
+
+        * WebCore.vcproj/WebCore.vcproj: Don't have an empty post-build step, use
+            WebCoreCommon.vsprops to handle post-build step.
+        * WebCore.vcproj/WebCoreCommon.vsprops: Set the post-build step to delete 
+             $(WebKitOutputDir)/buildfailed.
+
+2010-10-01  Ragner Magalhaes  <ragner.magalhaes@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Segmentation fault during zoom out
+        https://bugs.webkit.org/show_bug.cgi?id=46984
+
+        * platform/qt/QtMobileWebStyle.cpp:
+        (QtMobileWebStyle::drawChecker): Adjust checkerSize to be greater than or equals to middle.
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Another Qt build fix attempt.
+
+        * WebCore.pro:
+
+2010-10-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47021
+        
+        Patch the floatBottom function and its friends.  Rename them and consolidate them to be block-flow-aware.
+
+        Nothing testable yet, since most of the float code is still unpatched.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::newLine):
+        (WebCore::RenderBlock::nextFloatLogicalBottomBelow):
+        (WebCore::RenderBlock::lowestFloatLogicalBottom):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::getClearDelta):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalBottomForFloat):
+        (WebCore::RenderBlock::hasOverhangingFloats):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::fitBelowFloats):
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Fix typo.
+
+        * platform/network/qt/ProxyServerQt.cpp:
+        (WebCore::proxyServersForURL):
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Add Qt ProxyServer stub.
+
+        * WebCore.pro:
+        * platform/network/qt/ProxyServerQt.cpp: Added.
+        (WebCore::proxyServersForURL):
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add proxy server query function proxyServersForURL and change the Mac plug-in code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=47022
+        <rdar://problem/8504712>
+
+        * WebCore.exp.in:
+        Export proxyServersForURL and toString.
+
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        Add new files.
+
+        * platform/network/ProxyServer.cpp: Added.
+        (WebCore::appendProxyServerString):
+        (WebCore::toString):
+        New function that converts a vector of ProxyServers into a PAC style string.
+
+        * platform/network/ProxyServer.h: Added.
+        (WebCore::ProxyServer::ProxyServer):
+        (WebCore::ProxyServer::type):
+        (WebCore::ProxyServer::hostName):
+        (WebCore::ProxyServer::port):
+        Add ProxyServer class.
+
+        * platform/network/cf/ProxyServerCFNet.cpp: Added.
+        (WebCore::proxyServersForURL):
+        (WebCore::addProxyServersForURL):
+        Query CFNetwork for the proxy servers given a URL.
+
+2010-09-30  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        texImage2D fails on 16-bit-per-channel images
+        https://bugs.webkit.org/show_bug.cgi?id=46947
+
+        * platform/graphics/GraphicsContext3D.cpp: Handling 16-bit-per-channel source formats.
+        (WebCore::convertColor16To8):
+        (WebCore::doPacking):
+        * platform/graphics/GraphicsContext3D.h: Ditto.
+        * platform/graphics/cg/GraphicsContext3DCG.cpp: Ditto.
+        (WebCore::GraphicsContext3D::getImageData):
+
+2010-10-01  Eric Uhrhane  <ericu@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Add v8 binding helpers to make FileWriter be an EventTarget.
+        https://bugs.webkit.org/show_bug.cgi?id=46910
+
+        No new tests; still waiting for the first complete implementation.
+
+        * bindings/v8/V8DOMWrapper.cpp:
+        (WebCore::V8DOMWrapper::convertEventTargetToV8Object):
+
+2010-10-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47015
+        
+        Change FloatingObject to store its dimensions as a rect.
+        This will make it easier for logical access for block-flow later on if
+        top/bottom is no different from left/width.  This change also simplifies
+        calling code a bit in places.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::addOverflowFromFloats):
+        (WebCore::RenderBlock::repaintOverhangingFloats):
+        (WebCore::RenderBlock::paintFloats):
+        (WebCore::RenderBlock::fillSelectionGaps):
+        (WebCore::RenderBlock::insertFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObject):
+        (WebCore::RenderBlock::removeFloatingObjectsBelow):
+        (WebCore::RenderBlock::positionNewFloats):
+        (WebCore::RenderBlock::positionNewFloatOnLine):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::nextFloatBottomBelow):
+        (WebCore::RenderBlock::floatBottom):
+        (WebCore::RenderBlock::lowestPosition):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::leftBottom):
+        (WebCore::RenderBlock::rightBottom):
+        (WebCore::RenderBlock::clearFloats):
+        (WebCore::RenderBlock::addOverhangingFloats):
+        (WebCore::RenderBlock::addIntrudingFloats):
+        (WebCore::RenderBlock::hitTestFloats):
+        (WebCore::RenderBlock::adjustForBorderFit):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::FloatingObject::FloatingObject):
+        (WebCore::RenderBlock::FloatingObject::left):
+        (WebCore::RenderBlock::FloatingObject::right):
+        (WebCore::RenderBlock::FloatingObject::top):
+        (WebCore::RenderBlock::FloatingObject::bottom):
+        (WebCore::RenderBlock::FloatingObject::width):
+        (WebCore::RenderBlock::FloatingObject::height):
+        (WebCore::RenderBlock::FloatingObject::setLeft):
+        (WebCore::RenderBlock::FloatingObject::setTop):
+        (WebCore::RenderBlock::FloatingObject::setWidth):
+        (WebCore::RenderBlock::FloatingObject::setHeight):
+        (WebCore::RenderBlock::FloatingObject::frameRect):
+        (WebCore::RenderBlock::FloatingObject::setFrameRect):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        (WebCore::RenderBlock::matchedEndLine):
+
+2010-10-01  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        DOMFocusIn/DOMFocusOut return focusin/focusout Event.type
+        https://bugs.webkit.org/show_bug.cgi?id=42580
+        <rdar://problem/8107311>
+        
+        This change removes the aliased type machinery from the Event class.
+        We now fire the event with the new name and the oldname.
+        
+        Tests: Modified fast/events/focusinout.html to check the event
+        type.
+
+        * dom/Document.cpp:
+        (WebCore::Document::setFocusedNode):
+        * dom/Event.cpp: Removed aliasedType and hasAliasedType.
+        * dom/Event.h: Removed aliasedType and hasAliasedType.
+        * dom/EventTarget.cpp:
+        (WebCore::EventTarget::fireEventListeners): Removed aliasedType related code.
+
+2010-10-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46642, make replaced elements work with block-flow.  This patch changes
+        all of the computeReplacedLogicalWidth and comuteReplacedLogicalHeight functions (and their helpers) to use logical width
+        and logical height instead.
+
+        Added fast/blockflow/block-level-images.html
+
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalWidth):
+        (WebCore::RenderBox::computeReplacedLogicalWidthUsing):
+        (WebCore::RenderBox::computeReplacedLogicalHeight):
+        (WebCore::RenderBox::computeReplacedLogicalHeightUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::computePositionedLogicalHeightReplaced):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::intrinsicLogicalWidth):
+        (WebCore::RenderBox::intrinsicLogicalHeight):
+        * rendering/RenderImage.cpp:
+        (WebCore::RenderImage::isLogicalWidthSpecified):
+        (WebCore::RenderImage::isLogicalHeightSpecified):
+        (WebCore::RenderImage::computeReplacedLogicalWidth):
+        (WebCore::RenderImage::computeReplacedLogicalHeight):
+        (WebCore::RenderImage::calcAspectRatioLogicalWidth):
+        (WebCore::RenderImage::calcAspectRatioLogicalHeight):
+        * rendering/RenderImage.h:
+        * rendering/RenderReplaced.cpp:
+        (WebCore::RenderReplaced::layout):
+        (WebCore::RenderReplaced::computeReplacedLogicalWidth):
+        (WebCore::RenderReplaced::computeReplacedLogicalHeight):
+        (WebCore::RenderReplaced::calcAspectRatioLogicalWidth):
+        (WebCore::RenderReplaced::calcAspectRatioLogicalHeight):
+        (WebCore::RenderReplaced::computePreferredLogicalWidths):
+        * rendering/RenderReplaced.h:
+        * rendering/RenderSVGRoot.cpp:
+        (WebCore::RenderSVGRoot::computePreferredLogicalWidths):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalWidth):
+        (WebCore::RenderSVGRoot::computeReplacedLogicalHeight):
+        * rendering/RenderSVGRoot.h:
+        * rendering/RenderVideo.cpp:
+        (WebCore::RenderVideo::computeReplacedLogicalWidth):
+        (WebCore::RenderVideo::computeReplacedLogicalHeight):
+        * rendering/RenderVideo.h:
+
+2010-10-01  Nate Chapin  <japhet@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Remove unused Request::buffer() and Request::m_buffer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47003
+
+        * loader/Request.h:
+
+2010-10-01  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        <rdar://problem/7563219> Null dereference when dragging an element with generated content
+        https://bugs.webkit.org/show_bug.cgi?id=47005
+
+        Test: fast/css-generated-content/drag-state.html
+
+        * rendering/RenderObject.cpp:
+        (WebCore::RenderObject::updateDragState): Null-check node().
+
+2010-10-01  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        [Qt] Fix http/tests/loading/redirect-methods.html
+
+        Document our redirection behaviour too.
+
+        https://bugs.webkit.org/show_bug.cgi?id=41571
+
+        * platform/network/qt/QNetworkReplyHandler.cpp:
+        (WebCore::QNetworkReplyHandler::QNetworkReplyHandler):
+        (WebCore::QNetworkReplyHandler::sendResponseIfNeeded):
+        * platform/network/qt/QNetworkReplyHandler.h:
+
+2010-10-01  Adam Roben  <aroben@apple.com>
+
+        Copy forwarding headers and Inspector JS files as part of
+        WebCoreGenerated.vcproj
+
+        WebCoreGenerated.vcproj runs on every build, while WebCore.vcproj only
+        runs when a .h or .cpp file changes. By moving the copying to
+        WebCoreGenerated, it will happen even when someone only changes a JS
+        file (as happened in r68887).
+
+        Fixes <http://webkit.org/b/46988> <rdar://problem/8502489> REGRESSION
+        (r68887): Web Inspector: inspector/extensions*.html are failing on
+        Windows
+
+        Reviewed by Anders Carlsson.
+
+        * WebCore.vcproj/WebCore.vcproj: Moved invocation of
+        copyForwardingHeaders and copyInspectorFiles from here...
+        * WebCore.vcproj/WebCoreGenerated.vcproj: ...to here.
+
+2010-09-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Implement queryCommandState('justifyFull')
+        https://bugs.webkit.org/show_bug.cgi?id=46954
+
+        Implemented queryCommandState('justifyFull').
+        New tests are added to editing/style/inline-style-container.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::getTextAlignment): Added support for CSSValueJustify.
+        * editing/EditorCommand.cpp:
+        (WebCore::stateJustifyFull): Added.
+        (WebCore::createCommandMap): Added stateJustifyFull.
+
+2010-10-01  Jia Pu  <jpu@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Autocorrection shouldn't prompt the same correction after user has edited previous correction.
+        https://bugs.webkit.org/show_bug.cgi?id=46839
+        <rdar://problem/8476963>
+
+        * editing/Editor.cpp:
+        (WebCore::Editor::respondToChangedSelection): Remove "CorrectionIndicator" marker instead of
+          "Replacement" marker. Since the former controls whether we draw autocorrection underline,
+          and the latter is used to prevent autocorrection from being applied again on already auto-
+          corrected word. So the "Replacement" shouldn't be removed.
+
+2010-10-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        [CMake] Add handling for ENABLE(NETSCAPE_PLUGIN_API)
+        https://bugs.webkit.org/show_bug.cgi?id=46309
+
+        * CMakeLists.txt:
+        * CMakeListsEfl.txt:
+
+2010-10-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Darin Adler.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46996, patch the functions dealing with the bottom of the block to
+        be block-flow-aware.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::setCollapsedBottomMargin):
+        (WebCore::RenderBlock::handleAfterSideOfBlock):
+
+2010-10-01  Pratik Solanki  <psolanki@apple.com>
+
+        Reviewed by Geoffrey Garen.
+        Specify ALWAYS_INLINE at function declaration not function definition
+        https://bugs.webkit.org/show_bug.cgi?id=46960
+
+        For functions defined with ALWAYS_INLINE, add the attribute to the declaration as well.
+
+        * css/CSSStyleSelector.h:
+        * rendering/InlineIterator.h:
+        * rendering/style/RenderStyle.h:
+
+2010-10-01  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46995, make direction propagate up to the viewport from the root element.
+
+        Added fast/css/rtl-to-viewport.html
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::styleForDocument):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::styleDidChange):
+
+2010-10-01  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=44406
+        <rdar://problem/8310921> Application Cache crash when a fallback document has a manifest URL
+
+        Test: http/tests/appcache/foreign-fallback.html
+
+        * loader/appcache/ApplicationCacheGroup.cpp: (WebCore::ApplicationCacheGroup::selectCache):
+        Changed ApplicationCacheResource lookup to find fallback resources correctly.
+
+2010-10-01  Kwang Yul Seo  <skyul@company100.net>
+
+        Unreviewed, Brew MP build fix.
+
+        * platform/brew/ClipboardBrew.cpp:
+        (WebCore::ClipboardBrew::ClipboardBrew):
+
+2010-10-01  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Unreviewed build fix.
+
+        [CMAKE] Build fix for r68878
+        https://bugs.webkit.org/show_bug.cgi?id=46985
+
+        Fix name of files added to CMakeLists.txt:
+        SVGTextLayoutBaseline.cpp -> SVGTextLayoutEngineBaseline.cpp
+        SVGTextLayoutSpacing.cpp -> SVGTextLayoutEngineSpacing.cpp
+
+        No features added, so no new tests.
+
+        * CMakeLists.txt:
+
+2010-10-01  Ragner Magalhaes  <ragner.magalhaes@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] New buttons style for Qt Mobile theme
+        https://bugs.webkit.org/show_bug.cgi?id=46920
+
+        Rename Maemo5Webstyle to QtMobileWebStyle since it implements the style for all Qt mobile platform.
+        Adjust new Qt mobile style for buttons, radios, checks and combos.
+
+        * WebCore.pro:
+        * css/themeQtMobile.css: Adjust gradient color for buttons and combos.
+        (select):
+        (select:active):
+        * platform/qt/QtMobileWebStyle.cpp: Renamed from platform/qt/Maemo5Webstyle.cpp to match name scheme.
+        (QtMobileWebStyle::QtMobileWebStyle):
+        (drawRectangularControlBackground):
+        (QtMobileWebStyle::drawChecker):
+        (QtMobileWebStyle::findChecker):
+        (QtMobileWebStyle::drawRadio): Adjust gradient color for RadioButton.
+        (QtMobileWebStyle::findRadio):
+        (QtMobileWebStyle::drawControl): Adjust gradient color for CheckBox.
+        (QtMobileWebStyle::drawMultipleComboButton):
+        (QtMobileWebStyle::drawSimpleComboButton): Adjust ComboBox arrow.
+        (QtMobileWebStyle::getButtonImageSize):
+        (QtMobileWebStyle::findComboButton):
+        (QtMobileWebStyle::drawComplexControl):
+        * platform/qt/QtMobileWebStyle.h: Renamed from platform/qt/Maemo5Webstyle.h to match name scheme.
+        * platform/qt/RenderThemeQt.cpp:
+        (WebCore::RenderThemeQt::RenderThemeQt):
+
+2010-10-01  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: [Extensions API] expose page load events timings
+        Added webInspector.resources.getPageTimings()
+        
+        https://bugs.webkit.org/show_bug.cgi?id=45954
+
+        * inspector/front-end/ExtensionAPI.js:
+        (WebInspector.injectedExtensionAPI.Resources.prototype):
+        (WebInspector.injectedExtensionAPI.Resources.prototype.getPageTimings):
+        * inspector/front-end/ExtensionServer.js:
+        (WebInspector.ExtensionServer):
+        (WebInspector.ExtensionServer.prototype._onGetPageTimings):
+        * inspector/front-end/HAREntry.js: Return page event timings as -1 if start or event time unknown.
+        (WebInspector.HARLog.prototype._buildPages):
+        (WebInspector.HARLog.prototype.buildMainResourceTimings):
+        (WebInspector.HARLog.prototype._convertResource):
+        (WebInspector.HARLog.prototype._pageEventTime):
+
+2010-10-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WIN] Add GDIExtras
+        https://bugs.webkit.org/show_bug.cgi?id=46974
+
+        Some, but not all WinCE environments have support for AlphaBlend().
+        Add this files to check for AlphaBlend (and SoftLink) on WinCE.
+        On WinNT alphaBlendIfSupported() inlines AlphaBlend and returns true.
+
+        * platform/graphics/win/GDIExtras.cpp: Added.
+        (WebCore::AlphaBlendPointer):
+        * platform/graphics/win/GDIExtras.h: Added.
+        (WebCore::hasAlphaBlendSupport):
+        (WebCore::alphaBlendIfSupported):
+
+2010-10-01  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Use alphaBlendIfSupported in GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=46979
+
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::GraphicsContextPlatformPrivate::paintBackTransparentLayerBitmap):
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add two new helper files for the new SVGTextLayoutEngine
+        https://bugs.webkit.org/show_bug.cgi?id=46972
+
+        Refactor code from SVGTextLayoutUtilities into two seperated classes.
+        SVGTextLayoutUtilities will be removed, as soon as the main clss SVGTextLayoutEngine lands and gets used.
+
+        Doesn't affect any functionality yet, as the new classes are not used so far.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/svg/SVGTextFragment.h:
+        * rendering/svg/SVGTextLayoutEngineBaseline.cpp: Added.
+        (WebCore::SVGTextLayoutEngineBaseline::SVGTextLayoutEngineBaseline):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateBaselineShift):
+        (WebCore::SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateAlignmentBaselineShift):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateGlyphOrientationAngle):
+        (WebCore::glyphOrientationIsMultiplyOf180Degrees):
+        (WebCore::SVGTextLayoutEngineBaseline::calculateGlyphAdvanceAndOrientation):
+        * rendering/svg/SVGTextLayoutEngineBaseline.h: Added.
+        * rendering/svg/SVGTextLayoutEngineSpacing.cpp: Added.
+        (WebCore::SVGTextLayoutEngineSpacing::SVGTextLayoutEngineSpacing):
+        (WebCore::SVGTextLayoutEngineSpacing::calculateSVGKerning):
+        (WebCore::SVGTextLayoutEngineSpacing::calculateCSSKerningAndSpacing):
+        * rendering/svg/SVGTextLayoutEngineSpacing.h: Added.
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Rename SVGTextLayoutBuilder to SVGTextLayoutAttributesBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=46971
+
+        Doesn't affect any functionality, just moves files around.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/svg/RenderSVGText.cpp:
+        (WebCore::RenderSVGText::layout): Adopt to renaming.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.cpp: Copied from rendering/svg/SVGTextLayoutBuilder.cpp.
+        * rendering/svg/SVGTextLayoutAttributesBuilder.h: Copied from rendering/svg/SVGTextLayoutBuilder.h.
+        * rendering/svg/SVGTextLayoutBuilder.cpp: Removed.
+        * rendering/svg/SVGTextLayoutBuilder.h: Removed.
+
+2010-10-01  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::PlatformContextSkia):
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        Move SVG text related renderers into rendering/svg/
+        https://bugs.webkit.org/show_bug.cgi?id=46969
+
+        Doesn't affect any functionality, just moves files around.
+
+        * Android.mk:
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * rendering/RenderSVGAllInOne.cpp:
+        * rendering/RenderSVGInline.cpp: Removed.
+        * rendering/RenderSVGInline.h: Removed.
+        * rendering/RenderSVGInlineText.cpp: Removed.
+        * rendering/RenderSVGInlineText.h: Removed.
+        * rendering/RenderSVGTSpan.cpp: Removed.
+        * rendering/RenderSVGTSpan.h: Removed.
+        * rendering/RenderSVGText.cpp: Removed.
+        * rendering/RenderSVGText.h: Removed.
+        * rendering/RenderSVGTextPath.cpp: Removed.
+        * rendering/RenderSVGTextPath.h: Removed.
+        * rendering/SVGInlineFlowBox.cpp: Removed.
+        * rendering/SVGInlineFlowBox.h: Removed.
+        * rendering/SVGInlineTextBox.cpp: Removed.
+        * rendering/SVGInlineTextBox.h: Removed.
+        * rendering/SVGRootInlineBox.cpp: Removed.
+        * rendering/SVGRootInlineBox.h: Removed.
+        * rendering/SVGTextQuery.cpp: Removed.
+        * rendering/SVGTextQuery.h: Removed.
+        * rendering/svg/RenderSVGInline.cpp: Copied from rendering/RenderSVGInline.cpp.
+        * rendering/svg/RenderSVGInline.h: Copied from rendering/RenderSVGInline.h.
+        * rendering/svg/RenderSVGInlineText.cpp: Copied from rendering/RenderSVGInlineText.cpp.
+        * rendering/svg/RenderSVGInlineText.h: Copied from rendering/RenderSVGInlineText.h.
+        * rendering/svg/RenderSVGTSpan.cpp: Copied from rendering/RenderSVGTSpan.cpp.
+        * rendering/svg/RenderSVGTSpan.h: Copied from rendering/RenderSVGTSpan.h.
+        * rendering/svg/RenderSVGText.cpp: Copied from rendering/RenderSVGText.cpp.
+        * rendering/svg/RenderSVGText.h: Copied from rendering/RenderSVGText.h.
+        * rendering/svg/RenderSVGTextPath.cpp: Copied from rendering/RenderSVGTextPath.cpp.
+        * rendering/svg/RenderSVGTextPath.h: Copied from rendering/RenderSVGTextPath.h.
+        * rendering/svg/SVGInlineFlowBox.cpp: Copied from rendering/SVGInlineFlowBox.cpp.
+        * rendering/svg/SVGInlineFlowBox.h: Copied from rendering/SVGInlineFlowBox.h.
+        * rendering/svg/SVGInlineTextBox.cpp: Copied from rendering/SVGInlineTextBox.cpp.
+        * rendering/svg/SVGInlineTextBox.h: Copied from rendering/SVGInlineTextBox.h.
+        * rendering/svg/SVGRootInlineBox.cpp: Copied from rendering/SVGRootInlineBox.cpp.
+        * rendering/svg/SVGRootInlineBox.h: Copied from rendering/SVGRootInlineBox.h.
+        * rendering/svg/SVGTextQuery.cpp: Copied from rendering/SVGTextQuery.cpp.
+        * rendering/svg/SVGTextQuery.h: Copied from rendering/SVGTextQuery.h.
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add SVGTextMetrics/SVGTextFragment/SVGTextChunk primitives used by the new layout engine
+        https://bugs.webkit.org/show_bug.cgi?id=46964
+
+        The new SVG text layout engine will use these new classes.
+        1) SVGTextMetrics is used to measure either single glyphs (which may span multiple characters, when ligatures are defined) or a range of characters.
+           
+           -> In "single glyph" mode, it returns the width/height of the glyph, the length of the glyph (> 1, when ligatures are used) and a "Glyph" object
+              describing the glyph (name of glyph, when used together with SVG Fonts and the unicode string the glyph describes).
+           -> In "range of characters" mode, it returns the width/height of the range, and its length.
+
+           All measurements are done using the regular Font::floatWidth() methods, this class just encapsulates its usage for the SVG text layout engine.
+
+        2) SVGTextFragment describes a fragment of text, living in a SVGInlineTextBox, which can be measured/rendered in one shot.
+           It contains all necessary information to render the fragment (x/y/width/height, offset into characters() buffer for the first char of the fragment,
+           length, and an arbitary transformation, holding information about rotations/scale/glyph-orientation etc.)
+
+           In future the SVGTextLayoutEngine will generate SVGTextFragment objects for each SVGInlineTextBox. When painting no more measurements have to
+           be performed as SVGTextFragment contains all necessary information to render text / select text etc.
+
+        3) SVGTextChunk describes a SVG text chunk, which may span multiple text boxes (and in turn text fragments).
+
+           Quotes from SVG spec:
+           Each absolute position adjustment defines a new "text chunk". Absolute position adjustments impact text layout in the following ways:
+            * Ligatures only occur when a set of characters which might map to a ligature are all in the same text chunk.
+            * Each text chunk represents a separate block of text for alignment due to "text-anchor" property values.
+            * Reordering of characters due to bidirectionality only occurs within a text chunk. Reordering does not happen across text chunks.
+
+            An absolute position adjustment occurs in the following circumstances:
+            * At the start of a <text> element
+            * At the start of each <textPath> element
+            * For each character within a <text>, <tspan>, <tref> and <altGlyph> element which has an "x" or "y" attribute value assigned to it explicitly
+
+            After the line-layout finishes, each "text chunk" is altered according to the textLength and text-anchor processing rules
+            (eg. for text-anchor="middle" moving the whole text chunk by -fragmentWidth/2, for horizontal text).
+
+            SVGTextChunk is just a simple helper class, that encapsulates measuring/altering a text chunk.
+
+        Doesn't affect any tests, as these classes aren't used so far.
+
+        * Android.mk: Add SVGTextMetrics.*, SVGTextFragment.h, SVGTextChunk.* to build.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+        * rendering/svg/SVGTextChunk.cpp: Added.
+        * rendering/svg/SVGTextChunk.h: Added.
+        * rendering/svg/SVGTextFragment.h: Added.
+        * rendering/svg/SVGTextMetrics.cpp: Added.
+        * rendering/svg/SVGTextMetrics.h: Added.
+
+2010-10-01  Vincent Scheib  <scheib@chromium.org>
+
+        Reviewed by James Robinson.
+
+        REGRESSION: Lots of fast canvas updates fail to completely render
+        https://bugs.webkit.org/show_bug.cgi?id=46319
+
+        Test: fast/repaint/canvas-putImageData.html
+
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::putImageData):
+
+2010-10-01  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Add helper methods to cast between renderers & SVGTextContent/PositioningElement
+        https://bugs.webkit.org/show_bug.cgi?id=46963
+
+        Doesn't affect any tests.
+
+        * svg/SVGTextContentElement.cpp:
+        (WebCore::SVGTextContentElement::elementFromRenderer):
+        * svg/SVGTextContentElement.h:
+        * svg/SVGTextPositioningElement.cpp:
+        (WebCore::SVGTextPositioningElement::elementFromRenderer):
+        * svg/SVGTextPositioningElement.h:
+
+2010-09-30  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by James Robinson.
+
+        [Chromium] build fails unless ACCELERATED_2D_CANVAS defined
+        https://bugs.webkit.org/show_bug.cgi?id=46955
+        
+        Added ifdef guard around SharedGraphicsContext3D.
+
+        No new tests. just a build fix.
+
+        * platform/graphics/skia/PlatformContextSkia.cpp:
+        (WebCore::PlatformContextSkia::~PlatformContextSkia):
+        (WebCore::PlatformContextSkia::setSharedGraphicsContext3D):
+        (WebCore::PlatformContextSkia::uploadSoftwareToHardware):
+        (WebCore::PlatformContextSkia::readbackHardwareToSoftware):
+        * platform/graphics/skia/PlatformContextSkia.h:
+        (WebCore::PlatformContextSkia::gpuCanvas):
+
+2010-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Chris Fleizach.
+
+        [Windows] Implement <input type=number> UI
+        https://bugs.webkit.org/show_bug.cgi?id=38381
+
+        Implement theme drawing for inner-spin-button.
+        No new tests. Existing tests for type=number will cover this change.
+
+        * rendering/RenderThemeWin.cpp:
+        (WebCore::RenderThemeWin::RenderThemeWin):
+         Handle m_spinButtonTheme.
+        (WebCore::RenderThemeWin::spinButtonTheme): ditto.
+        (WebCore::RenderThemeWin::close): ditto.
+        (WebCore::RenderThemeWin::determineClassicState):
+         Add ControlSubPart parameter, and add support for InnerSpinButtonPart.
+        (WebCore::RenderThemeWin::determineSpinButtonState): Added.
+        (WebCore::RenderThemeWin::getClassicThemeData):
+         Add ControlSubPart parameter, and handle InnerSpinButtonPart.
+        (WebCore::RenderThemeWin::getThemeData): ditto.
+        (WebCore::RenderThemeWin::adjustInnerSpinButtonStyle):
+         Set SM_CXVSCROLL value to the width.
+        (WebCore::RenderThemeWin::paintInnerSpinButton):
+         Call drawControl() for the upper part and the lower part.
+        * rendering/RenderThemeWin.h:
+
+2010-09-30  Kent Tamura  <tkent@chromium.org>
+
+        Unreviewed, Windows build fix for r68854
+
+        * WebCore.vcproj/copyForwardingHeaders.cmd:
+          Copy WebCore/html/parser/*.h.
+
+2010-09-30  Abhishek Arya  <inferno@chromium.org>
+
+        Reviewed by Dan Bernstein.
+
+        While updating :before and :after content, make sure that the generated
+        container is allowed to add the child type.
+        https://bugs.webkit.org/show_bug.cgi?id=46106
+
+        Test: fast/css-generated-content/text-before-table-col-crash.html
+
+        * rendering/RenderObjectChildList.cpp:
+        (WebCore::RenderObjectChildList::updateBeforeAfterContent):
+
+2010-09-30  Mario Sanchez Prada  <msanchez@igalia.com>
+
+        Reviewed by Daniel Bates.
+
+        [GTK] Crash on testatk.c unittest because of a call to ASSERT_NOT_REACHED
+        https://bugs.webkit.org/show_bug.cgi?id=46886
+
+        Removed call to ASSERT_NOT_REACHED() from listMarkerSuffix().
+
+        So far, this assertion made sense because it was not possible that
+        a call to listMarkerSuffix() happened when the style of the list
+        item was one of the following: Asterisks, Circle, Discm Footnotes,
+        NoneListStyle or Square (it's easy to figure this out by checking
+        the functions where listMarkerSuffix() was called).
+
+        However, since revision 68415 (about bug 45381), there's a new
+        place where listMarkerSuffix() is being called (the suffix()
+        public method), regardless of the style of the item being or not
+        one of those pointed out, so the aforementioned assertion in
+        listMarkerSuffix() would no longer be correct, as now it's ok to
+        reach those cases in the switch statement.
+
+        * rendering/RenderListMarker.cpp:
+        (WebCore::listMarkerSuffix): Removed call to ASSERT_NOT_REACHED().
+
+2010-09-30  Beth Dakin  <bdakin@apple.com>
+
+        Reviewed by Adele Peterson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46948 Crash with all-
+        whitespace separators for mfenced
+
+        Check the size of characters instead of separators in case all the 
+        separators were whitespace.
+
+        * mathml/RenderMathMLFenced.cpp:
+        (WebCore::RenderMathMLFenced::updateFromElement):
+
+2010-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove remaining calls to deprecatedParseURL
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        Test: fast/replaced/object-param-spaces.html
+
+        * css/CSSHelper.cpp: Removed.
+        * css/CSSHelper.h: Removed deprecatedParseURL.
+
+        * html/parser/HTMLParserIdioms.cpp:
+        (WebCore::stripLeadingAndTrailingHTMLSpaces):
+        Fixed bug where the function would turn the null string into the empty string.
+        Fixed bug where the function would not strip all trailing spaces.
+
+        * html/parser/CSSPreloadScanner.cpp:
+        (WebCore::CSSPreloadScanner::CSSPreloadScanner): Initialize m_state
+        instead of calling the reset function.
+        (WebCore::CSSPreloadScanner::scan): Tweaked coding style.
+        (WebCore::CSSPreloadScanner::tokenize): Use isHTMLSpace instead of
+        an identical local function named isWhitespace.
+        (WebCore::parseCSSStringOrURL): Added. This function does what
+        deprecatedParseURL did before, and this is the only place in WebKit
+        that needs it. The code implements the rules for a string or URL
+        token. The real CSS parser does this with flex and the code to hook
+        flex up to yacc, so the function is not needed there.
+        (WebCore::CSSPreloadScanner::emitRule): Streamlined the code a bit
+        and mae it call parseCSSStringOrURL.
+
+        * bindings/generic/BindingSecurity.h:
+        (WebCore::::allowSettingFrameSrcToJavascriptUrl):
+        * bindings/js/JSDOMBinding.cpp:
+        (WebCore::allowSettingSrcToJavascriptURL):
+        * bindings/js/JSHTMLFrameElementCustom.cpp:
+        (WebCore::allowSettingJavascriptURL):
+        * bindings/objc/DOM.mm:
+        (-[DOMElement _getURLAttribute:]):
+        * bindings/objc/DOMHTML.mm:
+        (-[DOMHTMLDocument _createDocumentFragmentWithMarkupString:baseURLString:]):
+        * dom/Document.cpp:
+        (WebCore::Document::processBaseElement):
+        * dom/Element.cpp:
+        (WebCore::isAttributeToRemove):
+        (WebCore::Element::getURLAttribute):
+        (WebCore::Element::getNonEmptyURLAttribute):
+        * html/HTMLAnchorElement.cpp:
+        (WebCore::HTMLAnchorElement::defaultEventHandler):
+        (WebCore::HTMLAnchorElement::parseMappedAttribute):
+        (WebCore::HTMLAnchorElement::href):
+        * html/HTMLBodyElement.cpp:
+        (WebCore::HTMLBodyElement::parseMappedAttribute):
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::parseMappedAttribute):
+        * html/HTMLFrameElementBase.cpp:
+        (WebCore::HTMLFrameElementBase::parseMappedAttribute):
+        * html/HTMLImageElement.cpp:
+        (WebCore::HTMLImageElement::parseMappedAttribute):
+        * html/HTMLImageLoader.cpp:
+        (WebCore::HTMLImageLoader::sourceURI):
+        * html/HTMLLinkElement.cpp:
+        (WebCore::HTMLLinkElement::parseMappedAttribute):
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLObjectElement.cpp:
+        (WebCore::HTMLObjectElement::parseMappedAttribute):
+        (WebCore::HTMLObjectElement::parametersForPlugin):
+        * html/HTMLTableElement.cpp:
+        (WebCore::HTMLTableElement::parseMappedAttribute):
+        * html/HTMLTablePartElement.cpp:
+        (WebCore::HTMLTablePartElement::parseMappedAttribute):
+        * html/parser/HTMLPreloadScanner.cpp:
+        (WebCore::HTMLNames::PreloadTask::setUrlToLoad):
+        * loader/FormSubmission.cpp:
+        (WebCore::FormSubmission::Attributes::parseAction):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::ClipboardChromium::declareAndWriteDragImage):
+        * platform/chromium/PasteboardChromium.cpp:
+        (WebCore::Pasteboard::writeImage):
+        * platform/qt/ClipboardQt.cpp:
+        (WebCore::ClipboardQt::declareAndWriteDragImage):
+        * platform/win/ClipboardWin.cpp:
+        (WebCore::ClipboardWin::declareAndWriteDragImage):
+        * rendering/HitTestResult.cpp:
+        (WebCore::HitTestResult::absoluteImageURL):
+        (WebCore::HitTestResult::absoluteMediaURL):
+        (WebCore::HitTestResult::absoluteLinkURL):
+        * svg/SVGAElement.cpp:
+        (WebCore::SVGAElement::defaultEventHandler):
+        * svg/SVGImageLoader.cpp:
+        (WebCore::SVGImageLoader::sourceURI):
+        * wml/WMLAElement.cpp:
+        (WebCore::WMLAElement::defaultEventHandler):
+        * wml/WMLImageLoader.cpp:
+        (WebCore::WMLImageLoader::sourceURI):
+        Call stripLeadingAndTrailingHTMLSpaces instead of deprecatedParseURL.
+
+        * WebCore.exp.in: Updated.
+
+        * Android.mk: Removed CSSHelper.cpp.
+        * CMakeLists.txt: Ditto.
+        * GNUmakefile.am: Ditto.
+        * WebCore.gypi: Ditto.
+        * WebCore.pro: Ditto.
+        * WebCore.vcproj/WebCore.vcproj: Ditto.
+        * WebCore.xcodeproj/project.pbxproj: Ditto.
+
+        * bindings/js/JSAttrCustom.cpp:
+        * bindings/js/JSElementCustom.cpp:
+        * bindings/v8/custom/V8ElementCustom.cpp:
+        * bindings/v8/custom/V8LocationCustom.cpp:
+        * css/CSSParser.cpp:
+        * html/HTMLMediaElement.cpp:
+        * html/HTMLVideoElement.cpp:
+        * loader/ImageLoader.cpp:
+        * rendering/style/RenderStyle.h:
+        Removed unneeded include of CSSHelper.h.
+
+2010-09-30  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Chris Marrin.
+
+        Add GetGraphicsResetStatusARB entry point from ARB_robustness
+        extension to GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=46850
+
+        Added stubs for GraphicsContext3D::getGraphicsResetStatusARB for
+        Mac and QT.
+
+        * platform/graphics/GraphicsContext3D.h:
+        * platform/graphics/opengl/GraphicsContext3DOpenGL.cpp:
+        (WebCore::GraphicsContext3D::getGraphicsResetStatusARB):
+        * platform/graphics/qt/GraphicsContext3DQt.cpp:
+        (WebCore::GraphicsContext3D::getGraphicsResetStatusARB):
+
+2010-09-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46938
+        
+        Rewrite margin collapsing to be block-flow-aware.  Eliminate a bunch of the margin functions on RenderBox in favor of a single
+        master function for grabbing all the margin values for a child: marginValuesForChild on RenderBlock.  Introduce a new
+        MarginValues struct to make returning the collection of 4 margin values easy.
+    
+        fast/blockflow/inline-direction-positioning.html progresses to have the correct results.
+        Added fast/blockflow/margin-collapse.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::MarginInfo::MarginInfo):
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::clearFloatsIfNeeded):
+        (WebCore::RenderBlock::setCollapsedBottomMargin):
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::setMaxMarginBeforeValues):
+        (WebCore::RenderBlock::setMaxMarginAfterValues):
+        (WebCore::RenderBlock::marginValuesForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::MarginValues::MarginValues):
+        (WebCore::RenderBlock::MarginValues::positiveMarginBefore):
+        (WebCore::RenderBlock::MarginValues::negativeMarginBefore):
+        (WebCore::RenderBlock::MarginValues::positiveMarginAfter):
+        (WebCore::RenderBlock::MarginValues::negativeMarginAfter):
+        (WebCore::RenderBlock::MarginValues::setPositiveMarginBefore):
+        (WebCore::RenderBlock::MarginValues::setNegativeMarginBefore):
+        (WebCore::RenderBlock::MarginValues::setPositiveMarginAfter):
+        (WebCore::RenderBlock::MarginValues::setNegativeMarginAfter):
+        (WebCore::RenderBlock::maxPositiveMarginBefore):
+        (WebCore::RenderBlock::maxNegativeMarginBefore):
+        (WebCore::RenderBlock::maxPositiveMarginAfter):
+        (WebCore::RenderBlock::maxNegativeMarginAfter):
+        (WebCore::RenderBlock::initMaxMarginValues):
+        (WebCore::RenderBlock::collapsedMarginBefore):
+        (WebCore::RenderBlock::collapsedMarginAfter):
+        (WebCore::RenderBlock::MarginInfo::clearMargin):
+        (WebCore::RenderBlock::MarginInfo::setPositiveMargin):
+        (WebCore::RenderBlock::MarginInfo::setNegativeMargin):
+        (WebCore::RenderBlock::MarginInfo::setPositiveMarginIfLarger):
+        (WebCore::RenderBlock::MarginInfo::setNegativeMarginIfLarger):
+        (WebCore::RenderBlock::MarginInfo::setMargin):
+        (WebCore::RenderBlock::MarginInfo::positiveMargin):
+        (WebCore::RenderBlock::MarginInfo::negativeMargin):
+        (WebCore::RenderBlock::MarginInfo::margin):
+        (WebCore::RenderBlock::RenderBlockRareData::RenderBlockRareData):
+        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginBeforeDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginBeforeDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::positiveMarginAfterDefault):
+        (WebCore::RenderBlock::RenderBlockRareData::negativeMarginAfterDefault):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::collapsedMarginBefore):
+        (WebCore::RenderBox::collapsedMarginAfter):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::RenderFlexibleBox::layoutBlock):
+
+2010-09-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Fix InternetGetCookie in CookieJarWin.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=46929
+
+        If the InternetGetCookie fails the output size won't be set.
+        Set the default size to 0, so we always get the correct size
+        and check the return value of InternetGetCookie.
+
+        * platform/network/win/CookieJarWin.cpp:
+        (WebCore::cookies):
+
+2010-09-30  Patrick Gansterer  <paroga@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        [WINCE] Use OwnPtr for HBRUSH and HPEN in GraphicsContext
+        https://bugs.webkit.org/show_bug.cgi?id=46881
+
+        Also add some missing SelectObject calls.
+
+        * platform/graphics/wince/GraphicsContextWinCE.cpp:
+        (WebCore::createPen):
+        (WebCore::createBrush):
+        (WebCore::GraphicsContext::drawRect):
+        (WebCore::GraphicsContext::drawLine):
+        (WebCore::GraphicsContext::drawEllipse):
+        (WebCore::GraphicsContext::strokeArc):
+        (WebCore::GraphicsContext::drawConvexPolygon):
+        (WebCore::GraphicsContext::strokeRect):
+        (WebCore::GraphicsContext::fillRoundedRect):
+        (WebCore::GraphicsContext::fillPath):
+        (WebCore::GraphicsContext::strokePath):
+
+2010-09-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein and Darin Adler.
+
+        WebCore uses the main thread to process sleep notifications
+        https://bugs.webkit.org/show_bug.cgi?id=46935
+        <rdar://problem/8495374>
+
+        Rewrite the old WebCorePowerNotifier to use IOKit directly. 
+        
+        On Snow Leopard, set up power notifications to arrive on a dispatch queue,
+        so that we can handle them quickly even if the main thread is hung.
+
+        (Tiger and Leopard will still get the old behavior).
+
+        * WebCore.xcodeproj/project.pbxproj:
+        Link with IOKit.
+
+        * platform/mac/SharedTimerMac.mm:
+        (WebCore::PowerObserver::PowerObserver):
+        Initialize the IOKit machinery.
+
+        (WebCore::PowerObserver::~PowerObserver):
+        Tear down the IOKit notifications.
+
+        (WebCore::PowerObserver::didReceiveSystemPowerNotification):
+        Acknowledge the event immediately and then call the shared timer functions. On Snow Leopard, we
+        make sure to call the shared timer functions on the main thread.
+    
+2010-09-30  James Simonsen  <simonjam@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [Web Timing] Make requestEnd equal to start of response
+        https://bugs.webkit.org/show_bug.cgi?id=46302
+
+        * page/Timing.cpp:
+        (WebCore::Timing::requestEnd):
+
+2010-09-30  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        fast/canvas/webgl/draw-elements-out-of-bounds.html is crashing on Snow Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=46870
+
+        * platform/graphics/ANGLEWebKitBridge.cpp:
+        (WebCore::ANGLEWebKitBridge::~ANGLEWebKitBridge): Remove ShFinalize().
+
+2010-09-30  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        WebKit nests font element when applying different font styles
+        https://bugs.webkit.org/show_bug.cgi?id=45568
+
+        The bug was caused by fixRangeAndApplyInlineStyle's not including fully selected ancestors,
+        and addInlineStyleIfNeeded's always surrounding the contents by new elements as supposed to
+        adding font attributes or style attribute.
+
+        Fixed the bug by extending the node range in fixRangeAndApplyInlineStyle and finding
+        the appropriate container node to add attributes in addInlineStyleIfNeeded.
+        addInlineStyleIfNeeded now tires to add font and style attributes to the inner most font and
+        span elements respectively.
+
+        Also added an early exit check to removeStyleFromRunBeforeApplyingStyle so that WebKit does not
+        modify the contents when the entire contents already have the desired style.
+
+        Test: editing/style/inline-style-container.html
+
+        * editing/ApplyStyleCommand.cpp:
+        (WebCore::ApplyStyleCommand::fixRangeAndApplyInlineStyle):
+        (WebCore::ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle):
+        (WebCore::ApplyStyleCommand::removeInlineStyleFromElement):
+        (WebCore::ApplyStyleCommand::addInlineStyleIfNeeded):
+
+2010-09-30  Jarred Nicholls  <jarred@sencha.com>
+
+        Reviewed by Darin Adler.
+
+        Removed unnecessary calls to ceil() on an int
+        Removing the call fixes MSVC build errors
+        https://bugs.webkit.org/show_bug.cgi?id=46931
+
+        * platform/graphics/ContextShadow.cpp:
+        (WebCore::ContextShadow::calculateLayerBoundingRect):
+
+2010-09-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46932
+        
+        Get fast/blockflow/root-lr-basic.html results to be correct by patching a few more
+        height() calls to be logicalHeight().
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::collapseMargins):
+        (WebCore::RenderBlock::handleAfterSideOfBlock):
+
+2010-09-30  Cris Neckar  <cdn@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        Added check to test for removed counter node when calling findPlaceForCounter() in updateCounters().
+        Added refcounting to counternodes in countermaps.
+        https://bugs.webkit.org/show_bug.cgi?id=46387
+
+        Test: fast/css/counters/counter-traverse-table-cell.html
+
+        * rendering/CounterNode.cpp:
+        (WebCore::CounterNode::create):
+        * rendering/CounterNode.h:
+        * rendering/RenderCounter.cpp:
+        (WebCore::makeCounterNode):
+        (WebCore::destroyCounterNodeWithoutMapRemoval):
+        (WebCore::RenderCounter::destroyCounterNodes):
+        (WebCore::RenderCounter::destroyCounterNode):
+        (WebCore::updateCounters):
+
+2010-09-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46928
+        
+        Add isLeftToRightDirection() to RenderStyle and change callers that did direction() == LTR and direction() == RTL to use this instead.
+
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::isLeftPage):
+        (WebCore::CSSStyleSelector::applyProperty):
+        * editing/Editor.cpp:
+        (WebCore::Editor::hasBidiSelection):
+        * editing/VisiblePosition.cpp:
+        (WebCore::VisiblePosition::leftVisuallyDistinctCandidate):
+        (WebCore::VisiblePosition::rightVisuallyDistinctCandidate):
+        * html/canvas/CanvasRenderingContext2D.cpp:
+        (WebCore::CanvasRenderingContext2D::drawTextInternal):
+        * rendering/InlineBox.h:
+        (WebCore::InlineBox::isLeftToRightDirection):
+        (WebCore::InlineBox::caretLeftmostOffset):
+        (WebCore::InlineBox::caretRightmostOffset):
+        * rendering/InlineFlowBox.cpp:
+        (WebCore::InlineFlowBox::determineSpacingForFlowBoxes):
+        (WebCore::InlineFlowBox::placeBoxesInInlineDirection):
+        (WebCore::InlineFlowBox::paintTextDecorations):
+        * rendering/InlineIterator.h:
+        (WebCore::InlineIterator::direction):
+        * rendering/InlineTextBox.cpp:
+        (WebCore::InlineTextBox::selectionRect):
+        (WebCore::InlineTextBox::placeEllipsisBox):
+        (WebCore::InlineTextBox::paint):
+        (WebCore::InlineTextBox::paintSelection):
+        (WebCore::InlineTextBox::paintCompositionBackground):
+        (WebCore::InlineTextBox::paintDecoration):
+        (WebCore::InlineTextBox::paintSpellingOrGrammarMarker):
+        (WebCore::InlineTextBox::paintTextMatchMarker):
+        (WebCore::InlineTextBox::computeRectForReplacementMarker):
+        (WebCore::InlineTextBox::textPos):
+        (WebCore::InlineTextBox::offsetForPosition):
+        (WebCore::InlineTextBox::positionForOffset):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::adjustPositionedBlock):
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
+        (WebCore::RenderBlock::paintColumnRules):
+        (WebCore::RenderBlock::paintColumnContents):
+        (WebCore::RenderBlock::getHorizontalSelectionGapInfo):
+        (WebCore::RenderBlock::logicalLeftOffsetForLine):
+        (WebCore::RenderBlock::logicalRightOffsetForLine):
+        (WebCore::RenderBlock::rightmostPosition):
+        (WebCore::RenderBlock::leftmostPosition):
+        (WebCore::RenderBlock::columnRectAt):
+        (WebCore::RenderBlock::layoutColumns):
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::localCaretRect):
+        (WebCore::RenderBlock::marginStartForChild):
+        (WebCore::RenderBlock::marginEndForChild):
+        (WebCore::RenderBlock::setMarginStartForChild):
+        (WebCore::RenderBlock::setMarginEndForChild):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::getBorderPaddingMargin):
+        (WebCore::RenderBlock::constructLine):
+        (WebCore::RenderBlock::computeInlineDirectionPositionsForLine):
+        (WebCore::RenderBlock::determineStartPosition):
+        (WebCore::RenderBlock::skipTrailingWhitespace):
+        (WebCore::RenderBlock::skipLeadingWhitespace):
+        (WebCore::RenderBlock::findNextLineBreak):
+        (WebCore::RenderBlock::checkLinesForTextOverflow):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::marginStart):
+        (WebCore::RenderBox::marginEnd):
+        (WebCore::RenderBox::setMarginStart):
+        (WebCore::RenderBox::setMarginEnd):
+        (WebCore::RenderBox::scrollWidth):
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        (WebCore::RenderBox::containingBlockWidthForPositioned):
+        (WebCore::RenderBox::computePositionedLogicalWidthUsing):
+        (WebCore::RenderBox::computePositionedLogicalWidthReplaced):
+        (WebCore::RenderBox::localCaretRect):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetX):
+        * rendering/RenderFieldset.cpp:
+        (WebCore::RenderFieldset::layoutLegend):
+        * rendering/RenderFileUploadControl.cpp:
+        (WebCore::RenderFileUploadControl::paintObject):
+        * rendering/RenderFlexibleBox.cpp:
+        (WebCore::FlexBoxIterator::FlexBoxIterator):
+        (WebCore::RenderFlexibleBox::layoutHorizontalBox):
+        (WebCore::RenderFlexibleBox::layoutVerticalBox):
+        * rendering/RenderLayer.cpp:
+        (WebCore::RenderLayer::computeScrollDimensions):
+        * rendering/RenderListBox.cpp:
+        (WebCore::RenderListBox::paintItemForeground):
+        * rendering/RenderListItem.cpp:
+        (WebCore::RenderListItem::positionListMarker):
+        (WebCore::RenderListItem::markerTextWithSuffix):
+        * rendering/RenderListMarker.cpp:
+        (WebCore::RenderListMarker::paint):
+        (WebCore::RenderListMarker::updateMargins):
+        (WebCore::RenderListMarker::suffix):
+        * rendering/RenderMarquee.cpp:
+        (WebCore::RenderMarquee::computePosition):
+        * rendering/RenderMeter.cpp:
+        (WebCore::RenderMeter::valuePartRect):
+        * rendering/RenderProgress.cpp:
+        (WebCore::RenderProgress::valuePartRect):
+        * rendering/RenderTable.cpp:
+        (WebCore::RenderTable::calcBorderLeft):
+        (WebCore::RenderTable::calcBorderRight):
+        * rendering/RenderTableCell.cpp:
+        (WebCore::RenderTableCell::clippedOverflowRectForRepaint):
+        (WebCore::RenderTableCell::borderHalfLeft):
+        (WebCore::RenderTableCell::borderHalfRight):
+        (WebCore::RenderTableCell::collectBorderStyles):
+        (WebCore::RenderTableCell::paintCollapsedBorder):
+        * rendering/RenderTableSection.cpp:
+        (WebCore::RenderTableSection::layoutRows):
+        (WebCore::RenderTableSection::recalcOuterBorder):
+        (WebCore::RenderTableSection::paintObject):
+        (WebCore::RenderTableSection::nodeAtPoint):
+        * rendering/RenderText.cpp:
+        (WebCore::RenderText::localCaretRect):
+        (WebCore::RenderText::positionLineBox):
+        * rendering/RenderTextControlSingleLine.cpp:
+        (WebCore::RenderTextControlSingleLine::forwardEvent):
+        * rendering/RenderThemeMac.mm:
+        (WebCore::RenderThemeMac::levelIndicatorFor):
+        (WebCore::RenderThemeMac::paintProgressBar):
+        * rendering/RenderTreeAsText.cpp:
+        (WebCore::writeTextRun):
+        * rendering/SVGInlineTextBox.cpp:
+        (WebCore::SVGInlineTextBox::measureCharacter):
+        (WebCore::SVGInlineTextBox::buildLayoutInformation):
+        * rendering/SVGRenderTreeAsText.cpp:
+        (WebCore::writeSVGInlineTextBox):
+        * rendering/SVGTextLayoutUtilities.cpp:
+        (WebCore::svgTextRunForInlineTextBox):
+        * rendering/style/RenderStyle.cpp:
+        (WebCore::RenderStyle::borderStartWidth):
+        (WebCore::RenderStyle::borderEndWidth):
+        (WebCore::RenderStyle::marginStart):
+        (WebCore::RenderStyle::marginEnd):
+        (WebCore::RenderStyle::marginStartUsing):
+        (WebCore::RenderStyle::marginEndUsing):
+        (WebCore::RenderStyle::paddingStart):
+        (WebCore::RenderStyle::paddingEnd):
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::isLeftToRightDirection):
+        * wml/WMLTableElement.cpp:
+        (WebCore::WMLTableElement::alignCells):
+
+2010-09-30  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46923
+        
+        Make determineLogicalLeftPositionForChild block-flow-aware.  Rewrite the function so that there aren't
+        completely separate LTR/RTL cases.
+
+        Added fast/blockflow/inline-direction-positioning.html
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
+        (WebCore::RenderBlock::setLogicalLeftForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalWidthForChild):
+        (WebCore::RenderBlock::logicalRightOffsetForContent):
+        (WebCore::RenderBlock::logicalLeftOffsetForContent):
+
+2010-09-29  Adam Roben  <aroben@apple.com>
+
+        Fix color media queries on Windows
+
+        Fixes <http://webkit.org/b/42973> <rdar://problem/8234072> (color:8)
+        media query does not evaluate to true for 32bpp displays on Windows
+
+        Test: fast/media/color-does-not-include-alpha.html
+
+        Reviewed by Darin Adler.
+
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::screenDepthPerComponent): Use screenDepth instead of trying
+        to interpret DEVMODE directly, since screenDepth knows how to correct
+        for video drivers that return 32 instead of 24.
+
+2010-09-29  Adam Roben  <aroben@apple.com>
+
+        Make sure screen.colorDepth/screen.pixelDepth don't include the bits
+        used for alpha
+
+        Fixes <http://webkit.org/b/42972> <rdar://problem/8234071>
+        screen.colorDepth and screen.pixelDepth return 32 on Windows, but
+        should return 24 (according to CSSOM View and Firefox)
+
+        Reviewed by Darin Adler.
+
+        * platform/win/PlatformScreenWin.cpp:
+        (WebCore::screenDepth): If Windows says there are 32 bits per pixel,
+        return 24 instead, as 32 includes the alpha component but this
+        function is supposed to ignore the alpha component.
+
+2010-09-30  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Refactor ChromiumDataObject to use getters/setters.
+        https://bugs.webkit.org/show_bug.cgi?id=46559
+
+        This is an intermediate step to converting ChromiumDataObject to use
+        callbacks to the browser to retrieve data.
+
+        This is covered by existing tests.
+
+        * editing/chromium/EditorChromium.cpp:
+        (WebCore::Editor::newGeneralClipboard):
+        * page/chromium/EventHandlerChromium.cpp:
+        (WebCore::EventHandler::createDraggingClipboard):
+        * platform/chromium/ChromiumDataObject.cpp:
+        (WebCore::ChromiumDataObject::clearData):
+        (WebCore::ChromiumDataObject::clearAll):
+        (WebCore::ChromiumDataObject::clearAllExceptFiles):
+        (WebCore::ChromiumDataObject::hasData):
+        (WebCore::ChromiumDataObject::types):
+        (WebCore::ChromiumDataObject::getData):
+        (WebCore::ChromiumDataObject::setData):
+        (WebCore::ChromiumDataObject::ChromiumDataObject):
+        * platform/chromium/ChromiumDataObject.h:
+        (WebCore::ChromiumDataObject::create):
+        (WebCore::ChromiumDataObject::urlTitle):
+        (WebCore::ChromiumDataObject::setUrlTitle):
+        (WebCore::ChromiumDataObject::htmlBaseUrl):
+        (WebCore::ChromiumDataObject::setHtmlBaseUrl):
+        (WebCore::ChromiumDataObject::containsFilenames):
+        (WebCore::ChromiumDataObject::filenames):
+        (WebCore::ChromiumDataObject::setFilenames):
+        (WebCore::ChromiumDataObject::fileExtension):
+        (WebCore::ChromiumDataObject::setFileExtension):
+        (WebCore::ChromiumDataObject::fileContentFilename):
+        (WebCore::ChromiumDataObject::setFileContentFilename):
+        (WebCore::ChromiumDataObject::fileContent):
+        (WebCore::ChromiumDataObject::setFileContent):
+        * platform/chromium/ClipboardChromium.cpp:
+        (WebCore::normalizeType):
+        (WebCore::ClipboardChromium::clearData):
+        (WebCore::ClipboardChromium::clearAllData):
+        (WebCore::ClipboardChromium::getData):
+        (WebCore::ClipboardChromium::setData):
+        (WebCore::ClipboardChromium::types):
+        (WebCore::ClipboardChromium::files):
+        (WebCore::writeImageToDataObject):
+        (WebCore::ClipboardChromium::declareAndWriteDragImage):
+        (WebCore::ClipboardChromium::writeURL):
+        (WebCore::ClipboardChromium::writeRange):
+        (WebCore::ClipboardChromium::writePlainText):
+        * platform/chromium/ClipboardChromiumWin.cpp:
+        (WebCore::ClipboardChromium::validateFileName):
+        * platform/chromium/ClipboardMimeTypes.cpp:
+        * platform/chromium/ClipboardMimeTypes.h:
+        * platform/chromium/DragDataChromium.cpp:
+        (WebCore::containsHTML):
+        (WebCore::DragData::containsURL):
+        (WebCore::DragData::asURL):
+        (WebCore::DragData::containsFiles):
+        (WebCore::DragData::asFilenames):
+        (WebCore::DragData::containsPlainText):
+        (WebCore::DragData::asPlainText):
+        (WebCore::DragData::canSmartReplace):
+        (WebCore::DragData::asFragment):
+        * platform/chromium/ReadableDataObject.cpp:
+        (WebCore::ReadableDataObject::getURL):
+        (WebCore::ReadableDataObject::getHTML):
+        * platform/chromium/WritableDataObject.cpp:
+        (WebCore::WritableDataObject::clearData):
+        (WebCore::WritableDataObject::setData):
+        (WebCore::WritableDataObject::setURL):
+        (WebCore::WritableDataObject::setHTML):
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+
+        Add accelerated 2D rendering files to Mac build, fix build errors,
+        add ifdefs to compile only when the ACCELERATED_2D_CANVAS flag is
+        enabled, and add a skeleton of the mac specific file so it builds.
+
+        DrawingBufferMac.mm, the Mac specific file does nothing right now
+        other than initialize and create a layer. The rest will be added
+        when I do the actual implementation. 
+
+        The most significant change was to SharedGraphicsContext3D, which
+        had a static local OwnPtr in one of the methods. This was causing
+        the exit time destructor warning. Getting rid of the OwnPtr fixed
+        the problem. Since the pointer that was being wrapped was to a
+        static object that would never get destroyed, the OwnPtr was not
+        necessary.
+
+        I also added the ACCELERATED_2D_CANVAS flag to build-webkit
+        and FeatureDefines.xcconfig for WebCore, WebKit and JavaScriptCore.
+        But right now the flag is off by default.
+
+        * Configurations/FeatureDefines.xcconfig:
+        * WebCore.xcodeproj/project.pbxproj:
+        * platform/graphics/gpu/DrawingBuffer.cpp:
+        * platform/graphics/gpu/DrawingBuffer.h:
+        (WebCore::DrawingBuffer::WillPublishCallback::~WillPublishCallback):
+        * platform/graphics/gpu/LoopBlinnClassifier.cpp:
+        * platform/graphics/gpu/LoopBlinnMathUtils.cpp:
+        * platform/graphics/gpu/LoopBlinnTextureCoords.cpp:
+        * platform/graphics/gpu/Shader.cpp:
+        * platform/graphics/gpu/SharedGraphicsContext3D.cpp:
+        (WebCore::SharedGraphicsContext3D::allContexts):
+        * platform/graphics/gpu/SolidFillShader.cpp:
+        * platform/graphics/gpu/TexShader.cpp:
+        * platform/graphics/gpu/Texture.cpp:
+        * platform/graphics/gpu/Texture.h:
+        * platform/graphics/gpu/TilingData.cpp:
+        * platform/graphics/gpu/mac: Added.
+        * platform/graphics/gpu/mac/DrawingBufferMac.mm: Added.
+        (WebCore::DrawingBuffer::DrawingBuffer):
+        (WebCore::DrawingBuffer::~DrawingBuffer):
+        (WebCore::DrawingBuffer::reset):
+        (WebCore::DrawingBuffer::platformLayer):
+
+2010-09-30  Renata Hodovan  <reni@inf.u-szeged.hu>
+
+        Reviewed by Dirk Schulze.
+
+        SVGFECompositeElement doesn't support dynamic invalidation, when attributes change.
+        https://bugs.webkit.org/show_bug.cgi?id=46902
+
+        Tests: svg/dynamic-updates/SVGFECompositeElement-dom-in-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-in2-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-k1-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-k2-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-k3-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-k4-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-dom-operator-attr.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-in-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-in2-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-k1-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-k2-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-k3-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-k4-prop.html
+               svg/dynamic-updates/SVGFECompositeElement-svgdom-operator-prop.html
+
+        * svg/SVGFECompositeElement.cpp:
+        (WebCore::SVGFECompositeElement::svgAttributeChanged):
+        * svg/SVGFECompositeElement.h:
+
+2010-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Finished IDBTransaction for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=46823
+
+        Switch the rest of IndexedDB to use transactions.
+        Implement most of setVersion.
+        Add IDBTransactions to IDBAny, IDBCursor, IDBRequest, etc.
+        Switch to using the standard cross thread task stuff.
+        Make everything threadsafe so it works with cross thread copy
+            (will be useful in the future).
+        Fix some subtle bugs in transactions.
+        
+        Various bits of clean up (when I couldn't resist).
+
+        * bindings/js/JSIDBAnyCustom.cpp:
+        (WebCore::toJS):
+        * bindings/v8/IDBBindingUtilities.cpp:
+        (WebCore::LocalContext::LocalContext):
+        (WebCore::LocalContext::~LocalContext):
+        (WebCore::createIDBKeyFromSerializedValueAndKeyPath):
+        * bindings/v8/SerializedScriptValue.cpp:
+        (WebCore::SerializedScriptValue::release):
+        (WebCore::SerializedScriptValue::SerializedScriptValue):
+        * bindings/v8/SerializedScriptValue.h:
+        * bindings/v8/custom/V8IDBAnyCustom.cpp:
+        (WebCore::toV8):
+        * platform/CrossThreadCopier.cpp:
+        * storage/IDBAny.cpp:
+        (WebCore::IDBAny::idbFactory):
+        (WebCore::IDBAny::idbTransaction):
+        (WebCore::IDBAny::set):
+        * storage/IDBAny.h:
+        * storage/IDBCallbacks.h:
+        * storage/IDBCursor.cpp:
+        (WebCore::IDBCursor::IDBCursor):
+        (WebCore::IDBCursor::update):
+        (WebCore::IDBCursor::continueFunction):
+        (WebCore::IDBCursor::remove):
+        * storage/IDBCursor.h:
+        (WebCore::IDBCursor::create):
+        * storage/IDBCursorBackendImpl.cpp:
+        (WebCore::IDBCursorBackendImpl::IDBCursorBackendImpl):
+        (WebCore::IDBCursorBackendImpl::update):
+        (WebCore::IDBCursorBackendImpl::updateInternal):
+        (WebCore::IDBCursorBackendImpl::continueFunction):
+        (WebCore::IDBCursorBackendImpl::continueFunctionInternal):
+        (WebCore::IDBCursorBackendImpl::remove):
+        (WebCore::IDBCursorBackendImpl::removeInternal):
+        * storage/IDBCursorBackendImpl.h:
+        (WebCore::IDBCursorBackendImpl::create):
+        * storage/IDBDatabase.cpp:
+        (WebCore::IDBDatabase::setSetVersionTransaction):
+        (WebCore::IDBDatabase::createObjectStore):
+        (WebCore::IDBDatabase::removeObjectStore):
+        (WebCore::IDBDatabase::setVersion):
+        (WebCore::IDBDatabase::close):
+        * storage/IDBDatabase.h:
+        * storage/IDBDatabase.idl:
+        * storage/IDBDatabaseBackendImpl.cpp:
+        (WebCore::IDBDatabaseBackendImpl::createObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::createObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStore):
+        (WebCore::IDBDatabaseBackendImpl::removeObjectStoreInternal):
+        (WebCore::IDBDatabaseBackendImpl::setVersion):
+        (WebCore::IDBDatabaseBackendImpl::setVersionInternal):
+        (WebCore::IDBDatabaseBackendImpl::close):
+        * storage/IDBDatabaseBackendImpl.h:
+        * storage/IDBDatabaseBackendInterface.h:
+        * storage/IDBFactory.cpp:
+        (WebCore::IDBFactory::open):
+        * storage/IDBIndex.cpp:
+        (WebCore::IDBIndex::IDBIndex):
+        (WebCore::IDBIndex::openObjectCursor):
+        (WebCore::IDBIndex::openCursor):
+        (WebCore::IDBIndex::getObject):
+        (WebCore::IDBIndex::get):
+        * storage/IDBIndex.h:
+        (WebCore::IDBIndex::create):
+        * storage/IDBIndexBackendImpl.cpp:
+        (WebCore::IDBIndexBackendImpl::openCursorInternal):
+        (WebCore::IDBIndexBackendImpl::openObjectCursor):
+        (WebCore::IDBIndexBackendImpl::openCursor):
+        (WebCore::IDBIndexBackendImpl::getInternal):
+        (WebCore::IDBIndexBackendImpl::getObject):
+        (WebCore::IDBIndexBackendImpl::get):
+        * storage/IDBIndexBackendImpl.h:
+        * storage/IDBIndexBackendInterface.h:
+        * storage/IDBKey.cpp:
+        (WebCore::IDBKey::IDBKey):
+        * storage/IDBKey.h:
+        * storage/IDBKeyRange.h:
+        * storage/IDBObjectStore.cpp:
+        (WebCore::IDBObjectStore::IDBObjectStore):
+        (WebCore::IDBObjectStore::add):
+        (WebCore::IDBObjectStore::put):
+        (WebCore::IDBObjectStore::remove):
+        (WebCore::IDBObjectStore::createIndex):
+        (WebCore::IDBObjectStore::index):
+        (WebCore::IDBObjectStore::removeIndex):
+        (WebCore::IDBObjectStore::openCursor):
+        * storage/IDBObjectStore.idl:
+        * storage/IDBObjectStoreBackendImpl.cpp:
+        (WebCore::IDBObjectStoreBackendImpl::get):
+        (WebCore::IDBObjectStoreBackendImpl::getInternal):
+        (WebCore::IDBObjectStoreBackendImpl::put):
+        (WebCore::IDBObjectStoreBackendImpl::putInternal):
+        (WebCore::IDBObjectStoreBackendImpl::remove):
+        (WebCore::IDBObjectStoreBackendImpl::removeInternal):
+        (WebCore::IDBObjectStoreBackendImpl::createIndex):
+        (WebCore::IDBObjectStoreBackendImpl::createIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndex):
+        (WebCore::IDBObjectStoreBackendImpl::removeIndexInternal):
+        (WebCore::IDBObjectStoreBackendImpl::openCursor):
+        (WebCore::IDBObjectStoreBackendImpl::openCursorInternal):
+        * storage/IDBObjectStoreBackendImpl.h:
+        * storage/IDBObjectStoreBackendInterface.h:
+        * storage/IDBRequest.cpp:
+        (WebCore::IDBRequest::IDBRequest):
+        (WebCore::IDBRequest::resetReadyState):
+        (WebCore::IDBRequest::onSuccess):
+        (WebCore::IDBRequest::timerFired):
+        * storage/IDBRequest.h:
+        (WebCore::IDBRequest::create):
+        * storage/IDBTransactionBackendImpl.cpp:
+        (WebCore::IDBTransactionBackendImpl::IDBTransactionBackendImpl):
+        (WebCore::IDBTransactionBackendImpl::scheduleTask):
+        (WebCore::IDBTransactionBackendImpl::didCompleteTaskEvents):
+        (WebCore::IDBTransactionBackendImpl::run):
+        (WebCore::IDBTransactionBackendImpl::start):
+        (WebCore::IDBTransactionBackendImpl::commit):
+        (WebCore::IDBTransactionBackendImpl::timerFired):
+        * storage/IDBTransactionBackendImpl.h:
+
+2010-09-30  Csaba Osztrogonác  <ossy@webkit.org>
+
+        Reviewed by Martin Robinson.
+
+        [Gtk] build still broken since r68521
+        https://bugs.webkit.org/show_bug.cgi?id=46795
+
+        makevalues.pl and makeprop.pl generate 3 files in one run.
+        Double or triple target is incorrect, because on a multicore
+        machine make processes targets in parallel.
+
+        Setting a->b->c dependencies for 3 generated files guarantees
+        that make doesn't execute the recipe of the rule more than one.
+
+        * GNUmakefile.am: Dependencies and missing headers added.
+
+2010-09-30  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed build fix (marked ResourceRawHeaders.h as private)
+
+        * WebCore.xcodeproj/project.pbxproj:
+
+2010-09-29  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: display headers actually used by network stack in Resources tab
+        https://bugs.webkit.org/show_bug.cgi?id=46092
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest): enable raw headers reporting if front-end is visible.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        * platform/network/ResourceRawHeaders.h: Added.
+        * platform/network/ResourceRequestBase.h: Added flag to enable raw headers reporting.
+        (WebCore::ResourceRequestBase::reportRawHeaders):
+        (WebCore::ResourceRequestBase::setReportRawHeaders):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/ResourceResponseBase.cpp: Added support for raw headers.
+        (WebCore::ResourceResponseBase::resourceRawHeaders):
+        (WebCore::ResourceResponseBase::setResourceRawHeaders):
+        * platform/network/ResourceResponseBase.h:
+
+2010-09-29  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: display headers actually used by network stack in Resources tab
+        https://bugs.webkit.org/show_bug.cgi?id=46092
+
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::willSendRequest): enable raw headers reporting if front-end is visible.
+        * inspector/InspectorResource.cpp:
+        (WebCore::InspectorResource::updateResponse):
+        * platform/network/ResourceRawHeaders.h: Added.
+        * platform/network/ResourceRequestBase.h: Added flag to enable raw headers reporting.
+        (WebCore::ResourceRequestBase::reportRawHeaders):
+        (WebCore::ResourceRequestBase::setReportRawHeaders):
+        (WebCore::ResourceRequestBase::ResourceRequestBase):
+        * platform/network/ResourceResponseBase.cpp: Added support for raw headers.
+        (WebCore::ResourceResponseBase::resourceRawHeaders):
+        (WebCore::ResourceResponseBase::setResourceRawHeaders):
+        * platform/network/ResourceResponseBase.h:
+
+2010-09-30  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] V8 port: Unbreak build
+
+        Add missing <wtf/text/CString.h> include.
+
+        * loader/PingLoader.cpp:
+
+2010-09-29  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: assign the resource loading finish time which was obtained from the network stack
+        as the end time for the corresponding event in Timeline.
+        See related change for Resources panel https://bugs.webkit.org/show_bug.cgi?id=45664
+
+        https://bugs.webkit.org/show_bug.cgi?id=46789
+
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::didFinishLoading):
+        (WebCore::InspectorController::didFailLoading):
+        * inspector/InspectorTimelineAgent.cpp:
+        (WebCore::InspectorTimelineAgent::didFinishLoadingResource):
+        * inspector/InspectorTimelineAgent.h:
+
+2010-09-29  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: implement sorting by timeline in network panel + filtering.
+        https://bugs.webkit.org/show_bug.cgi?id=45657
+
+        A number of drive-by fixes, sorting by timeline added,
+        0-based timeline for duration added, filters added,
+        more love for detailed view + nice headers.
+
+        * English.lproj/localizedStrings.js:
+        * inspector/front-end/DataGrid.js:
+        (WebInspector.DataGrid):
+        (WebInspector.DataGrid.prototype.markColumnAsSortedBy):
+        (WebInspector.DataGrid.prototype.headerTableHeader):
+        * inspector/front-end/NetworkPanel.js:
+        (WebInspector.NetworkPanel):
+        (WebInspector.NetworkPanel.prototype.get statusBarItems):
+        (WebInspector.NetworkPanel.prototype._createTable):
+        (WebInspector.NetworkPanel.prototype._makeHeaderInnerHTML):
+        (WebInspector.NetworkPanel.prototype._createSortingFunctions):
+        (WebInspector.NetworkPanel.prototype._sortByTimeline):
+        (WebInspector.NetworkPanel.prototype._sortItems):
+        (WebInspector.NetworkPanel.prototype._createFilterPanel):
+        (WebInspector.NetworkPanel.prototype._showCategory):
+        (WebInspector.NetworkPanel.prototype._hideCategory):
+        (WebInspector.NetworkPanel.prototype._updateFilter):
+        (WebInspector.NetworkPanel.prototype._filter):
+        (WebInspector.NetworkPanel.prototype._updateDividersIfNeeded):
+        (WebInspector.NetworkPanel.prototype.reset):
+        (WebInspector.NetworkPanel.prototype._setLargerResources):
+        (WebInspector.NetworkDataGridNode.prototype.createCells):
+        (WebInspector.NetworkDataGridNode.prototype._createDivInTD):
+        (WebInspector.NetworkDataGridNode.prototype._refreshURLCell):
+        (WebInspector.NetworkDataGridNode.prototype._refreshStatusCell):
+        (WebInspector.NetworkDataGridNode.prototype._appendSubtitle):
+        (WebInspector.NetworkDataGridNode.SizeComparator):
+        (WebInspector.NetworkDataGridNode.ResourcePropertyComparator):
+        * inspector/front-end/ProfilesPanel.js:
+        (WebInspector.ProfilesPanel):
+        (WebInspector.ProfilesPanel.prototype.updateMainViewWidth):
+        * inspector/front-end/StoragePanel.js:
+        (WebInspector.StoragePanel):
+        * inspector/front-end/TimelineGrid.js:
+        (WebInspector.TimelineGrid.prototype.updateDividers):
+        * inspector/front-end/TimelineOverviewPane.js:
+        (WebInspector.TimelineOverviewPane):
+        (WebInspector.TimelineOverviewPane.prototype.updateMainViewWidth):
+        * inspector/front-end/inspector.css:
+        (.data-grid th.sort-ascending > div::after):
+        (.data-grid th.sort-descending > div::after):
+        (.status-bar-items):
+        * inspector/front-end/networkPanel.css:
+        (.network.panel .data-grid td):
+        (.network.panel .data-grid th):
+        (.network.panel .data-grid.small th):
+        (.network.panel .data-grid .data-container):
+        (.network.panel .data-grid.small .data-container):
+        (.network.panel .data-grid select):
+        (.network.panel .data-grid td.time-column):
+        (.network-cell-subtitle):
+        (.network-header-subtitle):
+        (.network-event-divider):
+        (.network.panel .network-timeline-grid.small .network-event-divider):
+        (.network.panel .resources-dividers-label-bar):
+        (.network.panel .network-timeline-grid.small .resources-dividers-label-bar):
+        (.network.panel .resources-divider-label):
+        (.network.panel .resources-dividers-label-bar .resources-divider):
+        (.network.panel .network-timeline-grid.small .resources-dividers-label-bar .resources-divider):
+        (.network.panel .resources-divider.first .resources-divider-label):
+        (.network.panel .resources-dividers-label-bar .resources-divider.first):
+        (#network-filter):
+        (.data-grid table.data tr.revealed.network-category-websockets, .data-grid table.data tr.revealed.network-category-other):
+        (.data-grid.filter-all table.data tr.revealed.network-category-other, .data-grid.filter-other table.data tr.revealed.network-category-other):
+
+2010-09-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Ensure we always report a valid size for the video
+
+        Some QtMultimedia-backends require a paint before even giving us
+        a size, so we start out by using the default video size, and then
+        update it once QtMultimedia starts feeding us valid sizes.
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
+        (WebCore::MediaPlayerPrivateQt::nativeSizeChanged):
+        (WebCore::MediaPlayerPrivateQt::setSize):
+        (WebCore::MediaPlayerPrivateQt::naturalSize):
+        * platform/graphics/qt/MediaPlayerPrivateQt.h:
+
+2010-09-30  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        RenderSVGTextPath lacks isSVGTextPath() method
+        https://bugs.webkit.org/show_bug.cgi?id=46888
+
+        Make RenderSVGTextPath objects easily detectable, using a isSVGTextPath() method, like all other SVG renderers have.
+
+        * rendering/RenderObject.h:
+        (WebCore::RenderObject::isSVGTextPath): Return false.
+        * rendering/RenderSVGTextPath.h: Changed indentation of whole file.
+        (WebCore::RenderSVGTextPath::isSVGTextPath): Return true.
+        (WebCore::RenderSVGTextPath::renderName):
+        (WebCore::toRenderSVGTextPath): Add helper casting methods.
+
+2010-09-30  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        AffineTransform should expose methods calculating the x/y scale factors
+        https://bugs.webkit.org/show_bug.cgi?id=46887
+
+        Expose methods calculating the x/y scale factors for an AffineTransform. 
+
+        * platform/graphics/transforms/AffineTransform.cpp:
+        (WebCore::affineTransformDecompose): Move xScale / yScale calculations in their own functions.
+        (WebCore::AffineTransform::xScale):
+        (WebCore::AffineTransform::yScale):
+        * platform/graphics/transforms/AffineTransform.h:
+
+2010-09-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Ensure that the media player backend does not leave any resources around
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::~MediaPlayerPrivateQt):
+
+2010-09-30  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        Minor cleanup of MediaPlayerPrivateQt
+
+        * platform/graphics/qt/MediaPlayerPrivateQt.cpp:
+        (WebCore::MediaPlayerPrivateQt::MediaPlayerPrivateQt):
+        (WebCore::MediaPlayerPrivateQt::currentTime):
+        (WebCore::MediaPlayerPrivateQt::positionChanged):
+        (WebCore::MediaPlayerPrivateQt::paint):
+
+2010-09-30  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Jeremy Orlow.
+
+        Mark unused parameters as such.
+        https://bugs.webkit.org/show_bug.cgi?id=46880
+
+        * inspector/InspectorDOMAgent.cpp:
+        * page/Geolocation.cpp:
+        (WebCore::Geolocation::clearWatch):
+
+2010-09-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract Inspector Instrumentation API as a class.
+        https://bugs.webkit.org/show_bug.cgi?id=46614
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.vcproj/WebCore.vcproj:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::parserAddChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::removeAttribute):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::instrumentWillSendXMLHttpRequest):
+        * inspector/InspectorController.h:
+        * inspector/InspectorInstrumentation.cpp: Added.
+        (WebCore::InspectorInstrumentation::willInsertDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::didInsertDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willRemoveDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::didRemoveDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::didModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::characterDataModifiedImpl):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequestImpl):
+        * inspector/InspectorInstrumentation.h: Added.
+        (WebCore::InspectorInstrumentation::frontendCreated):
+        (WebCore::InspectorInstrumentation::frontendDeleted):
+        (WebCore::InspectorInstrumentation::hasFrontends):
+        (WebCore::InspectorInstrumentation::willInsertDOMNode):
+        (WebCore::InspectorInstrumentation::didInsertDOMNode):
+        (WebCore::InspectorInstrumentation::willRemoveDOMNode):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttr):
+        (WebCore::InspectorInstrumentation::didModifyDOMAttr):
+        (WebCore::InspectorInstrumentation::characterDataModified):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequest):
+        (WebCore::InspectorInstrumentation::inspectorControllerForScriptExecutionContext):
+        (WebCore::InspectorInstrumentation::inspectorControllerForDocument):
+        (WebCore::InspectorInstrumentation::inspectorControllerForPage):
+        * workers/SharedWorker.cpp:
+
+2010-09-30  Kwang Yul Seo  <skyul@company100.net>
+
+        Reviewed by Darin Adler.
+
+        Build fix: Add ENABLE(INSPECTOR) guard
+        https://bugs.webkit.org/show_bug.cgi?id=46852
+
+        Page does not have inspectorController() when ENABLE(INSPECTOR) is 0.
+
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::inspectorControllerForDocument):
+
+2010-09-30  Michael Nordman  <michaeln@google.com>
+
+        Reviewed by David Levin.
+
+        Make it possible to copy platform specific data members of ResourceRequest and ResourceResponse
+        across threads and to compare platform specific data members of ResourceRequest.
+        - Added two instance methods to the platform specific subclasses: doPlatformAdopt and doPlatformCopyData.
+        - Also added a "shadowable" static method for platformCompare to ResourceRequestBase, a similar method
+          is already present on ResourceResponseBase.
+        - Converted the cross thread structs defined in ResourceRequest/ResponseBase.h to base
+          classes and extended those base classes in the platform specific headers to provide a place
+          to hold additional fields.
+        - Used this mechanism to have the chromium port's data members make the hop.
+        https://bugs.webkit.org/show_bug.cgi?id=46430
+
+        No new tests. Just plumbing.
+
+        * WebCore.exp.in: removed the symbol for the now inlined == operator
+        * WebCore.gypi: added chromium/ResourceResponse.cpp
+        * platform/network/ResourceRequestBase.cpp:
+        (WebCore::ResourceRequestBase::adopt):
+        (WebCore::ResourceRequestBase::copyData):
+        (WebCore::ResourceRequestBase::compare):
+        * platform/network/ResourceRequestBase.h:
+        (WebCore::ResourceRequestBase::platformCompare):
+        (WebCore::operator==):
+        (WebCore::operator!=):
+        * platform/network/ResourceResponseBase.cpp:
+        (WebCore::ResourceResponseBase::asResourceResponse):
+        (WebCore::ResourceResponseBase::adopt):
+        (WebCore::ResourceResponseBase::copyData):
+        * platform/network/ResourceResponseBase.h:
+        * platform/network/android/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/android/ResourceResponse.h:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/cf/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/cf/ResourceResponse.h:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/chromium/ResourceRequest.cpp:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/chromium/ResourceRequest.h:
+        * platform/network/chromium/ResourceResponse.cpp: Added.
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/chromium/ResourceResponse.h:
+        * platform/network/curl/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/curl/ResourceResponse.h:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/mac/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/mac/ResourceResponse.h:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/qt/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/qt/ResourceResponse.h:
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+        * platform/network/soup/ResourceRequest.h:
+        (WebCore::ResourceRequest::doPlatformCopyData):
+        (WebCore::ResourceRequest::doPlatformAdopt):
+        * platform/network/soup/ResourceResponse.h:
+        (WebCore::ResourceResponse::doUpdateResourceResponse):
+        (WebCore::ResourceResponse::doPlatformCopyData):
+        (WebCore::ResourceResponse::doPlatformAdopt):
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Put default initialize() and uninitialize() methods in AudioNode
+        https://bugs.webkit.org/show_bug.cgi?id=46767
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioNode.cpp:
+        (WebCore::AudioNode::initialize):
+        (WebCore::AudioNode::uninitialize):
+        * webaudio/AudioNode.h:
+
+2010-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Make DeprecatedInputType private.
+        https://bugs.webkit.org/show_bug.cgi?id=46791
+
+        No new tests because this doesn't change any behavior.
+
+        * html/HTMLInputElement.cpp:
+        (WebCore::HTMLInputElement::createTypeMap):
+        * html/HTMLInputElement.h:
+         Move DeprecatedInputType, deprecatedInputType() and
+         parseToDateComponents() to the private section, make
+         createTypeMap() a member function of HTMLInputElement.
+        (WebCore::HTMLInputElement::deprecatedInputType):
+
+2010-09-29  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        REGRESSION: page reload on back button after history.pushState with appearing/disappearing iframes
+        https://bugs.webkit.org/show_bug.cgi?id=46324
+        
+        Revert same document check to the way it was before r66238 for history
+        entries created by pushState or fragment changes. Logic fror determining
+        if same document navigation should be used is moved to HistoryItem.
+
+        Tests: fast/history/same-document-iframes-changing-fragment.html
+               fast/history/same-document-iframes-changing-pushstate.html
+
+        * history/HistoryItem.cpp:
+        (WebCore::HistoryItem::shouldDoSameDocumentNavigationTo):
+        (WebCore::HistoryItem::hasSameDocumentTree):
+        (WebCore::HistoryItem::hasSameFrames):
+        * history/HistoryItem.h:
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+
+        * loader/FrameLoader.cpp:
+        (WebCore::FrameLoader::loadItem):
+
+2010-09-29  MORITA Hajime  <morrita@google.com>
+
+        Unreviewed build fix.
+        
+        WebCore::ESpeak causes missing symbol with no ENABLE_SVG
+        https://bugs.webkit.org/show_bug.cgi?id=46865
+
+        Moves ESpeak related function definitions outside ENABLE_SVG block.
+
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ESpeak):
+        (WebCore::CSSPrimitiveValue::operator EVectorEffect):
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioChannelSplitter files
+        https://bugs.webkit.org/show_bug.cgi?id=46290
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioChannelSplitter.cpp: Added.
+        (WebCore::AudioChannelSplitter::AudioChannelSplitter):
+        (WebCore::AudioChannelSplitter::process):
+        (WebCore::AudioChannelSplitter::reset):
+        * webaudio/AudioChannelSplitter.h: Added.
+        (WebCore::AudioChannelSplitter::create):
+        * webaudio/AudioChannelSplitter.idl: Added.
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix DirectoryReader's behavior to trigger only one EntriesCallback per readEntries
+        https://bugs.webkit.org/show_bug.cgi?id=46563
+
+        Test: fast/filesystem/read-directory.html
+
+        * fileapi/DOMFileSystem.cpp:
+        (WebCore::DOMFileSystem::readDirectory): Changed to take DirectoryReader
+        as a parameter.
+        * fileapi/DOMFileSystem.h:
+        (WebCore::DOMFileSystem::scheduleCallback): Added.
+        * fileapi/DirectoryReader.cpp:
+        (WebCore::DirectoryReader::DirectoryReader): Added initializer for
+        m_hasMore flag.
+        (WebCore::DirectoryReader::readEntries): Changed to schedule
+        EntriesCallback with an empty array if m_hasMore flag is set false.
+        * fileapi/DirectoryReader.h:
+        (WebCore::DirectoryReader::filesystem): Added.
+        (WebCore::DirectoryReader::setHasMore): Added.
+        * fileapi/FileSystemCallbacks.cpp:
+        (WebCore::EntriesCallbacks::create):
+        (WebCore::EntriesCallbacks::EntriesCallbacks): Changed to take
+        DirectoryReader as a parameter.
+        (WebCore::EntriesCallbacks::didReadDirectoryEntry):
+        (WebCore::EntriesCallbacks::didReadDirectoryEntries): Changed 1) not to
+        trigger the second callback when hasMore is false, and 2) to update
+        the DirectoryReader's m_hasMore flag.
+        * fileapi/FileSystemCallbacks.h:
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioGainNode files
+        https://bugs.webkit.org/show_bug.cgi?id=46286
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioGainNode.cpp: Added.
+        (WebCore::AudioGainNode::AudioGainNode):
+        (WebCore::AudioGainNode::process):
+        (WebCore::AudioGainNode::reset):
+        (WebCore::AudioGainNode::checkNumberOfChannelsForInput):
+        * webaudio/AudioGainNode.h: Added.
+        (WebCore::AudioGainNode::create):
+        (WebCore::AudioGainNode::gain):
+        * webaudio/AudioGainNode.idl: Added.
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Add AudioChannelMerger files
+        https://bugs.webkit.org/show_bug.cgi?id=46291
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioChannelMerger.cpp: Added.
+        (WebCore::AudioChannelMerger::AudioChannelMerger):
+        (WebCore::AudioChannelMerger::process):
+        (WebCore::AudioChannelMerger::reset):
+        * webaudio/AudioChannelMerger.h: Added.
+        (WebCore::AudioChannelMerger::create):
+        * webaudio/AudioChannelMerger.idl: Added.
+
+2010-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        No review. Missed file for patch.
+
+        AX: implement CSS3 Speech "speak"
+        https://bugs.webkit.org/show_bug.cgi?id=46827
+
+        * css/CSSParser.cpp:
+        (WebCore::CSSParser::parseValue):
+
+2010-09-29  Enrica Casucci  <enrica@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Crash at lineBreakExistsAtPosition + 125
+        <rdar://problem/7028809> 
+        https://bugs.webkit.org/show_bug.cgi?id=46770
+        
+        lineBreakExistsAtPosition is called from InsertTextCommand::input,
+        where we compute the downstream position of the endingSelection().
+        Downstream can return the original position, that comes from a VisibleSelection
+        but there is no guarantee that its renderer is still there. Everywhere we dereference
+        a renderer we check if it's null.
+        
+        There is no regression test.
+        
+        * editing/htmlediting.cpp:
+        (WebCore::lineBreakExistsAtPosition): Added check that the renderer is not null
+        before dereferencing it.
+
+2010-09-29  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Add additional checks to StringBuilder.
+        <rdar://problem/7761248>
+
+        * platform/text/StringBuilder.cpp:
+        (WebCore::checkAppend):
+        (WebCore::StringBuilder::append):
+        (WebCore::StringBuilder::toString):
+        (WebCore::StringBuilder::clear):
+        (WebCore::StringBuilder::length):
+        * platform/text/StringBuilder.h:
+        (WebCore::StringBuilder::StringBuilder):
+        (WebCore::StringBuilder::setNonNull):
+        (WebCore::StringBuilder::isNull):
+
+2010-09-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        plugins/npruntime/invoke-failure.html fails in WebKit2 due to slightly different exception being thrown
+        https://bugs.webkit.org/show_bug.cgi?id=46715
+        <rdar://problem/8485909>
+
+        Remove exclamation points from exceptions.
+
+        * bindings/v8/V8NPObject.cpp:
+        (WebCore::npObjectInvokeImpl):
+        * bridge/c/c_instance.cpp:
+        (JSC::Bindings::CInstance::invokeMethod):
+        (JSC::Bindings::CInstance::invokeDefaultMethod):
+        (JSC::Bindings::CInstance::invokeConstruct):
+
+2010-09-29  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add additional check to Text::wholeText.
+        <rdar://problem/8304795>
+
+        * dom/Text.cpp:
+        (WebCore::Text::wholeText):
+
+2010-09-29  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Brady Eidson.
+
+        REGRESSION (r66129): Loading full-frame .swf file crashes with flash blocker extension enabled
+        <https://bugs.webkit.org/show_bug.cgi?id=46773>
+        <rdar://problem/8390975>
+        
+        After r66129, start scripts were run on plugin documents, and cancelling the load of a plugin
+        document could cause Safari to crash.
+        
+        If a plugin load on an initial document is cancelled, we cancel the main resource load (where the
+        main resource is the plugin), and if the load is restarted and allowed, we don't go through the manual
+        loading path like we do on the initial load of a plugin in a plugin document.
+
+        Tests: plugins/plugin-document-load-prevented-userscript.html
+               plugins/plugin-document-willSendRequest-null.html
+
+        * html/HTMLEmbedElement.cpp:
+        (WebCore::HTMLEmbedElement::updateWidget): If the plugin load was cancelled, and this is in a
+            plugin document, call a function on PluginDocument that cancels the main resource load, and
+            sets a plugin document flag.
+        * html/PluginDocument.cpp:
+        (WebCore::PluginDocumentParser::appendBytes): Null check the widget's renderer, because it could be
+            null if the load was cancelled.
+        (WebCore::PluginDocument::PluginDocument): Initialize the new variable.
+        (WebCore::PluginDocument::cancelManualPluginLoad): Cancel the main resource load of the plugin document
+            (which is a plugin in the case of a plugin document).
+        * html/PluginDocument.h:
+        (WebCore::PluginDocument::shouldLoadPluginManually): Returns whether or not we should load the plugin
+            manually.
+        (WebCore::PluginDocument::setShouldLoadPluginManually): Set whether or not we should load the plugin
+            manually.
+        (WebCore::toPluginDocument):
+        * loader/SubframeLoader.cpp:
+        (WebCore::SubframeLoader::loadPlugin): Check if we should load the plugin manually according to the plugin
+            document.
+
+2010-09-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46844, make estimateLogicalTopPosition
+        block-flow-aware.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::estimateLogicalTopPosition):
+        (WebCore::RenderBlock::collapsedMarginBeforeForChild):
+        (WebCore::RenderBlock::collapsedMarginAfterForChild):
+        * rendering/RenderBlock.h:
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Minor cleanup to AudioContext
+        https://bugs.webkit.org/show_bug.cgi?id=46843
+
+        No new tests since audio API is not yet implemented
+
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::lock):
+        (WebCore::AudioContext::handleDeferredFinishDerefs):
+
+2010-09-29  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Eric Seidel.
+
+        Assertion failed when accessing -webkit-margin-top-collapse via computed style.
+        https://bugs.webkit.org/show_bug.cgi?id=46798
+        
+        There was a switch statement which missed enum entries in getPropertyCSSValue().
+        This change added these entries to prevent the leak.
+        It also added extra case statements to encourage the compiler's help.
+
+        Test: fast/css/getComputedStyle/margin-top-bottom-collapse-alias.html
+
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+
+2010-09-29  Chris Rogers  <crogers@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Limit number of AudioNode deletions per render quantum in AudioContext
+        https://bugs.webkit.org/show_bug.cgi?id=46834
+
+        No new tests since audio API is not yet implemented.
+
+        * webaudio/AudioContext.cpp:
+        (WebCore::AudioContext::handlePostRenderTasks):
+        (WebCore::AudioContext::deleteMarkedNodes):
+
+2010-09-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46838
+        
+        Get rid of the marginXXXUsing/setMarginXXXUsing methods on RenderBox.  I'm inverting the way these are called
+        and putting the methods on RenderBlock instead.  The methods can be named better this way and the getters
+        can operate on RenderBoxModelObjects instead of just RenderBoxes.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlockChild):
+        (WebCore::RenderBlock::marginBeforeForChild):
+        (WebCore::RenderBlock::marginAfterForChild):
+        (WebCore::RenderBlock::marginStartForChild):
+        (WebCore::RenderBlock::marginEndForChild):
+        (WebCore::RenderBlock::setMarginStartForChild):
+        (WebCore::RenderBlock::setMarginEndForChild):
+        (WebCore::RenderBlock::setMarginBeforeForChild):
+        (WebCore::RenderBlock::setMarginAfterForChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalHeightForChild):
+        (WebCore::RenderBlock::logicalTopForChild):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::marginBefore):
+        (WebCore::RenderBox::marginAfter):
+        (WebCore::RenderBox::marginStart):
+        (WebCore::RenderBox::marginEnd):
+        (WebCore::RenderBox::setMarginStart):
+        (WebCore::RenderBox::setMarginEnd):
+        (WebCore::RenderBox::setMarginBefore):
+        (WebCore::RenderBox::setMarginAfter):
+        (WebCore::RenderBox::computeLogicalWidth):
+        (WebCore::RenderBox::computeInlineDirectionMargins):
+        (WebCore::RenderBox::computeBlockDirectionMargins):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::setMarginTop):
+        (WebCore::RenderBox::setMarginBottom):
+        (WebCore::RenderBox::setMarginLeft):
+        (WebCore::RenderBox::setMarginRight):
+
+2010-09-29  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Removed input type site-specific quirk for mail.google.com
+        https://bugs.webkit.org/show_bug.cgi?id=46836
+
+        * bindings/js/JSHTMLInputElementCustom.cpp:
+        (WebCore::needsGmailQuirk): Removed.
+        (WebCore::JSHTMLInputElement::type): Removed this custom getter. 
+        * html/HTMLInputElement.idl: Removed the JSCCustomGetter custom attribute
+        from the type attribute.
+
+2010-09-29  Joseph Pecoraro  <joepeck@webkit.org>
+
+        Reviewed by Simon Fraser.
+
+        CRASH at WebCore::HTMLSourceElement::scheduleErrorEvent
+        https://bugs.webkit.org/show_bug.cgi?id=46777
+
+        It should not be possible to get to be in the LoadingFromSourceElement
+        state with a null current source node. This was a possible scenario
+        where the current source node was cleared but the load state was not
+        cleared as well. Tried and could not create a test case for this.
+
+        * html/HTMLMediaElement.cpp:
+        (WebCore::HTMLMediaElement::userCancelledLoad): clear the load state because we also clear the current source node.
+
+2010-09-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46835, patch a few more height/logicalHeights.  Rename stretchesToViewHeight.
+
+        * page/FrameView.cpp:
+        (WebCore::FrameView::layout):
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        * rendering/RenderBlockLineLayout.cpp:
+        (WebCore::RenderBlock::layoutInlineChildren):
+        * rendering/RenderBox.cpp:
+        (WebCore::RenderBox::computeLogicalHeight):
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::stretchesToViewport):
+        * rendering/RenderBoxModelObject.cpp:
+        (WebCore::RenderBoxModelObject::relativePositionOffsetY):
+
+2010-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: implement CSS3 Speech "speak"
+        https://bugs.webkit.org/show_bug.cgi?id=46827
+
+        Support the "speak" style as defined in
+        http://www.w3.org/TR/css3-speech/#speak
+
+        This puts all the pieces in place for a platform to support this ability, but there's no platform implementation yet.
+
+        Test: platform/mac/accessibility/css-speech-speak.html
+
+        * accessibility/AccessibilityObject.h:
+        (WebCore::AccessibilityObject::speakProperty):
+        * accessibility/AccessibilityRenderObject.cpp:
+        (WebCore::AccessibilityRenderObject::speakProperty):
+        * accessibility/AccessibilityRenderObject.h:
+        * accessibility/mac/AccessibilityObjectWrapper.mm:
+        (-[AccessibilityObjectWrapper accessibilityAttributeValue:]):
+        * css/CSSComputedStyleDeclaration.cpp:
+        (WebCore::CSSComputedStyleDeclaration::getPropertyCSSValue):
+        * css/CSSPrimitiveValueMappings.h:
+        (WebCore::CSSPrimitiveValue::CSSPrimitiveValue):
+        (WebCore::CSSPrimitiveValue::operator ESpeak):
+        * css/CSSPropertyNames.in:
+        * css/CSSStyleSelector.cpp:
+        (WebCore::CSSStyleSelector::applyProperty):
+        * css/CSSValueKeywords.in:
+        * rendering/style/RenderStyle.h:
+        (WebCore::InheritedFlags::speak):
+        (WebCore::InheritedFlags::setSpeak):
+        (WebCore::InheritedFlags::initialSpeak):
+        * rendering/style/RenderStyleConstants.h:
+        * rendering/style/StyleRareInheritedData.cpp:
+        (WebCore::StyleRareInheritedData::StyleRareInheritedData):
+        (WebCore::StyleRareInheritedData::operator==):
+        * rendering/style/StyleRareInheritedData.h:
+
+2010-09-29  João Paulo Rechi Vita  <jprvita@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [Curl] Fix unused and unitialized warnings.
+        https://bugs.webkit.org/show_bug.cgi?id=46831
+
+        No new tests since no new funcionality has been added.
+
+        * platform/network/curl/ResourceHandleCurl.cpp:
+        (WebCore::allowsAnyHTTPSCertificateHosts):
+        * platform/network/curl/ResourceHandleManager.cpp:
+        (WebCore::ResourceHandleManager::ResourceHandleManager):
+        (WebCore::handleLocalReceiveResponse):
+        (WebCore::ResourceHandleManager::downloadTimerCallback):
+        (WebCore::ResourceHandleManager::initializeHandle):
+
+2010-09-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46824
+        
+        Convert layoutBlockChild (but not the functions it calls) to be block-flow-aware.
+
+        fast/blockflow/root-lr.html progresses as a result of this change.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::estimateLogicalTopPosition):
+        (WebCore::RenderBlock::determineLogicalLeftPositionForChild):
+        (WebCore::RenderBlock::setLogicalTopForChild):
+        (WebCore::RenderBlock::layoutBlockChild):
+        * rendering/RenderBlock.h:
+        (WebCore::RenderBlock::logicalHeightForChild):
+        (WebCore::RenderBlock::logicalTopForChild):
+        * rendering/RenderBox.h:
+
+2010-09-29  Ryosuke Niwa  <rniwa@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        queryCommandValue "formatBlock" always returns false
+        https://bugs.webkit.org/show_bug.cgi?id=21305
+
+        Implemented queryCommandValue('formatBlock'). We match the Firefox's behavior exactly
+        because Firefox and Internet Explorer support the same set of elements
+        (address, h1, h2, h3, h4, h5, h6, and p) and Firefox's behavior is more compatible with Opera.
+        See the bug for the detailed discussion.
+
+        WebKit's implementation returns the local name of the lowest common ancestor
+        of the selection with the tag name address, h1, h2, h3, h4, h5, h6, or p.
+        It returns "" when there is no such an ancestor or there is no selection.
+
+        Test: editing/execCommand/query-format-block.html
+
+        * editing/Editor.cpp:
+        (WebCore::isElementForFormatBlockCommand):
+        (WebCore::Editor::elementForFormatBlockCommand):
+        * editing/Editor.h:
+        * editing/EditorCommand.cpp:
+        (WebCore::valueFormatBlock):
+        (WebCore::createCommandMap):
+
+2010-09-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove obsolete registerExtension variants from chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=46683
+
+        * bindings/v8/V8DOMWindowShell.cpp:
+        (WebCore::V8DOMWindowShell::createNewContext):
+        * bindings/v8/V8Proxy.cpp:
+        (WebCore::V8Proxy::registeredExtensionWithV8):
+        (WebCore::V8Proxy::registerExtension):
+        * bindings/v8/V8Proxy.h:
+
+2010-09-29  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] editing/selection/selection-modify-crash.html crashes when run in Xvfb
+        https://bugs.webkit.org/show_bug.cgi?id=46822
+
+        When parentObjectUnignored returns null in objectAndOffsetUnignored consider that
+        a failure case. Handle this failure appropriately at all call sites.
+
+        * accessibility/gtk/AccessibilityObjectWrapperAtk.cpp:
+        (webkit_accessible_text_get_caret_offset): Handle the failure of objectAndOffsetUnignored.
+        (objectAndOffsetUnignored): Always check the return value of parentObjectUnignored and
+        return 0 to indicate failure when that happens.
+        * editing/gtk/SelectionControllerGtk.cpp:
+        (WebCore::SelectionController::notifyAccessibilityForSelectionChange): Handle the failure
+        case of objectAndOffsetUnignored.
+
+2010-09-29  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r68657.
+        http://trac.webkit.org/changeset/68657
+        https://bugs.webkit.org/show_bug.cgi?id=46820
+
+        reason "Breaks win debug build" (Requested by podivilov on
+        #webkit).
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::parserAddChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::removeAttribute):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::willInsertDOMNodeImpl):
+        (WebCore::InspectorController::didInsertDOMNodeImpl):
+        (WebCore::InspectorController::willRemoveDOMNodeImpl):
+        (WebCore::InspectorController::didRemoveDOMNodeImpl):
+        (WebCore::InspectorController::willModifyDOMAttrImpl):
+        (WebCore::InspectorController::didModifyDOMAttrImpl):
+        (WebCore::InspectorController::characterDataModifiedImpl):
+        (WebCore::InspectorController::instrumentWillSendXMLHttpRequestImpl):
+        * inspector/InspectorController.h:
+        (WebCore::InspectorController::willInsertDOMNode):
+        (WebCore::InspectorController::didInsertDOMNode):
+        (WebCore::InspectorController::willRemoveDOMNode):
+        (WebCore::InspectorController::willModifyDOMAttr):
+        (WebCore::InspectorController::didModifyDOMAttr):
+        (WebCore::InspectorController::characterDataModified):
+        (WebCore::InspectorController::instrumentWillSendXMLHttpRequest):
+        (WebCore::InspectorController::inspectorControllerForScriptExecutionContext):
+        (WebCore::InspectorController::inspectorControllerForNode):
+        (WebCore::InspectorController::inspectorControllerForDocument):
+        * inspector/InspectorInstrumentation.cpp: Removed.
+        * inspector/InspectorInstrumentation.h: Removed.
+        * workers/SharedWorker.cpp:
+
+2010-09-29  Xiaomei Ji  <xji@chromium.org>
+
+        Reviewed by David Levin.
+
+        Performance improvement for FontLinux.
+        https://bugs.webkit.org/show_bug.cgi?id=46374
+
+        Reduce new/delete operations by storing the maximum capacity of the glyph
+        array and use that value in subsequent HB_ShapeItem calls. (Note that a
+        call to HB_ShapeItem may reduce the value of m_item.num_glyphs below the
+        capacity.)
+
+        Also be consistent with zero'ing the glyph arrays before calling 
+        HB_ShapeItem.
+
+        There is no functionality changes so no new tests are added.
+ 
+        * platform/graphics/chromium/FontLinux.cpp:
+        (WebCore::TextRunWalker::createGlyphArrays):
+        (WebCore::TextRunWalker::resetGlyphArrays):
+        (WebCore::TextRunWalker::shapeGlyphs):
+
+2010-09-29  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: extract Inspector Instrumentation API as a class.
+        https://bugs.webkit.org/show_bug.cgi?id=46614
+
+        * CMakeLists.txt:
+        * GNUmakefile.am:
+        * WebCore.gypi:
+        * WebCore.pro:
+        * WebCore.xcodeproj/project.pbxproj:
+        * bindings/js/JSXMLHttpRequestCustom.cpp:
+        (WebCore::JSXMLHttpRequest::send):
+        * bindings/v8/custom/V8XMLHttpRequestCustom.cpp:
+        (WebCore::V8XMLHttpRequest::sendCallback):
+        * dom/CharacterData.cpp:
+        (WebCore::CharacterData::dispatchModifiedEvent):
+        * dom/ContainerNode.cpp:
+        (WebCore::ContainerNode::insertBefore):
+        (WebCore::ContainerNode::parserInsertBefore):
+        (WebCore::ContainerNode::replaceChild):
+        (WebCore::ContainerNode::appendChild):
+        (WebCore::ContainerNode::parserAddChild):
+        (WebCore::notifyChildInserted):
+        (WebCore::dispatchChildRemovalEvents):
+        * dom/Element.cpp:
+        (WebCore::Element::setAttribute):
+        (WebCore::Element::removeAttribute):
+        * inspector/InspectorController.cpp:
+        (WebCore::InspectorController::InspectorController):
+        (WebCore::InspectorController::~InspectorController):
+        (WebCore::InspectorController::connectFrontend):
+        (WebCore::InspectorController::disconnectFrontend):
+        (WebCore::InspectorController::instrumentWillSendXMLHttpRequest):
+        * inspector/InspectorController.h:
+        * inspector/InspectorInstrumentation.cpp: Added.
+        (WebCore::InspectorInstrumentation::willInsertDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::didInsertDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willRemoveDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::didRemoveDOMNodeImpl):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::didModifyDOMAttrImpl):
+        (WebCore::InspectorInstrumentation::characterDataModifiedImpl):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequestImpl):
+        * inspector/InspectorInstrumentation.h: Added.
+        (WebCore::InspectorInstrumentation::frontendCreated):
+        (WebCore::InspectorInstrumentation::frontendDeleted):
+        (WebCore::InspectorInstrumentation::hasFrontends):
+        (WebCore::InspectorInstrumentation::willInsertDOMNode):
+        (WebCore::InspectorInstrumentation::didInsertDOMNode):
+        (WebCore::InspectorInstrumentation::willRemoveDOMNode):
+        (WebCore::InspectorInstrumentation::willModifyDOMAttr):
+        (WebCore::InspectorInstrumentation::didModifyDOMAttr):
+        (WebCore::InspectorInstrumentation::characterDataModified):
+        (WebCore::InspectorInstrumentation::instrumentWillSendXMLHttpRequest):
+        (WebCore::InspectorInstrumentation::inspectorControllerForScriptExecutionContext):
+        (WebCore::InspectorInstrumentation::inspectorControllerForDocument):
+        (WebCore::InspectorInstrumentation::inspectorControllerForPage):
+
+2010-09-29  David Hyatt  <hyatt@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46786, convert layoutBlockChild (but not any functions it calls)
+        to be block-flow-aware.
+
+        * rendering/RenderBlock.cpp:
+        (WebCore::RenderBlock::layoutBlock):
+        (WebCore::RenderBlock::handleAfterSideOfBlock):
+        (WebCore::RenderBlock::layoutBlockChildren):
+        * rendering/RenderBlock.h:
+        * rendering/RenderBox.h:
+        (WebCore::RenderBox::scrollbarLogicalHeight):
+
+2010-09-29  João Paulo Rechi Vita  <jprvita@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] General small fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=46813
+
+        This commit spots a comparison between signed and unsigned integer
+        expressions, a missing return and a never-called function.
+
+        No new tests since no new funcionality has been added.
+
+        * platform/efl/SharedBufferEfl.cpp:
+        (WebCore::SharedBuffer::createWithContentsOfFile):
+
 2010-09-29  Philippe Normand  <pnormand@igalia.com>
 
         Reviewed by Gustavo Noronha Silva.
@@ -58398,7 +72823,7 @@
         Continuation outlines are normally painted by the containing block. However, when the
         block and the inline are not enclosed by the same self-painting layer, the inline has to
         paint its own outlines. This was handled correctly only for the case where the inline had
-        its own self-painting layer, but now when an ancestor inline had the self-painting layer.
+        its own self-painting layer, but not when an ancestor inline had the self-painting layer.
 
         * rendering/InlineFlowBox.cpp:
         (WebCore::InlineFlowBox::paint): Instead of testing for having a self-painting layer, test
diff --git a/WebCore/Configurations/FeatureDefines.xcconfig b/WebCore/Configurations/FeatureDefines.xcconfig
index 81d912f..7cb8640 100644
--- a/WebCore/Configurations/FeatureDefines.xcconfig
+++ b/WebCore/Configurations/FeatureDefines.xcconfig
@@ -33,6 +33,11 @@
 
 ENABLE_LINK_PREFETCH = ;
 
+ENABLE_ACCELERATED_2D_CANVAS = $(ENABLE_ACCELERATED_2D_CANVAS_$(REAL_PLATFORM_NAME));
+ENABLE_ACCELERATED_2D_CANVAS_macosx = $(ENABLE_ACCELERATED_2D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1060 = ;
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1070 = ;
+
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(REAL_PLATFORM_NAME));
 ENABLE_3D_CANVAS_macosx = $(ENABLE_3D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_macosx_1060 = ENABLE_3D_CANVAS;
@@ -89,9 +94,6 @@ ENABLE_PROGRESS_TAG = ENABLE_PROGRESS_TAG;
 ENABLE_RUBY = $(ENABLE_RUBY_$(REAL_PLATFORM_NAME));
 ENABLE_RUBY_macosx = ENABLE_RUBY;
 
-ENABLE_SANDBOX = $(ENABLE_SANDBOX_$(REAL_PLATFORM_NAME));
-ENABLE_SANDBOX_macosx = ENABLE_SANDBOX;
-
 ENABLE_SHARED_WORKERS = $(ENABLE_SHARED_WORKERS_$(REAL_PLATFORM_NAME));
 ENABLE_SHARED_WORKERS_macosx = ENABLE_SHARED_WORKERS;
 
@@ -120,4 +122,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebCore/Configurations/Version.xcconfig b/WebCore/Configurations/Version.xcconfig
index 81913dd..c8846df 100644
--- a/WebCore/Configurations/Version.xcconfig
+++ b/WebCore/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 10;
+MINOR_VERSION = 11;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebCore/DerivedSources.cpp b/WebCore/DerivedSources.cpp
index 898da5c..01f5023 100644
--- a/WebCore/DerivedSources.cpp
+++ b/WebCore/DerivedSources.cpp
@@ -74,13 +74,16 @@
 #include "JSDedicatedWorkerContext.cpp"
 #include "JSDeviceOrientationEvent.cpp"
 #include "JSDirectoryEntry.cpp"
+#include "JSDirectoryEntrySync.cpp"
 #include "JSDirectoryReader.cpp"
+#include "JSDirectoryReaderSync.cpp"
 #include "JSDocument.cpp"
 #include "JSDocumentFragment.cpp"
 #include "JSDocumentType.cpp"
 #include "JSDOMApplicationCache.cpp"
 #include "JSDOMCoreException.cpp"
 #include "JSDOMFileSystem.cpp"
+#include "JSDOMFileSystemSync.cpp"
 #include "JSDOMFormData.cpp"
 #include "JSDOMImplementation.cpp"
 #include "JSDOMMimeType.cpp"
@@ -99,6 +102,8 @@
 #include "JSEntriesCallback.cpp"
 #include "JSEntry.cpp"
 #include "JSEntryArray.cpp"
+#include "JSEntryArraySync.cpp"
+#include "JSEntrySync.cpp"
 #include "JSEntryCallback.cpp"
 #include "JSErrorCallback.cpp"
 #include "JSErrorEvent.cpp"
@@ -108,6 +113,7 @@
 #include "JSFile.cpp"
 #include "JSFileCallback.cpp"
 #include "JSFileEntry.cpp"
+#include "JSFileEntrySync.cpp"
 #include "JSFileError.cpp"
 #include "JSFileException.cpp"
 #include "JSFileList.cpp"
diff --git a/WebCore/DerivedSources.make b/WebCore/DerivedSources.make
index 2fda5e9..342bb7b 100644
--- a/WebCore/DerivedSources.make
+++ b/WebCore/DerivedSources.make
@@ -114,6 +114,7 @@ DOM_CLASSES = \
     DOMApplicationCache \
     DOMCoreException \
     DOMFileSystem \
+    DOMFileSystemSync \
     DOMFormData \
     DOMImplementation \
     DOMMimeType \
@@ -132,7 +133,9 @@ DOM_CLASSES = \
     DeviceMotionEvent \
     DeviceOrientationEvent \
     DirectoryEntry \
+    DirectoryEntrySync \
     DirectoryReader \
+    DirectoryReaderSync \
     Document \
     DocumentFragment \
     DocumentType \
@@ -142,7 +145,9 @@ DOM_CLASSES = \
     EntityReference \
     EntriesCallback \
     Entry \
+    EntrySync \
     EntryArray \
+    EntryArraySync \
     EntryCallback \
     ErrorCallback \
     ErrorEvent \
@@ -154,6 +159,7 @@ DOM_CLASSES = \
     File \
     FileCallback \
     FileEntry \
+    FileEntrySync \
     FileException \
     FileError \
     FileList \
diff --git a/WebCore/English.lproj/localizedStrings.js b/WebCore/English.lproj/localizedStrings.js
index 62103d7..8f3a228 100644
--- a/WebCore/English.lproj/localizedStrings.js
+++ b/WebCore/English.lproj/localizedStrings.js
diff --git a/WebCore/ForwardingHeaders/runtime/UStringBuilder.h b/WebCore/ForwardingHeaders/runtime/UStringBuilder.h
new file mode 100644
index 0000000..592a783
--- /dev/null
+++ b/WebCore/ForwardingHeaders/runtime/UStringBuilder.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_UStringBuilder_h
+#define WebCore_FWD_UStringBuilder_h
+#include <JavaScriptCore/UStringBuilder.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h b/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
deleted file mode 100644
index 72c1194..0000000
--- a/WebCore/ForwardingHeaders/wtf/StringHashFunctions.h
+++ /dev/null
@@ -1,4 +0,0 @@
-#ifndef WebCore_FWD_StringHashFunctions_h
-#define WebCore_FWD_StringHashFunctions_h
-#include <JavaScriptCore/StringHashFunctions.h>
-#endif
diff --git a/WebCore/ForwardingHeaders/wtf/StringHasher.h b/WebCore/ForwardingHeaders/wtf/StringHasher.h
new file mode 100644
index 0000000..fbc0d8d
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/StringHasher.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringHasher_h
+#define WebCore_FWD_StringHasher_h
+#include <JavaScriptCore/StringHasher.h>
+#endif
diff --git a/WebCore/ForwardingHeaders/runtime/StringBuilder.h b/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
index 115db06..115db06 100644
--- a/WebCore/ForwardingHeaders/runtime/StringBuilder.h
+++ b/WebCore/ForwardingHeaders/wtf/text/StringBuilder.h
diff --git a/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h b/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
new file mode 100644
index 0000000..666ac08
--- /dev/null
+++ b/WebCore/ForwardingHeaders/wtf/text/StringConcatenate.h
@@ -0,0 +1,4 @@
+#ifndef WebCore_FWD_StringConcatenate_h
+#define WebCore_FWD_StringConcatenate_h
+#include <JavaScriptCore/StringConcatenate.h>
+#endif
diff --git a/WebCore/GNUmakefile.am b/WebCore/GNUmakefile.am
index c98f971..b057051 100644
--- a/WebCore/GNUmakefile.am
+++ b/WebCore/GNUmakefile.am
@@ -43,6 +43,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/platform/image-decoders/gif \
 	-I$(srcdir)/WebCore/platform/image-decoders/ico \
 	-I$(srcdir)/WebCore/platform/image-decoders/jpeg \
+	-I$(srcdir)/WebCore/platform/image-decoders/webp \
 	-I$(srcdir)/WebCore/platform/image-decoders/png \
 	-I$(srcdir)/WebCore/platform/mock \
 	-I$(srcdir)/WebCore/platform/network \
@@ -50,6 +51,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/platform/text \
 	-I$(srcdir)/WebCore/platform/text/transcoder \
 	-I$(srcdir)/WebCore/plugins \
+	-I$(srcdir)/WebCore/plugins/win \
 	-I$(srcdir)/WebCore/rendering \
 	-I$(srcdir)/WebCore/rendering/style \
 	-I$(srcdir)/WebCore/rendering/svg \
@@ -58,6 +60,7 @@ webcore_cppflags += \
 	-I$(srcdir)/WebCore/svg/animation \
 	-I$(srcdir)/WebCore/svg/graphics \
 	-I$(srcdir)/WebCore/svg/graphics/filters \
+	-I$(srcdir)/WebCore/svg/properties \
 	-I$(srcdir)/WebCore/websockets \
 	-I$(srcdir)/WebCore/wml \
 	-I$(srcdir)/WebCore/workers \
@@ -78,7 +81,9 @@ webcoregtk_cppflags += \
 	-I$(srcdir)/WebCore/platform/graphics/gstreamer \
 	-I$(srcdir)/WebCore/platform/graphics/gtk \
 	-I$(srcdir)/WebCore/platform/gtk \
-	-I$(srcdir)/WebCore/platform/network/soup
+	-I$(srcdir)/WebCore/platform/network/soup \
+	-I$(srcdir)/WebCore/platform/network/soup/cache \
+	-I$(srcdir)/WebCore/platform/network/soup/cache/webkit
 
 webcore_built_nosources += \
 	DerivedSources/WebCore/tokenizer.cpp
@@ -88,8 +93,10 @@ webcore_built_sources += \
 	DerivedSources/WebCore/CSSGrammar.h \
 	DerivedSources/WebCore/CSSPropertyNames.h \
 	DerivedSources/WebCore/CSSPropertyNames.cpp \
+	DerivedSources/WebCore/CSSPropertyNamesHash.h \
 	DerivedSources/WebCore/CSSValueKeywords.h \
 	DerivedSources/WebCore/CSSValueKeywords.cpp \
+	DerivedSources/WebCore/CSSValueKeywordsHash.h \
 	DerivedSources/WebCore/ColorData.cpp \
 	DerivedSources/WebCore/DocTypeStrings.cpp \
 	DerivedSources/WebCore/HashTools.h \
@@ -687,6 +694,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSDeviceMotionEventCustom.cpp \
 	WebCore/bindings/js/JSDeviceOrientationEventCustom.cpp \
 	WebCore/bindings/js/JSDirectoryEntryCustom.cpp \
+	WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp \
 	WebCore/bindings/js/JSDocumentCustom.cpp \
 	WebCore/bindings/js/JSDOMApplicationCacheCustom.cpp \
 	WebCore/bindings/js/JSDOMBinding.cpp \
@@ -709,6 +717,7 @@ webcore_sources += \
 	WebCore/bindings/js/JSDOMWrapper.h \
 	WebCore/bindings/js/JSElementCustom.cpp \
 	WebCore/bindings/js/JSEntryCustom.cpp \
+	WebCore/bindings/js/JSEntrySyncCustom.cpp \
 	WebCore/bindings/js/JSEventCustom.cpp \
 	WebCore/bindings/js/JSEventListener.cpp \
 	WebCore/bindings/js/JSEventListener.h \
@@ -834,7 +843,6 @@ webcore_sources += \
 	WebCore/bindings/js/ScriptSourceProvider.h \
 	WebCore/bindings/js/ScriptState.cpp \
 	WebCore/bindings/js/ScriptState.h \
-	WebCore/bindings/js/ScriptString.h \
 	WebCore/bindings/js/ScriptValue.cpp \
 	WebCore/bindings/js/ScriptValue.h \
 	WebCore/bindings/js/ScriptWrappable.h \
@@ -912,7 +920,6 @@ webcore_sources += \
 	WebCore/css/CSSFunctionValue.h \
 	WebCore/css/CSSGradientValue.cpp \
 	WebCore/css/CSSGradientValue.h \
-	WebCore/css/CSSHelper.cpp \
 	WebCore/css/CSSHelper.h \
 	WebCore/css/CSSImageGeneratorValue.cpp \
 	WebCore/css/CSSImageGeneratorValue.h \
@@ -1257,6 +1264,8 @@ webcore_sources += \
 	WebCore/dom/XMLDocumentParserScope.h \
 	WebCore/editing/AppendNodeCommand.cpp \
 	WebCore/editing/AppendNodeCommand.h \
+	WebCore/editing/ApplyBlockElementCommand.cpp \
+	WebCore/editing/ApplyBlockElementCommand.h \
 	WebCore/editing/ApplyStyleCommand.cpp \
 	WebCore/editing/ApplyStyleCommand.h \
 	WebCore/editing/BreakBlockquoteCommand.cpp \
@@ -1308,6 +1317,8 @@ webcore_sources += \
 	WebCore/editing/JoinTextNodesCommand.h \
 	WebCore/editing/markup.cpp \
 	WebCore/editing/markup.h \
+	WebCore/editing/MarkupAccumulator.cpp \
+	WebCore/editing/MarkupAccumulator.h \
 	WebCore/editing/MergeIdenticalElementsCommand.cpp \
 	WebCore/editing/MergeIdenticalElementsCommand.h \
 	WebCore/editing/ModifySelectionListLevel.cpp \
@@ -1365,23 +1376,38 @@ webcore_sources += \
 	WebCore/fileapi/BlobURL.h \
 	WebCore/fileapi/DirectoryEntry.cpp \
 	WebCore/fileapi/DirectoryEntry.h \
+	WebCore/fileapi/DirectoryEntrySync.cpp \
+	WebCore/fileapi/DirectoryEntrySync.h \
 	WebCore/fileapi/DirectoryReader.cpp \
 	WebCore/fileapi/DirectoryReader.h \
+	WebCore/fileapi/DirectoryReaderSync.cpp \
+	WebCore/fileapi/DirectoryReaderSync.h \
 	WebCore/fileapi/DOMFilePath.cpp \
 	WebCore/fileapi/DOMFilePath.h \
 	WebCore/fileapi/DOMFileSystem.cpp \
 	WebCore/fileapi/DOMFileSystem.h \
+	WebCore/fileapi/DOMFileSystemBase.cpp \
+	WebCore/fileapi/DOMFileSystemBase.h \
+	WebCore/fileapi/DOMFileSystemSync.cpp \
+	WebCore/fileapi/DOMFileSystemSync.h \
 	WebCore/fileapi/EntriesCallback.h \
+	WebCore/fileapi/Entry.cpp \
+	WebCore/fileapi/Entry.h \
 	WebCore/fileapi/EntryArray.cpp \
 	WebCore/fileapi/EntryArray.h \
+	WebCore/fileapi/EntryArraySync.cpp \
+	WebCore/fileapi/EntryArraySync.h \
+	WebCore/fileapi/EntryBase.h \
 	WebCore/fileapi/EntryCallback.h \
-	WebCore/fileapi/Entry.cpp \
-	WebCore/fileapi/Entry.h \
+	WebCore/fileapi/EntrySync.cpp \
+	WebCore/fileapi/EntrySync.h \
 	WebCore/fileapi/ErrorCallback.h \
 	WebCore/fileapi/FileCallback.h \
 	WebCore/fileapi/File.cpp \
 	WebCore/fileapi/FileEntry.cpp \
 	WebCore/fileapi/FileEntry.h \
+	WebCore/fileapi/FileEntrySync.cpp \
+	WebCore/fileapi/FileEntrySync.h \
 	WebCore/fileapi/FileError.h \
 	WebCore/fileapi/FileException.h \
 	WebCore/fileapi/File.h \
@@ -1426,6 +1452,8 @@ webcore_sources += \
 	WebCore/history/PageCache.h \
 	WebCore/html/AsyncImageResizer.cpp \
 	WebCore/html/AsyncImageResizer.h \
+	WebCore/html/BaseDateAndTimeInputType.cpp \
+	WebCore/html/BaseDateAndTimeInputType.h \
 	WebCore/html/BaseTextInputType.cpp \
 	WebCore/html/BaseTextInputType.h \
 	WebCore/html/ButtonInputType.cpp \
@@ -1783,9 +1811,12 @@ webcore_sources += \
 	WebCore/inspector/InspectorApplicationCacheAgent.h \
 	WebCore/inspector/InspectorBackend.cpp \
 	WebCore/inspector/InspectorBackend.h \
+	WebCore/inspector/InspectorClient.cpp \
 	WebCore/inspector/InspectorClient.h \
 	WebCore/inspector/InspectorController.cpp \
 	WebCore/inspector/InspectorController.h \
+	WebCore/inspector/InspectorCSSAgent.cpp \
+	WebCore/inspector/InspectorCSSAgent.h \
 	WebCore/inspector/InspectorCSSStore.cpp \
 	WebCore/inspector/InspectorCSSStore.h \
 	WebCore/inspector/InspectorDatabaseResource.cpp \
@@ -1801,12 +1832,20 @@ webcore_sources += \
 	WebCore/inspector/InspectorFrontendClientLocal.h \
 	WebCore/inspector/InspectorFrontendHost.cpp \
 	WebCore/inspector/InspectorFrontendHost.h \
+	WebCore/inspector/InspectorInstrumentation.cpp \
+	WebCore/inspector/InspectorInstrumentation.h \
 	WebCore/inspector/InspectorProfilerAgent.cpp \
 	WebCore/inspector/InspectorProfilerAgent.h \
 	WebCore/inspector/InspectorResource.cpp \
 	WebCore/inspector/InspectorResource.h \
+	WebCore/inspector/InspectorResourceAgent.cpp \
+	WebCore/inspector/InspectorResourceAgent.h \
+	WebCore/inspector/InspectorState.cpp \
+	WebCore/inspector/InspectorState.h \
 	WebCore/inspector/InspectorStorageAgent.cpp \
 	WebCore/inspector/InspectorStorageAgent.h \
+	WebCore/inspector/InspectorStyleSheet.cpp \
+	WebCore/inspector/InspectorStyleSheet.h \
 	WebCore/inspector/InspectorTimelineAgent.cpp \
 	WebCore/inspector/InspectorTimelineAgent.h \
 	WebCore/inspector/InspectorValues.cpp \
@@ -1893,7 +1932,6 @@ webcore_sources += \
 	WebCore/loader/icon/IconDatabase.cpp \
 	WebCore/loader/icon/IconDatabase.h \
 	WebCore/loader/icon/IconDatabaseNone.cpp \
-	WebCore/loader/icon/IconFetcher.h \
 	WebCore/loader/icon/IconLoader.cpp \
 	WebCore/loader/icon/IconLoader.h \
 	WebCore/loader/icon/IconRecord.cpp \
@@ -1920,8 +1958,8 @@ webcore_sources += \
 	WebCore/loader/PolicyChecker.h \
 	WebCore/loader/ProgressTracker.cpp \
 	WebCore/loader/ProgressTracker.h \
-	WebCore/loader/RedirectScheduler.cpp \
-	WebCore/loader/RedirectScheduler.h \
+	WebCore/loader/NavigationScheduler.cpp \
+	WebCore/loader/NavigationScheduler.h \
 	WebCore/loader/Request.cpp \
 	WebCore/loader/Request.h \
 	WebCore/loader/ResourceLoader.cpp \
@@ -2187,8 +2225,6 @@ webcore_sources += \
 	WebCore/platform/graphics/filters/FilterEffect.cpp \
 	WebCore/platform/graphics/filters/FilterEffect.h \
 	WebCore/platform/graphics/filters/Filter.h \
-	WebCore/platform/graphics/filters/ImageBufferFilter.cpp \
-	WebCore/platform/graphics/filters/ImageBufferFilter.h \
 	WebCore/platform/graphics/filters/LightSource.cpp \
 	WebCore/platform/graphics/filters/LightSource.h \
 	WebCore/platform/graphics/filters/PointLightSource.h \
@@ -2305,6 +2341,7 @@ webcore_sources += \
 	WebCore/platform/KURL.cpp \
 	WebCore/platform/KURL.h \
 	WebCore/platform/KURLHash.h \
+	WebCore/platform/Language.cpp \
 	WebCore/platform/Language.h \
 	WebCore/platform/LengthBox.h \
 	WebCore/platform/Length.cpp \
@@ -2346,6 +2383,8 @@ webcore_sources += \
 	WebCore/platform/network/HTTPParsers.cpp \
 	WebCore/platform/network/HTTPParsers.h \
 	WebCore/platform/network/NetworkingContext.h \
+	WebCore/platform/network/ProxyServer.cpp \
+	WebCore/platform/network/ProxyServer.h \
 	WebCore/platform/network/NetworkStateNotifier.cpp \
 	WebCore/platform/network/NetworkStateNotifier.h \
 	WebCore/platform/network/ProtectionSpace.cpp \
@@ -2361,6 +2400,7 @@ webcore_sources += \
 	WebCore/platform/network/ResourceRequestBase.h \
 	WebCore/platform/network/ResourceResponseBase.cpp \
 	WebCore/platform/network/ResourceResponseBase.h \
+	WebCore/platform/network/ResourceRawHeaders.h \
 	WebCore/platform/network/SocketStreamErrorBase.cpp \
 	WebCore/platform/network/SocketStreamErrorBase.h \
 	WebCore/platform/network/SocketStreamHandleBase.cpp \
@@ -2427,9 +2467,6 @@ webcore_sources += \
 	WebCore/platform/text/RegularExpression.h \
 	WebCore/platform/text/SegmentedString.cpp \
 	WebCore/platform/text/SegmentedString.h \
-	WebCore/platform/text/StringBuffer.h \
-	WebCore/platform/text/StringBuilder.cpp \
-	WebCore/platform/text/StringBuilder.h \
 	WebCore/platform/text/String.cpp \
 	WebCore/platform/text/SuffixTree.h \
 	WebCore/platform/text/TextBoundaries.cpp \
@@ -2604,8 +2641,6 @@ webcore_sources += \
 	WebCore/rendering/RenderOverflow.h \
 	WebCore/rendering/RenderPart.cpp \
 	WebCore/rendering/RenderPart.h \
-	WebCore/rendering/RenderPath.cpp \
-	WebCore/rendering/RenderPath.h \
 	WebCore/rendering/RenderProgress.cpp \
 	WebCore/rendering/RenderProgress.h \
 	WebCore/rendering/RenderReplaced.cpp \
@@ -2639,10 +2674,6 @@ webcore_sources += \
 	WebCore/rendering/RenderSVGHiddenContainer.h \
 	WebCore/rendering/RenderSVGImage.cpp \
 	WebCore/rendering/RenderSVGImage.h \
-	WebCore/rendering/RenderSVGInline.cpp \
-	WebCore/rendering/RenderSVGInline.h \
-	WebCore/rendering/RenderSVGInlineText.cpp \
-	WebCore/rendering/RenderSVGInlineText.h \
 	WebCore/rendering/RenderSVGModelObject.cpp \
 	WebCore/rendering/RenderSVGModelObject.h \
 	WebCore/rendering/RenderSVGResourceClipper.cpp \
@@ -2673,14 +2704,8 @@ webcore_sources += \
 	WebCore/rendering/RenderSVGRoot.h \
 	WebCore/rendering/RenderSVGShadowTreeRootContainer.cpp \
 	WebCore/rendering/RenderSVGShadowTreeRootContainer.h \
-	WebCore/rendering/RenderSVGText.cpp \
-	WebCore/rendering/RenderSVGText.h \
-	WebCore/rendering/RenderSVGTextPath.cpp \
-	WebCore/rendering/RenderSVGTextPath.h \
 	WebCore/rendering/RenderSVGTransformableContainer.cpp \
 	WebCore/rendering/RenderSVGTransformableContainer.h \
-	WebCore/rendering/RenderSVGTSpan.cpp \
-	WebCore/rendering/RenderSVGTSpan.h \
 	WebCore/rendering/RenderSVGViewportContainer.cpp \
 	WebCore/rendering/RenderSVGViewportContainer.h \
 	WebCore/rendering/RenderTableCell.cpp \
@@ -2780,16 +2805,8 @@ webcore_sources += \
 	WebCore/rendering/style/SVGRenderStyleDefs.cpp \
 	WebCore/rendering/style/SVGRenderStyleDefs.h \
 	WebCore/rendering/style/SVGRenderStyle.h \
-	WebCore/rendering/SVGCharacterData.cpp \
-	WebCore/rendering/SVGCharacterData.h \
-	WebCore/rendering/SVGCharacterLayoutInfo.cpp \
-	WebCore/rendering/SVGCharacterLayoutInfo.h \
 	WebCore/rendering/SVGImageBufferTools.cpp \
 	WebCore/rendering/SVGImageBufferTools.h \
-	WebCore/rendering/SVGInlineFlowBox.cpp \
-	WebCore/rendering/SVGInlineFlowBox.h \
-	WebCore/rendering/SVGInlineTextBox.cpp \
-	WebCore/rendering/SVGInlineTextBox.h \
 	WebCore/rendering/SVGMarkerData.h \
 	WebCore/rendering/SVGMarkerLayoutInfo.cpp \
 	WebCore/rendering/SVGMarkerLayoutInfo.h \
@@ -2803,20 +2820,45 @@ webcore_sources += \
 	WebCore/rendering/SVGResourcesCycleSolver.cpp \
 	WebCore/rendering/SVGResourcesCycleSolver.h \
 	WebCore/rendering/SVGResources.h \
-	WebCore/rendering/SVGRootInlineBox.cpp \
-	WebCore/rendering/SVGRootInlineBox.h \
 	WebCore/rendering/SVGShadowTreeElements.cpp \
 	WebCore/rendering/SVGShadowTreeElements.h \
+	WebCore/rendering/svg/RenderSVGInline.cpp \
+	WebCore/rendering/svg/RenderSVGInline.h \
+	WebCore/rendering/svg/RenderSVGInlineText.cpp \
+	WebCore/rendering/svg/RenderSVGInlineText.h \
+	WebCore/rendering/svg/RenderSVGPath.cpp \
+	WebCore/rendering/svg/RenderSVGPath.h \
+	WebCore/rendering/svg/RenderSVGTSpan.cpp \
+	WebCore/rendering/svg/RenderSVGTSpan.h \
+	WebCore/rendering/svg/RenderSVGText.cpp \
+	WebCore/rendering/svg/RenderSVGText.h \
+	WebCore/rendering/svg/RenderSVGTextPath.cpp \
+	WebCore/rendering/svg/RenderSVGTextPath.h \
+	WebCore/rendering/svg/SVGInlineFlowBox.cpp \
+	WebCore/rendering/svg/SVGInlineFlowBox.h \
+	WebCore/rendering/svg/SVGInlineTextBox.cpp \
+	WebCore/rendering/svg/SVGInlineTextBox.h \
+	WebCore/rendering/svg/SVGRootInlineBox.cpp \
+	WebCore/rendering/svg/SVGRootInlineBox.h \
+	WebCore/rendering/svg/SVGTextChunk.cpp \
+	WebCore/rendering/svg/SVGTextChunk.h \
+	WebCore/rendering/svg/SVGTextChunkBuilder.cpp \
+	WebCore/rendering/svg/SVGTextChunkBuilder.h \
+	WebCore/rendering/svg/SVGTextFragment.h \
 	WebCore/rendering/svg/SVGTextLayoutAttributes.cpp \
 	WebCore/rendering/svg/SVGTextLayoutAttributes.h \
-	WebCore/rendering/svg/SVGTextLayoutBuilder.cpp \
-	WebCore/rendering/svg/SVGTextLayoutBuilder.h \
-	WebCore/rendering/SVGTextChunkLayoutInfo.cpp \
-	WebCore/rendering/SVGTextChunkLayoutInfo.h \
-	WebCore/rendering/SVGTextLayoutUtilities.cpp \
-	WebCore/rendering/SVGTextLayoutUtilities.h \
-	WebCore/rendering/SVGTextQuery.cpp \
-	WebCore/rendering/SVGTextQuery.h \
+	WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp \
+	WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h \
+	WebCore/rendering/svg/SVGTextLayoutEngine.cpp \
+	WebCore/rendering/svg/SVGTextLayoutEngine.h \
+	WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp \
+	WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h \
+	WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp \
+	WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h \
+	WebCore/rendering/svg/SVGTextMetrics.cpp \
+	WebCore/rendering/svg/SVGTextMetrics.h \
+	WebCore/rendering/svg/SVGTextQuery.cpp \
+	WebCore/rendering/svg/SVGTextQuery.h \
 	WebCore/rendering/TableLayout.h \
 	WebCore/rendering/TextControlInnerElements.cpp \
 	WebCore/rendering/TextControlInnerElements.h \
@@ -2950,6 +2992,9 @@ webcore_sources += \
 	WebCore/svg/animation/SVGSMILElement.h \
 	WebCore/svg/ColorDistance.cpp \
 	WebCore/svg/ColorDistance.h \
+	WebCore/svg/DeprecatedSVGAnimatedProperty.h \
+	WebCore/svg/DeprecatedSVGAnimatedPropertyTraits.h \
+	WebCore/svg/DeprecatedSVGAnimatedTemplate.h \
 	WebCore/svg/ElementTimeControl.h \
 	WebCore/svg/GradientAttributes.h \
 	WebCore/svg/graphics/filters/SVGFEImage.cpp \
@@ -2962,6 +3007,7 @@ webcore_sources += \
 	WebCore/svg/graphics/SVGImage.h \
 	WebCore/svg/LinearGradientAttributes.h \
 	WebCore/svg/PatternAttributes.h \
+	WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h \
 	WebCore/svg/RadialGradientAttributes.h \
 	WebCore/svg/SVGAElement.cpp \
 	WebCore/svg/SVGAElement.h \
@@ -2975,10 +3021,6 @@ webcore_sources += \
 	WebCore/svg/SVGAnimatedPathData.h \
 	WebCore/svg/SVGAnimatedPoints.cpp \
 	WebCore/svg/SVGAnimatedPoints.h \
-	WebCore/svg/SVGAnimatedProperty.h \
-	WebCore/svg/SVGAnimatedPropertySynchronizer.h \
-	WebCore/svg/SVGAnimatedPropertyTraits.h \
-	WebCore/svg/SVGAnimatedTemplate.h \
 	WebCore/svg/SVGAnimateElement.cpp \
 	WebCore/svg/SVGAnimateElement.h \
 	WebCore/svg/SVGAnimateMotionElement.cpp \
@@ -3421,6 +3463,7 @@ webcoregtk_sources += \
 	WebCore/platform/graphics/cairo/CairoUtilities.cpp \
 	WebCore/platform/graphics/cairo/CairoUtilities.h \
 	WebCore/platform/graphics/cairo/ContextShadowCairo.cpp \
+	WebCore/platform/graphics/cairo/FloatRectCairo.cpp \
 	WebCore/platform/graphics/cairo/FontCairo.cpp \
 	WebCore/platform/graphics/cairo/FontCustomPlatformData.h \
 	WebCore/platform/graphics/cairo/FontPlatformData.h \
@@ -3484,6 +3527,7 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/GRefPtrGtk.cpp \
 	WebCore/platform/gtk/GRefPtrGtk.h \
 	WebCore/platform/gtk/gtk2drawing.c \
+	WebCore/platform/gtk/gtk3drawing.c \
 	WebCore/platform/gtk/gtkdrawing.h \
 	WebCore/platform/gtk/GtkPluginWidget.cpp \
 	WebCore/platform/gtk/GtkPluginWidget.h \
@@ -3491,7 +3535,7 @@ webcoregtk_sources += \
 	WebCore/platform/gtk/GtkVersioning.h \
 	WebCore/platform/gtk/KeyEventGtk.cpp \
 	WebCore/platform/gtk/KURLGtk.cpp \
-	WebCore/platform/gtk/Language.cpp \
+	WebCore/platform/gtk/LanguageGtk.cpp \
 	WebCore/platform/gtk/LocalizedStringsGtk.cpp \
 	WebCore/platform/gtk/LoggingGtk.cpp \
 	WebCore/platform/gtk/MainFrameScrollbarGtk.cpp \
@@ -3532,6 +3576,8 @@ webcoregtk_sources += \
 	WebCore/platform/image-decoders/ImageDecoder.h \
 	WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.cpp \
 	WebCore/platform/image-decoders/jpeg/JPEGImageDecoder.h \
+	WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp \
+	WebCore/platform/image-decoders/webp/WEBPImageDecoder.h \
 	WebCore/platform/image-decoders/png/PNGImageDecoder.cpp \
 	WebCore/platform/image-decoders/png/PNGImageDecoder.h \
 	WebCore/platform/network/soup/AuthenticationChallenge.h \
@@ -3539,6 +3585,7 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/CookieJarSoup.h \
 	WebCore/platform/network/soup/GOwnPtrSoup.cpp \
 	WebCore/platform/network/soup/GOwnPtrSoup.h \
+	WebCore/platform/network/soup/ProxyServerSoup.cpp \
 	WebCore/platform/network/soup/ResourceError.h \
 	WebCore/platform/network/soup/ResourceHandleSoup.cpp \
 	WebCore/platform/network/soup/ResourceRequest.h \
@@ -3548,6 +3595,23 @@ webcoregtk_sources += \
 	WebCore/platform/network/soup/SocketStreamError.h \
 	WebCore/platform/network/soup/SocketStreamHandle.h \
 	WebCore/platform/network/soup/SocketStreamHandleSoup.cpp \
+	WebCore/platform/network/soup/cache/soup-directory-input-stream.c \
+	WebCore/platform/network/soup/cache/soup-directory-input-stream.h \
+	WebCore/platform/network/soup/cache/soup-http-input-stream.c \
+	WebCore/platform/network/soup/cache/soup-http-input-stream.h \
+	WebCore/platform/network/soup/cache/soup-request-data.c \
+	WebCore/platform/network/soup/cache/soup-request-data.h \
+	WebCore/platform/network/soup/cache/soup-request-file.c \
+	WebCore/platform/network/soup/cache/soup-request-file.h \
+	WebCore/platform/network/soup/cache/soup-request-http.c \
+	WebCore/platform/network/soup/cache/soup-request-http.h \
+	WebCore/platform/network/soup/cache/soup-request.c \
+	WebCore/platform/network/soup/cache/soup-request.h \
+	WebCore/platform/network/soup/cache/soup-requester.c \
+	WebCore/platform/network/soup/cache/soup-requester.h \
+	WebCore/platform/network/soup/cache/webkit/soup-cache.c \
+	WebCore/platform/network/soup/cache/webkit/soup-cache.h \
+	WebCore/platform/network/soup/cache/webkit/soup-cache-private.h \
 	WebCore/plugins/gtk/PluginDataGtk.cpp \
 	WebCore/plugins/gtk/PluginPackageGtk.cpp \
 	WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -3897,14 +3961,6 @@ webcore_cppflags += -DENABLE_XHTMLMP=1
 endif # END ENABLE_XHTMLMP
 
 # ----
-# Sandboxed IFrame Support
-# ----
-if ENABLE_SANDBOX
-HTML_FEATURES += ENABLE_SANDBOX=1
-webcore_cppflags += -DENABLE_SANDBOX=1
-endif # END ENABLE_SANDBOX
-
-# ----
 # Ruby Support
 # ----
 if ENABLE_RUBY
@@ -4397,20 +4453,22 @@ FEATURE_DEFINES += ENABLE_BLOB=1
 webcore_cppflags += -DENABLE_BLOB=1
 endif  # END ENABLE_BLOB
 
-DerivedSources/WebCore/CSSPropertyNames.cpp:
+DerivedSources/WebCore/CSSPropertyNamesHash.h: DerivedSources/WebCore/CSSPropertyNames.cpp
+DerivedSources/WebCore/CSSPropertyNames.cpp: DerivedSources/WebCore/CSSPropertyNames.h
 DerivedSources/WebCore/CSSPropertyNames.h: $(WEBCORE_CSS_PROPERTY_NAMES) $(WebCore)/css/makeprop.pl
 	if sort $(WEBCORE_CSS_PROPERTY_NAMES) | uniq -d | grep -E '^[^#]'; then echo 'Duplicate value!'; exit 1; fi
 	cat $(WEBCORE_CSS_PROPERTY_NAMES) > CSSPropertyNames.in
 	$(PERL) "$(WebCore)/css/makeprop.pl"
-	mv CSSPropertyNames.* $(GENSOURCES_WEBCORE)
+	mv CSSPropertyNames* $(GENSOURCES_WEBCORE)
 
 # Lower case all the values, as CSS values are case-insensitive
-DerivedSources/WebCore/CSSValueKeywords.cpp:
+DerivedSources/WebCore/CSSValueKeywordsHash.h: DerivedSources/WebCore/CSSValueKeywords.cpp
+DerivedSources/WebCore/CSSValueKeywords.cpp: DerivedSources/WebCore/CSSValueKeywords.h
 DerivedSources/WebCore/CSSValueKeywords.h: $(WEBCORE_CSS_VALUE_KEYWORDS) $(WebCore)/css/makevalues.pl
 	$(PERL) -ne 'print lc' $(WEBCORE_CSS_VALUE_KEYWORDS) > CSSValueKeywords.in
 	if sort CSSValueKeywords.in | uniq -d | grep -E '^[^#]'; then echo 'Duplicate value!'; exit 1; fi
 	$(PERL) "$(WebCore)/css/makevalues.pl"
-	mv CSSValueKeywords.* $(GENSOURCES_WEBCORE)
+	mv CSSValueKeywords* $(GENSOURCES_WEBCORE)
 
 # DOCTYPE strings
 DerivedSources/WebCore/DocTypeStrings.cpp DerivedSources/WebCore/HashTools.h: $(WebCore)/html/DocTypeStrings.gperf $(WebCore)/make-hash-tools.pl
diff --git a/WebCore/WebCore.exp.in b/WebCore/WebCore.exp.in
index 5d789dc..6948d67 100644
--- a/WebCore/WebCore.exp.in
+++ b/WebCore/WebCore.exp.in
@@ -137,6 +137,7 @@ __ZN3JSC8Bindings8Instance16newRuntimeObjectEPNS_9ExecStateE
 __ZN3WTF10StringImplcvP8NSStringEv
 __ZN3WTF6StringC1EP8NSString
 __ZN3WTF6StringC1EPK10__CFString
+__ZN7WebCore10JSDocument6s_infoE
 __ZN7WebCore10MouseEventC1ERKN3WTF12AtomicStringEbbNS1_10PassRefPtrINS_9DOMWindowEEEiiiiibbbbtNS5_INS_11EventTargetEEENS5_INS_9ClipboardEEEb
 __ZN7WebCore10ScrollView20setCanHaveScrollbarsEb
 __ZN7WebCore10ScrollView24windowResizerRectChangedEv
@@ -199,8 +200,6 @@ __ZN7WebCore11HistoryItemC1ERKN3WTF6StringES4_d
 __ZN7WebCore11HistoryItemC1ERKNS_4KURLERKN3WTF6StringES7_S7_
 __ZN7WebCore11HistoryItemC1Ev
 __ZN7WebCore11HistoryItemD1Ev
-__ZN7WebCore11IconFetcher6cancelEv
-__ZN7WebCore11IconFetcher6createEPNS_5FrameEPNS_17IconFetcherClientE
 __ZN7WebCore11RenderLayer19scrollRectToVisibleERKNS_7IntRectEbRKNS_15ScrollAlignmentES6_
 __ZN7WebCore11globalPointERK8_NSPointP8NSWindow
 __ZN7WebCore11toUserSpaceERK7_NSRectP8NSWindow
@@ -270,6 +269,7 @@ __ZN7WebCore12TextIterator11rangeLengthEPKNS_5RangeEb
 __ZN7WebCore12TextIterator26rangeFromLocationAndLengthEPNS_7ElementEiib
 __ZN7WebCore12TextIterator7advanceEv
 __ZN7WebCore12TextIteratorC1EPKNS_5RangeENS_20TextIteratorBehaviorE
+__ZN7WebCore12TextIteratorD1Ev
 __ZN7WebCore12WorkerThread17workerThreadCountEv
 __ZN7WebCore12applyCommandEN3WTF10PassRefPtrINS_11EditCommandEEE
 __ZN7WebCore12cacheStorageEv
@@ -280,6 +280,8 @@ __ZN7WebCore12iconDatabaseEv
 __ZN7WebCore13AXObjectCache11getOrCreateEPNS_12RenderObjectE
 __ZN7WebCore13AXObjectCache21gAccessibilityEnabledE
 __ZN7WebCore13AXObjectCache42gAccessibilityEnhancedUserInterfaceEnabledE
+__ZN7WebCore13HTTPHeaderMapC1Ev
+__ZN7WebCore13HTTPHeaderMapD1Ev
 __ZN7WebCore13HitTestResultC1ERKS0_
 __ZN7WebCore13HitTestResultD1Ev
 __ZN7WebCore13IdentifierRep3getEPKc
@@ -316,6 +318,7 @@ __ZN7WebCore14SVGSMILElement13isSMILElementEPNS_4NodeE
 __ZN7WebCore14SchemeRegistry24registerURLSchemeAsLocalERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry25registerURLSchemeAsSecureERKN3WTF6StringE
 __ZN7WebCore14SchemeRegistry32registerURLSchemeAsEmptyDocumentERKN3WTF6StringE
+__ZN7WebCore14SecurityOrigin14threadsafeCopyEv
 __ZN7WebCore14SecurityOrigin16createFromStringERKN3WTF6StringE
 __ZN7WebCore14SecurityOrigin18setLocalLoadPolicyENS0_15LocalLoadPolicyE
 __ZN7WebCore14SecurityOrigin18shouldHideReferrerERKNS_4KURLERKN3WTF6StringE
@@ -344,9 +347,24 @@ __ZN7WebCore15FocusController15setFocusedFrameEN3WTF10PassRefPtrINS_5FrameEEE
 __ZN7WebCore15FocusController15setInitialFocusENS_14FocusDirectionEPNS_13KeyboardEventE
 __ZN7WebCore15FocusController9setActiveEb
 __ZN7WebCore15GraphicsContext12setFillColorERKNS_5ColorENS_10ColorSpaceE
+__ZN7WebCore15GraphicsContext20endTransparencyLayerEv
+__ZN7WebCore15GraphicsContext21setCompositeOperationENS_17CompositeOperatorE
+__ZN7WebCore15GraphicsContext22beginTransparencyLayerEf
 __ZN7WebCore15GraphicsContext4clipERKNS_9FloatRectE
+__ZN7WebCore15GraphicsContext5scaleERKNS_9FloatSizeE
+__ZN7WebCore15GraphicsContext15setFillGradientEN3WTF10PassRefPtrINS_8GradientEEE
+__ZN7WebCore4PathD1Ev
+__ZN7WebCore8Gradient12addColorStopEfRKNS_5ColorE
+__ZN7WebCore4PathC1Ev
+__ZN7WebCore15GraphicsContext4clipERKNS_4PathE
+__ZN7WebCore15GraphicsContext8fillPathEv
+__ZN7WebCore4Path14addRoundedRectERKNS_9FloatRectERKNS_9FloatSizeE
+__ZN7WebCore15GraphicsContext7addPathERKNS_4PathE
 __ZN7WebCore15GraphicsContext4saveEv
 __ZN7WebCore15GraphicsContext7restoreEv
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectE
+__ZN7WebCore15GraphicsContext8fillRectERKNS_9FloatRectERKNS_5ColorENS_10ColorSpaceE
+__ZN7WebCore15GraphicsContext9setShadowERKNS_9FloatSizeEfRKNS_5ColorENS_10ColorSpaceE
 __ZN7WebCore15GraphicsContext9translateEff
 __ZN7WebCore15GraphicsContextC1EP9CGContext
 __ZN7WebCore15GraphicsContextD1Ev
@@ -358,6 +376,7 @@ __ZN7WebCore15StringTruncator14centerTruncateERKN3WTF6StringEfRKNS_4FontEb
 __ZN7WebCore15StringTruncator5widthERKN3WTF6StringERKNS_4FontEb
 __ZN7WebCore15VisiblePositionC1EPNS_4NodeEiNS_9EAffinityE
 __ZN7WebCore15VisiblePositionC1ERKNS_8PositionENS_9EAffinityE
+__ZN7WebCore15defaultLanguageEv
 __ZN7WebCore15reportExceptionEPN3JSC9ExecStateENS0_7JSValueE
 __ZN7WebCore15visitedLinkHashEPKtj
 __ZN7WebCore16AbstractDatabase14setIsAvailableEb
@@ -367,6 +386,7 @@ __ZN7WebCore16DeviceMotionData6createEN3WTF10PassRefPtrINS0_12AccelerationEEES4_
 __ZN7WebCore16FontFallbackList15releaseFontDataEv
 __ZN7WebCore16FontPlatformDataC1EP6NSFontbb
 __ZN7WebCore16FontPlatformDataD1Ev
+__ZN7WebCore16HTMLInputElement13setAutofilledEb
 __ZN7WebCore16LegacyWebArchive19createFromSelectionEPNS_5FrameE
 __ZN7WebCore16LegacyWebArchive21rawDataRepresentationEv
 __ZN7WebCore16LegacyWebArchive6createEN3WTF10PassRefPtrINS_15ArchiveResourceEEERNS1_6VectorIS4_Lm0EEERNS5_INS2_IS0_EELm0EEE
@@ -400,6 +420,7 @@ __ZN7WebCore16colorFromNSColorEP7NSColor
 __ZN7WebCore16createFullMarkupEPKNS_4NodeE
 __ZN7WebCore16createFullMarkupEPKNS_5RangeE
 __ZN7WebCore16enclosingIntRectERK7_NSRect
+__ZN7WebCore16enclosingIntRectERKNS_9FloatRectE
 __ZN7WebCore16isEndOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore16jsStringSlowCaseEPN3JSC9ExecStateERNS0_9WeakGCMapIPN3WTF10StringImplEPNS0_8JSStringEEES6_
 __ZN7WebCore17CredentialStorage3getERKNS_15ProtectionSpaceE
@@ -410,9 +431,9 @@ __ZN7WebCore17HistoryController26saveDocumentAndScrollStateEv
 __ZN7WebCore17nameForCursorTypeENS_6Cursor4TypeE
 __ZN7WebCore17openTemporaryFileEPKcRi
 __ZN7WebCore18SearchPopupMenuMacC1EPNS_15PopupMenuClientE
-__ZN7WebCore18deprecatedParseURLERKN3WTF6StringE
 __ZN7WebCore18isStartOfParagraphERKNS_15VisiblePositionE
 __ZN7WebCore18pluginScriptObjectEPN3JSC9ExecStateEPNS_13JSHTMLElementE
+__ZN7WebCore18proxyServersForURLERKNS_4KURLEPKNS_17NetworkingContextE
 __ZN7WebCore19AnimationController16resumeAnimationsEPNS_8DocumentE
 __ZN7WebCore19AnimationController17suspendAnimationsEPNS_8DocumentE
 __ZN7WebCore19AnimationController20pauseAnimationAtTimeEPNS_12RenderObjectERKN3WTF6StringEd
@@ -464,6 +485,7 @@ __ZN7WebCore22counterValueForElementEPNS_7ElementE
 __ZN7WebCore22createFragmentFromTextEPNS_5RangeERKN3WTF6StringE
 __ZN7WebCore22externalRepresentationEPNS_5FrameEj
 __ZN7WebCore23ReplaceSelectionCommandC1EPNS_8DocumentEN3WTF10PassRefPtrINS_16DocumentFragmentEEEbbbbbNS_10EditActionE
+__ZN7WebCore23overrideDefaultLanguageERKN3WTF6StringE
 __ZN7WebCore23createFragmentFromNodesEPNS_8DocumentERKN3WTF6VectorIPNS_4NodeELm0EEE
 __ZN7WebCore24BinaryPropertyListWriter17writePropertyListEv
 __ZN7WebCore24DocumentMarkerController13removeMarkersENS_14DocumentMarker10MarkerTypeE
@@ -484,6 +506,7 @@ __ZN7WebCore25PluginMainThreadScheduler12scheduleCallEP4_NPPPFvPvES3_
 __ZN7WebCore25PluginMainThreadScheduler14registerPluginEP4_NPP
 __ZN7WebCore25PluginMainThreadScheduler16unregisterPluginEP4_NPP
 __ZN7WebCore25PluginMainThreadScheduler9schedulerEv
+__ZN7WebCore25addLanguageChangeObserverEPvPFvS0_E
 __ZN7WebCore25contextMenuItemTagOutlineEv
 __ZN7WebCore26CSSMutableStyleDeclarationC1Ev
 __ZN7WebCore26NetscapePlugInStreamLoader6createEPNS_5FrameEPNS_32NetscapePlugInStreamLoaderClientE
@@ -504,6 +527,7 @@ __ZN7WebCore28contextMenuItemTagCapitalizeEv
 __ZN7WebCore28contextMenuItemTagShowColorsEv
 __ZN7WebCore28contextMenuItemTagSmartLinksEv
 __ZN7WebCore28contextMenuItemTagSpeechMenuEv
+__ZN7WebCore28removeLanguageChangeObserverEPv
 __ZN7WebCore29contextMenuItemTagLeftToRightEv
 __ZN7WebCore29contextMenuItemTagRightToLeftEv
 __ZN7WebCore29contextMenuItemTagSmartDashesEv
@@ -526,6 +550,7 @@ __ZN7WebCore32contextMenuItemTagSmartCopyPasteEv
 __ZN7WebCore32plainTextToMallocAllocatedBufferEPKNS_5RangeERjbNS_20TextIteratorBehaviorE
 __ZN7WebCore33contextMenuItemTagTextReplacementEv
 __ZN7WebCore33setDefaultThreadViolationBehaviorENS_23ThreadViolationBehaviorENS_20ThreadViolationRoundE
+__ZN7WebCore33stripLeadingAndTrailingHTMLSpacesERKN3WTF6StringE
 __ZN7WebCore34contextMenuItemTagDefaultDirectionEv
 __ZN7WebCore35contextMenuItemTagShowSpellingPanelEb
 __ZN7WebCore35contextMenuItemTagShowSubstitutionsEb
@@ -555,6 +580,7 @@ __ZN7WebCore4Node10renderRectEPb
 __ZN7WebCore4Node17stopIgnoringLeaksEv
 __ZN7WebCore4Node18startIgnoringLeaksEv
 __ZN7WebCore4Node19setNeedsStyleRecalcENS_15StyleChangeTypeE
+__ZN7WebCore4Page10findStringERKN3WTF6StringENS1_19TextCaseSensitivityENS_13FindDirectionEb
 __ZN7WebCore4Page12setGroupNameERKN3WTF6StringE
 __ZN7WebCore4Page13didStopPluginEPNS_14HaltablePluginE
 __ZN7WebCore4Page14didStartPluginEPNS_14HaltablePluginE
@@ -566,6 +592,8 @@ __ZN7WebCore4Page16setDefersLoadingEb
 __ZN7WebCore4Page17willMoveOffscreenEv
 __ZN7WebCore4Page18removeSchedulePairEN3WTF10PassRefPtrINS_12SchedulePairEEE
 __ZN7WebCore4Page19visitedStateChangedEPNS_9PageGroupEy
+__ZN7WebCore4Page20unmarkAllTextMatchesEv
+__ZN7WebCore4Page21markAllMatchesForTextERKN3WTF6StringENS1_19TextCaseSensitivityEbj
 __ZN7WebCore4Page22allVisitedStateChangedEPNS_9PageGroupE
 __ZN7WebCore4Page23clearUndoRedoOperationsEv
 __ZN7WebCore4Page27setJavaScriptURLsAreAllowedEb
@@ -665,6 +693,7 @@ __ZN7WebCore6Widget9setParentEPNS_10ScrollViewE
 __ZN7WebCore6WidgetC1EP6NSView
 __ZN7WebCore6WidgetC2EP6NSView
 __ZN7WebCore6WidgetD2Ev
+__ZN7WebCore6toNodeEN3JSC7JSValueE
 __ZN7WebCore7Console21shouldPrintExceptionsEv
 __ZN7WebCore7Console24setShouldPrintExceptionsEb
 __ZN7WebCore7IntRect5uniteERKS0_
@@ -674,6 +703,7 @@ __ZN7WebCore7IntSizeC1ERK7_NSSize
 __ZN7WebCore7cookiesEPKNS_8DocumentERKNS_4KURLE
 __ZN7WebCore7nsColorERKNS_5ColorE
 __ZN7WebCore8Document11createRangeEv
+__ZN7WebCore8Document12updateLayoutEv
 __ZN7WebCore8Document13svgExtensionsEv
 __ZN7WebCore8Document14setFocusedNodeEN3WTF10PassRefPtrINS_4NodeEEE
 __ZN7WebCore8Document16isPageBoxVisibleEi
@@ -689,10 +719,9 @@ __ZN7WebCore8Document26pageSizeAndMarginsInPixelsEiRNS_7IntSizeERiS3_S3_S3_
 __ZN7WebCore8Document27removeMediaCanStartListenerEPNS_21MediaCanStartListenerE
 __ZN7WebCore8Document36updateLayoutIgnorePendingStylesheetsEv
 __ZN7WebCore8Document4headEv
-__ZNK7WebCore8Document13nodesFromRectEiijjjjb
-__ZN7WebCore10JSDocument6s_infoE
 __ZN7WebCore8FormData6createEPKvm
 __ZN7WebCore8FormDataD1Ev
+__ZN7WebCore8GradientC1ERKNS_10FloatPointES3_
 __ZN7WebCore8IntPointC1ERK8_NSPoint
 __ZN7WebCore8PositionC1EN3WTF10PassRefPtrINS_4NodeEEEi
 __ZN7WebCore8Settings14setJavaEnabledEb
@@ -738,6 +767,7 @@ __ZN7WebCore8Settings26setNeedsSiteSpecificQuirksEb
 __ZN7WebCore8Settings27setFTPDirectoryTemplatePathERKN3WTF6StringE
 __ZN7WebCore8Settings27setLoadsImagesAutomaticallyEb
 __ZN7WebCore8Settings27setLocalStorageDatabasePathERKN3WTF6StringE
+__ZN7WebCore8Settings27setSpatialNavigationEnabledEb
 __ZN7WebCore8Settings28setForceFTPDirectoryListingsEb
 __ZN7WebCore8Settings29setAccelerated2dCanvasEnabledEb
 __ZN7WebCore8Settings29setAuthorAndUserStylesEnabledEb
@@ -759,6 +789,7 @@ __ZN7WebCore8Settings40setTextDirectionSubmenuInclusionBehaviorENS_37TextDirecti
 __ZN7WebCore8Settings41setNeedsKeyboardEventDisambiguationQuirksEb
 __ZN7WebCore8blankURLEv
 __ZN7WebCore8makeRGBAEiiii
+__ZN7WebCore8toStringERKN3WTF6VectorINS_11ProxyServerELm0EEE
 __ZN7WebCore9DOMWindow30dispatchAllPendingUnloadEventsEv
 __ZN7WebCore9DOMWindow36dispatchAllPendingBeforeUnloadEventsEv
 __ZN7WebCore9FloatRectC1ERK7_NSRect
@@ -852,7 +883,6 @@ __ZN7WebCore9fontCacheEv
 __ZN7WebCore9makeRangeERKNS_15VisiblePositionES2_
 __ZN7WebCore9pageCacheEv
 __ZN7WebCore9toElementEN3JSC7JSValueE
-__ZN7WebCoreeqERKNS_19ResourceRequestBaseES2_
 __ZNK3JSC8Bindings10RootObject12globalObjectEv
 __ZNK3WTF6String14createCFStringEv
 __ZNK7WebCore10FloatPointcv8_NSPointEv
@@ -872,6 +902,7 @@ __ZNK7WebCore11FrameLoader14cancelledErrorERKNS_15ResourceRequestE
 __ZNK7WebCore11FrameLoader14frameHasLoadedEv
 __ZNK7WebCore11FrameLoader16outgoingReferrerEv
 __ZNK7WebCore11FrameLoader20activeDocumentLoaderEv
+__ZNK7WebCore11FrameLoader17networkingContextEv
 __ZNK7WebCore11FrameLoader27numPendingOrLoadingRequestsEb
 __ZNK7WebCore11FrameLoader8loadTypeEv
 __ZNK7WebCore11HistoryItem10visitCountEv
@@ -911,6 +942,7 @@ __ZNK7WebCore12TextIterator5rangeEv
 __ZNK7WebCore13ContainerNode14childNodeCountEv
 __ZNK7WebCore13ContainerNode9childNodeEj
 __ZNK7WebCore13HTTPHeaderMap3getEPKc
+__ZNK7WebCore13HTTPHeaderMap3getERKN3WTF12AtomicStringE
 __ZNK7WebCore13HitTestResult10isLiveLinkEv
 __ZNK7WebCore13HitTestResult10isSelectedEv
 __ZNK7WebCore13HitTestResult11targetFrameEv
@@ -924,7 +956,6 @@ __ZNK7WebCore13HitTestResult18titleDisplayStringEv
 __ZNK7WebCore13HitTestResult5imageEv
 __ZNK7WebCore13HitTestResult5titleERNS_13TextDirectionE
 __ZNK7WebCore13HitTestResult9imageRectEv
-__ZN7WebCore13HitTestResult13rectFromPointERKNS_8IntPointEjjjj
 __ZNK7WebCore13ResourceErrorcvP7NSErrorEv
 __ZNK7WebCore14DocumentLoader10requestURLEv
 __ZNK7WebCore14DocumentLoader11frameLoaderEv
@@ -974,6 +1005,7 @@ __ZNK7WebCore19SelectionController17isInPasswordFieldEv
 __ZNK7WebCore19SelectionController18isFocusedAndActiveEv
 __ZNK7WebCore19SelectionController31getClippedVisibleTextRectanglesERN3WTF6VectorINS_9FloatRectELm0EEE
 __ZNK7WebCore19SelectionController6boundsEb
+__ZNK7WebCore20HTMLTableCellElement9cellAboveEv
 __ZNK7WebCore20ResourceResponseBase14httpStatusCodeEv
 __ZNK7WebCore20ResourceResponseBase14httpStatusTextEv
 __ZNK7WebCore20ResourceResponseBase15httpHeaderFieldEPKc
@@ -1050,6 +1082,7 @@ __ZNK7WebCore6Widget23convertToContainingViewERKNS_8IntPointE
 __ZNK7WebCore6Widget25convertFromContainingViewERKNS_7IntRectE
 __ZNK7WebCore6Widget25convertFromContainingViewERKNS_8IntPointE
 __ZNK7WebCore6Widget25convertToContainingWindowERKNS_7IntRectE
+__ZNK7WebCore6Widget25convertToContainingWindowERKNS_8IntPointE
 __ZNK7WebCore6Widget9frameRectEv
 __ZNK7WebCore7Element12getAttributeERKNS_13QualifiedNameE
 __ZNK7WebCore7Element9innerTextEv
@@ -1058,6 +1091,7 @@ __ZNK7WebCore7IntRectcv7_NSRectEv
 __ZNK7WebCore7IntSizecv7_NSSizeEv
 __ZNK7WebCore8Document11completeURLERKN3WTF6StringE
 __ZNK7WebCore8Document13axObjectCacheEv
+__ZNK7WebCore8Document13nodesFromRectEiijjjjb
 __ZNK7WebCore8Document14getElementByIdERKN3WTF12AtomicStringE
 __ZNK7WebCore8Document16dashboardRegionsEv
 __ZNK7WebCore8Document20cacheDocumentElementEv
@@ -1096,6 +1130,7 @@ _stringIsCaseInsensitiveEqualToString
 _suggestedFilenameWithMIMEType
 _wkAdvanceDefaultButtonPulseAnimation
 _wkCGContextGetShouldSmoothFonts
+_wkCopyCFLocalizationPreferredName
 _wkCopyCONNECTProxyResponse
 _wkCopyNSURLResponseStatusLine
 _wkCreateCustomCFReadStream
@@ -1198,7 +1233,7 @@ __ZN7WebCore22GeolocationServiceMock8setErrorEN3WTF10PassRefPtrINS_13PositionErr
 #endif
 
 #if ENABLE(INSPECTOR)
-__ZN7WebCore19InspectorController10setSettingERKN3WTF6StringES4_
+__ZN7WebCore15InspectorClient31doDispatchMessageOnFrontendPageEPNS_4PageERKN3WTF6StringE
 __ZN7WebCore19InspectorController12ConsolePanelE
 __ZN7WebCore19InspectorController12ScriptsPanelE
 __ZN7WebCore19InspectorController13ProfilesPanelE
@@ -1209,12 +1244,12 @@ __ZN7WebCore19InspectorController15disableProfilerEb
 __ZN7WebCore19InspectorController18disconnectFrontendEv
 __ZN7WebCore19InspectorController20stopTimelineProfilerEv
 __ZN7WebCore19InspectorController21startTimelineProfilerEv
+__ZN7WebCore19InspectorController23inspectorStartsAttachedEv
 __ZN7WebCore19InspectorController25evaluateForTestInFrontendElRKN3WTF6StringE
 __ZN7WebCore19InspectorController26setInspectorFrontendClientEN3WTF10PassOwnPtrINS_23InspectorFrontendClientEEE
+__ZN7WebCore19InspectorController26setInspectorStartsAttachedEb
 __ZN7WebCore19InspectorController27startUserInitiatedProfilingEv
 __ZN7WebCore19InspectorController26stopUserInitiatedProfilingEv
-__ZN7WebCore19InspectorController34inspectorStartsAttachedSettingNameEv
-__ZN7WebCore19InspectorController34inspectorStartsAttachedSettingNameEv
 __ZNK7WebCore19InspectorController31isRecordingUserInitiatedProfileEv
 __ZNK7WebCore19InspectorController15profilerEnabledEv
 __ZN7WebCore19InspectorController4showEv
@@ -1234,7 +1269,6 @@ __ZN7WebCore28InspectorFrontendClientLocalC2EPNS_19InspectorControllerEPNS_4Page
 __ZN7WebCore28InspectorFrontendClientLocalD2Ev
 __ZNK7WebCore19InspectorController17drawNodeHighlightERNS_15GraphicsContextE
 __ZNK7WebCore19InspectorController7enabledEv
-__ZNK7WebCore19InspectorController7settingERKN3WTF6StringE
 #endif
 
 #if ENABLE(JAVA_BRIDGE)
diff --git a/WebCore/WebCore.gyp/WebCore.gyp b/WebCore/WebCore.gyp/WebCore.gyp
index 6b13eb5..7f586a6 100644
--- a/WebCore/WebCore.gyp/WebCore.gyp
+++ b/WebCore/WebCore.gyp/WebCore.gyp
@@ -158,6 +158,7 @@
       '../platform/image-decoders/png',
       '../platform/image-decoders/skia',
       '../platform/image-decoders/xbm',
+      '../platform/image-decoders/webp',
       '../platform/image-encoders/skia',
       '../platform/mock',
       '../platform/network',
@@ -176,6 +177,7 @@
       '../svg/animation',
       '../svg/graphics',
       '../svg/graphics/filters',
+      '../svg/properties',
       '../websockets',
       '../workers',
       '../xml',
@@ -722,6 +724,7 @@
         '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
         '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
         '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
+        '<(chromium_src_dir)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
         '<(chromium_src_dir)/third_party/sqlite/sqlite.gyp:sqlite',
       ],
@@ -829,6 +832,7 @@
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
         '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
         '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
         '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
@@ -844,6 +848,7 @@
         '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
         '<(chromium_src_dir)/skia/skia.gyp:skia',
         '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
+        '<(chromium_src_dir)/third_party/libwebp/libwebp.gyp:libwebp',
         '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
         '<(chromium_src_dir)/third_party/libxml/libxml.gyp:libxml',
         '<(chromium_src_dir)/third_party/libxslt/libxslt.gyp:libxslt',
@@ -1173,6 +1178,7 @@
             ['exclude', 'platform/image-decoders/gif/GIFImageReader\\.(cpp|h)$'],
             ['exclude', 'platform/image-decoders/ico/ICOImageDecoder\\.(cpp|h)$'],
             ['exclude', 'platform/image-decoders/jpeg/JPEGImageDecoder\\.(cpp|h)$'],
+            ['exclude', 'platform/image-decoders/webp/WEBPImageDecoder\\.(cpp|h)$'],
             ['exclude', 'platform/image-decoders/png/PNGImageDecoder\\.(cpp|h)$'],
             ['exclude', 'platform/image-decoders/skia/ImageDecoderSkia\\.cpp$'],
             ['exclude', 'platform/image-decoders/xbm/XBMImageDecoder\\.(cpp|h)$'],
@@ -1202,6 +1208,11 @@
             ['exclude', 'Posix\\.cpp$'],
           ],
         }],
+        ['"ENABLE_CLIENT_BASED_GEOLOCATION=1" in feature_defines', {
+          'sources/': [
+            ['exclude', '/GeolocationService.*$'],
+          ],
+        }],
       ],
     },
     {
@@ -1278,7 +1289,6 @@
         # be nice to provide more explicit comments.  Some of these do actually
         # compile.
         ['exclude', 'dom/StaticStringList\\.cpp$'],
-        ['exclude', 'loader/icon/IconFetcher\\.cpp$'],
         ['exclude', 'loader/UserStyleSheetLoader\\.cpp$'],
 
         # We use a multi-process version from the WebKit API.
diff --git a/WebCore/WebCore.gypi b/WebCore/WebCore.gypi
index d666ebd..166c4d1 100644
--- a/WebCore/WebCore.gypi
+++ b/WebCore/WebCore.gypi
@@ -89,16 +89,22 @@
             'fileapi/Blob.idl',
             'fileapi/BlobBuilder.idl',
             'fileapi/DirectoryEntry.idl',
+            'fileapi/DirectoryEntrySync.idl',
             'fileapi/DirectoryReader.idl',
+            'fileapi/DirectoryReaderSync.idl',
             'fileapi/DOMFileSystem.idl',
+            'fileapi/DOMFileSystemSync.idl',
             'fileapi/EntriesCallback.idl',
             'fileapi/Entry.idl',
             'fileapi/EntryArray.idl',
+            'fileapi/EntryArraySync.idl',
             'fileapi/EntryCallback.idl',
+            'fileapi/EntrySync.idl',
             'fileapi/ErrorCallback.idl',
             'fileapi/File.idl',
             'fileapi/FileCallback.idl',
             'fileapi/FileEntry.idl',
+            'fileapi/FileEntrySync.idl',
             'fileapi/FileError.idl',
             'fileapi/FileException.idl',
             'fileapi/FileList.idl',
@@ -567,6 +573,7 @@
             'bindings/js/JSDeviceMotionEventCustom.cpp',
             'bindings/js/JSDeviceOrientationEventCustom.cpp',
             'bindings/js/JSDirectoryEntryCustom.cpp',
+            'bindings/js/JSDirectoryEntrySyncCustom.cpp',
             'bindings/js/JSDocumentCustom.cpp',
             'bindings/js/JSDOMApplicationCacheCustom.cpp',
             'bindings/js/JSDOMBinding.cpp',
@@ -585,6 +592,7 @@
             'bindings/js/JSDOMWrapper.h',
             'bindings/js/JSElementCustom.cpp',
             'bindings/js/JSEntryCustom.cpp',
+            'bindings/js/JSEntrySyncCustom.cpp',
             'bindings/js/JSEventCustom.cpp',
             'bindings/js/JSEventListener.cpp',
             'bindings/js/JSEventListener.h',
@@ -713,7 +721,6 @@
             'bindings/js/ScriptSourceProvider.h',
             'bindings/js/ScriptState.cpp',
             'bindings/js/ScriptState.h',
-            'bindings/js/ScriptString.h',
             'bindings/js/ScriptValue.cpp',
             'bindings/js/ScriptValue.h',
             'bindings/js/ScriptWrappable.h',
@@ -735,6 +742,7 @@
             'bindings/v8/custom/V8ArrayBufferCustom.cpp',
             'bindings/v8/custom/V8Int8ArrayCustom.cpp',
             'bindings/v8/custom/V8Int32ArrayCustom.cpp',
+            'bindings/v8/custom/V8FileReaderCustom.cpp',
             'bindings/v8/custom/V8Float32ArrayCustom.cpp',
             'bindings/v8/custom/V8Int16ArrayCustom.cpp',
             'bindings/v8/custom/V8Uint8ArrayCustom.cpp',
@@ -766,6 +774,7 @@
             'bindings/v8/custom/V8DeviceMotionEventCustom.cpp',
             'bindings/v8/custom/V8DeviceOrientationEventCustom.cpp',
             'bindings/v8/custom/V8DirectoryEntryCustom.cpp',
+            'bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp',
             'bindings/v8/custom/V8DocumentLocationCustom.cpp',
             'bindings/v8/custom/V8DOMFormDataCustom.cpp',
             'bindings/v8/custom/V8DOMStringMapCustom.cpp',
@@ -774,6 +783,7 @@
             'bindings/v8/custom/V8DocumentCustom.cpp',
             'bindings/v8/custom/V8ElementCustom.cpp',
             'bindings/v8/custom/V8EntryCustom.cpp',
+            'bindings/v8/custom/V8EntrySyncCustom.cpp',
             'bindings/v8/custom/V8EventCustom.cpp',
             'bindings/v8/custom/V8EventSourceConstructor.cpp',
             'bindings/v8/custom/V8GeolocationCustom.cpp',
@@ -890,9 +900,6 @@
             'bindings/v8/ScriptSourceCode.h',
             'bindings/v8/ScriptState.h',
             'bindings/v8/ScriptState.cpp',
-            'bindings/v8/ScriptString.h',
-            'bindings/v8/ScriptStringImpl.cpp',
-            'bindings/v8/ScriptStringImpl.h',
             'bindings/v8/ScriptValue.cpp',
             'bindings/v8/ScriptValue.h',
             'bindings/v8/ScriptWrappable.h',
@@ -983,7 +990,6 @@
             'css/CSSFunctionValue.h',
             'css/CSSGradientValue.cpp',
             'css/CSSGradientValue.h',
-            'css/CSSHelper.cpp',
             'css/CSSHelper.h',
             'css/CSSImageGeneratorValue.cpp',
             'css/CSSImageGeneratorValue.h',
@@ -1344,6 +1350,8 @@
             'editing/wx/EditorWx.cpp',
             'editing/AppendNodeCommand.cpp',
             'editing/AppendNodeCommand.h',
+            'editing/ApplyBlockElementCommand.cpp',
+            'editing/ApplyBlockElementCommand.h',
             'editing/ApplyStyleCommand.cpp',
             'editing/ApplyStyleCommand.h',
             'editing/BreakBlockquoteCommand.cpp',
@@ -1390,6 +1398,8 @@
             'editing/InsertTextCommand.h',
             'editing/JoinTextNodesCommand.cpp',
             'editing/JoinTextNodesCommand.h',
+            'editing/MarkupAccumulator.cpp',
+            'editing/MarkupAccumulator.h',
             'editing/MergeIdenticalElementsCommand.cpp',
             'editing/MergeIdenticalElementsCommand.h',
             'editing/ModifySelectionListLevel.cpp',
@@ -1452,24 +1462,41 @@
             'fileapi/BlobURL.h',
             'fileapi/DirectoryEntry.cpp',
             'fileapi/DirectoryEntry.h',
+            'fileapi/DirectoryEntrySync.cpp',
+            'fileapi/DirectoryEntrySync.h',
             'fileapi/DirectoryReader.cpp',
             'fileapi/DirectoryReader.h',
+            'fileapi/DirectoryReaderBase.h',
+            'fileapi/DirectoryReaderSync.cpp',
+            'fileapi/DirectoryReaderSync.h',
             'fileapi/DOMFilePath.cpp',
             'fileapi/DOMFilePath.h',
             'fileapi/DOMFileSystem.cpp',
             'fileapi/DOMFileSystem.h',
+            'fileapi/DOMFileSystemBase.cpp',
+            'fileapi/DOMFileSystemBase.h',
+            'fileapi/DOMFileSystemSync.cpp',
+            'fileapi/DOMFileSystemSync.h',
             'fileapi/EntriesCallback.h',
             'fileapi/Entry.cpp',
             'fileapi/Entry.h',
+            'fileapi/EntryBase.h',
             'fileapi/EntryArray.cpp',
             'fileapi/EntryArray.h',
+            'fileapi/EntryArraySync.cpp',
+            'fileapi/EntryArraySync.h',
             'fileapi/EntryCallback.h',
+            'fileapi/EntryBase.h',
+            'fileapi/EntrySync.cpp',
+            'fileapi/EntrySync.h',
             'fileapi/ErrorCallback.h',
             'fileapi/File.cpp',
             'fileapi/File.h',
             'fileapi/FileCallback.h',
             'fileapi/FileEntry.cpp',
             'fileapi/FileEntry.h',
+            'fileapi/FileEntrySync.cpp',
+            'fileapi/FileEntrySync.h',
             'fileapi/FileError.h',
             'fileapi/FileException.h',
             'fileapi/FileList.cpp',
@@ -1493,6 +1520,7 @@
             'fileapi/LocalFileSystem.h',
             'fileapi/Metadata.h',
             'fileapi/MetadataCallback.h',
+            'fileapi/SyncCallbackHelper.h',
             'fileapi/ThreadableBlobRegistry.cpp',
             'fileapi/ThreadableBlobRegistry.h',
             'history/mac/HistoryItemMac.mm',
@@ -1514,6 +1542,8 @@
             'history/PageCache.h',
             'html/AsyncImageResizer.cpp',
             'html/AsyncImageResizer.h',
+            'html/BaseDateAndTimeInputType.cpp',
+            'html/BaseDateAndTimeInputType.h',
             'html/BaseTextInputType.cpp',
             'html/BaseTextInputType.h',
             'html/ButtonInputType.cpp',
@@ -1873,7 +1903,6 @@
             'html/parser/TextDocumentParser.h',
             'html/parser/TextViewSourceParser.cpp',
             'html/parser/TextViewSourceParser.h',
-            'inspector/InspectorClient.h',
             'inspector/ConsoleMessage.cpp',
             'inspector/ConsoleMessage.h',
             'inspector/InjectedScript.cpp',
@@ -1884,8 +1913,12 @@
             'inspector/InspectorApplicationCacheAgent.h',
             'inspector/InspectorBackend.cpp',
             'inspector/InspectorBackend.h',
+            'inspector/InspectorClient.cpp',
+            'inspector/InspectorClient.h',
             'inspector/InspectorController.cpp',
             'inspector/InspectorController.h',
+            'inspector/InspectorCSSAgent.cpp',
+            'inspector/InspectorCSSAgent.h',
             'inspector/InspectorCSSStore.cpp',
             'inspector/InspectorCSSStore.h',
             'inspector/InspectorDatabaseResource.cpp',
@@ -1899,12 +1932,20 @@
             'inspector/InspectorFrontendClient.h',
             'inspector/InspectorFrontendHost.cpp',
             'inspector/InspectorFrontendHost.h',
+            'inspector/InspectorInstrumentation.cpp',
+            'inspector/InspectorInstrumentation.h',
             'inspector/InspectorProfilerAgent.cpp',
             'inspector/InspectorProfilerAgent.h',
             'inspector/InspectorResource.cpp',
             'inspector/InspectorResource.h',
+            'inspector/InspectorResourceAgent.cpp',
+            'inspector/InspectorResourceAgent.h',
+            'inspector/InspectorState.cpp',
+            'inspector/InspectorState.h',
             'inspector/InspectorStorageAgent.cpp',
             'inspector/InspectorStorageAgent.h',
+            'inspector/InspectorStyleSheet.cpp',
+            'inspector/InspectorStyleSheet.h',
             'inspector/InspectorTimelineAgent.cpp',
             'inspector/InspectorTimelineAgent.h',
             'inspector/InspectorValues.cpp',
@@ -1944,8 +1985,6 @@
             'loader/icon/IconDatabase.h',
             'loader/icon/IconDatabaseClient.h',
             'loader/icon/IconDatabaseNone.cpp',
-            'loader/icon/IconFetcher.cpp',
-            'loader/icon/IconFetcher.h',
             'loader/icon/IconLoader.cpp',
             'loader/icon/IconLoader.h',
             'loader/icon/IconRecord.cpp',
@@ -2026,8 +2065,8 @@
             'loader/PolicyChecker.h',
             'loader/ProgressTracker.cpp',
             'loader/ProgressTracker.h',
-            'loader/RedirectScheduler.cpp',
-            'loader/RedirectScheduler.h',
+            'loader/NavigationScheduler.cpp',
+            'loader/NavigationScheduler.h',
             'loader/Request.cpp',
             'loader/Request.h',
             'loader/ResourceLoader.cpp',
@@ -2254,6 +2293,8 @@
             'platform/chromium/ChromiumBridge.h',
             'platform/chromium/ChromiumDataObject.cpp',
             'platform/chromium/ChromiumDataObject.h',
+            'platform/chromium/ChromiumDataObjectLegacy.cpp',
+            'platform/chromium/ChromiumDataObjectLegacy.h',
             'platform/chromium/ClipboardChromium.cpp',
             'platform/chromium/ClipboardChromium.h',
             'platform/chromium/ClipboardChromiumLinux.cpp',
@@ -2283,7 +2324,7 @@
             'platform/chromium/GeolocationServiceChromium.h',
             'platform/chromium/KeyCodeConversion.h',
             'platform/chromium/KeyCodeConversionGtk.cpp',
-            'platform/chromium/Language.cpp',
+            'platform/chromium/LanguageChromium.cpp',
             'platform/chromium/LinkHashChromium.cpp',
             'platform/chromium/MIMETypeRegistryChromium.cpp',
             'platform/chromium/PasteboardChromium.cpp',
@@ -2455,8 +2496,6 @@
             'platform/graphics/filters/Filter.h',
             'platform/graphics/filters/FilterEffect.cpp',
             'platform/graphics/filters/FilterEffect.h',
-            'platform/graphics/filters/ImageBufferFilter.cpp',
-            'platform/graphics/filters/ImageBufferFilter.h',
             'platform/graphics/filters/SourceAlpha.cpp',
             'platform/graphics/filters/SourceAlpha.h',
             'platform/graphics/filters/SourceGraphic.cpp',
@@ -2773,7 +2812,7 @@
             'platform/gtk/GeolocationServiceGtk.h',
             'platform/gtk/KURLGtk.cpp',
             'platform/gtk/KeyEventGtk.cpp',
-            'platform/gtk/Language.cpp',
+            'platform/gtk/LanguageGtk.cpp',
             'platform/gtk/LocalizedStringsGtk.cpp',
             'platform/gtk/LoggingGtk.cpp',
             'platform/gtk/MIMETypeRegistryGtk.cpp',
@@ -2816,6 +2855,8 @@
             'platform/image-decoders/jpeg/JPEGImageDecoder.h',
             'platform/image-decoders/png/PNGImageDecoder.cpp',
             'platform/image-decoders/png/PNGImageDecoder.h',
+            'platform/image-decoders/webp/WEBPImageDecoder.cpp',
+            'platform/image-decoders/webp/WEBPImageDecoder.h',
             'platform/image-decoders/skia/ImageDecoderSkia.cpp',
             'platform/image-decoders/wx/ImageDecoderWx.cpp',
             'platform/image-decoders/zlib/crc32.h',
@@ -2907,6 +2948,7 @@
             'platform/network/chromium/ResourceError.h',
             'platform/network/chromium/ResourceRequest.cpp',
             'platform/network/chromium/ResourceRequest.h',
+            'platform/network/chromium/ResourceResponse.cpp',
             'platform/network/chromium/ResourceResponse.h',
             'platform/network/chromium/SocketStreamError.h',
             'platform/network/chromium/SocketStreamHandle.h',
@@ -2974,6 +3016,8 @@
             'platform/network/Credential.cpp',
             'platform/network/Credential.h',
             'platform/network/DNS.h',
+            'platform/network/DataURL.cpp',
+            'platform/network/DataURL.h',
             'platform/network/FormData.cpp',
             'platform/network/FormData.h',
             'platform/network/FormDataBuilder.cpp',
@@ -2996,6 +3040,7 @@
             'platform/network/ResourceRequestBase.h',
             'platform/network/ResourceResponseBase.cpp',
             'platform/network/ResourceResponseBase.h',
+            'platform/network/ResourceRawHeaders.h',
             'platform/network/SocketStreamErrorBase.cpp',
             'platform/network/SocketStreamErrorBase.h',
             'platform/network/SocketStreamHandleBase.cpp',
@@ -3101,9 +3146,6 @@
             'platform/text/SegmentedString.cpp',
             'platform/text/SegmentedString.h',
             'platform/text/String.cpp',
-            'platform/text/StringBuffer.h',
-            'platform/text/StringBuilder.cpp',
-            'platform/text/StringBuilder.h',
             'platform/text/StringHash.h',
             'platform/text/StringImpl.h',
             'platform/text/SuffixTree.h',
@@ -3154,7 +3196,7 @@
             'platform/win/GDIObjectCounter.cpp',
             'platform/win/GDIObjectCounter.h',
             'platform/win/KeyEventWin.cpp',
-            'platform/win/Language.cpp',
+            'platform/win/LanguageWin.cpp',
             'platform/win/LoggingWin.cpp',
             'platform/win/MIMETypeRegistryWin.cpp',
             'platform/win/PasteboardWin.cpp',
@@ -3258,6 +3300,7 @@
             'platform/KURLGoogle.cpp',
             'platform/KURLGooglePrivate.h',
             'platform/KURLHash.h',
+            'platform/Language.cpp',
             'platform/Language.h',
             'platform/Length.cpp',
             'platform/Length.h',
@@ -3434,10 +3477,43 @@
             'rendering/style/StyleTransformData.h',
             'rendering/style/StyleVisualData.cpp',
             'rendering/style/StyleVisualData.h',
+            'rendering/svg/RenderSVGInline.cpp',
+            'rendering/svg/RenderSVGInline.h',
+            'rendering/svg/RenderSVGInlineText.cpp',
+            'rendering/svg/RenderSVGInlineText.h',
+            'rendering/svg/RenderSVGPath.cpp',
+            'rendering/svg/RenderSVGPath.h',
+            'rendering/svg/RenderSVGTSpan.cpp',
+            'rendering/svg/RenderSVGTSpan.h',
+            'rendering/svg/RenderSVGText.cpp',
+            'rendering/svg/RenderSVGText.h',
+            'rendering/svg/RenderSVGTextPath.cpp',
+            'rendering/svg/RenderSVGTextPath.h',
+            'rendering/svg/SVGInlineFlowBox.cpp',
+            'rendering/svg/SVGInlineFlowBox.h',
+            'rendering/svg/SVGInlineTextBox.cpp',
+            'rendering/svg/SVGInlineTextBox.h',
+            'rendering/svg/SVGRootInlineBox.cpp',
+            'rendering/svg/SVGRootInlineBox.h',
+            'rendering/svg/SVGTextChunk.cpp',
+            'rendering/svg/SVGTextChunk.h',
+            'rendering/svg/SVGTextChunkBuilder.cpp',
+            'rendering/svg/SVGTextChunkBuilder.h',
+            'rendering/svg/SVGTextFragment.h',
             'rendering/svg/SVGTextLayoutAttributes.cpp',
             'rendering/svg/SVGTextLayoutAttributes.h',
-            'rendering/svg/SVGTextLayoutBuilder.cpp',
-            'rendering/svg/SVGTextLayoutBuilder.h',
+            'rendering/svg/SVGTextLayoutAttributesBuilder.cpp',
+            'rendering/svg/SVGTextLayoutAttributesBuilder.h',
+            'rendering/svg/SVGTextLayoutEngine.cpp',
+            'rendering/svg/SVGTextLayoutEngine.h',
+            'rendering/svg/SVGTextLayoutEngineBaseline.cpp',
+            'rendering/svg/SVGTextLayoutEngineBaseline.h',
+            'rendering/svg/SVGTextLayoutEngineSpacing.cpp',
+            'rendering/svg/SVGTextLayoutEngineSpacing.h',
+            'rendering/svg/SVGTextMetrics.cpp',
+            'rendering/svg/SVGTextMetrics.h',
+            'rendering/svg/SVGTextQuery.cpp',
+            'rendering/svg/SVGTextQuery.h',
             'rendering/AutoTableLayout.cpp',
             'rendering/AutoTableLayout.h',
             'rendering/BidiRun.cpp',
@@ -3548,8 +3624,6 @@
             'rendering/RenderObjectChildList.h',
             'rendering/RenderPart.cpp',
             'rendering/RenderPart.h',
-            'rendering/RenderPath.cpp',
-            'rendering/RenderPath.h',
             'rendering/RenderProgress.cpp',
             'rendering/RenderProgress.h',
             'rendering/RenderReplaced.cpp',
@@ -3574,10 +3648,6 @@
             'rendering/RenderSVGHiddenContainer.h',
             'rendering/RenderSVGImage.cpp',
             'rendering/RenderSVGImage.h',
-            'rendering/RenderSVGInline.cpp',
-            'rendering/RenderSVGInline.h',
-            'rendering/RenderSVGInlineText.cpp',
-            'rendering/RenderSVGInlineText.h',
             'rendering/RenderSVGModelObject.cpp',
             'rendering/RenderSVGModelObject.h',
             'rendering/RenderSVGResource.cpp',
@@ -3608,12 +3678,6 @@
             'rendering/RenderSVGRoot.h',
             'rendering/RenderSVGShadowTreeRootContainer.cpp',
             'rendering/RenderSVGShadowTreeRootContainer.h',
-            'rendering/RenderSVGTSpan.cpp',
-            'rendering/RenderSVGTSpan.h',
-            'rendering/RenderSVGText.cpp',
-            'rendering/RenderSVGText.h',
-            'rendering/RenderSVGTextPath.cpp',
-            'rendering/RenderSVGTextPath.h',
             'rendering/RenderSVGTransformableContainer.cpp',
             'rendering/RenderSVGTransformableContainer.h',
             'rendering/RenderSVGViewportContainer.cpp',
@@ -3679,16 +3743,8 @@
             'rendering/ScrollBehavior.h',
             'rendering/ShadowElement.cpp',
             'rendering/ShadowElement.h',
-            'rendering/SVGCharacterData.cpp',
-            'rendering/SVGCharacterData.h',
-            'rendering/SVGCharacterLayoutInfo.cpp',
-            'rendering/SVGCharacterLayoutInfo.h',
-            'rendering/SVGInlineFlowBox.cpp',
-            'rendering/SVGInlineFlowBox.h',
             'rendering/SVGImageBufferTools.cpp',
             'rendering/SVGImageBufferTools.h',
-            'rendering/SVGInlineTextBox.cpp',
-            'rendering/SVGInlineTextBox.h',
             'rendering/SVGMarkerData.h',
             'rendering/SVGMarkerLayoutInfo.cpp',
             'rendering/SVGMarkerLayoutInfo.h',
@@ -3702,16 +3758,8 @@
             'rendering/SVGResourcesCache.h',
             'rendering/SVGResourcesCycleSolver.cpp',
             'rendering/SVGResourcesCycleSolver.h',
-            'rendering/SVGRootInlineBox.cpp',
-            'rendering/SVGRootInlineBox.h',
             'rendering/SVGShadowTreeElements.cpp',
             'rendering/SVGShadowTreeElements.h',
-            'rendering/SVGTextChunkLayoutInfo.cpp',
-            'rendering/SVGTextChunkLayoutInfo.h',
-            'rendering/SVGTextLayoutUtilities.cpp',
-            'rendering/SVGTextLayoutUtilities.h',
-            'rendering/SVGTextQuery.cpp',
-            'rendering/SVGTextQuery.h',
             'rendering/TableLayout.h',
             'rendering/TextControlInnerElements.cpp',
             'rendering/TextControlInnerElements.h',
@@ -3750,6 +3798,8 @@
             'storage/IDBAny.cpp',
             'storage/IDBAny.h',
             'storage/IDBCallbacks.h',
+            'storage/IDBCompleteEvent.cpp',
+            'storage/IDBCompleteEvent.h',
             'storage/IDBCursor.cpp',
             'storage/IDBCursor.h',
             'storage/IDBCursorBackendImpl.cpp',
@@ -3785,7 +3835,6 @@
             'storage/IDBKeyPath.h',
             'storage/IDBKeyRange.cpp',
             'storage/IDBKeyRange.h',
-            'storage/IDBKeyTree.h',
             'storage/IDBObjectStore.cpp',
             'storage/IDBObjectStore.h',
             'storage/IDBObjectStoreBackendImpl.cpp',
@@ -3797,6 +3846,8 @@
             'storage/IDBRequest.h',
             'storage/IDBSuccessEvent.cpp',
             'storage/IDBSuccessEvent.h',
+            'storage/IDBTimeoutEvent.cpp',
+            'storage/IDBTimeoutEvent.h',
             'storage/IDBTransaction.cpp',
             'storage/IDBTransaction.h',
             'storage/IDBTransactionBackendImpl.cpp',
@@ -3869,8 +3920,12 @@
             'svg/graphics/filters/SVGFilterBuilder.h',
             'svg/graphics/SVGImage.cpp',
             'svg/graphics/SVGImage.h',
+            'svg/properties/SVGAnimatedPropertySynchronizer.h',
             'svg/ColorDistance.cpp',
             'svg/ColorDistance.h',
+            'svg/DeprecatedSVGAnimatedProperty.h',
+            'svg/DeprecatedSVGAnimatedPropertyTraits.h',
+            'svg/DeprecatedSVGAnimatedTemplate.h',
             'svg/ElementTimeControl.h',
             'svg/GradientAttributes.h',
             'svg/LinearGradientAttributes.h',
@@ -3895,10 +3950,6 @@
             'svg/SVGAnimatedPathData.h',
             'svg/SVGAnimatedPoints.cpp',
             'svg/SVGAnimatedPoints.h',
-            'svg/SVGAnimatedProperty.h',
-            'svg/SVGAnimatedPropertySynchronizer.h',
-            'svg/SVGAnimatedPropertyTraits.h',
-            'svg/SVGAnimatedTemplate.h',
             'svg/SVGAnimationElement.cpp',
             'svg/SVGAnimationElement.h',
             'svg/SVGCircleElement.cpp',
@@ -4305,6 +4356,7 @@
             'inspector/front-end/ConsoleView.js',
             'inspector/front-end/ContextMenu.js',
             'inspector/front-end/CookieItemsView.js',
+            'inspector/front-end/CookieParser.js',
             'inspector/front-end/CSSCompletions.js',
             'inspector/front-end/CSSStyleModel.js',
             'inspector/front-end/Database.js',
@@ -4353,6 +4405,7 @@
             'inspector/front-end/RemoteObject.js',
             'inspector/front-end/Resource.js',
             'inspector/front-end/ResourceCategory.js',
+            'inspector/front-end/ResourceManager.js',
             'inspector/front-end/ResourcesPanel.js',
             'inspector/front-end/ResourceView.js',
             'inspector/front-end/ScopeChainSidebarPane.js',
diff --git a/WebCore/WebCore.order b/WebCore/WebCore.order
index 4124777..06dfb3d 100644
--- a/WebCore/WebCore.order
+++ b/WebCore/WebCore.order
@@ -3397,9 +3397,6 @@ __ZN7WebCore17HTMLScriptElement8checkDTDEPKNS_4NodeE
 __ZN7WebCore17HTMLScriptElement15childrenChangedEbPNS_4NodeES2_i
 __ZN7WebCore13ScriptElement15childrenChangedERNS_17ScriptElementDataE
 __ZNK7WebCore4Node11textContentEb
-__ZNK7WebCore4Node17appendTextContentEbRNS_13StringBuilderE
-__ZN7WebCore13StringBuilder6appendERKNS_6StringE
-__ZNK7WebCore13StringBuilder8toStringEv
 __ZN3WTF6VectorIN7WebCore6StringELm16EE6shrinkEm
 __ZN7WebCore17HTMLScriptElement21finishParsingChildrenEv
 __ZN7WebCore13ScriptElement21finishParsingChildrenERNS_17ScriptElementDataERKNS_6StringE
@@ -15911,7 +15908,7 @@ __ZN7WebCore10TextStreamlsEPKc
 __ZN7WebCorelsERNS_10TextStreamERKNS_7IntRectE
 __ZN7WebCore10TextStreamlsEi
 __ZN7WebCore5writeERNS_10TextStreamERKNS_12RenderObjectEij
-__ZNK7WebCore12RenderObject12isRenderPathEv
+__ZNK7WebCore12RenderObject9isSVGPathEv
 __ZNK7WebCore12RenderObject17isSVGGradientStopEv
 __ZNK7WebCore12RenderObject22isSVGResourceContainerEv
 __ZNK7WebCore12RenderObject10isSVGImageEv
@@ -16699,13 +16696,13 @@ __ZNK7WebCore10SVGElement25childShouldCreateRendererEPNS_4NodeE
 __ZNK7WebCore14SVGRectElement7isValidEv
 __ZN7WebCore16SVGStyledElement16rendererIsNeededEPNS_11RenderStyleE
 __ZN7WebCore29SVGStyledTransformableElement14createRendererEPNS_11RenderArenaEPNS_11RenderStyleE
-__ZN7WebCore10RenderPathC1EPNS_29SVGStyledTransformableElementE
-__ZN7WebCore10RenderPathC2EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore13RenderSVGPathC1EPNS_29SVGStyledTransformableElementE
+__ZN7WebCore13RenderSVGPathC2EPNS_29SVGStyledTransformableElementE
 __ZN7WebCore20RenderSVGModelObjectC2EPNS_16SVGStyledElementE
 __ZN7WebCore19SVGMarkerLayoutInfoC1Ev
 __ZN7WebCore19SVGMarkerLayoutInfoC2Ev
-__ZN7WebCore10RenderPath15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
-__ZN7WebCore10RenderPath24setNeedsBoundariesUpdateEv
+__ZN7WebCore13RenderSVGPath15styleWillChangeENS_15StyleDifferenceEPKNS_11RenderStyleE
+__ZN7WebCore13RenderSVGPath24setNeedsBoundariesUpdateEv
 __ZN7WebCore13RenderSVGRoot15virtualChildrenEv
 __ZNK7WebCore13RenderSVGRoot9isSVGRootEv
 __ZN7WebCore10SVGElement15eventParentNodeEv
@@ -16749,7 +16746,7 @@ __ZN7WebCore24getRenderSVGResourceByIdINS_23RenderSVGResourceFilterEEEPT_PNS_8Do
 __ZN7WebCore24getRenderSVGResourceByIdINS_23RenderSVGResourceMarkerEEEPT_PNS_8DocumentERKNS_12AtomicStringE
 __ZN7WebCore29SVGStyledTransformableElement16isKnownAttributeERKNS_13QualifiedNameE
 __ZN7WebCore16SVGStyledElement16isKnownAttributeERKNS_13QualifiedNameE
-__ZN7WebCore10RenderPath23setNeedsTransformUpdateEv
+__ZN7WebCore13RenderSVGPath23setNeedsTransformUpdateEv
 __ZN7WebCoreL15textConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
 __ZN7WebCore14SVGTextElementC1ERKNS_13QualifiedNameEPNS_8DocumentE
 __ZN7WebCore25SVGTextPositioningElementC2ERKNS_13QualifiedNameEPNS_8DocumentE
@@ -16810,7 +16807,7 @@ __ZNK7WebCore13SVGSVGElement12currentScaleEv
 __ZNK7WebCore13RenderSVGRoot18calcReplacedHeightEv
 __ZN7WebCore13RenderSVGRoot12calcViewportEv
 __ZN7WebCore13SVGRenderBase14layoutChildrenEPNS_12RenderObjectEb
-__ZN7WebCore10RenderPath6layoutEv
+__ZN7WebCore13RenderSVGPath6layoutEv
 __ZNK7WebCore14SVGRectElement10toPathDataEv
 __ZNK7WebCore29SVGStyledTransformableElement22animatedLocalTransformEv
 __ZNK7WebCore16SVGTransformList11concatenateEv
@@ -16819,7 +16816,7 @@ __ZN7WebCore12SVGTransformC2Ev
 __ZNK7WebCore12SVGTransform6matrixEv
 __ZN7WebCore12SVGTransformD1Ev
 __ZN7WebCore12SVGTransformD2Ev
-__ZN7WebCore10RenderPath22updateCachedBoundariesEv
+__ZN7WebCore13RenderSVGPath22updateCachedBoundariesEv
 __ZNK7WebCore13SVGRenderBase28filterBoundingBoxForRendererEPKNS_12RenderObjectE
 __ZNK7WebCore13SVGRenderBase29clipperBoundingBoxForRendererEPKNS_12RenderObjectE
 __ZNK7WebCore13SVGRenderBase28maskerBoundingBoxForRendererEPKNS_12RenderObjectE
@@ -16932,14 +16929,14 @@ __ZN7WebCore15AffineTransform14translateRightEdd
 __ZN7WebCore25applyTransformToPaintInfoERNS_12RenderObject9PaintInfoERKNS_15AffineTransformE
 __ZNK7WebCore13RenderSVGRoot29repaintRectInLocalCoordinatesEv
 __ZN7WebCore13SVGRenderBase27computeContainerBoundingBoxEPKNS_12RenderObjectEb
-__ZNK7WebCore10RenderPath29repaintRectInLocalCoordinatesEv
-__ZNK7WebCore10RenderPath22localToParentTransformEv
+__ZNK7WebCore13RenderSVGPath29repaintRectInLocalCoordinatesEv
+__ZNK7WebCore13RenderSVGPath22localToParentTransformEv
 __ZNK7WebCore13RenderSVGText29repaintRectInLocalCoordinatesEv
 __ZNK7WebCore13RenderSVGText17strokeBoundingBoxEv
 __ZNK7WebCore13RenderSVGText17objectBoundingBoxEv
 __ZNK7WebCore13RenderSVGText22localToParentTransformEv
 __ZN7WebCore9RenderBox5paintERNS_12RenderObject9PaintInfoEii
-__ZN7WebCore10RenderPath5paintERNS_12RenderObject9PaintInfoEii
+__ZN7WebCore13RenderSVGPath5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13RenderSVGText5paintERNS_12RenderObject9PaintInfoEii
 __ZN7WebCore13SVGRenderBase25prepareToRenderSVGContentEPNS_12RenderObjectERNS1_9PaintInfoERKNS_9FloatRectERPNS_23RenderSVGResou
 __ZN7WebCore17RenderSVGResource20fillPaintingResourceEPKNS_12RenderObjectEPKNS_11RenderStyleE
@@ -16960,7 +16957,7 @@ __ZN7WebCore13SVGSVGElement26documentWillBecomeInactiveEv
 __ZN7WebCore13SVGSVGElement15pauseAnimationsEv
 __ZN7WebCore17SMILTimeContainer5pauseEv
 __ZN7WebCore20RenderSVGModelObject7destroyEv
-__ZN7WebCore10RenderPathD0Ev
+__ZN7WebCore13RenderSVGPathD0Ev
 __ZN7WebCore19SVGMarkerLayoutInfoD1Ev
 __ZN7WebCore19SVGMarkerLayoutInfoD2Ev
 __ZN7WebCore19RenderSVGInlineText7destroyEv
@@ -18629,7 +18626,7 @@ __ZNK7WebCore13RenderSVGText19mapLocalToContainerEPNS_20RenderBoxModelObjectEbbR
 __ZNK7WebCore14SVGLineElement17hasRelativeValuesEv
 __ZN7WebCore9FrameView15contentsResizedEv
 __ZNK7WebCore17EmptyChromeClient19contentsSizeChangedEPNS_5FrameERKNS_7IntSizeE
-__ZNK7WebCore10RenderPath17objectBoundingBoxEv
+__ZNK7WebCore13RenderSVGPath17objectBoundingBoxEv
 __ZN7WebCore5TimerINS_17SMILTimeContainerEE5firedEv
 __ZN7WebCore17SMILTimeContainer10timerFiredEPNS_5TimerIS0_EE
 __ZN7WebCore14SVGSMILElement19resolveNextIntervalEv
@@ -22595,7 +22592,6 @@ __ZN7WebCore16JSDOMWindowShell12lookupGetterEPN3JSC9ExecStateERKNS1_10Identifier
 __ZN7WebCore11JSDOMWindow12lookupGetterEPN3JSC9ExecStateERKNS1_10IdentifierE
 __ZN7WebCore16JSDOMWindowShell12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectEj
 __ZN7WebCore11JSDOMWindow12defineSetterEPN3JSC9ExecStateERKNS1_10IdentifierEPNS1_8JSObjectEj
-__ZN7WebCore13StringBuilder6appendEc
 __ZN7WebCore33jsLocationPrototypeFunctionAssignEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
 __ZN7WebCore10JSLocation6assignEPN3JSC9ExecStateERKNS1_7ArgListE
 __ZN7WebCore33jsHistoryPrototypeFunctionForwardEPN3JSC9ExecStateEPNS0_8JSObjectENS0_7JSValueERKNS0_7ArgListE
@@ -24894,10 +24890,10 @@ __ZNK7WebCore13RenderSVGRoot14localTransformEv
 __ZN7WebCoreL17writeIfNotDefaultIfEEvRNS_10TextStreamEPKcT_S5_
 __ZN7WebCoreL15writeIfNotEmptyERNS_10TextStreamEPKcRKNS_6StringE
 __ZN7WebCoreL13writeChildrenERNS_10TextStreamERKNS_12RenderObjectEi
-__ZNK7WebCore10RenderPath12isRenderPathEv
-__ZN7WebCore5writeERNS_10TextStreamERKNS_10RenderPathEi
-__ZNK7WebCore10RenderPath10renderNameEv
-__ZNK7WebCore10RenderPath14localTransformEv
+__ZNK7WebCore13RenderSVGPath9isSVGPathEv
+__ZN7WebCore5writeERNS_10TextStreamERKNS_13RenderSVGPathEi
+__ZNK7WebCore13RenderSVGPath10renderNameEv
+__ZNK7WebCore13RenderSVGPath14localTransformEv
 __ZN7WebCorelsERNS_10TextStreamERNS_19TextStreamSeparatorE
 __ZN7WebCoreL24writeSVGPaintingResourceERNS_10TextStreamEPNS_17RenderSVGResourceE
 __ZNK7WebCore27RenderSVGResourceSolidColor12resourceTypeEv
@@ -25840,7 +25836,6 @@ __ZNK3JSC8Bindings10RootObject12nativeHandleEv
 __ZNK3JSC8Bindings10JavaMethod8methodIDEP8_jobject
 __ZNK3JSC8Bindings10JavaMethod9signatureEv
 __ZN3JSC8Bindings26signatureFromPrimitiveTypeE7JNIType
-__ZL15appendClassNameRN7WebCore13StringBuilderEPKc
 __ZN3JSC8Bindings11getMethodIDEP8_jobjectPKcS4_
 __ZNK3JSC8Bindings10JavaMethod13JNIReturnTypeEv
 __ZN3JSC8Bindings15dispatchJNICallEPNS_9ExecStateEPKvP8_jobjectb7JNITypeP10_jmethodIDP6jvalueRSA_PKcRNS_7JSValueE
@@ -26820,7 +26815,7 @@ __ZNK3WTF7HashMapIN7WebCore12AtomicStringENS_6RefPtrINS1_12FilterEffectEEENS1_16
 __ZN7WebCore7FEBlend6createEPNS_12FilterEffectES2_NS_13BlendModeTypeE
 __ZN7WebCore7FEBlendC1EPNS_12FilterEffectES2_NS_13BlendModeTypeE
 __ZN7WebCore7FEBlendC2EPNS_12FilterEffectES2_NS_13BlendModeTypeE
-__ZNK7WebCore10RenderPath17strokeBoundingBoxEv
+__ZNK7WebCore13RenderSVGPath17strokeBoundingBoxEv
 __ZN7WebCore23RenderSVGResourceFilter22fitsInMaximumImageSizeERKNS_9FloatSizeERS1_
 __ZN7WebCore9SVGFilter6createERKNS_9FloatRectES3_b
 __ZN7WebCore9SVGFilterC1ERKNS_9FloatRectES3_b
@@ -27309,7 +27304,7 @@ __ZN7WebCore26StyleInheritedResourceDataC2ERKS0_
 __ZNK7WebCore26StyleInheritedResourceDataeqERKS0_
 __ZN7WebCore23RenderSVGResourceMarker6layoutEv
 __ZN7WebCore23RenderSVGResourceMarker12calcViewportEv
-__ZN7WebCore10RenderPath29calculateMarkerBoundsIfNeededEv
+__ZN7WebCore13RenderSVGPath29calculateMarkerBoundsIfNeededEv
 __ZNK7WebCore14SVGPathElement15supportsMarkersEv
 __ZThn88_NK7WebCore23RenderSVGResourceMarker12resourceTypeEv
 __ZNK7WebCore23RenderSVGResourceMarker12resourceTypeEv
@@ -27558,10 +27553,10 @@ __ZN7WebCore21JSSVGAnimationElement18getOwnPropertySlotEPN3JSC9ExecStateERKNS1_1
 __ZNK7WebCore19JSSVGAnimateElement9classInfoEv
 __ZN7WebCore13RenderSVGRoot11nodeAtPointERKNS_14HitTestRequestERNS_13HitTestResultEiiiiNS_13HitTestActionE
 __ZNK7WebCore15AffineTransform8mapPointERKNS_8IntPointE
-__ZN7WebCore10RenderPath16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
+__ZN7WebCore13RenderSVGPath16nodeAtFloatPointERKNS_14HitTestRequestERNS_13HitTestResultERKNS_10FloatPointENS_13HitTestActionE
 __ZN7WebCore21PointerEventsHitRulesC1ENS0_11EHitTestingENS_14EPointerEventsE
 __ZN7WebCore21PointerEventsHitRulesC2ENS0_11EHitTestingENS_14EPointerEventsE
-__ZNK7WebCore10RenderPath12fillContainsERKNS_10FloatPointEb
+__ZNK7WebCore13RenderSVGPath12fillContainsERKNS_10FloatPointEb
 __ZNK7WebCore16SVGStyledElement5titleEv
 __ZN7WebCore12RenderObject16positionForPointERKNS_8IntPointE
 __ZN7WebCore26jsSVGAnimatedLengthAnimValEPN3JSC9ExecStateENS0_7JSValueERKNS0_10IdentifierE
@@ -27825,7 +27820,7 @@ __ZN7WebCore24JSSVGAnimatedEnumerationD1Ev
 __ZN7WebCore24JSSVGAnimatedEnumerationD2Ev
 __ZN7WebCore26SVGAnimatedPropertyTearOffIiED0Ev
 __ZN7WebCore26RenderSVGViewportContainer25pointIsInsideViewportClipERKNS_10FloatPointE
-__ZNK7WebCore10RenderPath14strokeContainsERKNS_10FloatPointEb
+__ZNK7WebCore13RenderSVGPath14strokeContainsERKNS_10FloatPointEb
 __ZNK7WebCore4Path14strokeContainsEPNS_18StrokeStyleApplierERKNS_10FloatPointE
 __ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeE
 __ZNK7WebCore13SVGUseElement28instanceForShadowTreeElementEPNS_4NodeEPNS_18SVGElementInstanceE
@@ -27942,7 +27937,7 @@ __ZN7WebCore38jsSVGColorPrototypeFunctionSetRGBColorEPN3JSC9ExecStateEPNS0_8JSOb
 __ZN7WebCore8SVGPaintC1ERKNS_6StringERKNS_5ColorE
 __ZN7WebCore8SVGPaintC2ERKNS_6StringERKNS_5ColorE
 __ZN7WebCore14SVGPathElement19synchronizePropertyERKNS_13QualifiedNameE
-__ZN7WebCore10RenderPath17addFocusRingRectsERN3WTF6VectorINS_7IntRectELm0EEEii
+__ZN7WebCore13RenderSVGPath17addFocusRingRectsERN3WTF6VectorINS_7IntRectELm0EEEii
 __ZN7WebCore18RenderSVGContainer17addFocusRingRectsERN3WTF6VectorINS_7IntRectELm0EEEii
 __ZN7WebCore14RenderSVGImage17addFocusRingRectsERN3WTF6VectorINS_7IntRectELm0EEEii
 __ZN7WebCoreL23fontfacenameConstructorERKNS_13QualifiedNameEPNS_8DocumentEb
diff --git a/WebCore/WebCore.pri b/WebCore/WebCore.pri
index 3331626..051f4d9 100644
--- a/WebCore/WebCore.pri
+++ b/WebCore/WebCore.pri
@@ -156,16 +156,22 @@ IDL_BINDINGS += \
     fileapi/Blob.idl \
     fileapi/BlobBuilder.idl \
     fileapi/DirectoryEntry.idl \
+    fileapi/DirectoryEntrySync.idl \
     fileapi/DirectoryReader.idl \
+    fileapi/DirectoryReaderSync.idl \
     fileapi/DOMFileSystem.idl \
+    fileapi/DOMFileSystemSync.idl \
     fileapi/EntriesCallback.idl \
     fileapi/Entry.idl \
     fileapi/EntryArray.idl \
+    fileapi/EntryArraySync.idl \
     fileapi/EntryCallback.idl \
+    fileapi/EntrySync.idl \
     fileapi/ErrorCallback.idl \
     fileapi/File.idl \
     fileapi/FileCallback.idl \
     fileapi/FileEntry.idl \
+    fileapi/FileEntrySync.idl \
     fileapi/FileError.idl \
     fileapi/FileList.idl \
     fileapi/FileReader.idl \
diff --git a/WebCore/WebCore.pro b/WebCore/WebCore.pro
index 34dc9d0..b73061e 100644
--- a/WebCore/WebCore.pro
+++ b/WebCore/WebCore.pro
@@ -172,7 +172,7 @@ include($$PWD/../JavaScriptCore/JavaScriptCore.pri)
 
 webkit2 {
     include($$PWD/../WebKit2/WebKit2.pri)
-    addWebKit2Lib(../WebKit2)
+    addWebKit2LibWholeArchive(../WebKit2)
 }
 
 # Extract sources to build from the generator definitions
@@ -256,6 +256,7 @@ WEBCORE_INCLUDEPATH = \
     $$PWD/svg/animation \
     $$PWD/svg/graphics \
     $$PWD/svg/graphics/filters \
+    $$PWD/svg/properties \
     $$PWD/websockets \
     $$PWD/wml \
     $$PWD/workers \
@@ -360,7 +361,6 @@ v8 {
         bindings/v8/ScriptObject.cpp \
         bindings/v8/ScriptScope.cpp \
         bindings/v8/ScriptState.cpp \
-        bindings/v8/ScriptStringImpl.cpp \
         bindings/v8/ScriptValue.cpp \
         bindings/v8/StaticDOMDataStore.cpp \
         bindings/v8/SerializedScriptValue.cpp \
@@ -617,7 +617,6 @@ SOURCES += \
     css/CSSFontFaceSource.cpp \
     css/CSSFunctionValue.cpp \
     css/CSSGradientValue.cpp \
-    css/CSSHelper.cpp \
     css/CSSImageValue.cpp \
     css/CSSImageGeneratorValue.cpp \
     css/CSSImportRule.cpp \
@@ -775,6 +774,7 @@ SOURCES += \
     dom/XMLDocumentParserQt.cpp \
     dom/default/PlatformMessagePortChannel.cpp \
     editing/AppendNodeCommand.cpp \
+    editing/ApplyBlockElementCommand.cpp \
     editing/ApplyStyleCommand.cpp \
     editing/BreakBlockquoteCommand.cpp \
     editing/CompositeEditCommand.cpp \
@@ -798,6 +798,7 @@ SOURCES += \
     editing/InsertTextCommand.cpp \
     editing/JoinTextNodesCommand.cpp \
     editing/markup.cpp \
+    editing/MarkupAccumulator.cpp \
     editing/MergeIdenticalElementsCommand.cpp \
     editing/ModifySelectionListLevel.cpp \
     editing/MoveSelectionCommand.cpp \
@@ -838,6 +839,7 @@ SOURCES += \
     history/qt/HistoryItemQt.cpp \
     history/PageCache.cpp \
     html/AsyncImageResizer.cpp \
+    html/BaseDateAndTimeInputType.cpp \
     html/BaseTextInputType.cpp \
     html/ButtonInputType.cpp \
     html/CheckboxInputType.cpp \
@@ -991,7 +993,9 @@ SOURCES += \
     inspector/InjectedScriptHost.cpp \
     inspector/InspectorApplicationCacheAgent.cpp \
     inspector/InspectorBackend.cpp \
+    inspector/InspectorCSSAgent.cpp \
     inspector/InspectorCSSStore.cpp \
+    inspector/InspectorClient.cpp \
     inspector/InspectorController.cpp \
     inspector/InspectorDatabaseResource.cpp \
     inspector/InspectorDebuggerAgent.cpp \
@@ -999,9 +1003,13 @@ SOURCES += \
     inspector/InspectorDOMStorageResource.cpp \
     inspector/InspectorFrontendClientLocal.cpp \
     inspector/InspectorFrontendHost.cpp \
+    inspector/InspectorInstrumentation.cpp \
     inspector/InspectorProfilerAgent.cpp \
     inspector/InspectorResource.cpp \
+    inspector/InspectorResourceAgent.cpp \
+    inspector/InspectorState.cpp \
     inspector/InspectorStorageAgent.cpp \
+    inspector/InspectorStyleSheet.cpp \
     inspector/InspectorTimelineAgent.cpp \
     inspector/InspectorValues.cpp \
     inspector/ScriptBreakpoint.cpp \
@@ -1041,7 +1049,7 @@ SOURCES += \
     loader/PolicyCallback.cpp \
     loader/PolicyChecker.cpp \
     loader/ProgressTracker.cpp \
-    loader/RedirectScheduler.cpp \
+    loader/NavigationScheduler.cpp \
     loader/Request.cpp \
     loader/ResourceLoader.cpp \
     loader/ResourceLoadNotifier.cpp \
@@ -1163,6 +1171,7 @@ SOURCES += \
     platform/graphics/transforms/TranslateTransformOperation.cpp \
     platform/KillRingNone.cpp \
     platform/KURL.cpp \
+    platform/Language.cpp \
     platform/Length.cpp \
     platform/text/LineEnding.cpp \
     platform/LinkHash.cpp \
@@ -1182,6 +1191,7 @@ SOURCES += \
     platform/network/HTTPParsers.cpp \
     platform/network/NetworkStateNotifier.cpp \
     platform/network/ProtectionSpace.cpp \
+    platform/network/ProxyServer.cpp \
     platform/network/ResourceErrorBase.cpp \
     platform/network/ResourceHandle.cpp \
     platform/network/ResourceRequestBase.cpp \
@@ -1196,7 +1206,6 @@ SOURCES += \
     platform/text/SegmentedString.cpp \
     platform/SharedBuffer.cpp \
     platform/text/String.cpp \
-    platform/text/StringBuilder.cpp \
     platform/text/TextCodec.cpp \
     platform/text/TextCodecLatin1.cpp \
     platform/text/TextCodecUserDefined.cpp \
@@ -1391,8 +1400,6 @@ v8 {
         bindings/v8/ScriptScope.h \
         bindings/v8/ScriptSourceCode.h \
         bindings/v8/ScriptState.h \
-        bindings/v8/ScriptString.h \
-        bindings/v8/ScriptStringImpl.h \
         bindings/v8/ScriptValue.h \
         bindings/v8/ScriptWrappable.h \
         bindings/v8/SerializedScriptValue.h \
@@ -1669,6 +1676,7 @@ HEADERS += \
     dom/WheelEvent.h \
     dom/XMLDocumentParser.h \
     editing/AppendNodeCommand.h \
+    editing/ApplyBlockElementCommand.h \
     editing/ApplyStyleCommand.h \
     editing/BreakBlockquoteCommand.h \
     editing/CompositeEditCommand.h \
@@ -1867,15 +1875,20 @@ HEADERS += \
     inspector/InspectorApplicationCacheAgent.h \
     inspector/InspectorBackend.h \
     inspector/InspectorController.h \
+    inspector/InspectorCSSAgent.h \
     inspector/InspectorDatabaseResource.h \
     inspector/InspectorDebuggerAgent.h \
     inspector/InspectorDOMStorageResource.h \
     inspector/InspectorFrontendClient.h \
     inspector/InspectorFrontendClientLocal.h \
     inspector/InspectorFrontendHost.h \
+    inspector/InspectorInstrumentation.h \
     inspector/InspectorProfilerAgent.h \
     inspector/InspectorResource.h \
+    inspector/InspectorResourceAgent.h \
+    inspector/InspectorState.h \
     inspector/InspectorStorageAgent.h \
+    inspector/InspectorStyleSheet.h \
     inspector/InspectorTimelineAgent.h \
     inspector/ScriptGCEventListener.h \
     inspector/TimelineRecordFactory.h \
@@ -2098,12 +2111,14 @@ HEADERS += \
     platform/network/NetworkingContext.h \
     platform/network/NetworkStateNotifier.h \
     platform/network/ProtectionSpace.h \
+    platform/network/ProxyServer.h \
     platform/network/qt/QNetworkReplyHandler.h \
     platform/network/ResourceErrorBase.h \
     platform/network/ResourceHandle.h \
     platform/network/ResourceLoadTiming.h \
     platform/network/ResourceRequestBase.h \
     platform/network/ResourceResponseBase.h \
+    platform/network/ResourceRawHeaders.h \
     platform/PlatformTouchEvent.h \
     platform/PlatformTouchPoint.h \
     platform/PopupMenu.h \
@@ -2130,7 +2145,6 @@ HEADERS += \
     platform/text/qt/TextCodecQt.h \
     platform/text/RegularExpression.h \
     platform/text/SegmentedString.h \
-    platform/text/StringBuilder.h \
     platform/text/TextCodec.h \
     platform/text/TextCodecLatin1.h \
     platform/text/TextCodecUserDefined.h \
@@ -2211,7 +2225,6 @@ HEADERS += \
     rendering/RenderObjectChildList.h \
     rendering/RenderObject.h \
     rendering/RenderPart.h \
-    rendering/RenderPath.h \
     rendering/RenderProgress.h \
     rendering/RenderReplaced.h \
     rendering/RenderReplica.h \
@@ -2228,8 +2241,6 @@ HEADERS += \
     rendering/RenderSVGGradientStop.h \
     rendering/RenderSVGHiddenContainer.h \
     rendering/RenderSVGImage.h \
-    rendering/RenderSVGInline.h \
-    rendering/RenderSVGInlineText.h \
     rendering/RenderSVGModelObject.h \
     rendering/RenderSVGResource.h \
     rendering/RenderSVGResourceClipper.h \
@@ -2245,10 +2256,7 @@ HEADERS += \
     rendering/RenderSVGResourceSolidColor.h \
     rendering/RenderSVGRoot.h \
     rendering/RenderSVGShadowTreeRootContainer.h \
-    rendering/RenderSVGText.h \
-    rendering/RenderSVGTextPath.h \
     rendering/RenderSVGTransformableContainer.h \
-    rendering/RenderSVGTSpan.h \
     rendering/RenderSVGViewportContainer.h \
     rendering/RenderTableCell.h \
     rendering/RenderTableCol.h \
@@ -2294,13 +2302,26 @@ HEADERS += \
     rendering/style/StyleVisualData.h \
     rendering/style/SVGRenderStyleDefs.h \
     rendering/style/SVGRenderStyle.h \
+    rendering/svg/RenderSVGInline.h \
+    rendering/svg/RenderSVGInlineText.h \
+    rendering/svg/RenderSVGPath.h \
+    rendering/svg/RenderSVGTSpan.h \
+    rendering/svg/RenderSVGText.h \
+    rendering/svg/RenderSVGTextPath.h \
+    rendering/svg/SVGInlineFlowBox.h \
+    rendering/svg/SVGInlineTextBox.h \
+    rendering/svg/SVGRootInlineBox.h \
+    rendering/svg/SVGTextChunk.h \
+    rendering/svg/SVGTextChunkBuilder.h \
+    rendering/svg/SVGTextFragment.h \
     rendering/svg/SVGTextLayoutAttributes.h \
-    rendering/svg/SVGTextLayoutBuilder.h \
-    rendering/SVGCharacterData.h \
-    rendering/SVGCharacterLayoutInfo.h \
+    rendering/svg/SVGTextLayoutAttributesBuilder.h \
+    rendering/svg/SVGTextLayoutEngine.h \
+    rendering/svg/SVGTextLayoutEngineBaseline.h \
+    rendering/svg/SVGTextLayoutEngineSpacing.h \
+    rendering/svg/SVGTextMetrics.h \
+    rendering/svg/SVGTextQuery.h \
     rendering/SVGImageBufferTools.h \
-    rendering/SVGInlineFlowBox.h \
-    rendering/SVGInlineTextBox.h \
     rendering/SVGMarkerData.h \
     rendering/SVGMarkerLayoutInfo.h \
     rendering/SVGRenderSupport.h \
@@ -2308,31 +2329,27 @@ HEADERS += \
     rendering/SVGResources.h \
     rendering/SVGResourcesCache.h \
     rendering/SVGResourcesCycleSolver.h \
-    rendering/SVGRootInlineBox.h \
     rendering/SVGShadowTreeElements.h \
-    rendering/SVGTextChunkLayoutInfo.h \
-    rendering/SVGTextLayoutUtilities.h \
-    rendering/SVGTextQuery.h \
     rendering/TextControlInnerElements.h \
     rendering/TransformState.h \
     svg/animation/SMILTimeContainer.h \
     svg/animation/SMILTime.h \
     svg/animation/SVGSMILElement.h \
     svg/ColorDistance.h \
+    svg/DeprecatedSVGAnimatedProperty.h \
+    svg/DeprecatedSVGAnimatedPropertyTraits.h \
+    svg/DeprecatedSVGAnimatedTemplate.h \
     svg/graphics/filters/SVGFEImage.h \
     svg/graphics/filters/SVGFilterBuilder.h \
     svg/graphics/filters/SVGFilter.h \
     svg/graphics/SVGImage.h \
+    svg/properties/SVGAnimatedPropertySynchronizer.h \
     svg/SVGAElement.h \
     svg/SVGAltGlyphElement.h \
     svg/SVGAngle.h \
     svg/SVGAnimateColorElement.h \
     svg/SVGAnimatedPathData.h \
     svg/SVGAnimatedPoints.h \
-    svg/SVGAnimatedProperty.h \
-    svg/SVGAnimatedPropertySynchronizer.h \
-    svg/SVGAnimatedPropertyTraits.h \
-    svg/SVGAnimatedTemplate.h \
     svg/SVGAnimateElement.h \
     svg/SVGAnimateMotionElement.h \
     svg/SVGAnimateTransformElement.h \
@@ -2590,6 +2607,7 @@ SOURCES += \
     platform/network/qt/ResourceHandleQt.cpp \
     platform/network/qt/ResourceRequestQt.cpp \
     platform/network/qt/DnsPrefetchHelper.cpp \
+    platform/network/qt/ProxyServerQt.cpp \
     platform/network/qt/QNetworkReplyHandler.cpp \
     editing/qt/EditorQt.cpp \
     editing/qt/SmartReplaceQt.cpp \
@@ -2625,7 +2643,7 @@ SOURCES += \
     platform/qt/SharedTimerQt.cpp \
     platform/qt/SoundQt.cpp \
     platform/qt/LoggingQt.cpp \
-    platform/qt/Language.cpp \
+    platform/qt/LanguageQt.cpp \
     platform/qt/TemporaryLinkStubsQt.cpp \
     platform/text/qt/TextBoundariesQt.cpp \
     platform/text/qt/TextBreakIteratorQt.cpp \
@@ -2666,10 +2684,9 @@ SOURCES += \
     ../WebKit/qt/Api/qwebinspector.cpp \
     ../WebKit/qt/Api/qwebkitversion.cpp
 
-
 contains(DEFINES, WTF_USE_QT_MOBILE_THEME=1) {
-    HEADERS += platform/qt/Maemo5Webstyle.h
-    SOURCES += platform/qt/Maemo5Webstyle.cpp
+    HEADERS += platform/qt/QtMobileWebStyle.h
+    SOURCES += platform/qt/QtMobileWebStyle.cpp
 }
 
 maemo5 {
@@ -2702,6 +2719,11 @@ maemo5 {
         LIBS += -lole32
     }
 
+contains (CONFIG, text_breaking_with_icu) {
+    SOURCES += platform/text/TextBreakIteratorICU.cpp
+    LIBS += -licuuc
+}
+
 contains(DEFINES, ENABLE_NETSCAPE_PLUGIN_API=1) {
 
     SOURCES += plugins/npapi.cpp
@@ -2965,16 +2987,25 @@ contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
     HEADERS += \
         fileapi/AsyncFileWriter.h \
         fileapi/DirectoryEntry.h \
+        fileapi/DirectoryEntrySync.h \
         fileapi/DirectoryReader.h \
+        fileapi/DirectoryReaderBase.h \
+        fileapi/DirectoryReaderSync.h \
         fileapi/DOMFilePath.h \
         fileapi/DOMFileSystem.h \
+        fileapi/DOMFileSystemBase.h \
+        fileapi/DOMFileSystemSync.h \
         fileapi/EntriesCallback.h \
         fileapi/Entry.h \
         fileapi/EntryArray.h \
+        fileapi/EntryArraySync.h \
+        fileapi/EntryBase.h \
         fileapi/EntryCallback.h \
+        fileapi/EntrySync.h \
         fileapi/ErrorCallback.h \
         fileapi/FileCallback.h \
         fileapi/FileEntry.h \
+        fileapi/FileEntrySync.h \
         fileapi/FileSystemCallback.h \
         fileapi/FileSystemCallbacks.h \
         fileapi/FileWriter.h \
@@ -2989,14 +3020,23 @@ contains(DEFINES, ENABLE_FILE_SYSTEM=1) {
 
     SOURCES += \
         bindings/js/JSDirectoryEntryCustom.cpp \
+        bindings/js/JSDirectoryEntrySyncCustom.cpp \
         bindings/js/JSEntryCustom.cpp \
+        bindings/js/JSEntrySyncCustom.cpp \
         fileapi/DirectoryEntry.cpp \
+        fileapi/DirectoryEntrySync.cpp \
         fileapi/DirectoryReader.cpp \
+        fileapi/DirectoryReaderSync.cpp \
         fileapi/DOMFilePath.cpp \
         fileapi/DOMFileSystem.cpp \
+        fileapi/DOMFileSystemBase.cpp \
+        fileapi/DOMFileSystemSync.cpp \
         fileapi/Entry.cpp \
         fileapi/EntryArray.cpp \
+        fileapi/EntryArraySync.cpp \
+        fileapi/EntrySync.cpp \
         fileapi/FileEntry.cpp \
+        fileapi/FileEntrySync.cpp \
         fileapi/FileSystemCallbacks.cpp \
         fileapi/FileWriter.cpp \
         fileapi/LocalFileSystem.cpp \
@@ -3258,6 +3298,24 @@ contains(DEFINES, ENABLE_GEOLOCATION=1) {
     }
 }
 
+contains(DEFINES, ENABLE_DEVICE_ORIENTATION=1) {
+    HEADERS += \
+        ../WebKit/qt/WebCoreSupport/DeviceMotionClientQt.h \
+        ../WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.h \
+        ../WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.h \
+        ../WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.h \
+        bindings/generic/RuntimeEnabledFeatures.h
+    SOURCES += \
+        ../WebKit/qt/WebCoreSupport/DeviceMotionClientQt.cpp \
+        ../WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.cpp \
+        ../WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.cpp \
+        ../WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.cpp \
+        bindings/generic/RuntimeEnabledFeatures.cpp
+
+    CONFIG += mobility
+    MOBILITY += sensors
+}
+
 contains(DEFINES, ENABLE_SVG=1) {
     !v8 {
         SOURCES += \
@@ -3275,8 +3333,24 @@ contains(DEFINES, ENABLE_SVG=1) {
         css/SVGCSSStyleSelector.cpp \
         rendering/style/SVGRenderStyle.cpp \
         rendering/style/SVGRenderStyleDefs.cpp \
+        rendering/svg/RenderSVGInline.cpp \
+        rendering/svg/RenderSVGInlineText.cpp \
+        rendering/svg/RenderSVGPath.cpp \
+        rendering/svg/RenderSVGTSpan.cpp \
+        rendering/svg/RenderSVGText.cpp \
+        rendering/svg/RenderSVGTextPath.cpp \
+        rendering/svg/SVGInlineFlowBox.cpp \
+        rendering/svg/SVGInlineTextBox.cpp \
+        rendering/svg/SVGRootInlineBox.cpp \
+        rendering/svg/SVGTextChunk.cpp \
+        rendering/svg/SVGTextChunkBuilder.cpp \
         rendering/svg/SVGTextLayoutAttributes.cpp \
-        rendering/svg/SVGTextLayoutBuilder.cpp \
+        rendering/svg/SVGTextLayoutAttributesBuilder.cpp \
+        rendering/svg/SVGTextLayoutEngine.cpp \
+        rendering/svg/SVGTextLayoutEngineBaseline.cpp \
+        rendering/svg/SVGTextLayoutEngineSpacing.cpp \
+        rendering/svg/SVGTextMetrics.cpp \
+        rendering/svg/SVGTextQuery.cpp \
         rendering/PointerEventsHitRules.cpp \
         svg/SVGDocumentExtensions.cpp \
         svg/SVGImageLoader.cpp \
@@ -3431,14 +3505,11 @@ contains(DEFINES, ENABLE_SVG=1) {
         svg/graphics/filters/SVGFilterBuilder.cpp \
         svg/graphics/SVGImage.cpp \
         rendering/RenderForeignObject.cpp \
-        rendering/RenderPath.cpp \
         rendering/RenderSVGBlock.cpp \
         rendering/RenderSVGContainer.cpp \
         rendering/RenderSVGGradientStop.cpp \
         rendering/RenderSVGHiddenContainer.cpp \
         rendering/RenderSVGImage.cpp \
-        rendering/RenderSVGInline.cpp \
-        rendering/RenderSVGInlineText.cpp \
         rendering/RenderSVGModelObject.cpp \
         rendering/RenderSVGResource.cpp \
         rendering/RenderSVGResourceClipper.cpp \
@@ -3454,26 +3525,15 @@ contains(DEFINES, ENABLE_SVG=1) {
         rendering/RenderSVGResourceSolidColor.cpp \
         rendering/RenderSVGRoot.cpp \
         rendering/RenderSVGShadowTreeRootContainer.cpp \
-        rendering/RenderSVGText.cpp \
-        rendering/RenderSVGTextPath.cpp \
         rendering/RenderSVGTransformableContainer.cpp \
-        rendering/RenderSVGTSpan.cpp \
         rendering/RenderSVGViewportContainer.cpp \
-        rendering/SVGCharacterData.cpp \
-        rendering/SVGCharacterLayoutInfo.cpp \
         rendering/SVGImageBufferTools.cpp \
-        rendering/SVGInlineFlowBox.cpp \
-        rendering/SVGInlineTextBox.cpp \
         rendering/SVGMarkerLayoutInfo.cpp \
         rendering/SVGRenderSupport.cpp \
         rendering/SVGResources.cpp \
         rendering/SVGResourcesCache.cpp \
         rendering/SVGResourcesCycleSolver.cpp \
-        rendering/SVGRootInlineBox.cpp \
-        rendering/SVGShadowTreeElements.cpp \
-        rendering/SVGTextChunkLayoutInfo.cpp \
-        rendering/SVGTextLayoutUtilities.cpp \
-        rendering/SVGTextQuery.cpp
+        rendering/SVGShadowTreeElements.cpp
 }
 
 contains(DEFINES, ENABLE_JAVASCRIPT_DEBUGGER=1) {
diff --git a/WebCore/WebCore.vcproj/WebCore.vcproj b/WebCore/WebCore.vcproj/WebCore.vcproj
index 1971e15..b7996e5 100644
--- a/WebCore/WebCore.vcproj/WebCore.vcproj
+++ b/WebCore/WebCore.vcproj/WebCore.vcproj
@@ -67,7 +67,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -123,7 +122,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -178,7 +176,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -233,7 +230,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -289,7 +285,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 		<Configuration

@@ -344,7 +339,6 @@
 			/>

 			<Tool

 				Name="VCPostBuildEventTool"

-				CommandLine="cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;"

 			/>

 		</Configuration>

 	</Configurations>

@@ -355,6 +349,10 @@
 			Name="DerivedSources"

 			>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\ColorData.cpp"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSGrammar.cpp"

 				>

 				<FileConfiguration

@@ -423,6 +421,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSPropertyNames.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSValueKeywords.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\DerivedSources.cpp"

 				>

 				<FileConfiguration

@@ -481,6 +487,14 @@
 				</FileConfiguration>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\DocTypeStrings.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HashTools.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HTMLElementFactory.cpp"

 				>

 				<FileConfiguration

@@ -545,26 +559,6 @@
 				>

 			</File>

 			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\HashTools.h"

-				>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\DocTypeStrings.cpp"

-				>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSValueKeywords.cpp"

-				>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\CSSPropertyNames.cpp"

-				>

-			</File>

-			<File

-				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\ColorData.cpp"

-				>

-			</File>

-			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\InspectorBackendDispatcher.cpp"

 				>

 			</File>

@@ -3101,6 +3095,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDirectoryEntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDirectoryEntrySync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDirectoryReader.cpp"

 				>

 				<FileConfiguration

@@ -3157,6 +3159,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDirectoryReaderSync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDirectoryReaderSync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDocument.cpp"

 				>

 				<FileConfiguration

@@ -3493,6 +3503,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMFileSystemSync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMFileSystemSync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMFormData.cpp"

 				>

 				<FileConfiguration

@@ -4055,6 +4073,54 @@
 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMTokenList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSDOMTokenList.h"

@@ -4457,6 +4523,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntryArraySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntryArraySync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntryCallback.cpp"

 				>

 				<FileConfiguration

@@ -4513,6 +4587,14 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSEntrySync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSErrorCallback.cpp"

 				>

 				<FileConfiguration

@@ -4857,6 +4939,22 @@
 				>

 			</File>

 			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileEntry.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileEntry.h"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileEntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileEntrySync.h"

+				>

+			</File>

+			<File

 				RelativePath="$(WebKitOutputDir)\obj\$(ProjectName)\DerivedSources\JSFileError.cpp"

 				>

 				<FileConfiguration

@@ -23745,6 +23843,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\loader\NavigationScheduler.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\loader\NavigationScheduler.h"

+				>

+			</File>

+			<File

 				RelativePath="..\loader\NetscapePlugInStreamLoader.cpp"

 				>

 			</File>

@@ -23793,14 +23899,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\loader\RedirectScheduler.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\loader\RedirectScheduler.h"

-				>

-			</File>

-			<File

 				RelativePath="..\loader\Request.cpp"

 				>

 			</File>

@@ -23928,14 +24026,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\loader\icon\IconFetcher.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\loader\icon\IconFetcher.h"

-					>

-				</File>

-				<File

 					RelativePath="..\loader\icon\IconLoader.cpp"

 					>

 				</File>

@@ -24229,6 +24319,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\platform\Language.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\platform\Language.h"

 				>

 			</File>

@@ -24648,7 +24742,7 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\win\Language.cpp"

+					RelativePath="..\platform\win\LanguageWin.cpp"

 					>

 				</File>

 				<File

@@ -24948,6 +25042,78 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\graphics\ContextShadow.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\platform\graphics\ContextShadow.h"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCustomBuildTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

 					RelativePath="..\platform\graphics\FloatPoint.cpp"

 					>

 				</File>

@@ -26463,6 +26629,42 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\graphics\cairo\ContextShadowCairo.cpp"

+						>

+						<FileConfiguration

+							Name="Debug|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_Internal|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\graphics\cairo\DrawErrorUnderline.h"

 						>

 						<FileConfiguration

@@ -27243,14 +27445,6 @@
 						>

 					</File>

 					<File

-						RelativePath="..\platform\graphics\filters\ImageBufferFilter.cpp"

-						>

-					</File>

-					<File

-						RelativePath="..\platform\graphics\filters\ImageBufferFilter.h"

-						>

-					</File>

-					<File

 						RelativePath="..\platform\graphics\filters\LightSource.cpp"

 						>

 					</File>

@@ -27348,6 +27542,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\DataURL.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\DataURL.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\FormData.cpp"

 					>

 				</File>

@@ -27404,6 +27606,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\ProxyServer.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\platform\network\ProxyServer.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\ResourceErrorBase.cpp"

 					>

 				</File>

@@ -27432,6 +27642,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\platform\network\ResourceRawHeaders.h"

+					>

+				</File>

+				<File

 					RelativePath="..\platform\network\ResourceRequestBase.cpp"

 					>

 				</File>

@@ -27619,6 +27833,26 @@
 						>

 					</File>

 					<File

+						RelativePath="..\platform\network\cf\ProxyServerCFNet.cpp"

+						>

+						<FileConfiguration

+							Name="Debug_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release_Cairo|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\network\cf\ResourceError.h"

 						>

 						<FileConfiguration

@@ -28091,6 +28325,42 @@
 						</FileConfiguration>

 					</File>

 					<File

+						RelativePath="..\platform\network\curl\ProxyServerCurl.cpp"

+						>

+						<FileConfiguration

+							Name="Debug|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Release|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_Internal|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+						<FileConfiguration

+							Name="Debug_All|Win32"

+							ExcludedFromBuild="true"

+							>

+							<Tool

+								Name="VCCLCompilerTool"

+							/>

+						</FileConfiguration>

+					</File>

+					<File

 						RelativePath="..\platform\network\curl\ResourceError.h"

 						>

 						<FileConfiguration

@@ -28468,18 +28738,6 @@
 					>

 				</File>

 				<File

-					RelativePath="..\platform\text\StringBuffer.h"

-					>

-				</File>

-				<File

-					RelativePath="..\platform\text\StringBuilder.cpp"

-					>

-				</File>

-				<File

-					RelativePath="..\platform\text\StringBuilder.h"

-					>

-				</File>

-				<File

 					RelativePath="..\platform\text\StringHash.h"

 					>

 				</File>

@@ -29633,10 +29891,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\css\CSSHelper.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\css\CSSHelper.h"

 				>

 			</File>

@@ -30111,6 +30365,54 @@
 			<File

 				RelativePath="..\rendering\AutoTableLayout.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\AutoTableLayout.h"

@@ -30119,6 +30421,54 @@
 			<File

 				RelativePath="..\rendering\BidiRun.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\BidiRun.h"

@@ -30127,6 +30477,54 @@
 			<File

 				RelativePath="..\rendering\break_lines.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\break_lines.h"

@@ -30135,6 +30533,54 @@
 			<File

 				RelativePath="..\rendering\CounterNode.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\CounterNode.h"

@@ -30143,6 +30589,54 @@
 			<File

 				RelativePath="..\rendering\EllipsisBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\EllipsisBox.h"

@@ -30151,6 +30645,54 @@
 			<File

 				RelativePath="..\rendering\FixedTableLayout.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\FixedTableLayout.h"

@@ -30167,6 +30709,54 @@
 			<File

 				RelativePath="..\rendering\HitTestResult.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\HitTestResult.h"

@@ -30175,6 +30765,54 @@
 			<File

 				RelativePath="..\rendering\InlineBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineBox.h"

@@ -30183,6 +30821,54 @@
 			<File

 				RelativePath="..\rendering\InlineFlowBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineFlowBox.h"

@@ -30195,6 +30881,54 @@
 			<File

 				RelativePath="..\rendering\InlineTextBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\InlineTextBox.h"

@@ -30203,6 +30937,54 @@
 			<File

 				RelativePath="..\rendering\LayoutState.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\LayoutState.h"

@@ -30211,6 +30993,54 @@
 			<File

 				RelativePath="..\rendering\MediaControlElements.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\MediaControlElements.h"

@@ -30227,6 +31057,54 @@
 			<File

 				RelativePath="..\rendering\PointerEventsHitRules.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\PointerEventsHitRules.h"

@@ -30235,6 +31113,54 @@
 			<File

 				RelativePath="..\rendering\RenderApplet.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderApplet.h"

@@ -30243,6 +31169,54 @@
 			<File

 				RelativePath="..\rendering\RenderArena.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderArena.h"

@@ -30251,6 +31225,54 @@
 			<File

 				RelativePath="..\rendering\RenderBlock.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBlock.h"

@@ -30259,10 +31281,106 @@
 			<File

 				RelativePath="..\rendering\RenderBlockLineLayout.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBox.h"

@@ -30271,6 +31389,54 @@
 			<File

 				RelativePath="..\rendering\RenderBoxModelObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBoxModelObject.h"

@@ -30279,6 +31445,54 @@
 			<File

 				RelativePath="..\rendering\RenderBR.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderBR.h"

@@ -30287,6 +31501,54 @@
 			<File

 				RelativePath="..\rendering\RenderButton.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderButton.h"

@@ -30295,6 +31557,54 @@
 			<File

 				RelativePath="..\rendering\RenderCounter.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderCounter.h"

@@ -30303,6 +31613,54 @@
 			<File

 				RelativePath="..\rendering\RenderDataGrid.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderDataGrid.h"

@@ -30311,6 +31669,54 @@
 			<File

 				RelativePath="..\rendering\RenderEmbeddedObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderEmbeddedObject.h"

@@ -30319,6 +31725,54 @@
 			<File

 				RelativePath="..\rendering\RenderFieldset.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFieldset.h"

@@ -30327,6 +31781,54 @@
 			<File

 				RelativePath="..\rendering\RenderFileUploadControl.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFileUploadControl.h"

@@ -30335,6 +31837,54 @@
 			<File

 				RelativePath="..\rendering\RenderFlexibleBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFlexibleBox.h"

@@ -30343,6 +31893,54 @@
 			<File

 				RelativePath="..\rendering\RenderForeignObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderForeignObject.h"

@@ -30351,6 +31949,54 @@
 			<File

 				RelativePath="..\rendering\RenderFrame.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFrame.h"

@@ -30359,6 +32005,54 @@
 			<File

 				RelativePath="..\rendering\RenderFrameBase.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFrameBase.h"

@@ -30367,6 +32061,54 @@
 			<File

 				RelativePath="..\rendering\RenderFrameSet.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderFrameSet.h"

@@ -30375,6 +32117,54 @@
 			<File

 				RelativePath="..\rendering\RenderHTMLCanvas.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderHTMLCanvas.h"

@@ -30383,6 +32173,54 @@
 			<File

 				RelativePath="..\rendering\RenderIFrame.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderIFrame.h"

@@ -30391,6 +32229,54 @@
 			<File

 				RelativePath="..\rendering\RenderImage.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderImage.h"

@@ -30399,6 +32285,54 @@
 			<File

 				RelativePath="..\rendering\RenderImageResource.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderImageResource.h"

@@ -30407,6 +32341,54 @@
 			<File

 				RelativePath="..\rendering\RenderImageResourceStyleImage.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderImageResourceStyleImage.h"

@@ -30415,14 +32397,114 @@
 			<File

 				RelativePath="..\rendering\RenderIndicator.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderIndicator.h"

 				>

 			</File>

 			<File

+				RelativePath="..\rendering\RenderingAllInOne.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\rendering\RenderInline.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderInline.h"

@@ -30431,6 +32513,54 @@
 			<File

 				RelativePath="..\rendering\RenderLayer.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderLayer.h"

@@ -30447,6 +32577,54 @@
 			<File

 				RelativePath="..\rendering\RenderLayerCompositor.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderLayerCompositor.h"

@@ -30455,6 +32633,54 @@
 			<File

 				RelativePath="..\rendering\RenderLineBoxList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderLineBoxList.h"

@@ -30463,6 +32689,54 @@
 			<File

 				RelativePath="..\rendering\RenderListBox.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListBox.h"

@@ -30471,6 +32745,54 @@
 			<File

 				RelativePath="..\rendering\RenderListItem.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListItem.h"

@@ -30479,6 +32801,54 @@
 			<File

 				RelativePath="..\rendering\RenderListMarker.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderListMarker.h"

@@ -30487,6 +32857,54 @@
 			<File

 				RelativePath="..\rendering\RenderMarquee.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMarquee.h"

@@ -30495,6 +32913,54 @@
 			<File

 				RelativePath="..\rendering\RenderMedia.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMedia.h"

@@ -30504,6 +32970,30 @@
 				RelativePath="..\rendering\RenderMediaControls.cpp"

 				>

 				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

 					Name="Debug_Cairo|Win32"

 					ExcludedFromBuild="true"

 					>

@@ -30519,6 +33009,14 @@
 						Name="VCCLCompilerTool"

 					/>

 				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMediaControls.h"

@@ -30543,6 +33041,54 @@
 			<File

 				RelativePath="..\rendering\RenderMenuList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMenuList.h"

@@ -30551,6 +33097,54 @@
 			<File

 				RelativePath="..\rendering\RenderMeter.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderMeter.h"

@@ -30559,6 +33153,54 @@
 			<File

 				RelativePath="..\rendering\RenderObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderObject.h"

@@ -30567,6 +33209,54 @@
 			<File

 				RelativePath="..\rendering\RenderObjectChildList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderObjectChildList.h"

@@ -30575,22 +33265,110 @@
 			<File

 				RelativePath="..\rendering\RenderPart.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderPart.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderPath.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderPath.h"

-				>

-			</File>

-			<File

 				RelativePath="..\rendering\RenderProgress.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderProgress.h"

@@ -30599,6 +33377,54 @@
 			<File

 				RelativePath="..\rendering\RenderReplaced.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderReplaced.h"

@@ -30607,6 +33433,54 @@
 			<File

 				RelativePath="..\rendering\RenderReplica.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderReplica.h"

@@ -30615,6 +33489,54 @@
 			<File

 				RelativePath="..\rendering\RenderRuby.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderRuby.h"

@@ -30623,6 +33545,54 @@
 			<File

 				RelativePath="..\rendering\RenderRubyBase.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderRubyBase.h"

@@ -30631,6 +33601,54 @@
 			<File

 				RelativePath="..\rendering\RenderRubyRun.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderRubyRun.h"

@@ -30639,6 +33657,54 @@
 			<File

 				RelativePath="..\rendering\RenderRubyText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderRubyText.h"

@@ -30647,6 +33713,54 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbar.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderScrollbar.h"

@@ -30655,6 +33769,54 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbarPart.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderScrollbarPart.h"

@@ -30663,30 +33825,6 @@
 			<File

 				RelativePath="..\rendering\RenderScrollbarTheme.cpp"

 				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderScrollbarTheme.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSelectionInfo.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSlider.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSlider.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSVGAllInOne.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSVGBlock.cpp"

-				>

 				<FileConfiguration

 					Name="Debug|Win32"

 					ExcludedFromBuild="true"

@@ -30737,11 +33875,15 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGBlock.h"

+				RelativePath="..\rendering\RenderScrollbarTheme.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGContainer.cpp"

+				RelativePath="..\rendering\RenderSelectionInfo.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderSlider.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -30793,11 +33935,15 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGContainer.h"

+				RelativePath="..\rendering\RenderSlider.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGGradientStop.cpp"

+				RelativePath="..\rendering\RenderSVGAllInOne.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\RenderSVGBlock.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -30849,11 +33995,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGGradientStop.h"

+				RelativePath="..\rendering\RenderSVGBlock.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGHiddenContainer.cpp"

+				RelativePath="..\rendering\RenderSVGContainer.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -30905,11 +34051,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGHiddenContainer.h"

+				RelativePath="..\rendering\RenderSVGContainer.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGImage.cpp"

+				RelativePath="..\rendering\RenderSVGGradientStop.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -30961,11 +34107,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGImage.h"

+				RelativePath="..\rendering\RenderSVGGradientStop.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGInline.cpp"

+				RelativePath="..\rendering\RenderSVGHiddenContainer.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -31017,11 +34163,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGInline.h"

+				RelativePath="..\rendering\RenderSVGHiddenContainer.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGInlineText.cpp"

+				RelativePath="..\rendering\RenderSVGImage.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -31073,7 +34219,7 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGInlineText.h"

+				RelativePath="..\rendering\RenderSVGImage.h"

 				>

 			</File>

 			<File

@@ -31917,7 +35063,7 @@
 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGText.cpp"

+				RelativePath="..\rendering\RenderSVGTransformableContainer.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -31969,11 +35115,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGText.h"

+				RelativePath="..\rendering\RenderSVGTransformableContainer.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGTextPath.cpp"

+				RelativePath="..\rendering\RenderSVGViewportContainer.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32025,11 +35171,7 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGTextPath.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderSVGTransformableContainer.cpp"

+				RelativePath="..\rendering\RenderTable.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32081,11 +35223,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGTransformableContainer.h"

+				RelativePath="..\rendering\RenderTable.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGTSpan.cpp"

+				RelativePath="..\rendering\RenderTableCell.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32137,11 +35279,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGTSpan.h"

+				RelativePath="..\rendering\RenderTableCell.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderSVGViewportContainer.cpp"

+				RelativePath="..\rendering\RenderTableCol.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32193,32 +35335,60 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\RenderTable.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderTable.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderTableCell.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderTableCell.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderTableCol.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\rendering\RenderTableCol.h"

 				>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableRow.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableRow.h"

@@ -32227,6 +35397,54 @@
 			<File

 				RelativePath="..\rendering\RenderTableSection.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTableSection.h"

@@ -32235,6 +35453,54 @@
 			<File

 				RelativePath="..\rendering\RenderText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderText.h"

@@ -32243,6 +35509,54 @@
 			<File

 				RelativePath="..\rendering\RenderTextControl.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControl.h"

@@ -32251,6 +35565,54 @@
 			<File

 				RelativePath="..\rendering\RenderTextControlMultiLine.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControlMultiLine.h"

@@ -32259,6 +35621,54 @@
 			<File

 				RelativePath="..\rendering\RenderTextControlSingleLine.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextControlSingleLine.h"

@@ -32267,6 +35677,54 @@
 			<File

 				RelativePath="..\rendering\RenderTextFragment.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTextFragment.h"

@@ -32275,6 +35733,54 @@
 			<File

 				RelativePath="..\rendering\RenderTheme.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderTheme.h"

@@ -32323,6 +35829,54 @@
 			<File

 				RelativePath="..\rendering\RenderThemeWin.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\RenderThemeWin.h"

@@ -32373,70 +35927,6 @@
 			<File

 				RelativePath="..\rendering\RenderTreeAsText.cpp"

 				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderTreeAsText.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderVideo.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderVideo.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderView.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderView.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderWidget.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderWidget.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderWordBreak.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RenderWordBreak.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RootInlineBox.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\RootInlineBox.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\ScrollBehavior.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\ScrollBehavior.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\ShadowElement.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\ShadowElement.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\SVGCharacterData.cpp"

-				>

 				<FileConfiguration

 					Name="Debug|Win32"

 					ExcludedFromBuild="true"

@@ -32487,11 +35977,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGCharacterData.h"

+				RelativePath="..\rendering\RenderTreeAsText.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGCharacterLayoutInfo.cpp"

+				RelativePath="..\rendering\RenderVideo.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32543,11 +36033,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGCharacterLayoutInfo.h"

+				RelativePath="..\rendering\RenderVideo.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGInlineFlowBox.cpp"

+				RelativePath="..\rendering\RenderView.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32599,11 +36089,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGInlineFlowBox.h"

+				RelativePath="..\rendering\RenderView.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGInlineTextBox.cpp"

+				RelativePath="..\rendering\RenderWidget.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32655,15 +36145,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGInlineTextBox.h"

-				>

-			</File>

-			<File

-				RelativePath="..\rendering\SVGMarkerData.h"

+				RelativePath="..\rendering\RenderWidget.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGMarkerLayoutInfo.cpp"

+				RelativePath="..\rendering\RenderWordBreak.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32715,11 +36201,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGMarkerLayoutInfo.h"

+				RelativePath="..\rendering\RenderWordBreak.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRenderSupport.cpp"

+				RelativePath="..\rendering\RootInlineBox.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32771,11 +36257,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRenderSupport.h"

+				RelativePath="..\rendering\RootInlineBox.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRenderTreeAsText.cpp"

+				RelativePath="..\rendering\ScrollBehavior.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32827,11 +36313,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRenderTreeAsText.h"

+				RelativePath="..\rendering\ScrollBehavior.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResources.cpp"

+				RelativePath="..\rendering\ShadowElement.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32883,11 +36369,15 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResources.h"

+				RelativePath="..\rendering\ShadowElement.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResourcesCache.cpp"

+				RelativePath="..\rendering\SVGMarkerData.h"

+				>

+			</File>

+			<File

+				RelativePath="..\rendering\SVGMarkerLayoutInfo.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32939,11 +36429,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResourcesCache.h"

+				RelativePath="..\rendering\SVGMarkerLayoutInfo.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResourcesCycleSolver.cpp"

+				RelativePath="..\rendering\SVGRenderSupport.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -32995,11 +36485,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGResourcesCycleSolver.h"

+				RelativePath="..\rendering\SVGRenderSupport.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRootInlineBox.cpp"

+				RelativePath="..\rendering\SVGRenderTreeAsText.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -33051,11 +36541,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGRootInlineBox.h"

+				RelativePath="..\rendering\SVGRenderTreeAsText.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGShadowTreeElements.cpp"

+				RelativePath="..\rendering\SVGResources.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -33107,11 +36597,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGShadowTreeElements.h"

+				RelativePath="..\rendering\SVGResources.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextChunkLayoutInfo.cpp"

+				RelativePath="..\rendering\SVGResourcesCache.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -33163,11 +36653,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextChunkLayoutInfo.h"

+				RelativePath="..\rendering\SVGResourcesCache.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextLayoutUtilities.cpp"

+				RelativePath="..\rendering\SVGResourcesCycleSolver.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -33219,11 +36709,11 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextLayoutUtilities.h"

+				RelativePath="..\rendering\SVGResourcesCycleSolver.h"

 				>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextQuery.cpp"

+				RelativePath="..\rendering\SVGShadowTreeElements.cpp"

 				>

 				<FileConfiguration

 					Name="Debug|Win32"

@@ -33275,7 +36765,7 @@
 				</FileConfiguration>

 			</File>

 			<File

-				RelativePath="..\rendering\SVGTextQuery.h"

+				RelativePath="..\rendering\SVGShadowTreeElements.h"

 				>

 			</File>

 			<File

@@ -33285,6 +36775,54 @@
 			<File

 				RelativePath="..\rendering\TextControlInnerElements.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\TextControlInnerElements.h"

@@ -33297,6 +36835,54 @@
 			<File

 				RelativePath="..\rendering\TransformState.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\rendering\TransformState.h"

@@ -33320,6 +36906,54 @@
 				<File

 					RelativePath="..\rendering\style\ContentData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\ContentData.h"

@@ -33332,6 +36966,54 @@
 				<File

 					RelativePath="..\rendering\style\CounterDirectives.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\CounterDirectives.h"

@@ -33352,6 +37034,54 @@
 				<File

 					RelativePath="..\rendering\style\FillLayer.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\FillLayer.h"

@@ -33360,6 +37090,54 @@
 				<File

 					RelativePath="..\rendering\style\KeyframeList.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\KeyframeList.h"

@@ -33368,6 +37146,54 @@
 				<File

 					RelativePath="..\rendering\style\NinePieceImage.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\NinePieceImage.h"

@@ -33380,6 +37206,54 @@
 				<File

 					RelativePath="..\rendering\style\RenderStyle.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\RenderStyle.h"

@@ -33392,14 +37266,114 @@
 				<File

 					RelativePath="..\rendering\style\ShadowData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\ShadowData.h"

 					>

 				</File>

 				<File

+					RelativePath="..\rendering\style\StyleAllInOne.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\rendering\style\StyleBackgroundData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleBackgroundData.h"

@@ -33408,6 +37382,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleBoxData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleBoxData.h"

@@ -33416,6 +37438,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleCachedImage.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleCachedImage.h"

@@ -33424,6 +37494,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleFlexibleBoxData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleFlexibleBoxData.h"

@@ -33432,6 +37550,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleGeneratedImage.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleGeneratedImage.h"

@@ -33444,6 +37610,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleInheritedData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleInheritedData.h"

@@ -33452,6 +37666,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleMarqueeData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleMarqueeData.h"

@@ -33460,6 +37722,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleMultiColData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleMultiColData.h"

@@ -33472,6 +37782,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleRareInheritedData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleRareInheritedData.h"

@@ -33480,6 +37838,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleRareNonInheritedData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleRareNonInheritedData.h"

@@ -33492,6 +37898,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleSurroundData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleSurroundData.h"

@@ -33500,6 +37954,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleTransformData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleTransformData.h"

@@ -33508,6 +38010,54 @@
 				<File

 					RelativePath="..\rendering\style\StyleVisualData.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\StyleVisualData.h"

@@ -33516,6 +38066,54 @@
 				<File

 					RelativePath="..\rendering\style\SVGRenderStyle.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\SVGRenderStyle.h"

@@ -33524,6 +38122,54 @@
 				<File

 					RelativePath="..\rendering\style\SVGRenderStyleDefs.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\style\SVGRenderStyleDefs.h"

@@ -33534,19 +38180,967 @@
 				Name="svg"

 				>

 				<File

+					RelativePath="..\rendering\svg\RenderSVGInline.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGInline.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGInlineText.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGInlineText.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGPath.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGPath.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGText.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGText.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGTextPath.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGTextPath.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGTSpan.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\RenderSVGTSpan.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGInlineFlowBox.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGInlineFlowBox.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGInlineTextBox.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGInlineTextBox.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGRootInlineBox.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGRootInlineBox.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextChunk.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextChunk.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextChunkBuilder.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextChunkBuilder.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextFragment.h"

+					>

+				</File>

+				<File

 					RelativePath="..\rendering\svg\SVGTextLayoutAttributes.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

 					RelativePath="..\rendering\svg\SVGTextLayoutAttributes.h"

 					>

 				</File>

 				<File

-					RelativePath="..\rendering\svg\SVGTextLayoutBuilder.cpp"

+					RelativePath="..\rendering\svg\SVGTextLayoutAttributesBuilder.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutAttributesBuilder.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutEngine.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutEngine.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutEngineBaseline.cpp"

 					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

 				</File>

 				<File

-					RelativePath="..\rendering\svg\SVGTextLayoutBuilder.h"

+					RelativePath="..\rendering\svg\SVGTextLayoutEngineBaseline.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutEngineSpacing.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextLayoutEngineSpacing.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextMetrics.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextMetrics.h"

+					>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextQuery.cpp"

+					>

+					<FileConfiguration

+						Name="Debug|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Internal|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Release_Cairo|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+					<FileConfiguration

+						Name="Debug_All|Win32"

+						ExcludedFromBuild="true"

+						>

+						<Tool

+							Name="VCCLCompilerTool"

+						/>

+					</FileConfiguration>

+				</File>

+				<File

+					RelativePath="..\rendering\svg\SVGTextQuery.h"

 					>

 				</File>

 			</Filter>

@@ -33843,6 +39437,54 @@
 			<File

 				RelativePath="..\dom\ActiveDOMObject.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ActiveDOMObject.h"

@@ -33851,6 +39493,54 @@
 			<File

 				RelativePath="..\dom\AsyncScriptRunner.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\AsyncScriptRunner.h"

@@ -33863,6 +39553,54 @@
 			<File

 				RelativePath="..\dom\Attr.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Attr.h"

@@ -33871,6 +39609,54 @@
 			<File

 				RelativePath="..\dom\Attribute.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Attribute.h"

@@ -33883,6 +39669,54 @@
 			<File

 				RelativePath="..\dom\BeforeProcessEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\BeforeProcessEvent.h"

@@ -33891,6 +39725,54 @@
 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\BeforeTextInsertedEvent.h"

@@ -33899,6 +39781,54 @@
 			<File

 				RelativePath="..\dom\BeforeUnloadEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\BeforeUnloadEvent.h"

@@ -33907,6 +39837,54 @@
 			<File

 				RelativePath="..\dom\CDATASection.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CDATASection.h"

@@ -33915,6 +39893,54 @@
 			<File

 				RelativePath="..\dom\CharacterData.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CharacterData.h"

@@ -33923,6 +39949,54 @@
 			<File

 				RelativePath="..\dom\CheckedRadioButtons.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CheckedRadioButtons.h"

@@ -33931,6 +40005,54 @@
 			<File

 				RelativePath="..\dom\ChildNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ChildNodeList.h"

@@ -33939,6 +40061,54 @@
 			<File

 				RelativePath="..\dom\ClassNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClassNodeList.h"

@@ -33947,6 +40117,54 @@
 			<File

 				RelativePath="..\dom\ClientRect.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClientRect.h"

@@ -33955,6 +40173,54 @@
 			<File

 				RelativePath="..\dom\ClientRectList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClientRectList.h"

@@ -33963,6 +40229,54 @@
 			<File

 				RelativePath="..\dom\Clipboard.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Clipboard.h"

@@ -33975,6 +40289,54 @@
 			<File

 				RelativePath="..\dom\ClipboardEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ClipboardEvent.h"

@@ -33983,6 +40345,54 @@
 			<File

 				RelativePath="..\dom\Comment.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Comment.h"

@@ -33991,6 +40401,54 @@
 			<File

 				RelativePath="..\dom\CompositionEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CompositionEvent.h"

@@ -33999,6 +40457,54 @@
 			<File

 				RelativePath="..\dom\ContainerNode.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ContainerNode.h"

@@ -34011,6 +40517,54 @@
 			<File

 				RelativePath="..\dom\CSSMappedAttributeDeclaration.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CSSMappedAttributeDeclaration.h"

@@ -34019,6 +40573,54 @@
 			<File

 				RelativePath="..\dom\CustomEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\CustomEvent.h"

@@ -34027,6 +40629,54 @@
 			<File

 				RelativePath="..\dom\DatasetDOMStringMap.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DatasetDOMStringMap.h"

@@ -34035,6 +40685,54 @@
 			<File

 				RelativePath="..\dom\DecodedDataDocumentParser.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DecodedDataDocumentParser.h"

@@ -34047,6 +40745,54 @@
 			<File

 				RelativePath="..\dom\DeviceMotionController.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceMotionController.h"

@@ -34055,6 +40801,54 @@
 			<File

 				RelativePath="..\dom\DeviceMotionData.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceMotionData.h"

@@ -34063,6 +40857,54 @@
 			<File

 				RelativePath="..\dom\DeviceMotionEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceMotionEvent.h"

@@ -34071,6 +40913,54 @@
 			<File

 				RelativePath="..\dom\DeviceOrientation.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceOrientation.h"

@@ -34083,6 +40973,54 @@
 			<File

 				RelativePath="..\dom\DeviceOrientationController.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceOrientationController.h"

@@ -34091,6 +41029,54 @@
 			<File

 				RelativePath="..\dom\DeviceOrientationEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DeviceOrientationEvent.h"

@@ -34099,6 +41085,54 @@
 			<File

 				RelativePath="..\dom\Document.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Document.h"

@@ -34107,6 +41141,54 @@
 			<File

 				RelativePath="..\dom\DocumentFragment.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentFragment.h"

@@ -34119,6 +41201,54 @@
 			<File

 				RelativePath="..\dom\DocumentMarkerController.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentMarkerController.h"

@@ -34127,6 +41257,54 @@
 			<File

 				RelativePath="..\dom\DocumentParser.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentParser.h"

@@ -34135,18 +41313,118 @@
 			<File

 				RelativePath="..\dom\DocumentType.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DocumentType.h"

 				>

 			</File>

 			<File

+				RelativePath="..\dom\DOMAllInOne.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\dom\DOMCoreException.h"

 				>

 			</File>

 			<File

 				RelativePath="..\dom\DOMImplementation.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DOMImplementation.h"

@@ -34155,6 +41433,54 @@
 			<File

 				RelativePath="..\dom\DOMStringList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DOMStringList.h"

@@ -34163,6 +41489,54 @@
 			<File

 				RelativePath="..\dom\DOMStringMap.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DOMStringMap.h"

@@ -34171,6 +41545,54 @@
 			<File

 				RelativePath="..\dom\DynamicNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\DynamicNodeList.h"

@@ -34179,6 +41601,54 @@
 			<File

 				RelativePath="..\dom\EditingText.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EditingText.h"

@@ -34187,6 +41657,54 @@
 			<File

 				RelativePath="..\dom\Element.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Element.h"

@@ -34195,6 +41713,54 @@
 			<File

 				RelativePath="..\dom\Entity.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Entity.h"

@@ -34203,6 +41769,54 @@
 			<File

 				RelativePath="..\dom\EntityReference.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EntityReference.h"

@@ -34211,6 +41825,54 @@
 			<File

 				RelativePath="..\dom\ErrorEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ErrorEvent.h"

@@ -34219,6 +41881,54 @@
 			<File

 				RelativePath="..\dom\Event.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Event.h"

@@ -34235,6 +41945,54 @@
 			<File

 				RelativePath="..\dom\EventNames.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EventNames.h"

@@ -34243,6 +42001,54 @@
 			<File

 				RelativePath="..\dom\EventTarget.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\EventTarget.h"

@@ -34251,6 +42057,54 @@
 			<File

 				RelativePath="..\dom\ExceptionBase.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ExceptionBase.h"

@@ -34259,6 +42113,54 @@
 			<File

 				RelativePath="..\dom\ExceptionCode.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ExceptionCode.h"

@@ -34271,6 +42173,54 @@
 			<File

 				RelativePath="..\dom\InputElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\InputElement.h"

@@ -34279,6 +42229,54 @@
 			<File

 				RelativePath="..\dom\KeyboardEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\KeyboardEvent.h"

@@ -34291,6 +42289,54 @@
 			<File

 				RelativePath="..\dom\MessageChannel.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MessageChannel.h"

@@ -34299,6 +42345,54 @@
 			<File

 				RelativePath="..\dom\MessageEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MessageEvent.h"

@@ -34307,6 +42401,54 @@
 			<File

 				RelativePath="..\dom\MessagePort.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MessagePort.h"

@@ -34315,6 +42457,54 @@
 			<File

 				RelativePath="..\dom\MessagePortChannel.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MessagePortChannel.h"

@@ -34323,6 +42513,54 @@
 			<File

 				RelativePath="..\dom\MouseEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MouseEvent.h"

@@ -34331,6 +42569,54 @@
 			<File

 				RelativePath="..\dom\MouseRelatedEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MouseRelatedEvent.h"

@@ -34339,6 +42625,54 @@
 			<File

 				RelativePath="..\dom\MutationEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\MutationEvent.h"

@@ -34355,6 +42689,54 @@
 			<File

 				RelativePath="..\dom\NameNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NameNodeList.h"

@@ -34371,6 +42753,54 @@
 			<File

 				RelativePath="..\dom\NodeFilter.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeFilter.h"

@@ -34379,6 +42809,54 @@
 			<File

 				RelativePath="..\dom\NodeFilterCondition.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeFilterCondition.h"

@@ -34387,6 +42865,54 @@
 			<File

 				RelativePath="..\dom\NodeIterator.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\NodeIterator.h"

@@ -34395,6 +42921,54 @@
 			<File

 				RelativePath="..\dom\Notation.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Notation.h"

@@ -34403,6 +42977,54 @@
 			<File

 				RelativePath="..\dom\OptionElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OptionElement.h"

@@ -34411,6 +43033,54 @@
 			<File

 				RelativePath="..\dom\OptionGroupElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OptionGroupElement.h"

@@ -34419,6 +43089,54 @@
 			<File

 				RelativePath="..\dom\OverflowEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\OverflowEvent.h"

@@ -34427,6 +43145,54 @@
 			<File

 				RelativePath="..\dom\PageTransitionEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\PageTransitionEvent.h"

@@ -34435,6 +43201,54 @@
 			<File

 				RelativePath="..\dom\PendingScript.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\PendingScript.h"

@@ -34451,6 +43265,54 @@
 			<File

 				RelativePath="..\dom\PopStateEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\PopStateEvent.h"

@@ -34459,6 +43321,54 @@
 			<File

 				RelativePath="..\dom\Position.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Position.h"

@@ -34467,6 +43377,54 @@
 			<File

 				RelativePath="..\dom\PositionIterator.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\PositionIterator.h"

@@ -34475,6 +43433,54 @@
 			<File

 				RelativePath="..\dom\ProcessingInstruction.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ProcessingInstruction.h"

@@ -34483,6 +43489,54 @@
 			<File

 				RelativePath="..\dom\ProgressEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ProgressEvent.h"

@@ -34499,6 +43553,54 @@
 			<File

 				RelativePath="..\dom\Range.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Range.h"

@@ -34515,6 +43617,54 @@
 			<File

 				RelativePath="..\dom\RegisteredEventListener.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\RegisteredEventListener.h"

@@ -34523,6 +43673,54 @@
 			<File

 				RelativePath="..\dom\ScriptableDocumentParser.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ScriptableDocumentParser.h"

@@ -34531,6 +43729,54 @@
 			<File

 				RelativePath="..\dom\ScriptElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ScriptElement.h"

@@ -34539,6 +43785,54 @@
 			<File

 				RelativePath="..\dom\ScriptExecutionContext.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ScriptExecutionContext.h"

@@ -34547,6 +43841,54 @@
 			<File

 				RelativePath="..\dom\SelectElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\SelectElement.h"

@@ -34555,6 +43897,54 @@
 			<File

 				RelativePath="..\dom\SelectorNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\SelectorNodeList.h"

@@ -34563,6 +43953,54 @@
 			<File

 				RelativePath="..\dom\SpaceSplitString.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\SpaceSplitString.h"

@@ -34571,6 +44009,54 @@
 			<File

 				RelativePath="..\dom\StaticHashSetNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StaticHashSetNodeList.h"

@@ -34579,6 +44065,54 @@
 			<File

 				RelativePath="..\dom\StaticNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StaticNodeList.h"

@@ -34587,6 +44121,54 @@
 			<File

 				RelativePath="..\dom\StyledElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StyledElement.h"

@@ -34595,6 +44177,54 @@
 			<File

 				RelativePath="..\dom\StyleElement.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\StyleElement.h"

@@ -34603,6 +44233,54 @@
 			<File

 				RelativePath="..\dom\TagNodeList.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TagNodeList.h"

@@ -34611,6 +44289,54 @@
 			<File

 				RelativePath="..\dom\Text.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Text.h"

@@ -34619,6 +44345,54 @@
 			<File

 				RelativePath="..\dom\TextEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TextEvent.h"

@@ -34631,10 +44405,106 @@
 			<File

 				RelativePath="..\dom\TransformSourceLibxslt.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Traversal.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\Traversal.h"

@@ -34647,6 +44517,54 @@
 			<File

 				RelativePath="..\dom\TreeWalker.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\TreeWalker.h"

@@ -34655,6 +44573,54 @@
 			<File

 				RelativePath="..\dom\UIEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UIEvent.h"

@@ -34663,6 +44629,54 @@
 			<File

 				RelativePath="..\dom\UIEventWithKeyState.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UIEventWithKeyState.h"

@@ -34671,6 +44685,54 @@
 			<File

 				RelativePath="..\dom\UserGestureIndicator.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UserGestureIndicator.h"

@@ -34679,6 +44741,54 @@
 			<File

 				RelativePath="..\dom\UserTypingGestureIndicator.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\UserTypingGestureIndicator.h"

@@ -34687,6 +44797,54 @@
 			<File

 				RelativePath="..\dom\ViewportArguments.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\ViewportArguments.h"

@@ -34695,6 +44853,54 @@
 			<File

 				RelativePath="..\dom\WebKitAnimationEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WebKitAnimationEvent.h"

@@ -34703,6 +44909,54 @@
 			<File

 				RelativePath="..\dom\WebKitTransitionEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WebKitTransitionEvent.h"

@@ -34711,6 +44965,54 @@
 			<File

 				RelativePath="..\dom\WheelEvent.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\WheelEvent.h"

@@ -34719,6 +45021,54 @@
 			<File

 				RelativePath="..\dom\XMLDocumentParser.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\XMLDocumentParser.h"

@@ -34731,6 +45081,54 @@
 			<File

 				RelativePath="..\dom\XMLDocumentParserScope.cpp"

 				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

 			</File>

 			<File

 				RelativePath="..\dom\XMLDocumentParserScope.h"

@@ -36273,6 +46671,62 @@
 				>

 			</File>

 			<File

+				RelativePath="..\editing\MarkupAccumulator.cpp"

+				>

+				<FileConfiguration

+					Name="Debug|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Internal|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Release_Cairo|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+				<FileConfiguration

+					Name="Debug_All|Win32"

+					ExcludedFromBuild="true"

+					>

+					<Tool

+						Name="VCCLCompilerTool"

+					/>

+				</FileConfiguration>

+			</File>

+			<File

+				RelativePath="..\editing\MarkupAccumulator.h"

+				>

+			</File>

+			<File

 				RelativePath="..\editing\MergeIdenticalElementsCommand.cpp"

 				>

 				<FileConfiguration

@@ -37581,6 +48035,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\BaseDateAndTimeInputType.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\BaseDateAndTimeInputType.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\BaseTextInputType.cpp"

 				>

 			</File>

@@ -37765,6 +48227,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\fileapi\DirectoryEntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DirectoryEntrySync.h"

+				>

+			</File>

+			<File

 				RelativePath="..\fileapi\DirectoryReader.cpp"

 				>

 			</File>

@@ -37773,6 +48243,18 @@
 				>

 			</File>

 			<File

+				RelativePath="..\fileapi\DirectoryReaderBase.h"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DirectoryReaderSync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DirectoryReaderSync.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\DOMDataGridDataSource.cpp"

 				>

 			</File>

@@ -37797,6 +48279,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\fileapi\DOMFileSystemBase.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DOMFileSystemBase.h"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DOMFileSystemSync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\DOMFileSystemSync.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\DOMFormData.cpp"

 				>

 			</File>

@@ -37805,6 +48303,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\html\DOMTokenList.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\html\DOMTokenList.h"

+				>

+			</File>

+			<File

 				RelativePath="..\html\EmailInputType.cpp"

 				>

 			</File>

@@ -37833,10 +48339,30 @@
 				>

 			</File>

 			<File

+				RelativePath="..\fileapi\EntryArraySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\EntryArraySync.h"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\EntryBase.h"

+				>

+			</File>

+			<File

 				RelativePath="..\fileapi\EntryCallback.h"

 				>

 			</File>

 			<File

+				RelativePath="..\fileapi\EntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\EntrySync.h"

+				>

+			</File>

+			<File

 				RelativePath="..\fileapi\ErrorCallback.h"

 				>

 			</File>

@@ -37857,11 +48383,15 @@
 				>

 			</File>

 			<File

-				RelativePath="..\fileapi\FileEntry.cpp"

+				RelativePath="..\fileapi\FileEntry.h"

 				>

 			</File>

 			<File

-				RelativePath="..\fileapi\FileEntry.h"

+				RelativePath="..\fileapi\FileEntrySync.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\fileapi\FileEntrySync.h"

 				>

 			</File>

 			<File

@@ -37957,27 +48487,27 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\FormDataList.h"

+				RelativePath="..\html\FormDataList.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\html\FTPDirectoryDocument.cpp"

+				RelativePath="..\html\FormDataList.h"

 				>

 			</File>

 			<File

-				RelativePath="..\html\DOMTokenList.cpp"

+				RelativePath="..\html\FTPDirectoryDocument.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\html\DOMTokenList.h"

+				RelativePath="..\html\FTPDirectoryDocument.h"

 				>

 			</File>

 			<File

-				RelativePath="..\html\FormDataList.cpp"

+				RelativePath="..\html\HiddenInputType.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\html\FTPDirectoryDocument.h"

+				RelativePath="..\html\HiddenInputType.h"

 				>

 			</File>

 			<File

@@ -42329,14 +52859,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\html\HiddenInputType.cpp"

-				>

-			</File>

-			<File

-				RelativePath="..\html\HiddenInputType.h"

-				>

-			</File>

-			<File

 				RelativePath="..\html\ImageData.cpp"

 				>

 			</File>

@@ -44408,6 +54930,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSDirectoryEntrySyncCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSDocumentCustom.cpp"

 					>

 					<FileConfiguration

@@ -45168,6 +55694,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\bindings\js\JSEntrySyncCustom.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\bindings\js\JSEventCustom.cpp"

 					>

 					<FileConfiguration

@@ -50633,51 +61163,47 @@
 				>

 			</File>

 			<File

-				RelativePath="..\svg\ElementTimeControl.h"

-				>

-			</File>

-			<File

-				RelativePath="..\svg\SVGAElement.h"

+				RelativePath="..\svg\DeprecatedSVGAnimatedProperty.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAllInOne.cpp"

+				RelativePath="..\svg\DeprecatedSVGAnimatedPropertyTraits.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAltGlyphElement.h"

+				RelativePath="..\svg\DeprecatedSVGAnimatedTemplate.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAngle.h"

+				RelativePath="..\svg\ElementTimeControl.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimateColorElement.h"

+				RelativePath="..\svg\SVGAElement.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedPathData.h"

+				RelativePath="..\svg\SVGAllInOne.cpp"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedPoints.h"

+				RelativePath="..\svg\SVGAltGlyphElement.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedProperty.h"

+				RelativePath="..\svg\SVGAngle.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedPropertySynchronizer.h"

+				RelativePath="..\svg\SVGAnimateColorElement.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedPropertyTraits.h"

+				RelativePath="..\svg\SVGAnimatedPathData.h"

 				>

 			</File>

 			<File

-				RelativePath="..\svg\SVGAnimatedTemplate.h"

+				RelativePath="..\svg\SVGAnimatedPoints.h"

 				>

 			</File>

 			<File

@@ -51696,6 +62222,14 @@
 					</File>

 				</Filter>

 			</Filter>

+			<Filter

+				Name="properties"

+				>

+				<File

+    				RelativePath="..\svg\properties\SVGAnimatedPropertySynchronizer.h"

+					>

+				</File>

+			</Filter>

 		</Filter>

 		<Filter

 			Name="ForwardingHeaders"

@@ -52677,6 +63211,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorClient.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorClient.h"

 				>

 			</File>

@@ -52689,6 +63227,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorCSSAgent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorCSSAgent.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorCSSStore.cpp"

 				>

 			</File>

@@ -52749,6 +63295,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorInstrumentation.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorInstrumentation.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorProfilerAgent.cpp"

 				>

 			</File>

@@ -52765,6 +63319,22 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorResourceAgent.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorResourceAgent.h"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorState.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorState.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorStorageAgent.cpp"

 				>

 			</File>

@@ -52773,6 +63343,14 @@
 				>

 			</File>

 			<File

+				RelativePath="..\inspector\InspectorStyleSheet.cpp"

+				>

+			</File>

+			<File

+				RelativePath="..\inspector\InspectorStyleSheet.h"

+				>

+			</File>

+			<File

 				RelativePath="..\inspector\InspectorTimelineAgent.cpp"

 				>

 			</File>

@@ -52892,6 +63470,14 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\CookieItemsView.js"

+					>

+				</File>

+				<File

+					RelativePath="..\inspector\front-end\CookieParser.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\CSSStyleModel.js"

 					>

 				</File>

@@ -52972,11 +63558,11 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\GoToLineDialog.js"

+					RelativePath="..\inspector\front-end\goToLineDialog.css"

 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\goToLineDialog.css"

+					RelativePath="..\inspector\front-end\GoToLineDialog.js"

 					>

 				</File>

 				<File

@@ -53036,11 +63622,11 @@
 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\NetworkPanel.js"

+					RelativePath="..\inspector\front-end\networkPanel.css"

 					>

 				</File>

 				<File

-					RelativePath="..\inspector\front-end\networkPanel.css"

+					RelativePath="..\inspector\front-end\NetworkPanel.js"

 					>

 				</File>

 				<File

@@ -53104,6 +63690,10 @@
 					>

 				</File>

 				<File

+					RelativePath="..\inspector\front-end\ResourceManager.js"

+					>

+				</File>

+				<File

 					RelativePath="..\inspector\front-end\ResourcesPanel.js"

 					>

 				</File>

diff --git a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
index edc8ee1..c8c4e94 100644
--- a/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
+++ b/WebCore/WebCore.vcproj/WebCoreCommon.vsprops
@@ -7,7 +7,7 @@
 	>

 	<Tool

 		Name="VCCLCompilerTool"

-		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)..&quot;;&quot;$(ProjectDir)..\accessibility&quot;;&quot;$(ProjectDir)..\accessibility\win&quot;;&quot;$(ProjectDir)..\bridge&quot;;&quot;$(ProjectDir)..\bridge\c&quot;;&quot;$(ProjectDir)..\bridge\jsc&quot;;&quot;$(ProjectDir)..\css&quot;;&quot;$(ProjectDir)..\editing&quot;;&quot;$(ProjectDir)..\fileapi&quot;;&quot;$(ProjectDir)..\rendering&quot;;&quot;$(ProjectDir)..\rendering\style&quot;;&quot;$(ProjectDir)..\rendering\svg&quot;;&quot;$(ProjectDir)..\bindings&quot;;&quot;$(ProjectDir)..\bindings\generic&quot;;&quot;$(ProjectDir)..\bindings\js&quot;;&quot;$(ProjectDir)..\bindings\js\specialization&quot;;&quot;$(ProjectDir)..\dom&quot;;&quot;$(ProjectDir)..\dom\default&quot;;&quot;$(ProjectDir)..\history&quot;;&quot;$(ProjectDir)..\html&quot;;&quot;$(ProjectDir)..\html\canvas&quot;;&quot;$(ProjectDir)..\html\parser&quot;;&quot;$(ProjectDir)..\inspector&quot;;&quot;$(ProjectDir)..\loader&quot;;&quot;$(ProjectDir)..\loader\appcache&quot;;&quot;$(ProjectDir)..\loader\archive&quot;;&quot;$(ProjectDir)..\loader\archive\cf&quot;;&quot;$(ProjectDir)..\loader\icon&quot;;&quot;$(ProjectDir)..\mathml&quot;;&quot;$(ProjectDir)..\notifications&quot;;&quot;$(ProjectDir)..\page&quot;;&quot;$(ProjectDir)..\page\animation&quot;;&quot;$(ProjectDir)..\page\win&quot;;&quot;$(ProjectDir)..\platform&quot;;&quot;$(ProjectDir)..\platform\animation&quot;;&quot;$(ProjectDir)..\platform\mock&quot;;&quot;$(ProjectDir)..\platform\sql&quot;;&quot;$(ProjectDir)..\platform\win&quot;;&quot;$(ProjectDir)..\platform\network&quot;;&quot;$(ProjectDir)..\platform\network\win&quot;;&quot;$(ProjectDir)..\platform\cf&quot;;&quot;$(ProjectDir)..\platform\graphics&quot;;&quot;$(ProjectDir)..\platform\graphics\filters&quot;;&quot;$(ProjectDir)..\platform\graphics\opentype&quot;;&quot;$(ProjectDir)..\platform\graphics\transforms&quot;;&quot;$(ProjectDir)..\platform\text&quot;;&quot;$(ProjectDir)..\platform\text\transcoder&quot;;&quot;$(ProjectDir)..\platform\graphics\win&quot;;&quot;$(ProjectDir)..\xml&quot;;&quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;;&quot;$(ProjectDir)..\plugins&quot;;&quot;$(ProjectDir)..\plugins\win&quot;;&quot;$(ProjectDir)..\svg\animation&quot;;&quot;$(ProjectDir)..\svg\graphics&quot;;&quot;$(ProjectDir)..\svg\properties&quot;;&quot;$(ProjectDir)..\svg\graphics\filters&quot;;&quot;$(ProjectDir)..\svg&quot;;&quot;$(ProjectDir)..\wml&quot;;&quot;$(ProjectDir)..\storage&quot;;&quot;$(ProjectDir)..\websockets&quot;;&quot;$(ProjectDir)..\workers&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\JavaScriptCore&quot;;&quot;$(WebKitOutputDir)\include\private\JavaScriptCore&quot;;&quot;$(ProjectDir)..\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include\private\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\pthreads&quot;;&quot;$(WebKitLibrariesDir)\include\sqlite&quot;;&quot;$(WebKitLibrariesDir)\include\JavaScriptCore&quot;;&quot;$(WebKitLibrariesDir)\include\zlib&quot;"

 		PreprocessorDefinitions="__WIN32__;DISABLE_3D_RENDERING;WEBCORE_CONTEXT_MENUS"

 		UsePrecompiledHeader="2"

 		PrecompiledHeaderThrough="WebCorePrefix.h"

@@ -16,7 +16,7 @@
 	/>

 	<Tool

 		Name="VCPostBuildEventTool"

-		CommandLine=""

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 	/>

 	<Tool

 		Name="VCPreBuildEventTool"

diff --git a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
index 4315c52..4f7dcd9 100644
--- a/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
+++ b/WebCore/WebCore.vcproj/WebCoreGenerated.vcproj
@@ -22,8 +22,8 @@
 			>

 			<Tool

 				Name="VCNMakeTool"

-				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; windows&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; windows&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; windows&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; windows&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cg cf&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 				Output=""

 				PreprocessorDefinitions=""

@@ -42,8 +42,8 @@
 			>

 			<Tool

 				Name="VCNMakeTool"

-				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

-				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				BuildCommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+				ReBuildCommandLine="echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;bash build-generated-files.sh &quot;$(WebKitOutputDir)&quot; &quot;$(WebKitLibrariesDir)&quot; cairo&#x0D;&#x0A;bash migrate-scripts.sh &quot;$(WebKitOutputDir)/obj/WebCore/scripts&quot;&#x0D;&#x0A;cmd /C copyForwardingHeaders.cmd cairo curl&#x0D;&#x0A;cmd /C copyInspectorFiles.cmd&#x0D;&#x0A;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 				CleanCommandLine="del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\DerivedSources&quot;&#x0D;&#x0A;del /s /q &quot;$(WebKitOutputDir)\obj\WebCore\scripts&quot;&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

 				Output=""

 				PreprocessorDefinitions=""

diff --git a/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd b/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
index d76cfd6..a85ace3 100755
--- a/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
+++ b/WebCore/WebCore.vcproj/copyForwardingHeaders.cmd
@@ -28,6 +28,7 @@ xcopy /y /d "%ProjectDir%..\loader\icon\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\history\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\history\cf\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\html\*.h" "%WebKitOutputDir%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\html\parser\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\notifications\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\css\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\platform\*.h" "%WebKitOutputDir%\include\WebCore"
@@ -62,6 +63,7 @@ xcopy /y /d "%ProjectDir%..\editing\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\dom\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\xml\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\svg\animation\*.h" "%WebKitOutputDir%\include\WebCore"
+xcopy /y /d "%ProjectDir%..\svg\properties\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\svg\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\storage\*.h" "%WebKitOutputDir%\include\WebCore"
 xcopy /y /d "%ProjectDir%..\websockets\*.h" "%WebKitOutputDir%\include\WebCore"
diff --git a/WebCore/WebCore.xcodeproj/project.pbxproj b/WebCore/WebCore.xcodeproj/project.pbxproj
index d104455..bc612df 100644
--- a/WebCore/WebCore.xcodeproj/project.pbxproj
+++ b/WebCore/WebCore.xcodeproj/project.pbxproj
@@ -64,11 +64,25 @@
 		080AEC820ED8708B00DF4CCE /* WMLIntrinsicEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 080AEC7E0ED8708B00DF4CCE /* WMLIntrinsicEvent.h */; };
 		080AEC830ED8708B00DF4CCE /* WMLIntrinsicEventHandler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080AEC7F0ED8708B00DF4CCE /* WMLIntrinsicEventHandler.cpp */; };
 		080AEC840ED8708B00DF4CCE /* WMLIntrinsicEventHandler.h in Headers */ = {isa = PBXBuildFile; fileRef = 080AEC800ED8708B00DF4CCE /* WMLIntrinsicEventHandler.h */; };
+		080E49251255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080E49211255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.cpp */; };
+		080E49261255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.h in Headers */ = {isa = PBXBuildFile; fileRef = 080E49221255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.h */; };
+		080E49271255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080E49231255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.cpp */; };
+		080E49281255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.h in Headers */ = {isa = PBXBuildFile; fileRef = 080E49241255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.h */; };
 		080FAE1A0EEEBDA800AACDE9 /* WMLTemplateElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 080FAE180EEEBDA800AACDE9 /* WMLTemplateElement.cpp */; };
 		080FAE1B0EEEBDA800AACDE9 /* WMLTemplateElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 080FAE190EEEBDA800AACDE9 /* WMLTemplateElement.h */; };
+		081093DB1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081093D91255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.cpp */; };
+		081093DC1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 081093DA1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.h */; };
+		081668D3125603BF006F25DE /* SVGTextChunkBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081668D1125603BF006F25DE /* SVGTextChunkBuilder.cpp */; };
+		081668D4125603BF006F25DE /* SVGTextChunkBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 081668D2125603BF006F25DE /* SVGTextChunkBuilder.h */; };
+		081668D9125603D5006F25DE /* SVGTextLayoutEngine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081668D7125603D5006F25DE /* SVGTextLayoutEngine.cpp */; };
+		081668DA125603D5006F25DE /* SVGTextLayoutEngine.h in Headers */ = {isa = PBXBuildFile; fileRef = 081668D8125603D5006F25DE /* SVGTextLayoutEngine.h */; };
 		0818AEE20EDB86BC00647B66 /* WMLEventHandlingElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0818AEE00EDB86BC00647B66 /* WMLEventHandlingElement.cpp */; };
 		0818AEE30EDB86BC00647B66 /* WMLEventHandlingElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 0818AEE10EDB86BC00647B66 /* WMLEventHandlingElement.h */; };
 		081AA8DA1111237E002AB06E /* SVGElementRareData.h in Headers */ = {isa = PBXBuildFile; fileRef = 081AA8D91111237E002AB06E /* SVGElementRareData.h */; };
+		081CDFB8126ECFDB00D215CA /* DeprecatedSVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 081CDFB5126ECFDB00D215CA /* DeprecatedSVGAnimatedProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		081CDFB9126ECFDB00D215CA /* DeprecatedSVGAnimatedPropertyTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 081CDFB6126ECFDB00D215CA /* DeprecatedSVGAnimatedPropertyTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		081CDFBA126ECFDB00D215CA /* DeprecatedSVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = 081CDFB7126ECFDB00D215CA /* DeprecatedSVGAnimatedTemplate.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		081CDFBF126ECFE800D215CA /* SVGAnimatedPropertySynchronizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 081CDFBE126ECFE800D215CA /* SVGAnimatedPropertySynchronizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		081D81310EE0E74D00D73689 /* WMLTimerElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081D812F0EE0E74D00D73689 /* WMLTimerElement.cpp */; };
 		081D81320EE0E74D00D73689 /* WMLTimerElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 081D81300EE0E74D00D73689 /* WMLTimerElement.h */; };
 		081EBF3A0FD34F4100DA7559 /* SVGFilterBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 081EBF380FD34F4100DA7559 /* SVGFilterBuilder.cpp */; };
@@ -88,11 +102,6 @@
 		083DAEA70F01A7FB00342754 /* RenderTextControlMultiLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */; };
 		083DAEA80F01A7FB00342754 /* RenderTextControlSingleLine.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */; };
 		083DAEA90F01A7FB00342754 /* RenderTextControlSingleLine.h in Headers */ = {isa = PBXBuildFile; fileRef = 083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */; };
-		083F529911957FBE00653EBE /* SVGTextLayoutUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 083F529711957FBE00653EBE /* SVGTextLayoutUtilities.cpp */; };
-		083F529A11957FBE00653EBE /* SVGTextLayoutUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = 083F529811957FBE00653EBE /* SVGTextLayoutUtilities.h */; };
-		0842BC721190144000C7D08F /* SVGCharacterData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0842BC701190144000C7D08F /* SVGCharacterData.cpp */; };
-		0842BC731190144000C7D08F /* SVGCharacterData.h in Headers */ = {isa = PBXBuildFile; fileRef = 0842BC711190144000C7D08F /* SVGCharacterData.h */; };
-		0842BC811190147200C7D08F /* SVGTextChunkLayoutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 0842BC801190147200C7D08F /* SVGTextChunkLayoutInfo.h */; };
 		084AEBE40FB505FA0038483E /* SelectElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084AEBE20FB505FA0038483E /* SelectElement.cpp */; };
 		084AEBE50FB505FA0038483E /* SelectElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 084AEBE30FB505FA0038483E /* SelectElement.h */; };
 		084CE5CB0F27DADC00E6240E /* WMLOptGroupElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084CE5C70F27DADC00E6240E /* WMLOptGroupElement.cpp */; };
@@ -103,13 +112,26 @@
 		084D0E3D11F5816100081E1A /* SVGResources.h in Headers */ = {isa = PBXBuildFile; fileRef = 084D0E3911F5816100081E1A /* SVGResources.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		084D0E3E11F5816100081E1A /* SVGResourcesCache.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084D0E3A11F5816100081E1A /* SVGResourcesCache.cpp */; };
 		084D0E3F11F5816100081E1A /* SVGResourcesCache.h in Headers */ = {isa = PBXBuildFile; fileRef = 084D0E3B11F5816100081E1A /* SVGResourcesCache.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		084D2833110A7FCB0038239A /* SVGAnimatedPropertySynchronizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 084D2831110A7FCB0038239A /* SVGAnimatedPropertySynchronizer.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		084D2834110A7FCB0038239A /* SVGAnimatedPropertyTraits.h in Headers */ = {isa = PBXBuildFile; fileRef = 084D2832110A7FCB0038239A /* SVGAnimatedPropertyTraits.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		084DBAA10ED39D360038C226 /* WMLVariables.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 084DBA9D0ED39D350038C226 /* WMLVariables.cpp */; };
 		084DBAA20ED39D360038C226 /* WMLVariables.h in Headers */ = {isa = PBXBuildFile; fileRef = 084DBA9E0ED39D360038C226 /* WMLVariables.h */; };
-		0853D73211C9109000B2FD42 /* SVGTextChunkLayoutInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0853D72F11C9108F00B2FD42 /* SVGTextChunkLayoutInfo.cpp */; };
-		0853D73311C9109000B2FD42 /* SVGTextQuery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0853D73011C9109000B2FD42 /* SVGTextQuery.cpp */; };
-		0853D73411C9109000B2FD42 /* SVGTextQuery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0853D73111C9109000B2FD42 /* SVGTextQuery.h */; };
+		0854B0141255E4E600B9CDD0 /* RenderSVGInline.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0021255E4E600B9CDD0 /* RenderSVGInline.cpp */; };
+		0854B0151255E4E600B9CDD0 /* RenderSVGInline.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0031255E4E600B9CDD0 /* RenderSVGInline.h */; };
+		0854B0161255E4E600B9CDD0 /* RenderSVGInlineText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0041255E4E600B9CDD0 /* RenderSVGInlineText.cpp */; };
+		0854B0171255E4E600B9CDD0 /* RenderSVGInlineText.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0051255E4E600B9CDD0 /* RenderSVGInlineText.h */; };
+		0854B0181255E4E600B9CDD0 /* RenderSVGText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0061255E4E600B9CDD0 /* RenderSVGText.cpp */; };
+		0854B0191255E4E600B9CDD0 /* RenderSVGText.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0071255E4E600B9CDD0 /* RenderSVGText.h */; };
+		0854B01A1255E4E600B9CDD0 /* RenderSVGTextPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0081255E4E600B9CDD0 /* RenderSVGTextPath.cpp */; };
+		0854B01B1255E4E600B9CDD0 /* RenderSVGTextPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0091255E4E600B9CDD0 /* RenderSVGTextPath.h */; };
+		0854B01C1255E4E600B9CDD0 /* RenderSVGTSpan.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B00A1255E4E600B9CDD0 /* RenderSVGTSpan.cpp */; };
+		0854B01D1255E4E600B9CDD0 /* RenderSVGTSpan.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B00B1255E4E600B9CDD0 /* RenderSVGTSpan.h */; };
+		0854B01E1255E4E600B9CDD0 /* SVGInlineFlowBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B00C1255E4E600B9CDD0 /* SVGInlineFlowBox.cpp */; };
+		0854B01F1255E4E600B9CDD0 /* SVGInlineFlowBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B00D1255E4E600B9CDD0 /* SVGInlineFlowBox.h */; };
+		0854B0201255E4E600B9CDD0 /* SVGInlineTextBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B00E1255E4E600B9CDD0 /* SVGInlineTextBox.cpp */; };
+		0854B0211255E4E600B9CDD0 /* SVGInlineTextBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B00F1255E4E600B9CDD0 /* SVGInlineTextBox.h */; };
+		0854B0221255E4E600B9CDD0 /* SVGRootInlineBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0101255E4E600B9CDD0 /* SVGRootInlineBox.cpp */; };
+		0854B0231255E4E600B9CDD0 /* SVGRootInlineBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0111255E4E600B9CDD0 /* SVGRootInlineBox.h */; };
+		0854B0241255E4E600B9CDD0 /* SVGTextQuery.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 0854B0121255E4E600B9CDD0 /* SVGTextQuery.cpp */; };
+		0854B0251255E4E600B9CDD0 /* SVGTextQuery.h in Headers */ = {isa = PBXBuildFile; fileRef = 0854B0131255E4E600B9CDD0 /* SVGTextQuery.h */; };
 		08563BB4117861780012B578 /* RenderSVGResourcePattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08563BB2117861770012B578 /* RenderSVGResourcePattern.cpp */; };
 		08563BB5117861780012B578 /* RenderSVGResourcePattern.h in Headers */ = {isa = PBXBuildFile; fileRef = 08563BB3117861770012B578 /* RenderSVGResourcePattern.h */; };
 		08563BD0117865F50012B578 /* RenderSVGResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08563BCF117865F50012B578 /* RenderSVGResource.cpp */; };
@@ -134,7 +156,6 @@
 		08735FB910E91232006D6FAD /* SVGMarkerLayoutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = 08735FB710E91232006D6FAD /* SVGMarkerLayoutInfo.h */; };
 		08744BAA0EDB7D86004C9E63 /* WMLOnEventElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */; };
 		08744BAE0EDB7D92004C9E63 /* WMLOnEventElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */; };
-		0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */ = {isa = PBXBuildFile; fileRef = 0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		087D97BF10FB8D7700C00874 /* JSSVGPODListCustom.h in Headers */ = {isa = PBXBuildFile; fileRef = 087D97BE10FB8D7700C00874 /* JSSVGPODListCustom.h */; };
 		087FFA0F0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */; };
 		087FFA100EFF3ED3009DBD88 /* WMLInsertedLegendElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */; };
@@ -154,8 +175,6 @@
 		0885068011DA045B00182B98 /* PaintPhase.h in Headers */ = {isa = PBXBuildFile; fileRef = 0885067E11DA045B00182B98 /* PaintPhase.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		088C2F7912390081003D65CE /* SVGTextLayoutAttributes.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 088C2F7512390080003D65CE /* SVGTextLayoutAttributes.cpp */; };
 		088C2F7A12390081003D65CE /* SVGTextLayoutAttributes.h in Headers */ = {isa = PBXBuildFile; fileRef = 088C2F7612390080003D65CE /* SVGTextLayoutAttributes.h */; };
-		088C2F7B12390081003D65CE /* SVGTextLayoutBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 088C2F7712390081003D65CE /* SVGTextLayoutBuilder.cpp */; };
-		088C2F7C12390081003D65CE /* SVGTextLayoutBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = 088C2F7812390081003D65CE /* SVGTextLayoutBuilder.h */; };
 		088C97120ECB6D92000534BA /* WMLNames.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4CA3AB490E556F2400E9C0C0 /* WMLNames.cpp */; };
 		088C97130ECB6D9D000534BA /* WMLNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 4CA3AB480E556F2400E9C0C0 /* WMLNames.h */; };
 		088C97510ECB6E28000534BA /* WMLAElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4C6B99180E52E37300487BB7 /* WMLAElement.cpp */; };
@@ -209,6 +228,11 @@
 		08E6A2E90EEE035200AC1206 /* WMLPostfieldElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08E6A2E70EEE035200AC1206 /* WMLPostfieldElement.h */; };
 		08E6E0F10EFF42BA00029FBF /* WMLFieldSetElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08E6E0EF0EFF42BA00029FBF /* WMLFieldSetElement.cpp */; };
 		08E6E0F20EFF42BA00029FBF /* WMLFieldSetElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 08E6E0F00EFF42BA00029FBF /* WMLFieldSetElement.h */; };
+		08F0BFC21255C53C00075185 /* SVGTextChunk.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08F0BFBD1255C53C00075185 /* SVGTextChunk.cpp */; };
+		08F0BFC31255C53C00075185 /* SVGTextChunk.h in Headers */ = {isa = PBXBuildFile; fileRef = 08F0BFBE1255C53C00075185 /* SVGTextChunk.h */; };
+		08F0BFC41255C53C00075185 /* SVGTextFragment.h in Headers */ = {isa = PBXBuildFile; fileRef = 08F0BFBF1255C53C00075185 /* SVGTextFragment.h */; };
+		08F0BFC51255C53C00075185 /* SVGTextMetrics.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08F0BFC01255C53C00075185 /* SVGTextMetrics.cpp */; };
+		08F0BFC61255C53C00075185 /* SVGTextMetrics.h in Headers */ = {isa = PBXBuildFile; fileRef = 08F0BFC11255C53C00075185 /* SVGTextMetrics.h */; };
 		08F2F0091213E61700DCEC48 /* RenderImageResource.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 08F2F0071213E61700DCEC48 /* RenderImageResource.cpp */; };
 		08F2F00A1213E61700DCEC48 /* RenderImageResource.h in Headers */ = {isa = PBXBuildFile; fileRef = 08F2F0081213E61700DCEC48 /* RenderImageResource.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		0A4844990CA44CB200B7BD48 /* SoftLinking.h in Headers */ = {isa = PBXBuildFile; fileRef = 0A4844980CA44CB200B7BD48 /* SoftLinking.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -356,8 +380,6 @@
 		1A2AAC580DC2A3B100A20D9A /* ApplicationCacheStorage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2AAC560DC2A3B100A20D9A /* ApplicationCacheStorage.cpp */; };
 		1A2AAC590DC2A3B100A20D9A /* ApplicationCacheStorage.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2AAC570DC2A3B100A20D9A /* ApplicationCacheStorage.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A2C40AB0DEB55AA005AF19E /* JSTextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2C40AA0DEB55AA005AF19E /* JSTextCustom.cpp */; };
-		1A2D753D0DE47FAB00F0A648 /* IconFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2D753B0DE47FAB00F0A648 /* IconFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A2D753E0DE47FAB00F0A648 /* IconFetcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2D753C0DE47FAB00F0A648 /* IconFetcher.cpp */; };
 		1A2E6E590CC55213004A2062 /* SQLValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2E6E570CC55213004A2062 /* SQLValue.cpp */; };
 		1A2E6E5A0CC55213004A2062 /* SQLValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2E6E580CC55213004A2062 /* SQLValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1A2E6E7A0CC556D5004A2062 /* SQLiteAuthorizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A2E6E780CC556D5004A2062 /* SQLiteAuthorizer.cpp */; };
@@ -467,6 +489,7 @@
 		1AA8799011CBE846003C664F /* PluginStrategy.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AA8798F11CBE846003C664F /* PluginStrategy.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AB1AE7A0C051FDE00139F4F /* zoomInCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE780C051FDE00139F4F /* zoomInCursor.png */; };
 		1AB1AE7B0C051FDE00139F4F /* zoomOutCursor.png in Resources */ = {isa = PBXBuildFile; fileRef = 1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */; };
+		1AB33DA512551E320024457A /* IOKit.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1AB33DA412551E320024457A /* IOKit.framework */; };
 		1AB7FC680A8B92EC00D9D37B /* XPathEvaluator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */; };
 		1AB7FC690A8B92EC00D9D37B /* XPathEvaluator.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AB7FC480A8B92EC00D9D37B /* XPathEvaluator.h */; };
 		1AB7FC6B0A8B92EC00D9D37B /* XPathExpression.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AB7FC4A0A8B92EC00D9D37B /* XPathExpression.cpp */; };
@@ -568,6 +591,9 @@
 		1AE82FEC0CAB07EE002237AE /* JSSQLResultSet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */; };
 		1AE82FED0CAB07EE002237AE /* JSSQLResultSet.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */; };
 		1AF326790D78B9440068F0C4 /* EditorClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF326770D78B9440068F0C4 /* EditorClient.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AF8E1191256592600230FF7 /* ProxyServer.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E13212565A4400230FF7 /* ProxyServer.cpp */; };
+		1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */; };
 		1AFE117D0CBFFB36003017FA /* SQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */; };
 		1AFE117E0CBFFB36003017FA /* SQLResultSetRowList.h in Headers */ = {isa = PBXBuildFile; fileRef = 1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		1AFE11990CBFFCC4003017FA /* JSSQLResultSetRowList.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1AFE11970CBFFCC4003017FA /* JSSQLResultSetRowList.cpp */; };
@@ -630,6 +656,8 @@
 		1CF6BE150E9BB4670025E1CD /* ObjCNodeFilterCondition.h in Headers */ = {isa = PBXBuildFile; fileRef = 1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */; };
 		1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */ = {isa = PBXBuildFile; fileRef = 1CFAE3220A6D6A3F0032593D /* libobjc.dylib */; };
 		200B190911C277D900DCCD3A /* ScriptBreakpoint.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 200B190811C277D900DCCD3A /* ScriptBreakpoint.cpp */; };
+		20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 20D629241253690B00081543 /* InspectorInstrumentation.cpp */; };
+		20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */ = {isa = PBXBuildFile; fileRef = 20D629251253690B00081543 /* InspectorInstrumentation.h */; };
 		228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */ = {isa = PBXBuildFile; fileRef = 228C284410D82500009D0D0E /* ScriptWrappable.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */; };
 		24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 24F54EAB101FE914000AE741 /* ApplicationCacheHost.h */; settings = {ATTRIBUTES = (); }; };
@@ -849,7 +877,6 @@
 		416E75BF0EDF8FD700360E1D /* ScriptCallStack.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */; };
 		416E75CB0EDF90C700360E1D /* ScriptCallFrame.h in Headers */ = {isa = PBXBuildFile; fileRef = 416E75C90EDF90C700360E1D /* ScriptCallFrame.h */; };
 		416E75CC0EDF90C700360E1D /* ScriptCallFrame.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */; };
-		416F45F00ED7B311008215B6 /* ScriptString.h in Headers */ = {isa = PBXBuildFile; fileRef = 416F45EF0ED7B311008215B6 /* ScriptString.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41885B9311B6FDA6003383BB /* FormSubmission.h in Headers */ = {isa = PBXBuildFile; fileRef = 41885B9111B6FDA6003383BB /* FormSubmission.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		41885B9411B6FDA6003383BB /* FormSubmission.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 41885B9211B6FDA6003383BB /* FormSubmission.cpp */; };
 		418F88040FF957AE0080F045 /* JSAbstractWorker.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */; };
@@ -916,6 +943,7 @@
 		490707E61219C04300D90E51 /* ANGLEWebKitBridge.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 490707E41219C04300D90E51 /* ANGLEWebKitBridge.cpp */; };
 		490707E71219C04300D90E51 /* ANGLEWebKitBridge.h in Headers */ = {isa = PBXBuildFile; fileRef = 490707E51219C04300D90E51 /* ANGLEWebKitBridge.h */; };
 		492273A31083B3B100EE5C84 /* JSArrayBufferViewCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 492273A21083B3B100EE5C84 /* JSArrayBufferViewCustom.cpp */; };
+		492863991253B8FC00F792D6 /* ResourceRawHeaders.h in Headers */ = {isa = PBXBuildFile; fileRef = 492863981253B8FC00F792D6 /* ResourceRawHeaders.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		49484FC1102CF23C00187DD3 /* CanvasGradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */; };
 		49484FC2102CF23C00187DD3 /* CanvasGradient.h in Headers */ = {isa = PBXBuildFile; fileRef = 49484FB4102CF23C00187DD3 /* CanvasGradient.h */; };
 		49484FC4102CF23C00187DD3 /* CanvasPattern.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49484FB6102CF23C00187DD3 /* CanvasPattern.cpp */; };
@@ -936,6 +964,32 @@
 		498391520F1E76B400C23782 /* DOMWebKitCSSMatrixInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 4983914F0F1E76B400C23782 /* DOMWebKitCSSMatrixInternal.h */; };
 		498391580F1E776900C23782 /* WebKitCSSMatrix.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498391550F1E776900C23782 /* WebKitCSSMatrix.cpp */; };
 		498391590F1E776900C23782 /* WebKitCSSMatrix.h in Headers */ = {isa = PBXBuildFile; fileRef = 498391560F1E776900C23782 /* WebKitCSSMatrix.h */; };
+		498770DB1242C535002226BA /* DrawingBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770C21242C535002226BA /* DrawingBuffer.cpp */; };
+		498770DC1242C535002226BA /* DrawingBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770C31242C535002226BA /* DrawingBuffer.h */; };
+		498770E41242C535002226BA /* PODArena.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770CB1242C535002226BA /* PODArena.h */; };
+		498770E51242C535002226BA /* PODInterval.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770CC1242C535002226BA /* PODInterval.h */; };
+		498770E61242C535002226BA /* PODIntervalTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770CD1242C535002226BA /* PODIntervalTree.h */; };
+		498770E71242C535002226BA /* PODRedBlackTree.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770CE1242C535002226BA /* PODRedBlackTree.h */; };
+		498770E81242C535002226BA /* Shader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770CF1242C535002226BA /* Shader.cpp */; };
+		498770E91242C535002226BA /* Shader.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770D01242C535002226BA /* Shader.h */; };
+		498770EA1242C535002226BA /* SharedGraphicsContext3D.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D11242C535002226BA /* SharedGraphicsContext3D.cpp */; };
+		498770EB1242C535002226BA /* SharedGraphicsContext3D.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770D21242C535002226BA /* SharedGraphicsContext3D.h */; };
+		498770EC1242C535002226BA /* SolidFillShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D31242C535002226BA /* SolidFillShader.cpp */; };
+		498770ED1242C535002226BA /* SolidFillShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770D41242C535002226BA /* SolidFillShader.h */; };
+		498770EE1242C535002226BA /* TexShader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D51242C535002226BA /* TexShader.cpp */; };
+		498770EF1242C535002226BA /* TexShader.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770D61242C535002226BA /* TexShader.h */; };
+		498770F01242C535002226BA /* Texture.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D71242C535002226BA /* Texture.cpp */; };
+		498770F11242C535002226BA /* Texture.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770D81242C535002226BA /* Texture.h */; };
+		498770F21242C535002226BA /* TilingData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 498770D91242C535002226BA /* TilingData.cpp */; };
+		498770F31242C535002226BA /* TilingData.h in Headers */ = {isa = PBXBuildFile; fileRef = 498770DA1242C535002226BA /* TilingData.h */; };
+		498771531243F9FA002226BA /* DrawingBufferMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 498771521243F9FA002226BA /* DrawingBufferMac.mm */; };
+		49B69E5E1254FEED007D57EB /* LoopBlinnClassifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49B69E551254FEED007D57EB /* LoopBlinnClassifier.cpp */; };
+		49B69E5F1254FEED007D57EB /* LoopBlinnClassifier.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E561254FEED007D57EB /* LoopBlinnClassifier.h */; };
+		49B69E601254FEED007D57EB /* LoopBlinnConstants.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E571254FEED007D57EB /* LoopBlinnConstants.h */; };
+		49B69E631254FEED007D57EB /* LoopBlinnMathUtils.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49B69E5A1254FEED007D57EB /* LoopBlinnMathUtils.cpp */; };
+		49B69E641254FEED007D57EB /* LoopBlinnMathUtils.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E5B1254FEED007D57EB /* LoopBlinnMathUtils.h */; };
+		49B69E651254FEED007D57EB /* LoopBlinnTextureCoords.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49B69E5C1254FEED007D57EB /* LoopBlinnTextureCoords.cpp */; };
+		49B69E661254FEED007D57EB /* LoopBlinnTextureCoords.h in Headers */ = {isa = PBXBuildFile; fileRef = 49B69E5D1254FEED007D57EB /* LoopBlinnTextureCoords.h */; };
 		49C7B9931042D2D30009D447 /* JSWebGLBuffer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */; };
 		49C7B9941042D2D30009D447 /* JSWebGLBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */; };
 		49C7B9951042D2D30009D447 /* JSInt8Array.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 49C7B9821042D2D30009D447 /* JSInt8Array.cpp */; };
@@ -1078,6 +1132,8 @@
 		4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F4F5FFA11CBD2D200A186BF /* InspectorFrontend.cpp */; };
 		4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */; };
 		4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */; };
+		4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FA3B908125CD12100300BAD /* InspectorState.cpp */; };
+		4FA3B90B125CD12200300BAD /* InspectorState.h in Headers */ = {isa = PBXBuildFile; fileRef = 4FA3B909125CD12200300BAD /* InspectorState.h */; };
 		4FD8D0F2119C718B002FA825 /* ScriptGCEvent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */; };
 		4FD8D0F3119C718B002FA825 /* ScriptGCEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 4FD8D0F1119C718B002FA825 /* ScriptGCEvent.h */; };
 		510184690B08602A004A825F /* CachedPage.h in Headers */ = {isa = PBXBuildFile; fileRef = 510184670B08602A004A825F /* CachedPage.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -1444,6 +1500,7 @@
 		7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */; };
 		7A0E771E10C00DB100A0276E /* JSInspectorFrontendHost.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */; };
 		7A0E771F10C00DB100A0276E /* JSInspectorFrontendHost.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */; };
+		7A1F2B52126C61B20006A7E6 /* InspectorClient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A1F2B51126C61B20006A7E6 /* InspectorClient.cpp */; };
 		7A24587B1021EAF4000A00AA /* InspectorDOMAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */; };
 		7A24587C1021EAF4000A00AA /* InspectorDOMAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		7A674BDB0F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */; };
@@ -1463,6 +1520,12 @@
 		81BE209911F4AB8D00915DFA /* IDBCursorBackendInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE209411F4AB8D00915DFA /* IDBCursorBackendInterface.h */; };
 		81BE20D211F4BC3200915DFA /* JSIDBCursor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */; };
 		81BE20D311F4BC3200915DFA /* JSIDBCursor.h in Headers */ = {isa = PBXBuildFile; fileRef = 81BE20A811F4B66F00915DFA /* JSIDBCursor.h */; };
+		82AB1743124B99EC00C5069D /* InspectorCSSAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */; };
+		82AB1744124B99EC00C5069D /* InspectorCSSAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */; };
+		82AB1773125C826700C5069D /* InspectorStyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 82AB176F125C826700C5069D /* InspectorStyleSheet.cpp */; };
+		82AB1774125C826700C5069D /* InspectorStyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = 82AB1770125C826700C5069D /* InspectorStyleSheet.h */; };
+		82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 82AB1771125C826700C5069D /* InspectorResourceAgent.cpp */; };
+		82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 82AB1772125C826700C5069D /* InspectorResourceAgent.h */; };
 		82B658981189E39200E052A1 /* InspectorCSSStore.h in Headers */ = {isa = PBXBuildFile; fileRef = 82B658971189E39200E052A1 /* InspectorCSSStore.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		82B6589A1189E47600E052A1 /* InspectorCSSStore.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 82B658991189E47600E052A1 /* InspectorCSSStore.cpp */; };
 		82E3D8DE122EA0D1003AE5BC /* CSSPropertySourceData.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 82E3D8DC122EA0D1003AE5BC /* CSSPropertySourceData.cpp */; };
@@ -1808,22 +1871,8 @@
 		853CA9D70AEEC5E9002372DC /* RenderSVGContainer.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9CB0AEEC5E9002372DC /* RenderSVGContainer.h */; };
 		853CA9D80AEEC5E9002372DC /* RenderSVGImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9CC0AEEC5E9002372DC /* RenderSVGImage.cpp */; };
 		853CA9D90AEEC5E9002372DC /* RenderSVGImage.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9CD0AEEC5E9002372DC /* RenderSVGImage.h */; };
-		853CA9DA0AEEC5E9002372DC /* RenderSVGInline.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9CE0AEEC5E9002372DC /* RenderSVGInline.cpp */; };
-		853CA9DB0AEEC5E9002372DC /* RenderSVGInline.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9CF0AEEC5E9002372DC /* RenderSVGInline.h */; };
-		853CA9DC0AEEC5E9002372DC /* RenderSVGInlineText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9D00AEEC5E9002372DC /* RenderSVGInlineText.cpp */; };
-		853CA9DD0AEEC5E9002372DC /* RenderSVGInlineText.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9D10AEEC5E9002372DC /* RenderSVGInlineText.h */; };
-		853CA9DE0AEEC5E9002372DC /* RenderSVGText.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9D20AEEC5E9002372DC /* RenderSVGText.cpp */; };
-		853CA9DF0AEEC5E9002372DC /* RenderSVGText.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9D30AEEC5E9002372DC /* RenderSVGText.h */; };
-		853CA9E00AEEC5E9002372DC /* RenderSVGTSpan.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9D40AEEC5E9002372DC /* RenderSVGTSpan.cpp */; };
-		853CA9E10AEEC5E9002372DC /* RenderSVGTSpan.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9D50AEEC5E9002372DC /* RenderSVGTSpan.h */; };
-		853CA9E60AEEC608002372DC /* SVGInlineFlowBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9E20AEEC608002372DC /* SVGInlineFlowBox.cpp */; };
-		853CA9E70AEEC608002372DC /* SVGInlineFlowBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9E30AEEC608002372DC /* SVGInlineFlowBox.h */; };
-		853CA9E80AEEC608002372DC /* SVGRootInlineBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9E40AEEC608002372DC /* SVGRootInlineBox.cpp */; };
-		853CA9E90AEEC608002372DC /* SVGRootInlineBox.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9E50AEEC608002372DC /* SVGRootInlineBox.h */; };
 		853CA9EC0AEEC63C002372DC /* RenderForeignObject.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9EA0AEEC63C002372DC /* RenderForeignObject.cpp */; };
 		853CA9ED0AEEC63C002372DC /* RenderForeignObject.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9EB0AEEC63C002372DC /* RenderForeignObject.h */; };
-		853CA9F00AEEC657002372DC /* RenderPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 853CA9EE0AEEC657002372DC /* RenderPath.cpp */; };
-		853CA9F10AEEC657002372DC /* RenderPath.h in Headers */ = {isa = PBXBuildFile; fileRef = 853CA9EF0AEEC657002372DC /* RenderPath.h */; };
 		854074FC0AD6C22E00620C57 /* DOMSVGNumber.h in Headers */ = {isa = PBXBuildFile; fileRef = 854074F90AD6C22E00620C57 /* DOMSVGNumber.h */; };
 		854074FD0AD6C22E00620C57 /* DOMSVGPoint.h in Headers */ = {isa = PBXBuildFile; fileRef = 854074FA0AD6C22E00620C57 /* DOMSVGPoint.h */; };
 		854074FE0AD6C22E00620C57 /* DOMSVGRect.h in Headers */ = {isa = PBXBuildFile; fileRef = 854074FB0AD6C22E00620C57 /* DOMSVGRect.h */; };
@@ -2372,7 +2421,7 @@
 		85E9E0A80AB3A11900069CD0 /* DOMXPathExpression.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E9E09B0AB3A0C700069CD0 /* DOMXPathExpression.h */; };
 		85E9E0AA0AB3A11900069CD0 /* DOMXPathNSResolver.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E9E09E0AB3A0C700069CD0 /* DOMXPathNSResolver.h */; };
 		85E9E0AB0AB3A11900069CD0 /* DOMXPathResult.h in Copy Generated Headers */ = {isa = PBXBuildFile; fileRef = 85E9E09F0AB3A0C700069CD0 /* DOMXPathResult.h */; };
-		85EC9AFB0A71A2C600EEEAED /* Language.h in Headers */ = {isa = PBXBuildFile; fileRef = 85EC9AF90A71A2C600EEEAED /* Language.h */; };
+		85EC9AFB0A71A2C600EEEAED /* Language.h in Headers */ = {isa = PBXBuildFile; fileRef = 85EC9AF90A71A2C600EEEAED /* Language.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		85ECBEEB0AA7626900544F0B /* DOMHTMLAreaElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ECBEDD0AA7626800544F0B /* DOMHTMLAreaElement.h */; };
 		85ECBEEC0AA7626900544F0B /* DOMHTMLAreaElement.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85ECBEDE0AA7626800544F0B /* DOMHTMLAreaElement.mm */; };
 		85ECBEED0AA7626900544F0B /* DOMHTMLBaseFontElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 85ECBEDF0AA7626800544F0B /* DOMHTMLBaseFontElement.h */; };
@@ -2422,6 +2471,7 @@
 		85FF315A0AAFBFCB00374F38 /* DOMKeyboardEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */; };
 		85FF315B0AAFBFCB00374F38 /* DOMKeyboardEvent.mm in Sources */ = {isa = PBXBuildFile; fileRef = 85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */; };
 		86243D0111BC31F700CC006A /* JSArrayBufferViewHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = 86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */; };
+		890AE0E11256A07900F5968C /* DirectoryReaderBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 890AE0E01256A07900F5968C /* DirectoryReaderBase.h */; };
 		893C47A71238908B002B3D86 /* FileCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47A51238908B002B3D86 /* FileCallback.h */; };
 		893C47A81238908B002B3D86 /* FileWriterCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47A61238908B002B3D86 /* FileWriterCallback.h */; };
 		893C47B71238A099002B3D86 /* JSFileCallback.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47B51238A099002B3D86 /* JSFileCallback.cpp */; };
@@ -2430,6 +2480,35 @@
 		893C47BC1238A0A9002B3D86 /* JSFileWriterCallback.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47BA1238A0A9002B3D86 /* JSFileWriterCallback.h */; };
 		893C47CC123EEBA2002B3D86 /* JSEntryCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47CA123EEBA2002B3D86 /* JSEntryCustom.cpp */; };
 		893C47DF123EF4A9002B3D86 /* JSDirectoryEntryCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47DE123EF4A9002B3D86 /* JSDirectoryEntryCustom.cpp */; };
+		893C48001248BD3A002B3D86 /* DirectoryEntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47F01248BD39002B3D86 /* DirectoryEntrySync.cpp */; };
+		893C48011248BD3A002B3D86 /* DirectoryEntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47F11248BD39002B3D86 /* DirectoryEntrySync.h */; };
+		893C48021248BD3A002B3D86 /* DirectoryReaderSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47F21248BD39002B3D86 /* DirectoryReaderSync.cpp */; };
+		893C48031248BD3A002B3D86 /* DirectoryReaderSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47F31248BD39002B3D86 /* DirectoryReaderSync.h */; };
+		893C48041248BD3A002B3D86 /* DOMFileSystemBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47F41248BD39002B3D86 /* DOMFileSystemBase.cpp */; };
+		893C48051248BD3A002B3D86 /* DOMFileSystemBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47F51248BD39002B3D86 /* DOMFileSystemBase.h */; };
+		893C48061248BD3A002B3D86 /* DOMFileSystemSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47F61248BD39002B3D86 /* DOMFileSystemSync.cpp */; };
+		893C48071248BD3A002B3D86 /* DOMFileSystemSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47F71248BD39002B3D86 /* DOMFileSystemSync.h */; };
+		893C48081248BD3A002B3D86 /* EntryArraySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47F81248BD39002B3D86 /* EntryArraySync.cpp */; };
+		893C48091248BD3A002B3D86 /* EntryArraySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47F91248BD39002B3D86 /* EntryArraySync.h */; };
+		893C480B1248BD3A002B3D86 /* EntryBase.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47FB1248BD39002B3D86 /* EntryBase.h */; };
+		893C480C1248BD3A002B3D86 /* EntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47FC1248BD39002B3D86 /* EntrySync.cpp */; };
+		893C480D1248BD3A002B3D86 /* EntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47FD1248BD39002B3D86 /* EntrySync.h */; };
+		893C480E1248BD3A002B3D86 /* FileEntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C47FE1248BD39002B3D86 /* FileEntrySync.cpp */; };
+		893C480F1248BD3A002B3D86 /* FileEntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C47FF1248BD39002B3D86 /* FileEntrySync.h */; };
+		893C48211249535B002B3D86 /* JSDirectoryEntrySyncCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C48201249535B002B3D86 /* JSDirectoryEntrySyncCustom.cpp */; };
+		893C483212495472002B3D86 /* JSDirectoryEntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C482612495472002B3D86 /* JSDirectoryEntrySync.cpp */; };
+		893C483312495472002B3D86 /* JSDirectoryEntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C482712495472002B3D86 /* JSDirectoryEntrySync.h */; };
+		893C483412495472002B3D86 /* JSDirectoryReaderSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C482812495472002B3D86 /* JSDirectoryReaderSync.cpp */; };
+		893C483512495472002B3D86 /* JSDirectoryReaderSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C482912495472002B3D86 /* JSDirectoryReaderSync.h */; };
+		893C483612495472002B3D86 /* JSDOMFileSystemSync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C482A12495472002B3D86 /* JSDOMFileSystemSync.cpp */; };
+		893C483712495472002B3D86 /* JSDOMFileSystemSync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C482B12495472002B3D86 /* JSDOMFileSystemSync.h */; };
+		893C483812495472002B3D86 /* JSEntryArraySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C482C12495472002B3D86 /* JSEntryArraySync.cpp */; };
+		893C483912495472002B3D86 /* JSEntryArraySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C482D12495472002B3D86 /* JSEntryArraySync.h */; };
+		893C483A12495472002B3D86 /* JSEntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C482E12495472002B3D86 /* JSEntrySync.cpp */; };
+		893C483B12495472002B3D86 /* JSEntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C482F12495472002B3D86 /* JSEntrySync.h */; };
+		893C483C12495472002B3D86 /* JSFileEntrySync.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C483012495472002B3D86 /* JSFileEntrySync.cpp */; };
+		893C483D12495472002B3D86 /* JSFileEntrySync.h in Headers */ = {isa = PBXBuildFile; fileRef = 893C483112495472002B3D86 /* JSFileEntrySync.h */; };
+		893C485312499B06002B3D86 /* JSEntrySyncCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 893C485212499B06002B3D86 /* JSEntrySyncCustom.cpp */; };
 		89878552122CA064003AABDA /* DirectoryEntry.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 89878539122CA064003AABDA /* DirectoryEntry.cpp */; };
 		89878553122CA064003AABDA /* DirectoryEntry.h in Headers */ = {isa = PBXBuildFile; fileRef = 8987853A122CA064003AABDA /* DirectoryEntry.h */; };
 		89878554122CA064003AABDA /* DirectoryReader.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 8987853B122CA064003AABDA /* DirectoryReader.cpp */; };
@@ -2610,6 +2689,7 @@
 		933A14B90B7D1D5200A53FFD /* JSTextEvent.h in Headers */ = {isa = PBXBuildFile; fileRef = 933A14B70B7D1D5200A53FFD /* JSTextEvent.h */; };
 		93442C9E0D2B335C00338FF9 /* HTMLTableRowsCollection.h in Headers */ = {isa = PBXBuildFile; fileRef = 93442C9D0D2B335C00338FF9 /* HTMLTableRowsCollection.h */; };
 		93442CA00D2B336000338FF9 /* HTMLTableRowsCollection.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93442C9F0D2B336000338FF9 /* HTMLTableRowsCollection.cpp */; };
+		934907E4125BBBC8007F23A0 /* GraphicsContextCG.h in Headers */ = {isa = PBXBuildFile; fileRef = 934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */; };
 		934CC0E10ED39D6F00A658F2 /* ScriptValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 934CC0DF0ED39D6F00A658F2 /* ScriptValue.cpp */; };
 		934CC0E20ED39D6F00A658F2 /* ScriptValue.h in Headers */ = {isa = PBXBuildFile; fileRef = 934CC0E00ED39D6F00A658F2 /* ScriptValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */ = {isa = PBXBuildFile; fileRef = 934CC1090EDB223900A658F2 /* ScriptSourceCode.h */; };
@@ -2668,7 +2748,6 @@
 		939885C408B7E3D100E707C4 /* EventNames.h in Headers */ = {isa = PBXBuildFile; fileRef = 939885C208B7E3D100E707C4 /* EventNames.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		939B02EE0EA2DBC400C54570 /* WidthIterator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 939B02EC0EA2DBC400C54570 /* WidthIterator.cpp */; };
 		939B02EF0EA2DBC400C54570 /* WidthIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = 939B02ED0EA2DBC400C54570 /* WidthIterator.h */; };
-		939B3E4E0D3C1E8400B4A92B /* StringBuffer.h in Headers */ = {isa = PBXBuildFile; fileRef = 939B3E4D0D3C1E8400B4A92B /* StringBuffer.h */; };
 		93A38B4B0D0E5808006872C2 /* EditorCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93A38B4A0D0E5808006872C2 /* EditorCommand.cpp */; };
 		93B2D8160F9920D2006AE6B2 /* SuddenTermination.h in Headers */ = {isa = PBXBuildFile; fileRef = 93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */; };
 		93B2D8180F9920EE006AE6B2 /* SuddenTermination.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */; };
@@ -2708,7 +2787,7 @@
 		93E241FF0B2B4E4000C732A1 /* HTMLFrameOwnerElement.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E241FE0B2B4E4000C732A1 /* HTMLFrameOwnerElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93E2425F0B2B509500C732A1 /* HTMLFrameOwnerElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E2425E0B2B509500C732A1 /* HTMLFrameOwnerElement.cpp */; };
 		93E2A306123E9DC0009FE12A /* HTMLParserIdioms.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 93E2A304123E9DC0009FE12A /* HTMLParserIdioms.cpp */; };
-		93E2A307123E9DC0009FE12A /* HTMLParserIdioms.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E2A305123E9DC0009FE12A /* HTMLParserIdioms.h */; };
+		93E2A307123E9DC0009FE12A /* HTMLParserIdioms.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E2A305123E9DC0009FE12A /* HTMLParserIdioms.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93E62D9B0985F41600E1B5E3 /* SystemTime.h in Headers */ = {isa = PBXBuildFile; fileRef = 93E62D990985F41600E1B5E3 /* SystemTime.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		93EB169509F880B00091F8FF /* WebCoreSystemInterface.mm in Sources */ = {isa = PBXBuildFile; fileRef = 93EB169409F880B00091F8FF /* WebCoreSystemInterface.mm */; };
 		93EB169709F880C00091F8FF /* WebCoreSystemInterface.h in Headers */ = {isa = PBXBuildFile; fileRef = 93EB169609F880C00091F8FF /* WebCoreSystemInterface.h */; settings = {ATTRIBUTES = (Private, ); }; };
@@ -2784,6 +2863,8 @@
 		97205AB81239291000B17380 /* MediaDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205AB41239291000B17380 /* MediaDocument.h */; };
 		97205ABB1239292700B17380 /* PluginDocument.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97205AB91239292700B17380 /* PluginDocument.cpp */; };
 		97205ABC1239292700B17380 /* PluginDocument.h in Headers */ = {isa = PBXBuildFile; fileRef = 97205ABA1239292700B17380 /* PluginDocument.h */; };
+		9728C3131268E4390041E89B /* MarkupAccumulator.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9728C3111268E4390041E89B /* MarkupAccumulator.cpp */; };
+		9728C3141268E4390041E89B /* MarkupAccumulator.h in Headers */ = {isa = PBXBuildFile; fileRef = 9728C3121268E4390041E89B /* MarkupAccumulator.h */; };
 		973889A0116EA9DC00ADF313 /* DocumentWriter.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */; };
 		973889A1116EA9DC00ADF313 /* DocumentWriter.h in Headers */ = {isa = PBXBuildFile; fileRef = 9738899F116EA9DC00ADF313 /* DocumentWriter.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		973E325610883B7C005BC493 /* ResourceLoadNotifier.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */; };
@@ -2840,8 +2921,8 @@
 		977B3878122883E900B81FF8 /* HTMLTokenizer.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B385F122883E900B81FF8 /* HTMLTokenizer.h */; };
 		977B3879122883E900B81FF8 /* HTMLViewSourceParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 977B3860122883E900B81FF8 /* HTMLViewSourceParser.cpp */; };
 		977B387A122883E900B81FF8 /* HTMLViewSourceParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 977B3861122883E900B81FF8 /* HTMLViewSourceParser.h */; };
-		979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* RedirectScheduler.cpp */; };
-		979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* RedirectScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		979F43D31075E44A0000F83B /* NavigationScheduler.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 979F43D11075E44A0000F83B /* NavigationScheduler.cpp */; };
+		979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */ = {isa = PBXBuildFile; fileRef = 979F43D21075E44A0000F83B /* NavigationScheduler.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		97BC84831236FD93000C6161 /* TextDocumentParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97BC84811236FD93000C6161 /* TextDocumentParser.cpp */; };
 		97BC84841236FD93000C6161 /* TextDocumentParser.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC84821236FD93000C6161 /* TextDocumentParser.h */; };
 		97BC849B12370A4B000C6161 /* HTMLInputStream.h in Headers */ = {isa = PBXBuildFile; fileRef = 97BC849A12370A4B000C6161 /* HTMLInputStream.h */; };
@@ -2855,6 +2936,8 @@
 		97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */; };
 		97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */ = {isa = PBXBuildFile; fileRef = 97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */; };
 		97EF7DFE107E55B700D7C49C /* ScriptControllerBase.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */; };
+		9B417064125662B3006B28FC /* ApplyBlockElementCommand.h in Headers */ = {isa = PBXBuildFile; fileRef = 9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */; settings = {ATTRIBUTES = (Private, ); }; };
+		9B417065125662B3006B28FC /* ApplyBlockElementCommand.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */; };
 		9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */; };
 		9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */ = {isa = PBXBuildFile; fileRef = 9F0D6B2D121BFEBA006C0288 /* InspectorProfilerAgent.h */; };
 		9F3B947E12241758005304E7 /* ScriptHeapSnapshot.h in Headers */ = {isa = PBXBuildFile; fileRef = 9F3B947D12241758005304E7 /* ScriptHeapSnapshot.h */; };
@@ -3287,9 +3370,9 @@
 		A871DB270A150BD600B12A68 /* HTMLTableElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB190A150BD600B12A68 /* HTMLTableElement.h */; };
 		A871DB280A150BD600B12A68 /* HTMLTableElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A871DB1A0A150BD600B12A68 /* HTMLTableElement.cpp */; };
 		A871DB290A150BD600B12A68 /* HTMLTableColElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A871DB1B0A150BD600B12A68 /* HTMLTableColElement.cpp */; };
-		A871DB2A0A150BD600B12A68 /* HTMLTableCellElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB1C0A150BD600B12A68 /* HTMLTableCellElement.h */; };
+		A871DB2A0A150BD600B12A68 /* HTMLTableCellElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB1C0A150BD600B12A68 /* HTMLTableCellElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A871DB2B0A150BD600B12A68 /* HTMLTableCaptionElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB1D0A150BD600B12A68 /* HTMLTableCaptionElement.h */; };
-		A871DB2C0A150BD600B12A68 /* HTMLTablePartElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB1E0A150BD600B12A68 /* HTMLTablePartElement.h */; };
+		A871DB2C0A150BD600B12A68 /* HTMLTablePartElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB1E0A150BD600B12A68 /* HTMLTablePartElement.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		A871DB2D0A150BD600B12A68 /* HTMLTablePartElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A871DB1F0A150BD600B12A68 /* HTMLTablePartElement.cpp */; };
 		A871DB2E0A150BD600B12A68 /* HTMLTableCellElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A871DB200A150BD600B12A68 /* HTMLTableCellElement.cpp */; };
 		A871DB2F0A150BD600B12A68 /* HTMLTableColElement.h in Headers */ = {isa = PBXBuildFile; fileRef = A871DB210A150BD600B12A68 /* HTMLTableColElement.h */; };
@@ -3783,8 +3866,6 @@
 		A9D248070D757E7D00FDF959 /* JSDOMMimeType.h in Headers */ = {isa = PBXBuildFile; fileRef = A9D248030D757E7D00FDF959 /* JSDOMMimeType.h */; };
 		A9D248080D757E7D00FDF959 /* JSDOMMimeTypeArray.cpp in Sources */ = {isa = PBXBuildFile; fileRef = A9D248040D757E7D00FDF959 /* JSDOMMimeTypeArray.cpp */; };
 		A9D248090D757E7D00FDF959 /* JSDOMMimeTypeArray.h in Headers */ = {isa = PBXBuildFile; fileRef = A9D248050D757E7D00FDF959 /* JSDOMMimeTypeArray.h */; };
-		AA0972CC0B6947A800A705E9 /* SVGInlineTextBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AA0972CA0B6947A800A705E9 /* SVGInlineTextBox.cpp */; };
-		AA0972CD0B6947A800A705E9 /* SVGInlineTextBox.h in Headers */ = {isa = PBXBuildFile; fileRef = AA0972CB0B6947A800A705E9 /* SVGInlineTextBox.h */; };
 		AA21ECCA0ABF0FBA002B834C /* CSSCursorImageValue.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AA0978ED0ABAA6E100874480 /* CSSCursorImageValue.cpp */; };
 		AA21ECCD0ABF0FC6002B834C /* CSSCursorImageValue.h in Headers */ = {isa = PBXBuildFile; fileRef = AA0978EE0ABAA6E100874480 /* CSSCursorImageValue.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		AA31B5B40C1DFD1000AE7083 /* RenderSVGRoot.cpp in Sources */ = {isa = PBXBuildFile; fileRef = AA31B5B20C1DFD1000AE7083 /* RenderSVGRoot.cpp */; };
@@ -3812,6 +3893,8 @@
 		ABDDFE7A0A5C6E7000A3E11D /* RenderMenuList.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */; };
 		ABFE7E120D32FAF60066F4D2 /* MediaControlElements.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */; };
 		ABFE7E130D32FAF60066F4D2 /* MediaControlElements.h in Headers */ = {isa = PBXBuildFile; fileRef = ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */; };
+		ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */; };
+		ADDF1AD71257CD9A0003A759 /* RenderSVGPath.h in Headers */ = {isa = PBXBuildFile; fileRef = ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */; };
 		B0149E7D11A4B21500196A7B /* AsyncImageResizer.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */; };
 		B0149E7E11A4B21500196A7B /* AsyncImageResizer.h in Headers */ = {isa = PBXBuildFile; fileRef = B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */; };
 		B0149E7F11A4B21500196A7B /* ImageResizerThread.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B0149E7B11A4B21500196A7B /* ImageResizerThread.cpp */; };
@@ -3835,7 +3918,6 @@
 		B22279850D00BF220071B782 /* SVGAnimatedPathData.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277EF0D00BF1F0071B782 /* SVGAnimatedPathData.h */; };
 		B22279870D00BF220071B782 /* SVGAnimatedPoints.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F10D00BF1F0071B782 /* SVGAnimatedPoints.cpp */; };
 		B22279880D00BF220071B782 /* SVGAnimatedPoints.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F20D00BF1F0071B782 /* SVGAnimatedPoints.h */; };
-		B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B222798F0D00BF220071B782 /* SVGAnimateElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277F90D00BF1F0071B782 /* SVGAnimateElement.cpp */; };
 		B22279900D00BF220071B782 /* SVGAnimateElement.h in Headers */ = {isa = PBXBuildFile; fileRef = B22277FA0D00BF1F0071B782 /* SVGAnimateElement.h */; };
 		B22279920D00BF220071B782 /* SVGAnimateMotionElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B22277FC0D00BF1F0071B782 /* SVGAnimateMotionElement.cpp */; };
@@ -4093,8 +4175,6 @@
 		B25599A50D00D8BA00BB825C /* EmptyClients.h in Headers */ = {isa = PBXBuildFile; fileRef = B255990D0D00D8B900BB825C /* EmptyClients.h */; };
 		B25DFAAF0B2E2929000E6510 /* JSSVGMatrixCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B25DFAAE0B2E2929000E6510 /* JSSVGMatrixCustom.cpp */; };
 		B262B8040D1F32D000158F09 /* SVGFont.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B262B8030D1F32D000158F09 /* SVGFont.cpp */; };
-		B26554EA0B80D74900A50EC3 /* RenderSVGTextPath.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B26554E80B80D74900A50EC3 /* RenderSVGTextPath.cpp */; };
-		B26554EB0B80D74900A50EC3 /* RenderSVGTextPath.h in Headers */ = {isa = PBXBuildFile; fileRef = B26554E90B80D74900A50EC3 /* RenderSVGTextPath.h */; };
 		B266CD4D0C3AEC6500EB08D2 /* JSSVGException.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B266CD4B0C3AEC6500EB08D2 /* JSSVGException.cpp */; };
 		B266CD4E0C3AEC6500EB08D2 /* JSSVGException.h in Headers */ = {isa = PBXBuildFile; fileRef = B266CD4C0C3AEC6500EB08D2 /* JSSVGException.h */; };
 		B27535580B053814002CE64F /* TransformationMatrixCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B275352A0B053814002CE64F /* TransformationMatrixCG.cpp */; };
@@ -4194,8 +4274,6 @@
 		B2B1F7170D00CAA8004AEA64 /* PointerEventsHitRules.h in Headers */ = {isa = PBXBuildFile; fileRef = B2B1F7150D00CAA8004AEA64 /* PointerEventsHitRules.h */; };
 		B2B2645C0D00A77E000ACC1D /* StringCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2B2645A0D00A77E000ACC1D /* StringCF.cpp */; };
 		B2B2645D0D00A77E000ACC1D /* StringImplCF.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2B2645B0D00A77E000ACC1D /* StringImplCF.cpp */; };
-		B2B33A5F0B887CEF00C15984 /* SVGCharacterLayoutInfo.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2B33A5D0B887CEF00C15984 /* SVGCharacterLayoutInfo.cpp */; };
-		B2B33A600B887CEF00C15984 /* SVGCharacterLayoutInfo.h in Headers */ = {isa = PBXBuildFile; fileRef = B2B33A5E0B887CEF00C15984 /* SVGCharacterLayoutInfo.h */; };
 		B2C3DA210D006C1D00EF6F26 /* Base64.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2C3D9F00D006C1D00EF6F26 /* Base64.cpp */; };
 		B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */ = {isa = PBXBuildFile; fileRef = B2C3D9F10D006C1D00EF6F26 /* Base64.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		B2C3DA230D006C1D00EF6F26 /* BidiContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */; };
@@ -4676,7 +4754,7 @@
 		BC51579F0C03BBD3008BB0EE /* DOMHTMLMarqueeElement.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5156E50C03B741008BB0EE /* DOMHTMLMarqueeElement.h */; };
 		BC5157DD0C03BC22008BB0EE /* DOMHTMLFrameElementPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = BC5156F30C03B7DC008BB0EE /* DOMHTMLFrameElementPrivate.h */; };
 		BC51580B0C03D404008BB0EE /* JSHTMLDocumentCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC51580A0C03D404008BB0EE /* JSHTMLDocumentCustom.cpp */; };
-		BC53C5F50DA56B920021EB5D /* Gradient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC53C5F40DA56B920021EB5D /* Gradient.h */; };
+		BC53C5F50DA56B920021EB5D /* Gradient.h in Headers */ = {isa = PBXBuildFile; fileRef = BC53C5F40DA56B920021EB5D /* Gradient.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC53C6080DA56C570021EB5D /* Gradient.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53C6070DA56C570021EB5D /* Gradient.cpp */; };
 		BC53C60B0DA56CF10021EB5D /* GradientCG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC53C60A0DA56CF10021EB5D /* GradientCG.cpp */; };
 		BC53C6920DA591140021EB5D /* CSSGradientValue.h in Headers */ = {isa = PBXBuildFile; fileRef = BC53C6910DA591140021EB5D /* CSSGradientValue.h */; };
@@ -4798,7 +4876,6 @@
 		BC74DA481013F468007987AD /* JSRGBColor.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC74DA461013F468007987AD /* JSRGBColor.cpp */; };
 		BC74DA491013F468007987AD /* JSRGBColor.h in Headers */ = {isa = PBXBuildFile; fileRef = BC74DA471013F468007987AD /* JSRGBColor.h */; };
 		BC76AC130DD7AD5C00415F34 /* ParserUtilities.h in Headers */ = {isa = PBXBuildFile; fileRef = BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */; };
-		BC772B3B0C4EA91E0083285F /* CSSHelper.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772B350C4EA91E0083285F /* CSSHelper.cpp */; };
 		BC772B3C0C4EA91E0083285F /* CSSHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772B360C4EA91E0083285F /* CSSHelper.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BC772B3D0C4EA91E0083285F /* CSSParser.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC772B370C4EA91E0083285F /* CSSParser.cpp */; };
 		BC772B3E0C4EA91E0083285F /* CSSParser.h in Headers */ = {isa = PBXBuildFile; fileRef = BC772B380C4EA91E0083285F /* CSSParser.h */; };
@@ -4986,7 +5063,7 @@
 		BCDFD4960E30592F009D10AD /* JSXMLHttpRequestUpload.h in Headers */ = {isa = PBXBuildFile; fileRef = BCDFD4940E30592F009D10AD /* JSXMLHttpRequestUpload.h */; };
 		BCE0139A0C0BEF180043860A /* JSStyleSheet.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE013980C0BEF180043860A /* JSStyleSheet.cpp */; };
 		BCE0139B0C0BEF180043860A /* JSStyleSheet.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE013990C0BEF180043860A /* JSStyleSheet.h */; };
-		BCE04C8A0DAFF7A0007A0F41 /* Generator.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE04C890DAFF7A0007A0F41 /* Generator.h */; };
+		BCE04C8A0DAFF7A0007A0F41 /* Generator.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE04C890DAFF7A0007A0F41 /* Generator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCE04C940DAFF902007A0F41 /* GeneratedImage.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE04C930DAFF902007A0F41 /* GeneratedImage.cpp */; };
 		BCE1C41B0D982980003B02F2 /* Location.h in Headers */ = {isa = PBXBuildFile; fileRef = BCE1C4190D982980003B02F2 /* Location.h */; };
 		BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCE1C41A0D982980003B02F2 /* Location.cpp */; };
@@ -5022,7 +5099,7 @@
 		BCEA4861097D93020094C9E4 /* RenderBox.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEA4822097D93020094C9E4 /* RenderBox.cpp */; };
 		BCEA4862097D93020094C9E4 /* RenderBox.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEA4823097D93020094C9E4 /* RenderBox.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCEA4863097D93020094C9E4 /* RenderBR.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEA4824097D93020094C9E4 /* RenderBR.cpp */; };
-		BCEA4864097D93020094C9E4 /* RenderBR.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEA4825097D93020094C9E4 /* RenderBR.h */; };
+		BCEA4864097D93020094C9E4 /* RenderBR.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEA4825097D93020094C9E4 /* RenderBR.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		BCEA4865097D93020094C9E4 /* RenderButton.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEA4826097D93020094C9E4 /* RenderButton.cpp */; };
 		BCEA4866097D93020094C9E4 /* RenderButton.h in Headers */ = {isa = PBXBuildFile; fileRef = BCEA4827097D93020094C9E4 /* RenderButton.h */; };
 		BCEA4867097D93020094C9E4 /* RenderView.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCEA4828097D93020094C9E4 /* RenderView.cpp */; };
@@ -5152,7 +5229,6 @@
 		C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B311D4FB3D004C3E4B /* IDBKey.h */; };
 		C585A6E911D4FB3D004C3E4B /* IDBKeyRange.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */; };
 		C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */; };
-		C585A6EC11D4FB3D004C3E4B /* IDBKeyTree.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B811D4FB3D004C3E4B /* IDBKeyTree.h */; };
 		C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */; };
 		C585A6EE11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */; };
 		C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */ = {isa = PBXBuildFile; fileRef = C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */; };
@@ -5258,9 +5334,8 @@
 		E182568F0EF2B02D00933242 /* JSWorkerContext.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */; };
 		E18256900EF2B02D00933242 /* JSWorkerContext.h in Headers */ = {isa = PBXBuildFile; fileRef = E182568E0EF2B02D00933242 /* JSWorkerContext.h */; };
 		E18258AC0EF3CD7000933242 /* JSWorkerContextCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */; };
+		E18772F1126E2629003DD586 /* Language.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E18772F0126E2629003DD586 /* Language.cpp */; };
 		E1A1470811102B1500EEC0F3 /* ContainerNodeAlgorithms.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */; };
-		E1A302BC0DE8370300C52F2C /* StringBuilder.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A302BB0DE8370300C52F2C /* StringBuilder.h */; };
-		E1A302C10DE8376900C52F2C /* StringBuilder.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A302C00DE8376900C52F2C /* StringBuilder.cpp */; };
 		E1A5F99B0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */; };
 		E1A643F20EC0972500779668 /* WorkerScriptController.h in Headers */ = {isa = PBXBuildFile; fileRef = E1A643F10EC0972500779668 /* WorkerScriptController.h */; };
 		E1A643FD0EC097A000779668 /* WorkerScriptController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */; };
@@ -5429,6 +5504,8 @@
 		F55B3DDE1251F12D003EF269 /* URLInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3DAA1251F12D003EF269 /* URLInputType.h */; };
 		F55B3DDF1251F12D003EF269 /* WeekInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F55B3DAB1251F12D003EF269 /* WeekInputType.cpp */; };
 		F55B3DE01251F12D003EF269 /* WeekInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F55B3DAC1251F12D003EF269 /* WeekInputType.h */; };
+		F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */; };
+		F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */ = {isa = PBXBuildFile; fileRef = F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */; };
 		F5C041DA0FFCA7CE00839D4A /* HTMLDataListElement.cpp in Sources */ = {isa = PBXBuildFile; fileRef = F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */; };
 		F5C041DB0FFCA7CE00839D4A /* HTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */; };
 		F5C041E30FFCA96D00839D4A /* DOMHTMLDataListElement.h in Headers */ = {isa = PBXBuildFile; fileRef = F5C041DE0FFCA96D00839D4A /* DOMHTMLDataListElement.h */; };
@@ -5973,11 +6050,25 @@
 		080AEC7E0ED8708B00DF4CCE /* WMLIntrinsicEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLIntrinsicEvent.h; sourceTree = "<group>"; };
 		080AEC7F0ED8708B00DF4CCE /* WMLIntrinsicEventHandler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLIntrinsicEventHandler.cpp; sourceTree = "<group>"; };
 		080AEC800ED8708B00DF4CCE /* WMLIntrinsicEventHandler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLIntrinsicEventHandler.h; sourceTree = "<group>"; };
+		080E49211255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutEngineBaseline.cpp; sourceTree = "<group>"; };
+		080E49221255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutEngineBaseline.h; sourceTree = "<group>"; };
+		080E49231255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutEngineSpacing.cpp; sourceTree = "<group>"; };
+		080E49241255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutEngineSpacing.h; sourceTree = "<group>"; };
 		080FAE180EEEBDA800AACDE9 /* WMLTemplateElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLTemplateElement.cpp; sourceTree = "<group>"; };
 		080FAE190EEEBDA800AACDE9 /* WMLTemplateElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLTemplateElement.h; sourceTree = "<group>"; };
+		081093D91255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutAttributesBuilder.cpp; sourceTree = "<group>"; };
+		081093DA1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutAttributesBuilder.h; sourceTree = "<group>"; };
+		081668D1125603BF006F25DE /* SVGTextChunkBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextChunkBuilder.cpp; sourceTree = "<group>"; };
+		081668D2125603BF006F25DE /* SVGTextChunkBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextChunkBuilder.h; sourceTree = "<group>"; };
+		081668D7125603D5006F25DE /* SVGTextLayoutEngine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutEngine.cpp; sourceTree = "<group>"; };
+		081668D8125603D5006F25DE /* SVGTextLayoutEngine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutEngine.h; sourceTree = "<group>"; };
 		0818AEE00EDB86BC00647B66 /* WMLEventHandlingElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLEventHandlingElement.cpp; sourceTree = "<group>"; };
 		0818AEE10EDB86BC00647B66 /* WMLEventHandlingElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLEventHandlingElement.h; sourceTree = "<group>"; };
 		081AA8D91111237E002AB06E /* SVGElementRareData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGElementRareData.h; sourceTree = "<group>"; };
+		081CDFB5126ECFDB00D215CA /* DeprecatedSVGAnimatedProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedSVGAnimatedProperty.h; sourceTree = "<group>"; };
+		081CDFB6126ECFDB00D215CA /* DeprecatedSVGAnimatedPropertyTraits.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedSVGAnimatedPropertyTraits.h; sourceTree = "<group>"; };
+		081CDFB7126ECFDB00D215CA /* DeprecatedSVGAnimatedTemplate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedSVGAnimatedTemplate.h; sourceTree = "<group>"; };
+		081CDFBE126ECFE800D215CA /* SVGAnimatedPropertySynchronizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedPropertySynchronizer.h; sourceTree = "<group>"; };
 		081D812F0EE0E74D00D73689 /* WMLTimerElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLTimerElement.cpp; sourceTree = "<group>"; };
 		081D81300EE0E74D00D73689 /* WMLTimerElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLTimerElement.h; sourceTree = "<group>"; };
 		081EBF380FD34F4100DA7559 /* SVGFilterBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFilterBuilder.cpp; sourceTree = "<group>"; };
@@ -5995,11 +6086,6 @@
 		083DAEA30F01A7FB00342754 /* RenderTextControlMultiLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlMultiLine.h; sourceTree = "<group>"; };
 		083DAEA40F01A7FB00342754 /* RenderTextControlSingleLine.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderTextControlSingleLine.cpp; sourceTree = "<group>"; };
 		083DAEA50F01A7FB00342754 /* RenderTextControlSingleLine.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderTextControlSingleLine.h; sourceTree = "<group>"; };
-		083F529711957FBE00653EBE /* SVGTextLayoutUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutUtilities.cpp; sourceTree = "<group>"; };
-		083F529811957FBE00653EBE /* SVGTextLayoutUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutUtilities.h; sourceTree = "<group>"; };
-		0842BC701190144000C7D08F /* SVGCharacterData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGCharacterData.cpp; sourceTree = "<group>"; };
-		0842BC711190144000C7D08F /* SVGCharacterData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGCharacterData.h; sourceTree = "<group>"; };
-		0842BC801190147200C7D08F /* SVGTextChunkLayoutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextChunkLayoutInfo.h; sourceTree = "<group>"; };
 		084AEBE20FB505FA0038483E /* SelectElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SelectElement.cpp; sourceTree = "<group>"; };
 		084AEBE30FB505FA0038483E /* SelectElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SelectElement.h; sourceTree = "<group>"; };
 		084CE5C70F27DADC00E6240E /* WMLOptGroupElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLOptGroupElement.cpp; sourceTree = "<group>"; };
@@ -6010,13 +6096,26 @@
 		084D0E3911F5816100081E1A /* SVGResources.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResources.h; sourceTree = "<group>"; };
 		084D0E3A11F5816100081E1A /* SVGResourcesCache.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGResourcesCache.cpp; sourceTree = "<group>"; };
 		084D0E3B11F5816100081E1A /* SVGResourcesCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGResourcesCache.h; sourceTree = "<group>"; };
-		084D2831110A7FCB0038239A /* SVGAnimatedPropertySynchronizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedPropertySynchronizer.h; sourceTree = "<group>"; };
-		084D2832110A7FCB0038239A /* SVGAnimatedPropertyTraits.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedPropertyTraits.h; sourceTree = "<group>"; };
 		084DBA9D0ED39D350038C226 /* WMLVariables.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLVariables.cpp; sourceTree = "<group>"; };
 		084DBA9E0ED39D360038C226 /* WMLVariables.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLVariables.h; sourceTree = "<group>"; };
-		0853D72F11C9108F00B2FD42 /* SVGTextChunkLayoutInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextChunkLayoutInfo.cpp; sourceTree = "<group>"; };
-		0853D73011C9109000B2FD42 /* SVGTextQuery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextQuery.cpp; sourceTree = "<group>"; };
-		0853D73111C9109000B2FD42 /* SVGTextQuery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextQuery.h; sourceTree = "<group>"; };
+		0854B0021255E4E600B9CDD0 /* RenderSVGInline.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGInline.cpp; sourceTree = "<group>"; };
+		0854B0031255E4E600B9CDD0 /* RenderSVGInline.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGInline.h; sourceTree = "<group>"; };
+		0854B0041255E4E600B9CDD0 /* RenderSVGInlineText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGInlineText.cpp; sourceTree = "<group>"; };
+		0854B0051255E4E600B9CDD0 /* RenderSVGInlineText.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGInlineText.h; sourceTree = "<group>"; };
+		0854B0061255E4E600B9CDD0 /* RenderSVGText.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGText.cpp; sourceTree = "<group>"; };
+		0854B0071255E4E600B9CDD0 /* RenderSVGText.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGText.h; sourceTree = "<group>"; };
+		0854B0081255E4E600B9CDD0 /* RenderSVGTextPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTextPath.cpp; sourceTree = "<group>"; };
+		0854B0091255E4E600B9CDD0 /* RenderSVGTextPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTextPath.h; sourceTree = "<group>"; };
+		0854B00A1255E4E600B9CDD0 /* RenderSVGTSpan.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTSpan.cpp; sourceTree = "<group>"; };
+		0854B00B1255E4E600B9CDD0 /* RenderSVGTSpan.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGTSpan.h; sourceTree = "<group>"; };
+		0854B00C1255E4E600B9CDD0 /* SVGInlineFlowBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGInlineFlowBox.cpp; sourceTree = "<group>"; };
+		0854B00D1255E4E600B9CDD0 /* SVGInlineFlowBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGInlineFlowBox.h; sourceTree = "<group>"; };
+		0854B00E1255E4E600B9CDD0 /* SVGInlineTextBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGInlineTextBox.cpp; sourceTree = "<group>"; };
+		0854B00F1255E4E600B9CDD0 /* SVGInlineTextBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGInlineTextBox.h; sourceTree = "<group>"; };
+		0854B0101255E4E600B9CDD0 /* SVGRootInlineBox.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGRootInlineBox.cpp; sourceTree = "<group>"; };
+		0854B0111255E4E600B9CDD0 /* SVGRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGRootInlineBox.h; sourceTree = "<group>"; };
+		0854B0121255E4E600B9CDD0 /* SVGTextQuery.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextQuery.cpp; sourceTree = "<group>"; };
+		0854B0131255E4E600B9CDD0 /* SVGTextQuery.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextQuery.h; sourceTree = "<group>"; };
 		08563BB2117861770012B578 /* RenderSVGResourcePattern.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGResourcePattern.cpp; sourceTree = "<group>"; };
 		08563BB3117861770012B578 /* RenderSVGResourcePattern.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGResourcePattern.h; sourceTree = "<group>"; };
 		08563BCF117865F50012B578 /* RenderSVGResource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGResource.cpp; sourceTree = "<group>"; };
@@ -6041,7 +6140,6 @@
 		08735FB710E91232006D6FAD /* SVGMarkerLayoutInfo.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGMarkerLayoutInfo.h; sourceTree = "<group>"; };
 		08744BA90EDB7D86004C9E63 /* WMLOnEventElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLOnEventElement.cpp; sourceTree = "<group>"; };
 		08744BAD0EDB7D92004C9E63 /* WMLOnEventElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLOnEventElement.h; sourceTree = "<group>"; };
-		0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedProperty.h; sourceTree = "<group>"; };
 		087D97BE10FB8D7700C00874 /* JSSVGPODListCustom.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSVGPODListCustom.h; sourceTree = "<group>"; };
 		087FFA0D0EFF3ED3009DBD88 /* WMLInsertedLegendElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLInsertedLegendElement.cpp; sourceTree = "<group>"; };
 		087FFA0E0EFF3ED3009DBD88 /* WMLInsertedLegendElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLInsertedLegendElement.h; sourceTree = "<group>"; };
@@ -6061,8 +6159,6 @@
 		0885067E11DA045B00182B98 /* PaintPhase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PaintPhase.h; sourceTree = "<group>"; };
 		088C2F7512390080003D65CE /* SVGTextLayoutAttributes.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutAttributes.cpp; sourceTree = "<group>"; };
 		088C2F7612390080003D65CE /* SVGTextLayoutAttributes.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutAttributes.h; sourceTree = "<group>"; };
-		088C2F7712390081003D65CE /* SVGTextLayoutBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextLayoutBuilder.cpp; sourceTree = "<group>"; };
-		088C2F7812390081003D65CE /* SVGTextLayoutBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextLayoutBuilder.h; sourceTree = "<group>"; };
 		0893E4650ECB68F400A28563 /* WMLPageState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLPageState.cpp; sourceTree = "<group>"; };
 		0893E4660ECB68F400A28563 /* WMLPageState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLPageState.h; sourceTree = "<group>"; };
 		089582530E857A7E00F82C83 /* ImageLoader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageLoader.cpp; sourceTree = "<group>"; };
@@ -6103,6 +6199,11 @@
 		08E6A2E70EEE035200AC1206 /* WMLPostfieldElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLPostfieldElement.h; sourceTree = "<group>"; };
 		08E6E0EF0EFF42BA00029FBF /* WMLFieldSetElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLFieldSetElement.cpp; sourceTree = "<group>"; };
 		08E6E0F00EFF42BA00029FBF /* WMLFieldSetElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WMLFieldSetElement.h; sourceTree = "<group>"; };
+		08F0BFBD1255C53C00075185 /* SVGTextChunk.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextChunk.cpp; sourceTree = "<group>"; };
+		08F0BFBE1255C53C00075185 /* SVGTextChunk.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextChunk.h; sourceTree = "<group>"; };
+		08F0BFBF1255C53C00075185 /* SVGTextFragment.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextFragment.h; sourceTree = "<group>"; };
+		08F0BFC01255C53C00075185 /* SVGTextMetrics.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SVGTextMetrics.cpp; sourceTree = "<group>"; };
+		08F0BFC11255C53C00075185 /* SVGTextMetrics.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SVGTextMetrics.h; sourceTree = "<group>"; };
 		08F2F0071213E61700DCEC48 /* RenderImageResource.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderImageResource.cpp; sourceTree = "<group>"; };
 		08F2F0081213E61700DCEC48 /* RenderImageResource.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderImageResource.h; sourceTree = "<group>"; };
 		08FB84B00ECE373300DC064E /* WMLElementFactory.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WMLElementFactory.cpp; sourceTree = "<group>"; };
@@ -6266,8 +6367,6 @@
 		1A2AAC560DC2A3B100A20D9A /* ApplicationCacheStorage.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheStorage.cpp; sourceTree = "<group>"; };
 		1A2AAC570DC2A3B100A20D9A /* ApplicationCacheStorage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplicationCacheStorage.h; sourceTree = "<group>"; };
 		1A2C40AA0DEB55AA005AF19E /* JSTextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSTextCustom.cpp; sourceTree = "<group>"; };
-		1A2D753B0DE47FAB00F0A648 /* IconFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IconFetcher.h; sourceTree = "<group>"; };
-		1A2D753C0DE47FAB00F0A648 /* IconFetcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IconFetcher.cpp; sourceTree = "<group>"; };
 		1A2E6E570CC55213004A2062 /* SQLValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLValue.cpp; path = sql/SQLValue.cpp; sourceTree = "<group>"; };
 		1A2E6E580CC55213004A2062 /* SQLValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SQLValue.h; path = sql/SQLValue.h; sourceTree = "<group>"; };
 		1A2E6E780CC556D5004A2062 /* SQLiteAuthorizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SQLiteAuthorizer.cpp; path = sql/SQLiteAuthorizer.cpp; sourceTree = "<group>"; };
@@ -6392,6 +6491,7 @@
 		1AA8798F11CBE846003C664F /* PluginStrategy.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginStrategy.h; sourceTree = "<group>"; };
 		1AB1AE780C051FDE00139F4F /* zoomInCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomInCursor.png; sourceTree = "<group>"; };
 		1AB1AE790C051FDE00139F4F /* zoomOutCursor.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = zoomOutCursor.png; sourceTree = "<group>"; };
+		1AB33DA412551E320024457A /* IOKit.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = IOKit.framework; path = /System/Library/Frameworks/IOKit.framework; sourceTree = "<absolute>"; };
 		1AB7FC470A8B92EC00D9D37B /* XPathEvaluator.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = XPathEvaluator.cpp; sourceTree = "<group>"; };
 		1AB7FC480A8B92EC00D9D37B /* XPathEvaluator.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = XPathEvaluator.h; sourceTree = "<group>"; };
 		1AB7FC490A8B92EC00D9D37B /* XPathEvaluator.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = XPathEvaluator.idl; sourceTree = "<group>"; };
@@ -6517,6 +6617,9 @@
 		1AE82FEA0CAB07EE002237AE /* JSSQLResultSet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSSQLResultSet.cpp; sourceTree = "<group>"; };
 		1AE82FEB0CAB07EE002237AE /* JSSQLResultSet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSSQLResultSet.h; sourceTree = "<group>"; };
 		1AF326770D78B9440068F0C4 /* EditorClient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = EditorClient.h; sourceTree = "<group>"; };
+		1AF8E1191256592600230FF7 /* ProxyServer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyServer.h; sourceTree = "<group>"; };
+		1AF8E13212565A4400230FF7 /* ProxyServer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServer.cpp; sourceTree = "<group>"; };
+		1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ProxyServerCFNet.cpp; sourceTree = "<group>"; };
 		1AFE117B0CBFFB36003017FA /* SQLResultSetRowList.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SQLResultSetRowList.cpp; sourceTree = "<group>"; };
 		1AFE117C0CBFFB36003017FA /* SQLResultSetRowList.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SQLResultSetRowList.h; sourceTree = "<group>"; };
 		1AFE118C0CBFFC4E003017FA /* SQLResultSetRowList.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = SQLResultSetRowList.idl; sourceTree = "<group>"; };
@@ -6562,6 +6665,8 @@
 		1CF6BE130E9BB4670025E1CD /* ObjCNodeFilterCondition.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ObjCNodeFilterCondition.h; sourceTree = "<group>"; };
 		1CFAE3220A6D6A3F0032593D /* libobjc.dylib */ = {isa = PBXFileReference; lastKnownFileType = "compiled.mach-o.dylib"; name = libobjc.dylib; path = /usr/lib/libobjc.dylib; sourceTree = "<absolute>"; };
 		200B190811C277D900DCCD3A /* ScriptBreakpoint.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptBreakpoint.cpp; sourceTree = "<group>"; };
+		20D629241253690B00081543 /* InspectorInstrumentation.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorInstrumentation.cpp; sourceTree = "<group>"; };
+		20D629251253690B00081543 /* InspectorInstrumentation.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorInstrumentation.h; sourceTree = "<group>"; };
 		228C284410D82500009D0D0E /* ScriptWrappable.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptWrappable.h; sourceTree = "<group>"; };
 		2442BBF81194C9D300D49469 /* HashChangeEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HashChangeEvent.h; sourceTree = "<group>"; };
 		24F54EAA101FE914000AE741 /* ApplicationCacheHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplicationCacheHost.cpp; sourceTree = "<group>"; };
@@ -6799,7 +6904,6 @@
 		416E75BD0EDF8FD700360E1D /* ScriptCallStack.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallStack.cpp; sourceTree = "<group>"; };
 		416E75C90EDF90C700360E1D /* ScriptCallFrame.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptCallFrame.h; sourceTree = "<group>"; };
 		416E75CA0EDF90C700360E1D /* ScriptCallFrame.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptCallFrame.cpp; sourceTree = "<group>"; };
-		416F45EF0ED7B311008215B6 /* ScriptString.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptString.h; sourceTree = "<group>"; };
 		41885B9111B6FDA6003383BB /* FormSubmission.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = FormSubmission.h; sourceTree = "<group>"; };
 		41885B9211B6FDA6003383BB /* FormSubmission.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FormSubmission.cpp; sourceTree = "<group>"; };
 		418F88020FF957AE0080F045 /* JSAbstractWorker.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSAbstractWorker.cpp; sourceTree = "<group>"; };
@@ -6871,6 +6975,7 @@
 		490707E41219C04300D90E51 /* ANGLEWebKitBridge.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ANGLEWebKitBridge.cpp; sourceTree = "<group>"; };
 		490707E51219C04300D90E51 /* ANGLEWebKitBridge.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ANGLEWebKitBridge.h; sourceTree = "<group>"; };
 		492273A21083B3B100EE5C84 /* JSArrayBufferViewCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSArrayBufferViewCustom.cpp; sourceTree = "<group>"; };
+		492863981253B8FC00F792D6 /* ResourceRawHeaders.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ResourceRawHeaders.h; sourceTree = "<group>"; };
 		49484FB3102CF23C00187DD3 /* CanvasGradient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = CanvasGradient.cpp; path = canvas/CanvasGradient.cpp; sourceTree = "<group>"; };
 		49484FB4102CF23C00187DD3 /* CanvasGradient.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = CanvasGradient.h; path = canvas/CanvasGradient.h; sourceTree = "<group>"; };
 		49484FB5102CF23C00187DD3 /* CanvasGradient.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; name = CanvasGradient.idl; path = canvas/CanvasGradient.idl; sourceTree = "<group>"; };
@@ -6897,6 +7002,32 @@
 		498391550F1E776900C23782 /* WebKitCSSMatrix.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebKitCSSMatrix.cpp; sourceTree = "<group>"; };
 		498391560F1E776900C23782 /* WebKitCSSMatrix.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebKitCSSMatrix.h; sourceTree = "<group>"; };
 		498391570F1E776900C23782 /* WebKitCSSMatrix.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = WebKitCSSMatrix.idl; sourceTree = "<group>"; };
+		498770C21242C535002226BA /* DrawingBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DrawingBuffer.cpp; path = gpu/DrawingBuffer.cpp; sourceTree = "<group>"; };
+		498770C31242C535002226BA /* DrawingBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DrawingBuffer.h; path = gpu/DrawingBuffer.h; sourceTree = "<group>"; };
+		498770CB1242C535002226BA /* PODArena.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PODArena.h; path = gpu/PODArena.h; sourceTree = "<group>"; };
+		498770CC1242C535002226BA /* PODInterval.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PODInterval.h; path = gpu/PODInterval.h; sourceTree = "<group>"; };
+		498770CD1242C535002226BA /* PODIntervalTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PODIntervalTree.h; path = gpu/PODIntervalTree.h; sourceTree = "<group>"; };
+		498770CE1242C535002226BA /* PODRedBlackTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = PODRedBlackTree.h; path = gpu/PODRedBlackTree.h; sourceTree = "<group>"; };
+		498770CF1242C535002226BA /* Shader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Shader.cpp; path = gpu/Shader.cpp; sourceTree = "<group>"; };
+		498770D01242C535002226BA /* Shader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Shader.h; path = gpu/Shader.h; sourceTree = "<group>"; };
+		498770D11242C535002226BA /* SharedGraphicsContext3D.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SharedGraphicsContext3D.cpp; path = gpu/SharedGraphicsContext3D.cpp; sourceTree = "<group>"; };
+		498770D21242C535002226BA /* SharedGraphicsContext3D.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SharedGraphicsContext3D.h; path = gpu/SharedGraphicsContext3D.h; sourceTree = "<group>"; };
+		498770D31242C535002226BA /* SolidFillShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SolidFillShader.cpp; path = gpu/SolidFillShader.cpp; sourceTree = "<group>"; };
+		498770D41242C535002226BA /* SolidFillShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SolidFillShader.h; path = gpu/SolidFillShader.h; sourceTree = "<group>"; };
+		498770D51242C535002226BA /* TexShader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TexShader.cpp; path = gpu/TexShader.cpp; sourceTree = "<group>"; };
+		498770D61242C535002226BA /* TexShader.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TexShader.h; path = gpu/TexShader.h; sourceTree = "<group>"; };
+		498770D71242C535002226BA /* Texture.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = Texture.cpp; path = gpu/Texture.cpp; sourceTree = "<group>"; };
+		498770D81242C535002226BA /* Texture.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = Texture.h; path = gpu/Texture.h; sourceTree = "<group>"; };
+		498770D91242C535002226BA /* TilingData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TilingData.cpp; path = gpu/TilingData.cpp; sourceTree = "<group>"; };
+		498770DA1242C535002226BA /* TilingData.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TilingData.h; path = gpu/TilingData.h; sourceTree = "<group>"; };
+		498771521243F9FA002226BA /* DrawingBufferMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = DrawingBufferMac.mm; path = gpu/mac/DrawingBufferMac.mm; sourceTree = "<group>"; };
+		49B69E551254FEED007D57EB /* LoopBlinnClassifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LoopBlinnClassifier.cpp; path = gpu/LoopBlinnClassifier.cpp; sourceTree = "<group>"; };
+		49B69E561254FEED007D57EB /* LoopBlinnClassifier.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LoopBlinnClassifier.h; path = gpu/LoopBlinnClassifier.h; sourceTree = "<group>"; };
+		49B69E571254FEED007D57EB /* LoopBlinnConstants.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LoopBlinnConstants.h; path = gpu/LoopBlinnConstants.h; sourceTree = "<group>"; };
+		49B69E5A1254FEED007D57EB /* LoopBlinnMathUtils.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LoopBlinnMathUtils.cpp; path = gpu/LoopBlinnMathUtils.cpp; sourceTree = "<group>"; };
+		49B69E5B1254FEED007D57EB /* LoopBlinnMathUtils.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LoopBlinnMathUtils.h; path = gpu/LoopBlinnMathUtils.h; sourceTree = "<group>"; };
+		49B69E5C1254FEED007D57EB /* LoopBlinnTextureCoords.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = LoopBlinnTextureCoords.cpp; path = gpu/LoopBlinnTextureCoords.cpp; sourceTree = "<group>"; };
+		49B69E5D1254FEED007D57EB /* LoopBlinnTextureCoords.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = LoopBlinnTextureCoords.h; path = gpu/LoopBlinnTextureCoords.h; sourceTree = "<group>"; };
 		49C7B9801042D2D30009D447 /* JSWebGLBuffer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWebGLBuffer.cpp; sourceTree = "<group>"; };
 		49C7B9811042D2D30009D447 /* JSWebGLBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWebGLBuffer.h; sourceTree = "<group>"; };
 		49C7B9821042D2D30009D447 /* JSInt8Array.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInt8Array.cpp; sourceTree = "<group>"; };
@@ -7072,6 +7203,8 @@
 		4F4F5FFC11CBD30100A186BF /* InspectorFrontend.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorFrontend.h; sourceTree = "<group>"; };
 		4F707A9711EF679400ACDA69 /* InspectorBackendDispatcher.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorBackendDispatcher.cpp; sourceTree = "<group>"; };
 		4F707A9811EF679400ACDA69 /* InspectorBackendDispatcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorBackendDispatcher.h; sourceTree = "<group>"; };
+		4FA3B908125CD12100300BAD /* InspectorState.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorState.cpp; sourceTree = "<group>"; };
+		4FA3B909125CD12200300BAD /* InspectorState.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorState.h; sourceTree = "<group>"; };
 		4FD8D0F0119C718B002FA825 /* ScriptGCEvent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptGCEvent.cpp; sourceTree = "<group>"; };
 		4FD8D0F1119C718B002FA825 /* ScriptGCEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptGCEvent.h; sourceTree = "<group>"; };
 		510184670B08602A004A825F /* CachedPage.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = CachedPage.h; sourceTree = "<group>"; };
@@ -7192,9 +7325,9 @@
 		51A9267A0D53F0570063ECC2 /* OriginUsageRecord.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = OriginUsageRecord.cpp; sourceTree = "<group>"; };
 		51A9267B0D53F0570063ECC2 /* OriginUsageRecord.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = OriginUsageRecord.h; sourceTree = "<group>"; };
 		51AA3F6E0BD5AA9E00892971 /* ResourceLoaderMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ResourceLoaderMac.mm; sourceTree = "<group>"; };
-		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamError.h; path = cf/SocketStreamError.h; sourceTree = "<group>"; };
-		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = SocketStreamHandle.h; path = cf/SocketStreamHandle.h; sourceTree = "<group>"; };
-		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = SocketStreamHandleCFNet.cpp; path = cf/SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
+		51ABAE1A103C18FF008C5260 /* SocketStreamError.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamError.h; sourceTree = "<group>"; };
+		51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SocketStreamHandle.h; sourceTree = "<group>"; };
+		51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SocketStreamHandleCFNet.cpp; sourceTree = "<group>"; };
 		51ABAE421043AB4A008C5260 /* WebSocketHandshake.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WebSocketHandshake.cpp; sourceTree = "<group>"; };
 		51ABAE431043AB4A008C5260 /* WebSocketHandshake.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSocketHandshake.h; sourceTree = "<group>"; };
 		51B2417A0D931F3F00E83F5C /* LegacyWebArchiveMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = LegacyWebArchiveMac.mm; sourceTree = "<group>"; };
@@ -7466,6 +7599,7 @@
 		7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = InspectorFrontendHost.idl; sourceTree = "<group>"; };
 		7A0E771C10C00DB100A0276E /* JSInspectorFrontendHost.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSInspectorFrontendHost.cpp; sourceTree = "<group>"; };
 		7A0E771D10C00DB100A0276E /* JSInspectorFrontendHost.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSInspectorFrontendHost.h; sourceTree = "<group>"; };
+		7A1F2B51126C61B20006A7E6 /* InspectorClient.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorClient.cpp; sourceTree = "<group>"; };
 		7A2458791021EAF4000A00AA /* InspectorDOMAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorDOMAgent.cpp; sourceTree = "<group>"; };
 		7A24587A1021EAF4000A00AA /* InspectorDOMAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorDOMAgent.h; sourceTree = "<group>"; };
 		7A674BD90F9EBF4E006CF099 /* PageGroupLoadDeferrer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageGroupLoadDeferrer.cpp; sourceTree = "<group>"; };
@@ -7486,6 +7620,12 @@
 		81BE209C11F4ABBD00915DFA /* IDBCursor.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBCursor.idl; sourceTree = "<group>"; };
 		81BE20A711F4B66F00915DFA /* JSIDBCursor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSIDBCursor.cpp; sourceTree = "<group>"; };
 		81BE20A811F4B66F00915DFA /* JSIDBCursor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSIDBCursor.h; sourceTree = "<group>"; };
+		82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorCSSAgent.cpp; sourceTree = "<group>"; };
+		82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCSSAgent.h; sourceTree = "<group>"; };
+		82AB176F125C826700C5069D /* InspectorStyleSheet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorStyleSheet.cpp; sourceTree = "<group>"; };
+		82AB1770125C826700C5069D /* InspectorStyleSheet.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorStyleSheet.h; sourceTree = "<group>"; };
+		82AB1771125C826700C5069D /* InspectorResourceAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorResourceAgent.cpp; sourceTree = "<group>"; };
+		82AB1772125C826700C5069D /* InspectorResourceAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorResourceAgent.h; sourceTree = "<group>"; };
 		82B658971189E39200E052A1 /* InspectorCSSStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorCSSStore.h; sourceTree = "<group>"; };
 		82B658991189E47600E052A1 /* InspectorCSSStore.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorCSSStore.cpp; sourceTree = "<group>"; };
 		82E3D8DC122EA0D1003AE5BC /* CSSPropertySourceData.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = CSSPropertySourceData.cpp; sourceTree = "<group>"; };
@@ -7831,22 +7971,8 @@
 		853CA9CB0AEEC5E9002372DC /* RenderSVGContainer.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGContainer.h; sourceTree = "<group>"; };
 		853CA9CC0AEEC5E9002372DC /* RenderSVGImage.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGImage.cpp; sourceTree = "<group>"; };
 		853CA9CD0AEEC5E9002372DC /* RenderSVGImage.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGImage.h; sourceTree = "<group>"; };
-		853CA9CE0AEEC5E9002372DC /* RenderSVGInline.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGInline.cpp; sourceTree = "<group>"; };
-		853CA9CF0AEEC5E9002372DC /* RenderSVGInline.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGInline.h; sourceTree = "<group>"; };
-		853CA9D00AEEC5E9002372DC /* RenderSVGInlineText.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGInlineText.cpp; sourceTree = "<group>"; };
-		853CA9D10AEEC5E9002372DC /* RenderSVGInlineText.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGInlineText.h; sourceTree = "<group>"; };
-		853CA9D20AEEC5E9002372DC /* RenderSVGText.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGText.cpp; sourceTree = "<group>"; };
-		853CA9D30AEEC5E9002372DC /* RenderSVGText.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGText.h; sourceTree = "<group>"; };
-		853CA9D40AEEC5E9002372DC /* RenderSVGTSpan.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTSpan.cpp; sourceTree = "<group>"; };
-		853CA9D50AEEC5E9002372DC /* RenderSVGTSpan.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGTSpan.h; sourceTree = "<group>"; };
-		853CA9E20AEEC608002372DC /* SVGInlineFlowBox.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGInlineFlowBox.cpp; sourceTree = "<group>"; };
-		853CA9E30AEEC608002372DC /* SVGInlineFlowBox.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGInlineFlowBox.h; sourceTree = "<group>"; };
-		853CA9E40AEEC608002372DC /* SVGRootInlineBox.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGRootInlineBox.cpp; sourceTree = "<group>"; };
-		853CA9E50AEEC608002372DC /* SVGRootInlineBox.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGRootInlineBox.h; sourceTree = "<group>"; };
 		853CA9EA0AEEC63C002372DC /* RenderForeignObject.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderForeignObject.cpp; sourceTree = "<group>"; };
 		853CA9EB0AEEC63C002372DC /* RenderForeignObject.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderForeignObject.h; sourceTree = "<group>"; };
-		853CA9EE0AEEC657002372DC /* RenderPath.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderPath.cpp; sourceTree = "<group>"; };
-		853CA9EF0AEEC657002372DC /* RenderPath.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderPath.h; sourceTree = "<group>"; };
 		854074F90AD6C22E00620C57 /* DOMSVGNumber.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGNumber.h; sourceTree = "<group>"; };
 		854074FA0AD6C22E00620C57 /* DOMSVGPoint.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGPoint.h; sourceTree = "<group>"; };
 		854074FB0AD6C22E00620C57 /* DOMSVGRect.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMSVGRect.h; sourceTree = "<group>"; };
@@ -8395,6 +8521,7 @@
 		85FF31580AAFBFCB00374F38 /* DOMKeyboardEvent.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = DOMKeyboardEvent.h; sourceTree = "<group>"; };
 		85FF31590AAFBFCB00374F38 /* DOMKeyboardEvent.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = DOMKeyboardEvent.mm; sourceTree = "<group>"; };
 		86243D0011BC31F700CC006A /* JSArrayBufferViewHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSArrayBufferViewHelper.h; sourceTree = "<group>"; };
+		890AE0E01256A07900F5968C /* DirectoryReaderBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryReaderBase.h; path = fileapi/DirectoryReaderBase.h; sourceTree = "<group>"; };
 		893C47A51238908B002B3D86 /* FileCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileCallback.h; path = fileapi/FileCallback.h; sourceTree = "<group>"; };
 		893C47A61238908B002B3D86 /* FileWriterCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileWriterCallback.h; path = fileapi/FileWriterCallback.h; sourceTree = "<group>"; };
 		893C47B51238A099002B3D86 /* JSFileCallback.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFileCallback.cpp; sourceTree = "<group>"; };
@@ -8403,6 +8530,35 @@
 		893C47BA1238A0A9002B3D86 /* JSFileWriterCallback.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFileWriterCallback.h; sourceTree = "<group>"; };
 		893C47CA123EEBA2002B3D86 /* JSEntryCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEntryCustom.cpp; sourceTree = "<group>"; };
 		893C47DE123EF4A9002B3D86 /* JSDirectoryEntryCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDirectoryEntryCustom.cpp; sourceTree = "<group>"; };
+		893C47F01248BD39002B3D86 /* DirectoryEntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DirectoryEntrySync.cpp; path = fileapi/DirectoryEntrySync.cpp; sourceTree = "<group>"; };
+		893C47F11248BD39002B3D86 /* DirectoryEntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryEntrySync.h; path = fileapi/DirectoryEntrySync.h; sourceTree = "<group>"; };
+		893C47F21248BD39002B3D86 /* DirectoryReaderSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DirectoryReaderSync.cpp; path = fileapi/DirectoryReaderSync.cpp; sourceTree = "<group>"; };
+		893C47F31248BD39002B3D86 /* DirectoryReaderSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryReaderSync.h; path = fileapi/DirectoryReaderSync.h; sourceTree = "<group>"; };
+		893C47F41248BD39002B3D86 /* DOMFileSystemBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMFileSystemBase.cpp; path = fileapi/DOMFileSystemBase.cpp; sourceTree = "<group>"; };
+		893C47F51248BD39002B3D86 /* DOMFileSystemBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMFileSystemBase.h; path = fileapi/DOMFileSystemBase.h; sourceTree = "<group>"; };
+		893C47F61248BD39002B3D86 /* DOMFileSystemSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DOMFileSystemSync.cpp; path = fileapi/DOMFileSystemSync.cpp; sourceTree = "<group>"; };
+		893C47F71248BD39002B3D86 /* DOMFileSystemSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DOMFileSystemSync.h; path = fileapi/DOMFileSystemSync.h; sourceTree = "<group>"; };
+		893C47F81248BD39002B3D86 /* EntryArraySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = EntryArraySync.cpp; path = fileapi/EntryArraySync.cpp; sourceTree = "<group>"; };
+		893C47F91248BD39002B3D86 /* EntryArraySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = EntryArraySync.h; path = fileapi/EntryArraySync.h; sourceTree = "<group>"; };
+		893C47FB1248BD39002B3D86 /* EntryBase.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = EntryBase.h; path = fileapi/EntryBase.h; sourceTree = "<group>"; };
+		893C47FC1248BD39002B3D86 /* EntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = EntrySync.cpp; path = fileapi/EntrySync.cpp; sourceTree = "<group>"; };
+		893C47FD1248BD39002B3D86 /* EntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = EntrySync.h; path = fileapi/EntrySync.h; sourceTree = "<group>"; };
+		893C47FE1248BD39002B3D86 /* FileEntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = FileEntrySync.cpp; path = fileapi/FileEntrySync.cpp; sourceTree = "<group>"; };
+		893C47FF1248BD39002B3D86 /* FileEntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = FileEntrySync.h; path = fileapi/FileEntrySync.h; sourceTree = "<group>"; };
+		893C48201249535B002B3D86 /* JSDirectoryEntrySyncCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDirectoryEntrySyncCustom.cpp; sourceTree = "<group>"; };
+		893C482612495472002B3D86 /* JSDirectoryEntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDirectoryEntrySync.cpp; sourceTree = "<group>"; };
+		893C482712495472002B3D86 /* JSDirectoryEntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDirectoryEntrySync.h; sourceTree = "<group>"; };
+		893C482812495472002B3D86 /* JSDirectoryReaderSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDirectoryReaderSync.cpp; sourceTree = "<group>"; };
+		893C482912495472002B3D86 /* JSDirectoryReaderSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDirectoryReaderSync.h; sourceTree = "<group>"; };
+		893C482A12495472002B3D86 /* JSDOMFileSystemSync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMFileSystemSync.cpp; sourceTree = "<group>"; };
+		893C482B12495472002B3D86 /* JSDOMFileSystemSync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSDOMFileSystemSync.h; sourceTree = "<group>"; };
+		893C482C12495472002B3D86 /* JSEntryArraySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEntryArraySync.cpp; sourceTree = "<group>"; };
+		893C482D12495472002B3D86 /* JSEntryArraySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEntryArraySync.h; sourceTree = "<group>"; };
+		893C482E12495472002B3D86 /* JSEntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEntrySync.cpp; sourceTree = "<group>"; };
+		893C482F12495472002B3D86 /* JSEntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSEntrySync.h; sourceTree = "<group>"; };
+		893C483012495472002B3D86 /* JSFileEntrySync.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSFileEntrySync.cpp; sourceTree = "<group>"; };
+		893C483112495472002B3D86 /* JSFileEntrySync.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSFileEntrySync.h; sourceTree = "<group>"; };
+		893C485212499B06002B3D86 /* JSEntrySyncCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSEntrySyncCustom.cpp; sourceTree = "<group>"; };
 		89878539122CA064003AABDA /* DirectoryEntry.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DirectoryEntry.cpp; path = fileapi/DirectoryEntry.cpp; sourceTree = "<group>"; };
 		8987853A122CA064003AABDA /* DirectoryEntry.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = DirectoryEntry.h; path = fileapi/DirectoryEntry.h; sourceTree = "<group>"; };
 		8987853B122CA064003AABDA /* DirectoryReader.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DirectoryReader.cpp; path = fileapi/DirectoryReader.cpp; sourceTree = "<group>"; };
@@ -8589,6 +8745,7 @@
 		933A14B70B7D1D5200A53FFD /* JSTextEvent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSTextEvent.h; sourceTree = "<group>"; };
 		93442C9D0D2B335C00338FF9 /* HTMLTableRowsCollection.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLTableRowsCollection.h; sourceTree = "<group>"; };
 		93442C9F0D2B336000338FF9 /* HTMLTableRowsCollection.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLTableRowsCollection.cpp; sourceTree = "<group>"; };
+		934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = GraphicsContextCG.h; sourceTree = "<group>"; };
 		934CC0DF0ED39D6F00A658F2 /* ScriptValue.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptValue.cpp; sourceTree = "<group>"; };
 		934CC0E00ED39D6F00A658F2 /* ScriptValue.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptValue.h; sourceTree = "<group>"; };
 		934CC1090EDB223900A658F2 /* ScriptSourceCode.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptSourceCode.h; sourceTree = "<group>"; };
@@ -8651,7 +8808,6 @@
 		939885C208B7E3D100E707C4 /* EventNames.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = EventNames.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		939B02EC0EA2DBC400C54570 /* WidthIterator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WidthIterator.cpp; sourceTree = "<group>"; };
 		939B02ED0EA2DBC400C54570 /* WidthIterator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WidthIterator.h; sourceTree = "<group>"; };
-		939B3E4D0D3C1E8400B4A92B /* StringBuffer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuffer.h; sourceTree = "<group>"; };
 		93A38B4A0D0E5808006872C2 /* EditorCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = EditorCommand.cpp; sourceTree = "<group>"; };
 		93B2D8150F9920D2006AE6B2 /* SuddenTermination.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = SuddenTermination.h; sourceTree = "<group>"; };
 		93B2D8170F9920EE006AE6B2 /* SuddenTermination.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = SuddenTermination.mm; sourceTree = "<group>"; };
@@ -8745,6 +8901,8 @@
 		97205AB41239291000B17380 /* MediaDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaDocument.h; sourceTree = "<group>"; };
 		97205AB91239292700B17380 /* PluginDocument.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PluginDocument.cpp; sourceTree = "<group>"; };
 		97205ABA1239292700B17380 /* PluginDocument.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PluginDocument.h; sourceTree = "<group>"; };
+		9728C3111268E4390041E89B /* MarkupAccumulator.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MarkupAccumulator.cpp; sourceTree = "<group>"; };
+		9728C3121268E4390041E89B /* MarkupAccumulator.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MarkupAccumulator.h; sourceTree = "<group>"; };
 		9738899E116EA9DC00ADF313 /* DocumentWriter.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DocumentWriter.cpp; sourceTree = "<group>"; };
 		9738899F116EA9DC00ADF313 /* DocumentWriter.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DocumentWriter.h; sourceTree = "<group>"; };
 		973E325410883B7C005BC493 /* ResourceLoadNotifier.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ResourceLoadNotifier.cpp; sourceTree = "<group>"; };
@@ -8802,8 +8960,8 @@
 		977B385F122883E900B81FF8 /* HTMLTokenizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLTokenizer.h; path = parser/HTMLTokenizer.h; sourceTree = "<group>"; };
 		977B3860122883E900B81FF8 /* HTMLViewSourceParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = HTMLViewSourceParser.cpp; path = parser/HTMLViewSourceParser.cpp; sourceTree = "<group>"; };
 		977B3861122883E900B81FF8 /* HTMLViewSourceParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLViewSourceParser.h; path = parser/HTMLViewSourceParser.h; sourceTree = "<group>"; };
-		979F43D11075E44A0000F83B /* RedirectScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RedirectScheduler.cpp; sourceTree = "<group>"; };
-		979F43D21075E44A0000F83B /* RedirectScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RedirectScheduler.h; sourceTree = "<group>"; };
+		979F43D11075E44A0000F83B /* NavigationScheduler.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = NavigationScheduler.cpp; sourceTree = "<group>"; };
+		979F43D21075E44A0000F83B /* NavigationScheduler.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = NavigationScheduler.h; sourceTree = "<group>"; };
 		97BC84811236FD93000C6161 /* TextDocumentParser.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = TextDocumentParser.cpp; path = parser/TextDocumentParser.cpp; sourceTree = "<group>"; };
 		97BC84821236FD93000C6161 /* TextDocumentParser.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = TextDocumentParser.h; path = parser/TextDocumentParser.h; sourceTree = "<group>"; };
 		97BC849A12370A4B000C6161 /* HTMLInputStream.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HTMLInputStream.h; path = parser/HTMLInputStream.h; sourceTree = "<group>"; };
@@ -8818,6 +8976,8 @@
 		97DD4D840FDF4D6D00ECF9A4 /* XSSAuditor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = XSSAuditor.cpp; sourceTree = "<group>"; };
 		97DD4D850FDF4D6E00ECF9A4 /* XSSAuditor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = XSSAuditor.h; sourceTree = "<group>"; };
 		97EF7DFD107E55B700D7C49C /* ScriptControllerBase.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ScriptControllerBase.cpp; sourceTree = "<group>"; };
+		9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ApplyBlockElementCommand.h; sourceTree = "<group>"; };
+		9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ApplyBlockElementCommand.cpp; sourceTree = "<group>"; };
 		9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InspectorProfilerAgent.cpp; sourceTree = "<group>"; };
 		9F0D6B2D121BFEBA006C0288 /* InspectorProfilerAgent.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InspectorProfilerAgent.h; sourceTree = "<group>"; };
 		9F3B947D12241758005304E7 /* ScriptHeapSnapshot.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ScriptHeapSnapshot.h; sourceTree = "<group>"; };
@@ -9497,8 +9657,6 @@
 		A9D248030D757E7D00FDF959 /* JSDOMMimeType.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSDOMMimeType.h; sourceTree = "<group>"; };
 		A9D248040D757E7D00FDF959 /* JSDOMMimeTypeArray.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSDOMMimeTypeArray.cpp; sourceTree = "<group>"; };
 		A9D248050D757E7D00FDF959 /* JSDOMMimeTypeArray.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSDOMMimeTypeArray.h; sourceTree = "<group>"; };
-		AA0972CA0B6947A800A705E9 /* SVGInlineTextBox.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGInlineTextBox.cpp; sourceTree = "<group>"; };
-		AA0972CB0B6947A800A705E9 /* SVGInlineTextBox.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGInlineTextBox.h; sourceTree = "<group>"; };
 		AA0978ED0ABAA6E100874480 /* CSSCursorImageValue.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSCursorImageValue.cpp; sourceTree = "<group>"; };
 		AA0978EE0ABAA6E100874480 /* CSSCursorImageValue.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSCursorImageValue.h; sourceTree = "<group>"; };
 		AA31B5B20C1DFD1000AE7083 /* RenderSVGRoot.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGRoot.cpp; sourceTree = "<group>"; };
@@ -9526,6 +9684,8 @@
 		ABDDFE740A5C6E7000A3E11D /* RenderMenuList.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderMenuList.h; sourceTree = "<group>"; };
 		ABFE7E100D32FAF50066F4D2 /* MediaControlElements.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = MediaControlElements.cpp; sourceTree = "<group>"; };
 		ABFE7E110D32FAF50066F4D2 /* MediaControlElements.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = MediaControlElements.h; sourceTree = "<group>"; };
+		ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGPath.cpp; sourceTree = "<group>"; };
+		ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = RenderSVGPath.h; sourceTree = "<group>"; };
 		B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AsyncImageResizer.cpp; sourceTree = "<group>"; };
 		B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = AsyncImageResizer.h; sourceTree = "<group>"; };
 		B0149E7B11A4B21500196A7B /* ImageResizerThread.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = ImageResizerThread.cpp; sourceTree = "<group>"; };
@@ -9565,7 +9725,6 @@
 		B22277F40D00BF1F0071B782 /* SVGAnimatedPreserveAspectRatio.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGAnimatedPreserveAspectRatio.idl; sourceTree = "<group>"; };
 		B22277F50D00BF1F0071B782 /* SVGAnimatedRect.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGAnimatedRect.idl; sourceTree = "<group>"; };
 		B22277F60D00BF1F0071B782 /* SVGAnimatedString.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGAnimatedString.idl; sourceTree = "<group>"; };
-		B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGAnimatedTemplate.h; sourceTree = "<group>"; };
 		B22277F80D00BF1F0071B782 /* SVGAnimatedTransformList.idl */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = text; path = SVGAnimatedTransformList.idl; sourceTree = "<group>"; };
 		B22277F90D00BF1F0071B782 /* SVGAnimateElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGAnimateElement.cpp; sourceTree = "<group>"; };
 		B22277FA0D00BF1F0071B782 /* SVGAnimateElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGAnimateElement.h; sourceTree = "<group>"; };
@@ -9950,8 +10109,6 @@
 		B255990D0D00D8B900BB825C /* EmptyClients.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = EmptyClients.h; sourceTree = "<group>"; };
 		B25DFAAE0B2E2929000E6510 /* JSSVGMatrixCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGMatrixCustom.cpp; sourceTree = "<group>"; };
 		B262B8030D1F32D000158F09 /* SVGFont.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGFont.cpp; sourceTree = "<group>"; };
-		B26554E80B80D74900A50EC3 /* RenderSVGTextPath.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = RenderSVGTextPath.cpp; sourceTree = "<group>"; };
-		B26554E90B80D74900A50EC3 /* RenderSVGTextPath.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = RenderSVGTextPath.h; sourceTree = "<group>"; };
 		B266CD4B0C3AEC6500EB08D2 /* JSSVGException.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGException.cpp; sourceTree = "<group>"; };
 		B266CD4C0C3AEC6500EB08D2 /* JSSVGException.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGException.h; sourceTree = "<group>"; };
 		B275352A0B053814002CE64F /* TransformationMatrixCG.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = TransformationMatrixCG.cpp; sourceTree = "<group>"; };
@@ -10055,8 +10212,6 @@
 		B2B1F7150D00CAA8004AEA64 /* PointerEventsHitRules.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = PointerEventsHitRules.h; sourceTree = "<group>"; };
 		B2B2645A0D00A77E000ACC1D /* StringCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StringCF.cpp; sourceTree = "<group>"; };
 		B2B2645B0D00A77E000ACC1D /* StringImplCF.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = StringImplCF.cpp; sourceTree = "<group>"; };
-		B2B33A5D0B887CEF00C15984 /* SVGCharacterLayoutInfo.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = SVGCharacterLayoutInfo.cpp; sourceTree = "<group>"; };
-		B2B33A5E0B887CEF00C15984 /* SVGCharacterLayoutInfo.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGCharacterLayoutInfo.h; sourceTree = "<group>"; };
 		B2C3D9F00D006C1D00EF6F26 /* Base64.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = Base64.cpp; sourceTree = "<group>"; };
 		B2C3D9F10D006C1D00EF6F26 /* Base64.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = Base64.h; sourceTree = "<group>"; };
 		B2C3D9F20D006C1D00EF6F26 /* BidiContext.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = BidiContext.cpp; sourceTree = "<group>"; };
@@ -10128,7 +10283,7 @@
 		B2EBDC9B0AF77E3400AE4A68 /* SVGRenderTreeAsText.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = SVGRenderTreeAsText.h; sourceTree = "<group>"; };
 		B2ED97700B1F55CE00257D0F /* GraphicsContextCG.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = GraphicsContextCG.cpp; sourceTree = "<group>"; };
 		B2F34FE50E82F81400F627CD /* DNS.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = DNS.h; sourceTree = "<group>"; };
-		B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = DNSCFNet.cpp; path = cf/DNSCFNet.cpp; sourceTree = "<group>"; };
+		B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = DNSCFNet.cpp; sourceTree = "<group>"; };
 		B2FA3C4E0AB75A6E000E5AC4 /* JSSVGAnimateColorElement.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAnimateColorElement.cpp; sourceTree = "<group>"; };
 		B2FA3C4F0AB75A6E000E5AC4 /* JSSVGAnimateColorElement.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = JSSVGAnimateColorElement.h; sourceTree = "<group>"; };
 		B2FA3C500AB75A6E000E5AC4 /* JSSVGAnimatedAngle.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = JSSVGAnimatedAngle.cpp; sourceTree = "<group>"; };
@@ -10681,7 +10836,6 @@
 		BC74DA461013F468007987AD /* JSRGBColor.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSRGBColor.cpp; sourceTree = "<group>"; };
 		BC74DA471013F468007987AD /* JSRGBColor.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSRGBColor.h; sourceTree = "<group>"; };
 		BC76AC110DD7AD5C00415F34 /* ParserUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ParserUtilities.h; sourceTree = "<group>"; };
-		BC772B350C4EA91E0083285F /* CSSHelper.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSHelper.cpp; sourceTree = "<group>"; };
 		BC772B360C4EA91E0083285F /* CSSHelper.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSHelper.h; sourceTree = "<group>"; };
 		BC772B370C4EA91E0083285F /* CSSParser.cpp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.cpp; path = CSSParser.cpp; sourceTree = "<group>"; };
 		BC772B380C4EA91E0083285F /* CSSParser.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = CSSParser.h; sourceTree = "<group>"; };
@@ -11069,7 +11223,6 @@
 		C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBKeyRange.cpp; sourceTree = "<group>"; };
 		C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKeyRange.h; sourceTree = "<group>"; };
 		C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = IDBKeyRange.idl; sourceTree = "<group>"; };
-		C585A6B811D4FB3D004C3E4B /* IDBKeyTree.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBKeyTree.h; sourceTree = "<group>"; };
 		C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStore.h; sourceTree = "<group>"; };
 		C585A6BA11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = IDBObjectStoreBackendImpl.cpp; sourceTree = "<group>"; };
 		C585A6BB11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = IDBObjectStoreBackendImpl.h; sourceTree = "<group>"; };
@@ -11180,9 +11333,8 @@
 		E182568D0EF2B02D00933242 /* JSWorkerContext.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContext.cpp; sourceTree = "<group>"; };
 		E182568E0EF2B02D00933242 /* JSWorkerContext.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = JSWorkerContext.h; sourceTree = "<group>"; };
 		E18258AB0EF3CD7000933242 /* JSWorkerContextCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSWorkerContextCustom.cpp; sourceTree = "<group>"; };
+		E18772F0126E2629003DD586 /* Language.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Language.cpp; sourceTree = "<group>"; };
 		E1A1470711102B1500EEC0F3 /* ContainerNodeAlgorithms.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ContainerNodeAlgorithms.h; sourceTree = "<group>"; };
-		E1A302BB0DE8370300C52F2C /* StringBuilder.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = StringBuilder.h; sourceTree = "<group>"; };
-		E1A302C00DE8376900C52F2C /* StringBuilder.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = StringBuilder.cpp; sourceTree = "<group>"; };
 		E1A5F99A0E7EAA2500AF85EA /* JSMessageChannelCustom.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = JSMessageChannelCustom.cpp; sourceTree = "<group>"; };
 		E1A643F10EC0972500779668 /* WorkerScriptController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WorkerScriptController.h; sourceTree = "<group>"; };
 		E1A643FC0EC097A000779668 /* WorkerScriptController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WorkerScriptController.cpp; sourceTree = "<group>"; };
@@ -11388,6 +11540,8 @@
 		F587866202DE3B1101EA4122 /* SSLKeyGenerator.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = SSLKeyGenerator.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587868402DE3B8601EA4122 /* Cursor.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = Cursor.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F587869902DE3B8601EA4122 /* DeprecatedPtrList.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = DeprecatedPtrList.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = BaseDateAndTimeInputType.cpp; sourceTree = "<group>"; };
+		F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = BaseDateAndTimeInputType.h; sourceTree = "<group>"; };
 		F5C041D70FFCA7CE00839D4A /* HTMLDataListElement.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = HTMLDataListElement.cpp; sourceTree = "<group>"; };
 		F5C041D80FFCA7CE00839D4A /* HTMLDataListElement.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = HTMLDataListElement.h; sourceTree = "<group>"; };
 		F5C041D90FFCA7CE00839D4A /* HTMLDataListElement.idl */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text; path = HTMLDataListElement.idl; sourceTree = "<group>"; };
@@ -11480,6 +11634,7 @@
 				93F19B1308245E59001E9ABC /* ApplicationServices.framework in Frameworks */,
 				93F19B1408245E59001E9ABC /* Carbon.framework in Frameworks */,
 				93F19B1508245E59001E9ABC /* Cocoa.framework in Frameworks */,
+				1AB33DA512551E320024457A /* IOKit.framework in Frameworks */,
 				93F19B1608245E59001E9ABC /* JavaScriptCore.framework in Frameworks */,
 				93F19B1708245E59001E9ABC /* libicucore.dylib in Frameworks */,
 				1CFAE3230A6D6A3F0032593D /* libobjc.dylib in Frameworks */,
@@ -11505,6 +11660,14 @@
 			tabWidth = 4;
 			usesTabs = 0;
 		};
+		081CDFBD126ECFE800D215CA /* properties */ = {
+			isa = PBXGroup;
+			children = (
+				081CDFBE126ECFE800D215CA /* SVGAnimatedPropertySynchronizer.h */,
+			);
+			path = properties;
+			sourceTree = "<group>";
+		};
 		0867D691FE84028FC02AAC07 /* WebKit */ = {
 			isa = PBXGroup;
 			children = (
@@ -11551,6 +11714,7 @@
 				F5C2869302846DCD018635CA /* ApplicationServices.framework */,
 				F5C2869402846DCD018635CA /* Carbon.framework */,
 				F5C2869502846DCD018635CA /* Cocoa.framework */,
+				1AB33DA412551E320024457A /* IOKit.framework */,
 				F8216299029F4FB501000131 /* JavaScriptCore.framework */,
 				93F1D31A0558CC5C00821BC0 /* libicucore.dylib */,
 				1CFAE3220A6D6A3F0032593D /* libobjc.dylib */,
@@ -11568,10 +11732,43 @@
 		088C2F7412390080003D65CE /* svg */ = {
 			isa = PBXGroup;
 			children = (
+				0854B0021255E4E600B9CDD0 /* RenderSVGInline.cpp */,
+				0854B0031255E4E600B9CDD0 /* RenderSVGInline.h */,
+				0854B0041255E4E600B9CDD0 /* RenderSVGInlineText.cpp */,
+				0854B0051255E4E600B9CDD0 /* RenderSVGInlineText.h */,
+				ADDF1AD41257CD9A0003A759 /* RenderSVGPath.cpp */,
+				ADDF1AD51257CD9A0003A759 /* RenderSVGPath.h */,
+				0854B0061255E4E600B9CDD0 /* RenderSVGText.cpp */,
+				0854B0071255E4E600B9CDD0 /* RenderSVGText.h */,
+				0854B0081255E4E600B9CDD0 /* RenderSVGTextPath.cpp */,
+				0854B0091255E4E600B9CDD0 /* RenderSVGTextPath.h */,
+				0854B00A1255E4E600B9CDD0 /* RenderSVGTSpan.cpp */,
+				0854B00B1255E4E600B9CDD0 /* RenderSVGTSpan.h */,
+				0854B00C1255E4E600B9CDD0 /* SVGInlineFlowBox.cpp */,
+				0854B00D1255E4E600B9CDD0 /* SVGInlineFlowBox.h */,
+				0854B00E1255E4E600B9CDD0 /* SVGInlineTextBox.cpp */,
+				0854B00F1255E4E600B9CDD0 /* SVGInlineTextBox.h */,
+				0854B0101255E4E600B9CDD0 /* SVGRootInlineBox.cpp */,
+				0854B0111255E4E600B9CDD0 /* SVGRootInlineBox.h */,
+				08F0BFBD1255C53C00075185 /* SVGTextChunk.cpp */,
+				08F0BFBE1255C53C00075185 /* SVGTextChunk.h */,
+				081668D1125603BF006F25DE /* SVGTextChunkBuilder.cpp */,
+				081668D2125603BF006F25DE /* SVGTextChunkBuilder.h */,
+				08F0BFBF1255C53C00075185 /* SVGTextFragment.h */,
 				088C2F7512390080003D65CE /* SVGTextLayoutAttributes.cpp */,
 				088C2F7612390080003D65CE /* SVGTextLayoutAttributes.h */,
-				088C2F7712390081003D65CE /* SVGTextLayoutBuilder.cpp */,
-				088C2F7812390081003D65CE /* SVGTextLayoutBuilder.h */,
+				081093D91255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.cpp */,
+				081093DA1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.h */,
+				081668D7125603D5006F25DE /* SVGTextLayoutEngine.cpp */,
+				081668D8125603D5006F25DE /* SVGTextLayoutEngine.h */,
+				080E49211255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.cpp */,
+				080E49221255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.h */,
+				080E49231255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.cpp */,
+				080E49241255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.h */,
+				08F0BFC01255C53C00075185 /* SVGTextMetrics.cpp */,
+				08F0BFC11255C53C00075185 /* SVGTextMetrics.h */,
+				0854B0121255E4E600B9CDD0 /* SVGTextQuery.cpp */,
+				0854B0131255E4E600B9CDD0 /* SVGTextQuery.h */,
 			);
 			path = svg;
 			sourceTree = "<group>";
@@ -11863,7 +12060,6 @@
 				C585A6B511D4FB3D004C3E4B /* IDBKeyRange.cpp */,
 				C585A6B611D4FB3D004C3E4B /* IDBKeyRange.h */,
 				C585A6B711D4FB3D004C3E4B /* IDBKeyRange.idl */,
-				C585A6B811D4FB3D004C3E4B /* IDBKeyTree.h */,
 				C585A6BC11D4FB3D004C3E4B /* IDBObjectStore.cpp */,
 				C585A6B911D4FB3D004C3E4B /* IDBObjectStore.h */,
 				C585A6BE11D4FB3D004C3E4B /* IDBObjectStore.idl */,
@@ -11986,9 +12182,12 @@
 				B885E8D311E06DD2009FFBF4 /* InspectorApplicationCacheAgent.h */,
 				7A74ECB8101839A500BF939E /* InspectorBackend.cpp */,
 				7A74ECB9101839A600BF939E /* InspectorBackend.h */,
+				7A1F2B51126C61B20006A7E6 /* InspectorClient.cpp */,
 				1C81B9580E97330800266E07 /* InspectorClient.h */,
 				1C81B9570E97330800266E07 /* InspectorController.cpp */,
 				1C81B9560E97330800266E07 /* InspectorController.h */,
+				82AB1741124B99EC00C5069D /* InspectorCSSAgent.cpp */,
+				82AB1742124B99EC00C5069D /* InspectorCSSAgent.h */,
 				82B658991189E47600E052A1 /* InspectorCSSStore.cpp */,
 				82B658971189E39200E052A1 /* InspectorCSSStore.h */,
 				41F062130F5F192600A07EAC /* InspectorDatabaseResource.cpp */,
@@ -12005,12 +12204,20 @@
 				7A0E770B10C00A8800A0276E /* InspectorFrontendHost.cpp */,
 				7A0E770C10C00A8800A0276E /* InspectorFrontendHost.h */,
 				7A0E770D10C00A8800A0276E /* InspectorFrontendHost.idl */,
+				20D629241253690B00081543 /* InspectorInstrumentation.cpp */,
+				20D629251253690B00081543 /* InspectorInstrumentation.h */,
 				9F0D6B2C121BFEBA006C0288 /* InspectorProfilerAgent.cpp */,
 				9F0D6B2D121BFEBA006C0288 /* InspectorProfilerAgent.h */,
 				41F062000F5F0B6600A07EAC /* InspectorResource.cpp */,
 				41F061FF0F5F0B6600A07EAC /* InspectorResource.h */,
+				82AB1771125C826700C5069D /* InspectorResourceAgent.cpp */,
+				82AB1772125C826700C5069D /* InspectorResourceAgent.h */,
+				4FA3B908125CD12100300BAD /* InspectorState.cpp */,
+				4FA3B909125CD12200300BAD /* InspectorState.h */,
 				7AB0B1BE1211A62200A76940 /* InspectorStorageAgent.cpp */,
 				7AB0B1BF1211A62200A76940 /* InspectorStorageAgent.h */,
+				82AB176F125C826700C5069D /* InspectorStyleSheet.cpp */,
+				82AB1770125C826700C5069D /* InspectorStyleSheet.h */,
 				754133A9102E00F400075D00 /* InspectorTimelineAgent.cpp */,
 				754133A7102E00E800075D00 /* InspectorTimelineAgent.h */,
 				4F3289B311A42AAB005ABE7E /* InspectorValues.cpp */,
@@ -12298,6 +12505,47 @@
 			name = canvas;
 			sourceTree = "<group>";
 		};
+		498770C11242C50D002226BA /* gpu */ = {
+			isa = PBXGroup;
+			children = (
+				498771161242CD7F002226BA /* mac */,
+				498770C21242C535002226BA /* DrawingBuffer.cpp */,
+				498770C31242C535002226BA /* DrawingBuffer.h */,
+				49B69E551254FEED007D57EB /* LoopBlinnClassifier.cpp */,
+				49B69E561254FEED007D57EB /* LoopBlinnClassifier.h */,
+				49B69E571254FEED007D57EB /* LoopBlinnConstants.h */,
+				49B69E5A1254FEED007D57EB /* LoopBlinnMathUtils.cpp */,
+				49B69E5B1254FEED007D57EB /* LoopBlinnMathUtils.h */,
+				49B69E5C1254FEED007D57EB /* LoopBlinnTextureCoords.cpp */,
+				49B69E5D1254FEED007D57EB /* LoopBlinnTextureCoords.h */,
+				498770CB1242C535002226BA /* PODArena.h */,
+				498770CC1242C535002226BA /* PODInterval.h */,
+				498770CD1242C535002226BA /* PODIntervalTree.h */,
+				498770CE1242C535002226BA /* PODRedBlackTree.h */,
+				498770CF1242C535002226BA /* Shader.cpp */,
+				498770D01242C535002226BA /* Shader.h */,
+				498770D11242C535002226BA /* SharedGraphicsContext3D.cpp */,
+				498770D21242C535002226BA /* SharedGraphicsContext3D.h */,
+				498770D31242C535002226BA /* SolidFillShader.cpp */,
+				498770D41242C535002226BA /* SolidFillShader.h */,
+				498770D51242C535002226BA /* TexShader.cpp */,
+				498770D61242C535002226BA /* TexShader.h */,
+				498770D71242C535002226BA /* Texture.cpp */,
+				498770D81242C535002226BA /* Texture.h */,
+				498770D91242C535002226BA /* TilingData.cpp */,
+				498770DA1242C535002226BA /* TilingData.h */,
+			);
+			name = gpu;
+			sourceTree = "<group>";
+		};
+		498771161242CD7F002226BA /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				498771521243F9FA002226BA /* DrawingBufferMac.mm */,
+			);
+			name = mac;
+			sourceTree = "<group>";
+		};
 		49E911B20EF86D27009D0CAF /* transforms */ = {
 			isa = PBXGroup;
 			children = (
@@ -12428,8 +12676,6 @@
 				5126E6BA0A2E3B12005C29FA /* IconDatabase.h */,
 				51E1ECB80C91C90400DC255B /* IconDatabaseClient.h */,
 				445C8DB610015FC90031531A /* IconDatabaseNone.cpp */,
-				1A2D753C0DE47FAB00F0A648 /* IconFetcher.cpp */,
-				1A2D753B0DE47FAB00F0A648 /* IconFetcher.h */,
 				513F14510AB634C400094DDF /* IconLoader.cpp */,
 				513F14520AB634C400094DDF /* IconLoader.h */,
 				51E1ECBA0C91C90400DC255B /* IconRecord.cpp */,
@@ -12691,6 +12937,8 @@
 				514C765F0CE923A1007EF3CD /* ProtectionSpace.cpp */,
 				514C76600CE923A1007EF3CD /* ProtectionSpace.h */,
 				51A052551058874000CC9E95 /* ProtectionSpaceHash.h */,
+				1AF8E13212565A4400230FF7 /* ProxyServer.cpp */,
+				1AF8E1191256592600230FF7 /* ProxyServer.h */,
 				934F713D0D5A6F2800018D69 /* ResourceErrorBase.cpp */,
 				934F713B0D5A6F1900018D69 /* ResourceErrorBase.h */,
 				514C76630CE923A1007EF3CD /* ResourceHandle.cpp */,
@@ -12698,6 +12946,7 @@
 				514C76650CE923A1007EF3CD /* ResourceHandleClient.h */,
 				514C76660CE923A1007EF3CD /* ResourceHandleInternal.h */,
 				8A81BF8411DCFD9000DA2B98 /* ResourceLoadTiming.h */,
+				492863981253B8FC00F792D6 /* ResourceRawHeaders.h */,
 				514C76670CE923A1007EF3CD /* ResourceRequestBase.cpp */,
 				514C76680CE923A1007EF3CD /* ResourceRequestBase.h */,
 				514C76690CE923A1007EF3CD /* ResourceResponseBase.cpp */,
@@ -14055,18 +14304,28 @@
 				89CD029211C85B870070B791 /* JSBlobBuilder.h */,
 				89878586122CA26A003AABDA /* JSDirectoryEntry.cpp */,
 				89878587122CA26A003AABDA /* JSDirectoryEntry.h */,
+				893C482612495472002B3D86 /* JSDirectoryEntrySync.cpp */,
+				893C482712495472002B3D86 /* JSDirectoryEntrySync.h */,
 				89878588122CA26A003AABDA /* JSDirectoryReader.cpp */,
 				89878589122CA26A003AABDA /* JSDirectoryReader.h */,
+				893C482812495472002B3D86 /* JSDirectoryReaderSync.cpp */,
+				893C482912495472002B3D86 /* JSDirectoryReaderSync.h */,
 				8987858E122CA2A7003AABDA /* JSDOMFileSystem.cpp */,
 				8987858F122CA2A7003AABDA /* JSDOMFileSystem.h */,
+				893C482A12495472002B3D86 /* JSDOMFileSystemSync.cpp */,
+				893C482B12495472002B3D86 /* JSDOMFileSystemSync.h */,
 				89878590122CA2A7003AABDA /* JSEntriesCallback.cpp */,
 				89878591122CA2A7003AABDA /* JSEntriesCallback.h */,
 				89878592122CA2A7003AABDA /* JSEntry.cpp */,
 				89878593122CA2A7003AABDA /* JSEntry.h */,
 				89878594122CA2A7003AABDA /* JSEntryArray.cpp */,
 				89878595122CA2A7003AABDA /* JSEntryArray.h */,
+				893C482C12495472002B3D86 /* JSEntryArraySync.cpp */,
+				893C482D12495472002B3D86 /* JSEntryArraySync.h */,
 				89878596122CA2A7003AABDA /* JSEntryCallback.cpp */,
 				89878597122CA2A7003AABDA /* JSEntryCallback.h */,
+				893C482E12495472002B3D86 /* JSEntrySync.cpp */,
+				893C482F12495472002B3D86 /* JSEntrySync.h */,
 				89878598122CA2A7003AABDA /* JSErrorCallback.cpp */,
 				89878599122CA2A7003AABDA /* JSErrorCallback.h */,
 				BC00F0100E0A189500FD04E3 /* JSFile.cpp */,
@@ -14075,6 +14334,8 @@
 				893C47B61238A099002B3D86 /* JSFileCallback.h */,
 				8987859A122CA2A7003AABDA /* JSFileEntry.cpp */,
 				8987859B122CA2A7003AABDA /* JSFileEntry.h */,
+				893C483012495472002B3D86 /* JSFileEntrySync.cpp */,
+				893C483112495472002B3D86 /* JSFileEntrySync.h */,
 				2E3BC0C8117D3E0800B9409A /* JSFileError.cpp */,
 				2E3BC0C9117D3E0800B9409A /* JSFileError.h */,
 				898785EE122E1E87003AABDA /* JSFileException.cpp */,
@@ -14107,6 +14368,8 @@
 				ED501DC90B249F3900AE18D9 /* mac */,
 				93309D87099E64910056E581 /* AppendNodeCommand.cpp */,
 				93309D88099E64910056E581 /* AppendNodeCommand.h */,
+				9B417063125662B3006B28FC /* ApplyBlockElementCommand.cpp */,
+				9B417062125662B3006B28FC /* ApplyBlockElementCommand.h */,
 				93309D89099E64910056E581 /* ApplyStyleCommand.cpp */,
 				93309D8A099E64910056E581 /* ApplyStyleCommand.h */,
 				93309D8B099E64910056E581 /* BreakBlockquoteCommand.cpp */,
@@ -14157,6 +14420,8 @@
 				93309DA5099E64910056E581 /* JoinTextNodesCommand.h */,
 				93309DA8099E64910056E581 /* markup.cpp */,
 				93309DA9099E64910056E581 /* markup.h */,
+				9728C3111268E4390041E89B /* MarkupAccumulator.cpp */,
+				9728C3121268E4390041E89B /* MarkupAccumulator.h */,
 				93309DAA099E64910056E581 /* MergeIdenticalElementsCommand.cpp */,
 				93309DAB099E64910056E581 /* MergeIdenticalElementsCommand.h */,
 				C6D74AE309AA290A000B0A52 /* ModifySelectionListLevel.cpp */,
@@ -14253,6 +14518,8 @@
 				97C1F5511228558800EDE616 /* parser */,
 				B0149E7911A4B21500196A7B /* AsyncImageResizer.cpp */,
 				B0149E7A11A4B21500196A7B /* AsyncImageResizer.h */,
+				F59C95FD1255B23F000623C0 /* BaseDateAndTimeInputType.cpp */,
+				F59C95FE1255B23F000623C0 /* BaseDateAndTimeInputType.h */,
 				F55B3D791251F12D003EF269 /* BaseTextInputType.cpp */,
 				F55B3D7A1251F12D003EF269 /* BaseTextInputType.h */,
 				F55B3D7B1251F12D003EF269 /* ButtonInputType.cpp */,
@@ -14626,24 +14893,40 @@
 				976D6C60122B8A3D001FD1F7 /* BlobURL.h */,
 				89878539122CA064003AABDA /* DirectoryEntry.cpp */,
 				8987853A122CA064003AABDA /* DirectoryEntry.h */,
+				893C47F01248BD39002B3D86 /* DirectoryEntrySync.cpp */,
+				893C47F11248BD39002B3D86 /* DirectoryEntrySync.h */,
 				8987853B122CA064003AABDA /* DirectoryReader.cpp */,
 				8987853C122CA064003AABDA /* DirectoryReader.h */,
+				890AE0E01256A07900F5968C /* DirectoryReaderBase.h */,
+				893C47F21248BD39002B3D86 /* DirectoryReaderSync.cpp */,
+				893C47F31248BD39002B3D86 /* DirectoryReaderSync.h */,
 				8987853D122CA064003AABDA /* DOMFilePath.cpp */,
 				8987853E122CA064003AABDA /* DOMFilePath.h */,
 				8987853F122CA064003AABDA /* DOMFileSystem.cpp */,
 				89878540122CA064003AABDA /* DOMFileSystem.h */,
+				893C47F41248BD39002B3D86 /* DOMFileSystemBase.cpp */,
+				893C47F51248BD39002B3D86 /* DOMFileSystemBase.h */,
+				893C47F61248BD39002B3D86 /* DOMFileSystemSync.cpp */,
+				893C47F71248BD39002B3D86 /* DOMFileSystemSync.h */,
 				89878541122CA064003AABDA /* EntriesCallback.h */,
 				89878542122CA064003AABDA /* Entry.cpp */,
 				89878543122CA064003AABDA /* Entry.h */,
 				89878544122CA064003AABDA /* EntryArray.cpp */,
 				89878545122CA064003AABDA /* EntryArray.h */,
+				893C47F81248BD39002B3D86 /* EntryArraySync.cpp */,
+				893C47F91248BD39002B3D86 /* EntryArraySync.h */,
+				893C47FB1248BD39002B3D86 /* EntryBase.h */,
 				89878546122CA064003AABDA /* EntryCallback.h */,
+				893C47FC1248BD39002B3D86 /* EntrySync.cpp */,
+				893C47FD1248BD39002B3D86 /* EntrySync.h */,
 				89878547122CA064003AABDA /* ErrorCallback.h */,
 				976D6C61122B8A3D001FD1F7 /* File.cpp */,
 				976D6C62122B8A3D001FD1F7 /* File.h */,
 				893C47A51238908B002B3D86 /* FileCallback.h */,
 				89878548122CA064003AABDA /* FileEntry.cpp */,
 				89878549122CA064003AABDA /* FileEntry.h */,
+				893C47FE1248BD39002B3D86 /* FileEntrySync.cpp */,
+				893C47FF1248BD39002B3D86 /* FileEntrySync.h */,
 				976D6C64122B8A3D001FD1F7 /* FileError.h */,
 				2EDF369E122C94C8002F7D4E /* FileException.h */,
 				976D6C66122B8A3D001FD1F7 /* FileList.cpp */,
@@ -15593,8 +15876,12 @@
 			children = (
 				E46E97860DAAD61B0071E894 /* animation */,
 				B25598860D00D8B800BB825C /* graphics */,
+				081CDFBD126ECFE800D215CA /* properties */,
 				B22277CB0D00BF1F0071B782 /* ColorDistance.cpp */,
 				B22277CC0D00BF1F0071B782 /* ColorDistance.h */,
+				081CDFB5126ECFDB00D215CA /* DeprecatedSVGAnimatedProperty.h */,
+				081CDFB6126ECFDB00D215CA /* DeprecatedSVGAnimatedPropertyTraits.h */,
+				081CDFB7126ECFDB00D215CA /* DeprecatedSVGAnimatedTemplate.h */,
 				E415F1830D9A1A830033CE97 /* ElementTimeControl.h */,
 				E415F10C0D9A05870033CE97 /* ElementTimeControl.idl */,
 				B22277CD0D00BF1F0071B782 /* GradientAttributes.h */,
@@ -15628,12 +15915,8 @@
 				B22277F20D00BF1F0071B782 /* SVGAnimatedPoints.h */,
 				B22277F30D00BF1F0071B782 /* SVGAnimatedPoints.idl */,
 				B22277F40D00BF1F0071B782 /* SVGAnimatedPreserveAspectRatio.idl */,
-				0878B1F910874E3F00A55097 /* SVGAnimatedProperty.h */,
-				084D2831110A7FCB0038239A /* SVGAnimatedPropertySynchronizer.h */,
-				084D2832110A7FCB0038239A /* SVGAnimatedPropertyTraits.h */,
 				B22277F50D00BF1F0071B782 /* SVGAnimatedRect.idl */,
 				B22277F60D00BF1F0071B782 /* SVGAnimatedString.idl */,
-				B22277F70D00BF1F0071B782 /* SVGAnimatedTemplate.h */,
 				B22277F80D00BF1F0071B782 /* SVGAnimatedTransformList.idl */,
 				B22277F90D00BF1F0071B782 /* SVGAnimateElement.cpp */,
 				B22277FA0D00BF1F0071B782 /* SVGAnimateElement.h */,
@@ -16090,6 +16373,7 @@
 				BC53C60A0DA56CF10021EB5D /* GradientCG.cpp */,
 				6E21C6C11126339900A7BE02 /* GraphicsContext3DCG.cpp */,
 				B2ED97700B1F55CE00257D0F /* GraphicsContextCG.cpp */,
+				934907E3125BBBC8007F23A0 /* GraphicsContextCG.h */,
 				A80D67070E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h */,
 				B2A10B930B3818D700099AA4 /* ImageBufferCG.cpp */,
 				BCA979161215D055005C485C /* ImageBufferData.h */,
@@ -16158,6 +16442,7 @@
 				B27535290B053814002CE64F /* cg */,
 				B5320D68122A24E9002D1440 /* cocoa */,
 				A75E8B7F0E1DE2B0007F2481 /* filters */,
+				498770C11242C50D002226BA /* gpu */,
 				B27535490B053814002CE64F /* mac */,
 				FBC220DD1237FBEB00BCF788 /* opengl */,
 				F4EAF4AB10C74268009100D3 /* opentype */,
@@ -16290,9 +16575,6 @@
 				B2C3D9FE0D006C1D00EF6F26 /* SegmentedString.cpp */,
 				B2C3D9FF0D006C1D00EF6F26 /* SegmentedString.h */,
 				B2C3DA000D006C1D00EF6F26 /* String.cpp */,
-				939B3E4D0D3C1E8400B4A92B /* StringBuffer.h */,
-				E1A302C00DE8376900C52F2C /* StringBuilder.cpp */,
-				E1A302BB0DE8370300C52F2C /* StringBuilder.h */,
 				97C0784F1165D5BE003A32EF /* SuffixTree.h */,
 				B2C3DA040D006C1D00EF6F26 /* TextBoundaries.h */,
 				B2C3DA060D006C1D00EF6F26 /* TextBreakIterator.h */,
@@ -16347,11 +16629,12 @@
 			isa = PBXGroup;
 			children = (
 				B2F34FE80E82F82700F627CD /* DNSCFNet.cpp */,
+				1AF8E1C1125673E000230FF7 /* ProxyServerCFNet.cpp */,
 				51ABAE1A103C18FF008C5260 /* SocketStreamError.h */,
 				51ABAE1C103C1913008C5260 /* SocketStreamHandle.h */,
 				51ABAE1D103C1913008C5260 /* SocketStreamHandleCFNet.cpp */,
 			);
-			name = cf;
+			path = cf;
 			sourceTree = "<group>";
 		};
 		B5320D68122A24E9002D1440 /* cocoa */ = {
@@ -16485,7 +16768,6 @@
 				CE54FD371016D9A6008B44C8 /* ScriptSourceProvider.h */,
 				4127D5360F8AAB1D00E424F5 /* ScriptState.cpp */,
 				41C760B00EDE03D300C1655F /* ScriptState.h */,
-				416F45EF0ED7B311008215B6 /* ScriptString.h */,
 				934CC0DF0ED39D6F00A658F2 /* ScriptValue.cpp */,
 				934CC0E00ED39D6F00A658F2 /* ScriptValue.h */,
 				228C284410D82500009D0D0E /* ScriptWrappable.h */,
@@ -16568,6 +16850,7 @@
 				31FB1A6B120A5D6900DC02A0 /* JSDeviceMotionEventCustom.cpp */,
 				590E1B4A11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp */,
 				893C47DE123EF4A9002B3D86 /* JSDirectoryEntryCustom.cpp */,
+				893C48201249535B002B3D86 /* JSDirectoryEntrySyncCustom.cpp */,
 				49C7BA8C1042F5B10009D447 /* JSDocumentCustom.cpp */,
 				1AC226160DB69F740089B669 /* JSDOMApplicationCacheCustom.cpp */,
 				2E0888E5114884E200AF4265 /* JSDOMFormDataCustom.cpp */,
@@ -16579,6 +16862,7 @@
 				652FBBBB0DE27CB60001D386 /* JSDOMWindowCustom.h */,
 				BC2ED5540C6B9BD300920BFF /* JSElementCustom.cpp */,
 				893C47CA123EEBA2002B3D86 /* JSEntryCustom.cpp */,
+				893C485212499B06002B3D86 /* JSEntrySyncCustom.cpp */,
 				BCEFAF4D0C317E6900FA81F6 /* JSEventCustom.cpp */,
 				BC275B8011C5D2B400C9206C /* JSEventSourceCustom.cpp */,
 				49EECF7210508D9C00099FAB /* JSFloat32ArrayCustom.cpp */,
@@ -16842,6 +17126,8 @@
 				656D37290ADBA5DE00A4554D /* MainResourceLoader.h */,
 				93CCF05F0AF6CA7600018E89 /* NavigationAction.cpp */,
 				93CCF0260AF6C52900018E89 /* NavigationAction.h */,
+				979F43D11075E44A0000F83B /* NavigationScheduler.cpp */,
+				979F43D21075E44A0000F83B /* NavigationScheduler.h */,
 				93E227DD0AF589AD00D48324 /* NetscapePlugInStreamLoader.cpp */,
 				656D372B0ADBA5DE00A4554D /* NetscapePlugInStreamLoader.h */,
 				D0FF2A5B11F8C45A007E74E0 /* PingLoader.cpp */,
@@ -16854,8 +17140,6 @@
 				97059976107D975200A50A7C /* PolicyChecker.h */,
 				1A2A68210B5BEDE70002A480 /* ProgressTracker.cpp */,
 				1A2A68220B5BEDE70002A480 /* ProgressTracker.h */,
-				979F43D11075E44A0000F83B /* RedirectScheduler.cpp */,
-				979F43D21075E44A0000F83B /* RedirectScheduler.h */,
 				BCB16C150979C3BD00467741 /* Request.cpp */,
 				BCB16C160979C3BD00467741 /* Request.h */,
 				93E227DE0AF589AD00D48324 /* ResourceLoader.cpp */,
@@ -16986,6 +17270,7 @@
 				6593923509AE4346002C531F /* KURL.cpp */,
 				6593923609AE4346002C531F /* KURL.h */,
 				BCBD21AA0E417AD400A070F2 /* KURLHash.h */,
+				E18772F0126E2629003DD586 /* Language.cpp */,
 				85EC9AF90A71A2C600EEEAED /* Language.h */,
 				BCE65BE80EACDF16007E4533 /* Length.cpp */,
 				BCE65BE90EACDF16007E4533 /* Length.h */,
@@ -17225,7 +17510,6 @@
 				BC23E4E00DAACE0F009FDC91 /* CSSGradientValue.cpp */,
 				BC53C6910DA591140021EB5D /* CSSGradientValue.h */,
 				BCEA477E097CAAC80094C9E4 /* CSSGrammar.y */,
-				BC772B350C4EA91E0083285F /* CSSHelper.cpp */,
 				BC772B360C4EA91E0083285F /* CSSHelper.h */,
 				BC23E76B0DAE88A9009FDC91 /* CSSImageGeneratorValue.cpp */,
 				BC23EE910DAED2BC009FDC91 /* CSSImageGeneratorValue.h */,
@@ -17501,8 +17785,6 @@
 				BCFA930710333193007B25D1 /* RenderOverflow.h */,
 				A871DEC80A1530C700B12A68 /* RenderPart.cpp */,
 				A871DECF0A1530C700B12A68 /* RenderPart.h */,
-				853CA9EE0AEEC657002372DC /* RenderPath.cpp */,
-				853CA9EF0AEEC657002372DC /* RenderPath.h */,
 				A43BF59A1149292800C643CA /* RenderProgress.cpp */,
 				A43BF59B1149292800C643CA /* RenderProgress.h */,
 				A871DFDE0A15376B00B12A68 /* RenderReplaced.cpp */,
@@ -17536,10 +17818,6 @@
 				A809F1A80B737FB6002E4D7F /* RenderSVGHiddenContainer.h */,
 				853CA9CC0AEEC5E9002372DC /* RenderSVGImage.cpp */,
 				853CA9CD0AEEC5E9002372DC /* RenderSVGImage.h */,
-				853CA9CE0AEEC5E9002372DC /* RenderSVGInline.cpp */,
-				853CA9CF0AEEC5E9002372DC /* RenderSVGInline.h */,
-				853CA9D00AEEC5E9002372DC /* RenderSVGInlineText.cpp */,
-				853CA9D10AEEC5E9002372DC /* RenderSVGInlineText.h */,
 				A8F5C0B70F9285AC0098E06B /* RenderSVGModelObject.cpp */,
 				A8F5C0B60F9285AC0098E06B /* RenderSVGModelObject.h */,
 				08563BCF117865F50012B578 /* RenderSVGResource.cpp */,
@@ -17570,14 +17848,8 @@
 				AA31B5B30C1DFD1000AE7083 /* RenderSVGRoot.h */,
 				08DAB9B81103D9A5003E7ABA /* RenderSVGShadowTreeRootContainer.cpp */,
 				08DAB9B91103D9A5003E7ABA /* RenderSVGShadowTreeRootContainer.h */,
-				853CA9D20AEEC5E9002372DC /* RenderSVGText.cpp */,
-				853CA9D30AEEC5E9002372DC /* RenderSVGText.h */,
-				B26554E80B80D74900A50EC3 /* RenderSVGTextPath.cpp */,
-				B26554E90B80D74900A50EC3 /* RenderSVGTextPath.h */,
 				A8A909AB0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp */,
 				A8A909AA0CBCD6B50029B807 /* RenderSVGTransformableContainer.h */,
-				853CA9D40AEEC5E9002372DC /* RenderSVGTSpan.cpp */,
-				853CA9D50AEEC5E9002372DC /* RenderSVGTSpan.h */,
 				B2CCEC450C6CA9F1006A5424 /* RenderSVGViewportContainer.cpp */,
 				B2CCEC460C6CA9F1006A5424 /* RenderSVGViewportContainer.h */,
 				A8DF4AE20980C42C0052981B /* RenderTable.cpp */,
@@ -17620,16 +17892,8 @@
 				5D925B660F64D4DD00B847F0 /* ScrollBehavior.h */,
 				A7F338A111C0EFCA00A320A7 /* ShadowElement.cpp */,
 				A7F338A211C0EFCA00A320A7 /* ShadowElement.h */,
-				0842BC701190144000C7D08F /* SVGCharacterData.cpp */,
-				0842BC711190144000C7D08F /* SVGCharacterData.h */,
-				B2B33A5D0B887CEF00C15984 /* SVGCharacterLayoutInfo.cpp */,
-				B2B33A5E0B887CEF00C15984 /* SVGCharacterLayoutInfo.h */,
 				08C46B671212F15D0011AF40 /* SVGImageBufferTools.cpp */,
 				08C46B681212F15D0011AF40 /* SVGImageBufferTools.h */,
-				853CA9E20AEEC608002372DC /* SVGInlineFlowBox.cpp */,
-				853CA9E30AEEC608002372DC /* SVGInlineFlowBox.h */,
-				AA0972CA0B6947A800A705E9 /* SVGInlineTextBox.cpp */,
-				AA0972CB0B6947A800A705E9 /* SVGInlineTextBox.h */,
 				08385FF510F0186000BFE07B /* SVGMarkerData.h */,
 				08735FB610E91232006D6FAD /* SVGMarkerLayoutInfo.cpp */,
 				08735FB710E91232006D6FAD /* SVGMarkerLayoutInfo.h */,
@@ -17643,16 +17907,8 @@
 				084D0E3B11F5816100081E1A /* SVGResourcesCache.h */,
 				085B05C011FAE16C004D65F6 /* SVGResourcesCycleSolver.cpp */,
 				085B05C111FAE16C004D65F6 /* SVGResourcesCycleSolver.h */,
-				853CA9E40AEEC608002372DC /* SVGRootInlineBox.cpp */,
-				853CA9E50AEEC608002372DC /* SVGRootInlineBox.h */,
 				08DAB9C01103D9C1003E7ABA /* SVGShadowTreeElements.cpp */,
 				08DAB9C11103D9C1003E7ABA /* SVGShadowTreeElements.h */,
-				0853D72F11C9108F00B2FD42 /* SVGTextChunkLayoutInfo.cpp */,
-				0842BC801190147200C7D08F /* SVGTextChunkLayoutInfo.h */,
-				083F529711957FBE00653EBE /* SVGTextLayoutUtilities.cpp */,
-				083F529811957FBE00653EBE /* SVGTextLayoutUtilities.h */,
-				0853D73011C9109000B2FD42 /* SVGTextQuery.cpp */,
-				0853D73111C9109000B2FD42 /* SVGTextQuery.h */,
 				A8CFF04C0A154F09000A4234 /* TableLayout.h */,
 				AB014DE10E689A4300E10445 /* TextControlInnerElements.cpp */,
 				AB014DE20E689A4300E10445 /* TextControlInnerElements.h */,
@@ -18050,6 +18306,7 @@
 				24F54EAD101FE914000AE741 /* ApplicationCacheHost.h in Headers */,
 				1A8F6BC10DB55CDC001DB794 /* ApplicationCacheResource.h in Headers */,
 				1A2AAC590DC2A3B100A20D9A /* ApplicationCacheStorage.h in Headers */,
+				9B417064125662B3006B28FC /* ApplyBlockElementCommand.h in Headers */,
 				93309DD9099E64920056E581 /* ApplyStyleCommand.h in Headers */,
 				512DD8F60D91E6AF000F89EE /* Archive.h in Headers */,
 				512DD8FD0D91E6AF000F89EE /* ArchiveFactory.h in Headers */,
@@ -18081,6 +18338,7 @@
 				BCA8CA6011E4E6D100812FB7 /* BackForwardListImpl.h in Headers */,
 				BC124EE80C2641CD009E2349 /* BarInfo.h in Headers */,
 				B2C3DA220D006C1D00EF6F26 /* Base64.h in Headers */,
+				F59C96001255B23F000623C0 /* BaseDateAndTimeInputType.h in Headers */,
 				F55B3DAE1251F12D003EF269 /* BaseTextInputType.h in Headers */,
 				BC9462D8107A7B4C00857193 /* BeforeLoadEvent.h in Headers */,
 				51721FBB11D2790700638B42 /* BeforeProcessEvent.h in Headers */,
@@ -18296,7 +18554,10 @@
 				59A8F1D611A69513001AC34A /* DeviceOrientationController.h in Headers */,
 				59A85EA4119D68EC00DEF1EF /* DeviceOrientationEvent.h in Headers */,
 				89878553122CA064003AABDA /* DirectoryEntry.h in Headers */,
+				893C48011248BD3A002B3D86 /* DirectoryEntrySync.h in Headers */,
 				89878555122CA064003AABDA /* DirectoryReader.h in Headers */,
+				890AE0E11256A07900F5968C /* DirectoryReaderBase.h in Headers */,
+				893C48031248BD3A002B3D86 /* DirectoryReaderSync.h in Headers */,
 				84730D771248F0B300D3A9C9 /* DistantLightSource.h in Headers */,
 				B2F34FE60E82F81400F627CD /* DNS.h in Headers */,
 				A8185F4009765766005826D9 /* Document.h in Headers */,
@@ -18395,6 +18656,8 @@
 				BC00F0090E0A185500FD04E3 /* DOMFileListInternal.h in Headers */,
 				89878557122CA064003AABDA /* DOMFilePath.h in Headers */,
 				89878559122CA064003AABDA /* DOMFileSystem.h in Headers */,
+				893C48051248BD3A002B3D86 /* DOMFileSystemBase.h in Headers */,
+				893C48071248BD3A002B3D86 /* DOMFileSystemSync.h in Headers */,
 				2ED609BD1145B07100C8684E /* DOMFormData.h in Headers */,
 				BC1A37B6097C715F0019F3D8 /* DOMHTML.h in Headers */,
 				85DF81270AA7787200486AD7 /* DOMHTMLAnchorElement.h in Headers */,
@@ -19069,6 +19332,7 @@
 				A7CA595D0B27BD9E00FA021D /* DragController.h in Headers */,
 				A7B6E69F0B291A9600D0529F /* DragData.h in Headers */,
 				A7CFB3D20B7ED10A0070C32D /* DragImage.h in Headers */,
+				498770DC1242C535002226BA /* DrawingBuffer.h in Headers */,
 				BC7FA6210D1F0CBD00DB22A9 /* DynamicNodeList.h in Headers */,
 				93309DE2099E64920056E581 /* EditAction.h in Headers */,
 				93309DE4099E64920056E581 /* EditCommand.h in Headers */,
@@ -19091,7 +19355,10 @@
 				8987855A122CA064003AABDA /* EntriesCallback.h in Headers */,
 				8987855C122CA064003AABDA /* Entry.h in Headers */,
 				8987855E122CA064003AABDA /* EntryArray.h in Headers */,
+				893C48091248BD3A002B3D86 /* EntryArraySync.h in Headers */,
+				893C480B1248BD3A002B3D86 /* EntryBase.h in Headers */,
 				8987855F122CA064003AABDA /* EntryCallback.h in Headers */,
+				893C480D1248BD3A002B3D86 /* EntrySync.h in Headers */,
 				89878560122CA064003AABDA /* ErrorCallback.h in Headers */,
 				2ECF7AE210162B5800427DE7 /* ErrorEvent.h in Headers */,
 				85031B420A44EFC700F992E0 /* Event.h in Headers */,
@@ -19125,6 +19392,7 @@
 				893C47A71238908B002B3D86 /* FileCallback.h in Headers */,
 				066C772B0AB603B700238CC4 /* FileChooser.h in Headers */,
 				89878562122CA064003AABDA /* FileEntry.h in Headers */,
+				893C480F1248BD3A002B3D86 /* FileEntrySync.h in Headers */,
 				976D6C83122B8A3D001FD1F7 /* FileError.h in Headers */,
 				2EDF369F122C94C8002F7D4E /* FileException.h in Headers */,
 				F55B3DBE1251F12D003EF269 /* FileInputType.h in Headers */,
@@ -19210,6 +19478,7 @@
 				B22279640D00BF220071B782 /* GradientAttributes.h in Headers */,
 				B2A015A90AF6CD53006BCE0E /* GraphicsContext.h in Headers */,
 				49C7B9FC1042D3650009D447 /* GraphicsContext3D.h in Headers */,
+				934907E4125BBBC8007F23A0 /* GraphicsContextCG.h in Headers */,
 				A80D67080E9E9DEB00E420F0 /* GraphicsContextPlatformPrivateCG.h in Headers */,
 				A88FE3340E5EEE87008D8C0F /* GraphicsContextPrivate.h in Headers */,
 				0F580B0D0F12A2690051D689 /* GraphicsLayer.h in Headers */,
@@ -19339,7 +19608,6 @@
 				B275356E0B053814002CE64F /* Icon.h in Headers */,
 				5126E6BC0A2E3B12005C29FA /* IconDatabase.h in Headers */,
 				51E1ECBE0C91C90400DC255B /* IconDatabaseClient.h in Headers */,
-				1A2D753D0DE47FAB00F0A648 /* IconFetcher.h in Headers */,
 				513F14540AB634C400094DDF /* IconLoader.h in Headers */,
 				51E1ECC10C91C90400DC255B /* IconRecord.h in Headers */,
 				C585A6CD11D4FB3D004C3E4B /* IDBAny.h in Headers */,
@@ -19363,7 +19631,6 @@
 				C572EE0F1201C736007D8F82 /* IDBIndexBackendInterface.h in Headers */,
 				C585A6E711D4FB3D004C3E4B /* IDBKey.h in Headers */,
 				C585A6EA11D4FB3D004C3E4B /* IDBKeyRange.h in Headers */,
-				C585A6EC11D4FB3D004C3E4B /* IDBKeyTree.h in Headers */,
 				C585A6ED11D4FB3D004C3E4B /* IDBObjectStore.h in Headers */,
 				C585A6EF11D4FB3D004C3E4B /* IDBObjectStoreBackendImpl.h in Headers */,
 				C585A6F111D4FB3D004C3E4B /* IDBObjectStoreBackendInterface.h in Headers */,
@@ -19406,6 +19673,7 @@
 				4F707A9A11EF679400ACDA69 /* InspectorBackendDispatcher.h in Headers */,
 				1C81B95C0E97330800266E07 /* InspectorClient.h in Headers */,
 				1C81B95A0E97330800266E07 /* InspectorController.h in Headers */,
+				82AB1744124B99EC00C5069D /* InspectorCSSAgent.h in Headers */,
 				82B658981189E39200E052A1 /* InspectorCSSStore.h in Headers */,
 				41F062140F5F192600A07EAC /* InspectorDatabaseResource.h in Headers */,
 				F33F053E120B0DA500E5743A /* InspectorDebuggerAgent.h in Headers */,
@@ -19414,9 +19682,12 @@
 				F344C7141125B82C00F26EEE /* InspectorFrontendClient.h in Headers */,
 				F344C75311294D9D00F26EEE /* InspectorFrontendClientLocal.h in Headers */,
 				7A0E770F10C00A8800A0276E /* InspectorFrontendHost.h in Headers */,
+				20D629271253690B00081543 /* InspectorInstrumentation.h in Headers */,
 				9F0D6B2F121BFEBA006C0288 /* InspectorProfilerAgent.h in Headers */,
 				41F062010F5F0B6600A07EAC /* InspectorResource.h in Headers */,
+				82AB1776125C826700C5069D /* InspectorResourceAgent.h in Headers */,
 				7AB0B1C11211A62200A76940 /* InspectorStorageAgent.h in Headers */,
+				82AB1774125C826700C5069D /* InspectorStyleSheet.h in Headers */,
 				754133A8102E00E800075D00 /* InspectorTimelineAgent.h in Headers */,
 				4F3289B611A42AAB005ABE7E /* InspectorValues.h in Headers */,
 				F375CC071150D300008DDB81 /* InspectorWorkerResource.h in Headers */,
@@ -19500,7 +19771,9 @@
 				31FB1A66120A5D3F00DC02A0 /* JSDeviceMotionEvent.h in Headers */,
 				59A86008119DAFA100DEF1EF /* JSDeviceOrientationEvent.h in Headers */,
 				8987858B122CA26A003AABDA /* JSDirectoryEntry.h in Headers */,
+				893C483312495472002B3D86 /* JSDirectoryEntrySync.h in Headers */,
 				8987858D122CA26A003AABDA /* JSDirectoryReader.h in Headers */,
+				893C483512495472002B3D86 /* JSDirectoryReaderSync.h in Headers */,
 				659DDC8309E198BA001BF3C6 /* JSDocument.h in Headers */,
 				1A494EDF0A123F4C00FDAFC1 /* JSDocumentFragment.h in Headers */,
 				65DF31F609D1CC60000BE325 /* JSDocumentType.h in Headers */,
@@ -19508,6 +19781,7 @@
 				93B70D6409EB0C7C009D8468 /* JSDOMBinding.h in Headers */,
 				BC60D7C10D29A46300B9918F /* JSDOMCoreException.h in Headers */,
 				898785A5122CA2A7003AABDA /* JSDOMFileSystem.h in Headers */,
+				893C483712495472002B3D86 /* JSDOMFileSystemSync.h in Headers */,
 				2E0888D51148848A00AF4265 /* JSDOMFormData.h in Headers */,
 				E1C36C030EB076D6007410BC /* JSDOMGlobalObject.h in Headers */,
 				65DF31F809D1CC60000BE325 /* JSDOMImplementation.h in Headers */,
@@ -19530,7 +19804,9 @@
 				898785A7122CA2A7003AABDA /* JSEntriesCallback.h in Headers */,
 				898785A9122CA2A7003AABDA /* JSEntry.h in Headers */,
 				898785AB122CA2A7003AABDA /* JSEntryArray.h in Headers */,
+				893C483912495472002B3D86 /* JSEntryArraySync.h in Headers */,
 				898785AD122CA2A7003AABDA /* JSEntryCallback.h in Headers */,
+				893C483B12495472002B3D86 /* JSEntrySync.h in Headers */,
 				898785AF122CA2A7003AABDA /* JSErrorCallback.h in Headers */,
 				2ECF7ADD10162B3800427DE7 /* JSErrorEvent.h in Headers */,
 				14E8378E09F85D4F00B85AE4 /* JSEvent.h in Headers */,
@@ -19542,6 +19818,7 @@
 				BC00F0150E0A189500FD04E3 /* JSFile.h in Headers */,
 				893C47B81238A099002B3D86 /* JSFileCallback.h in Headers */,
 				898785B1122CA2A7003AABDA /* JSFileEntry.h in Headers */,
+				893C483D12495472002B3D86 /* JSFileEntrySync.h in Headers */,
 				2E3BC0CB117D3E0800B9409A /* JSFileError.h in Headers */,
 				898785F1122E1E87003AABDA /* JSFileException.h in Headers */,
 				BC00F0170E0A189500FD04E3 /* JSFileList.h in Headers */,
@@ -19927,6 +20204,10 @@
 				511F231A0DC160DA004F0032 /* LocalStorageThread.h in Headers */,
 				BCE1C41B0D982980003B02F2 /* Location.h in Headers */,
 				A8239E0109B3CF8A00B60641 /* Logging.h in Headers */,
+				49B69E5F1254FEED007D57EB /* LoopBlinnClassifier.h in Headers */,
+				49B69E601254FEED007D57EB /* LoopBlinnConstants.h in Headers */,
+				49B69E641254FEED007D57EB /* LoopBlinnMathUtils.h in Headers */,
+				49B69E661254FEED007D57EB /* LoopBlinnTextureCoords.h in Headers */,
 				656D37410ADBA5DE00A4554D /* MainResourceLoader.h in Headers */,
 				1A8F6BC60DB55CDC001DB794 /* ManifestParser.h in Headers */,
 				A8C4A84C09D5649D0003AC8D /* MappedAttributeEntry.h in Headers */,
@@ -19970,6 +20251,7 @@
 				E10B9B6C0B747599003ED890 /* NativeXPathNSResolver.h in Headers */,
 				8AF4E55611DC5A36000ED3DE /* Navigation.h in Headers */,
 				93CCF0270AF6C52900018E89 /* NavigationAction.h in Headers */,
+				979F43D41075E44A0000F83B /* NavigationScheduler.h in Headers */,
 				A9C6E5A60D746458006442E9 /* Navigator.h in Headers */,
 				E12719C70EEEC16800F61213 /* NavigatorBase.h in Headers */,
 				8A309C9F123950BE00CB9204 /* NestingLevelIncrementer.h in Headers */,
@@ -20054,6 +20336,10 @@
 				1ADA14110E1AE5D900023EE5 /* PluginMainThreadScheduler.h in Headers */,
 				1AA8799011CBE846003C664F /* PluginStrategy.h in Headers */,
 				0AFDAC3D10F5448C00E1F3D2 /* PluginViewBase.h in Headers */,
+				498770E41242C535002226BA /* PODArena.h in Headers */,
+				498770E51242C535002226BA /* PODInterval.h in Headers */,
+				498770E61242C535002226BA /* PODIntervalTree.h in Headers */,
+				498770E71242C535002226BA /* PODRedBlackTree.h in Headers */,
 				B2B1F7170D00CAA8004AEA64 /* PointerEventsHitRules.h in Headers */,
 				84730D921248F0B300D3A9C9 /* PointLightSource.h in Headers */,
 				97059978107D975200A50A7C /* PolicyCallback.h in Headers */,
@@ -20075,6 +20361,7 @@
 				1A2A68240B5BEDE70002A480 /* ProgressTracker.h in Headers */,
 				514C76750CE923A1007EF3CD /* ProtectionSpace.h in Headers */,
 				51A052561058874000CC9E95 /* ProtectionSpaceHash.h in Headers */,
+				1AF8E11A1256592600230FF7 /* ProxyServer.h in Headers */,
 				E4D687790ED7AE4F006EA978 /* PurgeableBuffer.h in Headers */,
 				550A0BCA085F6039007353D6 /* QualifiedName.h in Headers */,
 				B22279720D00BF220071B782 /* RadialGradientAttributes.h in Headers */,
@@ -20085,7 +20372,6 @@
 				F55B3DCE1251F12D003EF269 /* RangeInputType.h in Headers */,
 				A84D827C11D333ED00972990 /* RawDataDocumentParser.h in Headers */,
 				BC4368E80C226E32005EFB5F /* Rect.h in Headers */,
-				979F43D41075E44A0000F83B /* RedirectScheduler.h in Headers */,
 				85031B4C0A44EFC700F992E0 /* RegisteredEventListener.h in Headers */,
 				B2C3DA2D0D006C1D00EF6F26 /* RegularExpression.h in Headers */,
 				93309E01099E64920056E581 /* RemoveCSSPropertyCommand.h in Headers */,
@@ -20142,7 +20428,6 @@
 				BC2CC8DF0F32881000A9DF26 /* RenderObjectChildList.h in Headers */,
 				BCFA930810333193007B25D1 /* RenderOverflow.h in Headers */,
 				A871DED70A1530C700B12A68 /* RenderPart.h in Headers */,
-				853CA9F10AEEC657002372DC /* RenderPath.h in Headers */,
 				A43BF59D1149292800C643CA /* RenderProgress.h in Headers */,
 				A871DFE30A15376B00B12A68 /* RenderReplaced.h in Headers */,
 				BCA846D70DC67A350026C309 /* RenderReplica.h in Headers */,
@@ -20162,9 +20447,10 @@
 				A809F1470B73793A002E4D7F /* RenderSVGGradientStop.h in Headers */,
 				A809F1AA0B737FB6002E4D7F /* RenderSVGHiddenContainer.h in Headers */,
 				853CA9D90AEEC5E9002372DC /* RenderSVGImage.h in Headers */,
-				853CA9DB0AEEC5E9002372DC /* RenderSVGInline.h in Headers */,
-				853CA9DD0AEEC5E9002372DC /* RenderSVGInlineText.h in Headers */,
+				0854B0151255E4E600B9CDD0 /* RenderSVGInline.h in Headers */,
+				0854B0171255E4E600B9CDD0 /* RenderSVGInlineText.h in Headers */,
 				A8F5C0B80F9285AC0098E06B /* RenderSVGModelObject.h in Headers */,
+				ADDF1AD71257CD9A0003A759 /* RenderSVGPath.h in Headers */,
 				083192AA112B43050083C3B9 /* RenderSVGResource.h in Headers */,
 				84BDA16C11358D2A00DBF64C /* RenderSVGResourceClipper.h in Headers */,
 				08082373117987C100241DE8 /* RenderSVGResourceContainer.h in Headers */,
@@ -20179,10 +20465,10 @@
 				08C6A7AC117DFBAB00FEA1A2 /* RenderSVGResourceSolidColor.h in Headers */,
 				AA31B5B50C1DFD1000AE7083 /* RenderSVGRoot.h in Headers */,
 				08DAB9BB1103D9A5003E7ABA /* RenderSVGShadowTreeRootContainer.h in Headers */,
-				853CA9DF0AEEC5E9002372DC /* RenderSVGText.h in Headers */,
-				B26554EB0B80D74900A50EC3 /* RenderSVGTextPath.h in Headers */,
+				0854B0191255E4E600B9CDD0 /* RenderSVGText.h in Headers */,
+				0854B01B1255E4E600B9CDD0 /* RenderSVGTextPath.h in Headers */,
 				A8A909AC0CBCD6B50029B807 /* RenderSVGTransformableContainer.h in Headers */,
-				853CA9E10AEEC5E9002372DC /* RenderSVGTSpan.h in Headers */,
+				0854B01D1255E4E600B9CDD0 /* RenderSVGTSpan.h in Headers */,
 				B2CCEC480C6CA9F1006A5424 /* RenderSVGViewportContainer.h in Headers */,
 				A8DF4AEB0980C42C0052981B /* RenderTable.h in Headers */,
 				A8DF4AE90980C42C0052981B /* RenderTableCell.h in Headers */,
@@ -20213,6 +20499,7 @@
 				656D373F0ADBA5DE00A4554D /* ResourceLoader.h in Headers */,
 				973E325710883B7C005BC493 /* ResourceLoadNotifier.h in Headers */,
 				8A81BF8511DCFD9000DA2B98 /* ResourceLoadTiming.h in Headers */,
+				492863991253B8FC00F792D6 /* ResourceRawHeaders.h in Headers */,
 				514C76520CE9234E007EF3CD /* ResourceRequest.h in Headers */,
 				514C767D0CE923A1007EF3CD /* ResourceRequestBase.h in Headers */,
 				514C76540CE9234E007EF3CD /* ResourceResponse.h in Headers */,
@@ -20255,7 +20542,6 @@
 				934CC10A0EDB223900A658F2 /* ScriptSourceCode.h in Headers */,
 				CE54FD381016D9A6008B44C8 /* ScriptSourceProvider.h in Headers */,
 				41C760B10EDE03D300C1655F /* ScriptState.h in Headers */,
-				416F45F00ED7B311008215B6 /* ScriptString.h in Headers */,
 				934CC0E20ED39D6F00A658F2 /* ScriptValue.h in Headers */,
 				228C284510D82500009D0D0E /* ScriptWrappable.h in Headers */,
 				CA3BF67E10D99BAE00E6CE53 /* ScrollAnimator.h in Headers */,
@@ -20281,11 +20567,13 @@
 				A75E497610752ACB00C9B896 /* SerializedScriptValue.h in Headers */,
 				93309E10099E64920056E581 /* SetNodeAttributeCommand.h in Headers */,
 				93F1994F08245E59001E9ABC /* Settings.h in Headers */,
+				498770E91242C535002226BA /* Shader.h in Headers */,
 				BC5EB8C40E82031B00B25965 /* ShadowData.h in Headers */,
 				A7F338A411C0EFCA00A320A7 /* ShadowElement.h in Headers */,
 				A80E6CE80A1989CA007FB8C5 /* ShadowValue.h in Headers */,
 				B2AFFC940D00A5DF0030074D /* ShapeArabic.h in Headers */,
 				1A4A954E0B4EDCCB002D8C3C /* SharedBuffer.h in Headers */,
+				498770EB1242C535002226BA /* SharedGraphicsContext3D.h in Headers */,
 				93309EA3099EB78C0056E581 /* SharedTimer.h in Headers */,
 				41E1B1D40FF5986900576B3B /* SharedWorker.h in Headers */,
 				41D168E810226E89009BC827 /* SharedWorkerContext.h in Headers */,
@@ -20303,6 +20591,7 @@
 				510D4A37103165EE0049EA54 /* SocketStreamHandleBase.h in Headers */,
 				510D4A38103165EE0049EA54 /* SocketStreamHandleClient.h in Headers */,
 				0A4844990CA44CB200B7BD48 /* SoftLinking.h in Headers */,
+				498770ED1242C535002226BA /* SolidFillShader.h in Headers */,
 				4B3043C70AE0370300A82647 /* Sound.h in Headers */,
 				84A81F3E0FC7DFF000955300 /* SourceAlpha.h in Headers */,
 				84A81F420FC7E02700955300 /* SourceGraphic.h in Headers */,
@@ -20349,8 +20638,6 @@
 				C50D0E830FF4272900AC2644 /* StorageNamespace.h in Headers */,
 				C55E38BF10040D5D00A56BDB /* StorageNamespaceImpl.h in Headers */,
 				C5102D940FD9AA2D00FAFF04 /* StorageSyncManager.h in Headers */,
-				939B3E4E0D3C1E8400B4A92B /* StringBuffer.h in Headers */,
-				E1A302BC0DE8370300C52F2C /* StringBuilder.h in Headers */,
 				65488D6B0DD5A83D009D83B2 /* StringSourceProvider.h in Headers */,
 				B23540F30D00782E002382FA /* StringTruncator.h in Headers */,
 				849F77760EFEC6200090849D /* StrokeStyleApplier.h in Headers */,
@@ -20392,16 +20679,10 @@
 				B222797A0D00BF220071B782 /* SVGAnimateColorElement.h in Headers */,
 				B22279850D00BF220071B782 /* SVGAnimatedPathData.h in Headers */,
 				B22279880D00BF220071B782 /* SVGAnimatedPoints.h in Headers */,
-				0878B1FD10874E3F00A55097 /* SVGAnimatedProperty.h in Headers */,
-				084D2833110A7FCB0038239A /* SVGAnimatedPropertySynchronizer.h in Headers */,
-				084D2834110A7FCB0038239A /* SVGAnimatedPropertyTraits.h in Headers */,
-				B222798D0D00BF220071B782 /* SVGAnimatedTemplate.h in Headers */,
 				B22279900D00BF220071B782 /* SVGAnimateElement.h in Headers */,
 				B22279930D00BF220071B782 /* SVGAnimateMotionElement.h in Headers */,
 				B22279950D00BF220071B782 /* SVGAnimateTransformElement.h in Headers */,
 				B22279980D00BF220071B782 /* SVGAnimationElement.h in Headers */,
-				0842BC731190144000C7D08F /* SVGCharacterData.h in Headers */,
-				B2B33A600B887CEF00C15984 /* SVGCharacterLayoutInfo.h in Headers */,
 				B222799C0D00BF220071B782 /* SVGCircleElement.h in Headers */,
 				B222799F0D00BF220071B782 /* SVGClipPathElement.h in Headers */,
 				B22279A20D00BF220071B782 /* SVGColor.h in Headers */,
@@ -20467,8 +20748,8 @@
 				08C46B6A1212F15E0011AF40 /* SVGImageBufferTools.h in Headers */,
 				B2227A2D0D00BF220071B782 /* SVGImageElement.h in Headers */,
 				B28C6A2A0D00C44800334AA4 /* SVGImageLoader.h in Headers */,
-				853CA9E70AEEC608002372DC /* SVGInlineFlowBox.h in Headers */,
-				AA0972CD0B6947A800A705E9 /* SVGInlineTextBox.h in Headers */,
+				0854B01F1255E4E600B9CDD0 /* SVGInlineFlowBox.h in Headers */,
+				0854B0211255E4E600B9CDD0 /* SVGInlineTextBox.h in Headers */,
 				B2227A300D00BF220071B782 /* SVGLangSpace.h in Headers */,
 				B2227A330D00BF220071B782 /* SVGLength.h in Headers */,
 				B2227A360D00BF220071B782 /* SVGLengthList.h in Headers */,
@@ -20530,7 +20811,7 @@
 				084D0E3D11F5816100081E1A /* SVGResources.h in Headers */,
 				084D0E3F11F5816100081E1A /* SVGResourcesCache.h in Headers */,
 				085B05C311FAE16C004D65F6 /* SVGResourcesCycleSolver.h in Headers */,
-				853CA9E90AEEC608002372DC /* SVGRootInlineBox.h in Headers */,
+				0854B0231255E4E600B9CDD0 /* SVGRootInlineBox.h in Headers */,
 				B2227AA30D00BF220071B782 /* SVGScriptElement.h in Headers */,
 				B2227AA60D00BF220071B782 /* SVGSetElement.h in Headers */,
 				08DAB9C31103D9C1003E7ABA /* SVGShadowTreeElements.h in Headers */,
@@ -20546,15 +20827,20 @@
 				B2227ABE0D00BF220071B782 /* SVGSwitchElement.h in Headers */,
 				B2227AC10D00BF220071B782 /* SVGSymbolElement.h in Headers */,
 				B2227AC50D00BF220071B782 /* SVGTests.h in Headers */,
-				0842BC811190147200C7D08F /* SVGTextChunkLayoutInfo.h in Headers */,
+				08F0BFC31255C53C00075185 /* SVGTextChunk.h in Headers */,
+				081668D4125603BF006F25DE /* SVGTextChunkBuilder.h in Headers */,
 				B2227AC80D00BF220071B782 /* SVGTextContentElement.h in Headers */,
 				B2227ACB0D00BF220071B782 /* SVGTextElement.h in Headers */,
+				08F0BFC41255C53C00075185 /* SVGTextFragment.h in Headers */,
 				088C2F7A12390081003D65CE /* SVGTextLayoutAttributes.h in Headers */,
-				088C2F7C12390081003D65CE /* SVGTextLayoutBuilder.h in Headers */,
-				083F529A11957FBE00653EBE /* SVGTextLayoutUtilities.h in Headers */,
+				081093DC1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.h in Headers */,
+				081668DA125603D5006F25DE /* SVGTextLayoutEngine.h in Headers */,
+				080E49261255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.h in Headers */,
+				080E49281255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.h in Headers */,
+				08F0BFC61255C53C00075185 /* SVGTextMetrics.h in Headers */,
 				B2227ACE0D00BF220071B782 /* SVGTextPathElement.h in Headers */,
 				B2227AD10D00BF220071B782 /* SVGTextPositioningElement.h in Headers */,
-				0853D73411C9109000B2FD42 /* SVGTextQuery.h in Headers */,
+				0854B0251255E4E600B9CDD0 /* SVGTextQuery.h in Headers */,
 				B2227AD40D00BF220071B782 /* SVGTitleElement.h in Headers */,
 				B2227AD70D00BF220071B782 /* SVGTransform.h in Headers */,
 				B2227ADA0D00BF220071B782 /* SVGTransformable.h in Headers */,
@@ -20574,6 +20860,7 @@
 				A8CFF0510A154F09000A4234 /* TableLayout.h in Headers */,
 				BCE3BEC30D222B1D007E06E4 /* TagNodeList.h in Headers */,
 				F55B3DD61251F12D003EF269 /* TelephoneInputType.h in Headers */,
+				498770EF1242C535002226BA /* TexShader.h in Headers */,
 				6550B6A6099DF0270090D781 /* Text.h in Headers */,
 				93309E17099E64920056E581 /* TextAffinity.h in Headers */,
 				B2C3DA340D006C1D00EF6F26 /* TextBoundaries.h in Headers */,
@@ -20602,6 +20889,7 @@
 				93F198F608245E59001E9ABC /* TextResourceDecoder.h in Headers */,
 				A824B4650E2EF2EA0081A7B7 /* TextRun.h in Headers */,
 				B2C3DA4B0D006C1D00EF6F26 /* TextStream.h in Headers */,
+				498770F11242C535002226BA /* Texture.h in Headers */,
 				97BC84A512370DC8000C6161 /* TextViewSourceParser.h in Headers */,
 				BCE658FF0EA9248A007E4533 /* Theme.h in Headers */,
 				BCE659E60EA92FB2007E4533 /* ThemeMac.h in Headers */,
@@ -20614,6 +20902,7 @@
 				51DF6D7E0B92A16D00C2DC85 /* ThreadCheck.h in Headers */,
 				E1FF57A30F01255B00891EBB /* ThreadGlobalData.h in Headers */,
 				185BCF290F3279CE000EA262 /* ThreadTimers.h in Headers */,
+				498770F31242C535002226BA /* TilingData.h in Headers */,
 				F55B3DDC1251F12D003EF269 /* TimeInputType.h in Headers */,
 				7553CFE8108F473F00EA281E /* TimelineRecordFactory.h in Headers */,
 				9305B24D098F1B6B00C28855 /* Timer.h in Headers */,
@@ -20798,6 +21087,12 @@
 				93F199ED08245E59001E9ABC /* XSLTProcessor.h in Headers */,
 				E1BE512E0CF6C512002EA959 /* XSLTUnicodeSort.h in Headers */,
 				97DD4D870FDF4D6E00ECF9A4 /* XSSAuditor.h in Headers */,
+				4FA3B90B125CD12200300BAD /* InspectorState.h in Headers */,
+				9728C3141268E4390041E89B /* MarkupAccumulator.h in Headers */,
+				081CDFB8126ECFDB00D215CA /* DeprecatedSVGAnimatedProperty.h in Headers */,
+				081CDFB9126ECFDB00D215CA /* DeprecatedSVGAnimatedPropertyTraits.h in Headers */,
+				081CDFBA126ECFDB00D215CA /* DeprecatedSVGAnimatedTemplate.h in Headers */,
+				081CDFBF126ECFE800D215CA /* SVGAnimatedPropertySynchronizer.h in Headers */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -20857,6 +21152,7 @@
 			isa = PBXProject;
 			buildConfigurationList = 149C284308902B11008A9EFC /* Build configuration list for PBXProject "WebCore" */;
 			compatibilityVersion = "Xcode 2.4";
+			developmentRegion = English;
 			hasScannedForEncodings = 1;
 			knownRegions = (
 				English,
@@ -21095,10 +21391,6 @@
 			isa = PBXSourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
-				1ABA76C911D20E47004C201C /* ColorData.cpp in Sources */,
-				1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */,
-				1ABA76CB11D20E57004C201C /* CSSValueKeywords.cpp in Sources */,
-				1ABA76CC11D20E5B004C201C /* DocTypeStrings.cpp in Sources */,
 				B5B5DC69119BB3D5002A8790 /* AbstractDatabase.cpp in Sources */,
 				41E1B1D00FF5986900576B3B /* AbstractWorker.cpp in Sources */,
 				29A812280FBB9C1D00510293 /* AccessibilityARIAGrid.cpp in Sources */,
@@ -21138,6 +21430,7 @@
 				24F54EAC101FE914000AE741 /* ApplicationCacheHost.cpp in Sources */,
 				1A8F6BC00DB55CDC001DB794 /* ApplicationCacheResource.cpp in Sources */,
 				1A2AAC580DC2A3B100A20D9A /* ApplicationCacheStorage.cpp in Sources */,
+				9B417065125662B3006B28FC /* ApplyBlockElementCommand.cpp in Sources */,
 				93309DD8099E64920056E581 /* ApplyStyleCommand.cpp in Sources */,
 				512DD8FA0D91E6AF000F89EE /* ArchiveFactory.cpp in Sources */,
 				512DD8FB0D91E6AF000F89EE /* ArchiveResource.cpp in Sources */,
@@ -21160,6 +21453,7 @@
 				BCA8CA5F11E4E6D100812FB7 /* BackForwardListImpl.cpp in Sources */,
 				BC124EE70C2641CD009E2349 /* BarInfo.cpp in Sources */,
 				B2C3DA210D006C1D00EF6F26 /* Base64.cpp in Sources */,
+				F59C95FF1255B23F000623C0 /* BaseDateAndTimeInputType.cpp in Sources */,
 				F55B3DAD1251F12D003EF269 /* BaseTextInputType.cpp in Sources */,
 				5172204B11D2960500638B42 /* BeforeProcessEvent.cpp in Sources */,
 				AB23A32709BBA7D00067CC53 /* BeforeTextInsertedEvent.cpp in Sources */,
@@ -21221,6 +21515,7 @@
 				93C441EF0F813A1A00C1A634 /* CollectionCache.cpp in Sources */,
 				B27535660B053814002CE64F /* Color.cpp in Sources */,
 				0FCF33240F2B9715004B6795 /* ColorCG.cpp in Sources */,
+				1ABA76C911D20E47004C201C /* ColorData.cpp in Sources */,
 				B22279620D00BF220071B782 /* ColorDistance.cpp in Sources */,
 				F55B3DB31251F12D003EF269 /* ColorInputType.cpp in Sources */,
 				B27535770B053814002CE64F /* ColorMac.mm in Sources */,
@@ -21264,7 +21559,6 @@
 				BC02A6460E09AAE9004B6D2B /* CSSFunctionValue.cpp in Sources */,
 				BC23E4E10DAACE0F009FDC91 /* CSSGradientValue.cpp in Sources */,
 				650F53DD09D15DDF00C9B0C8 /* CSSGrammar.cpp in Sources */,
-				BC772B3B0C4EA91E0083285F /* CSSHelper.cpp in Sources */,
 				BC23E76C0DAE88A9009FDC91 /* CSSImageGeneratorValue.cpp in Sources */,
 				A80E6CFE0A1989CA007FB8C5 /* CSSImageValue.cpp in Sources */,
 				A80E6CEB0A1989CA007FB8C5 /* CSSImportRule.cpp in Sources */,
@@ -21281,6 +21575,7 @@
 				A80E6D050A1989CA007FB8C5 /* CSSPrimitiveValue.cpp in Sources */,
 				A80E6CF70A1989CA007FB8C5 /* CSSProperty.cpp in Sources */,
 				0F6ECD460F252F3700BDE271 /* CSSPropertyLonghand.cpp in Sources */,
+				1ABA76CA11D20E50004C201C /* CSSPropertyNames.cpp in Sources */,
 				82E3D8DE122EA0D1003AE5BC /* CSSPropertySourceData.cpp in Sources */,
 				BC5A12DF0DC0414800C9AFAD /* CSSReflectValue.cpp in Sources */,
 				A80E6D060A1989CA007FB8C5 /* CSSRule.cpp in Sources */,
@@ -21294,6 +21589,7 @@
 				A8EA80080A19516E00A8EF5F /* CSSStyleSheet.cpp in Sources */,
 				BC80C9870CD294EE00A0B7B3 /* CSSTimingFunctionValue.cpp in Sources */,
 				371F53EA0D2704F900ECE0D5 /* CSSUnicodeRangeValue.cpp in Sources */,
+				1ABA76CB11D20E57004C201C /* CSSValueKeywords.cpp in Sources */,
 				A80E6CE40A1989CA007FB8C5 /* CSSValueList.cpp in Sources */,
 				BCCBE7B50E07166900EAFA8E /* CSSVariableDependentValue.cpp in Sources */,
 				BCCBE69B0E06F51000EAFA8E /* CSSVariablesDeclaration.cpp in Sources */,
@@ -21331,8 +21627,11 @@
 				59A8F1D411A69508001AC34A /* DeviceOrientationController.cpp in Sources */,
 				59A85EA2119D68D900DEF1EF /* DeviceOrientationEvent.cpp in Sources */,
 				89878552122CA064003AABDA /* DirectoryEntry.cpp in Sources */,
+				893C48001248BD3A002B3D86 /* DirectoryEntrySync.cpp in Sources */,
 				89878554122CA064003AABDA /* DirectoryReader.cpp in Sources */,
+				893C48021248BD3A002B3D86 /* DirectoryReaderSync.cpp in Sources */,
 				B2F34FE90E82F82700F627CD /* DNSCFNet.cpp in Sources */,
+				1ABA76CC11D20E5B004C201C /* DocTypeStrings.cpp in Sources */,
 				A8185F3C09765766005826D9 /* Document.cpp in Sources */,
 				A8185F3F09765766005826D9 /* DocumentFragment.cpp in Sources */,
 				93E227E00AF589AD00D48324 /* DocumentLoader.cpp in Sources */,
@@ -21386,6 +21685,8 @@
 				BC00F0080E0A185500FD04E3 /* DOMFileList.mm in Sources */,
 				89878556122CA064003AABDA /* DOMFilePath.cpp in Sources */,
 				89878558122CA064003AABDA /* DOMFileSystem.cpp in Sources */,
+				893C48041248BD3A002B3D86 /* DOMFileSystemBase.cpp in Sources */,
+				893C48061248BD3A002B3D86 /* DOMFileSystemSync.cpp in Sources */,
 				2ED609BC1145B07100C8684E /* DOMFormData.cpp in Sources */,
 				BC1A37B7097C715F0019F3D8 /* DOMHTML.mm in Sources */,
 				85DF81280AA7787200486AD7 /* DOMHTMLAnchorElement.mm in Sources */,
@@ -21644,6 +21945,8 @@
 				A795463E0B5C4C80007B438F /* DragDataMac.mm in Sources */,
 				A7CFB3D10B7ED10A0070C32D /* DragImage.cpp in Sources */,
 				A7CFB3D50B7ED1180070C32D /* DragImageMac.mm in Sources */,
+				498770DB1242C535002226BA /* DrawingBuffer.cpp in Sources */,
+				498771531243F9FA002226BA /* DrawingBufferMac.mm in Sources */,
 				BC7FA6200D1F0CBD00DB22A9 /* DynamicNodeList.cpp in Sources */,
 				93309DE3099E64920056E581 /* EditCommand.cpp in Sources */,
 				6550B6A3099DF0270090D781 /* EditingText.cpp in Sources */,
@@ -21657,6 +21960,8 @@
 				A8EA7EC10A1945D000A8EF5F /* EntityReference.cpp in Sources */,
 				8987855B122CA064003AABDA /* Entry.cpp in Sources */,
 				8987855D122CA064003AABDA /* EntryArray.cpp in Sources */,
+				893C48081248BD3A002B3D86 /* EntryArraySync.cpp in Sources */,
+				893C480C1248BD3A002B3D86 /* EntrySync.cpp in Sources */,
 				2ECF7AE110162B5800427DE7 /* ErrorEvent.cpp in Sources */,
 				85031B410A44EFC700F992E0 /* Event.cpp in Sources */,
 				93C09A810B064F00005ABD4D /* EventHandler.cpp in Sources */,
@@ -21688,6 +21993,7 @@
 				934FE9E50B5CA539003E4A73 /* FileChooser.cpp in Sources */,
 				066C772D0AB603D200238CC4 /* FileChooserMac.mm in Sources */,
 				89878561122CA064003AABDA /* FileEntry.cpp in Sources */,
+				893C480E1248BD3A002B3D86 /* FileEntrySync.cpp in Sources */,
 				F55B3DBD1251F12D003EF269 /* FileInputType.cpp in Sources */,
 				976D6C85122B8A3D001FD1F7 /* FileList.cpp in Sources */,
 				976D6C88122B8A3D001FD1F7 /* FileReader.cpp in Sources */,
@@ -21884,7 +22190,6 @@
 				375CD23B119D44EA00A2A859 /* HyphenationMac.mm in Sources */,
 				5126E6BB0A2E3B12005C29FA /* IconDatabase.cpp in Sources */,
 				445C8DB710015FC90031531A /* IconDatabaseNone.cpp in Sources */,
-				1A2D753E0DE47FAB00F0A648 /* IconFetcher.cpp in Sources */,
 				513F14530AB634C400094DDF /* IconLoader.cpp in Sources */,
 				B275358E0B053A66002CE64F /* IconMac.mm in Sources */,
 				51E1ECC00C91C90400DC255B /* IconRecord.cpp in Sources */,
@@ -21939,6 +22244,7 @@
 				7A74ECBA101839A600BF939E /* InspectorBackend.cpp in Sources */,
 				4F707A9911EF679400ACDA69 /* InspectorBackendDispatcher.cpp in Sources */,
 				1C81B95B0E97330800266E07 /* InspectorController.cpp in Sources */,
+				82AB1743124B99EC00C5069D /* InspectorCSSAgent.cpp in Sources */,
 				82B6589A1189E47600E052A1 /* InspectorCSSStore.cpp in Sources */,
 				41F062150F5F192600A07EAC /* InspectorDatabaseResource.cpp in Sources */,
 				F33F053D120B0DA500E5743A /* InspectorDebuggerAgent.cpp in Sources */,
@@ -21947,9 +22253,12 @@
 				4F4F5FFB11CBD2E100A186BF /* InspectorFrontend.cpp in Sources */,
 				F344C75811294FF600F26EEE /* InspectorFrontendClientLocal.cpp in Sources */,
 				7A0E770E10C00A8800A0276E /* InspectorFrontendHost.cpp in Sources */,
+				20D629261253690B00081543 /* InspectorInstrumentation.cpp in Sources */,
 				9F0D6B2E121BFEBA006C0288 /* InspectorProfilerAgent.cpp in Sources */,
 				41F062020F5F0B6600A07EAC /* InspectorResource.cpp in Sources */,
+				82AB1775125C826700C5069D /* InspectorResourceAgent.cpp in Sources */,
 				7AB0B1C01211A62200A76940 /* InspectorStorageAgent.cpp in Sources */,
+				82AB1773125C826700C5069D /* InspectorStyleSheet.cpp in Sources */,
 				754133AA102E00F400075D00 /* InspectorTimelineAgent.cpp in Sources */,
 				4F3289B511A42AAB005ABE7E /* InspectorValues.cpp in Sources */,
 				49EECDEB10503C2400099FAB /* Int16Array.cpp in Sources */,
@@ -22051,7 +22360,10 @@
 				590E1B4B11E4EF700069F784 /* JSDeviceOrientationEventCustom.cpp in Sources */,
 				8987858A122CA26A003AABDA /* JSDirectoryEntry.cpp in Sources */,
 				893C47DF123EF4A9002B3D86 /* JSDirectoryEntryCustom.cpp in Sources */,
+				893C483212495472002B3D86 /* JSDirectoryEntrySync.cpp in Sources */,
+				893C48211249535B002B3D86 /* JSDirectoryEntrySyncCustom.cpp in Sources */,
 				8987858C122CA26A003AABDA /* JSDirectoryReader.cpp in Sources */,
+				893C483412495472002B3D86 /* JSDirectoryReaderSync.cpp in Sources */,
 				659DDC8209E198BA001BF3C6 /* JSDocument.cpp in Sources */,
 				49C7BA8D1042F5B10009D447 /* JSDocumentCustom.cpp in Sources */,
 				1A494EDE0A123F4C00FDAFC1 /* JSDocumentFragment.cpp in Sources */,
@@ -22061,6 +22373,7 @@
 				93B70D6309EB0C7C009D8468 /* JSDOMBinding.cpp in Sources */,
 				BC60D7C00D29A46300B9918F /* JSDOMCoreException.cpp in Sources */,
 				898785A4122CA2A7003AABDA /* JSDOMFileSystem.cpp in Sources */,
+				893C483612495472002B3D86 /* JSDOMFileSystemSync.cpp in Sources */,
 				2E0888D41148848A00AF4265 /* JSDOMFormData.cpp in Sources */,
 				2E0888E6114884E200AF4265 /* JSDOMFormDataCustom.cpp in Sources */,
 				E1C36CBD0EB08062007410BC /* JSDOMGlobalObject.cpp in Sources */,
@@ -22090,8 +22403,11 @@
 				898785A6122CA2A7003AABDA /* JSEntriesCallback.cpp in Sources */,
 				898785A8122CA2A7003AABDA /* JSEntry.cpp in Sources */,
 				898785AA122CA2A7003AABDA /* JSEntryArray.cpp in Sources */,
+				893C483812495472002B3D86 /* JSEntryArraySync.cpp in Sources */,
 				898785AC122CA2A7003AABDA /* JSEntryCallback.cpp in Sources */,
 				893C47CC123EEBA2002B3D86 /* JSEntryCustom.cpp in Sources */,
+				893C483A12495472002B3D86 /* JSEntrySync.cpp in Sources */,
+				893C485312499B06002B3D86 /* JSEntrySyncCustom.cpp in Sources */,
 				898785AE122CA2A7003AABDA /* JSErrorCallback.cpp in Sources */,
 				2ECF7ADC10162B3800427DE7 /* JSErrorEvent.cpp in Sources */,
 				14E8378409F85D1C00B85AE4 /* JSEvent.cpp in Sources */,
@@ -22105,6 +22421,7 @@
 				BC00F0140E0A189500FD04E3 /* JSFile.cpp in Sources */,
 				893C47B71238A099002B3D86 /* JSFileCallback.cpp in Sources */,
 				898785B0122CA2A7003AABDA /* JSFileEntry.cpp in Sources */,
+				893C483C12495472002B3D86 /* JSFileEntrySync.cpp in Sources */,
 				2E3BC0CA117D3E0800B9409A /* JSFileError.cpp in Sources */,
 				898785F0122E1E87003AABDA /* JSFileException.cpp in Sources */,
 				BC00F0160E0A189500FD04E3 /* JSFileList.cpp in Sources */,
@@ -22551,6 +22868,9 @@
 				BCE1C41C0D982981003B02F2 /* Location.cpp in Sources */,
 				A8239E0009B3CF8A00B60641 /* Logging.cpp in Sources */,
 				1402645E0AFDC19B005919E2 /* LoggingMac.mm in Sources */,
+				49B69E5E1254FEED007D57EB /* LoopBlinnClassifier.cpp in Sources */,
+				49B69E631254FEED007D57EB /* LoopBlinnMathUtils.cpp in Sources */,
+				49B69E651254FEED007D57EB /* LoopBlinnTextureCoords.cpp in Sources */,
 				93E227E10AF589AD00D48324 /* MainResourceLoader.cpp in Sources */,
 				1A8F6BC50DB55CDC001DB794 /* ManifestParser.cpp in Sources */,
 				93309DF7099E64920056E581 /* markup.cpp in Sources */,
@@ -22591,6 +22911,7 @@
 				E10B9B6D0B747599003ED890 /* NativeXPathNSResolver.cpp in Sources */,
 				8AF4E55511DC5A36000ED3DE /* Navigation.cpp in Sources */,
 				93CCF0600AF6CA7600018E89 /* NavigationAction.cpp in Sources */,
+				979F43D31075E44A0000F83B /* NavigationScheduler.cpp in Sources */,
 				A9C6E5A50D746458006442E9 /* Navigator.cpp in Sources */,
 				E12719CA0EEEC21300F61213 /* NavigatorBase.cpp in Sources */,
 				5D874F130D161D3200796C3B /* NetscapePlugInStreamLoader.cpp in Sources */,
@@ -22663,12 +22984,13 @@
 				E44613EB0CD681B400FADA75 /* ProgressEvent.cpp in Sources */,
 				1A2A68230B5BEDE70002A480 /* ProgressTracker.cpp in Sources */,
 				514C76740CE923A1007EF3CD /* ProtectionSpace.cpp in Sources */,
+				1AF8E13312565A4400230FF7 /* ProxyServer.cpp in Sources */,
+				1AF8E1C3125673E000230FF7 /* ProxyServerCFNet.cpp in Sources */,
 				E4D687770ED7AE3D006EA978 /* PurgeableBufferMac.cpp in Sources */,
 				550A0BC9085F6039007353D6 /* QualifiedName.cpp in Sources */,
 				F55B3DCB1251F12D003EF269 /* RadioInputType.cpp in Sources */,
 				93F19AB908245E59001E9ABC /* Range.cpp in Sources */,
 				F55B3DCD1251F12D003EF269 /* RangeInputType.cpp in Sources */,
-				979F43D31075E44A0000F83B /* RedirectScheduler.cpp in Sources */,
 				85031B4B0A44EFC700F992E0 /* RegisteredEventListener.cpp in Sources */,
 				B2C3DA2C0D006C1D00EF6F26 /* RegularExpression.cpp in Sources */,
 				93309E00099E64920056E581 /* RemoveCSSPropertyCommand.cpp in Sources */,
@@ -22725,7 +23047,6 @@
 				BCEA487F097D93020094C9E4 /* RenderObject.cpp in Sources */,
 				BC60EFB70F33A0E700812A93 /* RenderObjectChildList.cpp in Sources */,
 				A871DED00A1530C700B12A68 /* RenderPart.cpp in Sources */,
-				853CA9F00AEEC657002372DC /* RenderPath.cpp in Sources */,
 				A43BF59C1149292800C643CA /* RenderProgress.cpp in Sources */,
 				A871DFE20A15376B00B12A68 /* RenderReplaced.cpp in Sources */,
 				BCA846D60DC67A350026C309 /* RenderReplica.cpp in Sources */,
@@ -22743,9 +23064,10 @@
 				A809F1480B73793B002E4D7F /* RenderSVGGradientStop.cpp in Sources */,
 				A809F1AB0B737FB6002E4D7F /* RenderSVGHiddenContainer.cpp in Sources */,
 				853CA9D80AEEC5E9002372DC /* RenderSVGImage.cpp in Sources */,
-				853CA9DA0AEEC5E9002372DC /* RenderSVGInline.cpp in Sources */,
-				853CA9DC0AEEC5E9002372DC /* RenderSVGInlineText.cpp in Sources */,
+				0854B0141255E4E600B9CDD0 /* RenderSVGInline.cpp in Sources */,
+				0854B0161255E4E600B9CDD0 /* RenderSVGInlineText.cpp in Sources */,
 				A8F5C0B90F9285AC0098E06B /* RenderSVGModelObject.cpp in Sources */,
+				ADDF1AD61257CD9A0003A759 /* RenderSVGPath.cpp in Sources */,
 				08563BD0117865F50012B578 /* RenderSVGResource.cpp in Sources */,
 				84BDA16B11358D2A00DBF64C /* RenderSVGResourceClipper.cpp in Sources */,
 				086A400611F6D6B7002CEC53 /* RenderSVGResourceContainer.cpp in Sources */,
@@ -22760,10 +23082,10 @@
 				08C6A7AB117DFBAB00FEA1A2 /* RenderSVGResourceSolidColor.cpp in Sources */,
 				AA31B5B40C1DFD1000AE7083 /* RenderSVGRoot.cpp in Sources */,
 				08DAB9BA1103D9A5003E7ABA /* RenderSVGShadowTreeRootContainer.cpp in Sources */,
-				853CA9DE0AEEC5E9002372DC /* RenderSVGText.cpp in Sources */,
-				B26554EA0B80D74900A50EC3 /* RenderSVGTextPath.cpp in Sources */,
+				0854B0181255E4E600B9CDD0 /* RenderSVGText.cpp in Sources */,
+				0854B01A1255E4E600B9CDD0 /* RenderSVGTextPath.cpp in Sources */,
 				A8A909AD0CBCD6B50029B807 /* RenderSVGTransformableContainer.cpp in Sources */,
-				853CA9E00AEEC5E9002372DC /* RenderSVGTSpan.cpp in Sources */,
+				0854B01C1255E4E600B9CDD0 /* RenderSVGTSpan.cpp in Sources */,
 				B2CCEC470C6CA9F1006A5424 /* RenderSVGViewportContainer.cpp in Sources */,
 				A8DF4AEC0980C42C0052981B /* RenderTable.cpp in Sources */,
 				A8DF4AEA0980C42C0052981B /* RenderTableCell.cpp in Sources */,
@@ -22853,6 +23175,7 @@
 				A75E497710752ACB00C9B896 /* SerializedScriptValue.cpp in Sources */,
 				93309E0F099E64920056E581 /* SetNodeAttributeCommand.cpp in Sources */,
 				14C9A5EA0B3D105F005A0232 /* Settings.cpp in Sources */,
+				498770E81242C535002226BA /* Shader.cpp in Sources */,
 				BC5EB8C30E82031B00B25965 /* ShadowData.cpp in Sources */,
 				A7F338A311C0EFCA00A320A7 /* ShadowElement.cpp in Sources */,
 				A80E6CF40A1989CA007FB8C5 /* ShadowValue.cpp in Sources */,
@@ -22860,6 +23183,7 @@
 				1A4A954D0B4EDCCB002D8C3C /* SharedBuffer.cpp in Sources */,
 				512DD8E30D91E2B4000F89EE /* SharedBufferCF.cpp in Sources */,
 				1A4A95520B4EDCFF002D8C3C /* SharedBufferMac.mm in Sources */,
+				498770EA1242C535002226BA /* SharedGraphicsContext3D.cpp in Sources */,
 				93309EA2099EB78C0056E581 /* SharedTimerMac.mm in Sources */,
 				41E1B1D30FF5986900576B3B /* SharedWorker.cpp in Sources */,
 				41D168E710226E89009BC827 /* SharedWorkerContext.cpp in Sources */,
@@ -22877,6 +23201,7 @@
 				510D4A33103165EE0049EA54 /* SocketStreamErrorBase.cpp in Sources */,
 				510D4A36103165EE0049EA54 /* SocketStreamHandleBase.cpp in Sources */,
 				51ABAE1F103C1913008C5260 /* SocketStreamHandleCFNet.cpp in Sources */,
+				498770EC1242C535002226BA /* SolidFillShader.cpp in Sources */,
 				4B3043C90AE0371D00A82647 /* SoundMac.mm in Sources */,
 				84A81F3D0FC7DFF000955300 /* SourceAlpha.cpp in Sources */,
 				84A81F410FC7E02700955300 /* SourceGraphic.cpp in Sources */,
@@ -22915,7 +23240,6 @@
 				C55E38C010040D5D00A56BDB /* StorageNamespaceImpl.cpp in Sources */,
 				C5102D950FD9AA2D00FAFF04 /* StorageSyncManager.cpp in Sources */,
 				B2C3DA300D006C1D00EF6F26 /* String.cpp in Sources */,
-				E1A302C10DE8376900C52F2C /* StringBuilder.cpp in Sources */,
 				B2B2645C0D00A77E000ACC1D /* StringCF.cpp in Sources */,
 				B2B2645D0D00A77E000ACC1D /* StringImplCF.cpp in Sources */,
 				B2AFFC950D00A5DF0030074D /* StringImplMac.mm in Sources */,
@@ -22956,8 +23280,6 @@
 				B22279920D00BF220071B782 /* SVGAnimateMotionElement.cpp in Sources */,
 				B22279940D00BF220071B782 /* SVGAnimateTransformElement.cpp in Sources */,
 				B22279970D00BF220071B782 /* SVGAnimationElement.cpp in Sources */,
-				0842BC721190144000C7D08F /* SVGCharacterData.cpp in Sources */,
-				B2B33A5F0B887CEF00C15984 /* SVGCharacterLayoutInfo.cpp in Sources */,
 				B222799B0D00BF220071B782 /* SVGCircleElement.cpp in Sources */,
 				B222799E0D00BF220071B782 /* SVGClipPathElement.cpp in Sources */,
 				B22279A10D00BF220071B782 /* SVGColor.cpp in Sources */,
@@ -23024,8 +23346,8 @@
 				08C46B691212F15E0011AF40 /* SVGImageBufferTools.cpp in Sources */,
 				B2227A2C0D00BF220071B782 /* SVGImageElement.cpp in Sources */,
 				B28C6A290D00C44800334AA4 /* SVGImageLoader.cpp in Sources */,
-				853CA9E60AEEC608002372DC /* SVGInlineFlowBox.cpp in Sources */,
-				AA0972CC0B6947A800A705E9 /* SVGInlineTextBox.cpp in Sources */,
+				0854B01E1255E4E600B9CDD0 /* SVGInlineFlowBox.cpp in Sources */,
+				0854B0201255E4E600B9CDD0 /* SVGInlineTextBox.cpp in Sources */,
 				B2227A2F0D00BF220071B782 /* SVGLangSpace.cpp in Sources */,
 				B2227A320D00BF220071B782 /* SVGLength.cpp in Sources */,
 				B2227A350D00BF220071B782 /* SVGLengthList.cpp in Sources */,
@@ -23081,7 +23403,7 @@
 				084D0E3C11F5816100081E1A /* SVGResources.cpp in Sources */,
 				084D0E3E11F5816100081E1A /* SVGResourcesCache.cpp in Sources */,
 				085B05C211FAE16C004D65F6 /* SVGResourcesCycleSolver.cpp in Sources */,
-				853CA9E80AEEC608002372DC /* SVGRootInlineBox.cpp in Sources */,
+				0854B0221255E4E600B9CDD0 /* SVGRootInlineBox.cpp in Sources */,
 				B2227AA20D00BF220071B782 /* SVGScriptElement.cpp in Sources */,
 				B2227AA50D00BF220071B782 /* SVGSetElement.cpp in Sources */,
 				08DAB9C21103D9C1003E7ABA /* SVGShadowTreeElements.cpp in Sources */,
@@ -23097,15 +23419,19 @@
 				B2227ABD0D00BF220071B782 /* SVGSwitchElement.cpp in Sources */,
 				B2227AC00D00BF220071B782 /* SVGSymbolElement.cpp in Sources */,
 				B2227AC40D00BF220071B782 /* SVGTests.cpp in Sources */,
-				0853D73211C9109000B2FD42 /* SVGTextChunkLayoutInfo.cpp in Sources */,
+				08F0BFC21255C53C00075185 /* SVGTextChunk.cpp in Sources */,
+				081668D3125603BF006F25DE /* SVGTextChunkBuilder.cpp in Sources */,
 				B2227AC70D00BF220071B782 /* SVGTextContentElement.cpp in Sources */,
 				B2227ACA0D00BF220071B782 /* SVGTextElement.cpp in Sources */,
 				088C2F7912390081003D65CE /* SVGTextLayoutAttributes.cpp in Sources */,
-				088C2F7B12390081003D65CE /* SVGTextLayoutBuilder.cpp in Sources */,
-				083F529911957FBE00653EBE /* SVGTextLayoutUtilities.cpp in Sources */,
+				081093DB1255F0E700ED9D29 /* SVGTextLayoutAttributesBuilder.cpp in Sources */,
+				081668D9125603D5006F25DE /* SVGTextLayoutEngine.cpp in Sources */,
+				080E49251255F3BD00EFCA27 /* SVGTextLayoutEngineBaseline.cpp in Sources */,
+				080E49271255F3BD00EFCA27 /* SVGTextLayoutEngineSpacing.cpp in Sources */,
+				08F0BFC51255C53C00075185 /* SVGTextMetrics.cpp in Sources */,
 				B2227ACD0D00BF220071B782 /* SVGTextPathElement.cpp in Sources */,
 				B2227AD00D00BF220071B782 /* SVGTextPositioningElement.cpp in Sources */,
-				0853D73311C9109000B2FD42 /* SVGTextQuery.cpp in Sources */,
+				0854B0241255E4E600B9CDD0 /* SVGTextQuery.cpp in Sources */,
 				B2227AD30D00BF220071B782 /* SVGTitleElement.cpp in Sources */,
 				B2227AD60D00BF220071B782 /* SVGTransform.cpp in Sources */,
 				B2227AD90D00BF220071B782 /* SVGTransformable.cpp in Sources */,
@@ -23123,6 +23449,7 @@
 				6582A16309999D6D00BEEB6D /* SystemTimeMac.cpp in Sources */,
 				BCE3BEC20D222B1D007E06E4 /* TagNodeList.cpp in Sources */,
 				F55B3DD51251F12D003EF269 /* TelephoneInputType.cpp in Sources */,
+				498770EE1242C535002226BA /* TexShader.cpp in Sources */,
 				6550B6A5099DF0270090D781 /* Text.cpp in Sources */,
 				B2AFFC970D00A5DF0030074D /* TextBoundaries.mm in Sources */,
 				B2C3DA370D006C1D00EF6F26 /* TextBreakIteratorICU.cpp in Sources */,
@@ -23145,6 +23472,7 @@
 				93309E1B099E64920056E581 /* TextIterator.cpp in Sources */,
 				93F19A9D08245E59001E9ABC /* TextResourceDecoder.cpp in Sources */,
 				B2C3DA4A0D006C1D00EF6F26 /* TextStream.cpp in Sources */,
+				498770F01242C535002226BA /* Texture.cpp in Sources */,
 				97BC84A412370DC8000C6161 /* TextViewSourceParser.cpp in Sources */,
 				BCE65D320EAD1211007E4533 /* Theme.cpp in Sources */,
 				BCE659E90EA92FFA007E4533 /* ThemeMac.mm in Sources */,
@@ -23154,6 +23482,7 @@
 				51DF6D800B92A18E00C2DC85 /* ThreadCheck.mm in Sources */,
 				E1FF57A60F01256B00891EBB /* ThreadGlobalData.cpp in Sources */,
 				185BCF280F3279CE000EA262 /* ThreadTimers.cpp in Sources */,
+				498770F21242C535002226BA /* TilingData.cpp in Sources */,
 				F55B3DDB1251F12D003EF269 /* TimeInputType.cpp in Sources */,
 				7553CFE9108F473F00EA281E /* TimelineRecordFactory.cpp in Sources */,
 				93309EA4099EB78C0056E581 /* Timer.cpp in Sources */,
@@ -23311,6 +23640,10 @@
 				93F19B0508245E59001E9ABC /* XSLTProcessorLibxslt.cpp in Sources */,
 				E1BE512D0CF6C512002EA959 /* XSLTUnicodeSort.cpp in Sources */,
 				97DD4D860FDF4D6E00ECF9A4 /* XSSAuditor.cpp in Sources */,
+				4FA3B90A125CD12200300BAD /* InspectorState.cpp in Sources */,
+				9728C3131268E4390041E89B /* MarkupAccumulator.cpp in Sources */,
+				E18772F1126E2629003DD586 /* Language.cpp in Sources */,
+				7A1F2B52126C61B20006A7E6 /* InspectorClient.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
diff --git a/WebCore/accessibility/AccessibilityARIAGrid.cpp b/WebCore/accessibility/AccessibilityARIAGrid.cpp
index 58b3fa1..0d9f845 100644
--- a/WebCore/accessibility/AccessibilityARIAGrid.cpp
+++ b/WebCore/accessibility/AccessibilityARIAGrid.cpp
@@ -118,11 +118,12 @@ void AccessibilityARIAGrid::addChildren()
         column->setColumnIndex((int)i);
         column->setParentTable(this);
         m_columns.append(column);
-        m_children.append(column);
+        if (!column->accessibilityIsIgnored())
+            m_children.append(column);
     }
     
     AccessibilityObject* headerContainerObject = headerContainer();
-    if (headerContainerObject)
+    if (headerContainerObject && !headerContainerObject->accessibilityIsIgnored())
         m_children.append(headerContainerObject);
 }
     
diff --git a/WebCore/accessibility/AccessibilityObject.h b/WebCore/accessibility/AccessibilityObject.h
index e8f6d1b..bcf09d2 100644
--- a/WebCore/accessibility/AccessibilityObject.h
+++ b/WebCore/accessibility/AccessibilityObject.h
@@ -536,6 +536,9 @@ public:
     
     bool supportsARIAAttributes() const;
     
+    // CSS3 Speech properties.
+    virtual ESpeak speakProperty() const { return SpeakNormal; }
+    
 #if HAVE(ACCESSIBILITY)
 #if PLATFORM(GTK)
     AccessibilityObjectWrapper* wrapper() const;
diff --git a/WebCore/accessibility/AccessibilityRenderObject.cpp b/WebCore/accessibility/AccessibilityRenderObject.cpp
index 5ca78ca..0b82c67 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.cpp
+++ b/WebCore/accessibility/AccessibilityRenderObject.cpp
@@ -1487,6 +1487,14 @@ AccessibilityObject* AccessibilityRenderObject::internalLinkElement() const
     return firstAccessibleObjectFromNode(linkedNode);
 }
 
+ESpeak AccessibilityRenderObject::speakProperty() const
+{
+    if (!m_renderer)
+        return AccessibilityObject::speakProperty();
+    
+    return m_renderer->style()->speak();
+}
+    
 void AccessibilityRenderObject::addRadioButtonGroupMembers(AccessibilityChildrenVector& linkedUIElements) const
 {
     if (!m_renderer || roleValue() != RadioButtonRole)
@@ -2638,20 +2646,11 @@ PlainTextRange AccessibilityRenderObject::doAXRangeForLine(unsigned lineNumber)
         if (visiblePos.isNull() || visiblePos == savedVisiblePos)
             return PlainTextRange();
     }
-    
-    // make a caret selection for the marker position, then extend it to the line
-    // NOTE: ignores results of selection.modify because it returns false when
-    // starting at an empty line.  The resulting selection in that case
-    // will be a caret at visiblePos.
-    SelectionController selection;
-    selection.setSelection(VisibleSelection(visiblePos));
-    selection.modify(SelectionController::AlterationExtend, SelectionController::DirectionLeft, LineBoundary);
-    selection.modify(SelectionController::AlterationExtend, SelectionController::DirectionRight, LineBoundary);
-    
-    // calculate the indices for the selection start and end
-    VisiblePosition startPosition = selection.selection().visibleStart();
-    VisiblePosition endPosition = selection.selection().visibleEnd();
-    int index1 = indexForVisiblePosition(startPosition);
+
+    // Get the end of the line based on the starting position.
+    VisiblePosition endPosition = endOfLine(visiblePos);
+
+    int index1 = indexForVisiblePosition(visiblePos);
     int index2 = indexForVisiblePosition(endPosition);
     
     // add one to the end index for a line break not caused by soft line wrap (to match AppKit)
@@ -3089,6 +3088,10 @@ AccessibilityRole AccessibilityRenderObject::determineAccessibilityRole()
     if (m_renderer->isBlockFlow() || (node && node->hasTagName(labelTag)))
         return GroupRole;
     
+    // If the element does not have role, but it has ARIA attributes, accessibility should fallback to exposing it as a group.
+    if (supportsARIAAttributes())
+        return GroupRole;
+    
     return UnknownRole;
 }
 
@@ -3388,6 +3391,7 @@ const AtomicString& AccessibilityRenderObject::ariaLiveRegionStatus() const
         case ApplicationStatusRole:
             return liveRegionStatusPolite;
         case ApplicationTimerRole:
+        case ApplicationMarqueeRole:
             return liveRegionStatusOff;
         default:
             break;
diff --git a/WebCore/accessibility/AccessibilityRenderObject.h b/WebCore/accessibility/AccessibilityRenderObject.h
index b7b85fe..c62e98d 100644
--- a/WebCore/accessibility/AccessibilityRenderObject.h
+++ b/WebCore/accessibility/AccessibilityRenderObject.h
@@ -301,6 +301,8 @@ private:
     String accessibilityDescriptionForElements(Vector<Element*> &elements) const;
     void elementsFromAttribute(Vector<Element*>& elements, const QualifiedName& name) const;
     
+    virtual ESpeak speakProperty() const;
+    
     virtual const AtomicString& ariaLiveRegionStatus() const;
     virtual const AtomicString& ariaLiveRegionRelevant() const;
     virtual bool ariaLiveRegionAtomic() const;
diff --git a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
index 3575afe..aa88217 100644
--- a/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
+++ b/WebCore/accessibility/gtk/AccessibilityObjectWrapperAtk.cpp
@@ -1032,12 +1032,22 @@ static gint webkit_accessible_text_get_caret_offset(AtkText* text)
 
     int offset;
     // Don't ignore links if the offset is being requested for a link.
-    objectAndOffsetUnignored(focusedObject, offset, !coreObject->isLink());
+    if (!objectAndOffsetUnignored(focusedObject, offset, !coreObject->isLink()))
+        return 0;
 
     // TODO: Verify this for RTL text.
     return offset;
 }
 
+static int baselinePositionForAccessibilityRenderObject(RenderObject* renderObject)
+{
+    // FIXME: This implementation of baselinePosition originates from RenderObject.cpp and was
+    // removed in r70072. The implementation looks incorrect though, because this is not the
+    // baseline of the underlying RenderObject, but of the AccessibilityRenderObject.
+    const Font& f = renderObject->firstLineStyle()->font();
+    return f.ascent() + (renderObject->firstLineStyle()->computedLineHeight() - f.height()) / 2;
+}
+
 static AtkAttributeSet* getAttributeSetForAccessibilityObject(const AccessibilityObject* object)
 {
     if (!object->isAccessibilityRenderObject())
@@ -1068,10 +1078,10 @@ static AtkAttributeSet* getAttributeSetForAccessibilityObject(const Accessibilit
     bool includeRise = true;
     switch (style->verticalAlign()) {
     case SUB:
-        baselinePosition = -1 * renderer->baselinePosition(true);
+        baselinePosition = -1 * baselinePositionForAccessibilityRenderObject(renderer);
         break;
     case SUPER:
-        baselinePosition = renderer->baselinePosition(true);
+        baselinePosition = baselinePositionForAccessibilityRenderObject(renderer);
         break;
     case BASELINE:
         baselinePosition = 0;
@@ -2179,9 +2189,13 @@ AccessibilityObject* objectAndOffsetUnignored(AccessibilityObject* coreObject, i
     AccessibilityObject* realObject = coreObject;
     if (realObject->accessibilityIsIgnored())
         realObject = realObject->parentObjectUnignored();
+    if (!realObject)
+        return 0;
 
     if (ignoreLinks && realObject->isLink())
         realObject = realObject->parentObjectUnignored();
+    if (!realObject)
+        return 0;
 
     Node* node = static_cast<AccessibilityRenderObject*>(realObject)->renderer()->node();
     if (node) {
diff --git a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
index cb983eb..e4b7d8e 100644
--- a/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
+++ b/WebCore/accessibility/mac/AccessibilityObjectWrapper.mm
@@ -1908,6 +1908,26 @@ static NSString* roleValueToNSString(AccessibilityRole value)
     if ([attributeName isEqualToString:@"AXClickPoint"])
         return [NSValue valueWithPoint:m_object->clickPoint()];
     
+    // This is used by DRT to verify CSS3 speech works.
+    if ([attributeName isEqualToString:@"AXDRTSpeechAttribute"]) {
+        ESpeak speakProperty = m_object->speakProperty();
+        switch (speakProperty) {
+        case SpeakNone:
+            return @"none";
+        case SpeakSpellOut:
+            return @"spell-out";
+        case SpeakDigits:
+            return @"digits";
+        case SpeakLiteralPunctuation:
+            return @"literal-punctuation";
+        case SpeakNoPunctuation:
+            return @"no-punctuation";
+        default:
+        case SpeakNormal:
+            return @"normal";
+        }
+    }
+    
     return nil;
 }
 
diff --git a/WebCore/bindings/ScriptControllerBase.cpp b/WebCore/bindings/ScriptControllerBase.cpp
index 01911d8..a77ff9c 100644
--- a/WebCore/bindings/ScriptControllerBase.cpp
+++ b/WebCore/bindings/ScriptControllerBase.cpp
@@ -46,7 +46,7 @@ bool ScriptController::canExecuteScripts(ReasonForCallingCanExecuteScripts reaso
 
 ScriptValue ScriptController::executeScript(const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)
 {
-    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url()), shouldAllowXSS);
+    return executeScript(ScriptSourceCode(script, forceUserGesture ? KURL() : m_frame->document()->url()), shouldAllowXSS);
 }
 
 ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode, ShouldAllowXSS shouldAllowXSS)
@@ -67,7 +67,7 @@ ScriptValue ScriptController::executeScript(const ScriptSourceCode& sourceCode,
     return result;
 }
 
-bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)
+bool ScriptController::executeIfJavaScriptURL(const KURL& url, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)
 {
     if (!protocolIsJavaScript(url))
         return false;
@@ -90,7 +90,7 @@ bool ScriptController::executeIfJavaScriptURL(const KURL& url, bool userGesture,
     String decodedURL = decodeURLEscapeSequences(url.string());
     ScriptValue result;
     if (xssAuditor()->canEvaluateJavaScriptURL(decodedURL))
-        result = executeScript(decodedURL.substring(javascriptSchemeLength), userGesture, AllowXSS);
+        result = executeScript(decodedURL.substring(javascriptSchemeLength), processingUserGesture(), AllowXSS);
 
     // If executing script caused this frame to be removed from the page, we
     // don't want to try to replace its document!
diff --git a/WebCore/bindings/generic/BindingDOMWindow.h b/WebCore/bindings/generic/BindingDOMWindow.h
index 96b8b9d..3568e6c 100644
--- a/WebCore/bindings/generic/BindingDOMWindow.h
+++ b/WebCore/bindings/generic/BindingDOMWindow.h
@@ -119,12 +119,10 @@ Frame* BindingDOMWindow<Binding>::createWindow(State<Binding>* state,
     if (!protocolIsJavaScript(url) || BindingSecurity<Binding>::canAccessFrame(state, newFrame, true)) {
         KURL completedUrl =
             url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(state, url);
-        bool userGesture = state->processingUserGesture();
-
         if (created)
-            newFrame->loader()->changeLocation(completedUrl, referrer, false, false, userGesture);
+            newFrame->loader()->changeLocation(completedUrl, referrer, false, false);
         else if (!url.isEmpty())
-            newFrame->redirectScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, false, userGesture);
+            newFrame->navigationScheduler()->scheduleLocationChange(completedUrl.string(), referrer, false, false);
     }
 
     return newFrame;
@@ -187,13 +185,11 @@ WebCore::DOMWindow* BindingDOMWindow<Binding>::open(State<Binding>* state,
         if (!completedUrl.isEmpty()
             && (!protocolIsJavaScript(completedUrl)
                 || BindingSecurity<Binding>::canAccessFrame(state, frame, true))) {
-            bool userGesture = state->processingUserGesture();
-
             // For whatever reason, Firefox uses the first frame to determine
             // the outgoingReferrer.  We replicate that behavior here.
             String referrer = firstFrame->loader()->outgoingReferrer();
 
-            frame->redirectScheduler()->scheduleLocationChange(completedUrl, referrer, false, false, userGesture);
+            frame->navigationScheduler()->scheduleLocationChange(completedUrl, referrer, false, false);
         }
         return frame->domWindow();
     }
diff --git a/WebCore/bindings/generic/BindingFrame.h b/WebCore/bindings/generic/BindingFrame.h
index f1fdc79..d41206c 100644
--- a/WebCore/bindings/generic/BindingFrame.h
+++ b/WebCore/bindings/generic/BindingFrame.h
@@ -49,7 +49,7 @@ void BindingFrame<Binding>::navigateIfAllowed(State<Binding>* state, Frame* fram
     if (!activeFrame)
         return;
     if (!protocolIsJavaScript(url) || state->allowsAccessFromFrame(frame))
-        frame->redirectScheduler()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, state->processingUserGesture());
+        frame->navigationScheduler()->scheduleLocationChange(url.string(), activeFrame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList);
 }
 
 } // namespace WebCore
diff --git a/WebCore/bindings/generic/BindingSecurity.h b/WebCore/bindings/generic/BindingSecurity.h
index 1124f7e..1ce556c 100644
--- a/WebCore/bindings/generic/BindingSecurity.h
+++ b/WebCore/bindings/generic/BindingSecurity.h
@@ -32,12 +32,12 @@
 #define BindingSecurity_h
 
 #include "BindingSecurityBase.h"
-#include "CSSHelper.h"
 #include "Element.h"
 #include "Frame.h"
 #include "GenericBinding.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "Settings.h"
 
 namespace WebCore {
@@ -128,7 +128,7 @@ bool BindingSecurity<Binding>::allowPopUp(State<Binding>* state)
 template <class Binding>
 bool BindingSecurity<Binding>::allowSettingFrameSrcToJavascriptUrl(State<Binding>* state, HTMLFrameElementBase* frame, String value)
 {
-    if (protocolIsJavaScript(deprecatedParseURL(value))) {
+    if (protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value))) {
         Node* contentDoc = frame->contentDocument();
         if (contentDoc && !checkNodeSecurity(state, contentDoc))
             return false;
diff --git a/WebCore/bindings/generic/RuntimeEnabledFeatures.h b/WebCore/bindings/generic/RuntimeEnabledFeatures.h
index 88350c7..1054f64 100644
--- a/WebCore/bindings/generic/RuntimeEnabledFeatures.h
+++ b/WebCore/bindings/generic/RuntimeEnabledFeatures.h
@@ -54,21 +54,21 @@ public:
     static void setGeolocationEnabled(bool isEnabled) { isGeolocationEnabled = isEnabled; }
     static bool geolocationEnabled() { return isGeolocationEnabled; }
 
-    static void setIndexedDBEnabled(bool isEnabled) { isIndexedDBEnabled = isEnabled; }
-    static bool indexedDBEnabled() { return isIndexedDBEnabled; }
-    static bool iDBCursorEnabled() { return isIndexedDBEnabled; }
-    static bool iDBDatabaseEnabled() { return isIndexedDBEnabled; }
-    static bool iDBDatabaseErrorEnabled() { return isIndexedDBEnabled; }
-    static bool iDBDatabaseExceptionEnabled() { return isIndexedDBEnabled; }
-    static bool iDBErrorEventEnabled() { return isIndexedDBEnabled; }
-    static bool iDBEventEnabled() { return isIndexedDBEnabled; }
-    static bool iDBFactoryEnabled() { return isIndexedDBEnabled; }
-    static bool iDBIndexEnabled() { return isIndexedDBEnabled; }
-    static bool iDBKeyRangeEnabled() { return isIndexedDBEnabled; }
-    static bool iDBObjectStoreEnabled() { return isIndexedDBEnabled; }
-    static bool iDBRequestEnabled() { return isIndexedDBEnabled; }
-    static bool iDBSuccessEventEnabled() { return isIndexedDBEnabled; }
-    static bool iDBTransactionEnabled() { return isIndexedDBEnabled; }
+    static void setWebkitIndexedDBEnabled(bool isEnabled) { isIndexedDBEnabled = isEnabled; }
+    static bool webkitIndexedDBEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBCursorEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBDatabaseEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBDatabaseErrorEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBDatabaseExceptionEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBErrorEventEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBEventEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBFactoryEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBIndexEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBKeyRangeEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBObjectStoreEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBRequestEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBSuccessEventEnabled() { return isIndexedDBEnabled; }
+    static bool webkitIDBTransactionEnabled() { return isIndexedDBEnabled; }
 
 #if ENABLE(VIDEO)
     static bool audioEnabled();
@@ -138,7 +138,7 @@ public:
 
     static void setSpeechInputEnabled(bool isEnabled) { isSpeechInputEnabled = isEnabled; }
     static bool speechInputEnabled() { return isSpeechInputEnabled; }
-    static bool webkitspeechEnabled() { return isSpeechInputEnabled; }
+    static bool webkitSpeechEnabled() { return isSpeechInputEnabled; }
 
 #if ENABLE(XHR_RESPONSE_BLOB)
     static bool xhrResponseBlobEnabled() { return isXHRResponseBlobEnabled; }
@@ -150,7 +150,6 @@ public:
 #if ENABLE(FILE_SYSTEM)
     static bool fileSystemEnabled();
     static void setFileSystemEnabled(bool isEnabled) { isFileSystemEnabled = isEnabled; }
-    static bool requestFileSystemEnabled() { return isFileSystemEnabled; }
 #endif
 
 private:
diff --git a/WebCore/bindings/js/JSArrayBufferCustom.cpp b/WebCore/bindings/js/JSArrayBufferCustom.cpp
index 3555a60..68edc5c 100644
--- a/WebCore/bindings/js/JSArrayBufferCustom.cpp
+++ b/WebCore/bindings/js/JSArrayBufferCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBuffer.h"
 
@@ -54,4 +54,4 @@ EncodedJSValue JSC_HOST_CALL JSArrayBufferConstructor::constructJSArrayBuffer(Ex
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSArrayBufferViewCustom.cpp b/WebCore/bindings/js/JSArrayBufferViewCustom.cpp
index 1fb6b49..ccbddd2 100644
--- a/WebCore/bindings/js/JSArrayBufferViewCustom.cpp
+++ b/WebCore/bindings/js/JSArrayBufferViewCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "config.h"
 #include "JSArrayBufferView.h"
@@ -90,4 +90,4 @@ JSValue JSArrayBufferView::slice(ExecState* exec)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSAttrCustom.cpp b/WebCore/bindings/js/JSAttrCustom.cpp
index 998ecad..227582d 100644
--- a/WebCore/bindings/js/JSAttrCustom.cpp
+++ b/WebCore/bindings/js/JSAttrCustom.cpp
@@ -29,7 +29,6 @@
 #include "config.h"
 #include "JSAttr.h"
 
-#include "CSSHelper.h"
 #include "Document.h"
 #include "Element.h"
 #include "HTMLNames.h"
diff --git a/WebCore/bindings/js/JSConsoleCustom.cpp b/WebCore/bindings/js/JSConsoleCustom.cpp
index 3ad34a3..f0419c7 100644
--- a/WebCore/bindings/js/JSConsoleCustom.cpp
+++ b/WebCore/bindings/js/JSConsoleCustom.cpp
@@ -29,7 +29,6 @@
 
 #include "Console.h"
 #include "JSScriptProfile.h"
-#include "ScriptCallStack.h"
 #include "ScriptProfile.h"
 #include <runtime/JSArray.h>
 
diff --git a/WebCore/bindings/js/JSDOMBinding.cpp b/WebCore/bindings/js/JSDOMBinding.cpp
index 74c8131..72e6d03 100644
--- a/WebCore/bindings/js/JSDOMBinding.cpp
+++ b/WebCore/bindings/js/JSDOMBinding.cpp
@@ -24,7 +24,6 @@
 #include "debugger/DebuggerCallFrame.h"
 
 #include "ActiveDOMObject.h"
-#include "CSSHelper.h"
 #include "DOMCoreException.h"
 #include "DOMObjectHashTableMap.h"
 #include "Document.h"
@@ -453,6 +452,13 @@ JSValue jsStringOrNull(ExecState* exec, const String& s)
     return jsString(exec, s);
 }
 
+JSValue jsOwnedStringOrNull(ExecState* exec, const String& s)
+{
+    if (s.isNull())
+        return jsNull();
+    return jsOwnedString(exec, stringToUString(s));
+}
+
 JSValue jsOwnedStringOrNull(ExecState* exec, const UString& s)
 {
     if (s.isNull())
@@ -648,7 +654,7 @@ bool shouldAllowNavigation(ExecState* exec, Frame* frame)
 
 bool allowSettingSrcToJavascriptURL(ExecState* exec, Element* element, const String& name, const String& value)
 {
-    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(deprecatedParseURL(value))) {
+    if ((element->hasTagName(iframeTag) || element->hasTagName(frameTag)) && equalIgnoringCase(name, "src") && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value))) {
           Document* contentDocument = static_cast<HTMLFrameElementBase*>(element)->contentDocument();
           if (contentDocument && !checkNodeSecurity(exec, contentDocument))
               return false;
diff --git a/WebCore/bindings/js/JSDOMBinding.h b/WebCore/bindings/js/JSDOMBinding.h
index f0bd2e2..64a3dad 100644
--- a/WebCore/bindings/js/JSDOMBinding.h
+++ b/WebCore/bindings/js/JSDOMBinding.h
@@ -254,6 +254,7 @@ namespace WebCore {
 
     // See JavaScriptCore for explanation: Should be used for any UString that is already owned by another
     // object, to let the engine know that collecting the JSString wrapper is unlikely to save memory.
+    JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const String&); 
     JSC::JSValue jsOwnedStringOrNull(JSC::ExecState*, const JSC::UString&); 
 
     String identifierToString(const JSC::Identifier&);
diff --git a/WebCore/bindings/js/JSDOMFormDataCustom.cpp b/WebCore/bindings/js/JSDOMFormDataCustom.cpp
index f207578..2559e96 100644
--- a/WebCore/bindings/js/JSDOMFormDataCustom.cpp
+++ b/WebCore/bindings/js/JSDOMFormDataCustom.cpp
@@ -32,13 +32,31 @@
 #include "JSDOMFormData.h"
 
 #include "DOMFormData.h"
+#include "HTMLFormElement.h"
 #include "JSBlob.h"
+#include "JSHTMLFormElement.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
+static HTMLFormElement* toHTMLFormElement(JSC::JSValue value)
+{
+    return value.inherits(&JSHTMLFormElement::s_info) ? static_cast<HTMLFormElement*>(static_cast<JSHTMLFormElement*>(asObject(value))->impl()) : 0;
+}
+
+EncodedJSValue JSC_HOST_CALL JSDOMFormDataConstructor::constructJSDOMFormData(ExecState* exec)
+{
+    JSDOMFormDataConstructor* jsConstructor = static_cast<JSDOMFormDataConstructor*>(exec->callee());
+
+    HTMLFormElement* form = 0;
+    if (exec->argumentCount() > 0)
+        form = toHTMLFormElement(exec->argument(0));
+    RefPtr<DOMFormData> domFormData = DOMFormData::create(form);
+    return JSValue::encode(asObject(toJS(exec, jsConstructor->globalObject(), domFormData.get())));
+}
+
 JSValue JSDOMFormData::append(ExecState* exec)
 {
     if (exec->argumentCount() >= 2) {
diff --git a/WebCore/bindings/js/JSDOMWindowBase.cpp b/WebCore/bindings/js/JSDOMWindowBase.cpp
index 82ac1ce..e2b50d0 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.cpp
+++ b/WebCore/bindings/js/JSDOMWindowBase.cpp
@@ -37,7 +37,7 @@
 #include "Settings.h"
 #include "WebCoreJSClientData.h"
 #include <wtf/Threading.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 using namespace JSC;
 
@@ -83,8 +83,8 @@ String JSDOMWindowBase::crossDomainAccessErrorMessage(const JSGlobalObject* othe
         return String();
 
     // FIXME: this error message should contain more specifics of why the same origin check has failed.
-    return String::format("Unsafe JavaScript attempt to access frame with URL %s from frame with URL %s. Domains, protocols and ports must match.\n",
-        targetURL.string().utf8().data(), originURL.string().utf8().data());
+    return makeString("Unsafe JavaScript attempt to access frame with URL ", targetURL.string(),
+                      " from frame with URL ", originURL.string(), ". Domains, protocols and ports must match.\n");
 }
 
 void JSDOMWindowBase::printErrorMessage(const String& message) const
@@ -146,6 +146,11 @@ JSObject* JSDOMWindowBase::toThisObject(ExecState*) const
     return shell();
 }
 
+JSValue JSDOMWindowBase::toStrictThisObject(ExecState*) const
+{
+    return shell();
+}
+
 JSDOMWindowShell* JSDOMWindowBase::shell() const
 {
     return d()->shell;
diff --git a/WebCore/bindings/js/JSDOMWindowBase.h b/WebCore/bindings/js/JSDOMWindowBase.h
index f4f1ef9..cafca73 100644
--- a/WebCore/bindings/js/JSDOMWindowBase.h
+++ b/WebCore/bindings/js/JSDOMWindowBase.h
@@ -69,8 +69,9 @@ namespace WebCore {
 
         // Don't call this version of allowsAccessFrom -- it's a slightly incorrect implementation used only by WebScriptObject
         virtual bool allowsAccessFrom(const JSC::JSGlobalObject*) const;
-
+        
         virtual JSC::JSObject* toThisObject(JSC::ExecState*) const;
+        virtual JSC::JSValue toStrictThisObject(JSC::ExecState*) const;
         JSDOMWindowShell* shell() const;
 
         static JSC::JSGlobalData* commonJSGlobalData();
diff --git a/WebCore/bindings/js/JSDOMWindowCustom.cpp b/WebCore/bindings/js/JSDOMWindowCustom.cpp
index 2ad71f0..ecb37f3 100644
--- a/WebCore/bindings/js/JSDOMWindowCustom.cpp
+++ b/WebCore/bindings/js/JSDOMWindowCustom.cpp
@@ -51,7 +51,7 @@
 #include "JSSharedWorker.h"
 #endif
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 #include "JSArrayBuffer.h"
 #include "JSInt8Array.h"
 #include "JSUint8Array.h"
@@ -512,7 +512,7 @@ void JSDOMWindow::setLocation(ExecState* exec, JSValue value)
 
     if (!protocolIsJavaScript(url) || allowsAccessFrom(exec)) {
         // We want a new history item if this JS was called via a user gesture
-        frame->redirectScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, processingUserGesture());
+        frame->navigationScheduler()->scheduleLocationChange(url, lexicalFrame->loader()->outgoingReferrer(), !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false);
     }
 }
 
@@ -565,7 +565,7 @@ JSValue JSDOMWindow::webKitCSSMatrix(ExecState* exec) const
     return getDOMConstructor<JSWebKitCSSMatrixConstructor>(exec, this);
 }
  
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 JSValue JSDOMWindow::arrayBuffer(ExecState* exec) const
 {
     return getDOMConstructor<JSArrayBufferConstructor>(exec, this);
@@ -700,12 +700,10 @@ static Frame* createWindow(ExecState* exec, Frame* lexicalFrame, Frame* dynamicF
 
     if (!protocolIsJavaScript(url) || newWindow->allowsAccessFrom(exec)) {
         KURL completedURL = url.isEmpty() ? KURL(ParsedURLString, "") : completeURL(exec, url);
-        bool userGesture = processingUserGesture();
-
         if (created)
-            newFrame->loader()->changeLocation(completedURL, referrer, false, false, userGesture);
+            newFrame->loader()->changeLocation(completedURL, referrer, false, false);
         else if (!url.isEmpty())
-            newFrame->redirectScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            newFrame->navigationScheduler()->scheduleLocationChange(completedURL.string(), referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false);
     }
 
     return newFrame;
@@ -763,14 +761,12 @@ JSValue JSDOMWindow::open(ExecState* exec)
 
         const JSDOMWindow* targetedWindow = toJSDOMWindow(frame, currentWorld(exec));
         if (!completedURL.isEmpty() && (!protocolIsJavaScript(completedURL) || (targetedWindow && targetedWindow->allowsAccessFrom(exec)))) {
-            bool userGesture = processingUserGesture();
-
             // For whatever reason, Firefox uses the dynamicGlobalObject to
             // determine the outgoingReferrer.  We replicate that behavior
             // here.
             String referrer = dynamicFrame->loader()->outgoingReferrer();
 
-            frame->redirectScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+            frame->navigationScheduler()->scheduleLocationChange(completedURL, referrer, !lexicalFrame->script()->anyPageIsProcessingUserGesture(), false);
         }
         return toJS(exec, frame->domWindow());
     }
diff --git a/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp b/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp
new file mode 100644
index 0000000..ef14b79
--- /dev/null
+++ b/WebCore/bindings/js/JSDirectoryEntrySyncCustom.cpp
@@ -0,0 +1,101 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "JSDirectoryEntrySync.h"
+
+#include "JSDOMBinding.h"
+#include "JSEntryCallback.h"
+#include "JSErrorCallback.h"
+#include "JSFileEntrySync.h"
+#include "JSFlags.h"
+#include <wtf/Assertions.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+static PassRefPtr<Flags> getFlags(ExecState* exec, const JSValue& argument)
+{
+    if (argument.isNull() || argument.isUndefined() || !argument.isObject())
+        return 0;
+    if (argument.inherits(&JSFlags::s_info))
+        return toFlags(argument);
+
+    RefPtr<Flags> flags;
+    JSObject* object = argument.getObject();
+    flags = Flags::create();
+    JSValue jsCreate = object->get(exec, Identifier(exec, "create"));
+    flags->setCreate(jsCreate.toBoolean(exec));
+    JSValue jsExclusive = object->get(exec, Identifier(exec, "exclusive"));
+    flags->setExclusive(jsExclusive.toBoolean(exec));
+    return flags;
+}
+
+JSValue JSDirectoryEntrySync::getFile(ExecState* exec)
+{
+    DirectoryEntrySync* imp = static_cast<DirectoryEntrySync*>(impl());
+    const String& path = valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    RefPtr<Flags> flags = getFlags(exec, exec->argument(1));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    JSC::JSValue result = toJS(exec, this->globalObject(), WTF::getPtr(imp->getFile(path, flags, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+JSValue JSDirectoryEntrySync::getDirectory(ExecState* exec)
+{
+    DirectoryEntrySync* imp = static_cast<DirectoryEntrySync*>(impl());
+    const String& path = valueToStringWithUndefinedOrNullCheck(exec, exec->argument(0));
+    if (exec->hadException())
+        return jsUndefined();
+
+    RefPtr<Flags> flags = getFlags(exec, exec->argument(1));
+    if (exec->hadException())
+        return jsUndefined();
+
+    ExceptionCode ec = 0;
+    JSC::JSValue result = toJS(exec, this->globalObject(), WTF::getPtr(imp->getDirectory(path, flags, ec)));
+    setDOMException(exec, ec);
+    return result;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/bindings/js/JSDocumentCustom.cpp b/WebCore/bindings/js/JSDocumentCustom.cpp
index ec66cbd..8a107e9 100644
--- a/WebCore/bindings/js/JSDocumentCustom.cpp
+++ b/WebCore/bindings/js/JSDocumentCustom.cpp
@@ -88,8 +88,7 @@ void JSDocument::setLocation(ExecState* exec, JSValue value)
     if (activeFrame)
         str = activeFrame->document()->completeURL(str).string();
 
-    bool userGesture = ScriptController::processingUserGesture();
-    frame->redirectScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false, userGesture);
+    frame->navigationScheduler()->scheduleLocationChange(str, activeFrame->loader()->outgoingReferrer(), !activeFrame->script()->anyPageIsProcessingUserGesture(), false);
 }
 
 JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, Document* document)
diff --git a/WebCore/bindings/js/JSElementCustom.cpp b/WebCore/bindings/js/JSElementCustom.cpp
index f691620..3bfe110 100644
--- a/WebCore/bindings/js/JSElementCustom.cpp
+++ b/WebCore/bindings/js/JSElementCustom.cpp
@@ -30,7 +30,6 @@
 #include "config.h"
 #include "JSElement.h"
 
-#include "CSSHelper.h"
 #include "Document.h"
 #include "ExceptionCode.h"
 #include "HTMLFrameElementBase.h"
diff --git a/WebCore/bindings/js/JSEntrySyncCustom.cpp b/WebCore/bindings/js/JSEntrySyncCustom.cpp
new file mode 100644
index 0000000..22f96ad
--- /dev/null
+++ b/WebCore/bindings/js/JSEntrySyncCustom.cpp
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "JSEntrySync.h"
+
+#include "EntrySync.h"
+#include "JSDOMBinding.h"
+#include "JSDirectoryEntrySync.h"
+#include "JSFileEntrySync.h"
+#include <wtf/Assertions.h>
+
+using namespace JSC;
+
+namespace WebCore {
+
+JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, EntrySync* entry)
+{
+    if (!entry)
+        return jsNull();
+
+    if (entry->isFile())
+        return getDOMObjectWrapper<JSFileEntrySync>(exec, globalObject, static_cast<FileEntrySync*>(entry));
+
+    ASSERT(entry->isDirectory());
+    return getDOMObjectWrapper<JSDirectoryEntrySync>(exec, globalObject, static_cast<DirectoryEntrySync*>(entry));
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/bindings/js/JSFloat32ArrayCustom.cpp b/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
index 3be7458..671ee68 100644
--- a/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSFloat32ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSFloat32Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSFloat32ArrayConstructor::constructJSFloat32Array(
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
index 345cffe..5994167 100644
--- a/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLFrameElementCustom.cpp
@@ -29,10 +29,10 @@
 #include "config.h"
 #include "JSHTMLFrameElement.h"
 
-#include "CSSHelper.h"
 #include "Document.h"
 #include "HTMLFrameElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "JSDOMBinding.h"
 
 using namespace JSC;
@@ -43,7 +43,7 @@ using namespace HTMLNames;
 
 static inline bool allowSettingJavascriptURL(ExecState* exec, HTMLFrameElement* imp, const String& value)
 {
-    if (protocolIsJavaScript(deprecatedParseURL(value))) {
+    if (protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value))) {
         Document* contentDocument = imp->contentDocument();
         if (contentDocument && !checkNodeSecurity(exec, contentDocument))
             return false;
diff --git a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
index 23db266..412a096 100644
--- a/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
+++ b/WebCore/bindings/js/JSHTMLInputElementCustom.cpp
@@ -26,47 +26,13 @@
 #include "config.h"
 #include "JSHTMLInputElement.h"
 
-#include "Document.h"
 #include "HTMLInputElement.h"
-#include "Settings.h"
 #include <runtime/Error.h>
 
 using namespace JSC;
 
 namespace WebCore {
 
-static bool needsGmailQuirk(HTMLInputElement* input)
-{
-    Document* document = input->document();
-
-    const KURL& url = document->url();
-    if (url.host() != "mail.google.com")
-        return false;
-
-    // As with other site-specific quirks, allow website developers to turn this off.
-    // In theory, this allows website developers to check if their fixes are effective.
-    Settings* settings = document->settings();
-    if (!settings)
-        return false;
-    if (!settings->needsSiteSpecificQuirks())
-        return false;
-
-    return true;
-}
-
-JSValue JSHTMLInputElement::type(ExecState* exec) const
-{
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
-    const AtomicString& type = input->type();
-
-    DEFINE_STATIC_LOCAL(const AtomicString, url, ("url"));
-    DEFINE_STATIC_LOCAL(const AtomicString, text, ("text"));
-
-    if (type == url && needsGmailQuirk(input))
-        return jsString(exec, text);
-    return jsString(exec, type);
-}
-
 JSValue JSHTMLInputElement::selectionStart(ExecState* exec) const
 {
     HTMLInputElement* input = static_cast<HTMLInputElement*>(impl());
diff --git a/WebCore/bindings/js/JSIDBAnyCustom.cpp b/WebCore/bindings/js/JSIDBAnyCustom.cpp
index e428bf6..506f15f 100644
--- a/WebCore/bindings/js/JSIDBAnyCustom.cpp
+++ b/WebCore/bindings/js/JSIDBAnyCustom.cpp
@@ -44,6 +44,7 @@
 #include "JSIDBIndex.h"
 #include "JSIDBKey.h"
 #include "JSIDBObjectStore.h"
+#include "JSIDBTransaction.h"
 #include "SerializedScriptValue.h"
 
 using namespace JSC;
@@ -64,14 +65,16 @@ JSValue toJS(ExecState* exec, JSDOMGlobalObject* globalObject, IDBAny* idbAny)
         return toJS(exec, globalObject, idbAny->idbCursor());
     case IDBAny::IDBDatabaseType:
         return toJS(exec, globalObject, idbAny->idbDatabase());
+    case IDBAny::IDBFactoryType:
+        return toJS(exec, globalObject, idbAny->idbFactory());
     case IDBAny::IDBIndexType:
         return toJS(exec, globalObject, idbAny->idbIndex());
     case IDBAny::IDBKeyType:
         return toJS(exec, globalObject, idbAny->idbKey());
     case IDBAny::IDBObjectStoreType:
         return toJS(exec, globalObject, idbAny->idbObjectStore());
-    case IDBAny::IDBFactoryType:
-        return toJS(exec, globalObject, idbAny->idbFactory());
+    case IDBAny::IDBTransactionType:
+        return toJS(exec, globalObject, idbAny->idbTransaction());
     case IDBAny::SerializedScriptValueType:
         return idbAny->serializedScriptValue()->deserialize(exec, globalObject);
     }
diff --git a/WebCore/bindings/js/JSInt16ArrayCustom.cpp b/WebCore/bindings/js/JSInt16ArrayCustom.cpp
index e8be4d1..797568c 100644
--- a/WebCore/bindings/js/JSInt16ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSInt16ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSInt16Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSInt16ArrayConstructor::constructJSInt16Array(Exec
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSInt32ArrayCustom.cpp b/WebCore/bindings/js/JSInt32ArrayCustom.cpp
index ee5712b..53e6ec6 100644
--- a/WebCore/bindings/js/JSInt32ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSInt32ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSInt32Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSInt32ArrayConstructor::constructJSInt32Array(Exec
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSInt8ArrayCustom.cpp b/WebCore/bindings/js/JSInt8ArrayCustom.cpp
index 70f18a5..7556d6a 100644
--- a/WebCore/bindings/js/JSInt8ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSInt8ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSInt8Array.h"
@@ -64,4 +64,4 @@ EncodedJSValue JSC_HOST_CALL JSInt8ArrayConstructor::constructJSInt8Array(ExecSt
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSLocationCustom.cpp b/WebCore/bindings/js/JSLocationCustom.cpp
index 09e7294..b00249f 100644
--- a/WebCore/bindings/js/JSLocationCustom.cpp
+++ b/WebCore/bindings/js/JSLocationCustom.cpp
@@ -313,7 +313,7 @@ JSValue JSLocation::reload(ExecState* exec)
         return jsUndefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->redirectScheduler()->scheduleRefresh(processingUserGesture());
+        frame->navigationScheduler()->scheduleRefresh();
     return jsUndefined();
 }
 
diff --git a/WebCore/bindings/js/JSNodeCustom.cpp b/WebCore/bindings/js/JSNodeCustom.cpp
index b7c50f2..a0963b8 100644
--- a/WebCore/bindings/js/JSNodeCustom.cpp
+++ b/WebCore/bindings/js/JSNodeCustom.cpp
@@ -127,6 +127,8 @@ void JSNode::markChildren(MarkStack& markStack)
     // the document, we need to mark the document, but we don't need to explicitly
     // mark any other nodes.
     if (node->inDocument()) {
+        // FIXME: Do we really want to call a virtual function, ownerDocument here,
+        // when the non-virtual inline function, document, is so much faster?!
         if (Document* doc = node->ownerDocument())
             markDOMNodeWrapper(markStack, doc, doc);
         return;
diff --git a/WebCore/bindings/js/JSUint16ArrayCustom.cpp b/WebCore/bindings/js/JSUint16ArrayCustom.cpp
index ccea62f..9f12fa7 100644
--- a/WebCore/bindings/js/JSUint16ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSUint16ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSUint16Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSUint16ArrayConstructor::constructJSUint16Array(Ex
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSUint32ArrayCustom.cpp b/WebCore/bindings/js/JSUint32ArrayCustom.cpp
index 31ec8cb..c757786 100644
--- a/WebCore/bindings/js/JSUint32ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSUint32ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSUint32Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSUint32ArrayConstructor::constructJSUint32Array(Ex
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSUint8ArrayCustom.cpp b/WebCore/bindings/js/JSUint8ArrayCustom.cpp
index 7361b08..adf60a9 100644
--- a/WebCore/bindings/js/JSUint8ArrayCustom.cpp
+++ b/WebCore/bindings/js/JSUint8ArrayCustom.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "JSArrayBufferViewHelper.h"
 #include "JSUint8Array.h"
@@ -63,4 +63,4 @@ EncodedJSValue JSC_HOST_CALL JSUint8ArrayConstructor::constructJSUint8Array(Exec
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/js/JSWebSocketCustom.cpp b/WebCore/bindings/js/JSWebSocketCustom.cpp
index 3567206..813c0d4 100644
--- a/WebCore/bindings/js/JSWebSocketCustom.cpp
+++ b/WebCore/bindings/js/JSWebSocketCustom.cpp
@@ -54,16 +54,16 @@ EncodedJSValue JSC_HOST_CALL JSWebSocketConstructor::constructJSWebSocket(ExecSt
     if (!exec->argumentCount())
         return throwVMError(exec, createSyntaxError(exec, "Not enough arguments"));
 
-    const String& urlString = ustringToString(exec->argument(0).toString(exec));
+    String urlString = ustringToString(exec->argument(0).toString(exec));
     if (exec->hadException())
         return throwVMError(exec, createSyntaxError(exec, "wrong URL"));
-    const KURL& url = context->completeURL(urlString);
+    KURL url = context->completeURL(urlString);
     RefPtr<WebSocket> webSocket = WebSocket::create(context);
     ExceptionCode ec = 0;
     if (exec->argumentCount() < 2)
         webSocket->connect(url, ec);
     else {
-        const String& protocol = ustringToString(exec->argument(1).toString(exec));
+        String protocol = ustringToString(exec->argument(1).toString(exec));
         if (exec->hadException())
             return JSValue::encode(JSValue());
         webSocket->connect(url, protocol, ec);
diff --git a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
index 2da3771..58d324d 100644
--- a/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/js/JSXMLHttpRequestCustom.cpp
@@ -37,6 +37,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "InspectorInstrumentation.h"
 #include "JSBlob.h"
 #include "JSDOMFormData.h"
 #include "JSDOMWindowCustom.h"
@@ -93,6 +94,8 @@ JSValue JSXMLHttpRequest::open(ExecState* exec)
 
 JSValue JSXMLHttpRequest::send(ExecState* exec)
 {
+    InspectorInstrumentation::willSendXMLHttpRequest(impl()->scriptExecutionContext(), impl()->url());
+
     ExceptionCode ec = 0;
     if (!exec->argumentCount())
         impl()->send(ec);
@@ -125,7 +128,7 @@ JSValue JSXMLHttpRequest::send(ExecState* exec)
 JSValue JSXMLHttpRequest::responseText(ExecState* exec) const
 {
     ExceptionCode ec = 0;
-    const ScriptString& text = impl()->responseText(ec);
+    String text = impl()->responseText(ec);
     if (ec) {
         setDOMException(exec, ec);
         return jsUndefined();
diff --git a/WebCore/bindings/js/ScriptCallFrame.cpp b/WebCore/bindings/js/ScriptCallFrame.cpp
index 8381a4e..2f74b96 100644
--- a/WebCore/bindings/js/ScriptCallFrame.cpp
+++ b/WebCore/bindings/js/ScriptCallFrame.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "ScriptCallFrame.h"
 
-#include <interpreter/CallFrame.h>
+#include <runtime/ArgList.h>
 #include <runtime/UString.h>
 
 using namespace JSC;
@@ -39,8 +39,8 @@ using namespace JSC;
 namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const UString& functionName, const UString& urlString, int lineNumber, ExecState* exec, unsigned skipArgumentCount)
-    : m_functionName(functionName)
-    , m_sourceURL(ParsedURLString, ustringToString(urlString))
+    : m_functionName(ustringToString(functionName))
+    , m_sourceURL(ustringToString(urlString))
     , m_lineNumber(lineNumber)
 {
     if (!exec)
diff --git a/WebCore/bindings/js/ScriptCallFrame.h b/WebCore/bindings/js/ScriptCallFrame.h
index 202f4b6..31aec7e 100644
--- a/WebCore/bindings/js/ScriptCallFrame.h
+++ b/WebCore/bindings/js/ScriptCallFrame.h
@@ -31,43 +31,37 @@
 #ifndef ScriptCallFrame_h
 #define ScriptCallFrame_h
 
-#include "KURL.h"
-#include <runtime/ArgList.h>
-#include "ScriptString.h"
+#include "PlatformString.h"
 #include "ScriptValue.h"
 #include <wtf/Vector.h>
 
 namespace JSC {
-    class ExecState;
-    class InternalFunction;
+class ExecState;
+class UString;
 }
 
 namespace WebCore {
 
-    // FIXME: Implement retrieving line number and source URL and storing here
-    // for all call frames, not just the first one.
-    // See <https://bugs.webkit.org/show_bug.cgi?id=22556> and
-    // <https://bugs.webkit.org/show_bug.cgi?id=21180>
-    class ScriptCallFrame  {
-    public:
-        ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, unsigned skipArgumentCount);
-        ~ScriptCallFrame();
+class ScriptCallFrame  {
+public:
+    ScriptCallFrame(const JSC::UString& functionName, const JSC::UString& urlString, int lineNumber, JSC::ExecState*, unsigned skipArgumentCount);
+    ~ScriptCallFrame();
 
-        const ScriptString& functionName() const { return m_functionName; }
-        const KURL& sourceURL() const { return m_sourceURL; }
-        unsigned lineNumber() const { return m_lineNumber; }
+    const String& functionName() const { return m_functionName; }
+    const String& sourceURL() const { return m_sourceURL; }
+    unsigned lineNumber() const { return m_lineNumber; }
 
-        // argument retrieval methods
-        const ScriptValue& argumentAt(unsigned) const;
-        unsigned argumentCount() const { return m_arguments.size(); }
+    // argument retrieval methods
+    const ScriptValue& argumentAt(unsigned) const;
+    unsigned argumentCount() const { return m_arguments.size(); }
 
-    private:
-        ScriptString m_functionName;
-        KURL m_sourceURL;
-        unsigned m_lineNumber;
+private:
+    String m_functionName;
+    String m_sourceURL;
+    unsigned m_lineNumber;
 
-        Vector<ScriptValue> m_arguments;
-    };
+    Vector<ScriptValue> m_arguments;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/bindings/js/ScriptCallStack.h b/WebCore/bindings/js/ScriptCallStack.h
index a45e65a..17d1c46 100644
--- a/WebCore/bindings/js/ScriptCallStack.h
+++ b/WebCore/bindings/js/ScriptCallStack.h
@@ -33,7 +33,6 @@
 
 #include "ScriptCallFrame.h"
 #include "ScriptState.h"
-#include "ScriptString.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/RefPtr.h>
 
diff --git a/WebCore/bindings/js/ScriptController.cpp b/WebCore/bindings/js/ScriptController.cpp
index d318cbb..e03c822 100644
--- a/WebCore/bindings/js/ScriptController.cpp
+++ b/WebCore/bindings/js/ScriptController.cpp
@@ -28,7 +28,7 @@
 #include "FrameLoaderClient.h"
 #include "GCController.h"
 #include "HTMLPlugInElement.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "JSDocument.h"
 #include "JSMainThreadExecState.h"
 #include "NP_jsobject.h"
@@ -142,19 +142,13 @@ ScriptValue ScriptController::evaluateInWorld(const ScriptSourceCode& sourceCode
 
     RefPtr<Frame> protect = m_frame;
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
-        timelineAgent->willEvaluateScript(sourceURL, sourceCode.startLine());
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willEvaluateScript(m_frame, sourceURL, sourceCode.startLine());
 
     exec->globalData().timeoutChecker.start();
     Completion comp = JSMainThreadExecState::evaluate(exec, exec->dynamicGlobalObject()->globalScopeChain(), jsSourceCode, shell);
     exec->globalData().timeoutChecker.stop();
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
-        timelineAgent->didEvaluateScript();
-#endif
+    InspectorInstrumentation::didEvaluateScript(cookie);
 
     // Evaluating the JavaScript could cause the frame to be deallocated
     // so we start the keep alive timer here.
@@ -500,7 +494,7 @@ void ScriptController::clearScriptObjects()
 
 ScriptValue ScriptController::executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture, ShouldAllowXSS shouldAllowXSS)
 {
-    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->loader()->url());
+    ScriptSourceCode sourceCode(script, forceUserGesture ? KURL() : m_frame->document()->url());
 
     if (!canExecuteScripts(AboutToExecuteScript) || isPaused())
         return ScriptValue();
diff --git a/WebCore/bindings/js/ScriptController.h b/WebCore/bindings/js/ScriptController.h
index 2ec71b9..413b88a 100644
--- a/WebCore/bindings/js/ScriptController.h
+++ b/WebCore/bindings/js/ScriptController.h
@@ -98,7 +98,7 @@ public:
     ScriptValue executeScriptInWorld(DOMWrapperWorld* world, const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
 
     // Returns true if argument is a JavaScript URL.
-    bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
+    bool executeIfJavaScriptURL(const KURL&, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
 
     // This function must be called from the main thread. It is safe to call it repeatedly.
     // Darwin is an exception to this rule: it is OK to call this function from any thread, even reentrantly.
diff --git a/WebCore/bindings/js/ScriptDebugServer.cpp b/WebCore/bindings/js/ScriptDebugServer.cpp
index 1decefa..a440b81 100644
--- a/WebCore/bindings/js/ScriptDebugServer.cpp
+++ b/WebCore/bindings/js/ScriptDebugServer.cpp
@@ -200,9 +200,9 @@ void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pause)
     m_pauseOnExceptionsState = pause;
 }
 
-void ScriptDebugServer::pause()
+void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 {
-    m_pauseOnNextStatement = true;
+    m_pauseOnNextStatement = pause;
 }
 
 void ScriptDebugServer::breakProgram()
diff --git a/WebCore/bindings/js/ScriptDebugServer.h b/WebCore/bindings/js/ScriptDebugServer.h
index 432fe9a..3172c65 100644
--- a/WebCore/bindings/js/ScriptDebugServer.h
+++ b/WebCore/bindings/js/ScriptDebugServer.h
@@ -78,7 +78,7 @@ public:
     PauseOnExceptionsState pauseOnExceptionsState() const { return m_pauseOnExceptionsState; }
     void setPauseOnExceptionsState(PauseOnExceptionsState);
 
-    void pause();
+    void setPauseOnNextStatement(bool pause);
     void breakProgram();
     void continueProgram();
     void stepIntoStatement();
diff --git a/WebCore/bindings/js/ScriptFunctionCall.cpp b/WebCore/bindings/js/ScriptFunctionCall.cpp
index 2e4d536..775e3ad 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/js/ScriptFunctionCall.cpp
@@ -33,7 +33,6 @@
 
 #include "JSDOMBinding.h"
 #include "JSMainThreadExecState.h"
-#include "ScriptString.h"
 #include "ScriptValue.h"
 
 #include <runtime/JSLock.h>
@@ -52,11 +51,6 @@ void ScriptCallArgumentHandler::appendArgument(const ScriptObject& argument)
     m_arguments.append(argument.jsObject());
 }
 
-void ScriptCallArgumentHandler::appendArgument(const ScriptString& argument)
-{
-    m_arguments.append(jsString(m_exec, argument.ustring()));
-}
-
 void ScriptCallArgumentHandler::appendArgument(const ScriptValue& argument)
 {
     m_arguments.append(argument.jsValue());
diff --git a/WebCore/bindings/js/ScriptFunctionCall.h b/WebCore/bindings/js/ScriptFunctionCall.h
index 037a336..c7da858 100644
--- a/WebCore/bindings/js/ScriptFunctionCall.h
+++ b/WebCore/bindings/js/ScriptFunctionCall.h
@@ -44,14 +44,12 @@ namespace JSC {
 
 namespace WebCore {
     class ScriptValue;
-    class ScriptString;
 
     class ScriptCallArgumentHandler {
     public:
         ScriptCallArgumentHandler(ScriptState* state) : m_exec(state) { }
 
         void appendArgument(const ScriptObject&);
-        void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
         void appendArgument(const char*);
diff --git a/WebCore/bindings/js/SerializedScriptValue.cpp b/WebCore/bindings/js/SerializedScriptValue.cpp
index 8ccaf9c..c9ad0e6 100644
--- a/WebCore/bindings/js/SerializedScriptValue.cpp
+++ b/WebCore/bindings/js/SerializedScriptValue.cpp
@@ -781,6 +781,25 @@ private:
         JSValue m_jsString;
     };
 
+    struct CachedStringRef {
+        CachedStringRef()
+            : m_base(0)
+            , m_index(0)
+        {
+        }
+        CachedStringRef(Vector<CachedString>* base, size_t index)
+            : m_base(base)
+            , m_index(index)
+        {
+        }
+        
+        CachedString* operator->() { ASSERT(m_base); return &m_base->at(m_index); }
+        
+    private:
+        Vector<CachedString>* m_base;
+        size_t m_index;
+    };
+
     CloneDeserializer(ExecState* exec, JSGlobalObject* globalObject, const Vector<uint8_t>& buffer)
         : CloneBase(exec)
         , m_globalObject(globalObject)
@@ -819,7 +838,12 @@ private:
         if (sizeof(T) == 1)
             value = *ptr++;
         else {
-            value = *reinterpret_cast_ptr<const T*>(ptr);
+#if CPU(ARMV5_OR_LOWER)
+            // To protect misaligned memory access.
+            memcpy(&value, ptr, sizeof(T));
+#else
+            value = *reinterpret_cast<const T*>(ptr);
+#endif
             ptr += sizeof(T);
         }
         return true;
@@ -907,7 +931,14 @@ private:
             return false;
 
 #if ASSUME_LITTLE_ENDIAN
-        str = UString(reinterpret_cast_ptr<const UChar*>(ptr), length);
+#if CPU(ARMV5_OR_LOWER)
+        // To protect misaligned memory access.
+        Vector<UChar> alignedBuffer(length);
+        memcpy(alignedBuffer.data(), ptr, length * sizeof(UChar));
+        str = UString::adopt(alignedBuffer);
+#else
+        str = UString(reinterpret_cast<const UChar*>(ptr), length);
+#endif
         ptr += length * sizeof(UChar);
 #else
         Vector<UChar> buffer;
@@ -922,13 +953,13 @@ private:
         return true;
     }
 
-    bool readStringData(CachedString*& cachedString)
+    bool readStringData(CachedStringRef& cachedString)
     {
         bool scratch;
         return readStringData(cachedString, scratch);
     }
 
-    bool readStringData(CachedString*& cachedString, bool& wasTerminator)
+    bool readStringData(CachedStringRef& cachedString, bool& wasTerminator)
     {
         if (m_failed)
             return false;
@@ -949,7 +980,7 @@ private:
                 fail();
                 return false;
             }
-            cachedString = &m_constantPool[index];
+            cachedString = CachedStringRef(&m_constantPool, index);
             return true;
         }
         UString str;
@@ -958,7 +989,7 @@ private:
             return false;
         }
         m_constantPool.append(str);
-        cachedString = &m_constantPool.last();
+        cachedString = CachedStringRef(&m_constantPool, m_constantPool.size() - 1);
         return true;
     }
 
@@ -984,13 +1015,13 @@ private:
 
     bool readFile(RefPtr<File>& file)
     {
-        CachedString* path = 0;
+        CachedStringRef path;
         if (!readStringData(path))
             return 0;
-        CachedString* url = 0;
+        CachedStringRef url;
         if (!readStringData(url))
             return 0;
-        CachedString* type = 0;
+        CachedStringRef type;
         if (!readStringData(type))
             return 0;
         if (m_isDOMGlobalObject)
@@ -1080,10 +1111,10 @@ private:
             return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), result.get());
         }
         case BlobTag: {
-            CachedString* url = 0;
+            CachedStringRef url;
             if (!readStringData(url))
                 return JSValue();
-            CachedString* type = 0;
+            CachedStringRef type;
             if (!readStringData(type))
                 return JSValue();
             unsigned long long size = 0;
@@ -1094,7 +1125,7 @@ private:
             return toJS(m_exec, static_cast<JSDOMGlobalObject*>(m_globalObject), Blob::create(KURL(KURL(), url->ustring().impl()), String(type->ustring().impl()), size));
         }
         case StringTag: {
-            CachedString* cachedString = 0;
+            CachedStringRef cachedString;
             if (!readStringData(cachedString))
                 return JSValue();
             return cachedString->jsString(m_exec);
@@ -1102,10 +1133,10 @@ private:
         case EmptyStringTag:
             return jsEmptyString(&m_exec->globalData());
         case RegExpTag: {
-            CachedString* pattern = 0;
+            CachedStringRef pattern;
             if (!readStringData(pattern))
                 return JSValue();
-            CachedString* flags = 0;
+            CachedStringRef flags;
             if (!readStringData(flags))
                 return JSValue();
             RefPtr<RegExp> regExp = RegExp::create(&m_exec->globalData(), pattern->ustring(), flags->ustring());
@@ -1211,7 +1242,7 @@ JSValue CloneDeserializer::deserialize()
                 tickCount = ticksUntilNextCheck();
             }
 
-            CachedString* cachedString = 0;
+            CachedStringRef cachedString;
             bool wasTerminator = false;
             if (!readStringData(cachedString, wasTerminator)) {
                 if (!wasTerminator)
diff --git a/WebCore/bindings/objc/DOM.mm b/WebCore/bindings/objc/DOM.mm
index c526123..44bd653 100644
--- a/WebCore/bindings/objc/DOM.mm
+++ b/WebCore/bindings/objc/DOM.mm
@@ -37,6 +37,7 @@
 #import "Frame.h"
 #import "HTMLElement.h"
 #import "HTMLNames.h"
+#import "HTMLParserIdioms.h"
 #import "Image.h"
 #import "NodeFilter.h"
 #import "RenderImage.h"
@@ -469,7 +470,7 @@ id <DOMEventTarget> kit(WebCore::EventTarget* eventTarget)
     ASSERT(name);
     WebCore::Element* element = core(self);
     ASSERT(element);
-    return element->document()->completeURL(deprecatedParseURL(element->getAttribute(name)));
+    return element->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(element->getAttribute(name)));
 }
 
 - (BOOL)isFocused
diff --git a/WebCore/bindings/objc/DOMHTML.mm b/WebCore/bindings/objc/DOMHTML.mm
index 884a5b0..a2277d2 100644
--- a/WebCore/bindings/objc/DOMHTML.mm
+++ b/WebCore/bindings/objc/DOMHTML.mm
@@ -40,6 +40,7 @@
 #import "HTMLCollection.h"
 #import "HTMLDocument.h"
 #import "HTMLInputElement.h"
+#import "HTMLParserIdioms.h"
 #import "HTMLSelectElement.h"
 #import "HTMLTextAreaElement.h"
 #import "Page.h"
@@ -70,7 +71,7 @@
 
 - (DOMDocumentFragment *)_createDocumentFragmentWithMarkupString:(NSString *)markupString baseURLString:(NSString *)baseURLString
 {
-    NSURL *baseURL = core(self)->completeURL(WebCore::deprecatedParseURL(baseURLString));
+    NSURL *baseURL = core(self)->completeURL(WebCore::stripLeadingAndTrailingHTMLSpaces(baseURLString));
     return [self createDocumentFragmentWithMarkupString:markupString baseURL:baseURL];
 }
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorJS.pm b/WebCore/bindings/scripts/CodeGeneratorJS.pm
index 710ac3f..fe29b80 100644
--- a/WebCore/bindings/scripts/CodeGeneratorJS.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorJS.pm
@@ -1641,6 +1641,12 @@ sub GenerateImplementation
                 push(@implContent, "JSValue ${constructorFunctionName}(ExecState* exec, JSValue slotBase, const Identifier&)\n");
                 push(@implContent, "{\n");
                 push(@implContent, "    ${className}* domObject = static_cast<$className*>(asObject(slotBase));\n");
+
+                if ($dataNode->extendedAttributes->{"CheckDomainSecurity"}) {
+                    push(@implContent, "    if (!domObject->allowsAccessFrom(exec))\n");
+                    push(@implContent, "        return jsUndefined();\n");
+                }
+
                 push(@implContent, "    return ${className}::getConstructor(exec, domObject->globalObject());\n");
                 push(@implContent, "}\n");
             }
@@ -2847,7 +2853,11 @@ sub GenerateConstructorDefinition
     push(@$outputArray, "${constructorClassName}::${constructorClassName}(ExecState* exec, JSDOMGlobalObject* globalObject)\n");
     push(@$outputArray, "    : DOMConstructorObject(${constructorClassName}::createStructure(globalObject->objectPrototype()), globalObject)\n");
     push(@$outputArray, "{\n");
-    push(@$outputArray, "    putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
+    if ($interfaceName eq "DOMWindow") {
+        push(@$outputArray, "    putDirect(exec->propertyNames().prototype, globalObject->prototype(), DontDelete | ReadOnly);\n");
+    } else {
+        push(@$outputArray, "    putDirect(exec->propertyNames().prototype, ${protoClassName}::self(exec, globalObject), DontDelete | ReadOnly);\n");
+    }
     push(@$outputArray, "    putDirect(exec->propertyNames().length, jsNumber(exec, ${numberOfconstructParameters}), ReadOnly | DontDelete | DontEnum);\n") if $numberOfconstructParameters;
     push(@$outputArray, "}\n\n");
 
diff --git a/WebCore/bindings/scripts/CodeGeneratorObjC.pm b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
index 7e17008..96f0446 100644
--- a/WebCore/bindings/scripts/CodeGeneratorObjC.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorObjC.pm
@@ -588,7 +588,7 @@ sub AddIncludesForType
     }
 
     if ($codeGenerator->IsSVGAnimatedType($type)) {
-        $implIncludes{"SVGAnimatedTemplate.h"} = 1;
+        $implIncludes{"DeprecatedSVGAnimatedTemplate.h"} = 1;
         $implIncludes{"DOM${type}Internal.h"} = 1;
         return;
     }
@@ -983,7 +983,7 @@ sub GenerateHeader
         my $implClassName = GetImplClassName($interfaceName);
 
         if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
-            push(@internalHeaderContent, "#import <WebCore/SVGAnimatedTemplate.h>\n\n");
+            push(@internalHeaderContent, "#import <WebCore/DeprecatedSVGAnimatedTemplate.h>\n\n");
         } else {
             push(@internalHeaderContent, "namespace WebCore {\n");
             $startedNamespace = 1;
@@ -1087,7 +1087,7 @@ sub GenerateImplementation
     $implIncludes{"DOMSVGPathSegInternal.h"} = 1 if $interfaceName =~ /^SVGPathSeg.+/;
 
     if ($codeGenerator->IsSVGAnimatedType($interfaceName)) {
-        $implIncludes{"SVGAnimatedTemplate.h"} = 1;
+        $implIncludes{"DeprecatedSVGAnimatedTemplate.h"} = 1;
     } elsif ($interfaceName =~ /(\w+)(Abs|Rel)$/) {
         $implIncludes{"$1.h"} = 1;
     } else {
diff --git a/WebCore/bindings/scripts/CodeGeneratorV8.pm b/WebCore/bindings/scripts/CodeGeneratorV8.pm
index 3353f0f..91ffeaa 100644
--- a/WebCore/bindings/scripts/CodeGeneratorV8.pm
+++ b/WebCore/bindings/scripts/CodeGeneratorV8.pm
@@ -187,7 +187,7 @@ sub AddIncludesForSVGAnimatedType
         $implIncludes{"PlatformString.h"} = 1;
     }
 
-    $implIncludes{"SVGAnimatedTemplate.h"} = 1;
+    $implIncludes{"DeprecatedSVGAnimatedTemplate.h"} = 1;
 }
 
 # If the node has a [Conditional=XXX] attribute, returns an "ENABLE(XXX)" string for use in an #if.
@@ -450,7 +450,7 @@ sub GetHeaderClassInclude
         $className =~ s/Abs|Rel//;
     }
     return "" if (AvoidInclusionOfType($className));
-    return "SVGAnimatedTemplate.h" if ($codeGenerator->IsSVGAnimatedType($className));
+    return "DeprecatedSVGAnimatedTemplate.h" if ($codeGenerator->IsSVGAnimatedType($className));
     return "${className}.h";
 }
 
@@ -2555,6 +2555,8 @@ sub IsActiveDomType
     return 1 if $type eq "Worker";
     return 1 if $type eq "SharedWorker";
     return 1 if $type eq "IDBRequest";
+    return 1 if $type eq "FileReader";
+    return 1 if $type eq "FileWriter";
     return 0;
 }
 
diff --git a/WebCore/bindings/v8/DebuggerScript.js b/WebCore/bindings/v8/DebuggerScript.js
index 0222296..6026214 100644
--- a/WebCore/bindings/v8/DebuggerScript.js
+++ b/WebCore/bindings/v8/DebuggerScript.js
@@ -98,7 +98,9 @@ DebuggerScript.setBreakpoint = function(execState, args)
         Debug.disableScriptBreakPoint(breakId);
 
     var locations = Debug.findBreakPointActualLocations(breakId);
-    var actualLineNumber = locations.length ? locations[0].line : args.lineNumber;
+    if (!locations.length)
+        return undefined;
+    var actualLineNumber = locations[0].line;
 
     var key = args.scriptId + ":" + actualLineNumber;
     if (key in DebuggerScript._breakpoints) {
diff --git a/WebCore/bindings/v8/IDBBindingUtilities.cpp b/WebCore/bindings/v8/IDBBindingUtilities.cpp
index a000a7d..4a58853 100644
--- a/WebCore/bindings/v8/IDBBindingUtilities.cpp
+++ b/WebCore/bindings/v8/IDBBindingUtilities.cpp
@@ -58,9 +58,28 @@ bool getValueFrom(T indexOrName, v8::Handle<v8::Value>& v8Value)
     return true;
 }
 
+class LocalContext {
+public:
+    LocalContext()
+        : m_context(v8::Context::New())
+    {
+        m_context->Enter();
+    }
+
+    ~LocalContext()
+    {
+        m_context->Exit();
+        m_context.Dispose();
+    }
+
+private:
+    v8::HandleScope m_scope;
+    v8::Persistent<v8::Context> m_context;
+};
+
 PassRefPtr<IDBKey> createIDBKeyFromSerializedValueAndKeyPath(PassRefPtr<SerializedScriptValue> value, const Vector<IDBKeyPathElement>& keyPath)
 {
-    v8::HandleScope scope;
+    LocalContext localContext;
     v8::Handle<v8::Value> v8Value(value->deserialize());
     for (size_t i = 0; i < keyPath.size(); ++i) {
         switch (keyPath[i].type) {
diff --git a/WebCore/bindings/v8/ScriptCallFrame.cpp b/WebCore/bindings/v8/ScriptCallFrame.cpp
index 9554f67..f0c7343 100644
--- a/WebCore/bindings/v8/ScriptCallFrame.cpp
+++ b/WebCore/bindings/v8/ScriptCallFrame.cpp
@@ -42,7 +42,7 @@ namespace WebCore {
 
 ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber, const v8::Arguments& arguments, unsigned skipArgumentCount)
     : m_functionName(functionName)
-    , m_sourceURL(ParsedURLString, urlString)
+    , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
     for (int i = skipArgumentCount; i < arguments.Length(); ++i)
@@ -51,7 +51,7 @@ ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlSt
 
 ScriptCallFrame::ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber)
     : m_functionName(functionName)
-    , m_sourceURL(ParsedURLString, urlString)
+    , m_sourceURL(urlString)
     , m_lineNumber(lineNumber)
 {
 }
diff --git a/WebCore/bindings/v8/ScriptCallFrame.h b/WebCore/bindings/v8/ScriptCallFrame.h
index 8d1972f..ff77d4a 100644
--- a/WebCore/bindings/v8/ScriptCallFrame.h
+++ b/WebCore/bindings/v8/ScriptCallFrame.h
@@ -32,7 +32,6 @@
 #define ScriptCallFrame_h
 
 #include "KURL.h"
-#include "ScriptString.h"
 
 #include <wtf/Vector.h>
 
@@ -53,8 +52,8 @@ namespace WebCore {
         ScriptCallFrame(const String& functionName, const String& urlString, int lineNumber);
         ~ScriptCallFrame();
 
-        const ScriptString& functionName() const { return m_functionName; }
-        const KURL& sourceURL() const { return m_sourceURL; }
+        const String& functionName() const { return m_functionName; }
+        const String& sourceURL() const { return m_sourceURL; }
         unsigned lineNumber() const { return m_lineNumber; }
 
         // argument retrieval methods
@@ -62,8 +61,8 @@ namespace WebCore {
         unsigned argumentCount() const { return m_arguments.size(); }
 
     private:
-        ScriptString m_functionName;
-        KURL m_sourceURL;
+        String m_functionName;
+        String m_sourceURL;
         unsigned m_lineNumber;
 
         Vector<ScriptValue> m_arguments;
diff --git a/WebCore/bindings/v8/ScriptCallStack.cpp b/WebCore/bindings/v8/ScriptCallStack.cpp
index 7c07829..3e29c7a 100644
--- a/WebCore/bindings/v8/ScriptCallStack.cpp
+++ b/WebCore/bindings/v8/ScriptCallStack.cpp
@@ -44,7 +44,7 @@ namespace WebCore {
 static void getFrameLocation(v8::Handle<v8::StackFrame> frame, String* sourceName, int* sourceLineNumber, String* functionName)
 {
     ASSERT(!frame.IsEmpty());
-    v8::Local<v8::String> sourceNameValue(frame->GetScriptName());
+    v8::Local<v8::String> sourceNameValue(frame->GetScriptNameOrSourceURL());
     v8::Local<v8::String> functionNameValue(frame->GetFunctionName());
     *sourceName = sourceNameValue.IsEmpty() ? "" : toWebCoreString(sourceNameValue);
     *functionName = functionNameValue.IsEmpty() ? "" : toWebCoreString(functionNameValue);
@@ -85,13 +85,19 @@ static void toScriptCallFramesVector(v8::Local<v8::Context> context, v8::Handle<
 }
 
 const int ScriptCallStack::maxCallStackSizeToCapture = 200;
+const v8::StackTrace::StackTraceOptions ScriptCallStack::stackTraceOptions = static_cast<v8::StackTrace::StackTraceOptions>(
+     v8::StackTrace::kLineNumber
+    | v8::StackTrace::kColumnOffset
+    | v8::StackTrace::kScriptNameOrSourceURL
+    | v8::StackTrace::kFunctionName);
+
 
 PassOwnPtr<ScriptCallStack> ScriptCallStack::create(const v8::Arguments& arguments, unsigned skipArgumentCount, int framCountLimit)
 {
     v8::HandleScope scope;
     v8::Local<v8::Context> context = v8::Context::GetCurrent();
     v8::Context::Scope contextScope(context);
-    v8::Handle<v8::StackTrace> stackTrace(v8::StackTrace::CurrentStackTrace(framCountLimit));
+    v8::Handle<v8::StackTrace> stackTrace(v8::StackTrace::CurrentStackTrace(framCountLimit, ScriptCallStack::stackTraceOptions));
 
     if (stackTrace.IsEmpty())
         return 0;
diff --git a/WebCore/bindings/v8/ScriptCallStack.h b/WebCore/bindings/v8/ScriptCallStack.h
index 215cdec..98e5195 100644
--- a/WebCore/bindings/v8/ScriptCallStack.h
+++ b/WebCore/bindings/v8/ScriptCallStack.h
@@ -48,6 +48,7 @@ class InspectorArray;
 class ScriptCallStack : public Noncopyable {
 public:
     static const int maxCallStackSizeToCapture;
+    static const v8::StackTrace::StackTraceOptions stackTraceOptions;
 
     static PassOwnPtr<ScriptCallStack> create(const v8::Arguments&, unsigned skipArgumentCount = 0, int framCountLimit = 1);
     static PassOwnPtr<ScriptCallStack> create(ScriptState*, v8::Handle<v8::StackTrace>);
diff --git a/WebCore/bindings/v8/ScriptController.cpp b/WebCore/bindings/v8/ScriptController.cpp
index 8018a18..913a892 100644
--- a/WebCore/bindings/v8/ScriptController.cpp
+++ b/WebCore/bindings/v8/ScriptController.cpp
@@ -479,9 +479,9 @@ void ScriptController::clearWindowShell(bool)
 }
 
 #if ENABLE(INSPECTOR)
-void ScriptController::setCaptureCallStackForUncaughtExceptions(bool)
+void ScriptController::setCaptureCallStackForUncaughtExceptions(bool value)
 {
-    v8::V8::SetCaptureStackTraceForUncaughtExceptions(true, ScriptCallStack::maxCallStackSizeToCapture);
+    v8::V8::SetCaptureStackTraceForUncaughtExceptions(value, ScriptCallStack::maxCallStackSizeToCapture, ScriptCallStack::stackTraceOptions);
 }
 #endif
 
diff --git a/WebCore/bindings/v8/ScriptController.h b/WebCore/bindings/v8/ScriptController.h
index 8ac9064..63f1c17 100644
--- a/WebCore/bindings/v8/ScriptController.h
+++ b/WebCore/bindings/v8/ScriptController.h
@@ -76,7 +76,7 @@ public:
     ScriptValue executeScript(const String& script, bool forceUserGesture = false, ShouldAllowXSS shouldAllowXSS = DoNotAllowXSS);
 
     // Returns true if argument is a JavaScript URL.
-    bool executeIfJavaScriptURL(const KURL&, bool userGesture = false, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
+    bool executeIfJavaScriptURL(const KURL&, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL = ReplaceDocumentIfJavaScriptURL);
 
     // This function must be called from the main thread. It is safe to call it repeatedly.
     static void initializeThreading();
diff --git a/WebCore/bindings/v8/ScriptDebugServer.cpp b/WebCore/bindings/v8/ScriptDebugServer.cpp
index 3f1a0c5..7a8dbf7 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.cpp
+++ b/WebCore/bindings/v8/ScriptDebugServer.cpp
@@ -225,10 +225,14 @@ void ScriptDebugServer::setPauseOnExceptionsState(PauseOnExceptionsState pauseOn
     setPauseOnExceptionsFunction->Call(m_debuggerScript.get(), 1, argv);
 }
 
-void ScriptDebugServer::pause()
+void ScriptDebugServer::setPauseOnNextStatement(bool pause)
 {
-    if (!m_pausedPage)
+    if (m_pausedPage)
+        return;
+    if (pause)
         v8::Debug::DebugBreak();
+    else
+        v8::Debug::CancelDebugBreak();
 }
 
 void ScriptDebugServer::breakProgram()
diff --git a/WebCore/bindings/v8/ScriptDebugServer.h b/WebCore/bindings/v8/ScriptDebugServer.h
index d1fd71f..5c5d6c6 100644
--- a/WebCore/bindings/v8/ScriptDebugServer.h
+++ b/WebCore/bindings/v8/ScriptDebugServer.h
@@ -70,7 +70,7 @@ public:
     PauseOnExceptionsState pauseOnExceptionsState();
     void setPauseOnExceptionsState(PauseOnExceptionsState pauseOnExceptionsState);
 
-    void pause();
+    void setPauseOnNextStatement(bool pause);
     void breakProgram();
     void continueProgram();
     void stepIntoStatement();
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.cpp b/WebCore/bindings/v8/ScriptFunctionCall.cpp
index 29dbb02..3ea536e 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.cpp
+++ b/WebCore/bindings/v8/ScriptFunctionCall.cpp
@@ -33,7 +33,6 @@
 
 #include "ScriptScope.h"
 #include "ScriptState.h"
-#include "ScriptString.h"
 #include "ScriptValue.h"
 
 #include "V8Binding.h"
@@ -54,12 +53,6 @@ void ScriptCallArgumentHandler::appendArgument(const ScriptObject& argument)
     m_arguments.append(argument);
 }
 
-void ScriptCallArgumentHandler::appendArgument(const ScriptString& argument)
-{
-    ScriptScope scope(m_scriptState);
-    m_arguments.append(v8String(argument));
-}
-
 void ScriptCallArgumentHandler::appendArgument(const ScriptValue& argument)
 {
     m_arguments.append(argument);
diff --git a/WebCore/bindings/v8/ScriptFunctionCall.h b/WebCore/bindings/v8/ScriptFunctionCall.h
index 04dddc8..d4f63ac 100644
--- a/WebCore/bindings/v8/ScriptFunctionCall.h
+++ b/WebCore/bindings/v8/ScriptFunctionCall.h
@@ -39,14 +39,12 @@
 namespace WebCore {
     class ScriptValue;
     class ScriptState;
-    class ScriptString;
 
     class ScriptCallArgumentHandler {
     public:
         ScriptCallArgumentHandler(ScriptState* scriptState) : m_scriptState(scriptState) { }
 
         void appendArgument(const ScriptObject&);
-        void appendArgument(const ScriptString&);
         void appendArgument(const ScriptValue&);
         void appendArgument(const String&);
         void appendArgument(const char*);
diff --git a/WebCore/bindings/v8/ScriptProfiler.cpp b/WebCore/bindings/v8/ScriptProfiler.cpp
index ab7cfa7..02dea14 100644
--- a/WebCore/bindings/v8/ScriptProfiler.cpp
+++ b/WebCore/bindings/v8/ScriptProfiler.cpp
@@ -32,9 +32,9 @@
 #include "ScriptProfiler.h"
 
 #include "InspectorValues.h"
-#include "ScriptString.h"
 
 #include <v8-profiler.h>
+#include <V8Binding.h>
 
 namespace WebCore {
 
diff --git a/WebCore/bindings/v8/ScriptStringImpl.h b/WebCore/bindings/v8/ScriptStringImpl.h
deleted file mode 100644
index 84a25c4..0000000
--- a/WebCore/bindings/v8/ScriptStringImpl.h
+++ /dev/null
@@ -1,77 +0,0 @@
-/*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- * 
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef ScriptStringImpl_h
-#define ScriptStringImpl_h
-
-#include "OwnHandle.h"
-#include "PlatformString.h"
-
-#include <v8.h>
-
-namespace WebCore {
-
-// This class is used for strings that tend to be shared with JavaScript frequently.  The JSC implementation uses wtf::UString - see bindings/js/ScriptString.h
-// Currently XMLHttpRequest uses a ScriptString to build up the responseText attribute.  As data arrives from the network, it is appended to the ScriptString
-// via operator+= and a JavaScript readystatechange event is fired.  JavaScript can access the responseText attribute of the XMLHttpRequest object.  JavaScript
-// may also query the responseXML attribute of the XMLHttpRequest object which results in the responseText attribute being coerced into a WTF::String and
-// then parsed as an XML document.
-// This implementation optimizes for the common case where the responseText is built up with many calls to operator+= before the actual text is queried.
-class ScriptStringImpl : public RefCounted<ScriptStringImpl> {
-public:
-    static PassRefPtr<ScriptStringImpl> create(const String& s)
-    {
-        return adoptRef(new ScriptStringImpl(s));
-    }
-
-    static PassRefPtr<ScriptStringImpl> create(const char* s)
-    {
-        return adoptRef(new ScriptStringImpl(s));
-    }
-
-    String toString() const;
-
-    bool isNull() const;
-    size_t size() const;
-
-    void append(const String& s);
-
-    v8::Handle<v8::String> v8StringHandle() { return m_handle.get(); }
-
-private:
-    ScriptStringImpl(const String& s);
-    ScriptStringImpl(const char* s);
-
-    OwnHandle<v8::String> m_handle;
-};
-
-} // namespace WebCore
-
-#endif // ScriptStringImpl_h
diff --git a/WebCore/bindings/v8/SerializedScriptValue.cpp b/WebCore/bindings/v8/SerializedScriptValue.cpp
index 4e5354e..ff92167 100644
--- a/WebCore/bindings/v8/SerializedScriptValue.cpp
+++ b/WebCore/bindings/v8/SerializedScriptValue.cpp
@@ -1105,7 +1105,7 @@ SerializedScriptValue* SerializedScriptValue::nullValue()
 PassRefPtr<SerializedScriptValue> SerializedScriptValue::release()
 {
     RefPtr<SerializedScriptValue> result = adoptRef(new SerializedScriptValue(m_data, WireData));
-    m_data = String();
+    m_data = String().crossThreadString();
     return result.release();
 }
 
@@ -1123,18 +1123,18 @@ SerializedScriptValue::SerializedScriptValue(v8::Handle<v8::Value> value, bool&
         didThrow = true;
         return;
     }
-    m_data = StringImpl::adopt(writer.data());
+    m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
 }
 
 SerializedScriptValue::SerializedScriptValue(String data, StringDataMode mode)
 {
     if (mode == WireData)
-        m_data = data;
+        m_data = data.crossThreadString();
     else {
         ASSERT(mode == StringValue);
         Writer writer;
         writer.writeWebCoreString(data);
-        m_data = StringImpl::adopt(writer.data());
+        m_data = String(StringImpl::adopt(writer.data())).crossThreadString();
     }
 }
 
diff --git a/WebCore/bindings/v8/SerializedScriptValue.h b/WebCore/bindings/v8/SerializedScriptValue.h
index 275e5f2..b534a57 100644
--- a/WebCore/bindings/v8/SerializedScriptValue.h
+++ b/WebCore/bindings/v8/SerializedScriptValue.h
@@ -33,11 +33,11 @@
 
 #include "ScriptValue.h"
 #include <v8.h>
-#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
-class SerializedScriptValue : public RefCounted<SerializedScriptValue> {
+class SerializedScriptValue : public ThreadSafeShared<SerializedScriptValue> {
 public:
     static void deserializeAndSetProperty(v8::Handle<v8::Object> object, const char* propertyName,
                                           v8::PropertyAttribute, SerializedScriptValue*);
diff --git a/WebCore/bindings/v8/V8DOMWindowShell.cpp b/WebCore/bindings/v8/V8DOMWindowShell.cpp
index bea1eb8..1a39a15 100644
--- a/WebCore/bindings/v8/V8DOMWindowShell.cpp
+++ b/WebCore/bindings/v8/V8DOMWindowShell.cpp
@@ -37,7 +37,6 @@
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "FrameLoaderClient.h"
-#include "InspectorTimelineAgent.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "ScriptController.h"
@@ -342,30 +341,19 @@ v8::Persistent<v8::Context> V8DOMWindowShell::createNewContext(v8::Handle<v8::Ob
 
     // Used to avoid sleep calls in unload handlers.
     if (!V8Proxy::registeredExtensionWithV8(DateExtension::get()))
-        V8Proxy::registerExtension(DateExtension::get(), String());
+        V8Proxy::registerExtension(DateExtension::get());
 
     // Dynamically tell v8 about our extensions now.
     const V8Extensions& extensions = V8Proxy::extensions();
     OwnArrayPtr<const char*> extensionNames(new const char*[extensions.size()]);
     int index = 0;
     for (size_t i = 0; i < extensions.size(); ++i) {
-        if (extensions[i].group && extensions[i].group != extensionGroup)
+        // Ensure our date extension is always allowed.
+        if (extensions[i] != DateExtension::get()
+            && !m_frame->loader()->client()->allowScriptExtension(extensions[i]->name(), extensionGroup))
             continue;
 
-        if (extensions[i].useCallback) {
-            // Ensure our date extension is always allowed.
-            if (extensions[i].extension != DateExtension::get()
-                && !m_frame->loader()->client()->allowScriptExtension(extensions[i].extension->name(), extensionGroup))
-                continue;
-        } else {
-            // Note: we check the loader URL here instead of the document URL
-            // because we might be currently loading an URL into a blank page.
-            // See http://code.google.com/p/chromium/issues/detail?id=10924
-            if (extensions[i].scheme.length() > 0 && (extensions[i].scheme != m_frame->loader()->activeDocumentLoader()->url().protocol()))
-                continue;
-        }
-
-        extensionNames[index++] = extensions[i].extension->name();
+        extensionNames[index++] = extensions[i]->name();
     }
     v8::ExtensionConfiguration extensionConfiguration(index, extensionNames.get());
     result = v8::Context::New(&extensionConfiguration, globalTemplate, global);
diff --git a/WebCore/bindings/v8/V8DOMWrapper.cpp b/WebCore/bindings/v8/V8DOMWrapper.cpp
index e7a8142..dd0446c 100644
--- a/WebCore/bindings/v8/V8DOMWrapper.cpp
+++ b/WebCore/bindings/v8/V8DOMWrapper.cpp
@@ -48,6 +48,7 @@
 #include "V8EventListenerList.h"
 #include "V8EventSource.h"
 #include "V8FileReader.h"
+#include "V8FileWriter.h"
 #include "V8HTMLCollection.h"
 #include "V8HTMLDocument.h"
 #include "V8IDBRequest.h"
@@ -428,6 +429,11 @@ v8::Handle<v8::Value> V8DOMWrapper::convertEventTargetToV8Object(EventTarget* ta
         return toV8(fileReader);
 #endif
 
+#if ENABLE(FILE_SYSTEM)
+    if (FileWriter* fileWriter = target->toFileWriter())
+        return toV8(fileWriter);
+#endif
+
     ASSERT(0);
     return notHandledByInterceptor();
 }
diff --git a/WebCore/bindings/v8/V8NPObject.cpp b/WebCore/bindings/v8/V8NPObject.cpp
index 7f2051e..0b1d25e 100644
--- a/WebCore/bindings/v8/V8NPObject.cpp
+++ b/WebCore/bindings/v8/V8NPObject.cpp
@@ -131,7 +131,7 @@ static v8::Handle<v8::Value> npObjectInvokeImpl(const v8::Arguments& args, Invok
     }
 
     if (!retval)
-        throwError("Error calling method on NPObject!", V8Proxy::GeneralError);
+        throwError("Error calling method on NPObject.", V8Proxy::GeneralError);
 
     for (int i = 0; i < numArgs; i++)
         _NPN_ReleaseVariantValue(&npArgs[i]);
diff --git a/WebCore/bindings/v8/V8Proxy.cpp b/WebCore/bindings/v8/V8Proxy.cpp
index be2be07..e7dca4f 100644
--- a/WebCore/bindings/v8/V8Proxy.cpp
+++ b/WebCore/bindings/v8/V8Proxy.cpp
@@ -39,7 +39,7 @@
 #include "FrameLoaderClient.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PlatformBridge.h"
@@ -77,7 +77,7 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/StringExtras.h>
 #include <wtf/UnusedParam.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
@@ -199,11 +199,8 @@ void V8Proxy::reportUnsafeAccessTo(Frame* target, DelayReporting delay)
 
     // FIXME: This error message should contain more specifics of why the same
     // origin check has failed.
-    String str = String::format("Unsafe JavaScript attempt to access frame "
-                                "with URL %s from frame with URL %s. "
-                                "Domains, protocols and ports must match.\n",
-                                targetDocument->url().string().utf8().data(),
-                                sourceDocument->url().string().utf8().data());
+    String str = makeString("Unsafe JavaScript attempt to access frame with URL ", targetDocument->url().string(),
+                            " from frame with URL ", sourceDocument->url().string(), ". Domains, protocols and ports must match.\n");
 
     // Build a console message with fake source ID and line number.
     const String kSourceID = "";
@@ -394,10 +391,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
 
     V8GCController::checkMemoryUsage();
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
-        timelineAgent->willEvaluateScript(source.url().isNull() ? String() : source.url().string(), source.startLine());
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willEvaluateScript(m_frame, source.url().isNull() ? String() : source.url().string(), source.startLine());
 
     v8::Local<v8::Value> result;
     {
@@ -432,10 +426,7 @@ v8::Local<v8::Value> V8Proxy::evaluate(const ScriptSourceCode& source, Node* nod
     PlatformBridge::traceEventEnd("v8.run", node, "");
 #endif
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0)
-        timelineAgent->didEvaluateScript();
-#endif
+    InspectorInstrumentation::didEvaluateScript(cookie);
 
     return result;
 }
@@ -536,33 +527,23 @@ v8::Local<v8::Value> V8Proxy::callFunction(v8::Handle<v8::Function> function, v8
         // execution finishs before firing the timer.
         m_frame->keepAlive();
 
-#if ENABLE(INSPECTOR)
-        Page* inspectedPage = InspectorTimelineAgent::instanceCount() ? m_frame->page(): 0;
-        if (inspectedPage) {
-            if (InspectorTimelineAgent* timelineAgent = inspectedPage->inspectorTimelineAgent()) {
-                v8::ScriptOrigin origin = function->GetScriptOrigin();
-                String resourceName("undefined");
-                int lineNumber = 1;
-                if (!origin.ResourceName().IsEmpty()) {
-                    resourceName = toWebCoreString(origin.ResourceName());
-                    lineNumber = function->GetScriptLineNumber() + 1;
-                }
-                timelineAgent->willCallFunction(resourceName, lineNumber);
-            } else
-                inspectedPage = 0;
+        InspectorInstrumentationCookie cookie;
+        if (InspectorInstrumentation::hasFrontends()) {
+            v8::ScriptOrigin origin = function->GetScriptOrigin();
+            String resourceName("undefined");
+            int lineNumber = 1;
+            if (!origin.ResourceName().IsEmpty()) {
+                resourceName = toWebCoreString(origin.ResourceName());
+                lineNumber = function->GetScriptLineNumber() + 1;
+            }
+            cookie = InspectorInstrumentation::willCallFunction(m_frame, resourceName, lineNumber);
         }
-#endif // !ENABLE(INSPECTOR)
 
         m_recursion++;
         result = function->Call(receiver, argc, args);
         m_recursion--;
 
-#if ENABLE(INSPECTOR)
-        if (inspectedPage)
-            if (InspectorTimelineAgent* timelineAgent = inspectedPage->inspectorTimelineAgent())
-                timelineAgent->didCallFunction();
-#endif // !ENABLE(INSPECTOR)
-
+        InspectorInstrumentation::didCallFunction(cookie);
     }
 
     // Release the storage mutex if applicable.
@@ -862,32 +843,17 @@ void V8Proxy::registerExtensionWithV8(v8::Extension* extension)
 bool V8Proxy::registeredExtensionWithV8(v8::Extension* extension)
 {
     for (size_t i = 0; i < m_extensions.size(); ++i) {
-        if (m_extensions[i].extension == extension)
+        if (m_extensions[i] == extension)
             return true;
     }
 
     return false;
 }
 
-void V8Proxy::registerExtension(v8::Extension* extension, const String& schemeRestriction)
-{
-    registerExtensionWithV8(extension);
-    V8ExtensionInfo info = {schemeRestriction, 0, extension, false};
-    m_extensions.append(info);
-}
-
-void V8Proxy::registerExtension(v8::Extension* extension, int extensionGroup)
-{
-    registerExtensionWithV8(extension);
-    V8ExtensionInfo info = {String(), extensionGroup, extension, false};
-    m_extensions.append(info);
-}
-
 void V8Proxy::registerExtension(v8::Extension* extension)
 {
     registerExtensionWithV8(extension);
-    V8ExtensionInfo info = {String(), 0, extension, true};
-    m_extensions.append(info);
+    m_extensions.append(extension);
 }
 
 bool V8Proxy::setContextDebugId(int debugId)
diff --git a/WebCore/bindings/v8/V8Proxy.h b/WebCore/bindings/v8/V8Proxy.h
index 169883b..bc5e526 100644
--- a/WebCore/bindings/v8/V8Proxy.h
+++ b/WebCore/bindings/v8/V8Proxy.h
@@ -119,18 +119,8 @@ namespace WebCore {
 
     const int kMaxRecursionDepth = 20;
 
-    // Information about an extension that is registered for use with V8. If
-    // scheme is non-empty, it contains the URL scheme the extension should be
-    // used with. If group is non-zero, the extension will only be loaded into
-    // script contexts that belong to that group. Otherwise, the extension is
-    // used with all schemes and contexts.
-    struct V8ExtensionInfo {
-        String scheme;
-        int group;
-        v8::Extension* extension;
-        bool useCallback; // FIXME: remove
-    };
-    typedef WTF::Vector<V8ExtensionInfo> V8Extensions;
+    // The list of extensions that are registered for use with V8.
+    typedef WTF::Vector<v8::Extension*> V8Extensions;
 
     class V8Proxy {
     public:
@@ -328,19 +318,9 @@ namespace WebCore {
         bool setContextDebugId(int id);
         static int contextDebugId(v8::Handle<v8::Context>);
 
-        // Registers a v8 extension to be available on webpages. The two forms
-        // offer various restrictions on what types of contexts the extension is
-        // loaded into. If a scheme is provided, only pages whose URL has the given
-        // scheme will match. If extensionGroup is provided, the extension will
-        // only be loaded into scripts run via evaluateInNewWorld with the
-        // matching group.  Will only affect v8 contexts initialized after this
-        // call. Takes ownership of the v8::Extension object passed.
-        static void registerExtension(v8::Extension*, const String& schemeRestriction);
-        static void registerExtension(v8::Extension*, int extensionGroup);
-
-        // Same as above, but new version.
-        // FIXME: remove the other 2 versions in phase 3 of multipart checkin:
-        // https://bugs.webkit.org/show_bug.cgi?id=45721
+        // Registers a v8 extension to be available on webpages. Will only
+        // affect v8 contexts initialized after this call. Takes ownership of
+        // the v8::Extension object passed.
         static void registerExtension(v8::Extension*);
 
         static void registerExtensionWithV8(v8::Extension*);
diff --git a/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp b/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
index 305fb18..99edc8b 100644
--- a/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ArrayBufferCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 
@@ -78,4 +78,4 @@ v8::Handle<v8::Value> V8ArrayBuffer::constructorCallback(const v8::Arguments& ar
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
index 2c89b95..4671c61 100644
--- a/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ArrayBufferViewCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 #include "V8ArrayBufferView.h"
 
 #include "V8Binding.h"
@@ -92,4 +92,4 @@ v8::Handle<v8::Value> V8ArrayBufferView::sliceCallback(const v8::Arguments& args
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
index baffbd4..fc83b61 100644
--- a/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ConsoleCustom.cpp
@@ -64,7 +64,7 @@ v8::Handle<v8::Value> V8Console::traceCallback(const v8::Arguments& args)
     Console* imp = V8Console::toNative(args.Holder());
     v8::HandleScope handleScope;
     ScriptState* scriptState = ScriptState::current();
-    v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(ScriptCallStack::maxCallStackSizeToCapture);
+    v8::Local<v8::StackTrace> stackTrace = v8::StackTrace::CurrentStackTrace(ScriptCallStack::maxCallStackSizeToCapture, ScriptCallStack::stackTraceOptions);
     OwnPtr<ScriptCallStack> callStack(ScriptCallStack::create(scriptState, stackTrace));
     imp->trace(callStack.get());
     return v8::Handle<v8::Value>();
diff --git a/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp b/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
index 8a39332..caf2e16 100644
--- a/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DOMFormDataCustom.cpp
@@ -34,11 +34,28 @@
 #include "DOMFormData.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
+#include "V8HTMLFormElement.h"
 #include "V8Proxy.h"
 #include "V8Utilities.h"
 
 namespace WebCore {
 
+v8::Handle<v8::Value> V8DOMFormData::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.FormData.Constructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::SyntaxError);
+
+    HTMLFormElement* form = 0;
+    if (args.Length() > 0 && V8HTMLFormElement::HasInstance(args[0]))
+        form = V8HTMLFormElement::toNative(args[0]->ToObject());
+    RefPtr<DOMFormData> domFormData = DOMFormData::create(form);
+
+    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, domFormData.get());
+    return toV8(domFormData.release(), args.Holder());
+}
+
 v8::Handle<v8::Value> V8DOMFormData::appendCallback(const v8::Arguments& args)
 {
     INC_STATS("DOM.FormData.append()");
diff --git a/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp b/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
index fc8cf98..a44131a 100644
--- a/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8DirectoryEntryCustom.cpp
@@ -70,8 +70,8 @@ v8::Handle<v8::Value> V8DirectoryEntry::getDirectoryCallback(const v8::Arguments
             flags->setExclusive(isExclusive);
         }
     } else {
-       EXCEPTION_BLOCK(Flags*, tmp_flags, V8Flags::HasInstance(args[1]) ? V8Flags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
-       flags = tmp_flags;
+        EXCEPTION_BLOCK(Flags*, tmp_flags, V8Flags::HasInstance(args[1]) ? V8Flags::toNative(v8::Handle<v8::Object>::Cast(args[1])) : 0);
+        flags = tmp_flags;
     }
     RefPtr<EntryCallback> successCallback;
     if (args.Length() > 2 && !args[2]->IsNull() && !args[2]->IsUndefined()) {
diff --git a/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp b/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
new file mode 100644
index 0000000..90b3d13
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8DirectoryEntrySyncCustom.cpp
@@ -0,0 +1,139 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8DirectoryEntrySync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DirectoryEntrySync.h"
+#include "ExceptionCode.h"
+#include "V8Binding.h"
+#include "V8BindingMacros.h"
+#include "V8EntryCallback.h"
+#include "V8ErrorCallback.h"
+#include "V8FileEntrySync.h"
+#include "V8Flags.h"
+#include "V8Proxy.h"
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+static bool extractBooleanValue(const v8::Handle<v8::Object>& object, const char* name, ExceptionCode& ec) {
+    ec = 0;
+    v8::Local<v8::Value> value = object->Get(v8::String::New(name));
+    if (!value.IsEmpty() && !isUndefinedOrNull(value)) {
+        v8::TryCatch block;
+        bool nativeValue = value->BooleanValue();
+        if (block.HasCaught()) {
+            ec = TYPE_MISMATCH_ERR;
+            return false;
+        }
+        return nativeValue;
+    }
+    return false;
+}
+
+static PassRefPtr<Flags> getFlags(const v8::Local<v8::Value>& arg, ExceptionCode& ec)
+{
+    ec = 0;
+    if (isUndefinedOrNull(arg) || !arg->IsObject())
+        return 0;
+    if (V8Flags::HasInstance(arg))
+        return V8Flags::toNative(v8::Handle<v8::Object>::Cast(arg));
+
+    v8::Handle<v8::Object> object;
+    {
+        v8::TryCatch block;
+        object = v8::Handle<v8::Object>::Cast(arg);
+        if (block.HasCaught()) {
+            ec = TYPE_MISMATCH_ERR;
+            return 0;
+        }
+    }
+
+    bool isCreate = extractBooleanValue(object, "create", ec);
+    if (ec)
+        return 0;
+    bool isExclusive = extractBooleanValue(object, "exclusive", ec);
+    if (ec)
+        return 0;
+
+    RefPtr<Flags> flags = Flags::create();
+    flags->setCreate(isCreate);
+    flags->setExclusive(isExclusive);
+
+    return flags;
+}
+
+v8::Handle<v8::Value> V8DirectoryEntrySync::getDirectoryCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.DirectoryEntrySync.getDirectory");
+    DirectoryEntrySync* imp = V8DirectoryEntrySync::toNative(args.Holder());
+    ExceptionCode ec = 0;
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, path, args[0]);
+    RefPtr<Flags> flags = getFlags(args[1], ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    RefPtr<DirectoryEntrySync> result = imp->getDirectory(path, flags, ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return toV8(result.release());
+}
+
+v8::Handle<v8::Value> V8DirectoryEntrySync::getFileCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.DirectoryEntrySync.getFile");
+    DirectoryEntrySync* imp = V8DirectoryEntrySync::toNative(args.Holder());
+    ExceptionCode ec = 0;
+    STRING_TO_V8PARAMETER_EXCEPTION_BLOCK(V8Parameter<>, path, args[0]);
+    RefPtr<Flags> flags = getFlags(args[1], ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    RefPtr<FileEntrySync> result = imp->getFile(path, flags, ec);
+    if (UNLIKELY(ec)) {
+        V8Proxy::setDOMException(ec);
+        return v8::Handle<v8::Value>();
+    }
+    return toV8(result.release());
+}
+
+
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/bindings/v8/custom/V8ElementCustom.cpp b/WebCore/bindings/v8/custom/V8ElementCustom.cpp
index 3f6cd6a..02fc457 100644
--- a/WebCore/bindings/v8/custom/V8ElementCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8ElementCustom.cpp
@@ -32,7 +32,6 @@
 #include "V8Element.h"
 
 #include "Attr.h"
-#include "CSSHelper.h"
 #include "Document.h"
 #include "Element.h"
 #include "ExceptionCode.h"
diff --git a/WebCore/bindings/v8/ScriptStringImpl.cpp b/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
index afe74b1..e98df19 100644
--- a/WebCore/bindings/v8/ScriptStringImpl.cpp
+++ b/WebCore/bindings/v8/custom/V8EntrySyncCustom.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -29,46 +29,33 @@
  */
 
 #include "config.h"
-#include "ScriptStringImpl.h"
+#include "EntrySync.h"
+
+#if ENABLE(FILE_SYSTEM)
 
+#include "V8Attr.h"
 #include "V8Binding.h"
+#include "V8BindingState.h"
+#include "V8DirectoryEntrySync.h"
+#include "V8EntrySync.h"
+#include "V8FileEntrySync.h"
+#include "V8Proxy.h"
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-ScriptStringImpl::ScriptStringImpl(const String& s)
-{
-    v8::HandleScope scope;
-    m_handle.set(v8String(s));
-}
-
-ScriptStringImpl::ScriptStringImpl(const char* s)
-{
-    v8::HandleScope scope;
-    m_handle.set(v8::String::New(s));
-}
-
-String ScriptStringImpl::toString() const
+v8::Handle<v8::Value> toV8(EntrySync* impl)
 {
-    return v8StringToWebCoreString(m_handle.get());
-}
-
-bool ScriptStringImpl::isNull() const
-{
-    return m_handle.get().IsEmpty();
-}
+    if (!impl)
+        return v8::Null();
 
-size_t ScriptStringImpl::size() const
-{
-    return m_handle.get()->Length();
-}
+    if (impl->isFile())
+        return toV8(static_cast<FileEntrySync*>(impl));
 
-void ScriptStringImpl::append(const String& s)
-{
-    v8::HandleScope scope;
-    if (m_handle.get().IsEmpty())
-        m_handle.set(v8String(s));
-    else
-        m_handle.set(v8::String::Concat(m_handle.get(), v8String(s)));
+    ASSERT(impl->isDirectory());
+    return toV8(static_cast<DirectoryEntrySync*>(impl));
 }
 
 } // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/bindings/v8/custom/V8FileReaderCustom.cpp b/WebCore/bindings/v8/custom/V8FileReaderCustom.cpp
new file mode 100755
index 0000000..5f4fb57
--- /dev/null
+++ b/WebCore/bindings/v8/custom/V8FileReaderCustom.cpp
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "V8FileReader.h"
+
+#include "ScriptExecutionContext.h"
+#include "V8Binding.h"
+
+namespace WebCore {
+
+v8::Handle<v8::Value> V8FileReader::constructorCallback(const v8::Arguments& args)
+{
+    INC_STATS("DOM.FileReader.Constructor");
+
+    if (!args.IsConstructCall())
+        return throwError("DOM object constructor cannot be called as a function.", V8Proxy::TypeError);
+
+    // Expect no parameters.
+    // Allocate a FileReader object as its internal field.
+    ScriptExecutionContext* context = getScriptExecutionContext();
+    if (!context)
+        return throwError("FileReader constructor's associated context is not available", V8Proxy::ReferenceError);
+    RefPtr<FileReader> fileReader = FileReader::create(context);
+    V8DOMWrapper::setDOMWrapper(args.Holder(), &info, fileReader.get());
+
+    // Add object to the wrapper map.
+    fileReader->ref();
+    V8DOMWrapper::setJSWrapperForActiveDOMObject(fileReader.get(), v8::Persistent<v8::Object>::New(args.Holder()));
+    return args.Holder();
+}
+
+} // namespace WebCore
diff --git a/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
index 93c5e91..c3dbe3b 100644
--- a/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Float32ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Float32Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Float32Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp b/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
index 3dffeb5..fd6f1a5 100644
--- a/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8IDBAnyCustom.cpp
@@ -38,6 +38,7 @@
 #include "V8IDBIndex.h"
 #include "V8IDBKey.h"
 #include "V8IDBObjectStore.h"
+#include "V8IDBTransaction.h"
 
 namespace WebCore {
 
@@ -55,14 +56,16 @@ v8::Handle<v8::Value> toV8(IDBAny* impl)
         return toV8(impl->idbCursor());
     case IDBAny::IDBDatabaseType:
         return toV8(impl->idbDatabase());
+    case IDBAny::IDBFactoryType:
+        return toV8(impl->idbFactory());
     case IDBAny::IDBIndexType:
         return toV8(impl->idbIndex());
     case IDBAny::IDBKeyType:
         return toV8(impl->idbKey());
     case IDBAny::IDBObjectStoreType:
         return toV8(impl->idbObjectStore());
-    case IDBAny::IDBFactoryType:
-        return toV8(impl->idbFactory());
+    case IDBAny::IDBTransactionType:
+        return toV8(impl->idbTransaction());
     case IDBAny::SerializedScriptValueType:
         return impl->serializedScriptValue()->deserialize();
     }
diff --git a/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
index 515af24..244a231 100644
--- a/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Int16ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Int16Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Int16Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
index 46087aa..a5001ed 100644
--- a/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Int32ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Int32Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Int32Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
index f941111..526d83e 100644
--- a/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Int8ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Int8Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Int8Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8LocationCustom.cpp b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
index 6068aa2..34c7e28 100644
--- a/WebCore/bindings/v8/custom/V8LocationCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8LocationCustom.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "V8Location.h"
 
-#include "CSSHelper.h"
 #include "Document.h"
 #include "Frame.h"
 #include "FrameLoader.h"
@@ -283,7 +282,7 @@ v8::Handle<v8::Value> V8Location::reloadCallback(const v8::Arguments& args)
         return v8::Undefined();
 
     if (!protocolIsJavaScript(frame->loader()->url()))
-        frame->redirectScheduler()->scheduleRefresh(processingUserGesture());
+        frame->navigationScheduler()->scheduleRefresh();
     return v8::Undefined();
 }
 
diff --git a/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
index 5569253..e3ae263 100644
--- a/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Uint16ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Uint16Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Uint16Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
index c1521cf..6c60283 100644
--- a/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Uint32ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Uint32Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Uint32Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp b/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
index 73f995c..ea9f421 100644
--- a/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8Uint8ArrayCustom.cpp
@@ -30,7 +30,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 #include "Uint8Array.h"
@@ -68,4 +68,4 @@ v8::Handle<v8::Value> toV8(Uint8Array* impl)
 
 } // namespace WebCore
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
index 2355d2a..393e544 100644
--- a/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
+++ b/WebCore/bindings/v8/custom/V8XMLHttpRequestCustom.cpp
@@ -32,7 +32,7 @@
 #include "V8XMLHttpRequest.h"
 
 #include "Frame.h"
-#include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "V8Binding.h"
 #include "V8Blob.h"
 #include "V8DOMFormData.h"
@@ -51,10 +51,10 @@ v8::Handle<v8::Value> V8XMLHttpRequest::responseTextAccessorGetter(v8::Local<v8:
     INC_STATS("DOM.XMLHttpRequest.responsetext._get");
     XMLHttpRequest* xmlHttpRequest = V8XMLHttpRequest::toNative(info.Holder());
     ExceptionCode ec = 0;
-    const ScriptString& text = xmlHttpRequest->responseText(ec);
+    const String& text = xmlHttpRequest->responseText(ec);
     if (ec)
         return throwError(ec);
-    return text.v8StringOrNull();
+    return v8String(text);
 }
 
 v8::Handle<v8::Value> V8XMLHttpRequest::openCallback(const v8::Arguments& args)
@@ -114,7 +114,7 @@ v8::Handle<v8::Value> V8XMLHttpRequest::sendCallback(const v8::Arguments& args)
     INC_STATS("DOM.XMLHttpRequest.send()");
     XMLHttpRequest* xmlHttpRequest = V8XMLHttpRequest::toNative(args.Holder());
 
-    InspectorController::instrumentWillSendXMLHttpRequest(xmlHttpRequest->scriptExecutionContext(), xmlHttpRequest->url());
+    InspectorInstrumentation::willSendXMLHttpRequest(xmlHttpRequest->scriptExecutionContext(), xmlHttpRequest->url());
 
     ExceptionCode ec = 0;
     if (args.Length() < 1)
diff --git a/WebCore/bridge/c/c_instance.cpp b/WebCore/bridge/c/c_instance.cpp
index 2db009e..03e72fc 100644
--- a/WebCore/bridge/c/c_instance.cpp
+++ b/WebCore/bridge/c/c_instance.cpp
@@ -165,7 +165,7 @@ JSValue CInstance::invokeMethod(ExecState* exec, RuntimeMethod* runtimeMethod)
     }
     
     if (!retval)
-        throwError(exec, createError(exec, "Error calling method on NPObject!"));
+        throwError(exec, createError(exec, "Error calling method on NPObject."));
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -200,7 +200,7 @@ JSValue CInstance::invokeDefaultMethod(ExecState* exec)
     }
     
     if (!retval)
-        throwError(exec, createError(exec, "Error calling method on NPObject!"));
+        throwError(exec, createError(exec, "Error calling method on NPObject."));
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
@@ -239,7 +239,7 @@ JSValue CInstance::invokeConstruct(ExecState* exec, const ArgList& args)
     }
     
     if (!retval)
-        throwError(exec, createError(exec, "Error calling method on NPObject!"));
+        throwError(exec, createError(exec, "Error calling method on NPObject."));
 
     for (i = 0; i < count; i++)
         _NPN_ReleaseVariantValue(&cArgs[i]);
diff --git a/WebCore/bridge/jni/JNIBridge.cpp b/WebCore/bridge/jni/JNIBridge.cpp
index 8fa2678..c512ee7 100644
--- a/WebCore/bridge/jni/JNIBridge.cpp
+++ b/WebCore/bridge/jni/JNIBridge.cpp
@@ -29,14 +29,11 @@
 
 #if ENABLE(JAVA_BRIDGE)
 
-#include "StringBuilder.h"
 #include <wtf/text/CString.h>
-
+#include <wtf/text/StringBuilder.h>
 
 using namespace JSC;
 using namespace JSC::Bindings;
-using namespace WebCore;
-
 
 JavaParameter::JavaParameter(JNIEnv* env, jstring type)
 {
@@ -132,7 +129,7 @@ const char* JavaMethod::signature() const
 #endif
 
         StringBuilder signatureBuilder;
-        signatureBuilder.append("(");
+        signatureBuilder.append('(');
         for (int i = 0; i < m_numParameters; i++) {
             JavaParameter* aParameter = parameterAt(i);
             JNIType type = aParameter->getJNIType();
@@ -142,11 +139,11 @@ const char* JavaMethod::signature() const
                 signatureBuilder.append(signatureFromPrimitiveType(type));
                 if (type == object_type) {
                     appendClassName(signatureBuilder, aParameter->type());
-                    signatureBuilder.append(";");
+                    signatureBuilder.append(';');
                 }
             }
         }
-        signatureBuilder.append(")");
+        signatureBuilder.append(')');
 
         const char* returnType = m_returnType.utf8();
         if (m_JNIReturnType == array_type)
@@ -155,7 +152,7 @@ const char* JavaMethod::signature() const
             signatureBuilder.append(signatureFromPrimitiveType(m_JNIReturnType));
             if (m_JNIReturnType == object_type) {
                 appendClassName(signatureBuilder, returnType);
-                signatureBuilder.append(";");
+                signatureBuilder.append(';');
             }
         }
 
diff --git a/WebCore/bridge/npapi.h b/WebCore/bridge/npapi.h
index 6b8556d..48e78c0 100644
--- a/WebCore/bridge/npapi.h
+++ b/WebCore/bridge/npapi.h
@@ -528,6 +528,8 @@ typedef struct _NPPrint
 #if defined(XP_MACOSX)
 #ifndef NP_NO_CARBON
 typedef EventRecord NPEvent;
+#else
+typedef void*  NPEvent;
 #endif
 #elif defined(XP_SYMBIAN)
 typedef QEvent NPEvent;
@@ -691,10 +693,6 @@ enum NPEventType {
   NPEventType_ScrollingBeginsEvent = 1000,
   NPEventType_ScrollingEndsEvent
 };
-/* Obsolete versions of the above */
-#define getFocusEvent        (osEvt + 16)
-#define loseFocusEvent        (osEvt + 17)
-#define adjustCursorEvent   (osEvt + 18)
 #endif /* NP_NO_CARBON */
 
 #endif /* XP_MACOSX */
diff --git a/WebCore/css/CSSBorderImageValue.cpp b/WebCore/css/CSSBorderImageValue.cpp
index 3260af4..8d4721a 100644
--- a/WebCore/css/CSSBorderImageValue.cpp
+++ b/WebCore/css/CSSBorderImageValue.cpp
@@ -34,6 +34,10 @@ CSSBorderImageValue::CSSBorderImageValue(PassRefPtr<CSSValue> image, PassRefPtr<
 {
 }
 
+CSSBorderImageValue::~CSSBorderImageValue()
+{
+}
+
 String CSSBorderImageValue::cssText() const
 {
     // Image first.
diff --git a/WebCore/css/CSSBorderImageValue.h b/WebCore/css/CSSBorderImageValue.h
index 23832b8..a17df7d 100644
--- a/WebCore/css/CSSBorderImageValue.h
+++ b/WebCore/css/CSSBorderImageValue.h
@@ -35,6 +35,7 @@ public:
     {
         return adoptRef(new CSSBorderImageValue(image, sliceRect, horizontalRule, verticalRule));
     }
+    virtual ~CSSBorderImageValue();
 
     virtual String cssText() const;
 
diff --git a/WebCore/css/CSSComputedStyleDeclaration.cpp b/WebCore/css/CSSComputedStyleDeclaration.cpp
index 1d574ab..44cfd74 100644
--- a/WebCore/css/CSSComputedStyleDeclaration.cpp
+++ b/WebCore/css/CSSComputedStyleDeclaration.cpp
@@ -127,6 +127,7 @@ static const int computedProperties[] = {
     CSSPropertyPosition,
     CSSPropertyResize,
     CSSPropertyRight,
+    CSSPropertySpeak,
     CSSPropertyTableLayout,
     CSSPropertyTextAlign,
     CSSPropertyTextDecoration,
@@ -162,7 +163,6 @@ static const int computedProperties[] = {
     CSSPropertyWebkitBackgroundComposite,
     CSSPropertyWebkitBackgroundOrigin,
     CSSPropertyWebkitBackgroundSize,
-    CSSPropertyWebkitBlockFlow,
     CSSPropertyWebkitBorderFit,
     CSSPropertyWebkitBorderHorizontalSpacing,
     CSSPropertyWebkitBorderImage,
@@ -229,7 +229,8 @@ static const int computedProperties[] = {
     CSSPropertyWebkitTransitionTimingFunction,
     CSSPropertyWebkitUserDrag,
     CSSPropertyWebkitUserModify,
-    CSSPropertyWebkitUserSelect
+    CSSPropertyWebkitUserSelect,
+    CSSPropertyWebkitWritingMode
 
 #if ENABLE(SVG)
     ,
@@ -753,10 +754,14 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
     if (!style)
         return 0;
 
+<<<<<<< HEAD
     propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->blockFlow());
 #ifdef ANDROID_LAYOUT
     const Settings * settings = node->document()->frame() ? node->document()->frame()->settings() : 0; 
 #endif
+=======
+    propertyID = CSSProperty::resolveDirectionAwareProperty(propertyID, style->direction(), style->writingMode());
+>>>>>>> webkit.org at r70209
 
     switch (static_cast<CSSPropertyID>(propertyID)) {
         case CSSPropertyInvalid:
@@ -1407,8 +1412,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->appearance());
         case CSSPropertyWebkitBackfaceVisibility:
             return CSSPrimitiveValue::createIdentifier((style->backfaceVisibility() == BackfaceVisibilityHidden) ? CSSValueHidden : CSSValueVisible);
-        case CSSPropertyWebkitBlockFlow:
-            return CSSPrimitiveValue::create(style->blockFlow());
         case CSSPropertyWebkitBorderImage:
             return valueForNinePieceImage(style->borderImage());
         case CSSPropertyWebkitMaskBoxImage:
@@ -1416,8 +1419,10 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyWebkitFontSizeDelta:
             // Not a real style property -- used by the editing engine -- so has no computed value.
             break;
+        case CSSPropertyWebkitMarginBottomCollapse:
         case CSSPropertyWebkitMarginAfterCollapse:
             return CSSPrimitiveValue::create(style->marginAfterCollapse());
+        case CSSPropertyWebkitMarginTopCollapse:
         case CSSPropertyWebkitMarginBeforeCollapse:
             return CSSPrimitiveValue::create(style->marginBeforeCollapse());
         case CSSPropertyWebkitPerspective:
@@ -1463,6 +1468,8 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             rect->setLeft(zoomAdjustedPixelValue(style->clip().left().value(), style.get()));
             return CSSPrimitiveValue::create(rect.release());
         }
+        case CSSPropertySpeak:
+            return CSSPrimitiveValue::create(style->speak());
         case CSSPropertyWebkitTransform:
             return computedTransform(renderer, style.get());
         case CSSPropertyWebkitTransformOrigin: {
@@ -1512,7 +1519,9 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::create(style->pointerEvents());
         case CSSPropertyWebkitColorCorrection:
             return CSSPrimitiveValue::create(style->colorSpace());
-
+        case CSSPropertyWebkitWritingMode:
+            return CSSPrimitiveValue::create(style->writingMode());
+        
         /* Shorthand properties, currently not supported see bug 13658*/
         case CSSPropertyBackground:
         case CSSPropertyBorder:
@@ -1528,7 +1537,6 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
         case CSSPropertyListStyle:
         case CSSPropertyMargin:
         case CSSPropertyPadding:
-        case CSSPropertyWebkitWritingMode:
             break;
 
         /* Unimplemented CSS 3 properties (including CSS3 shorthand properties) */
@@ -1650,10 +1658,47 @@ PassRefPtr<CSSValue> CSSComputedStyleDeclaration::getPropertyCSSValue(int proper
             return CSSPrimitiveValue::createColor(style->tapHighlightColor().rgb());
 #endif
 #if ENABLE(SVG)
-        // FIXME: This default case ruins the point of using an enum for
-        // properties -- it prevents us from getting a warning when we
-        // forget to list a property above.
-        default:
+        case CSSPropertyClipPath:
+        case CSSPropertyClipRule:
+        case CSSPropertyMask:
+        case CSSPropertyEnableBackground:
+        case CSSPropertyFilter:
+        case CSSPropertyFloodColor:
+        case CSSPropertyFloodOpacity:
+        case CSSPropertyLightingColor:
+        case CSSPropertyStopColor:
+        case CSSPropertyStopOpacity:
+        case CSSPropertyColorInterpolation:
+        case CSSPropertyColorInterpolationFilters:
+        case CSSPropertyColorProfile:
+        case CSSPropertyColorRendering:
+        case CSSPropertyFill:
+        case CSSPropertyFillOpacity:
+        case CSSPropertyFillRule:
+        case CSSPropertyImageRendering:
+        case CSSPropertyMarker:
+        case CSSPropertyMarkerEnd:
+        case CSSPropertyMarkerMid:
+        case CSSPropertyMarkerStart:
+        case CSSPropertyShapeRendering:
+        case CSSPropertyStroke:
+        case CSSPropertyStrokeDasharray:
+        case CSSPropertyStrokeDashoffset:
+        case CSSPropertyStrokeLinecap:
+        case CSSPropertyStrokeLinejoin:
+        case CSSPropertyStrokeMiterlimit:
+        case CSSPropertyStrokeOpacity:
+        case CSSPropertyStrokeWidth:
+        case CSSPropertyAlignmentBaseline:
+        case CSSPropertyBaselineShift:
+        case CSSPropertyDominantBaseline:
+        case CSSPropertyGlyphOrientationHorizontal:
+        case CSSPropertyGlyphOrientationVertical:
+        case CSSPropertyKerning:
+        case CSSPropertyTextAnchor:
+        case CSSPropertyVectorEffect:
+        case CSSPropertyWritingMode:
+        case CSSPropertyWebkitSvgShadow:
             return getSVGPropertyCSSValue(propertyID, DoNotUpdateLayout);
 #endif
     }
diff --git a/WebCore/css/CSSFontFaceSrcValue.cpp b/WebCore/css/CSSFontFaceSrcValue.cpp
index 5b204d7..d951e5d 100644
--- a/WebCore/css/CSSFontFaceSrcValue.cpp
+++ b/WebCore/css/CSSFontFaceSrcValue.cpp
@@ -31,6 +31,10 @@
 
 namespace WebCore {
 
+CSSFontFaceSrcValue::~CSSFontFaceSrcValue()
+{
+}
+
 #if ENABLE(SVG_FONTS)
 bool CSSFontFaceSrcValue::isSVGFontFaceSrc() const
 {
diff --git a/WebCore/css/CSSFontFaceSrcValue.h b/WebCore/css/CSSFontFaceSrcValue.h
index 22f1be7..570652d 100644
--- a/WebCore/css/CSSFontFaceSrcValue.h
+++ b/WebCore/css/CSSFontFaceSrcValue.h
@@ -47,7 +47,7 @@ public:
         return adoptRef(new CSSFontFaceSrcValue(resource, true));
     }
 
-    virtual ~CSSFontFaceSrcValue() { }
+    virtual ~CSSFontFaceSrcValue();
 
     const String& resource() const { return m_resource; }
     const String& format() const { return m_format; }
diff --git a/WebCore/css/CSSFunctionValue.h b/WebCore/css/CSSFunctionValue.h
index e9545a1..1d73f33 100644
--- a/WebCore/css/CSSFunctionValue.h
+++ b/WebCore/css/CSSFunctionValue.h
@@ -40,14 +40,14 @@ public:
         return adoptRef(new CSSFunctionValue(function));
     }
 
-    ~CSSFunctionValue();
+    virtual ~CSSFunctionValue();
     
     virtual String cssText() const;
 
     virtual CSSParserValue parserValue() const;
 
 private:
-    CSSFunctionValue(CSSParserFunction*);
+    explicit CSSFunctionValue(CSSParserFunction*);
     
     String m_name;
     RefPtr<CSSValueList> m_args;
diff --git a/WebCore/css/CSSGrammar.y b/WebCore/css/CSSGrammar.y
index c55f998..c0139a2 100644
--- a/WebCore/css/CSSGrammar.y
+++ b/WebCore/css/CSSGrammar.y
@@ -408,7 +408,9 @@ rule_list:
  ;
 
 valid_rule:
-    ruleset
+    before_ruleset ruleset {
+        $$ = $2;
+    }
   | media
   | page
   | font_face
@@ -910,8 +912,22 @@ maybe_space_before_declaration:
     }
   ;
 
+before_ruleset:
+    /* empty */ {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        p->markSelectorListStart();
+    }
+  ;
+
+before_rule_opening_brace:
+    /* empty */ {
+        CSSParser* p = static_cast<CSSParser*>(parser);
+        p->markSelectorListEnd();
+    }
+  ;
+
 ruleset:
-    selector_list '{' maybe_space_before_declaration declaration_list closing_brace {
+    selector_list before_rule_opening_brace '{' maybe_space_before_declaration declaration_list closing_brace {
         CSSParser* p = static_cast<CSSParser*>(parser);
         $$ = p->createStyleRule($1);
     }
diff --git a/WebCore/css/CSSHelper.cpp b/WebCore/css/CSSHelper.cpp
deleted file mode 100644
index e0ce7c3..0000000
--- a/WebCore/css/CSSHelper.cpp
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
- * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "CSSHelper.h"
-
-#include "PlatformString.h"
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-String deprecatedParseURL(const String& url)
-{
-    StringImpl* i = url.impl();
-    if (!i)
-        return url;
-
-    int length = i->length();
-
-    int o = 0;
-    int l = length;
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    if (l >= 5
-            && ((*i)[o] == 'u' || (*i)[o] == 'U')
-            && ((*i)[o + 1] == 'r' || (*i)[o + 1] == 'R')
-            && ((*i)[o + 2] == 'l' || (*i)[o + 2] == 'L')
-            && (*i)[o + 3] == '('
-            && (*i)[o + l - 1] == ')') {
-        o += 4;
-        l -= 5;
-    }
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    if (l >= 2 && (*i)[o] == (*i)[o + l - 1] && ((*i)[o] == '\'' || (*i)[o] == '\"')) {
-        o++;
-        l -= 2;
-    }
-
-    while (0 < l && (*i)[o] <= ' ') {
-        ++o;
-        --l;
-    }
-    while (l > 0 && (*i)[o + l - 1] <= ' ')
-        --l;
-
-    const UChar* characters = i->characters();
-
-    // Optimize for the likely case there there is nothing to strip.
-    if (l == length) {
-        int k;
-        // If the URL has any control characters in it, we have to strip them.
-        // '\r' (ascii value 13) is the largest control character.
-        for (k = 0; k < length; k++) {
-            if (characters[k] <= '\r')
-                break;
-        }
-        if (k == length)
-            return url;
-    }
-
-    Vector<UChar, 2048> buffer(l);
-
-    int nl = 0;
-    for (int k = o; k < o + l; k++) {
-        UChar c = characters[k];
-        if (c > '\r')
-            buffer[nl++] = c;
-    }
-
-    return String(buffer.data(), nl);
-}
-
-} // namespace WebCore
diff --git a/WebCore/css/CSSHelper.h b/WebCore/css/CSSHelper.h
index ffd9166..6f2ffca 100644
--- a/WebCore/css/CSSHelper.h
+++ b/WebCore/css/CSSHelper.h
@@ -26,10 +26,6 @@
 
 namespace WebCore {
 
-// Used in many inappropriate contexts throughout WebCore. Most callers should be using
-// stripLeadingAndTrailingHTMLSpaces instead.
-String deprecatedParseURL(const String&);
-
 // We always assume 96 CSS pixels in a CSS inch. This is the cold hard truth of the Web.
 // At high DPI, we may scale a CSS pixel, but the ratio of the CSS pixel to the so-called
 // "absolute" CSS length units like inch and pt is always fixed and never changes.
diff --git a/WebCore/css/CSSMutableStyleDeclaration.cpp b/WebCore/css/CSSMutableStyleDeclaration.cpp
index f620be1..708e2eb 100644
--- a/WebCore/css/CSSMutableStyleDeclaration.cpp
+++ b/WebCore/css/CSSMutableStyleDeclaration.cpp
@@ -424,18 +424,16 @@ String CSSMutableStyleDeclaration::getCommonValue(const int* properties, int num
 {
     String res;
     for (int i = 0; i < number; ++i) {
-        if (!isPropertyImplicit(properties[i])) {
-            RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
-            if (!value)
-                return String();
-            String text = value->cssText();
-            if (text.isNull())
-                return String();
-            if (res.isNull())
-                res = text;
-            else if (res != text)
-                return String();
-        }
+        RefPtr<CSSValue> value = getPropertyCSSValue(properties[i]);
+        if (!value)
+            return String();
+        String text = value->cssText();
+        if (text.isNull())
+            return String();
+        if (res.isNull())
+            res = text;
+        else if (res != text)
+            return String();
     }
     return res;
 }
diff --git a/WebCore/css/CSSParser.cpp b/WebCore/css/CSSParser.cpp
index 0347d69..f098a9f 100644
--- a/WebCore/css/CSSParser.cpp
+++ b/WebCore/css/CSSParser.cpp
@@ -25,16 +25,14 @@
 #include "config.h"
 #include "CSSParser.h"
 
-#include "CSSTimingFunctionValue.h"
 #include "CSSBorderImageValue.h"
 #include "CSSCanvasValue.h"
 #include "CSSCharsetRule.h"
 #include "CSSCursorImageValue.h"
-#include "CSSHelper.h"
-#include "CSSImageValue.h"
 #include "CSSFontFaceRule.h"
 #include "CSSFontFaceSrcValue.h"
 #include "CSSGradientValue.h"
+#include "CSSImageValue.h"
 #include "CSSImportRule.h"
 #include "CSSInheritedValue.h"
 #include "CSSInitialValue.h"
@@ -51,6 +49,7 @@
 #include "CSSSelector.h"
 #include "CSSStyleRule.h"
 #include "CSSStyleSheet.h"
+#include "CSSTimingFunctionValue.h"
 #include "CSSUnicodeRangeValue.h"
 #include "CSSValueKeywords.h"
 #include "CSSValueList.h"
@@ -62,6 +61,7 @@
 #include "FloatConversion.h"
 #include "FontFamilyValue.h"
 #include "FontValue.h"
+#include "HTMLParserIdioms.h"
 #include "HashTools.h"
 #include "MediaList.h"
 #include "MediaQueryExp.h"
@@ -148,12 +148,11 @@ CSSParser::CSSParser(bool strictParsing)
     , m_hasFontFaceOnlyValues(false)
     , m_hadSyntacticallyValidCSSRule(false)
     , m_defaultNamespace(starAtom)
-    , m_ruleBodyStartOffset(0)
-    , m_ruleBodyEndOffset(0)
-    , m_propertyStartOffset(UINT_MAX)
-    , m_propertyEndOffset(UINT_MAX)
+    , m_selectorListRange(0, 0)
+    , m_ruleBodyRange(0, 0)
+    , m_propertyRange(UINT_MAX, UINT_MAX)
     , m_ruleRangeMap(0)
-    , m_currentStyleData(0)
+    , m_currentRuleData(0)
     , m_data(0)
     , yy_start(1)
     , m_lineNumber(0)
@@ -236,14 +235,16 @@ void CSSParser::parseSheet(CSSStyleSheet* sheet, const String& string, int start
     m_styleSheet = sheet;
     m_defaultNamespace = starAtom; // Reset the default namespace.
     m_ruleRangeMap = ruleRangeMap;
-    if (ruleRangeMap)
-        m_currentStyleData = CSSStyleSourceData::create();
+    if (ruleRangeMap) {
+        m_currentRuleData = CSSRuleSourceData::create();
+        m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
+    }
 
     m_lineNumber = startLineNumber;
     setupParser("", string, "");
     cssyyparse(this);
     m_ruleRangeMap = 0;
-    m_currentStyleData = 0;
+    m_currentRuleData = 0;
     m_rule = 0;
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
@@ -373,7 +374,7 @@ void CSSParser::parseSelector(const String& string, Document* doc, CSSSelectorLi
 #endif
 }
 
-bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const String& string, CSSStyleSourceData* styleSourceData)
+bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const String& string, RefPtr<CSSStyleSourceData>* styleSourceData)
 {
 #ifdef ANDROID_INSTRUMENT
     android::TimeCounter::start(android::TimeCounter::CSSParseTimeCounter);
@@ -384,7 +385,10 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
 
     ASSERT(!declaration->stylesheet() || declaration->stylesheet()->isCSSStyleSheet());
     m_styleSheet = static_cast<CSSStyleSheet*>(declaration->stylesheet());
-    m_currentStyleData = styleSourceData;
+    if (styleSourceData) {
+        m_currentRuleData = CSSRuleSourceData::create();
+        m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
+    }
 
     setupParser("@-webkit-decls{", string, "} ");
     cssyyparse(this);
@@ -399,15 +403,16 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
         clearProperties();
     }
 
-    if (m_currentStyleData) {
-        m_currentStyleData->styleBodyRange.start = 0;
-        m_currentStyleData->styleBodyRange.end = string.length();
-        for (Vector<CSSPropertySourceData>::iterator it = m_currentStyleData->propertyData.begin(); it != m_currentStyleData->propertyData.end(); ++it) {
+    if (m_currentRuleData) {
+        m_currentRuleData->styleSourceData->styleBodyRange.start = 0;
+        m_currentRuleData->styleSourceData->styleBodyRange.end = string.length();
+        for (Vector<CSSPropertySourceData>::iterator it = m_currentRuleData->styleSourceData->propertyData.begin(), endIt = m_currentRuleData->styleSourceData->propertyData.end(); it != endIt; ++it) {
             (*it).range.start -= prefixLength;
             (*it).range.end -= prefixLength;
         }
     }
 
+<<<<<<< HEAD
     if (!m_ruleRangeMap)
         m_currentStyleData = 0;
 
@@ -415,6 +420,12 @@ bool CSSParser::parseDeclaration(CSSMutableStyleDeclaration* declaration, const
     android::TimeCounter::record(android::TimeCounter::CSSParseTimeCounter, __FUNCTION__);
 #endif
 
+=======
+    if (styleSourceData) {
+        *styleSourceData = m_currentRuleData->styleSourceData.release();
+        m_currentRuleData = 0;
+    }
+>>>>>>> webkit.org at r70209
     return ok;
 }
 
@@ -1056,7 +1067,12 @@ bool CSSParser::parseValue(int propId, bool important)
         if (id == CSSValueNormal || id == CSSValueBreakWord)
             validPrimitive = true;
         break;
-
+    case CSSPropertySpeak:           // none | normal | spell-out | digits | literal-punctuation | no-punctuation | inherit
+        if (id == CSSValueNone || id == CSSValueNormal || id == CSSValueSpellOut || id == CSSValueDigits 
+            || id == CSSValueLiteralPunctuation || id == CSSValueNoPunctuation)
+            validPrimitive = true;
+        break;
+            
     case CSSPropertyTextIndent:          // <length> | <percentage> | inherit
         validPrimitive = (!id && validUnit(value, FLength | FPercent, m_strict));
         break;
@@ -1826,15 +1842,8 @@ bool CSSParser::parseValue(int propId, bool important)
 #endif
 
     // CSS Text Layout Module Level 3: Vertical writing support
-    case CSSPropertyWebkitBlockFlow:
-        // [ "tb" | "rl" | "lr" | "bt" ]
-        if (id == CSSValueTb || id == CSSValueRl || id == CSSValueLr || id == CSSValueBt)
-            validPrimitive = true;
-        break;
-
     case CSSPropertyWebkitWritingMode:
-        // [ "lr-tb" | "rl-tb" | "tb-rl" | "bt-rl" | "tb-lr" | "bt-lr" ]
-        if (id == CSSValueLrTb || id == CSSValueRlTb || id == CSSValueTbRl || id == CSSValueBtRl || id == CSSValueTbLr || id == CSSValueBtLr)
+        if (id >= CSSValueHorizontalTb && id <= CSSValueHorizontalBt)
             validPrimitive = true;
         break;
 
@@ -3849,17 +3858,12 @@ bool CSSParser::parseFontFaceUnicodeRange()
     return true;
 }
 
-static inline bool isCSSWhitespace(UChar c)
-{
-    return c == ' ' || c == '\t' || c == '\r' || c == '\n' || c == '\f';
-}
-
 static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar terminator, int& value)
 {
     const UChar* current = string;
     int localValue = 0;
     bool negative = false;
-    while (current != end && isCSSWhitespace(*current))
+    while (current != end && isHTMLSpace(*current))
         current++;
     if (current != end && *current == '-') {
         negative = true;
@@ -3878,7 +3882,7 @@ static inline bool parseColorInt(const UChar*& string, const UChar* end, UChar t
         }
         localValue = newValue;
     }
-    while (current != end && isCSSWhitespace(*current))
+    while (current != end && isHTMLSpace(*current))
         current++;
     if (current == end || *current++ != terminator)
         return false;
@@ -3903,7 +3907,7 @@ static inline bool isTenthAlpha(const UChar* string, const int length)
 
 static inline bool parseAlphaValue(const UChar*& string, const UChar* end, UChar terminator, int& value)
 {
-    while (string != end && isCSSWhitespace(*string))
+    while (string != end && isHTMLSpace(*string))
         string++;
 
     value = 0;
@@ -5287,11 +5291,11 @@ UChar* CSSParser::text(int *length)
         start += 4;
         l -= 5;
         // strip {w}
-        while (l && isCSSWhitespace(*start)) {
+        while (l && isHTMLSpace(*start)) {
             ++start;
             --l;
         }
-        while (l && isCSSWhitespace(start[l - 1]))
+        while (l && isHTMLSpace(start[l - 1]))
             --l;
         if (l && (*start == '"' || *start == '\'')) {
             ASSERT(l >= 2 && start[l - 1] == *start);
@@ -5305,11 +5309,11 @@ UChar* CSSParser::text(int *length)
         start += 12;
         l -= 13;
         // strip {w}
-        while (l && isCSSWhitespace(*start)) {
+        while (l && isHTMLSpace(*start)) {
             ++start;
             --l;
         }
-        while (l && isCSSWhitespace(start[l - 1]))
+        while (l && isHTMLSpace(start[l - 1]))
             --l;
         break;
     default:
@@ -5361,7 +5365,7 @@ UChar* CSSParser::text(int *length)
                 uc = 0xfffd;
             *out++ = uc;
             escape = 0;
-            if (isCSSWhitespace(*current))
+            if (isHTMLSpace(*current))
                 continue;
         }
         if (!escape && *current == '\\') {
@@ -5573,12 +5577,15 @@ CSSRule* CSSParser::createStyleRule(Vector<CSSSelector*>* selectors)
         result = rule.get();
         m_parsedStyleObjects.append(rule.release());
         if (m_ruleRangeMap) {
-            ASSERT(m_currentStyleData);
-            m_currentStyleData->styleBodyRange = SourceRange(m_ruleBodyStartOffset, m_ruleBodyEndOffset);
-            m_ruleRangeMap->set(result, m_currentStyleData.release());
-            m_currentStyleData = CSSStyleSourceData::create();
+            ASSERT(m_currentRuleData);
+            m_currentRuleData->styleSourceData->styleBodyRange = m_ruleBodyRange;
+            m_currentRuleData->selectorListRange = m_selectorListRange;
+            m_ruleRangeMap->set(result, m_currentRuleData.release());
+            m_currentRuleData = CSSRuleSourceData::create();
+            m_currentRuleData->styleSourceData = CSSStyleSourceData::create();
         }
     }
+    resetSelectorListMarks();
     resetRuleBodyMarks();
     clearProperties();
     return result;
@@ -5833,26 +5840,44 @@ void CSSParser::updateLastSelectorLineAndPosition()
     markRuleBodyStart();
 }
 
+void CSSParser::markSelectorListStart()
+{
+    m_selectorListRange.start = yytext - m_data;
+}
+
+void CSSParser::markSelectorListEnd()
+{
+    if (!m_currentRuleData)
+        return;
+    UChar* listEnd = yytext;
+    while (listEnd > m_data + 1) {
+        if (isHTMLSpace(*(listEnd - 1)))
+            --listEnd;
+        else
+            break;
+    }
+    m_selectorListRange.end = listEnd - m_data;
+}
+
 void CSSParser::markRuleBodyStart()
 {
     unsigned offset = yytext - m_data;
     if (*yytext == '{')
         ++offset; // Skip the rule body opening brace.
-    if (offset > m_ruleBodyStartOffset)
-        m_ruleBodyStartOffset = offset;
+    if (offset > m_ruleBodyRange.start)
+        m_ruleBodyRange.start = offset;
 }
 
 void CSSParser::markRuleBodyEnd()
 {
     unsigned offset = yytext - m_data;
-    if (offset > m_ruleBodyEndOffset)
-        m_ruleBodyEndOffset = offset;
+    if (offset > m_ruleBodyRange.end)
+        m_ruleBodyRange.end = offset;
 }
 
 void CSSParser::markPropertyStart()
 {
-    unsigned offset = yytext - m_data;
-    m_propertyStartOffset = offset;
+    m_propertyRange.start = yytext - m_data;
 }
 
 void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
@@ -5860,11 +5885,11 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
     unsigned offset = yytext - m_data;
     if (*yytext == ';') // Include semicolon into the property text.
         ++offset;
-    m_propertyEndOffset = offset;
-    if (m_propertyStartOffset != UINT_MAX && m_currentStyleData) {
+    m_propertyRange.end = offset;
+    if (m_propertyRange.start != UINT_MAX && m_currentRuleData) {
         // This stuff is only executed when the style data retrieval is requested by client.
-        const unsigned start = m_propertyStartOffset;
-        const unsigned end = m_propertyEndOffset;
+        const unsigned start = m_propertyRange.start;
+        const unsigned end = m_propertyRange.end;
         ASSERT(start < end);
         String propertyString = String(m_data + start, end - start).stripWhiteSpace();
         if (propertyString.endsWith(";", true))
@@ -5876,8 +5901,8 @@ void CSSParser::markPropertyEnd(bool isImportantFound, bool isPropertyParsed)
         String name = propertyString.left(colonIndex).stripWhiteSpace();
         String value = propertyString.substring(colonIndex + 1, propertyString.length()).stripWhiteSpace();
         // The property range is relative to the declaration start offset.
-        m_currentStyleData->propertyData.append(
-            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(m_propertyStartOffset - m_ruleBodyStartOffset, m_propertyEndOffset - m_ruleBodyStartOffset)));
+        m_currentRuleData->styleSourceData->propertyData.append(
+            CSSPropertySourceData(name, value, isImportantFound, isPropertyParsed, SourceRange(start - m_ruleBodyRange.start, end - m_ruleBodyRange.start)));
     }
     resetPropertyMarks();
 }
diff --git a/WebCore/css/CSSParser.h b/WebCore/css/CSSParser.h
index f8b24df..8f3c6dd 100644
--- a/WebCore/css/CSSParser.h
+++ b/WebCore/css/CSSParser.h
@@ -65,7 +65,7 @@ namespace WebCore {
         bool parseValue(CSSMutableStyleDeclaration*, int propId, const String&, bool important);
         static bool parseColor(RGBA32& color, const String&, bool strict = false);
         bool parseColor(CSSMutableStyleDeclaration*, const String&);
-        bool parseDeclaration(CSSMutableStyleDeclaration*, const String&, CSSStyleSourceData* styleSourceData = 0);
+        bool parseDeclaration(CSSMutableStyleDeclaration*, const String&, RefPtr<CSSStyleSourceData>* styleSourceData = 0);
         bool parseMediaQuery(MediaList*, const String&);
 
         Document* document() const;
@@ -241,18 +241,20 @@ namespace WebCore {
         AtomicString m_defaultNamespace;
 
         // tokenizer methods and data
-        unsigned m_ruleBodyStartOffset;
-        unsigned m_ruleBodyEndOffset;
-        unsigned m_propertyStartOffset;
-        unsigned m_propertyEndOffset;
+        SourceRange m_selectorListRange;
+        SourceRange m_ruleBodyRange;
+        SourceRange m_propertyRange;
         StyleRuleRangeMap* m_ruleRangeMap;
-        RefPtr<CSSStyleSourceData> m_currentStyleData;
+        RefPtr<CSSRuleSourceData> m_currentRuleData;
+        void markSelectorListStart();
+        void markSelectorListEnd();
         void markRuleBodyStart();
         void markRuleBodyEnd();
         void markPropertyStart();
         void markPropertyEnd(bool isImportantFound, bool isPropertyParsed);
-        void resetRuleBodyMarks() { m_ruleBodyStartOffset = m_ruleBodyEndOffset = 0; }
-        void resetPropertyMarks() { m_propertyStartOffset = m_propertyEndOffset = UINT_MAX; }
+        void resetSelectorListMarks() { m_selectorListRange.start = m_selectorListRange.end = 0; }
+        void resetRuleBodyMarks() { m_ruleBodyRange.start = m_ruleBodyRange.end = 0; }
+        void resetPropertyMarks() { m_propertyRange.start = m_propertyRange.end = UINT_MAX; }
         int lex(void* yylval);
         int token() { return yyTok; }
         UChar* text(int* length);
diff --git a/WebCore/css/CSSPrimitiveValue.cpp b/WebCore/css/CSSPrimitiveValue.cpp
index 5c83e7c..065c244 100644
--- a/WebCore/css/CSSPrimitiveValue.cpp
+++ b/WebCore/css/CSSPrimitiveValue.cpp
@@ -35,7 +35,9 @@
 #include "Rect.h"
 #include "RenderStyle.h"
 #include <wtf/ASCIICType.h>
+#include <wtf/DecimalNumber.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuffer.h>
 
 #if ENABLE(DASHBOARD_SUPPORT)
 #include "DashboardRegion.h"
@@ -613,6 +615,17 @@ int CSSPrimitiveValue::getIdent()
     return m_value.ident;
 }
 
+static String formatNumber(double number)
+{
+    DecimalNumber decimal(number);
+    
+    StringBuffer buffer(decimal.bufferLengthForStringDecimal());
+    unsigned length = decimal.toStringDecimal(buffer.characters(), buffer.length());
+    ASSERT_UNUSED(length, length == buffer.length());
+
+    return String::adopt(buffer);
+}
+
 String CSSPrimitiveValue::cssText() const
 {
     // FIXME: return the original value instead of a generated one (e.g. color
@@ -630,61 +643,61 @@ String CSSPrimitiveValue::cssText() const
             break;
         case CSS_NUMBER:
         case CSS_PARSER_INTEGER:
-            text = String::number(m_value.num);
+            text = formatNumber(m_value.num);
             break;
         case CSS_PERCENTAGE:
-            text = String::format("%.6lg%%", m_value.num);
+            text = formatNumber(m_value.num) + "%";
             break;
         case CSS_EMS:
-            text = String::format("%.6lgem", m_value.num);
+            text = formatNumber(m_value.num) + "em";
             break;
         case CSS_EXS:
-            text = String::format("%.6lgex", m_value.num);
+            text = formatNumber(m_value.num) + "ex";
             break;
         case CSS_REMS:
-            text = String::format("%.6lgrem", m_value.num);
+            text = formatNumber(m_value.num) + "rem";
             break;
         case CSS_PX:
-            text = String::format("%.6lgpx", m_value.num);
+            text = formatNumber(m_value.num) + "px";
             break;
         case CSS_CM:
-            text = String::format("%.6lgcm", m_value.num);
+            text = formatNumber(m_value.num) + "cm";
             break;
         case CSS_MM:
-            text = String::format("%.6lgmm", m_value.num);
+            text = formatNumber(m_value.num) + "mm";
             break;
         case CSS_IN:
-            text = String::format("%.6lgin", m_value.num);
+            text = formatNumber(m_value.num) + "in";
             break;
         case CSS_PT:
-            text = String::format("%.6lgpt", m_value.num);
+            text = formatNumber(m_value.num) + "pt";
             break;
         case CSS_PC:
-            text = String::format("%.6lgpc", m_value.num);
+            text = formatNumber(m_value.num) + "pc";
             break;
         case CSS_DEG:
-            text = String::format("%.6lgdeg", m_value.num);
+            text = formatNumber(m_value.num) + "deg";
             break;
         case CSS_RAD:
-            text = String::format("%.6lgrad", m_value.num);
+            text = formatNumber(m_value.num) + "rad";
             break;
         case CSS_GRAD:
-            text = String::format("%.6lggrad", m_value.num);
+            text = formatNumber(m_value.num) + "grad";
             break;
         case CSS_MS:
-            text = String::format("%.6lgms", m_value.num);
+            text = formatNumber(m_value.num) + "ms";
             break;
         case CSS_S:
-            text = String::format("%.6lgs", m_value.num);
+            text = formatNumber(m_value.num) + "s";
             break;
         case CSS_HZ:
-            text = String::format("%.6lghz", m_value.num);
+            text = formatNumber(m_value.num) + "hz";
             break;
         case CSS_KHZ:
-            text = String::format("%.6lgkhz", m_value.num);
+            text = formatNumber(m_value.num) + "khz";
             break;
         case CSS_TURN:
-            text = String::format("%.6lgturn", m_value.num);
+            text = formatNumber(m_value.num) + "turn";
             break;
         case CSS_DIMENSION:
             // FIXME
diff --git a/WebCore/css/CSSPrimitiveValueMappings.h b/WebCore/css/CSSPrimitiveValueMappings.h
index 14afdf6..a57a882 100644
--- a/WebCore/css/CSSPrimitiveValueMappings.h
+++ b/WebCore/css/CSSPrimitiveValueMappings.h
@@ -2003,40 +2003,40 @@ template<> inline CSSPrimitiveValue::operator TextDirection() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EBlockFlowDirection e)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(WritingMode e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
 {
     switch (e) {
-    case TopToBottomBlockFlow:
-        m_value.ident = CSSValueTb;
+    case TopToBottomWritingMode:
+        m_value.ident = CSSValueHorizontalTb;
         break;
-    case RightToLeftBlockFlow:
-        m_value.ident = CSSValueRl;
+    case RightToLeftWritingMode:
+        m_value.ident = CSSValueVerticalRl;
         break;
-    case LeftToRightBlockFlow:
-        m_value.ident = CSSValueLr;
+    case LeftToRightWritingMode:
+        m_value.ident = CSSValueVerticalLr;
         break;
-    case BottomToTopBlockFlow:
-        m_value.ident = CSSValueBt;
+    case BottomToTopWritingMode:
+        m_value.ident = CSSValueHorizontalBt;
         break;
     }
 }
 
-template<> inline CSSPrimitiveValue::operator EBlockFlowDirection() const
+template<> inline CSSPrimitiveValue::operator WritingMode() const
 {
     switch (m_value.ident) {
-    case CSSValueTb:
-        return TopToBottomBlockFlow;
-    case CSSValueRl:
-        return RightToLeftBlockFlow;
-    case CSSValueLr:
-        return LeftToRightBlockFlow;
-    case CSSValueBt:
-        return BottomToTopBlockFlow;
+    case CSSValueHorizontalTb:
+        return TopToBottomWritingMode;
+    case CSSValueVerticalRl:
+        return RightToLeftWritingMode;
+    case CSSValueVerticalLr:
+        return LeftToRightWritingMode;
+    case CSSValueHorizontalBt:
+        return BottomToTopWritingMode;
     default:
         ASSERT_NOT_REACHED();
-        return TopToBottomBlockFlow;
+        return TopToBottomWritingMode;
     }
 }
 
@@ -2189,25 +2189,30 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ColorSpace space)
     , m_hasCachedCSSText(false)
 {
     switch (space) {
-        case DeviceColorSpace:
-            m_value.ident = CSSValueDefault;
-            break;
-        case sRGBColorSpace:
-            m_value.ident = CSSValueSrgb;
-            break;
+    case ColorSpaceDeviceRGB:
+        m_value.ident = CSSValueDefault;
+        break;
+    case ColorSpaceSRGB:
+        m_value.ident = CSSValueSrgb;
+        break;
+    case ColorSpaceLinearRGB:
+        // CSS color correction does not support linearRGB yet.
+        ASSERT_NOT_REACHED();
+        m_value.ident = CSSValueDefault;
+        break;
     }
 }
 
 template<> inline CSSPrimitiveValue::operator ColorSpace() const
 {
     switch (m_value.ident) {
-        case CSSValueDefault:
-            return DeviceColorSpace;
-        case CSSValueSrgb:
-            return sRGBColorSpace;
-        default:
-            ASSERT_NOT_REACHED();
-            return DeviceColorSpace;
+    case CSSValueDefault:
+        return ColorSpaceDeviceRGB;
+    case CSSValueSrgb:
+        return ColorSpaceSRGB;
+    default:
+        ASSERT_NOT_REACHED();
+        return ColorSpaceDeviceRGB;
     }
 }
 
@@ -2243,6 +2248,53 @@ template<> inline CSSPrimitiveValue::operator Hyphens() const
     }
 }
 
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(ESpeak e)
+    : m_type(CSS_IDENT)
+    , m_hasCachedCSSText(false)
+{
+    switch (e) {
+    case SpeakNone:
+        m_value.ident = CSSValueNone;
+        break;
+    case SpeakNormal:
+        m_value.ident = CSSValueNormal;
+        break;
+    case SpeakSpellOut:
+        m_value.ident = CSSValueSpellOut;
+        break;
+    case SpeakDigits:
+        m_value.ident = CSSValueDigits;
+        break;
+    case SpeakLiteralPunctuation:
+        m_value.ident = CSSValueLiteralPunctuation;
+        break;
+    case SpeakNoPunctuation:
+        m_value.ident = CSSValueNoPunctuation;
+        break;
+    }
+}
+    
+template<> inline CSSPrimitiveValue::operator ESpeak() const
+{
+    switch (m_value.ident) {
+    case CSSValueNone:
+        return SpeakNone;
+    case CSSValueNormal:
+        return SpeakNormal;
+    case CSSValueSpellOut:
+        return SpeakSpellOut;
+    case CSSValueDigits:
+        return SpeakDigits;
+    case CSSValueLiteralPunctuation:
+        return SpeakLiteralPunctuation;
+    case CSSValueNoPunctuation:
+        return SpeakNoPunctuation;
+    default:
+        ASSERT_NOT_REACHED();
+        return SpeakNormal;
+    }
+}
+
 #if ENABLE(SVG)
 
 template<> inline CSSPrimitiveValue::CSSPrimitiveValue(LineCap e)
@@ -2656,7 +2708,7 @@ template<> inline CSSPrimitiveValue::operator ETextAnchor() const
     }
 }
 
-template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
+template<> inline CSSPrimitiveValue::CSSPrimitiveValue(SVGWritingMode e)
     : m_type(CSS_IDENT)
     , m_hasCachedCSSText(false)
 {
@@ -2682,7 +2734,7 @@ template<> inline CSSPrimitiveValue::CSSPrimitiveValue(EWritingMode e)
     }
 }
 
-template<> inline CSSPrimitiveValue::operator EWritingMode() const
+template<> inline CSSPrimitiveValue::operator SVGWritingMode() const
 {
     switch (m_value.ident) {
     case CSSValueLrTb:
@@ -2729,7 +2781,7 @@ template<> inline CSSPrimitiveValue::operator EVectorEffect() const
         return VE_NONE;
     }
 }
-
+    
 #endif
 
 }
diff --git a/WebCore/css/CSSProperty.cpp b/WebCore/css/CSSProperty.cpp
index 7779aad..61300a2 100644
--- a/WebCore/css/CSSProperty.cpp
+++ b/WebCore/css/CSSProperty.cpp
@@ -42,16 +42,16 @@ bool operator==(const CSSProperty& a, const CSSProperty& b)
 enum LogicalBoxSide { BeforeSide, EndSide, AfterSide, StartSide };
 enum PhysicalBoxSide { TopSide, RightSide, BottomSide, LeftSide };
 
-static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirection blockDirection, LogicalBoxSide logicalSide, const int* properties)
+static int resolveToPhysicalProperty(TextDirection direction, WritingMode writingMode, LogicalBoxSide logicalSide, const int* properties)
 {
     if (direction == LTR) {
-        if (blockDirection == TopToBottomBlockFlow) {
+        if (writingMode == TopToBottomWritingMode) {
             // The common case. The logical and physical box sides match.
             // Left = Start, Right = End, Before = Top, After = Bottom
             return properties[logicalSide];
         }
         
-        if (blockDirection == BottomToTopBlockFlow) {
+        if (writingMode == BottomToTopWritingMode) {
             // Start = Left, End = Right, Before = Bottom, After = Top.
             switch (logicalSide) {
             case StartSide:
@@ -65,7 +65,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
             }
         }
         
-        if (blockDirection == LeftToRightBlockFlow) {
+        if (writingMode == LeftToRightWritingMode) {
             // Start = Top, End = Bottom, Before = Left, After = Right.
             switch (logicalSide) {
             case StartSide:
@@ -92,7 +92,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
 
-    if (blockDirection == TopToBottomBlockFlow) {
+    if (writingMode == TopToBottomWritingMode) {
         // Start = Right, End = Left, Before = Top, After = Bottom
         switch (logicalSide) {
         case StartSide:
@@ -106,7 +106,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
     
-    if (blockDirection == BottomToTopBlockFlow) {
+    if (writingMode == BottomToTopWritingMode) {
         // Start = Right, End = Left, Before = Bottom, After = Top
         switch (logicalSide) {
         case StartSide:
@@ -120,7 +120,7 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
         }
     }
     
-    if (blockDirection == LeftToRightBlockFlow) {
+    if (writingMode == LeftToRightWritingMode) {
         // Start = Bottom, End = Top, Before = Left, After = Right
         switch (logicalSide) {
         case StartSide:
@@ -149,135 +149,135 @@ static int resolveToPhysicalProperty(TextDirection direction, EBlockFlowDirectio
 
 enum LogicalExtent { LogicalWidth, LogicalHeight };
 
-static int resolveToPhysicalProperty(EBlockFlowDirection blockDirection, LogicalExtent logicalSide, const int* properties)
+static int resolveToPhysicalProperty(WritingMode writingMode, LogicalExtent logicalSide, const int* properties)
 {
-    if (blockDirection == TopToBottomBlockFlow || blockDirection == BottomToTopBlockFlow)
+    if (writingMode == TopToBottomWritingMode || writingMode == BottomToTopWritingMode)
         return properties[logicalSide];
     return logicalSide == LogicalWidth ? properties[1] : properties[0];
 }
         
-int CSSProperty::resolveDirectionAwareProperty(int propertyID, TextDirection direction, EBlockFlowDirection blockDirection)
+int CSSProperty::resolveDirectionAwareProperty(int propertyID, TextDirection direction, WritingMode writingMode)
 {
     switch (static_cast<CSSPropertyID>(propertyID)) {
     case CSSPropertyWebkitMarginEnd: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitMarginStart: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitMarginBefore: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitMarginAfter: {
         const int properties[4] = { CSSPropertyMarginTop, CSSPropertyMarginRight, CSSPropertyMarginBottom, CSSPropertyMarginLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitPaddingEnd: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitPaddingStart: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitPaddingBefore: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitPaddingAfter: {
         const int properties[4] = { CSSPropertyPaddingTop, CSSPropertyPaddingRight, CSSPropertyPaddingBottom, CSSPropertyPaddingLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEnd: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStart: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBefore: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfter: {
         const int properties[4] = { CSSPropertyBorderTop, CSSPropertyBorderRight, CSSPropertyBorderBottom, CSSPropertyBorderLeft };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterColor: {
         const int properties[4] = { CSSPropertyBorderTopColor, CSSPropertyBorderRightColor, CSSPropertyBorderBottomColor, CSSPropertyBorderLeftColor };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterStyle: {
         const int properties[4] = { CSSPropertyBorderTopStyle, CSSPropertyBorderRightStyle, CSSPropertyBorderBottomStyle, CSSPropertyBorderLeftStyle };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitBorderEndWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, EndSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, EndSide, properties);
     }
     case CSSPropertyWebkitBorderStartWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, StartSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, StartSide, properties);
     }
     case CSSPropertyWebkitBorderBeforeWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, BeforeSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, BeforeSide, properties);
     }
     case CSSPropertyWebkitBorderAfterWidth: {
         const int properties[4] = { CSSPropertyBorderTopWidth, CSSPropertyBorderRightWidth, CSSPropertyBorderBottomWidth, CSSPropertyBorderLeftWidth };
-        return resolveToPhysicalProperty(direction, blockDirection, AfterSide, properties);
+        return resolveToPhysicalProperty(direction, writingMode, AfterSide, properties);
     }
     case CSSPropertyWebkitLogicalWidth: {
         const int properties[2] = { CSSPropertyWidth, CSSPropertyHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitLogicalHeight: {
         const int properties[2] = { CSSPropertyWidth, CSSPropertyHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     case CSSPropertyWebkitMinLogicalWidth: {
         const int properties[2] = { CSSPropertyMinWidth, CSSPropertyMinHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitMinLogicalHeight: {
         const int properties[2] = { CSSPropertyMinWidth, CSSPropertyMinHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     case CSSPropertyWebkitMaxLogicalWidth: {
         const int properties[2] = { CSSPropertyMaxWidth, CSSPropertyMaxHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalWidth, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalWidth, properties);
     }
     case CSSPropertyWebkitMaxLogicalHeight: {
         const int properties[2] = { CSSPropertyMaxWidth, CSSPropertyMaxHeight };
-        return resolveToPhysicalProperty(blockDirection, LogicalHeight, properties);
+        return resolveToPhysicalProperty(writingMode, LogicalHeight, properties);
     }
     default:
         return propertyID;
diff --git a/WebCore/css/CSSProperty.h b/WebCore/css/CSSProperty.h
index 0da6050..106171d 100644
--- a/WebCore/css/CSSProperty.h
+++ b/WebCore/css/CSSProperty.h
@@ -60,7 +60,7 @@ public:
     
     String cssText() const;
 
-    static int resolveDirectionAwareProperty(int propertyID, TextDirection, EBlockFlowDirection);
+    static int resolveDirectionAwareProperty(int propertyID, TextDirection, WritingMode);
 
     friend bool operator==(const CSSProperty&, const CSSProperty&);
 
diff --git a/WebCore/css/CSSPropertyNames.in b/WebCore/css/CSSPropertyNames.in
index 8584e5f..9fd2d2c 100644
--- a/WebCore/css/CSSPropertyNames.in
+++ b/WebCore/css/CSSPropertyNames.in
@@ -20,7 +20,6 @@ font-style
 font-variant
 font-weight
 text-rendering
--webkit-block-flow
 -webkit-font-smoothing
 -webkit-text-size-adjust
 -webkit-writing-mode
@@ -123,6 +122,7 @@ resize
 right
 size
 src
+speak
 table-layout
 text-align
 text-decoration
diff --git a/WebCore/css/CSSPropertySourceData.cpp b/WebCore/css/CSSPropertySourceData.cpp
index 1628031..eb9c2c1 100644
--- a/WebCore/css/CSSPropertySourceData.cpp
+++ b/WebCore/css/CSSPropertySourceData.cpp
@@ -54,13 +54,6 @@ SourceRange::SourceRange(unsigned start, unsigned end)
 {
 }
 
-SourceRange& SourceRange::operator=(const SourceRange& other)
-{
-    this->start = other.start;
-    this->end = other.end;
-    return *this;
-}
-
 CSSPropertySourceData::CSSPropertySourceData(const String& name, const String& value, bool important, bool parsedOk, const SourceRange& range)
     : name(name)
     , value(value)
@@ -88,16 +81,6 @@ CSSPropertySourceData::CSSPropertySourceData()
 {
 }
 
-CSSPropertySourceData& CSSPropertySourceData::operator=(const CSSPropertySourceData& other)
-{
-    name = other.name;
-    value = other.value;
-    important = other.important;
-    parsedOk = other.parsedOk;
-    range = other.range;
-    return *this;
-}
-
 String CSSPropertySourceData::toString() const
 {
     DEFINE_STATIC_LOCAL(String, emptyValue, ("e"));
diff --git a/WebCore/css/CSSPropertySourceData.h b/WebCore/css/CSSPropertySourceData.h
index beae9d0..db80d46 100644
--- a/WebCore/css/CSSPropertySourceData.h
+++ b/WebCore/css/CSSPropertySourceData.h
@@ -44,7 +44,6 @@ class CSSStyleRule;
 struct SourceRange {
     SourceRange();
     SourceRange(unsigned start, unsigned end);
-    SourceRange& operator=(const SourceRange& other);
 
     unsigned start;
     unsigned end;
@@ -56,9 +55,7 @@ struct CSSPropertySourceData {
     CSSPropertySourceData(const String& name, const String& value, bool important, bool parsedOk, const SourceRange& range);
     CSSPropertySourceData(const CSSPropertySourceData& other);
     CSSPropertySourceData();
-    ALWAYS_INLINE ~CSSPropertySourceData() { }
 
-    CSSPropertySourceData& operator=(const CSSPropertySourceData& other);
     String toString() const;
     unsigned hash() const;
 
@@ -83,7 +80,18 @@ struct CSSStyleSourceData : public RefCounted<CSSStyleSourceData> {
     SourceRange styleBodyRange;
     Vector<CSSPropertySourceData> propertyData;
 };
-typedef HashMap<CSSStyleRule*, RefPtr<CSSStyleSourceData> > StyleRuleRangeMap;
+
+struct CSSRuleSourceData : public RefCounted<CSSRuleSourceData> {
+    static PassRefPtr<CSSRuleSourceData> create()
+    {
+        return adoptRef(new CSSRuleSourceData());
+    }
+
+    // Range of the selector list in the enclosing source.
+    SourceRange selectorListRange;
+    RefPtr<CSSStyleSourceData> styleSourceData;
+};
+typedef HashMap<CSSStyleRule*, RefPtr<CSSRuleSourceData> > StyleRuleRangeMap;
 
 } // namespace WebCore
 
diff --git a/WebCore/css/CSSStyleSelector.cpp b/WebCore/css/CSSStyleSelector.cpp
index bf95877..9ae0505 100644
--- a/WebCore/css/CSSStyleSelector.cpp
+++ b/WebCore/css/CSSStyleSelector.cpp
@@ -1107,8 +1107,12 @@ PassRefPtr<RenderStyle> CSSStyleSelector::styleForDocument(Document* document)
     documentStyle->setZoom(frame ? frame->pageZoomFactor() : 1);
     
     Element* docElement = document->documentElement();
-    if (docElement && docElement->renderer())
-        documentStyle->setBlockFlow(docElement->renderer()->style()->blockFlow());
+    if (docElement && docElement->renderer()) {
+        // Use the direction and block-flow of the document element to set the
+        // viewport's direction and block-flow.
+        documentStyle->setWritingMode(docElement->renderer()->style()->writingMode());
+        documentStyle->setDirection(docElement->renderer()->style()->direction());
+    }
 
     FontDescription fontDescription;
     fontDescription.setUsePrinterFont(document->printing());
@@ -1722,7 +1726,7 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
         
         // FIXME: Don't support this mutation for pseudo styles like first-letter or first-line, since it's not completely
         // clear how that should work.
-        if (style->display() == INLINE && style->styleType() == NOPSEUDO && parentStyle && style->blockFlow() != parentStyle->blockFlow())
+        if (style->display() == INLINE && style->styleType() == NOPSEUDO && parentStyle && style->writingMode() != parentStyle->writingMode())
             style->setDisplay(INLINE_BLOCK);
         
         // After performing the display mutation, check table rows.  We do not honor position:relative on
@@ -1734,14 +1738,14 @@ void CSSStyleSelector::adjustRenderStyle(RenderStyle* style, RenderStyle* parent
             style->setPosition(StaticPosition);
         
         // FIXME: Since we don't support block-flow on either tables or flexible boxes yet, disallow setting
-        // of block-flow to anything other than TopToBottomBlockFlow.
+        // of block-flow to anything other than TopToBottomWritingMode.
         // https://bugs.webkit.org/show_bug.cgi?id=46417 - Tables support
         // https://bugs.webkit.org/show_bug.cgi?id=46418 - Flexible box support.
-        if (style->blockFlow() != TopToBottomBlockFlow && (style->display() == TABLE || style->display() == INLINE_TABLE
+        if (style->writingMode() != TopToBottomWritingMode && (style->display() == TABLE || style->display() == INLINE_TABLE
             || style->display() == TABLE_HEADER_GROUP || style->display() == TABLE_ROW_GROUP
             || style->display() == TABLE_FOOTER_GROUP || style->display() == TABLE_ROW || style->display() == TABLE_CELL
             || style->display() == BOX || style->display() == INLINE_BOX))
-            style->setBlockFlow(TopToBottomBlockFlow);
+            style->setWritingMode(TopToBottomWritingMode);
     }
 
     // Make sure our z-index value is only applied if the object is positioned.
@@ -1960,7 +1964,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
     switch (relation) {
         case CSSSelector::Descendant:
             while (true) {
-                Node* n = e->parentNode();
+                ContainerNode* n = e->parentNode();
                 if (!n || !n->isElementNode())
                     return SelectorFailsCompletely;
                 e = static_cast<Element*>(n);
@@ -1971,7 +1975,7 @@ CSSStyleSelector::SelectorMatch CSSStyleSelector::SelectorChecker::checkSelector
             break;
         case CSSSelector::Child:
         {
-            Node* n = e->parentNode();
+            ContainerNode* n = e->parentNode();
             if (!n || !n->isElementNode())
                 return SelectorFailsCompletely;
             e = static_cast<Element*>(n);
@@ -2942,7 +2946,7 @@ void CSSStyleSelector::applyDeclarations(bool isImportant, int startIndex, int e
 
                 if (applyFirst) {
                     COMPILE_ASSERT(firstCSSProperty == CSSPropertyColor, CSS_color_is_first_property);
-                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 14, CSS_zoom_is_end_of_first_prop_range);
+                    COMPILE_ASSERT(CSSPropertyZoom == CSSPropertyColor + 13, CSS_zoom_is_end_of_first_prop_range);
                     COMPILE_ASSERT(CSSPropertyLineHeight == CSSPropertyZoom + 1, CSS_line_height_is_after_zoom);
 
                     // give special priority to font-xxx, color properties, etc
@@ -3012,7 +3016,7 @@ void CSSStyleSelector::matchPageRulesForList(CSSRuleDataList* rules, bool isLeft
 bool CSSStyleSelector::isLeftPage(int pageIndex) const
 {
     bool isFirstPageLeft = false;
-    if (m_rootElementStyle->direction() == RTL)
+    if (!m_rootElementStyle->isLeftToRightDirection())
         isFirstPageLeft = true;
 
     return (pageIndex + (isFirstPageLeft ? 1 : 0)) % 2;
@@ -3130,7 +3134,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     bool isInherit = m_parentNode && valueType == CSSValue::CSS_INHERIT;
     bool isInitial = valueType == CSSValue::CSS_INITIAL || (!m_parentNode && valueType == CSSValue::CSS_INHERIT);
     
-    id = CSSProperty::resolveDirectionAwareProperty(id, m_style->direction(), m_style->blockFlow());
+    id = CSSProperty::resolveDirectionAwareProperty(id, m_style->direction(), m_style->writingMode());
 
     if (m_checker.m_matchVisitedPseudoClass && !isValidVisitedLinkProperty(id)) {
         // Limit the properties that can be applied to only the ones honored by :visited.
@@ -4190,9 +4194,9 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
             return;
         int id = primitiveValue->getIdent();
         if (id == CSSValueStart)
-            m_style->setTextAlign(m_style->direction() == LTR ? LEFT : RIGHT);
+            m_style->setTextAlign(m_style->isLeftToRightDirection() ? LEFT : RIGHT);
         else if (id == CSSValueEnd)
-            m_style->setTextAlign(m_style->direction() == LTR ? RIGHT : LEFT);
+            m_style->setTextAlign(m_style->isLeftToRightDirection() ? RIGHT : LEFT);
         else
             m_style->setTextAlign(*primitiveValue);
         return;
@@ -5473,7 +5477,7 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
         if (isInherit) 
             m_style->setColorSpace(m_parentStyle->colorSpace());
         else if (isInitial)
-            m_style->setColorSpace(DeviceColorSpace);
+            m_style->setColorSpace(ColorSpaceDeviceRGB);
         else {
             if (!primitiveValue)
                 return;
@@ -5483,6 +5487,12 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
     case CSSPropertySize:
         applyPageSizeProperty(value);
         return;
+    
+    case CSSPropertySpeak:
+        HANDLE_INHERIT_AND_INITIAL(speak, Speak);
+        m_style->setSpeak(*primitiveValue);
+        return;
+            
     case CSSPropertyInvalid:
         return;
 
@@ -5561,50 +5571,8 @@ void CSSStyleSelector::applyProperty(int id, CSSValue *value)
 #endif 
 
     // CSS Text Layout Module Level 3: Vertical writing support
-    case CSSPropertyWebkitBlockFlow:
-        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(blockFlow, BlockFlow)
-        return;
-
     case CSSPropertyWebkitWritingMode:
-        // The 'writing-mode' property is a shorthand property for the 'direction' property and the 'block-flow' property. 
-        if (isInherit) {
-            m_style->setDirection(m_parentStyle->direction());
-            m_style->setBlockFlow(m_parentStyle->blockFlow());
-        } else if (isInitial) {
-            m_style->setDirection(m_style->initialDirection());
-            m_style->setBlockFlow(m_style->initialBlockFlow());
-        } else {
-            if (!primitiveValue)
-                return;
-            switch (primitiveValue->getIdent()) {
-            case CSSValueLrTb:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(TopToBottomBlockFlow);
-                break;
-            case CSSValueRlTb:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(TopToBottomBlockFlow);
-                break;
-            case CSSValueTbRl:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(RightToLeftBlockFlow);
-                break;
-            case CSSValueBtRl:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(RightToLeftBlockFlow);
-                break;
-            case CSSValueTbLr:
-                m_style->setDirection(LTR);
-                m_style->setBlockFlow(LeftToRightBlockFlow);
-                break;
-            case CSSValueBtLr:
-                m_style->setDirection(RTL);
-                m_style->setBlockFlow(LeftToRightBlockFlow);
-                break;
-            default:
-                break;
-            }
-        }
+        HANDLE_INHERIT_AND_INITIAL_AND_PRIMITIVE(writingMode, WritingMode)
         return;
 
 #ifdef ANDROID_CSS_RING
@@ -6994,7 +6962,8 @@ void CSSStyleSelector::loadPendingImages()
                 for (ContentData* contentData = const_cast<ContentData*>(m_style->contentData()); contentData; contentData = contentData->next()) {
                     if (contentData->isImage() && contentData->image()->isPendingImage()) {
                         CSSImageValue* imageValue = static_cast<StylePendingImage*>(contentData->image())->cssImageValue();
-                        contentData->setImage(imageValue->cachedImage(cachedResourceLoader));
+                        if (StyleCachedImage* cachedImage = imageValue->cachedImage(cachedResourceLoader))
+                            contentData->setImage(cachedImage);
                     }
                 }
                 break;
diff --git a/WebCore/css/CSSStyleSelector.h b/WebCore/css/CSSStyleSelector.h
index 2bca2f4..5f70e05 100644
--- a/WebCore/css/CSSStyleSelector.h
+++ b/WebCore/css/CSSStyleSelector.h
@@ -109,7 +109,7 @@ public:
     private:
         void initForStyleResolve(Element*, RenderStyle* parentStyle = 0, PseudoId = NOPSEUDO);
         void initElement(Element*);
-        RenderStyle* locateSharedStyle();
+        ALWAYS_INLINE RenderStyle* locateSharedStyle();
         Node* locateCousinList(Element* parent, unsigned depth = 1);
         bool canShareStyleWithElement(Node*);
 
diff --git a/WebCore/css/CSSValueKeywords.in b/WebCore/css/CSSValueKeywords.in
index 556d0bc..fa0a214 100644
--- a/WebCore/css/CSSValueKeywords.in
+++ b/WebCore/css/CSSValueKeywords.in
@@ -714,6 +714,14 @@ stroke
 #none
 
 #
+# CSS_PROP_SPEECH
+#
+spell-out
+digits
+literal-punctuation
+no-punctuation
+
+#
 # -webkit-font-smoothing
 #
 # auto
@@ -743,16 +751,16 @@ windowed
 manual
 # auto
 
-# -webkit-block-flow
-tb
-rl
-lr
-bt
-
 # -webkit-writing-mode
+# SVG compatibility
+lr
+rl
+tb
 lr-tb
 rl-tb
 tb-rl
-bt-rl
-tb-lr
-bt-lr
+# Standard values from CSS3
+horizontal-tb
+vertical-rl
+vertical-lr
+horizontal-bt
diff --git a/WebCore/css/MediaQuery.cpp b/WebCore/css/MediaQuery.cpp
index 77a79ad..c476a21 100644
--- a/WebCore/css/MediaQuery.cpp
+++ b/WebCore/css/MediaQuery.cpp
@@ -30,8 +30,8 @@
 #include "MediaQuery.h"
 
 #include "MediaQueryExp.h"
-#include "StringBuilder.h"
 #include <wtf/NonCopyingSort.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/css/MediaQueryExp.cpp b/WebCore/css/MediaQueryExp.cpp
index 36a155e..e970400 100644
--- a/WebCore/css/MediaQueryExp.cpp
+++ b/WebCore/css/MediaQueryExp.cpp
@@ -32,7 +32,7 @@
 #include "CSSParser.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSValueList.h"
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/css/html.css b/WebCore/css/html.css
index 5399c1c..02fa620 100644
--- a/WebCore/css/html.css
+++ b/WebCore/css/html.css
@@ -284,16 +284,19 @@ label {
 
 legend {
     display: block;
-    padding-left: 2px;
-    padding-right: 2px;
+    -webkit-padding-start: 2px;
+    -webkit-padding-end: 2px;
     border: none
 }
 
 fieldset {
     display: block;
-    margin-left: 2px;
-    margin-right: 2px;
-    padding: 0.35em 0.75em 0.625em;
+    -webkit-margin-start: 2px;
+    -webkit-margin-end: 2px;
+    -webkit-padding-before: 0.35em;
+    -webkit-padding-start: 0.75em;
+    -webkit-padding-end: 0.75em;
+    -webkit-padding-after: 0.625em;
     border: 2px groove ThreeDFace
 }
 
diff --git a/WebCore/css/mathml.css b/WebCore/css/mathml.css
index 7cf9866..b797b21 100644
--- a/WebCore/css/mathml.css
+++ b/WebCore/css/mathml.css
@@ -21,13 +21,10 @@ math[display="block"] {
     margin-right: auto;
 }
 
-math > * {
-    vertical-align: baseline;
-}
-
 mrow, mfenced {
     display: inline-block;
     white-space: nowrap;
+    vertical-align: baseline;
 }
 
 mfenced {
@@ -96,8 +93,7 @@ mo {
 }
 
 math > mo, mrow > mo, mfenced > mo {
-    padding-left: 0.05em;
-    padding-right: 0.05em;
+    padding-right: 0.1em;
 }
 
 math[mathvariant="normal"], mstyle[mathvariant="normal"], mo[mathvariant="normal"], mn[mathvariant="normal"], mi[mathvariant="normal"], mtext[mathvariant="normal"], mspace[mathvariant="normal"], ms[mathvariant="normal"] {
diff --git a/WebCore/css/themeQtMobile.css b/WebCore/css/themeQtMobile.css
index ef2d182..5cc39c8 100644
--- a/WebCore/css/themeQtMobile.css
+++ b/WebCore/css/themeQtMobile.css
@@ -31,9 +31,10 @@ input[type="reset"],
 input[type="file"]::-webkit-file-upload-button, button,
 select {
     padding: 2px 18px 3px 18px;
-    border: 1px solid black;
+    border: 1px solid gray;
     -webkit-border-radius:5px;
-    background-color: ButtonFace;
+    background: -webkit-gradient(linear, left bottom, left top, color-stop(0.0, #e5e5e5), color-stop(0.4, #ffffff));
+    color: #3e3e3e;
 }
 
 input[type="button"]:disabled,
@@ -50,8 +51,8 @@ input[type="submit"]:active,
 input[type="reset"]:active,
 input[type="file"]:active::-webkit-file-upload-button,
 button:active,
-select:active{
-    background-color: ButtonShadow;
+select:active {
+    background: ButtonShadow;
 }
 
 input[type="button"]:active:disabled,
diff --git a/WebCore/dom/BeforeTextInsertedEvent.cpp b/WebCore/dom/BeforeTextInsertedEvent.cpp
index af86d66..472eefc 100644
--- a/WebCore/dom/BeforeTextInsertedEvent.cpp
+++ b/WebCore/dom/BeforeTextInsertedEvent.cpp
@@ -35,4 +35,8 @@ BeforeTextInsertedEvent::BeforeTextInsertedEvent(const String& text)
 {
 }
 
+BeforeTextInsertedEvent::~BeforeTextInsertedEvent()
+{
+}
+
 }
diff --git a/WebCore/dom/BeforeTextInsertedEvent.h b/WebCore/dom/BeforeTextInsertedEvent.h
index f2a2ac4..a6966ff 100644
--- a/WebCore/dom/BeforeTextInsertedEvent.h
+++ b/WebCore/dom/BeforeTextInsertedEvent.h
@@ -32,6 +32,8 @@ namespace WebCore {
 
 class BeforeTextInsertedEvent : public Event {
 public:
+    virtual ~BeforeTextInsertedEvent();
+
     static PassRefPtr<BeforeTextInsertedEvent> create(const String& text)
     {
         return adoptRef(new BeforeTextInsertedEvent(text));
diff --git a/WebCore/dom/BeforeUnloadEvent.cpp b/WebCore/dom/BeforeUnloadEvent.cpp
index 97d7f97..19adcab 100644
--- a/WebCore/dom/BeforeUnloadEvent.cpp
+++ b/WebCore/dom/BeforeUnloadEvent.cpp
@@ -32,6 +32,10 @@ BeforeUnloadEvent::BeforeUnloadEvent()
 {
 }
 
+BeforeUnloadEvent::~BeforeUnloadEvent()
+{
+}
+
 bool BeforeUnloadEvent::storesResultAsString() const
 {
     return true;
diff --git a/WebCore/dom/BeforeUnloadEvent.h b/WebCore/dom/BeforeUnloadEvent.h
index 2644693..136e85c 100644
--- a/WebCore/dom/BeforeUnloadEvent.h
+++ b/WebCore/dom/BeforeUnloadEvent.h
@@ -30,6 +30,8 @@ namespace WebCore {
 
     class BeforeUnloadEvent : public Event {
     public:
+        virtual ~BeforeUnloadEvent();
+
         static PassRefPtr<BeforeUnloadEvent> create()
         {
             return adoptRef(new BeforeUnloadEvent);
diff --git a/WebCore/dom/CharacterData.cpp b/WebCore/dom/CharacterData.cpp
index bc9ec56..0cb2847 100644
--- a/WebCore/dom/CharacterData.cpp
+++ b/WebCore/dom/CharacterData.cpp
@@ -24,7 +24,7 @@
 
 #include "EventNames.h"
 #include "ExceptionCode.h"
-#include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "MutationEvent.h"
 #include "RenderText.h"
 
@@ -199,7 +199,7 @@ void CharacterData::dispatchModifiedEvent(StringImpl* prevValue)
         dispatchEvent(MutationEvent::create(eventNames().DOMCharacterDataModifiedEvent, true, 0, prevValue, m_data));
     dispatchSubtreeModifiedEvent();
 #if ENABLE(INSPECTOR)
-    InspectorController::characterDataModified(this);
+    InspectorInstrumentation::characterDataModified(document(), this);
 #endif
 }
 
diff --git a/WebCore/dom/ClassNodeList.h b/WebCore/dom/ClassNodeList.h
index ea048a2..13d5d24 100644
--- a/WebCore/dom/ClassNodeList.h
+++ b/WebCore/dom/ClassNodeList.h
@@ -31,6 +31,7 @@
 #define ClassNodeList_h
 
 #include "DynamicNodeList.h"
+#include "Node.h"
 #include "SpaceSplitString.h"
 
 namespace WebCore {
diff --git a/WebCore/dom/ClipboardEvent.cpp b/WebCore/dom/ClipboardEvent.cpp
index 3c427e1..b64703d 100644
--- a/WebCore/dom/ClipboardEvent.cpp
+++ b/WebCore/dom/ClipboardEvent.cpp
@@ -34,6 +34,10 @@ ClipboardEvent::ClipboardEvent(const AtomicString& eventType, bool canBubble, bo
 {
 }
 
+ClipboardEvent::~ClipboardEvent()
+{
+}
+
 bool ClipboardEvent::isClipboardEvent() const
 {
     return true;
diff --git a/WebCore/dom/ClipboardEvent.h b/WebCore/dom/ClipboardEvent.h
index b9bc705..42741e6 100644
--- a/WebCore/dom/ClipboardEvent.h
+++ b/WebCore/dom/ClipboardEvent.h
@@ -31,6 +31,8 @@ namespace WebCore {
 
     class ClipboardEvent : public Event {
     public:
+        virtual ~ClipboardEvent();
+
         static PassRefPtr<ClipboardEvent> create()
         {
             return adoptRef(new ClipboardEvent);
diff --git a/WebCore/dom/ContainerNode.cpp b/WebCore/dom/ContainerNode.cpp
index e18f6fe..fc33519 100644
--- a/WebCore/dom/ContainerNode.cpp
+++ b/WebCore/dom/ContainerNode.cpp
@@ -33,7 +33,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "InlineTextBox.h"
-#include "InspectorController.h"
+#include "InspectorInstrumentation.h"
 #include "MutationEvent.h"
 #include "Page.h"
 #include "RenderBox.h"
@@ -135,7 +135,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
         Node* child = it->get();
 
         // If child is already present in the tree, first remove it from the old location.
-        if (Node* oldParent = child->parentNode())
+        if (ContainerNode* oldParent = child->parentNode())
             oldParent->removeChild(child, ec);
         if (ec)
             return false;
@@ -155,7 +155,7 @@ bool ContainerNode::insertBefore(PassRefPtr<Node> newChild, Node* refChild, Exce
             break;
 
 #if ENABLE(INSPECTOR)
-        InspectorController::willInsertDOMNode(child, this);
+        InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
         insertBeforeCommon(next.get(), child);
@@ -226,7 +226,7 @@ void ContainerNode::parserInsertBefore(PassRefPtr<Node> newChild, Node* nextChil
         Node* child = it->get();
 
 #if ENABLE(INSPECTOR)
-        InspectorController::willInsertDOMNode(child, this);
+        InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
         insertBeforeCommon(next.get(), child);
@@ -285,7 +285,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         RefPtr<Node> nextChild = isFragment ? child->nextSibling() : 0;
 
         // Remove child from its old position.
-        if (Node* oldParent = child->parentNode())
+        if (ContainerNode* oldParent = child->parentNode())
             oldParent->removeChild(child.get(), ec);
         if (ec)
             return false;
@@ -303,7 +303,7 @@ bool ContainerNode::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, Exce
         ASSERT(!child->previousSibling());
 
 #if ENABLE(INSPECTOR)
-        InspectorController::willInsertDOMNode(child.get(), this);
+        InspectorInstrumentation::willInsertDOMNode(document(), child.get(), this);
 #endif
 
         // Add child after "prev".
@@ -489,10 +489,10 @@ void ContainerNode::parserRemoveChild(Node* oldChild)
 
 // this differs from other remove functions because it forcibly removes all the children,
 // regardless of read-only status or event exceptions, e.g.
-bool ContainerNode::removeChildren()
+void ContainerNode::removeChildren()
 {
     if (!m_firstChild)
-        return false;
+        return;
 
     // The container node can be removed from event handlers.
     RefPtr<ContainerNode> protect(this);
@@ -541,8 +541,6 @@ bool ContainerNode::removeChildren()
         // document. There is no explanation for this discrepancy between removeChild()
         // and its optimized version removeChildren().
     }
-
-    return true;
 }
 
 bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
@@ -571,7 +569,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
     for (NodeVector::const_iterator it = targets.begin(); it != targets.end(); ++it) {
         Node* child = it->get();
         // If child is already present in the tree, first remove it
-        if (Node* oldParent = child->parentNode()) {
+        if (ContainerNode* oldParent = child->parentNode()) {
             oldParent->removeChild(child, ec);
             if (ec)
                 return false;
@@ -584,7 +582,7 @@ bool ContainerNode::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bo
         }
 
 #if ENABLE(INSPECTOR)
-        InspectorController::willInsertDOMNode(child, this);
+        InspectorInstrumentation::willInsertDOMNode(document(), child, this);
 #endif
 
         // Append child to the end of the list
@@ -626,7 +624,7 @@ void ContainerNode::parserAddChild(PassRefPtr<Node> newChild)
     ASSERT(!newChild->parent()); // Use appendChild if you need to handle reparenting (and want DOM mutation events).
 
 #if ENABLE(INSPECTOR)
-    InspectorController::willInsertDOMNode(newChild.get(), this);
+    InspectorInstrumentation::willInsertDOMNode(document(), newChild.get(), this);
 #endif
 
     forbidEventDispatch();
@@ -1001,7 +999,7 @@ static void notifyChildInserted(Node* child)
     ASSERT(!eventDispatchForbidden());
 
 #if ENABLE(INSPECTOR)
-    InspectorController::didInsertDOMNode(child);
+    InspectorInstrumentation::didInsertDOMNode(child->document(), child);
 #endif
 
     RefPtr<Node> c = child;
@@ -1037,7 +1035,7 @@ static void dispatchChildRemovalEvents(Node* child)
     ASSERT(!eventDispatchForbidden());
 
 #if ENABLE(INSPECTOR)
-    InspectorController::willRemoveDOMNode(child);
+    InspectorInstrumentation::willRemoveDOMNode(child->document(), child);
 #endif
 
     RefPtr<Node> c = child;
diff --git a/WebCore/dom/ContainerNode.h b/WebCore/dom/ContainerNode.h
index ab90783..76eb1bd 100644
--- a/WebCore/dom/ContainerNode.h
+++ b/WebCore/dom/ContainerNode.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2009, 2010 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -25,9 +25,10 @@
 #define ContainerNode_h
 
 #include "Node.h"
-#include "FloatPoint.h"
 
 namespace WebCore {
+
+class FloatPoint;
     
 typedef void (*NodeCallback)(Node*);
 
@@ -43,10 +44,10 @@ public:
     Node* firstChild() const { return m_firstChild; }
     Node* lastChild() const { return m_lastChild; }
 
-    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChild(Node* child, ExceptionCode&);
-    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool removeChild(Node* child, ExceptionCode&);
+    bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
 
     // These methods are only used during parsing.
     // They don't send DOM mutation events or handle reparenting.
@@ -72,8 +73,9 @@ public:
     virtual void removedFromTree(bool deep);
     virtual void childrenChanged(bool createdByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
 
-    virtual bool removeChildren();
-
+    // FIXME: It's not good to have two functions with such similar names, especially public functions.
+    // How do removeChildren and removeAllChildren differ?
+    void removeChildren();
     void removeAllChildren();
     void takeAllChildrenFrom(ContainerNode*);
 
@@ -118,6 +120,21 @@ private:
     Node* m_lastChild;
 };
 
+inline ContainerNode* toContainerNode(Node* node)
+{
+    ASSERT(!node || node->isContainerNode());
+    return static_cast<ContainerNode*>(node);
+}
+
+inline const ContainerNode* toContainerNode(const Node* node)
+{
+    ASSERT(!node || node->isContainerNode());
+    return static_cast<const ContainerNode*>(node);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toContainerNode(const ContainerNode*);
+
 inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
     : Node(document, type)
     , m_firstChild(0)
@@ -125,28 +142,32 @@ inline ContainerNode::ContainerNode(Document* document, ConstructionType type)
 {
 }
 
-inline unsigned Node::containerChildNodeCount() const
+inline unsigned Node::childNodeCount() const
 {
-    ASSERT(isContainerNode());
-    return static_cast<const ContainerNode*>(this)->childNodeCount();
+    if (!isContainerNode())
+        return 0;
+    return toContainerNode(this)->childNodeCount();
 }
 
-inline Node* Node::containerChildNode(unsigned index) const
+inline Node* Node::childNode(unsigned index) const
 {
-    ASSERT(isContainerNode());
-    return static_cast<const ContainerNode*>(this)->childNode(index);
+    if (!isContainerNode())
+        return 0;
+    return toContainerNode(this)->childNode(index);
 }
 
-inline Node* Node::containerFirstChild() const
+inline Node* Node::firstChild() const
 {
-    ASSERT(isContainerNode());
-    return static_cast<const ContainerNode*>(this)->firstChild();
+    if (!isContainerNode())
+        return 0;
+    return toContainerNode(this)->firstChild();
 }
 
-inline Node* Node::containerLastChild() const
+inline Node* Node::lastChild() const
 {
-    ASSERT(isContainerNode());
-    return static_cast<const ContainerNode*>(this)->lastChild();
+    if (!isContainerNode())
+        return 0;
+    return toContainerNode(this)->lastChild();
 }
 
 } // namespace WebCore
diff --git a/WebCore/dom/CustomEvent.cpp b/WebCore/dom/CustomEvent.cpp
index c377063..53e255d 100644
--- a/WebCore/dom/CustomEvent.cpp
+++ b/WebCore/dom/CustomEvent.cpp
@@ -34,6 +34,10 @@ CustomEvent::CustomEvent()
 {
 }
 
+CustomEvent::~CustomEvent()
+{
+}
+
 void CustomEvent::initCustomEvent(const AtomicString& type, bool canBubble, bool cancelable, ScriptValue detail)
 {
     if (dispatched())
diff --git a/WebCore/dom/CustomEvent.h b/WebCore/dom/CustomEvent.h
index 8372af2..65c3f04 100644
--- a/WebCore/dom/CustomEvent.h
+++ b/WebCore/dom/CustomEvent.h
@@ -34,6 +34,8 @@ namespace WebCore {
 
 class CustomEvent : public Event {
 public:
+    virtual ~CustomEvent();
+
     static PassRefPtr<CustomEvent> create()
     {
         return adoptRef(new CustomEvent);
diff --git a/WebCore/dom/DOMAllInOne.cpp b/WebCore/dom/DOMAllInOne.cpp
new file mode 100644
index 0000000..c1d536a
--- /dev/null
+++ b/WebCore/dom/DOMAllInOne.cpp
@@ -0,0 +1,130 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "ActiveDOMObject.cpp"
+#include "AsyncScriptRunner.cpp"
+#include "Attr.cpp"
+#include "Attribute.cpp"
+#include "BeforeProcessEvent.cpp"
+#include "BeforeTextInsertedEvent.cpp"
+#include "BeforeUnloadEvent.cpp"
+#include "CDATASection.cpp"
+#include "CSSMappedAttributeDeclaration.cpp"
+#include "CharacterData.cpp"
+#include "CheckedRadioButtons.cpp"
+#include "ChildNodeList.cpp"
+#include "ClassNodeList.cpp"
+#include "ClientRect.cpp"
+#include "ClientRectList.cpp"
+#include "Clipboard.cpp"
+#include "ClipboardEvent.cpp"
+#include "Comment.cpp"
+#include "CompositionEvent.cpp"
+#include "ContainerNode.cpp"
+#include "CustomEvent.cpp"
+#include "DOMImplementation.cpp"
+#include "DOMStringList.cpp"
+#include "DOMStringMap.cpp"
+#include "DatasetDOMStringMap.cpp"
+#include "DecodedDataDocumentParser.cpp"
+#include "DeviceMotionController.cpp"
+#include "DeviceMotionData.cpp"
+#include "DeviceMotionEvent.cpp"
+#include "DeviceOrientation.cpp"
+#include "DeviceOrientationController.cpp"
+#include "DeviceOrientationEvent.cpp"
+#include "Document.cpp"
+#include "DocumentFragment.cpp"
+#include "DocumentMarkerController.cpp"
+#include "DocumentParser.cpp"
+#include "DocumentType.cpp"
+#include "DynamicNodeList.cpp"
+#include "EditingText.cpp"
+#include "Element.cpp"
+#include "Entity.cpp"
+#include "EntityReference.cpp"
+#include "ErrorEvent.cpp"
+#include "Event.cpp"
+#include "EventNames.cpp"
+#include "EventTarget.cpp"
+#include "ExceptionBase.cpp"
+#include "ExceptionCode.cpp"
+#include "InputElement.cpp"
+#include "KeyboardEvent.cpp"
+#include "MessageChannel.cpp"
+#include "MessageEvent.cpp"
+#include "MessagePort.cpp"
+#include "MessagePortChannel.cpp"
+#include "MouseEvent.cpp"
+#include "MouseRelatedEvent.cpp"
+#include "MutationEvent.cpp"
+#include "NameNodeList.cpp"
+#include "NodeFilter.cpp"
+#include "NodeFilterCondition.cpp"
+#include "NodeIterator.cpp"
+#include "Notation.cpp"
+#include "OptionElement.cpp"
+#include "OptionGroupElement.cpp"
+#include "OverflowEvent.cpp"
+#include "PageTransitionEvent.cpp"
+#include "PendingScript.cpp"
+#include "PopStateEvent.cpp"
+#include "Position.cpp"
+#include "PositionIterator.cpp"
+#include "ProcessingInstruction.cpp"
+#include "ProgressEvent.cpp"
+#include "Range.cpp"
+#include "RegisteredEventListener.cpp"
+#include "ScriptElement.cpp"
+#include "ScriptExecutionContext.cpp"
+#include "ScriptableDocumentParser.cpp"
+#include "SelectElement.cpp"
+#include "SelectorNodeList.cpp"
+#include "SpaceSplitString.cpp"
+#include "StaticHashSetNodeList.cpp"
+#include "StaticNodeList.cpp"
+#include "StyleElement.cpp"
+#include "StyledElement.cpp"
+#include "TagNodeList.cpp"
+#include "Text.cpp"
+#include "TextEvent.cpp"
+#include "Touch.cpp"
+#include "TouchEvent.cpp"
+#include "TouchList.cpp"
+#include "TransformSourceLibxslt.cpp"
+#include "Traversal.cpp"
+#include "TreeWalker.cpp"
+#include "UIEvent.cpp"
+#include "UIEventWithKeyState.cpp"
+#include "UserGestureIndicator.cpp"
+#include "UserTypingGestureIndicator.cpp"
+#include "ViewportArguments.cpp"
+#include "WebKitAnimationEvent.cpp"
+#include "WebKitTransitionEvent.cpp"
+#include "WheelEvent.cpp"
+#include "XMLDocumentParser.cpp"
+#include "XMLDocumentParserScope.cpp"
diff --git a/WebCore/dom/DOMStringList.cpp b/WebCore/dom/DOMStringList.cpp
index 660be92..430265a 100644
--- a/WebCore/dom/DOMStringList.cpp
+++ b/WebCore/dom/DOMStringList.cpp
@@ -28,6 +28,13 @@
 
 namespace WebCore {
 
+String DOMStringList::item(unsigned index) const
+{
+    if (index >= m_strings.size())
+        return String();
+    return m_strings[index];
+}
+
 bool DOMStringList::contains(const String& string) const
 {
     // FIXME: Currently, all consumers of DOMStringList store fairly small lists and thus an O(n)
diff --git a/WebCore/dom/DOMStringList.h b/WebCore/dom/DOMStringList.h
index a3f9b40..6719f17 100644
--- a/WebCore/dom/DOMStringList.h
+++ b/WebCore/dom/DOMStringList.h
@@ -48,7 +48,7 @@ public:
 
     // Implements the IDL.
     size_t length() const { return m_strings.size(); }
-    String item(unsigned index) const { return m_strings[index]; }
+    String item(unsigned index) const;
     bool contains(const String& str) const;
 
 private:
diff --git a/WebCore/dom/DOMStringList.idl b/WebCore/dom/DOMStringList.idl
index 271c9de..c9e5c29 100644
--- a/WebCore/dom/DOMStringList.idl
+++ b/WebCore/dom/DOMStringList.idl
@@ -30,7 +30,7 @@ module core {
         HasIndexGetter
     ] DOMStringList {
         readonly attribute unsigned long length;
-        DOMString item(in [IsIndex] unsigned long index);
+        [ConvertNullStringTo=Null] DOMString item(in [IsIndex] unsigned long index);
         boolean contains(in DOMString string);
     };
 
diff --git a/WebCore/dom/DeviceMotionController.h b/WebCore/dom/DeviceMotionController.h
index 422be73..70c948e 100644
--- a/WebCore/dom/DeviceMotionController.h
+++ b/WebCore/dom/DeviceMotionController.h
@@ -46,6 +46,8 @@ public:
 
     void didChangeDeviceMotion(DeviceMotionData*);
 
+    bool isActive() { return !m_listeners.isEmpty(); }
+
 private:
     void timerFired(Timer<DeviceMotionController>*);
     
diff --git a/WebCore/dom/DeviceOrientationController.h b/WebCore/dom/DeviceOrientationController.h
index 53b80f8..4fa9006 100644
--- a/WebCore/dom/DeviceOrientationController.h
+++ b/WebCore/dom/DeviceOrientationController.h
@@ -48,6 +48,8 @@ public:
 
     void didChangeDeviceOrientation(DeviceOrientation*);
 
+    bool isActive() { return !m_listeners.isEmpty(); }
+
 private:
     void timerFired(Timer<DeviceOrientationController>*);
 
diff --git a/WebCore/dom/Document.cpp b/WebCore/dom/Document.cpp
index 2ad8b50..1e7c213 100644
--- a/WebCore/dom/Document.cpp
+++ b/WebCore/dom/Document.cpp
@@ -32,7 +32,6 @@
 #include "Attr.h"
 #include "Attribute.h"
 #include "CDATASection.h"
-#include "CSSHelper.h"
 #include "CSSStyleSelector.h"
 #include "CSSStyleSheet.h"
 #include "CSSValueKeywords.h"
@@ -81,6 +80,7 @@
 #include "HTMLMapElement.h"
 #include "HTMLNameCollection.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "HTMLStyleElement.h"
 #include "HTMLTitleElement.h"
 #include "HTTPParsers.h"
@@ -88,7 +88,7 @@
 #include "HitTestResult.h"
 #include "ImageLoader.h"
 #include "InspectorController.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "KeyboardEvent.h"
 #include "Logging.h"
 #include "MessageEvent.h"
@@ -425,6 +425,7 @@ Document::Document(Frame* frame, const KURL& url, bool isXHTML, bool isHTML, con
     , m_areKeysEnabledInFullScreen(0)
 #endif
     , m_loadEventDelayCount(0)
+    , m_loadEventDelayTimer(this, &Document::loadEventDelayTimerFired)
 {
     m_document = this;
 
@@ -1013,8 +1014,10 @@ String Document::readyState() const
 
 void Document::setReadyState(ReadyState readyState)
 {
-    // FIXME: Fire the readystatechange event on this Document.
+    if (readyState == m_readyState)
+        return;
     m_readyState = readyState;
+    dispatchEvent(Event::create(eventNames().readystatechangeEvent, false, false));
 }
 
 String Document::encoding() const
@@ -1098,7 +1101,7 @@ PassRefPtr<NodeList> Document::nodesFromRect(int centerX, int centerY, unsigned
     // When ignoreClipping is false, this method returns null for coordinates outside of the viewport.
     if (ignoreClipping)
         type |= HitTestRequest::IgnoreClipping;
-    else if (!frameView->visibleContentRect().intersects(HitTestResult::rectFromPoint(point, topPadding, rightPadding, bottomPadding, leftPadding)))
+    else if (!frameView->visibleContentRect().intersects(HitTestResult::rectForPoint(point, topPadding, rightPadding, bottomPadding, leftPadding)))
         return 0;
 
     HitTestRequest request(type);
@@ -1189,7 +1192,7 @@ PassRefPtr<Range> Document::caretRangeFromPoint(int x, int y)
     Node* shadowAncestorNode = node->shadowAncestorNode();
     if (shadowAncestorNode != node) {
         unsigned offset = shadowAncestorNode->nodeIndex();
-        Node* container = shadowAncestorNode->parentNode();
+        ContainerNode* container = shadowAncestorNode->parentNode();
         return Range::create(this, container, offset, container, offset);
     }
 
@@ -1489,10 +1492,7 @@ void Document::recalcStyle(StyleChange change)
     if (m_inStyleRecalc)
         return; // Guard against re-entrancy. -dwh
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->willRecalculateStyle();
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willRecalculateStyle(this);
 
     m_inStyleRecalc = true;
     suspendPostAttachCallbacks();
@@ -1555,10 +1555,7 @@ bail_out:
         implicitClose();
     }
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->didRecalculateStyle();
-#endif
+    InspectorInstrumentation::didRecalculateStyle(cookie);
 }
 
 void Document::updateStyleIfNeeded()
@@ -1916,6 +1913,7 @@ void Document::open(Document* ownerDocument)
             m_frame->loader()->stopAllLoaders();
     }
 
+    removeAllEventListeners();
     implicitOpen();
 
     if (DOMWindow* domWindow = this->domWindow())
@@ -2036,7 +2034,7 @@ void Document::implicitClose()
         return;
     }
 
-    bool wasLocationChangePending = frame() && frame()->redirectScheduler()->locationChangePending();
+    bool wasLocationChangePending = frame() && frame()->navigationScheduler()->locationChangePending();
     bool doload = !parsing() && m_parser && !m_processingLoadEvent && !wasLocationChangePending;
     
     if (!doload)
@@ -2091,7 +2089,7 @@ void Document::implicitClose()
     // fires. This will improve onload scores, and other browsers do it.
     // If they wanna cheat, we can too. -dwh
 
-    if (frame()->redirectScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
+    if (frame()->navigationScheduler()->locationChangePending() && elapsedTime() < cLayoutScheduleThreshold) {
         // Just bail out. Before or during the onload we were shifted to another page.
         // The old i-Bench suite does this. When this happens don't bother painting or laying out.        
         view()->unscheduleRelayout();
@@ -2290,7 +2288,7 @@ void Document::processBaseElement()
     // FIXME: Since this doesn't share code with completeURL it may not handle encodings correctly.
     KURL baseElementURL;
     if (href) {
-        String strippedHref = deprecatedParseURL(*href);
+        String strippedHref = stripLeadingAndTrailingHTMLSpaces(*href);
         if (!strippedHref.isEmpty() && (!frame() || frame()->script()->xssAuditor()->canSetBaseElementURL(*href)))
             baseElementURL = KURL(url(), strippedHref);
     }
@@ -2571,7 +2569,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
                 url = frame->loader()->url().string();
             else
                 url = completeURL(url).string();
-            frame->redirectScheduler()->scheduleRedirect(delay, url);
+            frame->navigationScheduler()->scheduleRedirect(delay, url);
         }
     } else if (equalIgnoringCase(equiv, "set-cookie")) {
         // FIXME: make setCookie work on XML documents too; e.g. in case of <html:meta .....>
@@ -2588,7 +2586,7 @@ void Document::processHttpEquiv(const String& equiv, const String& content)
             FrameLoader* frameLoader = frame->loader();
             if (frameLoader->shouldInterruptLoadForXFrameOptions(content, url())) {
                 frameLoader->stopAllLoaders();
-                frame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
+                frame->navigationScheduler()->scheduleLocationChange(blankURL(), String());
 
                 DEFINE_STATIC_LOCAL(String, consoleMessage, ("Refused to display document because display forbidden by X-Frame-Options.\n"));
                 frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
@@ -2670,7 +2668,7 @@ void Document::processViewport(const String& features)
     if (!frame || !frame->page())
         return;
 
-    frame->page()->chrome()->client()->didReceiveViewportArguments(frame, m_viewportArguments);
+    frame->page()->updateViewportArguments();
 }
 
 MouseEventWithHitTestResults Document::prepareMouseEvent(const HitTestRequest& request, const IntPoint& documentPoint, const PlatformMouseEvent& event)
@@ -3168,6 +3166,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
         
         oldFocusedNode->dispatchUIEvent(eventNames().focusoutEvent, 0, 0); // DOM level 3 name for the bubbling blur event.
+        // FIXME: We should remove firing DOMFocusOutEvent event when we are sure no content depends
+        // on it, probably when <rdar://problem/8503958> is resolved.
+        oldFocusedNode->dispatchUIEvent(eventNames().DOMFocusOutEvent, 0, 0); // DOM level 2 name for compatibility.
 
         if (m_focusedNode) {
             // handler shifted focus
@@ -3208,6 +3209,9 @@ bool Document::setFocusedNode(PassRefPtr<Node> newFocusedNode)
         }
 
         m_focusedNode->dispatchUIEvent(eventNames().focusinEvent, 0, 0); // DOM level 3 bubbling focus event.
+        // FIXME: We should remove firing DOMFocusInEvent event when we are sure no content depends
+        // on it, probably when <rdar://problem/8503958> is resolved.
+        m_focusedNode->dispatchUIEvent(eventNames().DOMFocusInEvent, 0, 0); // DOM level 2 for compatibility.
 
         if (m_focusedNode != newFocusedNode) { 
             // handler shifted focus
@@ -3522,6 +3526,10 @@ PassRefPtr<Event> Document::createEvent(const String& eventType, ExceptionCode&
     else if (eventType == "DeviceOrientationEvent")
         event = DeviceOrientationEvent::create();
 #endif
+#if ENABLE(ORIENTATION_EVENTS)
+    else if (eventType == "OrientationEvent")
+        event = Event::create();
+#endif
     if (event)
         return event.release();
 
@@ -3888,7 +3896,7 @@ void Document::setInPageCache(bool flag)
         m_savedRenderer = 0;
 
         if (frame() && frame()->page())
-            frame()->page()->chrome()->client()->didReceiveViewportArguments(frame(), m_viewportArguments);
+            frame()->page()->updateViewportArguments();
 
         if (childNeedsStyleRecalc())
             scheduleStyleRecalc();
@@ -4490,11 +4498,12 @@ void Document::updateURLForPushOrReplaceState(const KURL& url)
 
 void Document::statePopped(SerializedScriptValue* stateObject)
 {
-    Frame* f = frame();
-    if (!f)
+    if (!frame())
         return;
     
-    if (f->loader()->isComplete())
+    // Per step 11 of section 6.5.9 (history traversal) of the HTML5 spec, we 
+    // defer firing of popstate until we're in the complete state.
+    if (m_readyState == Complete)
         enqueuePopstateEvent(stateObject);
     else
         m_pendingStateObject = stateObject;
@@ -4742,17 +4751,12 @@ bool Document::isXHTMLMPDocument() const
 #endif
 
 #if ENABLE(INSPECTOR)
-InspectorTimelineAgent* Document::inspectorTimelineAgent() const 
-{
-    return page() ? page()->inspectorTimelineAgent() : 0;
-}
-
-InspectorController* Document::inspectorController() const 
+InspectorController* Document::inspectorController() const
 {
     return page() ? page()->inspectorController() : 0;
 }
 #endif
-    
+
 #if ENABLE(FULLSCREEN_API)
 void Document::webkitRequestFullScreenForElement(Element* element, unsigned short flags)
 {
@@ -4822,7 +4826,13 @@ void Document::decrementLoadEventDelayCount()
     ASSERT(m_loadEventDelayCount);
     --m_loadEventDelayCount;
 
-    if (frame() && !m_loadEventDelayCount)
+    if (frame() && !m_loadEventDelayCount && !m_loadEventDelayTimer.isActive())
+        m_loadEventDelayTimer.startOneShot(0);
+}
+
+void Document::loadEventDelayTimerFired(Timer<Document>*)
+{
+    if (frame())
         frame()->loader()->checkCompleted();
 }
 
diff --git a/WebCore/dom/Document.h b/WebCore/dom/Document.h
index e119d40..1fb7079 100644
--- a/WebCore/dom/Document.h
+++ b/WebCore/dom/Document.h
@@ -88,7 +88,7 @@ class HTMLInputElement;
 class HTMLMapElement;
 class HitTestRequest;
 class HitTestResult;
-class InspectorTimelineAgent;
+class InspectorController;
 class IntPoint;
 class DOMWrapperWorld;
 class JSNode;
@@ -261,6 +261,7 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(focus);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(load);
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(readystatechange);
 
     // WebKit extensions
     DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
@@ -486,7 +487,6 @@ public:
     Page* page() const; // can be NULL
     Settings* settings() const; // can be NULL
 #if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* inspectorTimelineAgent() const; // can be NULL
     virtual InspectorController* inspectorController() const; // can be NULL
 #endif
 
@@ -1096,6 +1096,8 @@ private:
 
     PassRefPtr<NodeList> handleZeroPadding(const HitTestRequest&, HitTestResult&) const;
 
+    void loadEventDelayTimerFired(Timer<Document>*);
+
     OwnPtr<CSSStyleSelector> m_styleSelector;
     bool m_didCalculateStyleSelector;
 
@@ -1340,6 +1342,7 @@ private:
 #endif
 
     int m_loadEventDelayCount;
+    Timer<Document> m_loadEventDelayTimer;
 
     ViewportArguments m_viewportArguments;
 };
diff --git a/WebCore/dom/Document.idl b/WebCore/dom/Document.idl
index f05a430..4a37acc 100644
--- a/WebCore/dom/Document.idl
+++ b/WebCore/dom/Document.idl
@@ -278,6 +278,7 @@ module core {
         attribute [DontEnum] EventListener onmouseover;
         attribute [DontEnum] EventListener onmouseup;
         attribute [DontEnum] EventListener onmousewheel;
+        attribute [DontEnum] EventListener onreadystatechange;
         attribute [DontEnum] EventListener onscroll;
         attribute [DontEnum] EventListener onselect;
         attribute [DontEnum] EventListener onsubmit;
@@ -297,7 +298,6 @@ module core {
         // attribute [DontEnum] EventListener onplaying;
         // attribute [DontEnum] EventListener onprogress;
         // attribute [DontEnum] EventListener onratechange;
-        // attribute [DontEnum] EventListener onreadystatechange;
         // attribute [DontEnum] EventListener onseeked;
         // attribute [DontEnum] EventListener onseeking;
         // attribute [DontEnum] EventListener onshow;
diff --git a/WebCore/dom/DocumentParser.cpp b/WebCore/dom/DocumentParser.cpp
index efb96b0..5f8e04f 100644
--- a/WebCore/dom/DocumentParser.cpp
+++ b/WebCore/dom/DocumentParser.cpp
@@ -32,6 +32,7 @@ namespace WebCore {
 
 DocumentParser::DocumentParser(Document* document)
     : m_state(ParsingState)
+    , m_documentWasLoadedAsPartOfNavigation(false)
     , m_document(document)
 {
     ASSERT(document);
diff --git a/WebCore/dom/DocumentParser.h b/WebCore/dom/DocumentParser.h
index 7cc9e7b..aa18a64 100644
--- a/WebCore/dom/DocumentParser.h
+++ b/WebCore/dom/DocumentParser.h
@@ -88,6 +88,9 @@ public:
     // detach is called.
     virtual void detach();
 
+    void setDocumentWasLoadedAsPartOfNavigation() { m_documentWasLoadedAsPartOfNavigation = true; }
+    bool documentWasLoadedAsPartOfNavigation() const { return m_documentWasLoadedAsPartOfNavigation; }
+
 protected:
     DocumentParser(Document*);
 
@@ -99,6 +102,7 @@ private:
         DetachedState
     };
     ParserState m_state;
+    bool m_documentWasLoadedAsPartOfNavigation;
 
     // Every DocumentParser needs a pointer back to the document.
     // m_document will be 0 after the parser is stopped.
diff --git a/WebCore/dom/DynamicNodeList.cpp b/WebCore/dom/DynamicNodeList.cpp
index c7609a1..3538b60 100644
--- a/WebCore/dom/DynamicNodeList.cpp
+++ b/WebCore/dom/DynamicNodeList.cpp
@@ -124,7 +124,7 @@ Node* DynamicNodeList::itemWithName(const AtomicString& elementId) const
     if (m_rootNode->isDocumentNode() || m_rootNode->inDocument()) {
         Element* node = m_rootNode->document()->getElementById(elementId);
         if (node && nodeMatches(node)) {
-            for (Node* p = node->parentNode(); p; p = p->parentNode()) {
+            for (ContainerNode* p = node->parentNode(); p; p = p->parentNode()) {
                 if (p == m_rootNode)
                     return node;
             }
diff --git a/WebCore/dom/Element.cpp b/WebCore/dom/Element.cpp
index c408790..83e129e 100644
--- a/WebCore/dom/Element.cpp
+++ b/WebCore/dom/Element.cpp
@@ -44,7 +44,8 @@
 #include "FrameView.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
-#include "InspectorController.h"
+#include "HTMLParserIdioms.h"
+#include "InspectorInstrumentation.h"
 #include "NodeList.h"
 #include "NodeRenderStyle.h"
 #include "Page.h"
@@ -93,6 +94,11 @@ NodeRareData* Element::createRareData()
     return new ElementRareData;
 }
 
+DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, blur);
+DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, error);
+DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, focus);
+DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(Element, load);
+
 PassRefPtr<DocumentFragment> Element::deprecatedCreateContextualFragment(const String& markup, FragmentScriptingPermission scriptingPermission)
 {
     RefPtr<DocumentFragment> fragment = document()->createDocumentFragment();
@@ -116,18 +122,19 @@ PassRefPtr<DocumentFragment> Element::deprecatedCreateContextualFragment(const S
     for (RefPtr<Node> node = fragment->firstChild(); node; node = nextNode) {
         nextNode = node->nextSibling();
         if (node->hasTagName(htmlTag) || node->hasTagName(bodyTag)) {
-            Node* firstChild = node->firstChild();
+            HTMLElement* element = static_cast<HTMLElement*>(node.get());
+            Node* firstChild = element->firstChild();
             if (firstChild)
                 nextNode = firstChild;
             RefPtr<Node> nextChild;
             for (RefPtr<Node> child = firstChild; child; child = nextChild) {
                 nextChild = child->nextSibling();
-                node->removeChild(child.get(), ignoredExceptionCode);
+                element->removeChild(child.get(), ignoredExceptionCode);
                 ASSERT(!ignoredExceptionCode);
-                fragment->insertBefore(child, node.get(), ignoredExceptionCode);
+                fragment->insertBefore(child, element, ignoredExceptionCode);
                 ASSERT(!ignoredExceptionCode);
             }
-            fragment->removeChild(node.get(), ignoredExceptionCode);
+            fragment->removeChild(element, ignoredExceptionCode);
             ASSERT(!ignoredExceptionCode);
         } else if (node->hasTagName(headTag)) {
             fragment->removeChild(node.get(), ignoredExceptionCode);
@@ -558,7 +565,7 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorController::willModifyDOMAttr(this);
+        InspectorInstrumentation::willModifyDOMAttr(document(), this);
 #endif
 
     const AtomicString& localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
@@ -588,7 +595,7 @@ void Element::setAttribute(const AtomicString& name, const AtomicString& value,
 
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorController::didModifyDOMAttr(this);
+        InspectorInstrumentation::didModifyDOMAttr(document(), this);
 #endif
 }
 
@@ -596,7 +603,7 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
 {
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorController::willModifyDOMAttr(this);
+        InspectorInstrumentation::willModifyDOMAttr(document(), this);
 #endif
 
     document()->incDOMTreeVersion();
@@ -621,7 +628,7 @@ void Element::setAttribute(const QualifiedName& name, const AtomicString& value,
 
 #if ENABLE(INSPECTOR)
     if (!isSynchronizingStyleAttribute())
-        InspectorController::didModifyDOMAttr(this);
+        InspectorInstrumentation::didModifyDOMAttr(document(), this);
 #endif
 }
 
@@ -680,7 +687,7 @@ static bool isEventHandlerAttribute(const QualifiedName& name)
 
 static bool isAttributeToRemove(const QualifiedName& name, const AtomicString& value)
 {    
-    return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(deprecatedParseURL(value));       
+    return (name.localName().endsWith(hrefAttr.localName()) || name == srcAttr || name == actionAttr) && protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value));       
 }
 
 void Element::setAttributeMap(PassRefPtr<NamedNodeMap> list, FragmentScriptingPermission scriptingPermission)
@@ -769,7 +776,7 @@ KURL Element::baseURI() const
     if (!base.protocol().isEmpty())
         return base;
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent)
         return base;
 
@@ -1257,7 +1264,7 @@ void Element::setAttributeNS(const AtomicString& namespaceURI, const AtomicStrin
 
 void Element::removeAttribute(const String& name, ExceptionCode& ec)
 {
-    InspectorController::willModifyDOMAttr(this);
+    InspectorInstrumentation::willModifyDOMAttr(document(), this);
 
     String localName = shouldIgnoreAttributeCase(this) ? name.lower() : name;
 
@@ -1267,7 +1274,7 @@ void Element::removeAttribute(const String& name, ExceptionCode& ec)
             ec = 0;
     }
     
-    InspectorController::didModifyDOMAttr(this);
+    InspectorInstrumentation::didModifyDOMAttr(document(), this);
 }
 
 void Element::removeAttributeNS(const String& namespaceURI, const String& localName, ExceptionCode& ec)
@@ -1612,7 +1619,7 @@ KURL Element::getURLAttribute(const QualifiedName& name) const
             ASSERT(isURLAttribute(attribute));
     }
 #endif
-    return document()->completeURL(deprecatedParseURL(getAttribute(name)));
+    return document()->completeURL(stripLeadingAndTrailingHTMLSpaces(getAttribute(name)));
 }
 
 KURL Element::getNonEmptyURLAttribute(const QualifiedName& name) const
@@ -1623,7 +1630,7 @@ KURL Element::getNonEmptyURLAttribute(const QualifiedName& name) const
             ASSERT(isURLAttribute(attribute));
     }
 #endif
-    String value = deprecatedParseURL(getAttribute(name));
+    String value = stripLeadingAndTrailingHTMLSpaces(getAttribute(name));
     if (value.isEmpty())
         return KURL();
     return document()->completeURL(value);
diff --git a/WebCore/dom/Element.h b/WebCore/dom/Element.h
index b51e750..b890ecd 100644
--- a/WebCore/dom/Element.h
+++ b/WebCore/dom/Element.h
@@ -74,10 +74,10 @@ public:
 
     // These four attribute event handler attributes are overridden by HTMLBodyElement
     // and HTMLFrameSetElement to forward to the DOMWindow.
-    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
-    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
-    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(focus);
-    DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(load);
+    DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(blur);
+    DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(error);
+    DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(focus);
+    DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(load);
 
     // WebKit extensions
     DEFINE_ATTRIBUTE_EVENT_LISTENER(beforecut);
@@ -276,6 +276,12 @@ public:
     DOMStringMap* dataset();
     DOMStringMap* optionalDataset() const;
 
+#if ENABLE(MATHML)
+    virtual bool isMathMLElement() const { return false; }
+#else
+    static bool isMathMLElement() { return false; }
+#endif
+
     virtual bool isFormControlElement() const { return false; }
     virtual bool isEnabledFormControl() const { return true; }
     virtual bool isReadOnlyFormControl() const { return false; }
@@ -372,25 +378,40 @@ private:
     mutable RefPtr<NamedNodeMap> m_attributeMap;
 };
     
+inline Element* toElement(Node* node)
+{
+    ASSERT(!node || node->isElementNode());
+    return static_cast<Element*>(node);
+}
+
+inline const Element* toElement(const Node* node)
+{
+    ASSERT(!node || node->isElementNode());
+    return static_cast<const Element*>(node);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toElement(const Element*);
+
 inline bool Node::hasTagName(const QualifiedName& name) const
 {
-    return isElementNode() && static_cast<const Element*>(this)->hasTagName(name);
+    return isElementNode() && toElement(this)->hasTagName(name);
 }
 
 inline bool Node::hasAttributes() const
 {
-    return isElementNode() && static_cast<const Element*>(this)->hasAttributes();
+    return isElementNode() && toElement(this)->hasAttributes();
 }
 
 inline NamedNodeMap* Node::attributes() const
 {
-    return isElementNode() ? static_cast<const Element*>(this)->attributes() : 0;
+    return isElementNode() ? toElement(this)->attributes() : 0;
 }
 
 inline Element* Node::parentElement() const
 {
-    Node* parent = parentNode();
-    return parent && parent->isElementNode() ? static_cast<Element*>(parent) : 0;
+    ContainerNode* parent = parentNode();
+    return parent && parent->isElementNode() ? toElement(parent) : 0;
 }
 
 inline NamedNodeMap* Element::attributes(bool readonly) const
diff --git a/WebCore/dom/Event.cpp b/WebCore/dom/Event.cpp
index bb404fa..9293a9a 100644
--- a/WebCore/dom/Event.cpp
+++ b/WebCore/dom/Event.cpp
@@ -282,25 +282,4 @@ void Event::setUnderlyingEvent(PassRefPtr<Event> ue)
     m_underlyingEvent = ue;
 }
 
-const AtomicString& Event::aliasedType() const
-{
-    if (type() == eventNames().focusinEvent)
-        return eventNames().DOMFocusInEvent;
-    if (type() == eventNames().focusoutEvent)
-        return eventNames().DOMFocusOutEvent;
-    if (type() == eventNames().DOMFocusInEvent)
-        return eventNames().focusinEvent;
-    if (type() == eventNames().DOMFocusOutEvent)
-        return eventNames().focusoutEvent;
-    
-    ASSERT_NOT_REACHED();
-    return type();
-}
-
-bool Event::hasAliasedType() const
-{
-    return type() == eventNames().focusinEvent || type() == eventNames().focusoutEvent ||
-           type() == eventNames().DOMFocusInEvent || type() == eventNames().DOMFocusOutEvent;
-}
-
 } // namespace WebCore
diff --git a/WebCore/dom/Event.h b/WebCore/dom/Event.h
index 2a00eee..82ac8ec 100644
--- a/WebCore/dom/Event.h
+++ b/WebCore/dom/Event.h
@@ -76,9 +76,6 @@ namespace WebCore {
 
         const AtomicString& type() const { return m_type; }
         
-        const AtomicString& aliasedType() const;
-        bool hasAliasedType() const;
-
         EventTarget* target() const { return m_target.get(); }
         void setTarget(PassRefPtr<EventTarget>);
 
diff --git a/WebCore/dom/EventNames.h b/WebCore/dom/EventNames.h
index 6b8b908..c91c136 100644
--- a/WebCore/dom/EventNames.h
+++ b/WebCore/dom/EventNames.h
@@ -170,7 +170,9 @@ namespace WebCore {
     \
     macro(loadend) \
     \
-    macro(webkitfullscreenchange)
+    macro(webkitfullscreenchange) \
+    \
+    macro(webkitspeechchange)
     \
 // end of DOM_EVENT_NAMES_FOR_EACH
 
diff --git a/WebCore/dom/EventTarget.cpp b/WebCore/dom/EventTarget.cpp
index d2b6f49..42cbb32 100644
--- a/WebCore/dom/EventTarget.cpp
+++ b/WebCore/dom/EventTarget.cpp
@@ -66,6 +66,10 @@ bool eventDispatchForbidden()
 }
 #endif // NDEBUG
 
+EventTargetData::EventTargetData()
+{
+}
+
 EventTargetData::~EventTargetData()
 {
     deleteAllValues(eventListenerMap);
@@ -299,14 +303,6 @@ bool EventTarget::fireEventListeners(Event* event)
     if (result != d->eventListenerMap.end())
         fireEventListeners(event, d, *result->second);
     
-    // Alias DOMFocusIn/DOMFocusOut to focusin/focusout (and vice versa). Just consider them to be the
-    // same event (triggering one another's handlers).  This mechanism allows us to deprecate or change event
-    // names in the future and still make them be interoperable.
-    if (event->hasAliasedType() && !event->immediatePropagationStopped()) {
-        EventListenerMap::iterator result = d->eventListenerMap.find(event->aliasedType());
-        if (result != d->eventListenerMap.end())
-            fireEventListeners(event, d, *result->second);
-    }
     return !event->defaultPrevented();
 }
         
diff --git a/WebCore/dom/EventTarget.h b/WebCore/dom/EventTarget.h
index de7c2e0..feff4ae 100644
--- a/WebCore/dom/EventTarget.h
+++ b/WebCore/dom/EventTarget.h
@@ -83,6 +83,7 @@ namespace WebCore {
     typedef HashMap<AtomicString, EventListenerVector*> EventListenerMap;
 
     struct EventTargetData : Noncopyable {
+        EventTargetData();
         ~EventTargetData();
 
         EventListenerMap eventListenerMap;
@@ -177,9 +178,13 @@ namespace WebCore {
         EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
         void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
 
-    #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
-        virtual EventListener* on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
-        virtual void setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
+    #define DECLARE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(attribute) \
+        virtual EventListener* on##attribute(); \
+        virtual void setOn##attribute(PassRefPtr<EventListener> listener); \
+
+    #define DEFINE_VIRTUAL_ATTRIBUTE_EVENT_LISTENER(type, attribute) \
+        EventListener* type::on##attribute() { return getAttributeEventListener(eventNames().attribute##Event); } \
+        void type::setOn##attribute(PassRefPtr<EventListener> listener) { setAttributeEventListener(eventNames().attribute##Event, listener); } \
 
     #define DEFINE_WINDOW_ATTRIBUTE_EVENT_LISTENER(attribute) \
         EventListener* on##attribute() { return document()->getWindowAttributeEventListener(eventNames().attribute##Event); } \
diff --git a/WebCore/dom/ExceptionBase.cpp b/WebCore/dom/ExceptionBase.cpp
index d175d8b..edca706 100644
--- a/WebCore/dom/ExceptionBase.cpp
+++ b/WebCore/dom/ExceptionBase.cpp
@@ -29,6 +29,8 @@
 #include "config.h"
 #include "ExceptionBase.h"
 
+#include <wtf/text/StringConcatenate.h>
+
 namespace WebCore {
 
 ExceptionBase::ExceptionBase(const ExceptionCodeDescription& description)
@@ -37,9 +39,9 @@ ExceptionBase::ExceptionBase(const ExceptionCodeDescription& description)
     , m_description(description.description)
 {
     if (description.name)
-        m_message = String::format("%s: %s Exception %d", description.name, description.typeName, description.code);
+        m_message = makeString(description.name, ": ", description.typeName, " Exception ", String::number(description.code));
     else
-        m_message = String::format("%s Exception %d", description.typeName, description.code);
+        m_message = makeString(description.typeName, " Exception ", String::number(description.code));
 }
 
 String ExceptionBase::toString() const
diff --git a/WebCore/dom/InputElement.cpp b/WebCore/dom/InputElement.cpp
index b2a9714..ecae206 100644
--- a/WebCore/dom/InputElement.cpp
+++ b/WebCore/dom/InputElement.cpp
@@ -279,6 +279,10 @@ InputElementData::InputElementData()
 {
 }
 
+InputElementData::~InputElementData()
+{
+}
+
 const AtomicString& InputElementData::name() const
 {
     return m_name.isNull() ? emptyAtom : m_name;
diff --git a/WebCore/dom/InputElement.h b/WebCore/dom/InputElement.h
index d5ce212..34784bc 100644
--- a/WebCore/dom/InputElement.h
+++ b/WebCore/dom/InputElement.h
@@ -107,6 +107,7 @@ protected:
 class InputElementData {
 public:
     InputElementData();
+    ~InputElementData();
 
     const AtomicString& name() const;
     void setName(const AtomicString& value) { m_name = value; }
diff --git a/WebCore/dom/MutationEvent.cpp b/WebCore/dom/MutationEvent.cpp
index 58bce1f..890742f 100644
--- a/WebCore/dom/MutationEvent.cpp
+++ b/WebCore/dom/MutationEvent.cpp
@@ -42,6 +42,10 @@ MutationEvent::MutationEvent(const AtomicString& type, bool canBubble, bool canc
 {
 }
 
+MutationEvent::~MutationEvent()
+{
+}
+
 void MutationEvent::initMutationEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<Node> relatedNode,
                                       const String& prevValue, const String& newValue,
                                       const String& attrName, unsigned short attrChange)
diff --git a/WebCore/dom/MutationEvent.h b/WebCore/dom/MutationEvent.h
index 29b978c..f2ba759 100644
--- a/WebCore/dom/MutationEvent.h
+++ b/WebCore/dom/MutationEvent.h
@@ -31,6 +31,8 @@ namespace WebCore {
 
     class MutationEvent : public Event {
     public:
+        virtual ~MutationEvent();
+
         enum attrChangeType {
             MODIFICATION    = 1,
             ADDITION        = 2,
diff --git a/WebCore/dom/Node.cpp b/WebCore/dom/Node.cpp
index 831250e..5c67bfd 100644
--- a/WebCore/dom/Node.cpp
+++ b/WebCore/dom/Node.cpp
@@ -58,7 +58,7 @@
 #include "Frame.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "KeyboardEvent.h"
 #include "LabelsNodeList.h"
 #include "Logging.h"
@@ -77,7 +77,6 @@
 #include "ScriptController.h"
 #include "SelectorNodeList.h"
 #include "StaticNodeList.h"
-#include "StringBuilder.h"
 #include "TagNodeList.h"
 #include "Text.h"
 #include "TextEvent.h"
@@ -93,6 +92,7 @@
 #include <wtf/RefCountedLeakCounter.h>
 #include <wtf/UnusedParam.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
 
 #if ENABLE(DOM_STORAGE)
 #include "StorageEvent.h"
@@ -535,38 +535,48 @@ Node* Node::firstDescendant() const
     return n;
 }
 
-bool Node::insertBefore(PassRefPtr<Node>, Node*, ExceptionCode& ec, bool)
+bool Node::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    ec = HIERARCHY_REQUEST_ERR;
-    return false;
+    if (!isContainerNode()) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return false;
+    }
+    return toContainerNode(this)->insertBefore(newChild, refChild, ec, shouldLazyAttach);
 }
 
-bool Node::replaceChild(PassRefPtr<Node>, Node*, ExceptionCode& ec, bool)
+bool Node::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    ec = HIERARCHY_REQUEST_ERR;
-    return false;
+    if (!isContainerNode()) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return false;
+    }
+    return toContainerNode(this)->replaceChild(newChild, oldChild, ec, shouldLazyAttach);
 }
 
-bool Node::removeChild(Node*, ExceptionCode& ec)
+bool Node::removeChild(Node* oldChild, ExceptionCode& ec)
 {
-    ec = NOT_FOUND_ERR;
-    return false;
+    if (!isContainerNode()) {
+        ec = NOT_FOUND_ERR;
+        return false;
+    }
+    return toContainerNode(this)->removeChild(oldChild, ec);
 }
 
-bool Node::appendChild(PassRefPtr<Node>, ExceptionCode& ec, bool)
+bool Node::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
 {
-    ec = HIERARCHY_REQUEST_ERR;
-    return false;
+    if (!isContainerNode()) {
+        ec = HIERARCHY_REQUEST_ERR;
+        return false;
+    }
+    return toContainerNode(this)->appendChild(newChild, ec, shouldLazyAttach);
 }
 
 void Node::remove(ExceptionCode& ec)
 {
-    ref();
-    if (Node *p = parentNode())
-        p->removeChild(this, ec);
+    if (ContainerNode* parent = parentNode())
+        parent->removeChild(this, ec);
     else
         ec = HIERARCHY_REQUEST_ERR;
-    deref();
 }
 
 void Node::normalize()
@@ -729,13 +739,23 @@ inline void Node::setStyleChange(StyleChangeType changeType)
 
 inline void Node::markAncestorsWithChildNeedsStyleRecalc()
 {
-    for (Node* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
+    for (ContainerNode* p = parentNode(); p && !p->childNeedsStyleRecalc(); p = p->parentNode())
         p->setChildNeedsStyleRecalc();
     
     if (document()->childNeedsStyleRecalc())
         document()->scheduleStyleRecalc();
 }
 
+void Node::refEventTarget()
+{
+    ref();
+}
+
+void Node::derefEventTarget()
+{
+    deref();
+}
+
 void Node::setNeedsStyleRecalc(StyleChangeType changeType)
 {
     ASSERT(changeType != NoStyleChange);
@@ -1161,7 +1181,7 @@ bool Node::isDescendantOf(const Node *other) const
     // Return true if other is an ancestor of this, otherwise false
     if (!other)
         return false;
-    for (const Node *n = parentNode(); n; n = n->parentNode()) {
+    for (const ContainerNode* n = parentNode(); n; n = n->parentNode()) {
         if (n == other)
             return true;
     }
@@ -1223,28 +1243,6 @@ void Node::detach()
     clearFlag(InDetachFlag);
 }
 
-Node *Node::previousEditable() const
-{
-    Node *node = previousLeafNode();
-    while (node) {
-        if (node->isContentEditable())
-            return node;
-        node = node->previousLeafNode();
-    }
-    return 0;
-}
-
-Node *Node::nextEditable() const
-{
-    Node *node = nextLeafNode();
-    while (node) {
-        if (node->isContentEditable())
-            return node;
-        node = node->nextLeafNode();
-    }
-    return 0;
-}
-
 RenderObject * Node::previousRenderer()
 {
     for (Node *n = previousSibling(); n; n = n->previousSibling()) {
@@ -1328,15 +1326,11 @@ void Node::createRendererIfNeeded()
 
     ASSERT(!renderer());
     
-    Node* parent = parentNode();    
+    ContainerNode* parent = parentNode();    
     ASSERT(parent);
     
     RenderObject* parentRenderer = parent->renderer();
-    if (parentRenderer && parentRenderer->canHaveChildren()
-#if ENABLE(SVG) || ENABLE(XHTMLMP)
-        && parent->childShouldCreateRenderer(this)
-#endif
-        ) {
+    if (parentRenderer && parentRenderer->canHaveChildren() && parent->childShouldCreateRenderer(this)) {
         RefPtr<RenderStyle> style = styleForRenderer();
         if (rendererIsNeeded(style.get())) {
             if (RenderObject* r = createRenderer(document()->renderArena(), style.get())) {
@@ -1461,11 +1455,6 @@ bool Node::isBlockFlowOrBlockTable() const
     return renderer() && (renderer()->isBlockFlow() || (renderer()->isTable() && !renderer()->isInline()));
 }
 
-bool Node::isEditableBlock() const
-{
-    return isContentEditable() && isBlockFlow();
-}
-
 Element *Node::enclosingBlockFlowElement() const
 {
     Node *n = const_cast<Node *>(this);
@@ -1482,26 +1471,6 @@ Element *Node::enclosingBlockFlowElement() const
     return 0;
 }
 
-Element *Node::enclosingInlineElement() const
-{
-    Node *n = const_cast<Node *>(this);
-    Node *p;
-
-    while (1) {
-        p = n->parentNode();
-        if (!p || p->isBlockFlow() || p->hasTagName(bodyTag))
-            return static_cast<Element *>(n);
-        // Also stop if any previous sibling is a block
-        for (Node *sibling = n->previousSibling(); sibling; sibling = sibling->previousSibling()) {
-            if (sibling->isBlockFlow())
-                return static_cast<Element *>(n);
-        }
-        n = p;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
 Element* Node::rootEditableElement() const
 {
     Element* result = 0;
@@ -1918,55 +1887,57 @@ String Node::lookupNamespacePrefix(const AtomicString &_namespaceURI, const Elem
     return String();
 }
 
-void Node::appendTextContent(bool convertBRsToNewlines, StringBuilder& content) const
+static void appendTextContent(const Node* node, bool convertBRsToNewlines, bool& isNullString, StringBuilder& content)
 {
-    switch (nodeType()) {
-        case TEXT_NODE:
-        case CDATA_SECTION_NODE:
-        case COMMENT_NODE:
-            content.append(static_cast<const CharacterData*>(this)->data());
-            break;
+    switch (node->nodeType()) {
+    case Node::TEXT_NODE:
+    case Node::CDATA_SECTION_NODE:
+    case Node::COMMENT_NODE:
+        isNullString = false;
+        content.append(static_cast<const CharacterData*>(node)->data());
+        break;
 
-        case PROCESSING_INSTRUCTION_NODE:
-            content.append(static_cast<const ProcessingInstruction*>(this)->data());
+    case Node::PROCESSING_INSTRUCTION_NODE:
+        isNullString = false;
+        content.append(static_cast<const ProcessingInstruction*>(node)->data());
+        break;
+    
+    case Node::ELEMENT_NODE:
+        if (node->hasTagName(brTag) && convertBRsToNewlines) {
+            isNullString = false;
+            content.append('\n');
             break;
-        
-        case ELEMENT_NODE:
-            if (hasTagName(brTag) && convertBRsToNewlines) {
-                content.append('\n');
-                break;
         }
-        // Fall through.
-        case ATTRIBUTE_NODE:
-        case ENTITY_NODE:
-        case ENTITY_REFERENCE_NODE:
-        case DOCUMENT_FRAGMENT_NODE:
-            content.setNonNull();
-
-            for (Node *child = firstChild(); child; child = child->nextSibling()) {
-                if (child->nodeType() == COMMENT_NODE || child->nodeType() == PROCESSING_INSTRUCTION_NODE)
-                    continue;
-            
-                child->appendTextContent(convertBRsToNewlines, content);
-            }
-            break;
+    // Fall through.
+    case Node::ATTRIBUTE_NODE:
+    case Node::ENTITY_NODE:
+    case Node::ENTITY_REFERENCE_NODE:
+    case Node::DOCUMENT_FRAGMENT_NODE:
+        isNullString = false;
+        for (Node* child = node->firstChild(); child; child = child->nextSibling()) {
+            if (child->nodeType() == Node::COMMENT_NODE || child->nodeType() == Node::PROCESSING_INSTRUCTION_NODE)
+                continue;
+            appendTextContent(child, convertBRsToNewlines, isNullString, content);
+        }
+        break;
 
-        case DOCUMENT_NODE:
-        case DOCUMENT_TYPE_NODE:
-        case NOTATION_NODE:
-        case XPATH_NAMESPACE_NODE:
-            break;
+    case Node::DOCUMENT_NODE:
+    case Node::DOCUMENT_TYPE_NODE:
+    case Node::NOTATION_NODE:
+    case Node::XPATH_NAMESPACE_NODE:
+        break;
     }
 }
 
 String Node::textContent(bool convertBRsToNewlines) const
 {
     StringBuilder content;
-    appendTextContent(convertBRsToNewlines, content);
-    return content.toString();
+    bool isNullString = true;
+    appendTextContent(this, convertBRsToNewlines, isNullString, content);
+    return isNullString ? String() : content.toString();
 }
 
-void Node::setTextContent(const String &text, ExceptionCode& ec)
+void Node::setTextContent(const String& text, ExceptionCode& ec)
 {           
     switch (nodeType()) {
         case TEXT_NODE:
@@ -1974,33 +1945,32 @@ void Node::setTextContent(const String &text, ExceptionCode& ec)
         case COMMENT_NODE:
         case PROCESSING_INSTRUCTION_NODE:
             setNodeValue(text, ec);
-            break;
+            return;
         case ELEMENT_NODE:
         case ATTRIBUTE_NODE:
         case ENTITY_NODE:
         case ENTITY_REFERENCE_NODE:
         case DOCUMENT_FRAGMENT_NODE: {
-            ContainerNode *container = static_cast<ContainerNode *>(this);
-            
+            ContainerNode* container = toContainerNode(this);
             container->removeChildren();
-            
             if (!text.isEmpty())
-                appendChild(document()->createTextNode(text), ec);
-            break;
+                container->appendChild(document()->createTextNode(text), ec);
+            return;
         }
         case DOCUMENT_NODE:
         case DOCUMENT_TYPE_NODE:
         case NOTATION_NODE:
-        default:
-            // Do nothing
-            break;
+        case XPATH_NAMESPACE_NODE:
+            // Do nothing.
+            return;
     }
+    ASSERT_NOT_REACHED();
 }
 
 Element* Node::ancestorElement() const
 {
     // In theory, there can be EntityReference nodes between elements, but this is currently not supported.
-    for (Node* n = parentNode(); n; n = n->parentNode()) {
+    for (ContainerNode* n = parentNode(); n; n = n->parentNode()) {
         if (n->isElementNode())
             return static_cast<Element*>(n);
     }
@@ -2651,23 +2621,6 @@ bool Node::dispatchEvent(PassRefPtr<Event> prpEvent)
     return dispatchGenericEvent(event.release());
 }
 
-static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, Vector<RefPtr<ContainerNode> >& ancestors)
-{
-    if (window && window->hasEventListeners(eventType))
-        return true;
-
-    if (node->hasEventListeners(eventType))
-        return true;
-
-    for (size_t i = 0; i < ancestors.size(); i++) {
-        ContainerNode* ancestor = ancestors[i].get();
-        if (ancestor->hasEventListeners(eventType))
-            return true;
-    }
-
-   return false;    
-}
-
 bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
 {
     RefPtr<Event> event(prpEvent);
@@ -2693,15 +2646,7 @@ bool Node::dispatchGenericEvent(PassRefPtr<Event> prpEvent)
             targetForWindowEvents = static_cast<Document*>(topLevelContainer)->domWindow();
     }
 
-#if ENABLE(INSPECTOR)
-    Page* inspectedPage = InspectorTimelineAgent::instanceCount() ? document()->page() : 0;
-    if (inspectedPage) {
-        if (InspectorTimelineAgent* timelineAgent = eventHasListeners(event->type(), targetForWindowEvents, this, ancestors) ? inspectedPage->inspectorTimelineAgent() : 0)
-            timelineAgent->willDispatchEvent(*event);
-        else
-            inspectedPage = 0;
-    }
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEvent(document(), *event, targetForWindowEvents, this, ancestors);
 
     // Give the target node a chance to do some work before DOM event handlers get a crack.
     void* data = preDispatchEventHandler(event.get());
@@ -2783,11 +2728,8 @@ doneDispatching:
     }
 
 doneWithDefault:
-#if ENABLE(INSPECTOR)
-    if (inspectedPage)
-        if (InspectorTimelineAgent* timelineAgent = inspectedPage->inspectorTimelineAgent())
-            timelineAgent->didDispatchEvent();
-#endif
+
+    InspectorInstrumentation::didDispatchEvent(cookie);
 
     return !event->defaultPrevented();
 }
diff --git a/WebCore/dom/Node.h b/WebCore/dom/Node.h
index 603829b..3e5a444 100644
--- a/WebCore/dom/Node.h
+++ b/WebCore/dom/Node.h
@@ -2,7 +2,7 @@
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
- * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved. (http://www.torchmobile.com/)
  *
  * This library is free software; you can redistribute it and/or
@@ -35,8 +35,8 @@
 
 #if USE(JSC)
 namespace JSC {
-class JSGlobalData;
-class MarkStack;
+    class JSGlobalData;
+    class MarkStack;
 }
 #endif
 
@@ -69,7 +69,6 @@ class RenderBox;
 class RenderBoxModelObject;
 class RenderObject;
 class RenderStyle;
-class StringBuilder;
 class TagNodeList;
 
 typedef int ExceptionCode;
@@ -138,8 +137,8 @@ public:
     Node* previousSibling() const { return m_previous; }
     Node* nextSibling() const { return m_next; }
     PassRefPtr<NodeList> childNodes();
-    Node* firstChild() const { return isContainerNode() ? containerFirstChild() : 0; }
-    Node* lastChild() const { return isContainerNode() ? containerLastChild() : 0; }
+    Node* firstChild() const;
+    Node* lastChild() const;
     bool hasAttributes() const;
     NamedNodeMap* attributes() const;
 
@@ -150,10 +149,10 @@ public:
     // These should all actually return a node, but this is only important for language bindings,
     // which will already know and hold a ref on the right node to return. Returning bool allows
     // these methods to be more efficient since they don't need to return a ref
-    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChild(Node* child, ExceptionCode&);
-    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
+    bool removeChild(Node* child, ExceptionCode&);
+    bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
 
     void remove(ExceptionCode&);
     bool hasChildNodes() const { return firstChild(); }
@@ -193,13 +192,6 @@ public:
     static bool isWMLElement() { return false; }
 #endif
 
-#if ENABLE(MATHML)
-    virtual bool isMathMLElement() const { return false; }
-#else
-    static bool isMathMLElement() { return false; }
-#endif
-
-
     virtual bool isMediaControlElement() const { return false; }
     bool isStyledElement() const { return getFlag(IsStyledElementFlag); }
     virtual bool isFrameOwnerElement() const { return false; }
@@ -219,7 +211,8 @@ public:
     // Returns the enclosing event parent node (or self) that, when clicked, would trigger a navigation.
     Node* enclosingLinkEventParentOrSelf();
 
-    // Node ancestors when concerned about event flow
+    // Node ancestors when concerned about event flow.
+    // FIXME: Should be named getEventAncestors.
     void eventAncestors(Vector<RefPtr<ContainerNode> > &ancestors);
 
     bool isBlockFlow() const;
@@ -233,28 +226,21 @@ public:
     Node* previousNodeConsideringAtomicNodes() const;
     Node* nextNodeConsideringAtomicNodes() const;
     
-    /** (Not part of the official DOM)
-     * Returns the next leaf node.
-     *
-     * Using this function delivers leaf nodes as if the whole DOM tree were a linear chain of its leaf nodes.
-     * @return next leaf node or 0 if there are no more.
-     */
+    // Returns the next leaf node or 0 if there are no more.
+    // Delivers leaf nodes as if the whole DOM tree were a linear chain of its leaf nodes.
+    // Uses an editing-specific concept of what a leaf node is, and should probably be moved
+    // out of the Node class into an editing-specific source file.
     Node* nextLeafNode() const;
 
-    /** (Not part of the official DOM)
-     * Returns the previous leaf node.
-     *
-     * Using this function delivers leaf nodes as if the whole DOM tree were a linear chain of its leaf nodes.
-     * @return previous leaf node or 0 if there are no more.
-     */
+    // Returns the previous leaf node or 0 if there are no more.
+    // Delivers leaf nodes as if the whole DOM tree were a linear chain of its leaf nodes.
+    // Uses an editing-specific concept of what a leaf node is, and should probably be moved
+    // out of the Node class into an editing-specific source file.
     Node* previousLeafNode() const;
 
-    bool isEditableBlock() const;
-    
-    // enclosingBlockFlowElement() is deprecated.  Use enclosingBlock instead.
+    // enclosingBlockFlowElement() is deprecated. Use enclosingBlock instead.
     Element* enclosingBlockFlowElement() const;
     
-    Element* enclosingInlineElement() const;
     Element* rootEditableElement() const;
     
     bool inSameContainingBlockFlowElement(Node*);
@@ -271,9 +257,7 @@ public:
     virtual void finishParsingChildren() { }
     virtual void beginParsingChildren() { }
 
-    // Called by the frame right before dispatching an unloadEvent. [Radar 4532113]
-    // This is needed for HTMLInputElements to tell the frame that it is done editing 
-    // (sends textFieldDidEndEditing notification)
+    // Called on the focused node right before dispatching an unload event.
     virtual void aboutToUnload() { }
 
     // For <link> and <style> elements.
@@ -316,14 +300,14 @@ public:
     };
     void lazyAttach(ShouldSetAttached = SetAttached);
 
-    virtual void setFocus(bool b = true);
+    virtual void setFocus(bool = true);
     virtual void setActive(bool f = true, bool /*pause*/ = false) { setFlag(f, IsActiveFlag); }
     virtual void setHovered(bool f = true) { setFlag(f, IsHoveredFlag); }
 
     virtual short tabIndex() const;
 
     // Whether this kind of node can receive focus by default. Most nodes are
-    // not focusable but some elements, such as form controls and links are.
+    // not focusable but some elements, such as form controls and links, are.
     virtual bool supportsFocus() const;
     // Whether the node can actually be focused.
     virtual bool isFocusable() const;
@@ -372,53 +356,27 @@ public:
 
     bool isReadOnlyNode() const { return nodeType() == ENTITY_REFERENCE_NODE; }
     virtual bool childTypeAllowed(NodeType) { return false; }
-    unsigned childNodeCount() const { return isContainerNode() ? containerChildNodeCount() : 0; }
-    Node* childNode(unsigned index) const { return isContainerNode() ? containerChildNode(index) : 0; }
-
-    /**
-     * Does a pre-order traversal of the tree to find the node next node after this one. This uses the same order that
-     * the tags appear in the source file.
-     *
-     * @param stayWithin If not null, the traversal will stop once the specified node is reached. This can be used to
-     * restrict traversal to a particular sub-tree.
-     *
-     * @return The next node, in document order
-     *
-     * see @ref traversePreviousNode()
-     */
+    unsigned childNodeCount() const;
+    Node* childNode(unsigned index) const;
+
+    // Does a pre-order traversal of the tree to find the next node after this one.
+    // This uses the same order that tags appear in the source file. If the stayWithin
+    // argument is non-null, the traversal will stop once the specified node is reached.
+    // This can be used to restrict traversal to a particular sub-tree.
     Node* traverseNextNode(const Node* stayWithin = 0) const;
     
     // Like traverseNextNode, but skips children and starts with the next sibling.
     Node* traverseNextSibling(const Node* stayWithin = 0) const;
 
-    /**
-     * Does a reverse pre-order traversal to find the node that comes before the current one in document order
-     *
-     * see @ref traverseNextNode()
-     */
-    Node* traversePreviousNode(const Node * stayWithin = 0) const;
+    // Does a reverse pre-order traversal to find the node that comes before the current one in document order
+    Node* traversePreviousNode(const Node* stayWithin = 0) const;
 
     // Like traverseNextNode, but visits parents after their children.
     Node* traverseNextNodePostOrder() const;
 
     // Like traversePreviousNode, but visits parents before their children.
-    Node* traversePreviousNodePostOrder(const Node *stayWithin = 0) const;
-    Node* traversePreviousSiblingPostOrder(const Node *stayWithin = 0) const;
-
-    /**
-     * Finds previous or next editable leaf node.
-     */
-    Node* previousEditable() const;
-    Node* nextEditable() const;
-
-    RenderObject* renderer() const { return m_renderer; }
-    RenderObject* nextRenderer();
-    RenderObject* previousRenderer();
-    void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
-    
-    // Use these two methods with caution.
-    RenderBox* renderBox() const;
-    RenderBoxModelObject* renderBoxModelObject() const;
+    Node* traversePreviousNodePostOrder(const Node* stayWithin = 0) const;
+    Node* traversePreviousSiblingPostOrder(const Node* stayWithin = 0) const;
 
     void checkSetPrefix(const AtomicString& prefix, ExceptionCode&);
     bool isDescendantOf(const Node*) const;
@@ -445,32 +403,35 @@ public:
     virtual bool canStartSelection() const;
 
     // Getting points into and out of screen space
-    FloatPoint convertToPage(const FloatPoint& p) const;
-    FloatPoint convertFromPage(const FloatPoint& p) const;
+    FloatPoint convertToPage(const FloatPoint&) const;
+    FloatPoint convertFromPage(const FloatPoint&) const;
 
     // -----------------------------------------------------------------------------
     // Integration with rendering tree
 
-    /**
-     * Attaches this node to the rendering tree. This calculates the style to be applied to the node and creates an
-     * appropriate RenderObject which will be inserted into the tree (except when the style has display: none). This
-     * makes the node visible in the FrameView.
-     */
+    RenderObject* renderer() const { return m_renderer; }
+    RenderObject* nextRenderer();
+    RenderObject* previousRenderer();
+    void setRenderer(RenderObject* renderer) { m_renderer = renderer; }
+    
+    // Use these two methods with caution.
+    RenderBox* renderBox() const;
+    RenderBoxModelObject* renderBoxModelObject() const;
+
+    // Attaches this node to the rendering tree. This calculates the style to be applied to the node and creates an
+    // appropriate RenderObject which will be inserted into the tree (except when the style has display: none). This
+    // makes the node visible in the FrameView.
     virtual void attach();
 
-    /**
-     * Detaches the node from the rendering tree, making it invisible in the rendered view. This method will remove
-     * the node's rendering object from the rendering tree and delete it.
-     */
+    // Detaches the node from the rendering tree, making it invisible in the rendered view. This method will remove
+    // the node's rendering object from the rendering tree and delete it.
     virtual void detach();
 
     virtual void willRemove();
     void createRendererIfNeeded();
     PassRefPtr<RenderStyle> styleForRenderer();
     virtual bool rendererIsNeeded(RenderStyle*);
-#if ENABLE(SVG) || ENABLE(XHTMLMP)
     virtual bool childShouldCreateRenderer(Node*) const { return true; }
-#endif
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
     
     // Wrapper for nodes that don't have a renderer, but still cache the style (like HTMLOptionElement).
@@ -482,24 +443,20 @@ public:
     // -----------------------------------------------------------------------------
     // Notification of document structure changes
 
-    /**
-     * Notifies the node that it has been inserted into the document. This is called during document parsing, and also
-     * when a node is added through the DOM methods insertBefore(), appendChild() or replaceChild(). Note that this only
-     * happens when the node becomes part of the document tree, i.e. only when the document is actually an ancestor of
-     * the node. The call happens _after_ the node has been added to the tree.
-     *
-     * This is similar to the DOMNodeInsertedIntoDocument DOM event, but does not require the overhead of event
-     * dispatching.
-     */
+    // Notifies the node that it has been inserted into the document. This is called during document parsing, and also
+    // when a node is added through the DOM methods insertBefore(), appendChild() or replaceChild(). Note that this only
+    // happens when the node becomes part of the document tree, i.e. only when the document is actually an ancestor of
+    // the node. The call happens _after_ the node has been added to the tree.
+    //
+    // This is similar to the DOMNodeInsertedIntoDocument DOM event, but does not require the overhead of event
+    // dispatching.
     virtual void insertedIntoDocument();
 
-    /**
-     * Notifies the node that it is no longer part of the document tree, i.e. when the document is no longer an ancestor
-     * node.
-     *
-     * This is similar to the DOMNodeRemovedFromDocument DOM event, but does not require the overhead of event
-     * dispatching, and is called _after_ the node is removed from the tree.
-     */
+    // Notifies the node that it is no longer part of the document tree, i.e. when the document is no longer an ancestor
+    // node.
+    //
+    // This is similar to the DOMNodeRemovedFromDocument DOM event, but does not require the overhead of event
+    // dispatching, and is called _after_ the node is removed from the tree.
     virtual void removedFromDocument();
 
     // These functions are called whenever you are connected or disconnected from a tree.  That tree may be the main
@@ -508,10 +465,8 @@ public:
     virtual void insertedIntoTree(bool /*deep*/) { }
     virtual void removedFromTree(bool /*deep*/) { }
 
-    /**
-     * Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
-     * node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
-     */
+    // Notifies the node that it's list of children have changed (either by adding or removing child nodes), or a child
+    // node that is of the type CDATA_SECTION_NODE, TEXT_NODE or COMMENT_NODE has changed its value.
     virtual void childrenChanged(bool /*changedByParser*/ = false, Node* /*beforeChange*/ = 0, Node* /*afterChange*/ = 0, int /*childCountDelta*/ = 0) { }
 
 #if !defined(NDEBUG) || defined(ANDROID_DOM_LOGGING)
@@ -578,8 +533,7 @@ public:
     void dispatchUIEvent(const AtomicString& eventType, int detail, PassRefPtr<Event> underlyingEvent);
     bool dispatchKeyEvent(const PlatformKeyboardEvent&);
     void dispatchWheelEvent(PlatformWheelEvent&);
-    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType,
-        int clickCount = 0, Node* relatedTarget = 0);
+    bool dispatchMouseEvent(const PlatformMouseEvent&, const AtomicString& eventType, int clickCount = 0, Node* relatedTarget = 0);
     bool dispatchMouseEvent(const AtomicString& eventType, int button, int clickCount,
         int pageX, int pageY, int screenX, int screenY,
         bool ctrlKey, bool altKey, bool shiftKey, bool metaKey,
@@ -590,15 +544,11 @@ public:
     virtual void dispatchFocusEvent();
     virtual void dispatchBlurEvent();
 
-    /**
-     * Perform the default action for an event e.g. submitting a form
-     */
+    // Perform the default action for an event.
     virtual void defaultEventHandler(Event*);
 
-    /**
-     * Used for disabled form elements; if true, prevents mouse events from being dispatched
-     * to event listeners, and prevents DOMActivate events from being sent at all.
-     */
+    // Used for disabled form elements; if true, prevents mouse events from being dispatched
+    // to event listeners, and prevents DOMActivate events from being sent at all.
     virtual bool disabled() const;
 
     using TreeShared<ContainerNode>::ref;
@@ -699,14 +649,10 @@ private:
     // Used to share code between lazyAttach and setNeedsStyleRecalc.
     void markAncestorsWithChildNeedsStyleRecalc();
 
-    virtual void refEventTarget() { ref(); }
-    virtual void derefEventTarget() { deref(); }
+    virtual void refEventTarget();
+    virtual void derefEventTarget();
 
     virtual NodeRareData* createRareData();
-    Node* containerChildNode(unsigned index) const;
-    unsigned containerChildNodeCount() const;
-    Node* containerFirstChild() const;
-    Node* containerLastChild() const;
     bool rareDataFocused() const;
 
     virtual RenderStyle* nonRendererRenderStyle() const;
@@ -718,7 +664,6 @@ private:
 
     Element* ancestorElement() const;
 
-    void appendTextContent(bool convertBRsToNewlines, StringBuilder&) const;
     void trackForDebugging();
 
     Document* m_document;
@@ -727,7 +672,7 @@ private:
     RenderObject* m_renderer;
     mutable uint32_t m_nodeFlags;
 
- protected:
+protected:
     bool isParsingChildrenFinished() const { return getFlag(IsParsingChildrenFinishedFlag); }
     void setIsParsingChildrenFinished() { setFlag(IsParsingChildrenFinishedFlag); }
     void clearIsParsingChildrenFinished() { clearFlag(IsParsingChildrenFinishedFlag); }
diff --git a/WebCore/dom/OptionElement.cpp b/WebCore/dom/OptionElement.cpp
index 240a8fc..ab7863e 100644
--- a/WebCore/dom/OptionElement.cpp
+++ b/WebCore/dom/OptionElement.cpp
@@ -134,6 +134,10 @@ OptionElementData::OptionElementData()
 {
 }
 
+OptionElementData::~OptionElementData()
+{
+}
+
 OptionElement* toOptionElement(Element* element)
 {
     if (element->isHTMLElement() && element->hasTagName(HTMLNames::optionTag))
diff --git a/WebCore/dom/OptionElement.h b/WebCore/dom/OptionElement.h
index 232c3ee..9ff5cd5 100644
--- a/WebCore/dom/OptionElement.h
+++ b/WebCore/dom/OptionElement.h
@@ -58,6 +58,7 @@ private:
 class OptionElementData {
 public:
     OptionElementData();
+    ~OptionElementData();
 
     String value() const { return m_value; }
     void setValue(const String& value) { m_value = value; }
diff --git a/WebCore/dom/PopStateEvent.cpp b/WebCore/dom/PopStateEvent.cpp
index b9ad862..bac676a 100644
--- a/WebCore/dom/PopStateEvent.cpp
+++ b/WebCore/dom/PopStateEvent.cpp
@@ -36,7 +36,11 @@ PopStateEvent::PopStateEvent(PassRefPtr<SerializedScriptValue> stateObject)
     , m_stateObject(stateObject)
 {
 }
-    
+
+PopStateEvent::~PopStateEvent()
+{
+}
+
 void PopStateEvent::initPopStateEvent(const AtomicString& type, bool canBubble, bool cancelable, PassRefPtr<SerializedScriptValue> stateObject)
 {
     if (dispatched())
diff --git a/WebCore/dom/PopStateEvent.h b/WebCore/dom/PopStateEvent.h
index 2fb8d06..42fbd45 100644
--- a/WebCore/dom/PopStateEvent.h
+++ b/WebCore/dom/PopStateEvent.h
@@ -36,6 +36,8 @@ class SerializedScriptValue;
 
 class PopStateEvent : public Event {
 public:
+    virtual ~PopStateEvent();
+
     static PassRefPtr<PopStateEvent> create(PassRefPtr<SerializedScriptValue> stateObject)
     {
         return adoptRef(new PopStateEvent(stateObject));
@@ -47,7 +49,7 @@ public:
     SerializedScriptValue* state() const { return m_stateObject.get(); }    
 
 private:
-    PopStateEvent(PassRefPtr<SerializedScriptValue>);
+    explicit PopStateEvent(PassRefPtr<SerializedScriptValue>);
 
     RefPtr<SerializedScriptValue> m_stateObject;
 };
diff --git a/WebCore/dom/Position.cpp b/WebCore/dom/Position.cpp
index 4758bd9..8c03224 100644
--- a/WebCore/dom/Position.cpp
+++ b/WebCore/dom/Position.cpp
@@ -45,10 +45,9 @@ using namespace HTMLNames;
 
 static Node* nextRenderedEditable(Node* node)
 {
-    while (1) {
-        node = node->nextEditable();
-        if (!node)
-            return 0;
+    while ((node = node->nextLeafNode())) {
+        if (!node->isContentEditable())
+            continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
@@ -60,10 +59,9 @@ static Node* nextRenderedEditable(Node* node)
 
 static Node* previousRenderedEditable(Node* node)
 {
-    while (1) {
-        node = node->previousEditable();
-        if (!node)
-            return 0;
+    while ((node = node->previousLeafNode())) {
+        if (!node->isContentEditable())
+            continue;
         RenderObject* renderer = node->renderer();
         if (!renderer)
             continue;
@@ -239,7 +237,7 @@ Position Position::previous(PositionMoveType moveType) const
         }
     }
 
-    Node* parent = n->parentNode();
+    ContainerNode* parent = n->parentNode();
     if (!parent)
         return *this;
 
@@ -271,7 +269,7 @@ Position Position::next(PositionMoveType moveType) const
         return Position(n, (moveType == Character) ? uncheckedNextOffset(n, o) : o + 1);
     }
 
-    Node* parent = n->parentNode();
+    ContainerNode* parent = n->parentNode();
     if (!parent)
         return *this;
 
diff --git a/WebCore/dom/QualifiedName.cpp b/WebCore/dom/QualifiedName.cpp
index 7c29ce0..90c6d29 100644
--- a/WebCore/dom/QualifiedName.cpp
+++ b/WebCore/dom/QualifiedName.cpp
@@ -72,6 +72,11 @@ QualifiedName::QualifiedName(const AtomicString& p, const char* l, const AtomicS
     init(p, AtomicString(l), n);
 }
 
+QualifiedName::~QualifiedName()
+{
+    deref();
+}
+
 void QualifiedName::deref()
 {
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
diff --git a/WebCore/dom/QualifiedName.h b/WebCore/dom/QualifiedName.h
index 2da8f0c..34fc069 100644
--- a/WebCore/dom/QualifiedName.h
+++ b/WebCore/dom/QualifiedName.h
@@ -60,7 +60,7 @@ public:
     QualifiedName(const AtomicString& prefix, const char* localName, const AtomicString& namespaceURI);
     QualifiedName(WTF::HashTableDeletedValueType) : m_impl(hashTableDeletedValue()) { }
     bool isHashTableDeletedValue() const { return m_impl == hashTableDeletedValue(); }
-    ~QualifiedName() { deref(); }
+    ~QualifiedName();
 #ifdef QNAME_DEFAULT_CONSTRUCTOR
     QualifiedName() : m_impl(0) { }
 #endif
diff --git a/WebCore/dom/Range.cpp b/WebCore/dom/Range.cpp
index 95502df..5507b83 100644
--- a/WebCore/dom/Range.cpp
+++ b/WebCore/dom/Range.cpp
@@ -373,7 +373,7 @@ Range::CompareResults Range::compareNode(Node* refNode, ExceptionCode& ec) const
         return NODE_BEFORE;
     }
 
-    Node* parentNode = refNode->parentNode();
+    ContainerNode* parentNode = refNode->parentNode();
     int nodeIndex = refNode->nodeIndex();
     
     if (!parentNode) {
@@ -572,7 +572,7 @@ bool Range::intersectsNode(Node* refNode, ExceptionCode& ec)
         return false;
     }
 
-    Node* parentNode = refNode->parentNode();
+    ContainerNode* parentNode = refNode->parentNode();
     int nodeIndex = refNode->nodeIndex();
     
     if (!parentNode) {
@@ -667,7 +667,7 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
                 else if (action == CLONE_CONTENTS)
                     fragment->appendChild(n->cloneNode(true), ec);
                 else
-                    m_start.container()->removeChild(n, ec);
+                    toContainerNode(m_start.container())->removeChild(n, ec);
                 n = next;
                 i++;
             }
@@ -730,12 +730,12 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
                 else if (action == CLONE_CONTENTS)
                     leftContents->appendChild(n->cloneNode(true), ec);
                 else
-                    m_start.container()->removeChild(n, ec);
+                    toContainerNode(m_start.container())->removeChild(n, ec);
                 n = next;
             }
         }
 
-        Node* leftParent = m_start.container()->parentNode();
+        ContainerNode* leftParent = m_start.container()->parentNode();
         Node* n = m_start.container()->nextSibling();
         for (; leftParent != commonRoot; leftParent = leftParent->parentNode()) {
             if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
@@ -800,12 +800,12 @@ PassRefPtr<DocumentFragment> Range::processContents(ActionType action, Exception
                     else if (action == CLONE_CONTENTS)
                         rightContents->insertBefore(n->cloneNode(true), rightContents->firstChild(), ec);
                     else
-                        m_end.container()->removeChild(n, ec);
+                        toContainerNode(m_end.container())->removeChild(n, ec);
                 }
             }
         }
 
-        Node* rightParent = m_end.container()->parentNode();
+        ContainerNode* rightParent = m_end.container()->parentNode();
         Node* n = m_end.container()->previousSibling();
         for (; rightParent != commonRoot; rightParent = rightParent->parentNode()) {
             if (action == EXTRACT_CONTENTS || action == CLONE_CONTENTS) {
@@ -1161,7 +1161,7 @@ void Range::checkNodeBA(Node* n, ExceptionCode& ec) const
     }
 
     Node* root = n;
-    while (Node* parent = root->parentNode())
+    while (ContainerNode* parent = root->parentNode())
         root = parent;
 
     switch (root->nodeType()) {
@@ -1287,7 +1287,7 @@ void Range::selectNode(Node* refNode, ExceptionCode& ec)
     // INVALID_NODE_TYPE_ERR: Raised if an ancestor of refNode is an Entity, Notation or
     // DocumentType node or if refNode is a Document, DocumentFragment, Attr, Entity, or Notation
     // node.
-    for (Node* anc = refNode->parentNode(); anc; anc = anc->parentNode()) {
+    for (ContainerNode* anc = refNode->parentNode(); anc; anc = anc->parentNode()) {
         switch (anc->nodeType()) {
             case Node::ATTRIBUTE_NODE:
             case Node::CDATA_SECTION_NODE:
@@ -1463,7 +1463,7 @@ void Range::surroundContents(PassRefPtr<Node> passNewParent, ExceptionCode& ec)
 
     ec = 0;
     while (Node* n = newParent->firstChild()) {
-        newParent->removeChild(n, ec);
+        toContainerNode(newParent.get())->removeChild(n, ec);
         if (ec)
             return;
     }
diff --git a/WebCore/dom/ScriptExecutionContext.h b/WebCore/dom/ScriptExecutionContext.h
index d39cb64..b46a0f4 100644
--- a/WebCore/dom/ScriptExecutionContext.h
+++ b/WebCore/dom/ScriptExecutionContext.h
@@ -57,7 +57,6 @@ namespace WebCore {
 #endif
     class MessagePort;
     class SecurityOrigin;
-    class ScriptString;
 #if ENABLE(INSPECTOR)
     class InspectorController;
 #endif
diff --git a/WebCore/dom/SelectElement.cpp b/WebCore/dom/SelectElement.cpp
index bcab08c..57fb277 100644
--- a/WebCore/dom/SelectElement.cpp
+++ b/WebCore/dom/SelectElement.cpp
@@ -41,6 +41,7 @@
 #include "Page.h"
 #include "RenderListBox.h"
 #include "RenderMenuList.h"
+#include "Settings.h"
 #include <wtf/Assertions.h>
 
 #if ENABLE(WML)
@@ -151,7 +152,7 @@ void SelectElement::setActiveSelectionEndIndex(SelectElementData& data, int inde
 void SelectElement::updateListBoxSelection(SelectElementData& data, Element* element, bool deselectOtherOptions)
 {
     ASSERT(element->renderer() && (element->renderer()->isListBox() || data.multiple()));
-    ASSERT(data.activeSelectionAnchorIndex() >= 0);
+    ASSERT(!data.listItems(element).size() || data.activeSelectionAnchorIndex() >= 0);
 
     unsigned start = min(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
     unsigned end = max(data.activeSelectionAnchorIndex(), data.activeSelectionEndIndex());
@@ -546,6 +547,10 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 #if ARROW_KEYS_POP_MENU
         if (keyIdentifier == "Down" || keyIdentifier == "Up") {
             element->focus();
+
+            if (!element->renderer()) // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
+                return;
+
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
@@ -554,6 +559,13 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
             handled = true;
         }
 #else
+        // When using spatial navigation, we want to be able to navigate away from the select element
+        // when the user hits any of the arrow keys, instead of changing the selection.
+        if (Frame* frame = element->document()->frame()) {
+            if (frame->settings() && frame->settings()->isSpatialNavigationEnabled())
+                return;
+        }
+
         UNUSED_PARAM(htmlForm);
         const Vector<Element*>& listItems = data.listItems(element);
 
@@ -597,6 +609,10 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 #if SPACE_OR_RETURN_POP_MENU
         if (keyCode == ' ' || keyCode == '\r') {
             element->focus();
+
+            if (!element->renderer()) // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
+                return;
+
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
@@ -607,6 +623,10 @@ void SelectElement::menuListDefaultEventHandler(SelectElementData& data, Element
 #elif ARROW_KEYS_POP_MENU
         if (keyCode == ' ') {
             element->focus();
+
+            if (!element->renderer()) // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
+                return;
+
             // Save the selection so it can be compared to the new selection when dispatching change events during setSelectedIndex,
             // which gets called from RenderMenuList::valueChanged, which gets called after the user makes a selection from the menu.
             saveLastSelection(data, element);
@@ -702,6 +722,9 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
     if (event->type() == eventNames().mousedownEvent && event->isMouseEvent() && static_cast<MouseEvent*>(event)->button() == LeftButton) {
         element->focus();
 
+        if (!element->renderer()) // Calling focus() may cause us to lose our renderer, in which case do not want to handle the event.
+            return;
+
         // Convert to coords relative to the list box if needed.
         MouseEvent* mouseEvent = static_cast<MouseEvent*>(event);
         IntPoint localOffset = roundedIntPoint(element->renderer()->absoluteToLocal(mouseEvent->absoluteLocation(), false, true));
@@ -744,7 +767,7 @@ void SelectElement::listBoxDefaultEventHandler(SelectElementData& data, Element*
             // Save the selection so it can be compared to the new selection when dispatching change events immediately after making the new selection.
             saveLastSelection(data, element);
 
-            ASSERT_UNUSED(listItems, endIndex >= 0 && (unsigned) endIndex < listItems.size());
+            ASSERT_UNUSED(listItems, !listItems.size() || (endIndex >= 0 && (unsigned) endIndex < listItems.size()));
             setActiveSelectionEndIndex(data, endIndex);
             
             // If the anchor is unitialized, or if we're going to deselect all other options, then set the anchor index equal to the end index.
@@ -945,6 +968,10 @@ SelectElementData::SelectElementData()
 {
 }
 
+SelectElementData::~SelectElementData()
+{
+}
+
 void SelectElementData::checkListItems(const Element* element) const
 {
 #if !ASSERT_DISABLED
diff --git a/WebCore/dom/SelectElement.h b/WebCore/dom/SelectElement.h
index 73e2620..53815f2 100644
--- a/WebCore/dom/SelectElement.h
+++ b/WebCore/dom/SelectElement.h
@@ -113,6 +113,7 @@ private:
 class SelectElementData {
 public:
     SelectElementData();
+    ~SelectElementData();
 
     bool multiple() const { return m_multiple; }
     void setMultiple(bool value) { m_multiple = value; }
diff --git a/WebCore/dom/SpaceSplitString.cpp b/WebCore/dom/SpaceSplitString.cpp
index b062dbf..8a2710c 100644
--- a/WebCore/dom/SpaceSplitString.cpp
+++ b/WebCore/dom/SpaceSplitString.cpp
@@ -21,6 +21,7 @@
 #include "config.h"
 #include "SpaceSplitString.h"
 
+#include "HTMLParserIdioms.h"
 #include <wtf/ASCIICType.h>
 
 using namespace WTF;
@@ -53,12 +54,12 @@ void SpaceSplitStringData::createVector()
     unsigned length = m_string.length();
     unsigned start = 0;
     while (true) {
-        while (start < length && isClassWhitespace(characters[start]))
+        while (start < length && isHTMLSpace(characters[start]))
             ++start;
         if (start >= length)
             break;
         unsigned end = start + 1;
-        while (end < length && !isClassWhitespace(characters[end]))
+        while (end < length && isNotHTMLSpace(characters[end]))
             ++end;
 
         m_vector.append(AtomicString(characters + start, end - start));
diff --git a/WebCore/dom/SpaceSplitString.h b/WebCore/dom/SpaceSplitString.h
index 0d3650e..09ca8d9 100644
--- a/WebCore/dom/SpaceSplitString.h
+++ b/WebCore/dom/SpaceSplitString.h
@@ -81,11 +81,6 @@ namespace WebCore {
         OwnPtr<SpaceSplitStringData> m_data;
     };
 
-    inline bool isClassWhitespace(UChar c)
-    {
-        return c == ' ' || c == '\r' || c == '\n' || c == '\t' || c == '\f';
-    }
-
 } // namespace WebCore
 
 #endif // SpaceSplitString_h
diff --git a/WebCore/dom/StaticHashSetNodeList.cpp b/WebCore/dom/StaticHashSetNodeList.cpp
index d641cb5..6c8c2db 100644
--- a/WebCore/dom/StaticHashSetNodeList.cpp
+++ b/WebCore/dom/StaticHashSetNodeList.cpp
@@ -34,6 +34,19 @@
 
 namespace WebCore {
 
+StaticHashSetNodeList::StaticHashSetNodeList(ListHashSet<RefPtr<Node> >& nodes)
+{
+    m_nodes.swap(nodes);
+}
+
+StaticHashSetNodeList::StaticHashSetNodeList()
+{
+}
+
+StaticHashSetNodeList::~StaticHashSetNodeList()
+{
+}
+
 unsigned StaticHashSetNodeList::length() const
 {
     return m_nodes.size();
diff --git a/WebCore/dom/StaticHashSetNodeList.h b/WebCore/dom/StaticHashSetNodeList.h
index e954493..e60bf44 100644
--- a/WebCore/dom/StaticHashSetNodeList.h
+++ b/WebCore/dom/StaticHashSetNodeList.h
@@ -41,6 +41,9 @@ class Node;
 
 class StaticHashSetNodeList : public NodeList {
 public:
+    StaticHashSetNodeList();
+    ~StaticHashSetNodeList();
+
     // Adopts the contents of the nodes ListHashSet.
     static PassRefPtr<StaticHashSetNodeList> adopt(const ListHashSet<RefPtr<Node> >& nodes)
     {
@@ -57,10 +60,7 @@ public:
     virtual Node* itemWithName(const AtomicString&) const;
 
 private:
-    StaticHashSetNodeList(ListHashSet<RefPtr<Node> >& nodes)
-    {
-        m_nodes.swap(nodes);
-    }
+    StaticHashSetNodeList(ListHashSet<RefPtr<Node> >& nodes);
 
     ListHashSet<RefPtr<Node> > m_nodes;
 };
diff --git a/WebCore/dom/StyleElement.cpp b/WebCore/dom/StyleElement.cpp
index c3a7300..f318326 100644
--- a/WebCore/dom/StyleElement.cpp
+++ b/WebCore/dom/StyleElement.cpp
@@ -39,6 +39,10 @@ StyleElement::StyleElement(Document* document, bool createdByParser)
         m_startLineNumber = document->scriptableDocumentParser()->lineNumber();
 }
 
+StyleElement::~StyleElement()
+{
+}
+
 StyleSheet* StyleElement::sheet(Element* e)
 {
     if (!m_sheet)
diff --git a/WebCore/dom/StyleElement.h b/WebCore/dom/StyleElement.h
index 00e45ed..65f6310 100644
--- a/WebCore/dom/StyleElement.h
+++ b/WebCore/dom/StyleElement.h
@@ -31,7 +31,7 @@ class Element;
 class StyleElement {
 public:
     StyleElement(Document*, bool createdByParser);
-    virtual ~StyleElement() {}
+    virtual ~StyleElement();
 
 protected:
     virtual const AtomicString& type() const = 0;
diff --git a/WebCore/dom/StyledElement.cpp b/WebCore/dom/StyledElement.cpp
index f07fda9..12744cb 100644
--- a/WebCore/dom/StyledElement.cpp
+++ b/WebCore/dom/StyledElement.cpp
@@ -31,6 +31,7 @@
 #include "DOMTokenList.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include <wtf/HashFunctions.h>
 
 using namespace std;
@@ -213,7 +214,7 @@ void StyledElement::classAttributeChanged(const AtomicString& newClassString)
     unsigned length = newClassString.length();
     unsigned i;
     for (i = 0; i < length; ++i) {
-        if (!isClassWhitespace(characters[i]))
+        if (isNotHTMLSpace(characters[i]))
             break;
     }
     bool hasClass = i < length;
@@ -401,62 +402,25 @@ void StyledElement::createMappedDecl(Attribute* attr)
     decl->setStrictParsing(false); // Mapped attributes are just always quirky.
 }
 
-// Paul Hsieh's SuperFastHash
-// http://www.azillionmonkeys.com/qed/hash.html
 unsigned MappedAttributeHash::hash(const MappedAttributeKey& key)
 {
-    uint32_t hash = WTF::stringHashingStartValue;
-    uint32_t tmp;
-
-    const uint16_t* p;
-
-    p = reinterpret_cast<const uint16_t*>(&key.name);
-    hash += p[0];
-    tmp = (p[1] << 11) ^ hash;
-    hash = (hash << 16) ^ tmp;
-    hash += hash >> 11;
-    ASSERT(sizeof(key.name) == 4 || sizeof(key.name) == 8);
-    if (sizeof(key.name) == 8) {
-        p += 2;
-        hash += p[0];
-        tmp = (p[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        hash += hash >> 11;
-    }
+    COMPILE_ASSERT(sizeof(key.name) == 4 || sizeof(key.name) == 8, key_name_size);
+    COMPILE_ASSERT(sizeof(key.value) == 4 || sizeof(key.value) == 8, key_value_size);
 
-    p = reinterpret_cast<const uint16_t*>(&key.value);
-    hash += p[0];
-    tmp = (p[1] << 11) ^ hash;
-    hash = (hash << 16) ^ tmp;
-    hash += hash >> 11;
-    ASSERT(sizeof(key.value) == 4 || sizeof(key.value) == 8);
-    if (sizeof(key.value) == 8) {
-        p += 2;
-        hash += p[0];
-        tmp = (p[1] << 11) ^ hash;
-        hash = (hash << 16) ^ tmp;
-        hash += hash >> 11;
-    }
+    WTF::StringHasher hasher;
+    const UChar* data;
+
+    data = reinterpret_cast<const UChar*>(&key.name);
+    hasher.addCharacters(data[0], data[1]);
+    if (sizeof(key.name) == 8)
+        hasher.addCharacters(data[2], data[3]);
+
+    data = reinterpret_cast<const UChar*>(&key.value);
+    hasher.addCharacters(data[0], data[1]);
+    if (sizeof(key.value) == 8)
+        hasher.addCharacters(data[2], data[3]);
 
-    // Handle end case
-    hash += key.type;
-    hash ^= hash << 11;
-    hash += hash >> 17;
-
-    // Force "avalanching" of final 127 bits
-    hash ^= hash << 3;
-    hash += hash >> 5;
-    hash ^= hash << 2;
-    hash += hash >> 15;
-    hash ^= hash << 10;
-
-    // This avoids ever returning a hash code of 0, since that is used to
-    // signal "hash not computed yet", using a value that is likely to be
-    // effectively the same as 0 when the low bits are masked
-    if (hash == 0)
-        hash = 0x80000000;
-
-    return hash;
+    return hasher.hash();
 }
 
 void StyledElement::copyNonAttributeProperties(const Element *sourceElement)
diff --git a/WebCore/dom/Text.cpp b/WebCore/dom/Text.cpp
index 928b975..6271f11 100644
--- a/WebCore/dom/Text.cpp
+++ b/WebCore/dom/Text.cpp
@@ -123,6 +123,8 @@ String Text::wholeText() const
             continue;
         const Text* t = static_cast<const Text*>(n);
         const String& data = t->data();
+        if (std::numeric_limits<unsigned>::max() - data.length() < resultLength)
+            CRASH();
         resultLength += data.length();
     }
     UChar* resultData;
@@ -151,7 +153,7 @@ PassRefPtr<Text> Text::replaceWholeText(const String& newText, ExceptionCode&)
     RefPtr<Text> endText = const_cast<Text*>(latestLogicallyAdjacentTextNode(this));
 
     RefPtr<Text> protectedThis(this); // Mutation event handlers could cause our last ref to go away
-    Node* parent = parentNode(); // Protect against mutation handlers moving this node during traversal
+    ContainerNode* parent = parentNode(); // Protect against mutation handlers moving this node during traversal
     ExceptionCode ignored = 0;
     for (RefPtr<Node> n = startText; n && n != this && n->isTextNode() && n->parentNode() == parent;) {
         RefPtr<Node> nodeToRemove(n.release());
diff --git a/WebCore/dom/TouchEvent.cpp b/WebCore/dom/TouchEvent.cpp
index bcc395f..88d3e6f 100644
--- a/WebCore/dom/TouchEvent.cpp
+++ b/WebCore/dom/TouchEvent.cpp
@@ -31,6 +31,10 @@
 
 namespace WebCore {
 
+TouchEvent::TouchEvent()
+{
+}
+
 TouchEvent::TouchEvent(TouchList* touches, TouchList* targetTouches,
         TouchList* changedTouches, const AtomicString& type, 
         PassRefPtr<AbstractView> view, int screenX, int screenY, int pageX, int pageY,
@@ -43,6 +47,10 @@ TouchEvent::TouchEvent(TouchList* touches, TouchList* targetTouches,
 {
 }
 
+TouchEvent::~TouchEvent()
+{
+}
+
 void TouchEvent::initTouchEvent(TouchList* touches, TouchList* targetTouches,
         TouchList* changedTouches, const AtomicString& type, 
         PassRefPtr<AbstractView> view, int screenX, int screenY, int clientX, int clientY,
diff --git a/WebCore/dom/TouchEvent.h b/WebCore/dom/TouchEvent.h
index 080a495..1514cf8 100644
--- a/WebCore/dom/TouchEvent.h
+++ b/WebCore/dom/TouchEvent.h
@@ -35,6 +35,8 @@ namespace WebCore {
 
 class TouchEvent : public MouseRelatedEvent {
 public:
+    virtual ~TouchEvent();
+
     static PassRefPtr<TouchEvent> create()
     {
         return adoptRef(new TouchEvent);
@@ -61,7 +63,7 @@ public:
     TouchList* changedTouches() const { return m_changedTouches.get(); }
 
 private:
-    TouchEvent() {}
+    TouchEvent();
     TouchEvent(TouchList* touches, TouchList* targetTouches,
             TouchList* changedTouches, const AtomicString& type,
             PassRefPtr<AbstractView>, int screenX, int screenY, int pageX,
diff --git a/WebCore/dom/TreeWalker.cpp b/WebCore/dom/TreeWalker.cpp
index 6a8ca87..d28603f 100644
--- a/WebCore/dom/TreeWalker.cpp
+++ b/WebCore/dom/TreeWalker.cpp
@@ -94,7 +94,7 @@ Node* TreeWalker::firstChild(ScriptState* state)
                 node = node->nextSibling();
                 break;
             }
-            Node* parent = node->parentNode();
+            ContainerNode* parent = node->parentNode();
             if (!parent || parent == root() || parent == m_current)
                 return 0;
             node = parent;
@@ -127,7 +127,7 @@ Node* TreeWalker::lastChild(ScriptState* state)
                 node = node->previousSibling();
                 break;
             }
-            Node* parent = node->parentNode();
+            ContainerNode* parent = node->parentNode();
             if (!parent || parent == root() || parent == m_current)
                 return 0;
             node = parent;
@@ -236,7 +236,7 @@ Node* TreeWalker::previousNode(ScriptState* state)
         }
         if (node == root())
             return 0;
-        Node* parent = node->parentNode();
+        ContainerNode* parent = node->parentNode();
         if (!parent)
             return 0;
         node = parent;
diff --git a/WebCore/dom/ViewportArguments.cpp b/WebCore/dom/ViewportArguments.cpp
index 356f9ed..d2e6684 100644
--- a/WebCore/dom/ViewportArguments.cpp
+++ b/WebCore/dom/ViewportArguments.cpp
@@ -41,9 +41,9 @@ using namespace std;
 
 namespace WebCore {
 
-ViewportConfiguration findConfigurationForViewportData(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport)
+ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport)
 {
-    ViewportConfiguration result;
+    ViewportAttributes result;
 
     float availableWidth = visibleViewport.width();
     float availableHeight = visibleViewport.height();
@@ -151,12 +151,17 @@ ViewportConfiguration findConfigurationForViewportData(ViewportArguments args, i
     // Extend width and height to fill the visual viewport for the resolved initial-scale.
     width = max(width, availableWidth / result.initialScale);
     height = max(height, availableHeight / result.initialScale);
-    result.layoutViewport.setWidth(width);
-    result.layoutViewport.setHeight(height);
+    result.layoutSize.setWidth(width);
+    result.layoutSize.setHeight(height);
 
     // Update minimum scale factor, to never allow zooming out more than viewport
     result.minimumScale = max(result.minimumScale, max(availableWidth / width, availableHeight / height));
 
+    result.userScalable = args.userScalable;
+    // Make maximum and minimum scale equal to the initial scale if user is not allowed to zoom in/out.
+    if (!args.userScalable)
+        result.maximumScale = result.minimumScale = result.initialScale;
+
     return result;
 }
 
diff --git a/WebCore/dom/ViewportArguments.h b/WebCore/dom/ViewportArguments.h
index 5731842..a31e009 100644
--- a/WebCore/dom/ViewportArguments.h
+++ b/WebCore/dom/ViewportArguments.h
@@ -42,14 +42,16 @@ enum ViewportErrorCode {
     TargetDensityDpiTooSmallOrLargeError
 };
 
-struct ViewportConfiguration {
-    IntSize layoutViewport;
+struct ViewportAttributes {
+    IntSize layoutSize;
 
     float devicePixelRatio;
 
     float initialScale;
     float minimumScale;
     float maximumScale;
+
+    bool userScalable;
 };
 
 struct ViewportArguments {
@@ -83,15 +85,21 @@ struct ViewportArguments {
     float height;
     float targetDensityDpi;
 
-    float userScalable;
+    bool userScalable;
 
-    bool hasCustomArgument() const
+    bool operator==(const ViewportArguments& other) const
     {
-        return initialScale != ValueAuto || minimumScale != ValueAuto || maximumScale != ValueAuto || width != ValueAuto || height != ValueAuto || userScalable != ValueAuto || targetDensityDpi != ValueAuto;
+        return initialScale == other.initialScale
+            && minimumScale == other.minimumScale
+            && maximumScale == other.maximumScale
+            && width == other.width
+            && height == other.height
+            && targetDensityDpi == other.targetDensityDpi
+            && userScalable == other.userScalable;
     }
 };
 
-ViewportConfiguration findConfigurationForViewportData(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport);
+ViewportAttributes computeViewportAttributes(ViewportArguments args, int desktopWidth, int deviceWidth, int deviceHeight, int deviceDPI, IntSize visibleViewport);
 
 void setViewportFeature(const String& keyString, const String& valueString, Document*, void* data);
 void reportViewportWarning(Document*, ViewportErrorCode, const String& replacement);
diff --git a/WebCore/dom/XMLDocumentParser.cpp b/WebCore/dom/XMLDocumentParser.cpp
index 4ae18a1..b790217 100644
--- a/WebCore/dom/XMLDocumentParser.cpp
+++ b/WebCore/dom/XMLDocumentParser.cpp
@@ -51,7 +51,7 @@
 #include "ScriptValue.h"
 #include "TextResourceDecoder.h"
 #include "TreeDepthLimit.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/StringExtras.h>
 #include <wtf/Threading.h>
 #include <wtf/Vector.h>
@@ -151,11 +151,11 @@ void XMLDocumentParser::handleError(ErrorType type, const char* m, int lineNumbe
     if (type == fatal || (m_errorCount < maxErrors && m_lastErrorLine != lineNumber && m_lastErrorColumn != columnNumber)) {
         switch (type) {
             case warning:
-                m_errorMessages += String::format("warning on line %d at column %d: %s", lineNumber, columnNumber, m);
+                m_errorMessages += makeString("warning on line ", String::number(lineNumber), " at column ", String::number(columnNumber), ": ", m);
                 break;
             case fatal:
             case nonFatal:
-                m_errorMessages += String::format("error on line %d at column %d: %s", lineNumber, columnNumber, m);
+                m_errorMessages += makeString("error on line ", String::number(lineNumber), " at column ", String::number(columnNumber), ": ", m);
         }
 
         m_lastErrorLine = lineNumber;
@@ -293,47 +293,47 @@ void XMLDocumentParser::insertErrorMessageBlock()
 
     // Create elements for display
     ExceptionCode ec = 0;
-    Document* doc = document();
-    Node* documentElement = doc->documentElement();
+    Document* document = this->document();
+    Element* documentElement = document->documentElement();
     if (!documentElement) {
-        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
-        doc->appendChild(rootElement, ec);
-        RefPtr<Node> body = doc->createElement(bodyTag, false);
+        RefPtr<Element> rootElement = document->createElement(htmlTag, false);
+        document->appendChild(rootElement, ec);
+        RefPtr<Element> body = document->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         documentElement = body.get();
     }
 #if ENABLE(SVG)
     else if (documentElement->namespaceURI() == SVGNames::svgNamespaceURI) {
-        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
-        RefPtr<Node> body = doc->createElement(bodyTag, false);
+        RefPtr<Element> rootElement = document->createElement(htmlTag, false);
+        RefPtr<Element> body = document->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
-        doc->appendChild(rootElement.get(), ec);
+        document->appendChild(rootElement.get(), ec);
         documentElement = body.get();
     }
 #endif
 #if ENABLE(WML)
     else if (isWMLDocument()) {
-        RefPtr<Node> rootElement = doc->createElement(htmlTag, false);
-        RefPtr<Node> body = doc->createElement(bodyTag, false);
+        RefPtr<Element> rootElement = document->createElement(htmlTag, false);
+        RefPtr<Element> body = document->createElement(bodyTag, false);
         rootElement->appendChild(body, ec);
         body->appendChild(documentElement, ec);
-        doc->appendChild(rootElement.get(), ec);
+        document->appendChild(rootElement.get(), ec);
         documentElement = body.get();
     }
 #endif
 
-    RefPtr<Element> reportElement = createXHTMLParserErrorHeader(doc, m_errorMessages);
+    RefPtr<Element> reportElement = createXHTMLParserErrorHeader(document, m_errorMessages);
     documentElement->insertBefore(reportElement, documentElement->firstChild(), ec);
 #if ENABLE(XSLT)
-    if (doc->transformSourceDocument()) {
-        RefPtr<Element> par = doc->createElement(pTag, false);
-        reportElement->appendChild(par, ec);
-        par->setAttribute(styleAttr, "white-space: normal");
-        par->appendChild(doc->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
+    if (document->transformSourceDocument()) {
+        RefPtr<Element> paragraph = document->createElement(pTag, false);
+        paragraph->setAttribute(styleAttr, "white-space: normal");
+        paragraph->appendChild(document->createTextNode("This document was created as the result of an XSL transformation. The line and column numbers given are from the transformed result."), ec);
+        reportElement->appendChild(paragraph.release(), ec);
     }
 #endif
-    doc->updateStyleIfNeeded();
+    document->updateStyleIfNeeded();
 }
 
 void XMLDocumentParser::notifyFinished(CachedResource* unusedResource)
diff --git a/WebCore/dom/XMLDocumentParserLibxml2.cpp b/WebCore/dom/XMLDocumentParserLibxml2.cpp
index 5539072..5b5ac89 100644
--- a/WebCore/dom/XMLDocumentParserLibxml2.cpp
+++ b/WebCore/dom/XMLDocumentParserLibxml2.cpp
@@ -38,7 +38,9 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "HTMLEntityParser.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLLinkElement.h"
+#include "HTMLNames.h"
 #include "HTMLStyleElement.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
@@ -596,7 +598,7 @@ XMLDocumentParser::XMLDocumentParser(DocumentFragment* fragment, Element* parent
     while (parentElement) {
         elemStack.append(parentElement);
 
-        Node* n = parentElement->parentNode();
+        ContainerNode* n = parentElement->parentNode();
         if (!n || !n->isElementNode())
             break;
         parentElement = static_cast<Element*>(n);
@@ -825,6 +827,11 @@ void XMLDocumentParser::startElementNs(const xmlChar* xmlLocalName, const xmlCha
     if (m_view && !newElement->attached())
         newElement->attach();
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (newElement->hasTagName(HTMLNames::htmlTag))
+        static_cast<HTMLHtmlElement*>(newElement.get())->insertedByParser();
+#endif
+
     if (!m_parsingFragment && isFirstElement && document()->frame())
         document()->frame()->loader()->dispatchDocumentElementAvailable();
 }
diff --git a/WebCore/dom/XMLDocumentParserQt.cpp b/WebCore/dom/XMLDocumentParserQt.cpp
index 75a20be..03b083e 100644
--- a/WebCore/dom/XMLDocumentParserQt.cpp
+++ b/WebCore/dom/XMLDocumentParserQt.cpp
@@ -37,7 +37,9 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "HTMLEntityParser.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLLinkElement.h"
+#include "HTMLNames.h"
 #include "HTMLStyleElement.h"
 #include "ProcessingInstruction.h"
 #include "ResourceError.h"
@@ -524,6 +526,11 @@ void XMLDocumentParser::parseStartElement()
     if (m_view && !newElement->attached())
         newElement->attach();
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (newElement->hasTagName(HTMLNames::htmlTag))
+        static_cast<HTMLHtmlElement*>(newElement.get())->insertedByParser();
+#endif
+
     if (isFirstElement && document()->frame())
         document()->frame()->loader()->dispatchDocumentElementAvailable();
 }
diff --git a/WebCore/dom/make_names.pl b/WebCore/dom/make_names.pl
index 9dec124..a3b71b8 100755
--- a/WebCore/dom/make_names.pl
+++ b/WebCore/dom/make_names.pl
@@ -54,6 +54,7 @@ my %allTags = ();
 my %allAttrs = ();
 my %parameters = ();
 my $extraDefines = 0;
+my %extensionAttrs = ();
 
 require Config;
 
@@ -180,7 +181,14 @@ sub tagsHandler
 sub attrsHandler
 {
     my ($attr, $property, $value) = @_;
-
+    # Translate HTML5 extension attributes of the form 'x-webkit-feature' to 'webkitfeature'.
+    # We don't just check for the 'x-' prefix because there are attributes such as x-height
+    # which should follow the default path below.
+    if ($attr =~ m/^x-webkit-(.*)/) {
+        my $newAttr = "webkit$1";
+        $extensionAttrs{$newAttr} = $attr;
+        $attr = $newAttr;
+    }
     $attr =~ s/-/_/g;
 
     # Initialize default properties' values.
@@ -620,8 +628,11 @@ sub printDefinitions
     print F "    // " . ucfirst($type) . "\n";
 
     for my $name (sort keys %$namesRef) {
-        my $realName = $name;
-        $realName =~ s/_/-/g;
+        my $realName = $extensionAttrs{$name};
+        if (!$realName) {
+            $realName = $name;
+            $realName =~ s/_/-/g;
+        }
         print F "    new ((void*)&$name","${shortCamelType}) QualifiedName(nullAtom, \"$realName\", $namespaceURI);\n";
     }
 }
diff --git a/WebCore/editing/ApplyBlockElementCommand.cpp b/WebCore/editing/ApplyBlockElementCommand.cpp
new file mode 100644
index 0000000..ecd3d9b
--- /dev/null
+++ b/WebCore/editing/ApplyBlockElementCommand.cpp
@@ -0,0 +1,261 @@
+/*
+ * Copyright (C) 2006, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ApplyBlockElementCommand.h"
+
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "Text.h"
+#include "TextIterator.h"
+#include "VisiblePosition.h"
+#include "htmlediting.h"
+#include "visible_units.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+ApplyBlockElementCommand::ApplyBlockElementCommand(Document* document, const QualifiedName& tagName, const AtomicString& className, const AtomicString& inlineStyle)
+    : CompositeEditCommand(document)
+    , m_tagName(tagName)
+    , m_className(className)
+    , m_inlineStyle(inlineStyle)
+{
+}
+
+ApplyBlockElementCommand::ApplyBlockElementCommand(Document* document, const QualifiedName& tagName)
+    : CompositeEditCommand(document)
+    , m_tagName(tagName)
+{
+}
+
+void ApplyBlockElementCommand::doApply()
+{
+    if (!endingSelection().isNonOrphanedCaretOrRange())
+        return;
+
+    if (!endingSelection().rootEditableElement())
+        return;
+
+    VisiblePosition visibleEnd = endingSelection().visibleEnd();
+    VisiblePosition visibleStart = endingSelection().visibleStart();
+    // When a selection ends at the start of a paragraph, we rarely paint 
+    // the selection gap before that paragraph, because there often is no gap.  
+    // In a case like this, it's not obvious to the user that the selection 
+    // ends "inside" that paragraph, so it would be confusing if Indent/Outdent 
+    // operated on that paragraph.
+    // FIXME: We paint the gap before some paragraphs that are indented with left 
+    // margin/padding, but not others.  We should make the gap painting more consistent and 
+    // then use a left margin/padding rule here.
+    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
+        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
+
+    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
+    VisiblePosition startOfSelection = selection.visibleStart();
+    VisiblePosition endOfSelection = selection.visibleEnd();
+    ASSERT(!startOfSelection.isNull());
+    ASSERT(!endOfSelection.isNull());
+    int startIndex = indexForVisiblePosition(startOfSelection);
+    int endIndex = indexForVisiblePosition(endOfSelection);
+
+    formatSelection(startOfSelection, endOfSelection);
+
+    updateLayout();
+
+    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
+    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
+    if (startRange && endRange)
+        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+}
+
+void ApplyBlockElementCommand::formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
+{
+    // Special case empty unsplittable elements because there's nothing to split
+    // and there's nothing to move.
+    Position start = startOfSelection.deepEquivalent().downstream();
+    if (isAtUnsplittableElement(start)) {
+        RefPtr<Element> blockquote = createBlockElement();
+        insertNodeAt(blockquote, start);
+        RefPtr<Element> placeholder = createBreakElement(document());
+        appendNode(placeholder, blockquote);
+        setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
+        return;
+    }
+
+    RefPtr<Element> blockquoteForNextIndent;
+    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
+    VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
+    VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
+
+    bool atEnd = false;
+    Position end;
+    while (endOfCurrentParagraph != endAfterSelection && !atEnd) {
+        if (endOfCurrentParagraph == endOfLastParagraph)
+            atEnd = true;
+
+        rangeForParagraphSplittingTextNodesIfNeeded(endOfCurrentParagraph, start, end);
+        endOfCurrentParagraph = end;
+
+        Position afterEnd = end.next();
+        Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
+        VisiblePosition endOfNextParagraph = endOfNextParagrahSplittingTextNodesIfNeeded(endOfCurrentParagraph, start, end);
+
+        formatRange(start, end, blockquoteForNextIndent);
+
+        // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
+        // the next paragraph is in the same cell.
+        if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
+            blockquoteForNextIndent = 0;
+
+        // indentIntoBlockquote could move more than one paragraph if the paragraph
+        // is in a list item or a table. As a result, endAfterSelection could refer to a position
+        // no longer in the document.
+        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
+            break;
+        // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
+        // If somehow we did, return to prevent crashes.
+        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
+            ASSERT_NOT_REACHED();
+            return;
+        }
+        endOfCurrentParagraph = endOfNextParagraph;
+    }
+}
+
+static bool isNewLineAtPosition(const Position& position)
+{
+    if (position.anchorType() != Position::PositionIsOffsetInAnchor)
+        return false;
+
+    Node* textNode = position.containerNode();
+    int offset = position.offsetInContainerNode();
+    if (!textNode || !textNode->isTextNode() || offset < 0 || offset >= textNode->maxCharacterOffset())
+        return false;
+
+    ExceptionCode ec = 0;
+    String textAtPosition = static_cast<Text*>(textNode)->substringData(offset, 1, ec);
+    if (ec)
+        return false;
+
+    return textAtPosition[0] == '\n';
+}
+
+static RenderStyle* renderStyleOfEnclosingTextNode(const Position& position)
+{
+    if (position.anchorType() != Position::PositionIsOffsetInAnchor
+        || !position.containerNode()
+        || !position.containerNode()->isTextNode()
+        || !position.containerNode()->renderer())
+        return 0;
+    return position.containerNode()->renderer()->style();
+}
+
+void ApplyBlockElementCommand::rangeForParagraphSplittingTextNodesIfNeeded(const VisiblePosition& endOfCurrentParagraph, Position& start, Position& end)
+{
+    start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
+    end = endOfCurrentParagraph.deepEquivalent();
+
+    RenderStyle* startStyle = renderStyleOfEnclosingTextNode(start);
+    if (startStyle) {
+        // Avoid obtanining the start of next paragraph for start
+        if (startStyle->preserveNewline() && isNewLineAtPosition(start) && !isNewLineAtPosition(start.previous()) && start.offsetInContainerNode() > 0)
+            start = startOfParagraph(end.previous()).deepEquivalent();
+
+        // If start is in the middle of a text node, split.
+        if (!startStyle->collapseWhiteSpace() && start.offsetInContainerNode() > 0) {
+            int startOffset = start.offsetInContainerNode();
+            splitTextNode(static_cast<Text*>(start.node()), startOffset);
+            start = positionBeforeNode(start.node());
+            if (start.node() == end.node()) {
+                ASSERT(end.offsetInContainerNode() >= startOffset);
+                end = Position(end.node(), end.offsetInContainerNode() - startOffset, Position::PositionIsOffsetInAnchor);
+            }
+        }
+    }
+
+    RenderStyle* endStyle = renderStyleOfEnclosingTextNode(end);
+    if (endStyle) {
+        // Include \n at the end of line if we're at an empty paragraph
+        if (endStyle->preserveNewline() && start == end
+            && end.offsetInContainerNode() < end.containerNode()->maxCharacterOffset()) {
+            int endOffset = end.offsetInContainerNode();
+            if (!isNewLineAtPosition(end.previous()) && isNewLineAtPosition(end))
+                end = Position(end.node(), endOffset + 1, Position::PositionIsOffsetInAnchor);
+        }
+
+        // If end is in the middle of a text node, split.
+        if (!endStyle->collapseWhiteSpace() && end.offsetInContainerNode()
+            && end.offsetInContainerNode() < end.containerNode()->maxCharacterOffset()) {
+            splitTextNode(static_cast<Text*>(end.node()), end.offsetInContainerNode());
+            if (start.node() == end.node())
+                start = positionBeforeNode(end.node()->previousSibling());
+            end = lastPositionInNode(end.node()->previousSibling());
+        }
+    }
+}
+
+VisiblePosition ApplyBlockElementCommand::endOfNextParagrahSplittingTextNodesIfNeeded(VisiblePosition& endOfCurrentParagraph, Position& start, Position& end)
+{
+    VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
+    Position position = endOfNextParagraph.deepEquivalent();
+    RenderStyle* style = renderStyleOfEnclosingTextNode(position);
+    if (!style)
+        return endOfNextParagraph;
+
+    RefPtr<Node> containerNode = position.containerNode();
+    if (!style->preserveNewline() || !position.offsetInContainerNode()
+        || !isNewLineAtPosition(Position(containerNode.get(), 0, Position::PositionIsOffsetInAnchor)))
+        return endOfNextParagraph;
+
+    // \n at the beginning of the text node immediately following the current paragraph is trimmed by moveParagraphWithClones.
+    // If endOfNextParagraph was pointing at this same text node, endOfNextParagraph will be shifted by one paragraph.
+    // Avoid this by splitting "\n"
+    splitTextNode(static_cast<Text*>(containerNode.get()), 1);
+
+    if (start.anchorType() == Position::PositionIsOffsetInAnchor && containerNode.get() == start.containerNode()) {
+        ASSERT(start.offsetInContainerNode() < position.offsetInContainerNode());
+        start = Position(containerNode->previousSibling(), start.offsetInContainerNode(), Position::PositionIsOffsetInAnchor);
+    }
+    if (end.anchorType() == Position::PositionIsOffsetInAnchor && containerNode.get() == end.containerNode()) {
+        ASSERT(end.offsetInContainerNode() < position.offsetInContainerNode());
+        end = Position(containerNode->previousSibling(), end.offsetInContainerNode(), Position::PositionIsOffsetInAnchor);
+    }
+
+    return Position(containerNode.get(), position.offsetInContainerNode() - 1, Position::PositionIsOffsetInAnchor);
+}
+
+PassRefPtr<Element> ApplyBlockElementCommand::createBlockElement() const
+{
+    RefPtr<Element> element = createHTMLElement(document(), m_tagName);
+    if (m_className.length())
+        element->setAttribute(classAttr, m_className);
+    if (m_inlineStyle.length())
+        element->setAttribute(styleAttr, m_inlineStyle);
+    return element.release();
+}
+
+}
diff --git a/WebCore/editing/ApplyBlockElementCommand.h b/WebCore/editing/ApplyBlockElementCommand.h
new file mode 100644
index 0000000..1fc4931
--- /dev/null
+++ b/WebCore/editing/ApplyBlockElementCommand.h
@@ -0,0 +1,60 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ApplyBlockElementCommand_h
+#define ApplyBlockElementCommand_h
+
+#include "CompositeEditCommand.h"
+
+namespace WebCore {
+
+class ApplyBlockElementCommand : public CompositeEditCommand {
+protected:
+    ApplyBlockElementCommand(Document*, const QualifiedName& tagName, const AtomicString& className, const AtomicString& inlineStyle);
+    ApplyBlockElementCommand(Document*, const QualifiedName& tagName);
+
+    virtual void formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection);
+    PassRefPtr<Element> createBlockElement() const;
+    const QualifiedName tagName() const { return m_tagName; }
+
+private:
+    virtual void doApply();
+    virtual void formatRange(const Position& start, const Position&, RefPtr<Element>&) = 0;
+    void rangeForParagraphSplittingTextNodesIfNeeded(const VisiblePosition&, Position&, Position&);
+    VisiblePosition endOfNextParagrahSplittingTextNodesIfNeeded(VisiblePosition&, Position&, Position&);
+
+    QualifiedName m_tagName;
+    AtomicString m_className;
+    AtomicString m_inlineStyle;
+};
+
+}
+
+#endif
diff --git a/WebCore/editing/ApplyStyleCommand.cpp b/WebCore/editing/ApplyStyleCommand.cpp
index 3ff7169..3f60a8b 100644
--- a/WebCore/editing/ApplyStyleCommand.cpp
+++ b/WebCore/editing/ApplyStyleCommand.cpp
@@ -395,6 +395,8 @@ static int getTextAlignment(CSSStyleDeclaration* style)
     case CSSValueCenter:
     case CSSValueWebkitCenter:
         return CSSValueCenter;
+    case CSSValueJustify:
+        return CSSValueJustify;
     case CSSValueLeft:
     case CSSValueWebkitLeft:
         return CSSValueLeft;
@@ -638,9 +640,13 @@ void ApplyStyleCommand::applyBlockStyle(CSSMutableStyleDeclaration *style)
         start = end;
         end = swap;
     }
-        
+
     VisiblePosition visibleStart(start);
     VisiblePosition visibleEnd(end);
+
+    if (visibleStart.isNull() || visibleStart.isOrphan() || visibleEnd.isNull() || visibleEnd.isOrphan())
+        return;
+    
     // Save and restore the selection endpoints using their indices in the document, since
     // addBlockStyleIfNeeded may moveParagraphs, which can remove these endpoints.
     // Calculate start and end indices from the start of the tree that they're in.
@@ -1093,6 +1099,14 @@ void ApplyStyleCommand::fixRangeAndApplyInlineStyle(CSSMutableStyleDeclaration*
     if (start == end && start.node()->hasTagName(brTag))
         pastEndNode = start.node()->traverseNextNode();
 
+    // Start from the highest fully selected ancestor so that we can modify the fully selected node.
+    // e.g. When applying font-size: large on <font color="blue">hello</font>, we need to include the font element in our run
+    // to generate <font color="blue" size="4">hello</font> instead of <font color="blue"><font size="4">hello</font></font>
+    RefPtr<Range> range = Range::create(startNode->document(), start, end);
+    Element* editableRoot = startNode->rootEditableElement();
+    while (editableRoot && startNode->parentNode() != editableRoot && isNodeVisiblyContainedWithin(startNode->parentNode(), range.get()))
+        startNode = startNode->parentNode();
+
     applyInlineStyleToNodeRange(style, startNode, pastEndNode);
 }
 
@@ -1163,7 +1177,21 @@ void ApplyStyleCommand::applyInlineStyleToNodeRange(CSSMutableStyleDeclaration*
 
 bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(CSSMutableStyleDeclaration* style, Node*& runStart, Node*& runEnd)
 {
+    ASSERT(runStart && runEnd && runStart->parentNode() == runEnd->parentNode());
     Node* pastEndNode = runEnd->traverseNextSibling();
+    bool needToApplyStyle = false;
+    for (Node* node = runStart; node && node != pastEndNode; node = node->traverseNextNode()) {
+        if (node->childNodeCount())
+            continue;
+        if (getPropertiesNotIn(style, computedStyle(node).get())->length()
+            || (m_styledInlineElement && !enclosingNodeWithTag(positionBeforeNode(node), m_styledInlineElement->tagQName()))) {
+            needToApplyStyle = true;
+            break;
+        }
+    }
+    if (!needToApplyStyle)
+        return false;
+
     Node* next;
     for (Node* node = runStart; node && node != pastEndNode; node = next) {
         next = node->traverseNextNode();
@@ -1172,7 +1200,7 @@ bool ApplyStyleCommand::removeStyleFromRunBeforeApplyingStyle(CSSMutableStyleDec
         
         Node* previousSibling = node->previousSibling();
         Node* nextSibling = node->nextSibling();
-        Node* parent = node->parentNode();
+        ContainerNode* parent = node->parentNode();
         removeInlineStyleFromElement(style, static_cast<HTMLElement*>(node), RemoveAlways);
         if (!node->inDocument()) {
             // FIXME: We might need to update the start and the end of current selection here but need a test.
@@ -1191,12 +1219,16 @@ bool ApplyStyleCommand::removeInlineStyleFromElement(CSSMutableStyleDeclaration*
     ASSERT(style);
     ASSERT(element);
 
+    if (!element->parentNode() || !element->parentNode()->isContentEditable())
+        return false;
+
     if (m_styledInlineElement && element->hasTagName(m_styledInlineElement->tagQName())) {
-        if (mode != RemoveNone) {
-            if (extractedStyle && element->inlineStyleDecl())
-                extractedStyle->merge(element->inlineStyleDecl());
-            removeNodePreservingChildren(element);
-        }
+        if (mode == RemoveNone)
+            return true;
+        ASSERT(extractedStyle);
+        if (element->inlineStyleDecl())
+            extractedStyle->merge(element->inlineStyleDecl());
+        removeNodePreservingChildren(element);
         return true;
     }
 
@@ -1335,7 +1367,7 @@ void ApplyStyleCommand::replaceWithSpanOrRemoveIfWithoutAttributes(HTMLElement*&
     if (removeNode)
         removeNodePreservingChildren(elem);
     else {
-        HTMLElement* newSpanElement = replaceNodeWithSpanPreservingChildrenAndAttributes(elem);
+        HTMLElement* newSpanElement = replaceElementWithSpanPreservingChildrenAndAttributes(elem);
         ASSERT(newSpanElement && newSpanElement->inDocument());
         elem = newSpanElement;
     }
@@ -1555,12 +1587,19 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
 
     Node* node = start.node();
     while (node) {
-        Node* next = node->traverseNextNode();
+        RefPtr<Node> next = node->traverseNextNode();
         if (node->isHTMLElement() && nodeFullySelected(node, start, end)) {
-            HTMLElement* elem = static_cast<HTMLElement*>(node);
-            Node* prev = elem->traversePreviousNodePostOrder();
-            Node* next = elem->traverseNextNode();
-            removeInlineStyleFromElement(style.get(), elem);
+            RefPtr<HTMLElement> elem = static_cast<HTMLElement*>(node);
+            RefPtr<Node> prev = elem->traversePreviousNodePostOrder();
+            RefPtr<Node> next = elem->traverseNextNode();
+            RefPtr<CSSMutableStyleDeclaration> styleToPushDown;
+            PassRefPtr<Node> childNode = 0;
+            if (m_styledInlineElement && elem->hasTagName(m_styledInlineElement->tagQName())) {
+                styleToPushDown = CSSMutableStyleDeclaration::create();
+                childNode = elem->firstChild();
+            }
+
+            removeInlineStyleFromElement(style.get(), elem.get(), RemoveIfNeeded, styleToPushDown.get());
             if (!elem->inDocument()) {
                 if (s.node() == elem) {
                     // Since elem must have been fully selected, and it is at the start
@@ -1573,13 +1612,18 @@ void ApplyStyleCommand::removeInlineStyle(PassRefPtr<CSSMutableStyleDeclaration>
                     // of the selection, it is clear we can set the new e offset to
                     // the max range offset of prev.
                     ASSERT(e.deprecatedEditingOffset() >= lastOffsetForEditing(e.node()));
-                    e = Position(prev, lastOffsetForEditing(prev));
+                    e = Position(prev, lastOffsetForEditing(prev.get()));
                 }
             }
+
+            if (styleToPushDown) {
+                for (; childNode; childNode = childNode->nextSibling())
+                    applyInlineStyleToPushDown(childNode.get(), styleToPushDown.get());
+            }
         }
         if (node == end.node())
             break;
-        node = next;
+        node = next.get();
     }
     
     ASSERT(s.node()->inDocument());
@@ -1650,7 +1694,7 @@ void ApplyStyleCommand::splitTextElementAtEnd(const Position& start, const Posit
 
 bool ApplyStyleCommand::shouldSplitTextElement(Element* element, CSSMutableStyleDeclaration* style)
 {
-    if (!element || !element->isHTMLElement() || !element->parentElement() || !element->parentElement()->isContentEditable())
+    if (!element || !element->isHTMLElement())
         return false;
 
     return shouldRemoveInlineStyleFromElement(style, static_cast<HTMLElement*>(element));
@@ -1835,26 +1879,69 @@ void ApplyStyleCommand::addBlockStyle(const StyleChange& styleChange, HTMLElemen
 
 void ApplyStyleCommand::addInlineStyleIfNeeded(CSSMutableStyleDeclaration *style, Node *startNode, Node *endNode, EAddStyledElement addStyledElement)
 {
-    StyleChange styleChange(style, Position(startNode, 0));
+    // It's okay to obtain the style at the startNode because we've removed all relevant styles from the current run.
+    RefPtr<HTMLElement> dummyElement;
+    Position positionForStyleComparison;
+    if (!startNode->isElementNode()) {
+        dummyElement = createStyleSpanElement(document());
+        insertNodeAt(dummyElement, positionBeforeNode(startNode));
+        positionForStyleComparison = positionBeforeNode(dummyElement.get());
+    } else
+        positionForStyleComparison = firstPositionInNode(startNode);
+
+    StyleChange styleChange(style, positionForStyleComparison);
+
+    if (dummyElement)
+        removeNode(dummyElement);
+
+    // Find appropriate font and span elements top-down.
+    HTMLElement* fontContainer = 0;
+    HTMLElement* styleContainer = 0;
+    for (Node* container = startNode; container && startNode == endNode; container = container->firstChild()) {
+        if (container->isHTMLElement() && container->hasTagName(fontTag))
+            fontContainer = static_cast<HTMLElement*>(container);
+        bool styleContainerIsNotSpan = !styleContainer || !styleContainer->hasTagName(spanTag);
+        if (container->isHTMLElement() && (container->hasTagName(spanTag) || (styleContainerIsNotSpan && container->childNodeCount())))
+            styleContainer = static_cast<HTMLElement*>(container);
+        if (!container->firstChild())
+            break;
+        startNode = container->firstChild();
+        endNode = container->lastChild();
+    }
 
     // Font tags need to go outside of CSS so that CSS font sizes override leagcy font sizes.
     if (styleChange.applyFontColor() || styleChange.applyFontFace() || styleChange.applyFontSize()) {
-        RefPtr<Element> fontElement = createFontElement(document());
-
-        if (styleChange.applyFontColor())
-            fontElement->setAttribute(colorAttr, styleChange.fontColor());
-        if (styleChange.applyFontFace())
-            fontElement->setAttribute(faceAttr, styleChange.fontFace());
-        if (styleChange.applyFontSize())
-            fontElement->setAttribute(sizeAttr, styleChange.fontSize());
-
-        surroundNodeRangeWithElement(startNode, endNode, fontElement.get());
+        if (fontContainer) {
+            if (styleChange.applyFontColor())
+                setNodeAttribute(fontContainer, colorAttr, styleChange.fontColor());
+            if (styleChange.applyFontFace())
+                setNodeAttribute(fontContainer, faceAttr, styleChange.fontFace());
+            if (styleChange.applyFontSize())
+                setNodeAttribute(fontContainer, sizeAttr, styleChange.fontSize());
+        } else {
+            RefPtr<Element> fontElement = createFontElement(document());
+            if (styleChange.applyFontColor())
+                fontElement->setAttribute(colorAttr, styleChange.fontColor());
+            if (styleChange.applyFontFace())
+                fontElement->setAttribute(faceAttr, styleChange.fontFace());
+            if (styleChange.applyFontSize())
+                fontElement->setAttribute(sizeAttr, styleChange.fontSize());
+            surroundNodeRangeWithElement(startNode, endNode, fontElement.get());
+        }
     }
 
     if (styleChange.cssStyle().length()) {
-        RefPtr<Element> styleElement = createStyleSpanElement(document());
-        styleElement->setAttribute(styleAttr, styleChange.cssStyle());
-        surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
+        if (styleContainer) {
+            CSSMutableStyleDeclaration* existingStyle = static_cast<HTMLElement*>(styleContainer)->inlineStyleDecl();
+            if (existingStyle)
+                setNodeAttribute(styleContainer, styleAttr, existingStyle->cssText() + styleChange.cssStyle());
+            else
+                setNodeAttribute(styleContainer, styleAttr, styleChange.cssStyle());
+        } else {
+            RefPtr<Element> styleElement = createStyleSpanElement(document());
+            styleElement->setAttribute(styleAttr, styleChange.cssStyle());
+            surroundNodeRangeWithElement(startNode, endNode, styleElement.release());
+        }
     }
 
     if (styleChange.applyBold())
diff --git a/WebCore/editing/BreakBlockquoteCommand.cpp b/WebCore/editing/BreakBlockquoteCommand.cpp
index 2da6047..63956e5 100644
--- a/WebCore/editing/BreakBlockquoteCommand.cpp
+++ b/WebCore/editing/BreakBlockquoteCommand.cpp
@@ -67,7 +67,7 @@ void BreakBlockquoteCommand::doApply()
     
     // Find the top-most blockquote from the start.
     Element* topBlockquote = 0;
-    for (Node *node = pos.node()->parentNode(); node; node = node->parentNode()) {
+    for (ContainerNode* node = pos.node()->parentNode(); node; node = node->parentNode()) {
         if (isMailBlockquote(node))
             topBlockquote = static_cast<Element*>(node);
     }
diff --git a/WebCore/editing/CompositeEditCommand.cpp b/WebCore/editing/CompositeEditCommand.cpp
index 356a717..a00db36 100644
--- a/WebCore/editing/CompositeEditCommand.cpp
+++ b/WebCore/editing/CompositeEditCommand.cpp
@@ -77,6 +77,10 @@ CompositeEditCommand::CompositeEditCommand(Document *document)
 {
 }
 
+CompositeEditCommand::~CompositeEditCommand()
+{
+}
+
 void CompositeEditCommand::doUnapply()
 {
     size_t size = m_commands.size();
@@ -212,12 +216,12 @@ void CompositeEditCommand::removeNodePreservingChildren(PassRefPtr<Node> node)
 
 void CompositeEditCommand::removeNodeAndPruneAncestors(PassRefPtr<Node> node)
 {
-    RefPtr<Node> parent = node->parentNode();
+    RefPtr<ContainerNode> parent = node->parentNode();
     removeNode(node);
     prune(parent.release());
 }
 
-HTMLElement* CompositeEditCommand::replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node> node)
+HTMLElement* CompositeEditCommand::replaceElementWithSpanPreservingChildrenAndAttributes(PassRefPtr<HTMLElement> node)
 {
     // It would also be possible to implement all of ReplaceNodeWithSpanCommand
     // as a series of existing smaller edit commands.  Someone who wanted to
@@ -250,7 +254,7 @@ void CompositeEditCommand::prune(PassRefPtr<Node> node)
         if (renderer && (!renderer->canHaveChildren() || hasARenderedDescendant(node.get()) || node->rootEditableElement() == node))
             return;
             
-        RefPtr<Node> next = node->parentNode();
+        RefPtr<ContainerNode> next = node->parentNode();
         removeNode(node);
         node = next;
     }
@@ -859,7 +863,8 @@ void CompositeEditCommand::moveParagraphWithClones(const VisiblePosition& startO
     beforeParagraph = VisiblePosition(beforeParagraph.deepEquivalent());
     afterParagraph = VisiblePosition(afterParagraph.deepEquivalent());
 
-    if (beforeParagraph.isNotNull() && !isTableElement(beforeParagraph.deepEquivalent().node()) && (!isEndOfParagraph(beforeParagraph) || beforeParagraph == afterParagraph)) {
+    if (beforeParagraph.isNotNull() && !isTableElement(beforeParagraph.deepEquivalent().node())
+        && ((!isEndOfParagraph(beforeParagraph) && !isStartOfParagraph(beforeParagraph)) || beforeParagraph == afterParagraph)) {
         // FIXME: Trim text between beforeParagraph and afterParagraph if they aren't equal.
         insertNodeAt(createBreakElement(document()), beforeParagraph.deepEquivalent());
     }
@@ -1000,7 +1005,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
 
     RefPtr<CSSMutableStyleDeclaration> style = ApplyStyleCommand::editingStyleAtPosition(endingSelection().start(), IncludeTypingStyle);
 
-    Node* listNode = emptyListItem->parentNode();
+    ContainerNode* listNode = emptyListItem->parentNode();
     // FIXME: Can't we do something better when the immediate parent wasn't a list node?
     if (!listNode
         || (!listNode->hasTagName(ulTag) && !listNode->hasTagName(olTag))
@@ -1009,7 +1014,7 @@ bool CompositeEditCommand::breakOutOfEmptyListItem()
         return false;
 
     RefPtr<Element> newBlock = 0;
-    if (Node* blockEnclosingList = listNode->parentNode()) {
+    if (ContainerNode* blockEnclosingList = listNode->parentNode()) {
         if (blockEnclosingList->hasTagName(liTag)) { // listNode is inside another list item
             if (visiblePositionAfterNode(blockEnclosingList) == visiblePositionAfterNode(listNode)) {
                 // If listNode appears at the end of the outer list item, then move listNode outside of this list item
@@ -1100,7 +1105,7 @@ bool CompositeEditCommand::breakOutOfEmptyMailBlockquotedParagraph()
     } else {
         ASSERT(caretPos.deprecatedEditingOffset() == 0);
         Text* textNode = static_cast<Text*>(caretPos.node());
-        Node* parentNode = textNode->parentNode();
+        ContainerNode* parentNode = textNode->parentNode();
         // The preserved newline must be the first thing in the node, since otherwise the previous
         // paragraph would be quoted, and we verified that it wasn't above.
         deleteTextFromNode(textNode, 0, 1);
diff --git a/WebCore/editing/CompositeEditCommand.h b/WebCore/editing/CompositeEditCommand.h
index f839a72..b4c3b2d 100644
--- a/WebCore/editing/CompositeEditCommand.h
+++ b/WebCore/editing/CompositeEditCommand.h
@@ -39,10 +39,12 @@ class Text;
 
 class CompositeEditCommand : public EditCommand {
 public:
+    virtual ~CompositeEditCommand();
+
     bool isFirstCommand(EditCommand* command) { return !m_commands.isEmpty() && m_commands.first() == command; }
 
 protected:
-    CompositeEditCommand(Document*);
+    explicit CompositeEditCommand(Document*);
 
     //
     // sugary-sweet convenience functions to help create and apply edit commands in composite commands
@@ -73,7 +75,7 @@ protected:
     void removeNodeAttribute(PassRefPtr<Element>, const QualifiedName& attribute);
     void removeChildrenInRange(PassRefPtr<Node>, unsigned from, unsigned to);
     virtual void removeNode(PassRefPtr<Node>);
-    HTMLElement* replaceNodeWithSpanPreservingChildrenAndAttributes(PassRefPtr<Node>);
+    HTMLElement* replaceElementWithSpanPreservingChildrenAndAttributes(PassRefPtr<HTMLElement>);
     void removeNodePreservingChildren(PassRefPtr<Node>);
     void removeNodeAndPruneAncestors(PassRefPtr<Node>);
     void prune(PassRefPtr<Node>);
diff --git a/WebCore/editing/DeleteButtonController.cpp b/WebCore/editing/DeleteButtonController.cpp
index 8b23eaa..028edc8 100644
--- a/WebCore/editing/DeleteButtonController.cpp
+++ b/WebCore/editing/DeleteButtonController.cpp
@@ -121,7 +121,7 @@ static bool isDeletableElement(const Node* node)
             return true;
 
         // Allow blocks that have a different background from it's parent
-        Node* parentNode = node->parentNode();
+        ContainerNode* parentNode = node->parentNode();
         if (!parentNode)
             return false;
 
diff --git a/WebCore/editing/EditingAllInOne.cpp b/WebCore/editing/EditingAllInOne.cpp
index dda2501..ba484be 100644
--- a/WebCore/editing/EditingAllInOne.cpp
+++ b/WebCore/editing/EditingAllInOne.cpp
@@ -26,6 +26,7 @@
 // This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
 
 #include <AppendNodeCommand.cpp>
+#include <ApplyBlockElementCommand.cpp>
 #include <ApplyStyleCommand.cpp>
 #include <BreakBlockquoteCommand.cpp>
 #include <CompositeEditCommand.cpp>
@@ -47,6 +48,7 @@
 #include <InsertParagraphSeparatorCommand.cpp>
 #include <InsertTextCommand.cpp>
 #include <JoinTextNodesCommand.cpp>
+#include <MarkupAccumulator.cpp>
 #include <MergeIdenticalElementsCommand.cpp>
 #include <ModifySelectionListLevel.cpp>
 #include <MoveSelectionCommand.cpp>
diff --git a/WebCore/editing/Editor.cpp b/WebCore/editing/Editor.cpp
index b267637..7b3d055 100644
--- a/WebCore/editing/Editor.cpp
+++ b/WebCore/editing/Editor.cpp
@@ -95,10 +95,14 @@ VisibleSelection Editor::selectionForCommand(Event* event)
     Node* target = event->target()->toNode();
     Node* selectionStart = selection.start().node();
     if (target && (!selectionStart || target->shadowAncestorNode() != selectionStart->shadowAncestorNode())) {
+        RefPtr<Range> range;
         if (target->hasTagName(inputTag) && static_cast<HTMLInputElement*>(target)->isTextField())
-            return static_cast<HTMLInputElement*>(target)->selection();
-        if (target->hasTagName(textareaTag))
-            return static_cast<HTMLTextAreaElement*>(target)->selection();
+            range = static_cast<HTMLInputElement*>(target)->selection();
+        else if (target->hasTagName(textareaTag))
+            range = static_cast<HTMLTextAreaElement*>(target)->selection();
+
+        if (range)
+            return VisibleSelection(range.get());
     }
     return selection;
 }
@@ -643,7 +647,7 @@ bool Editor::hasBidiSelection() const
         return false;
 
     RenderStyle* style = renderer->style();
-    if (style->direction() == RTL)
+    if (!style->isLeftToRightDirection())
         return true;
 
     return toRenderBlock(renderer)->containsNonZeroBidiLevel();
@@ -2373,6 +2377,49 @@ void Editor::markMisspellingsAndBadGrammar(const VisibleSelection &movingSelecti
 void Editor::markMisspellingsAfterTypingToPosition(const VisiblePosition &p)
 {
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+#if !defined(BUILDING_ON_SNOW_LEOPARD)
+    // Apply pending autocorrection before next round of spell checking.
+    bool didApplyCorrection = false;
+    if (m_rangeToBeReplacedByCorrection) {
+        ExceptionCode ec = 0;
+        RefPtr<Range> paragraphRangeContainingCorrection = m_rangeToBeReplacedByCorrection->cloneRange(ec);
+        if (!ec) {
+            setStart(paragraphRangeContainingCorrection.get(), startOfParagraph(m_rangeToBeReplacedByCorrection->startPosition()));
+            setEnd(paragraphRangeContainingCorrection.get(), endOfParagraph(m_rangeToBeReplacedByCorrection->endPosition()));
+            // After we replace the word at range m_rangeToBeReplacedByCorrection, we need to add 
+            // autocorrection underline at that range. However, once the replacement took place, the
+            // value of m_rangeToBeReplacedByCorrection is not valid anymore. So before we carry out
+            // the replacement, we need to store the start position of m_rangeToBeReplacedByCorrection
+            // relative to the start position of the containing paragraph. We use correctionStartOffsetInParagraph
+            // to store this value. In order to obtain this offset, we need to first create a range
+            // which spans from the start of paragraph to the start position of m_rangeToBeReplacedByCorrection.
+            RefPtr<Range> correctionStartOffsetInParagraphAsRange = Range::create(paragraphRangeContainingCorrection->startContainer(ec)->document(), paragraphRangeContainingCorrection->startPosition(), paragraphRangeContainingCorrection->startPosition());
+            if (!ec) {
+                Position startPositionOfRangeToBeReplaced = m_rangeToBeReplacedByCorrection->startPosition();
+                correctionStartOffsetInParagraphAsRange->setEnd(startPositionOfRangeToBeReplaced.containerNode(), startPositionOfRangeToBeReplaced.computeOffsetInContainerNode(), ec);
+                if (!ec) {
+                    // Take note of the location of autocorrection so that we can add marker after the replacement took place.
+                    int correctionStartOffsetInParagraph = TextIterator::rangeLength(correctionStartOffsetInParagraphAsRange.get());
+                    Position caretPosition = m_frame->selection()->selection().end();
+                    RefPtr<Range> rangeToBeReplaced = m_rangeToBeReplacedByCorrection->cloneRange(ec);
+                    VisibleSelection selectionToReplace(rangeToBeReplaced.get(), DOWNSTREAM);
+                    if (m_frame->selection()->shouldChangeSelection(selectionToReplace)) {
+                        m_frame->selection()->setSelection(selectionToReplace);
+                        replaceSelectionWithText(m_correctionReplacementString, false, false);
+                        caretPosition.moveToOffset(caretPosition.offsetInContainerNode() + m_correctionReplacementString.length() - m_stringToBeReplacedByCorrection.length());
+                        RefPtr<Range> replacementRange = TextIterator::subrange(paragraphRangeContainingCorrection.get(), correctionStartOffsetInParagraph, m_correctionReplacementString.length());
+                        replacementRange->startContainer()->document()->markers()->addMarker(replacementRange.get(), DocumentMarker::Replacement, m_correctionReplacementString);
+                        replacementRange->startContainer()->document()->markers()->addMarker(replacementRange.get(), DocumentMarker::CorrectionIndicator);
+                        m_frame->selection()->moveTo(caretPosition, false);
+                        didApplyCorrection = true;
+                    }
+                }
+            }
+        }
+        m_rangeToBeReplacedByCorrection.clear();
+    }
+#endif
+
     TextCheckingOptions textCheckingOptions = 0;
     if (isContinuousSpellCheckingEnabled())
         textCheckingOptions |= MarkSpelling;
@@ -2723,6 +2770,7 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                             totalBoundingBox.unite(it->boundingBox());
                         m_rangeToBeReplacedByCorrection = rangeToReplace;
                         m_stringToBeReplacedByCorrection = replacedString;
+                        m_correctionReplacementString = result->replacement;
                         client()->showCorrectionPanel(totalBoundingBox, m_stringToBeReplacedByCorrection, result->replacement, this);
                         doReplacement = false;
                     }
@@ -2734,10 +2782,6 @@ void Editor::markAllMisspellingsAndBadGrammarInRanges(TextCheckingOptions textCh
                         if (resultLocation < selectionOffset)
                             selectionOffset += replacementLength - resultLength;
                         if (result->type == TextCheckingTypeCorrection) {
-#if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
-                            if (client())
-                                client()->dismissCorrectionPanel(true);
-#endif
                             // Add a marker so that corrections can easily be undone and won't be re-corrected.
                             RefPtr<Range> replacedRange = TextIterator::subrange(paragraphRange.get(), resultLocation, replacementLength);
                             replacedRange->startContainer()->document()->markers()->addMarker(replacedRange.get(), DocumentMarker::Replacement, replacedString);
@@ -2826,10 +2870,10 @@ void Editor::startCorrectionPanelTimer()
 {
 #if PLATFORM(MAC) && !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_SNOW_LEOPARD)
     static const double correctionPanelTimerInterval = 0.3;
-    if (client())
-        client()->dismissCorrectionPanel(true);
-    if (isAutomaticSpellingCorrectionEnabled())
+    if (isAutomaticSpellingCorrectionEnabled()) {
+        m_rangeToBeReplacedByCorrection.clear();
         m_correctionPanelTimer.startOneShot(correctionPanelTimerInterval);
+    }
 #endif
 }
 
@@ -3565,12 +3609,12 @@ void Editor::respondToChangedSelection(const VisibleSelection& oldSelection, boo
             }
         }
 
+#if !PLATFORM(MAC) || (PLATFORM(MAC) && (defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD) || defined(BUILDING_ON_SNOW_LEOPARD)))
         // This only erases markers that are in the first unit (word or sentence) of the selection.
-        // Perhaps peculiar, but it matches AppKit.
-        if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange()) {
+        // Perhaps peculiar, but it matches AppKit on these Mac OSX versions.
+        if (RefPtr<Range> wordRange = newAdjacentWords.toNormalizedRange())
             m_frame->document()->markers()->removeMarkers(wordRange.get(), DocumentMarker::Spelling);
-            m_frame->document()->markers()->removeMarkers(wordRange.get(), DocumentMarker::Replacement);
-        }
+#endif
         if (RefPtr<Range> sentenceRange = newSelectedSentence.toNormalizedRange())
             m_frame->document()->markers()->removeMarkers(sentenceRange.get(), DocumentMarker::Grammar);
     }
diff --git a/WebCore/editing/Editor.h b/WebCore/editing/Editor.h
index f167b16..df2e947 100644
--- a/WebCore/editing/Editor.h
+++ b/WebCore/editing/Editor.h
@@ -378,6 +378,7 @@ private:
     OwnPtr<KillRing> m_killRing;
     RefPtr<Range> m_rangeToBeReplacedByCorrection;
     String m_stringToBeReplacedByCorrection;
+    String m_correctionReplacementString;
     Timer<Editor> m_correctionPanelTimer;
     VisibleSelection m_mark;
     bool m_areMarkedTextMatchesHighlighted;
diff --git a/WebCore/editing/EditorCommand.cpp b/WebCore/editing/EditorCommand.cpp
index 616c07b..23fba39 100644
--- a/WebCore/editing/EditorCommand.cpp
+++ b/WebCore/editing/EditorCommand.cpp
@@ -432,10 +432,16 @@ static bool executeFormatBlock(Frame* frame, Event*, EditorCommandSource, const
     String tagName = value.lower();
     if (tagName[0] == '<' && tagName[tagName.length() - 1] == '>')
         tagName = tagName.substring(1, tagName.length() - 2);
-    if (!validBlockTag(tagName))
+
+    ExceptionCode ec;
+    String localName, prefix;
+    if (!Document::parseQualifiedName(tagName, prefix, localName, ec))
         return false;
-    applyCommand(FormatBlockCommand::create(frame->document(), tagName));
-    return true;
+    QualifiedName qualifiedTagName(prefix, localName, xhtmlNamespaceURI);
+
+    RefPtr<FormatBlockCommand> command = FormatBlockCommand::create(frame->document(), qualifiedTagName);
+    applyCommand(command);
+    return command->didApply();
 }
 
 static bool executeForwardDelete(Frame* frame, Event*, EditorCommandSource source, const String&)
@@ -1304,6 +1310,11 @@ static TriState stateJustifyCenter(Frame* frame, Event*)
     return stateStyle(frame, CSSPropertyTextAlign, "center");
 }
 
+static TriState stateJustifyFull(Frame* frame, Event*)
+{
+    return stateStyle(frame, CSSPropertyTextAlign, "justify");
+}
+
 static TriState stateJustifyLeft(Frame* frame, Event*)
 {
     return stateStyle(frame, CSSPropertyTextAlign, "left");
@@ -1346,6 +1357,17 @@ static String valueForeColor(Frame* frame, Event*)
     return valueStyle(frame, CSSPropertyColor);
 }
 
+static String valueFormatBlock(Frame* frame, Event*)
+{
+    const VisibleSelection& selection = frame->selection()->selection();
+    if (!selection.isNonOrphanedCaretOrRange() || !selection.isContentEditable())
+        return "";
+    Element* formatBlockElement = FormatBlockCommand::elementForFormatBlockCommand(selection.firstRange().get());
+    if (!formatBlockElement)
+        return "";
+    return formatBlockElement->localName();
+}
+
 // Map of functions
 
 struct CommandEntry {
@@ -1382,7 +1404,7 @@ static const CommandMap& createCommandMap()
         { "FontSize", { executeFontSize, supported, enabledInEditableText, stateNone, valueFontSize, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "FontSizeDelta", { executeFontSizeDelta, supported, enabledInEditableText, stateNone, valueFontSizeDelta, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "ForeColor", { executeForeColor, supported, enabledInRichlyEditableText, stateNone, valueForeColor, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "FormatBlock", { executeFormatBlock, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "FormatBlock", { executeFormatBlock, supported, enabledInRichlyEditableText, stateNone, valueFormatBlock, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "ForwardDelete", { executeForwardDelete, supported, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "HiliteColor", { executeBackColor, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "IgnoreSpelling", { executeIgnoreSpelling, supportedFromMenuOrKeyBinding, enabledInEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
@@ -1401,7 +1423,7 @@ static const CommandMap& createCommandMap()
         { "InsertUnorderedList", { executeInsertUnorderedList, supported, enabledInRichlyEditableText, stateUnorderedList, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "Italic", { executeToggleItalic, supported, enabledInRichlyEditableText, stateItalic, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "JustifyCenter", { executeJustifyCenter, supported, enabledInRichlyEditableText, stateJustifyCenter, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
-        { "JustifyFull", { executeJustifyFull, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
+        { "JustifyFull", { executeJustifyFull, supported, enabledInRichlyEditableText, stateJustifyFull, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "JustifyLeft", { executeJustifyLeft, supported, enabledInRichlyEditableText, stateJustifyLeft, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "JustifyNone", { executeJustifyLeft, supported, enabledInRichlyEditableText, stateNone, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
         { "JustifyRight", { executeJustifyRight, supported, enabledInRichlyEditableText, stateJustifyRight, valueNull, notTextInsertion, doNotAllowExecutionWhenDisabled } },
diff --git a/WebCore/editing/FormatBlockCommand.cpp b/WebCore/editing/FormatBlockCommand.cpp
index 6bb8ad5..2e42fb3 100644
--- a/WebCore/editing/FormatBlockCommand.cpp
+++ b/WebCore/editing/FormatBlockCommand.cpp
@@ -30,101 +30,126 @@
 #include "htmlediting.h"
 #include "HTMLElement.h"
 #include "HTMLNames.h"
+#include "Range.h"
 #include "visible_units.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
 
-FormatBlockCommand::FormatBlockCommand(Document* document, const AtomicString& tagName) 
-    : CompositeEditCommand(document), m_tagName(tagName)
+static Node* enclosingBlockToSplitTreeTo(Node* startNode);
+static bool isElementForFormatBlock(const QualifiedName& tagName);
+static inline bool isElementForFormatBlock(Node* node)
 {
+    return node->isElementNode() && isElementForFormatBlock(static_cast<Element*>(node)->tagQName());
 }
 
-void FormatBlockCommand::doApply()
+FormatBlockCommand::FormatBlockCommand(Document* document, const QualifiedName& tagName) 
+    : ApplyBlockElementCommand(document, tagName)
+    , m_didApply(false)
 {
-    if (!endingSelection().isNonOrphanedCaretOrRange())
-        return;
-    
-    if (!endingSelection().rootEditableElement())
+}
+
+void FormatBlockCommand::formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
+{
+    if (!isElementForFormatBlock(tagName()))
         return;
+    ApplyBlockElementCommand::formatSelection(startOfSelection, endOfSelection);
+    m_didApply = true;
+}
 
-    VisiblePosition visibleEnd = endingSelection().visibleEnd();
-    VisiblePosition visibleStart = endingSelection().visibleStart();
-    // When a selection ends at the start of a paragraph, we rarely paint 
-    // the selection gap before that paragraph, because there often is no gap.  
-    // In a case like this, it's not obvious to the user that the selection 
-    // ends "inside" that paragraph, so it would be confusing if FormatBlock
-    // operated on that paragraph.
-    // FIXME: We paint the gap before some paragraphs that are indented with left 
-    // margin/padding, but not others.  We should make the gap painting more consistent and 
-    // then use a left margin/padding rule here.
-    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd)) {
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
-        visibleEnd = endingSelection().visibleEnd();
-    }
+void FormatBlockCommand::formatRange(const Position& start, const Position& end, RefPtr<Element>& blockNode)
+{
+    Node* nodeToSplitTo = enclosingBlockToSplitTreeTo(start.node());
+    RefPtr<Node> outerBlock = (start.node() == nodeToSplitTo) ? start.node() : splitTreeToNode(start.node(), nodeToSplitTo);
+    RefPtr<Node> nodeAfterInsertionPosition = outerBlock;
 
-    VisiblePosition startOfLastParagraph = startOfParagraph(visibleEnd);
-    if (endingSelection().isCaret() || startOfParagraph(visibleStart) == startOfLastParagraph) {
-        doApplyForSingleParagraph();
-        return;
+    Element* refNode = enclosingBlockFlowElement(end);
+    Element* root = editableRootForPosition(start);
+    if (isElementForFormatBlock(refNode->tagQName()) && start == startOfBlock(start) && end == endOfBlock(end)
+        && refNode != root && !root->isDescendantOf(refNode)) {
+        // Already in a block element that only contains the current paragraph
+        if (refNode->hasTagName(tagName()))
+            return;
+        nodeAfterInsertionPosition = refNode;
     }
 
-    setEndingSelection(visibleStart);
-    doApplyForSingleParagraph();
-    visibleStart = endingSelection().visibleStart();
-    VisiblePosition nextParagraph = endOfParagraph(visibleStart).next();
-    while (nextParagraph.isNotNull() && nextParagraph != startOfLastParagraph) {
-        setEndingSelection(nextParagraph);
-        doApplyForSingleParagraph();
-        nextParagraph = endOfParagraph(endingSelection().visibleStart()).next();
+    if (!blockNode) {
+        // Create a new blockquote and insert it as a child of the root editable element. We accomplish
+        // this by splitting all parents of the current paragraph up to that point.
+        blockNode = createBlockElement();
+        insertNodeBefore(blockNode, nodeAfterInsertionPosition);
     }
-    setEndingSelection(visibleEnd);
-    doApplyForSingleParagraph();
-    visibleEnd = endingSelection().visibleEnd();
 
-    setEndingSelection(VisibleSelection(visibleStart.deepEquivalent(), visibleEnd.deepEquivalent(), DOWNSTREAM));
-}
+    Position lastParagraphInBlockNode = lastPositionInNode(blockNode.get());
+    bool wasEndOfParagraph = isEndOfParagraph(lastParagraphInBlockNode);
+
+    moveParagraphWithClones(start, end, blockNode.get(), outerBlock.get());
 
-void FormatBlockCommand::doApplyForSingleParagraph()
+    if (wasEndOfParagraph && !isEndOfParagraph(lastParagraphInBlockNode) && !isStartOfParagraph(lastParagraphInBlockNode))
+        insertBlockPlaceholder(lastParagraphInBlockNode);
+}
+    
+Element* FormatBlockCommand::elementForFormatBlockCommand(Range* range)
 {
+    if (!range)
+        return 0;
+
     ExceptionCode ec;
-    String localName, prefix;
-    if (!Document::parseQualifiedName(m_tagName, prefix, localName, ec))
-        return;
-    QualifiedName qTypeOfBlock(prefix, localName, xhtmlNamespaceURI);
+    Node* commonAncestor = range->commonAncestorContainer(ec);
+    while (commonAncestor && !isElementForFormatBlock(commonAncestor))
+        commonAncestor = commonAncestor->parentNode();
 
-    Node* refNode = enclosingBlockFlowElement(endingSelection().visibleStart());
-    if (refNode->hasTagName(qTypeOfBlock))
-        // We're already in a block with the format we want, so we don't have to do anything
-        return;
+    if (!commonAncestor)
+        return 0;
 
-    VisiblePosition paragraphStart = startOfParagraph(endingSelection().visibleStart());
-    VisiblePosition paragraphEnd = endOfParagraph(endingSelection().visibleStart());
-    VisiblePosition blockStart = startOfBlock(endingSelection().visibleStart());
-    VisiblePosition blockEnd = endOfBlock(endingSelection().visibleStart());
-    RefPtr<Element> blockNode = createHTMLElement(document(), m_tagName);
-    RefPtr<Element> placeholder = createBreakElement(document());
-
-    Node* root = endingSelection().start().node()->rootEditableElement();
-    if (validBlockTag(refNode->nodeName().lower()) && 
-        paragraphStart == blockStart && paragraphEnd == blockEnd && 
-        refNode != root && !root->isDescendantOf(refNode))
-        // Already in a valid block tag that only contains the current paragraph, so we can swap with the new tag
-        insertNodeBefore(blockNode, refNode);
-    else {
-        // Avoid inserting inside inline elements that surround paragraphStart with upstream().
-        // This is only to avoid creating bloated markup.
-        insertNodeAt(blockNode, paragraphStart.deepEquivalent().upstream());
+    ASSERT(commonAncestor->isElementNode());
+    return static_cast<Element*>(commonAncestor);
+}
+
+bool isElementForFormatBlock(const QualifiedName& tagName)
+{
+    DEFINE_STATIC_LOCAL(HashSet<QualifiedName>, blockTags, ());
+    if (blockTags.isEmpty()) {
+        blockTags.add(addressTag);
+        blockTags.add(articleTag);
+        blockTags.add(asideTag);
+        blockTags.add(blockquoteTag);
+        blockTags.add(ddTag);
+        blockTags.add(divTag);
+        blockTags.add(dlTag);
+        blockTags.add(dtTag);
+        blockTags.add(footerTag);
+        blockTags.add(h1Tag);
+        blockTags.add(h2Tag);
+        blockTags.add(h3Tag);
+        blockTags.add(h4Tag);
+        blockTags.add(h5Tag);
+        blockTags.add(h6Tag);
+        blockTags.add(headerTag);
+        blockTags.add(hgroupTag);
+        blockTags.add(navTag);
+        blockTags.add(pTag);
+        blockTags.add(preTag);
+        blockTags.add(sectionTag);
     }
-    appendNode(placeholder, blockNode);
+    return blockTags.contains(tagName);
+}
 
-    VisiblePosition destination(Position(placeholder.get(), 0));
-    if (paragraphStart == paragraphEnd && !lineBreakExistsAtVisiblePosition(paragraphStart)) {
-        setEndingSelection(destination);
-        return;
+Node* enclosingBlockToSplitTreeTo(Node* startNode)
+{
+    Node* lastBlock = startNode;
+    for (Node* n = startNode; n; n = n->parentNode()) {
+        if (!n->isContentEditable())
+            return lastBlock;
+        if (isTableCell(n) || n->hasTagName(bodyTag) || !n->parentNode() || !n->parentNode()->isContentEditable() || isElementForFormatBlock(n))
+            return n;
+        if (isBlock(n))
+            lastBlock = n;
+        if (isListElement(n))
+            return n->parentNode()->isContentEditable() ? n->parentNode() : n;
     }
-    moveParagraph(paragraphStart, paragraphEnd, destination, true, false);
+    return lastBlock;
 }
 
 }
diff --git a/WebCore/editing/FormatBlockCommand.h b/WebCore/editing/FormatBlockCommand.h
index 70e6fa6..134a422 100644
--- a/WebCore/editing/FormatBlockCommand.h
+++ b/WebCore/editing/FormatBlockCommand.h
@@ -26,25 +26,29 @@
 #ifndef FormatBlockCommand_h
 #define FormatBlockCommand_h
 
+#include "ApplyBlockElementCommand.h"
 #include "CompositeEditCommand.h"
 
 namespace WebCore {
 
-class FormatBlockCommand : public CompositeEditCommand {
+class FormatBlockCommand : public ApplyBlockElementCommand {
 public:
-    static PassRefPtr<FormatBlockCommand> create(Document* document, const AtomicString& tagName)
+    static PassRefPtr<FormatBlockCommand> create(Document* document, const QualifiedName& tagName)
     {
         return adoptRef(new FormatBlockCommand(document, tagName));
     }
 
+    static Element* elementForFormatBlockCommand(Range*);
+    bool didApply() const { return m_didApply; }
+
 private:
-    FormatBlockCommand(Document*, const AtomicString& tagName);
+    FormatBlockCommand(Document*, const QualifiedName& tagName);
 
-    virtual void doApply();
-    void doApplyForSingleParagraph();
-    virtual EditAction editingAction() const { return EditActionFormatBlock; }
+    void formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection);
+    void formatRange(const Position&, const Position&, RefPtr<Element>&);
+    EditAction editingAction() const { return EditActionFormatBlock; }
 
-    AtomicString m_tagName;
+    bool m_didApply;
 };
 
 } // namespace WebCore
diff --git a/WebCore/editing/IndentOutdentCommand.cpp b/WebCore/editing/IndentOutdentCommand.cpp
index d4ffe7f..9642afa 100644
--- a/WebCore/editing/IndentOutdentCommand.cpp
+++ b/WebCore/editing/IndentOutdentCommand.cpp
@@ -44,50 +44,22 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-static String indentBlockquoteString()
-{
-    DEFINE_STATIC_LOCAL(String, string, ("webkit-indent-blockquote"));
-    return string;
-}
-
-static PassRefPtr<HTMLBlockquoteElement> createIndentBlockquoteElement(Document* document)
-{
-    RefPtr<HTMLBlockquoteElement> element = HTMLBlockquoteElement::create(document);
-    element->setAttribute(classAttr, indentBlockquoteString());
-    element->setAttribute(styleAttr, "margin: 0 0 0 40px; border: none; padding: 0px;");
-    return element.release();
-}
-
 static bool isListOrIndentBlockquote(const Node* node)
 {
     return node && (node->hasTagName(ulTag) || node->hasTagName(olTag) || node->hasTagName(blockquoteTag));
 }
 
-// This function can return -1 if we are unable to count the paragraphs between |start| and |end|.
-static int countParagraphs(const VisiblePosition& endOfFirstParagraph, const VisiblePosition& endOfLastParagraph)
-{
-    int count = 0;
-    VisiblePosition cur = endOfFirstParagraph;
-    while (cur != endOfLastParagraph) {
-        ++count;
-        cur = endOfParagraph(cur.next());
-        // If start is before a table and end is inside a table, we will never hit end because the
-        // whole table is considered a single paragraph.
-        if (cur.isNull())
-            return -1;
-    }
-    return count;
-}
-
 IndentOutdentCommand::IndentOutdentCommand(Document* document, EIndentType typeOfAction, int marginInPixels)
-    : CompositeEditCommand(document), m_typeOfAction(typeOfAction), m_marginInPixels(marginInPixels)
+    : ApplyBlockElementCommand(document, blockquoteTag, "webkit-indent-blockquote", "margin: 0 0 0 40px; border: none; padding: 0px;")
+    , m_typeOfAction(typeOfAction)
+    , m_marginInPixels(marginInPixels)
 {
 }
 
-bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCurrentParagraph)
+bool IndentOutdentCommand::tryIndentingAsListItem(const Position& start, const Position& end)
 {
     // If our selection is not inside a list, bail out.
-    Node* lastNodeInSelectedParagraph = endOfCurrentParagraph.deepEquivalent().node();
+    Node* lastNodeInSelectedParagraph = start.node();
     RefPtr<Element> listNode = enclosingList(lastNodeInSelectedParagraph);
     if (!listNode)
         return false;
@@ -106,7 +78,7 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
     RefPtr<Element> newList = document()->createElement(listNode->tagQName(), false);
     insertNodeBefore(newList, selectedListItem);
 
-    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, newList.get(), selectedListItem);
+    moveParagraphWithClones(start, end, newList.get(), selectedListItem);
 
     if (canMergeLists(previousList, newList.get()))
         mergeIdenticalElements(previousList, newList);
@@ -115,13 +87,10 @@ bool IndentOutdentCommand::tryIndentingAsListItem(const VisiblePosition& endOfCu
 
     return true;
 }
-    
-void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurrentParagraph, const VisiblePosition& endOfNextParagraph, RefPtr<Element>& targetBlockquote)
-{
-    Node* enclosingCell = 0;
 
-    Position start = startOfParagraph(endOfCurrentParagraph).deepEquivalent();
-    enclosingCell = enclosingNodeOfType(start, &isTableCell);
+void IndentOutdentCommand::indentIntoBlockquote(const Position& start, const Position& end, RefPtr<Element>& targetBlockquote)
+{
+    Node* enclosingCell = enclosingNodeOfType(start, &isTableCell);
     Node* nodeToSplitTo;
     if (enclosingCell)
         nodeToSplitTo = enclosingCell;
@@ -135,97 +104,11 @@ void IndentOutdentCommand::indentIntoBlockquote(const VisiblePosition& endOfCurr
     if (!targetBlockquote) {
         // Create a new blockquote and insert it as a child of the root editable element. We accomplish
         // this by splitting all parents of the current paragraph up to that point.
-        targetBlockquote = createIndentBlockquoteElement(document());
+        targetBlockquote = createBlockElement();
         insertNodeBefore(targetBlockquote, outerBlock);
     }
 
-    moveParagraphWithClones(startOfParagraph(endOfCurrentParagraph), endOfCurrentParagraph, targetBlockquote.get(), outerBlock.get());
-    
-    // Don't put the next paragraph in the blockquote we just created for this paragraph unless 
-    // the next paragraph is in the same cell.
-    if (enclosingCell && enclosingCell != enclosingNodeOfType(endOfNextParagraph.deepEquivalent(), &isTableCell))
-        targetBlockquote = 0;
-}
-
-void IndentOutdentCommand::indentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
-{
-    // Special case empty unsplittable elements because there's nothing to split
-    // and there's nothing to move.
-    Position start = startOfSelection.deepEquivalent().downstream();
-    if (isAtUnsplittableElement(start)) {
-        RefPtr<Element> blockquote = createIndentBlockquoteElement(document());
-        insertNodeAt(blockquote, start);
-        RefPtr<Element> placeholder = createBreakElement(document());
-        appendNode(placeholder, blockquote);
-        setEndingSelection(VisibleSelection(Position(placeholder.get(), 0), DOWNSTREAM));
-        return;
-    }
-
-    RefPtr<Element> blockquoteForNextIndent;
-    VisiblePosition endOfCurrentParagraph = endOfParagraph(startOfSelection);
-    VisiblePosition endAfterSelection = endOfParagraph(endOfParagraph(endOfSelection).next());
-    int endOfCurrentParagraphIndex = indexForVisiblePosition(endOfCurrentParagraph);
-    int endAfterSelectionIndex = indexForVisiblePosition(endAfterSelection);
-
-    // When indenting within a <pre> tag, we need to split each paragraph into a separate node for moveParagraphWithClones to work.
-    // However, splitting text nodes can cause endOfCurrentParagraph and endAfterSelection to point to an invalid position if we
-    // changed the text node it was pointing at.  So we have to reset these positions.
-    int numParagraphs = countParagraphs(endOfCurrentParagraph, endAfterSelection);
-    if (splitTextNodes(startOfParagraph(startOfSelection), numParagraphs + 1)) {
-        RefPtr<Range> endOfCurrentParagraphRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endOfCurrentParagraphIndex, 0, true);
-        RefPtr<Range> endAfterSelectionRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endAfterSelectionIndex, 0, true);
-        if (!endOfCurrentParagraphRange.get() || !endAfterSelectionRange.get()) {
-            ASSERT_NOT_REACHED();
-            return;
-        }
-        endOfCurrentParagraph = VisiblePosition(endOfCurrentParagraphRange->startPosition(), DOWNSTREAM);
-        endAfterSelection = VisiblePosition(endAfterSelectionRange->startPosition(), DOWNSTREAM);
-    }
-
-    while (endOfCurrentParagraph != endAfterSelection) {
-        // Iterate across the selected paragraphs...
-        VisiblePosition endOfNextParagraph = endOfParagraph(endOfCurrentParagraph.next());
-        if (tryIndentingAsListItem(endOfCurrentParagraph))
-            blockquoteForNextIndent = 0;
-        else
-            indentIntoBlockquote(endOfCurrentParagraph, endOfNextParagraph, blockquoteForNextIndent);
-
-        // indentIntoBlockquote could move more than one paragraph if the paragraph
-        // is in a list item or a table. As a result, endAfterSelection could refer to a position
-        // no longer in the document.
-        if (endAfterSelection.isNotNull() && !endAfterSelection.deepEquivalent().node()->inDocument())
-            break;
-        // Sanity check: Make sure our moveParagraph calls didn't remove endOfNextParagraph.deepEquivalent().node()
-        // If somehow we did, return to prevent crashes.
-        if (endOfNextParagraph.isNotNull() && !endOfNextParagraph.deepEquivalent().node()->inDocument()) {
-            ASSERT_NOT_REACHED();
-            return;
-        }
-        endOfCurrentParagraph = endOfNextParagraph;
-    }   
-}
-
-// Returns true if at least one text node was split.
-bool IndentOutdentCommand::splitTextNodes(const VisiblePosition& start, int numParagraphs)
-{
-    VisiblePosition currentParagraphStart = start;
-    bool hasSplit = false;
-    int paragraphCount;
-    for (paragraphCount = 0; paragraphCount < numParagraphs; ++paragraphCount) {
-        // If there are multiple paragraphs in a single text node, we split the text node into a separate node for each paragraph.
-        if (currentParagraphStart.deepEquivalent().node()->isTextNode() && currentParagraphStart.deepEquivalent().node() == startOfParagraph(currentParagraphStart.previous()).deepEquivalent().node()) {
-            Text* textNode = static_cast<Text *>(currentParagraphStart.deepEquivalent().node());
-            int offset = currentParagraphStart.deepEquivalent().offsetInContainerNode();
-            splitTextNode(textNode, offset);
-            currentParagraphStart = VisiblePosition(textNode, 0, VP_DEFAULT_AFFINITY);
-            hasSplit = true;
-        }
-        VisiblePosition nextParagraph = startOfParagraph(endOfParagraph(currentParagraphStart).next());
-        if (nextParagraph.isNull())
-            break;
-        currentParagraphStart = nextParagraph;
-    }
-    return hasSplit;
+    moveParagraphWithClones(start, end, targetBlockquote.get(), outerBlock.get());
 }
 
 void IndentOutdentCommand::outdentParagraph()
@@ -260,7 +143,7 @@ void IndentOutdentCommand::outdentParagraph()
         // outdentRegion() assumes it is operating on the first paragraph of an enclosing blockquote, but if there are multiply nested blockquotes and we've
         // just removed one, then this assumption isn't true. By splitting the next containing blockquote after this node, we keep this assumption true
         if (splitPoint) {
-            if (Node* splitPointParent = splitPoint->parentNode()) {
+            if (ContainerNode* splitPointParent = splitPoint->parentNode()) {
                 if (splitPointParent->hasTagName(blockquoteTag)
                     && !splitPoint->hasTagName(blockquoteTag)
                     && splitPointParent->parentNode()->isContentEditable()) // We can't outdent if there is no place to go!
@@ -291,6 +174,7 @@ void IndentOutdentCommand::outdentParagraph()
     moveParagraph(startOfParagraph(visibleStartOfParagraph), endOfParagraph(visibleEndOfParagraph), VisiblePosition(Position(placeholder.get(), 0)), true);
 }
 
+// FIXME: We should merge this function with ApplyBlockElementCommand::formatSelection
 void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
     VisiblePosition endOfLastParagraph = endOfParagraph(endOfSelection);
@@ -327,48 +211,20 @@ void IndentOutdentCommand::outdentRegion(const VisiblePosition& startOfSelection
     }
 }
 
-void IndentOutdentCommand::doApply()
+void IndentOutdentCommand::formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection)
 {
-    if (!endingSelection().isNonOrphanedCaretOrRange())
-        return;
-
-    if (!endingSelection().rootEditableElement())
-        return;
-        
-    VisiblePosition visibleEnd = endingSelection().visibleEnd();
-    VisiblePosition visibleStart = endingSelection().visibleStart();
-    // When a selection ends at the start of a paragraph, we rarely paint 
-    // the selection gap before that paragraph, because there often is no gap.  
-    // In a case like this, it's not obvious to the user that the selection 
-    // ends "inside" that paragraph, so it would be confusing if Indent/Outdent 
-    // operated on that paragraph.
-    // FIXME: We paint the gap before some paragraphs that are indented with left 
-    // margin/padding, but not others.  We should make the gap painting more consistent and 
-    // then use a left margin/padding rule here.
-    if (visibleEnd != visibleStart && isStartOfParagraph(visibleEnd))
-        setEndingSelection(VisibleSelection(visibleStart, visibleEnd.previous(true)));
-
-    VisibleSelection selection = selectionForParagraphIteration(endingSelection());
-    VisiblePosition startOfSelection = selection.visibleStart();
-    VisiblePosition endOfSelection = selection.visibleEnd();
-    
-    int startIndex = indexForVisiblePosition(startOfSelection);
-    int endIndex = indexForVisiblePosition(endOfSelection);
-    
-    ASSERT(!startOfSelection.isNull());
-    ASSERT(!endOfSelection.isNull());
-    
     if (m_typeOfAction == Indent)
-        indentRegion(startOfSelection, endOfSelection);
+        ApplyBlockElementCommand::formatSelection(startOfSelection, endOfSelection);
     else
         outdentRegion(startOfSelection, endOfSelection);
+}
 
-    updateLayout();
-    
-    RefPtr<Range> startRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), startIndex, 0, true);
-    RefPtr<Range> endRange = TextIterator::rangeFromLocationAndLength(document()->documentElement(), endIndex, 0, true);
-    if (startRange && endRange)
-        setEndingSelection(VisibleSelection(startRange->startPosition(), endRange->startPosition(), DOWNSTREAM));
+void IndentOutdentCommand::formatRange(const Position& start, const Position& end, RefPtr<Element>& blockquoteForNextIndent)
+{
+    if (tryIndentingAsListItem(start, end))
+        blockquoteForNextIndent = 0;
+    else
+        indentIntoBlockquote(start, end, blockquoteForNextIndent);
 }
 
 }
diff --git a/WebCore/editing/IndentOutdentCommand.h b/WebCore/editing/IndentOutdentCommand.h
index 8644cc5..201e794 100644
--- a/WebCore/editing/IndentOutdentCommand.h
+++ b/WebCore/editing/IndentOutdentCommand.h
@@ -26,32 +26,34 @@
 #ifndef IndentOutdentCommand_h
 #define IndentOutdentCommand_h
 
+#include "ApplyBlockElementCommand.h"
 #include "CompositeEditCommand.h"
 
 namespace WebCore {
 
-class IndentOutdentCommand : public CompositeEditCommand {
+class IndentOutdentCommand : public ApplyBlockElementCommand {
 public:
     enum EIndentType { Indent, Outdent };
     static PassRefPtr<IndentOutdentCommand> create(Document* document, EIndentType type, int marginInPixels = 0)
     {
         return adoptRef(new IndentOutdentCommand(document, type, marginInPixels));
     }
-    
+
     virtual bool preservesTypingStyle() const { return true; }
 
 private:
     IndentOutdentCommand(Document*, EIndentType, int marginInPixels);
 
-    virtual void doApply();
     virtual EditAction editingAction() const { return m_typeOfAction == Indent ? EditActionIndent : EditActionOutdent; }
 
     void indentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentRegion(const VisiblePosition&, const VisiblePosition&);
     void outdentParagraph();
-    bool tryIndentingAsListItem(const VisiblePosition&);
-    void indentIntoBlockquote(const VisiblePosition&, const VisiblePosition&, RefPtr<Element>&);
-    bool splitTextNodes(const VisiblePosition& start, int numParagraphs);
+    bool tryIndentingAsListItem(const Position&, const Position&);
+    void indentIntoBlockquote(const Position&, const Position&, RefPtr<Element>&);
+
+    void formatSelection(const VisiblePosition& startOfSelection, const VisiblePosition& endOfSelection);
+    void formatRange(const Position&, const Position&, RefPtr<Element>& blockquoteForNextIndent);
 
     EIndentType m_typeOfAction;
     int m_marginInPixels;
diff --git a/WebCore/editing/InsertNodeBeforeCommand.cpp b/WebCore/editing/InsertNodeBeforeCommand.cpp
index fb72312..5fae45e 100644
--- a/WebCore/editing/InsertNodeBeforeCommand.cpp
+++ b/WebCore/editing/InsertNodeBeforeCommand.cpp
@@ -46,7 +46,7 @@ InsertNodeBeforeCommand::InsertNodeBeforeCommand(PassRefPtr<Node> insertChild, P
 
 void InsertNodeBeforeCommand::doApply()
 {
-    Node* parent = m_refChild->parentNode();
+    ContainerNode* parent = m_refChild->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
 
diff --git a/WebCore/editing/JoinTextNodesCommand.cpp b/WebCore/editing/JoinTextNodesCommand.cpp
index fa0987d..2766b84 100644
--- a/WebCore/editing/JoinTextNodesCommand.cpp
+++ b/WebCore/editing/JoinTextNodesCommand.cpp
@@ -45,7 +45,7 @@ void JoinTextNodesCommand::doApply()
     if (m_text1->nextSibling() != m_text2)
         return;
 
-    Node* parent = m_text2->parentNode();
+    ContainerNode* parent = m_text2->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
     
@@ -62,7 +62,7 @@ void JoinTextNodesCommand::doUnapply()
     if (m_text1->parentNode())
         return;
 
-    Node* parent = m_text2->parentNode();
+    ContainerNode* parent = m_text2->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
 
diff --git a/WebCore/editing/MarkupAccumulator.cpp b/WebCore/editing/MarkupAccumulator.cpp
new file mode 100644
index 0000000..a701189
--- /dev/null
+++ b/WebCore/editing/MarkupAccumulator.cpp
@@ -0,0 +1,465 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "MarkupAccumulator.h"
+
+#include "CDATASection.h"
+#include "CharacterNames.h"
+#include "Comment.h"
+#include "DocumentFragment.h"
+#include "DocumentType.h"
+#include "Editor.h"
+#include "HTMLElement.h"
+#include "HTMLNames.h"
+#include "KURL.h"
+#include "ProcessingInstruction.h"
+#include "XMLNSNames.h"
+
+namespace WebCore {
+
+using namespace HTMLNames;
+
+void appendCharactersReplacingEntities(Vector<UChar>& out, const UChar* content, size_t length, EntityMask entityMask)
+{
+    DEFINE_STATIC_LOCAL(const String, ampReference, ("&amp;"));
+    DEFINE_STATIC_LOCAL(const String, ltReference, ("&lt;"));
+    DEFINE_STATIC_LOCAL(const String, gtReference, ("&gt;"));
+    DEFINE_STATIC_LOCAL(const String, quotReference, ("&quot;"));
+    DEFINE_STATIC_LOCAL(const String, nbspReference, ("&nbsp;"));
+
+    static const EntityDescription entityMaps[] = {
+        { '&', ampReference, EntityAmp },
+        { '<', ltReference, EntityLt },
+        { '>', gtReference, EntityGt },
+        { '"', quotReference, EntityQuot },
+        { noBreakSpace, nbspReference, EntityNbsp },
+    };
+
+    size_t positionAfterLastEntity = 0;
+    for (size_t i = 0; i < length; i++) {
+        for (size_t m = 0; m < sizeof(entityMaps) / sizeof(EntityDescription); m++) {
+            if (content[i] == entityMaps[m].entity && entityMaps[m].mask & entityMask) {
+                out.append(content + positionAfterLastEntity, i - positionAfterLastEntity);
+                append(out, entityMaps[m].reference);
+                positionAfterLastEntity = i + 1;
+                break;
+            }
+        }
+    }
+    out.append(content + positionAfterLastEntity, length - positionAfterLastEntity);
+}
+
+MarkupAccumulator::MarkupAccumulator(Vector<Node*>* nodes, EAbsoluteURLs shouldResolveURLs, const Range* range)
+    : m_nodes(nodes)
+    , m_range(range)
+    , m_shouldResolveURLs(shouldResolveURLs)
+{
+}
+
+MarkupAccumulator::~MarkupAccumulator()
+{
+}
+
+String MarkupAccumulator::serializeNodes(Node* node, Node* nodeToSkip, EChildrenOnly childrenOnly)
+{
+    Vector<UChar> out;
+    serializeNodesWithNamespaces(node, nodeToSkip, childrenOnly, 0);
+    out.reserveInitialCapacity(length());
+    concatenateMarkup(out);
+    return String::adopt(out);
+}
+
+void MarkupAccumulator::serializeNodesWithNamespaces(Node* node, Node* nodeToSkip, EChildrenOnly childrenOnly, const Namespaces* namespaces)
+{
+    if (node == nodeToSkip)
+        return;
+
+    Namespaces namespaceHash;
+    if (namespaces)
+        namespaceHash = *namespaces;
+
+    if (!childrenOnly)
+        appendStartTag(node, &namespaceHash);
+
+    if (!(node->document()->isHTMLDocument() && elementCannotHaveEndTag(node))) {
+        for (Node* current = node->firstChild(); current; current = current->nextSibling())
+            serializeNodesWithNamespaces(current, nodeToSkip, IncludeNode, &namespaceHash);
+    }
+
+    if (!childrenOnly)
+        appendEndTag(node);
+}
+
+void MarkupAccumulator::appendString(const String& string)
+{
+    m_succeedingMarkup.append(string);
+}
+
+void MarkupAccumulator::appendStartTag(Node* node, Namespaces* namespaces)
+{
+    Vector<UChar> markup;
+    appendStartMarkup(markup, node, namespaces);
+    appendString(String::adopt(markup));
+    if (m_nodes)
+        m_nodes->append(node);
+}
+
+void MarkupAccumulator::appendEndTag(Node* node)
+{
+    Vector<UChar> markup;
+    appendEndMarkup(markup, node);
+    appendString(String::adopt(markup));
+}
+
+size_t MarkupAccumulator::totalLength(const Vector<String>& strings)
+{
+    size_t length = 0;
+    for (size_t i = 0; i < strings.size(); ++i)
+        length += strings[i].length();
+    return length;
+}
+
+// FIXME: This is a very inefficient way of accumulating the markup.
+// We're converting results of appendStartMarkup and appendEndMarkup from Vector<UChar> to String
+// and then back to Vector<UChar> and again to String here.
+void MarkupAccumulator::concatenateMarkup(Vector<UChar>& out)
+{
+    for (size_t i = 0; i < m_succeedingMarkup.size(); ++i)
+        append(out, m_succeedingMarkup[i]);
+}
+
+void MarkupAccumulator::appendAttributeValue(Vector<UChar>& result, const String& attribute, bool documentIsHTML)
+{
+    appendCharactersReplacingEntities(result, attribute.characters(), attribute.length(),
+        documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
+}
+
+void MarkupAccumulator::appendQuotedURLAttributeValue(Vector<UChar>& result, const String& urlString)
+{
+    UChar quoteChar = '\"';
+    String strippedURLString = urlString.stripWhiteSpace();
+    if (protocolIsJavaScript(strippedURLString)) {
+        // minimal escaping for javascript urls
+        if (strippedURLString.contains('"')) {
+            if (strippedURLString.contains('\''))
+                strippedURLString.replace('\"', "&quot;");
+            else
+                quoteChar = '\'';
+        }
+        result.append(quoteChar);
+        append(result, strippedURLString);
+        result.append(quoteChar);
+        return;
+    }
+
+    // FIXME: This does not fully match other browsers. Firefox percent-escapes non-ASCII characters for innerHTML.
+    result.append(quoteChar);
+    appendAttributeValue(result, urlString, false);
+    result.append(quoteChar);
+}
+
+void MarkupAccumulator::appendNodeValue(Vector<UChar>& out, const Node* node, const Range* range, EntityMask entityMask)
+{
+    String str = node->nodeValue();
+    const UChar* characters = str.characters();
+    size_t length = str.length();
+
+    if (range) {
+        ExceptionCode ec;
+        if (node == range->endContainer(ec))
+            length = range->endOffset(ec);
+        if (node == range->startContainer(ec)) {
+            size_t start = range->startOffset(ec);
+            characters += start;
+            length -= start;
+        }
+    }
+
+    appendCharactersReplacingEntities(out, characters, length, entityMask);
+}
+
+bool MarkupAccumulator::shouldAddNamespaceElement(const Element* element)
+{
+    // Don't add namespace attribute if it is already defined for this elem.
+    const AtomicString& prefix = element->prefix();
+    AtomicString attr = !prefix.isEmpty() ? "xmlns:" + prefix : "xmlns";
+    return !element->hasAttribute(attr);
+}
+
+bool MarkupAccumulator::shouldAddNamespaceAttribute(const Attribute& attribute, Namespaces& namespaces)
+{
+    namespaces.checkConsistency();
+
+    // Don't add namespace attributes twice
+    if (attribute.name() == XMLNSNames::xmlnsAttr) {
+        namespaces.set(emptyAtom.impl(), attribute.value().impl());
+        return false;
+    }
+    
+    QualifiedName xmlnsPrefixAttr(xmlnsAtom, attribute.localName(), XMLNSNames::xmlnsNamespaceURI);
+    if (attribute.name() == xmlnsPrefixAttr) {
+        namespaces.set(attribute.localName().impl(), attribute.value().impl());
+        return false;
+    }
+    
+    return true;
+}
+
+void MarkupAccumulator::appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces& namespaces)
+{
+    namespaces.checkConsistency();
+    if (namespaceURI.isEmpty())
+        return;
+        
+    // Use emptyAtoms's impl() for both null and empty strings since the HashMap can't handle 0 as a key
+    AtomicStringImpl* pre = prefix.isEmpty() ? emptyAtom.impl() : prefix.impl();
+    AtomicStringImpl* foundNS = namespaces.get(pre);
+    if (foundNS != namespaceURI.impl()) {
+        namespaces.set(pre, namespaceURI.impl());
+        result.append(' ');
+        append(result, xmlnsAtom.string());
+        if (!prefix.isEmpty()) {
+            result.append(':');
+            append(result, prefix);
+        }
+
+        result.append('=');
+        result.append('"');
+        appendAttributeValue(result, namespaceURI, false);
+        result.append('"');
+    }
+}
+
+EntityMask MarkupAccumulator::entityMaskForText(Text* text) const
+{
+    const QualifiedName* parentName = 0;
+    if (text->parentElement())
+        parentName = &static_cast<Element*>(text->parentElement())->tagQName();
+    
+    if (parentName && (*parentName == scriptTag || *parentName == styleTag || *parentName == xmpTag))
+        return EntityMaskInCDATA;
+
+    return text->document()->isHTMLDocument() ? EntityMaskInHTMLPCDATA : EntityMaskInPCDATA;
+}
+
+void MarkupAccumulator::appendText(Vector<UChar>& out, Text* text)
+{
+    appendNodeValue(out, text, m_range, entityMaskForText(text));
+}
+
+void MarkupAccumulator::appendComment(Vector<UChar>& out, const String& comment)
+{
+    // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
+    append(out, "<!--");
+    append(out, comment);
+    append(out, "-->");
+}
+
+void MarkupAccumulator::appendDocumentType(Vector<UChar>& result, const DocumentType* n)
+{
+    if (n->name().isEmpty())
+        return;
+
+    append(result, "<!DOCTYPE ");
+    append(result, n->name());
+    if (!n->publicId().isEmpty()) {
+        append(result, " PUBLIC \"");
+        append(result, n->publicId());
+        append(result, "\"");
+        if (!n->systemId().isEmpty()) {
+            append(result, " \"");
+            append(result, n->systemId());
+            append(result, "\"");
+        }
+    } else if (!n->systemId().isEmpty()) {
+        append(result, " SYSTEM \"");
+        append(result, n->systemId());
+        append(result, "\"");
+    }
+    if (!n->internalSubset().isEmpty()) {
+        append(result, " [");
+        append(result, n->internalSubset());
+        append(result, "]");
+    }
+    append(result, ">");
+}
+
+void MarkupAccumulator::appendProcessingInstruction(Vector<UChar>& out, const String& target, const String& data)
+{
+    // FIXME: PI data is not escaped, but XMLSerializer (and possibly other callers) this should raise an exception if it includes "?>".
+    append(out, "<?");
+    append(out, target);
+    append(out, " ");
+    append(out, data);
+    append(out, "?>");
+}
+
+void MarkupAccumulator::appendElement(Vector<UChar>& out, Element* element, Namespaces* namespaces)
+{
+    appendOpenTag(out, element, namespaces);
+
+    NamedNodeMap* attributes = element->attributes();
+    unsigned length = attributes->length();
+    for (unsigned int i = 0; i < length; i++)
+        appendAttribute(out, element, *attributes->attributeItem(i), namespaces);
+
+    appendCloseTag(out, element);
+}
+
+void MarkupAccumulator::appendOpenTag(Vector<UChar>& out, Element* element, Namespaces* namespaces)
+{
+    out.append('<');
+    append(out, element->nodeNamePreservingCase());
+    if (!element->document()->isHTMLDocument() && namespaces && shouldAddNamespaceElement(element))
+        appendNamespace(out, element->prefix(), element->namespaceURI(), *namespaces);    
+}
+
+void MarkupAccumulator::appendCloseTag(Vector<UChar>& out, Element* element)
+{
+    if (shouldSelfClose(element)) {
+        if (element->isHTMLElement())
+            out.append(' '); // XHTML 1.0 <-> HTML compatibility.
+        out.append('/');
+    }
+    out.append('>');
+}
+
+void MarkupAccumulator::appendAttribute(Vector<UChar>& out, Element* element, const Attribute& attribute, Namespaces* namespaces)
+{
+    bool documentIsHTML = element->document()->isHTMLDocument();
+
+    out.append(' ');
+
+    if (documentIsHTML)
+        append(out, attribute.name().localName());
+    else
+        append(out, attribute.name().toString());
+
+    out.append('=');
+
+    if (element->isURLAttribute(const_cast<Attribute*>(&attribute))) {
+        // We don't want to complete file:/// URLs because it may contain sensitive information
+        // about the user's system.
+        if (shouldResolveURLs() && !element->document()->url().isLocalFile())
+            appendQuotedURLAttributeValue(out, element->document()->completeURL(attribute.value()).string());
+        else
+            appendQuotedURLAttributeValue(out, attribute.value()); 
+    } else {
+        out.append('\"');
+        appendAttributeValue(out, attribute.value(), documentIsHTML);
+        out.append('\"');
+    }
+
+    if (!documentIsHTML && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
+        appendNamespace(out, attribute.prefix(), attribute.namespaceURI(), *namespaces);
+}
+
+void MarkupAccumulator::appendCDATASection(Vector<UChar>& out, const String& section)
+{
+    // FIXME: CDATA content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "]]>".
+    append(out, "<![CDATA[");
+    append(out, section);
+    append(out, "]]>");
+}
+
+void MarkupAccumulator::appendStartMarkup(Vector<UChar>& result, const Node* node, Namespaces* namespaces)
+{
+    if (namespaces)
+        namespaces->checkConsistency();
+
+    switch (node->nodeType()) {
+    case Node::TEXT_NODE:
+        appendText(result, static_cast<Text*>(const_cast<Node*>(node)));
+        break;
+    case Node::COMMENT_NODE:
+        appendComment(result, static_cast<const Comment*>(node)->data());
+        break;
+    case Node::DOCUMENT_NODE:
+    case Node::DOCUMENT_FRAGMENT_NODE:
+        break;
+    case Node::DOCUMENT_TYPE_NODE:
+        appendDocumentType(result, static_cast<const DocumentType*>(node));
+        break;
+    case Node::PROCESSING_INSTRUCTION_NODE:
+        appendProcessingInstruction(result, static_cast<const ProcessingInstruction*>(node)->target(), static_cast<const ProcessingInstruction*>(node)->data());
+        break;
+    case Node::ELEMENT_NODE:
+        appendElement(result, static_cast<Element*>(const_cast<Node*>(node)), namespaces);
+        break;
+    case Node::CDATA_SECTION_NODE:
+        appendCDATASection(result, static_cast<const CDATASection*>(node)->data());
+        break;
+    case Node::ATTRIBUTE_NODE:
+    case Node::ENTITY_NODE:
+    case Node::ENTITY_REFERENCE_NODE:
+    case Node::NOTATION_NODE:
+    case Node::XPATH_NAMESPACE_NODE:
+        ASSERT_NOT_REACHED();
+        break;
+    }
+}
+
+// Rules of self-closure
+// 1. No elements in HTML documents use the self-closing syntax.
+// 2. Elements w/ children never self-close because they use a separate end tag.
+// 3. HTML elements which do not have a "forbidden" end tag will close with a separate end tag.
+// 4. Other elements self-close.
+bool MarkupAccumulator::shouldSelfClose(const Node* node)
+{
+    if (node->document()->isHTMLDocument())
+        return false;
+    if (node->hasChildNodes())
+        return false;
+    if (node->isHTMLElement() && !elementCannotHaveEndTag(node))
+        return false;
+    return true;
+}
+
+bool MarkupAccumulator::elementCannotHaveEndTag(const Node* node)
+{
+    if (!node->isHTMLElement())
+        return false;
+    
+    // FIXME: ieForbidsInsertHTML may not be the right function to call here
+    // ieForbidsInsertHTML is used to disallow setting innerHTML/outerHTML
+    // or createContextualFragment.  It does not necessarily align with
+    // which elements should be serialized w/o end tags.
+    return static_cast<const HTMLElement*>(node)->ieForbidsInsertHTML();
+}
+
+void MarkupAccumulator::appendEndMarkup(Vector<UChar>& result, const Node* node)
+{
+    if (!node->isElementNode() || shouldSelfClose(node) || (!node->hasChildNodes() && elementCannotHaveEndTag(node)))
+        return;
+
+    result.append('<');
+    result.append('/');
+    append(result, static_cast<const Element*>(node)->nodeNamePreservingCase());
+    result.append('>');
+}
+
+}
diff --git a/WebCore/editing/MarkupAccumulator.h b/WebCore/editing/MarkupAccumulator.h
new file mode 100644
index 0000000..5a9c884
--- /dev/null
+++ b/WebCore/editing/MarkupAccumulator.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef MarkupAccumulator_h
+#define MarkupAccumulator_h
+
+#include "PlatformString.h"
+#include "markup.h"
+#include <wtf/HashMap.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class Attribute;
+class DocumentType;
+class Element;
+class Node;
+class Range;
+
+typedef HashMap<AtomicStringImpl*, AtomicStringImpl*> Namespaces;
+
+enum EntityMask {
+    EntityAmp = 0x0001,
+    EntityLt = 0x0002,
+    EntityGt = 0x0004,
+    EntityQuot = 0x0008,
+    EntityNbsp = 0x0010,
+
+    // Non-breaking space needs to be escaped in innerHTML for compatibility reason. See http://trac.webkit.org/changeset/32879
+    // However, we cannot do this in a XML document because it does not have the entity reference defined (See the bug 19215).
+    EntityMaskInCDATA = 0,
+    EntityMaskInPCDATA = EntityAmp | EntityLt | EntityGt,
+    EntityMaskInHTMLPCDATA = EntityMaskInPCDATA | EntityNbsp,
+    EntityMaskInAttributeValue = EntityAmp | EntityLt | EntityGt | EntityQuot,
+    EntityMaskInHTMLAttributeValue = EntityMaskInAttributeValue | EntityNbsp,
+};
+
+struct EntityDescription {
+    UChar entity;
+    const String& reference;
+    EntityMask mask;
+};
+
+// FIXME: Noncopyable?
+class MarkupAccumulator {
+public:
+    MarkupAccumulator(Vector<Node*>* nodes, EAbsoluteURLs shouldResolveURLs, const Range* range = 0);
+    virtual ~MarkupAccumulator();
+
+    String serializeNodes(Node* node, Node* nodeToSkip, EChildrenOnly childrenOnly);
+
+protected:
+    void appendString(const String&);
+    void appendStartTag(Node*, Namespaces* = 0);
+    void appendEndTag(Node*);
+    static size_t totalLength(const Vector<String>&);
+    size_t length() const { return totalLength(m_succeedingMarkup); }
+    void concatenateMarkup(Vector<UChar>& out);
+    void appendAttributeValue(Vector<UChar>& result, const String& attribute, bool documentIsHTML);
+    void appendQuotedURLAttributeValue(Vector<UChar>& result, const String& urlString);
+    void appendNodeValue(Vector<UChar>& out, const Node*, const Range*, EntityMask);
+    bool shouldAddNamespaceElement(const Element*);
+    bool shouldAddNamespaceAttribute(const Attribute&, Namespaces&);
+    void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces&);
+    EntityMask entityMaskForText(Text* text) const;
+    virtual void appendText(Vector<UChar>& out, Text*);
+    void appendComment(Vector<UChar>& out, const String& comment);
+    void appendDocumentType(Vector<UChar>& result, const DocumentType*);
+    void appendProcessingInstruction(Vector<UChar>& out, const String& target, const String& data);
+    virtual void appendElement(Vector<UChar>& out, Element*, Namespaces*);
+    void appendOpenTag(Vector<UChar>& out, Element* element, Namespaces*);
+    void appendCloseTag(Vector<UChar>& out, Element* element);
+    void appendAttribute(Vector<UChar>& out, Element* element, const Attribute&, Namespaces*);
+    void appendCDATASection(Vector<UChar>& out, const String& section);
+    void appendStartMarkup(Vector<UChar>& result, const Node*, Namespaces*);
+    bool shouldSelfClose(const Node*);
+    bool elementCannotHaveEndTag(const Node* node);
+    void appendEndMarkup(Vector<UChar>& result, const Node*);
+
+    bool shouldResolveURLs() { return m_shouldResolveURLs == AbsoluteURLs; }
+
+    Vector<Node*>* const m_nodes;
+    const Range* const m_range;
+
+private:
+    void serializeNodesWithNamespaces(Node*, Node* nodeToSkip, EChildrenOnly, const Namespaces*);
+
+    Vector<String> m_succeedingMarkup;
+    const bool m_shouldResolveURLs;
+};
+
+// FIXME: This method should be integrated with MarkupAccumulator.
+void appendCharactersReplacingEntities(Vector<UChar>& out, const UChar* content, size_t length, EntityMask entityMask);
+
+}
+
+#endif
diff --git a/WebCore/editing/MergeIdenticalElementsCommand.cpp b/WebCore/editing/MergeIdenticalElementsCommand.cpp
index f56f726..a1cb79f 100644
--- a/WebCore/editing/MergeIdenticalElementsCommand.cpp
+++ b/WebCore/editing/MergeIdenticalElementsCommand.cpp
@@ -67,7 +67,7 @@ void MergeIdenticalElementsCommand::doUnapply()
 
     RefPtr<Node> atChild = m_atChild.release();
 
-    Node* parent = m_element2->parent();
+    ContainerNode* parent = m_element2->parent();
     if (!parent || !parent->isContentEditable())
         return;
 
diff --git a/WebCore/editing/RemoveNodeCommand.cpp b/WebCore/editing/RemoveNodeCommand.cpp
index f6d6a4b..94e3e62 100644
--- a/WebCore/editing/RemoveNodeCommand.cpp
+++ b/WebCore/editing/RemoveNodeCommand.cpp
@@ -41,7 +41,7 @@ RemoveNodeCommand::RemoveNodeCommand(PassRefPtr<Node> node)
 
 void RemoveNodeCommand::doApply()
 {
-    Node* parent = m_node->parentNode();
+    ContainerNode* parent = m_node->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
 
@@ -54,7 +54,7 @@ void RemoveNodeCommand::doApply()
 
 void RemoveNodeCommand::doUnapply()
 {
-    RefPtr<Node> parent = m_parent.release();
+    RefPtr<ContainerNode> parent = m_parent.release();
     RefPtr<Node> refChild = m_refChild.release();
     if (!parent || !parent->isContentEditable())
         return;
diff --git a/WebCore/editing/RemoveNodeCommand.h b/WebCore/editing/RemoveNodeCommand.h
index 14a798c..b803964 100644
--- a/WebCore/editing/RemoveNodeCommand.h
+++ b/WebCore/editing/RemoveNodeCommand.h
@@ -44,7 +44,7 @@ private:
     virtual void doUnapply();
 
     RefPtr<Node> m_node;
-    RefPtr<Node> m_parent;
+    RefPtr<ContainerNode> m_parent;
     RefPtr<Node> m_refChild;    
 };
 
diff --git a/WebCore/editing/ReplaceNodeWithSpanCommand.cpp b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
index c3b6b89..7ab3aba 100644
--- a/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
+++ b/WebCore/editing/ReplaceNodeWithSpanCommand.cpp
@@ -41,18 +41,18 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand(PassRefPtr<Node> node)
-    : CompositeEditCommand(node->document())
-    , m_node(node)
+ReplaceNodeWithSpanCommand::ReplaceNodeWithSpanCommand(PassRefPtr<HTMLElement> element)
+    : SimpleEditCommand(element->document())
+    , m_elementToReplace(element)
 {
-    ASSERT(m_node);
+    ASSERT(m_elementToReplace);
 }
 
-static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeToReplace)
+static void swapInNodePreservingAttributesAndChildren(HTMLElement* newNode, HTMLElement* nodeToReplace)
 {
     ASSERT(nodeToReplace->inDocument());
     ExceptionCode ec = 0;
-    Node* parentNode = nodeToReplace->parentNode();
+    ContainerNode* parentNode = nodeToReplace->parentNode();
     parentNode->insertBefore(newNode, nodeToReplace, ec);
     ASSERT(!ec);
 
@@ -71,18 +71,18 @@ static void swapInNodePreservingAttributesAndChildren(Node* newNode, Node* nodeT
 
 void ReplaceNodeWithSpanCommand::doApply()
 {
-    if (!m_node->inDocument())
+    if (!m_elementToReplace->inDocument())
         return;
     if (!m_spanElement)
-        m_spanElement = createHTMLElement(m_node->document(), spanTag);
-    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_node.get());
+        m_spanElement = createHTMLElement(m_elementToReplace->document(), spanTag);
+    swapInNodePreservingAttributesAndChildren(m_spanElement.get(), m_elementToReplace.get());
 }
 
 void ReplaceNodeWithSpanCommand::doUnapply()
 {
     if (!m_spanElement->inDocument())
         return;
-    swapInNodePreservingAttributesAndChildren(m_node.get(), m_spanElement.get());
+    swapInNodePreservingAttributesAndChildren(m_elementToReplace.get(), m_spanElement.get());
 }
 
 } // namespace WebCore
diff --git a/WebCore/editing/ReplaceNodeWithSpanCommand.h b/WebCore/editing/ReplaceNodeWithSpanCommand.h
index 7b375b6..0154f29 100644
--- a/WebCore/editing/ReplaceNodeWithSpanCommand.h
+++ b/WebCore/editing/ReplaceNodeWithSpanCommand.h
@@ -37,23 +37,23 @@ namespace WebCore {
 
 class HTMLElement;
 
-// More accurately, this is ReplaceNodeWithSpanPreservingChildrenAndAttributesCommand
-class ReplaceNodeWithSpanCommand : public CompositeEditCommand {
+// More accurately, this is ReplaceElementWithSpanPreservingChildrenAndAttributesCommand
+class ReplaceNodeWithSpanCommand : public SimpleEditCommand {
 public:
-    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtr<Node> node)
+    static PassRefPtr<ReplaceNodeWithSpanCommand> create(PassRefPtr<HTMLElement> element)
     {
-        return adoptRef(new ReplaceNodeWithSpanCommand(node));
+        return adoptRef(new ReplaceNodeWithSpanCommand(element));
     }
 
     HTMLElement* spanElement() { return m_spanElement.get(); }
 
 private:
-    ReplaceNodeWithSpanCommand(PassRefPtr<Node>);
+    ReplaceNodeWithSpanCommand(PassRefPtr<HTMLElement>);
 
     virtual void doApply();
     virtual void doUnapply();
 
-    RefPtr<Node> m_node;
+    RefPtr<HTMLElement> m_elementToReplace;
     RefPtr<HTMLElement> m_spanElement;
 };
 
diff --git a/WebCore/editing/ReplaceSelectionCommand.cpp b/WebCore/editing/ReplaceSelectionCommand.cpp
index 49bdaca..056ab70 100644
--- a/WebCore/editing/ReplaceSelectionCommand.cpp
+++ b/WebCore/editing/ReplaceSelectionCommand.cpp
@@ -76,9 +76,9 @@ public:
     void removeNodePreservingChildren(Node*);
 
 private:
-    PassRefPtr<Node> insertFragmentForTestRendering(Node* context);
+    PassRefPtr<StyledElement> insertFragmentForTestRendering(Node* context);
     void removeUnrenderedNodes(Node*);
-    void restoreTestRenderingNodesToFragment(Node*);
+    void restoreTestRenderingNodesToFragment(StyledElement*);
     void removeInterchangeNodes(Node*);
     
     void insertNodeBefore(PassRefPtr<Node> node, Node* refNode);
@@ -150,7 +150,7 @@ ReplacementFragment::ReplacementFragment(Document* document, DocumentFragment* f
     }
 
     Node* styleNode = selection.base().node();
-    RefPtr<Node> holder = insertFragmentForTestRendering(styleNode);
+    RefPtr<StyledElement> holder = insertFragmentForTestRendering(styleNode);
     
     RefPtr<Range> range = VisibleSelection::selectionFromContentsOfNode(holder.get()).toNormalizedRange();
     String text = plainText(range.get());
@@ -208,7 +208,7 @@ void ReplacementFragment::removeNode(PassRefPtr<Node> node)
     if (!node)
         return;
     
-    Node *parent = node->parentNode();
+    ContainerNode* parent = node->parentNode();
     if (!parent)
         return;
     
@@ -222,7 +222,7 @@ void ReplacementFragment::insertNodeBefore(PassRefPtr<Node> node, Node* refNode)
     if (!node || !refNode)
         return;
         
-    Node* parent = refNode->parentNode();
+    ContainerNode* parent = refNode->parentNode();
     if (!parent)
         return;
         
@@ -231,9 +231,9 @@ void ReplacementFragment::insertNodeBefore(PassRefPtr<Node> node, Node* refNode)
     ASSERT(ec == 0);
 }
 
-PassRefPtr<Node> ReplacementFragment::insertFragmentForTestRendering(Node* context)
+PassRefPtr<StyledElement> ReplacementFragment::insertFragmentForTestRendering(Node* context)
 {
-    Node* body = m_document->body();
+    HTMLElement* body = m_document->body();
     if (!body)
         return 0;
 
@@ -266,7 +266,7 @@ PassRefPtr<Node> ReplacementFragment::insertFragmentForTestRendering(Node* conte
     return holder.release();
 }
 
-void ReplacementFragment::restoreTestRenderingNodesToFragment(Node *holder)
+void ReplacementFragment::restoreTestRenderingNodesToFragment(StyledElement* holder)
 {
     if (!holder)
         return;
@@ -628,7 +628,7 @@ void ReplaceSelectionCommand::handleStyleSpans()
         return;
         
     RefPtr<CSSMutableStyleDeclaration> sourceDocumentStyle = static_cast<HTMLElement*>(sourceDocumentStyleSpan)->getInlineStyleDecl()->copy();
-    Node* context = sourceDocumentStyleSpan->parentNode();
+    ContainerNode* context = sourceDocumentStyleSpan->parentNode();
     
     // If Mail wraps the fragment with a Paste as Quotation blockquote, or if you're pasting into a quoted region,
     // styles from blockquoteNode are allowed to override those from the source document, see <rdar://problem/4930986> and <rdar://problem/5089327>.
@@ -710,13 +710,15 @@ void ReplaceSelectionCommand::copyStyleToChildren(Node* parentNode, const CSSMut
     for (Node* childNode = parentNode->firstChild(); childNode; childNode = childNode->nextSibling()) {
         if (childNode->isTextNode() || !isBlock(childNode) || childNode->hasTagName(preTag)) {
             // In this case, put a span tag around the child node.
-            RefPtr<Node> newSpan = parentNode->cloneNode(false);
-            setNodeAttribute(static_cast<Element*>(newSpan.get()), styleAttr, parentStyle->cssText());
+            RefPtr<Node> newNode = parentNode->cloneNode(false);
+            ASSERT(newNode->hasTagName(spanTag));
+            HTMLElement* newSpan = static_cast<HTMLElement*>(newNode.get());
+            setNodeAttribute(newSpan, styleAttr, parentStyle->cssText());
             insertNodeAfter(newSpan, childNode);
             ExceptionCode ec = 0;
             newSpan->appendChild(childNode, ec);
             ASSERT(!ec);
-            childNode = newSpan.get();
+            childNode = newSpan;
         } else if (childNode->isHTMLElement()) {
             // Copy the style attribute and merge them into the child node.  We don't want to override
             // existing styles, so don't clobber on merge.
@@ -777,6 +779,21 @@ void ReplaceSelectionCommand::mergeEndIfNeeded()
     }
 }
 
+static Node* enclosingInline(Node* node)
+{
+    while (ContainerNode* parent = node->parentNode()) {
+        if (parent->isBlockFlow() || parent->hasTagName(bodyTag))
+            return node;
+        // Stop if any previous sibling is a block.
+        for (Node* sibling = node->previousSibling(); sibling; sibling = sibling->previousSibling()) {
+            if (sibling->isBlockFlow())
+                return node;
+        }
+        node = parent;
+    }
+    return node;
+}
+
 void ReplaceSelectionCommand::doApply()
 {
     VisibleSelection selection = endingSelection();
@@ -996,7 +1013,7 @@ void ReplaceSelectionCommand::doApply()
         // but our destination node is inside an inline that is the last in the block.
         // We insert a placeholder before the newly inserted content to avoid being merged into the inline.
         Node* destinationNode = destination.deepEquivalent().node();
-        if (m_shouldMergeEnd && destinationNode != destinationNode->enclosingInlineElement() && destinationNode->enclosingInlineElement()->nextSibling())
+        if (m_shouldMergeEnd && destinationNode != enclosingInline(destinationNode) && enclosingInline(destinationNode)->nextSibling())
             insertNodeBefore(createBreakElement(document()), refNode.get());
         
         // Merging the the first paragraph of inserted content with the content that came
@@ -1211,7 +1228,7 @@ Node* ReplaceSelectionCommand::insertAsListItems(PassRefPtr<Node> listElement, N
 
     while (RefPtr<Node> listItem = listElement->firstChild()) {
         ExceptionCode ec = 0;
-        listElement->removeChild(listItem.get(), ec);
+        toContainerNode(listElement.get())->removeChild(listItem.get(), ec);
         ASSERT(!ec);
         if (isStart || isMiddle)
             insertNodeBefore(listItem, lastNode);
diff --git a/WebCore/editing/SelectionController.cpp b/WebCore/editing/SelectionController.cpp
index c9295d3..6f25c86 100644
--- a/WebCore/editing/SelectionController.cpp
+++ b/WebCore/editing/SelectionController.cpp
@@ -1085,7 +1085,7 @@ void SelectionController::paintCaret(GraphicsContext* context, int tx, int ty, c
         return;
 
     Color caretColor = Color::black;
-    ColorSpace colorSpace = DeviceColorSpace;
+    ColorSpace colorSpace = ColorSpaceDeviceRGB;
     Element* element = rootEditableElement();
     if (element && element->renderer()) {
         caretColor = element->renderer()->style()->visitedDependentColor(CSSPropertyColor);
@@ -1222,11 +1222,10 @@ void SelectionController::selectFrameElementInParentIfFullySelected()
         return;
 
     // Get to the <iframe> or <frame> (or even <object>) element in the parent frame.
-    Document* doc = m_frame->document();
-    Element* ownerElement = doc->ownerElement();
+    Element* ownerElement = m_frame->document()->ownerElement();
     if (!ownerElement)
         return;
-    Node* ownerElementParent = ownerElement->parentNode();
+    ContainerNode* ownerElementParent = ownerElement->parentNode();
     if (!ownerElementParent)
         return;
         
diff --git a/WebCore/editing/SplitElementCommand.cpp b/WebCore/editing/SplitElementCommand.cpp
index 5047205..888c45f 100644
--- a/WebCore/editing/SplitElementCommand.cpp
+++ b/WebCore/editing/SplitElementCommand.cpp
@@ -53,7 +53,7 @@ void SplitElementCommand::executeApply()
     
     ExceptionCode ec = 0;
     
-    Node* parent = m_element2->parentNode();
+    ContainerNode* parent = m_element2->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
     parent->insertBefore(m_element1.get(), m_element2.get(), ec);
diff --git a/WebCore/editing/SplitTextNodeCommand.cpp b/WebCore/editing/SplitTextNodeCommand.cpp
index 1f38902..6c414f9 100644
--- a/WebCore/editing/SplitTextNodeCommand.cpp
+++ b/WebCore/editing/SplitTextNodeCommand.cpp
@@ -49,7 +49,7 @@ SplitTextNodeCommand::SplitTextNodeCommand(PassRefPtr<Text> text, int offset)
 
 void SplitTextNodeCommand::doApply()
 {
-    Node* parent = m_text2->parentNode();
+    ContainerNode* parent = m_text2->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
 
@@ -87,7 +87,7 @@ void SplitTextNodeCommand::doReapply()
     if (!m_text1 || !m_text2)
         return;
 
-    Node* parent = m_text2->parentNode();
+    ContainerNode* parent = m_text2->parentNode();
     if (!parent || !parent->isContentEditable())
         return;
 
diff --git a/WebCore/editing/TextIterator.cpp b/WebCore/editing/TextIterator.cpp
index 0612986..a96268d 100644
--- a/WebCore/editing/TextIterator.cpp
+++ b/WebCore/editing/TextIterator.cpp
@@ -112,6 +112,10 @@ BitStack::BitStack()
 {
 }
 
+BitStack::~BitStack()
+{
+}
+
 void BitStack::push(bool bit)
 {
     unsigned index = m_size / bitsInWord;
@@ -150,9 +154,9 @@ unsigned BitStack::size() const
 
 // --------
 
-static inline Node* parentCrossingShadowBoundaries(Node* node)
+static inline ContainerNode* parentCrossingShadowBoundaries(Node* node)
 {
-    if (Node* parent = node->parentNode())
+    if (ContainerNode* parent = node->parentNode())
         return parent;
     return node->shadowParentNode();
 }
@@ -336,6 +340,10 @@ TextIterator::TextIterator(const Range* r, TextIteratorBehavior behavior)
     advance();
 }
 
+TextIterator::~TextIterator()
+{
+}
+
 void TextIterator::advance()
 {
     // reset the run information
@@ -1456,6 +1464,10 @@ WordAwareIterator::WordAwareIterator(const Range* r)
     advance(); // get in position over the first chunk of text
 }
 
+WordAwareIterator::~WordAwareIterator()
+{
+}
+
 // We're always in one of these modes:
 // - The current chunk in the text iterator is our current chunk
 //      (typically its a piece of whitespace, or text that ended with whitespace)
diff --git a/WebCore/editing/TextIterator.h b/WebCore/editing/TextIterator.h
index 7fd87bd..1bd8828 100644
--- a/WebCore/editing/TextIterator.h
+++ b/WebCore/editing/TextIterator.h
@@ -64,6 +64,7 @@ PassRefPtr<Range> findPlainText(const Range*, const String&, bool forward, bool
 class BitStack {
 public:
     BitStack();
+    ~BitStack();
 
     void push(bool);
     void pop();
@@ -83,6 +84,7 @@ private:
 class TextIterator {
 public:
     TextIterator();
+    ~TextIterator();
     explicit TextIterator(const Range*, TextIteratorBehavior = TextIteratorDefaultBehavior);
 
     bool atEnd() const { return !m_positionNode; }
@@ -291,6 +293,7 @@ class WordAwareIterator {
 public:
     WordAwareIterator();
     explicit WordAwareIterator(const Range*);
+    ~WordAwareIterator();
 
     bool atEnd() const { return !m_didLookAhead && m_textIterator.atEnd(); }
     void advance();
diff --git a/WebCore/editing/VisiblePosition.cpp b/WebCore/editing/VisiblePosition.cpp
index 1b4a514..760c68c 100644
--- a/WebCore/editing/VisiblePosition.cpp
+++ b/WebCore/editing/VisiblePosition.cpp
@@ -123,9 +123,9 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretRightmostOffset())
-                return box->direction() == LTR ? previousVisuallyDistinctCandidate(m_deepPosition) : nextVisuallyDistinctCandidate(m_deepPosition);
+                return box->isLeftToRightDirection() ? previousVisuallyDistinctCandidate(m_deepPosition) : nextVisuallyDistinctCandidate(m_deepPosition);
 
-            offset = box->direction() == LTR ? renderer->previousOffset(offset) : renderer->nextOffset(offset);
+            offset = box->isLeftToRightDirection() ? renderer->previousOffset(offset) : renderer->nextOffset(offset);
 
             int caretMinOffset = box->caretMinOffset();
             int caretMaxOffset = box->caretMaxOffset();
@@ -133,7 +133,7 @@ Position VisiblePosition::leftVisuallyDistinctCandidate() const
             if (offset > caretMinOffset && offset < caretMaxOffset)
                 break;
 
-            if (box->direction() == LTR ? offset < caretMinOffset : offset > caretMaxOffset) {
+            if (box->isLeftToRightDirection() ? offset < caretMinOffset : offset > caretMaxOffset) {
                 // Overshot to the left.
                 InlineBox* prevBox = box->prevLeafChild();
                 if (!prevBox)
@@ -259,9 +259,9 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
 
         while (true) {
             if ((renderer->isReplaced() || renderer->isBR()) && offset == box->caretLeftmostOffset())
-                return box->direction() == LTR ? nextVisuallyDistinctCandidate(m_deepPosition) : previousVisuallyDistinctCandidate(m_deepPosition);
+                return box->isLeftToRightDirection() ? nextVisuallyDistinctCandidate(m_deepPosition) : previousVisuallyDistinctCandidate(m_deepPosition);
 
-            offset = box->direction() == LTR ? renderer->nextOffset(offset) : renderer->previousOffset(offset);
+            offset = box->isLeftToRightDirection() ? renderer->nextOffset(offset) : renderer->previousOffset(offset);
 
             int caretMinOffset = box->caretMinOffset();
             int caretMaxOffset = box->caretMaxOffset();
@@ -269,7 +269,7 @@ Position VisiblePosition::rightVisuallyDistinctCandidate() const
             if (offset > caretMinOffset && offset < caretMaxOffset)
                 break;
 
-            if (box->direction() == LTR ? offset > caretMaxOffset : offset < caretMinOffset) {
+            if (box->isLeftToRightDirection() ? offset > caretMaxOffset : offset < caretMinOffset) {
                 // Overshot to the right.
                 InlineBox* nextBox = box->nextLeafChild();
                 if (!nextBox)
@@ -439,8 +439,13 @@ static Position canonicalizeCandidate(const Position& candidate)
     return candidate;
 }
 
-Position VisiblePosition::canonicalPosition(const Position& position)
+Position VisiblePosition::canonicalPosition(const Position& passedPosition)
 {
+    // The updateLayout call below can do so much that even the position passed
+    // in to us might get changed as a side effect. Specifically, there are code
+    // paths that pass selection endpoints, and updateLayout can change the selection.
+    Position position = passedPosition;
+
     // FIXME (9535):  Canonicalizing to the leftmost candidate means that if we're at a line wrap, we will 
     // ask renderers to paint downstream carets for other renderers.
     // To fix this, we need to either a) add code to all paintCarets to pass the responsibility off to
@@ -629,7 +634,7 @@ bool setEnd(Range *r, const VisiblePosition &visiblePosition)
     return code == 0;
 }
 
-Node *enclosingBlockFlowElement(const VisiblePosition &visiblePosition)
+Element* enclosingBlockFlowElement(const VisiblePosition &visiblePosition)
 {
     if (visiblePosition.isNull())
         return NULL;
diff --git a/WebCore/editing/VisiblePosition.h b/WebCore/editing/VisiblePosition.h
index fe795a1..e649b68 100644
--- a/WebCore/editing/VisiblePosition.h
+++ b/WebCore/editing/VisiblePosition.h
@@ -136,7 +136,7 @@ bool setEnd(Range*, const VisiblePosition&);
 VisiblePosition startVisiblePosition(const Range*, EAffinity);
 VisiblePosition endVisiblePosition(const Range*, EAffinity);
 
-Node *enclosingBlockFlowElement(const VisiblePosition&);
+Element* enclosingBlockFlowElement(const VisiblePosition&);
 
 bool isFirstVisiblePositionInNode(const VisiblePosition&, const Node*);
 bool isLastVisiblePositionInNode(const VisiblePosition&, const Node*);
diff --git a/WebCore/editing/chromium/EditorChromium.cpp b/WebCore/editing/chromium/EditorChromium.cpp
index c938a7e..ca7f41a 100644
--- a/WebCore/editing/chromium/EditorChromium.cpp
+++ b/WebCore/editing/chromium/EditorChromium.cpp
@@ -39,7 +39,7 @@ namespace WebCore {
 
 PassRefPtr<Clipboard> Editor::newGeneralClipboard(ClipboardAccessPolicy policy, Frame* frame)
 {
-    return ClipboardChromium::create(Clipboard::CopyAndPaste, ChromiumDataObject::create(), policy, frame);
+    return ClipboardChromium::create(Clipboard::CopyAndPaste, policy, frame);
 }
 
 } // namespace WebCore
diff --git a/WebCore/editing/gtk/SelectionControllerGtk.cpp b/WebCore/editing/gtk/SelectionControllerGtk.cpp
index 9d52c1a..5626110 100644
--- a/WebCore/editing/gtk/SelectionControllerGtk.cpp
+++ b/WebCore/editing/gtk/SelectionControllerGtk.cpp
@@ -41,6 +41,9 @@ void SelectionController::notifyAccessibilityForSelectionChange()
         int offset;
         // Always report the events w.r.t. the non-linked unignored parent. (i.e. ignoreLinks == true)
         AccessibilityObject* object = objectAndOffsetUnignored(accessibilityObject, offset, true);
+        if (!object)
+            return;
+
         AtkObject* wrapper = object->wrapper();
         if (ATK_IS_TEXT(wrapper)) {
             g_signal_emit_by_name(wrapper, "text-caret-moved", offset);
diff --git a/WebCore/editing/htmlediting.cpp b/WebCore/editing/htmlediting.cpp
index 53b5d7e..f8f02b9 100644
--- a/WebCore/editing/htmlediting.cpp
+++ b/WebCore/editing/htmlediting.cpp
@@ -465,39 +465,6 @@ bool isSpecialElement(const Node *n)
     return false;
 }
 
-// Checks if a string is a valid tag for the FormatBlockCommand function of execCommand. Expects lower case strings.
-bool validBlockTag(const AtomicString& blockTag)
-{
-    if (blockTag.isEmpty())
-        return false;
-
-    DEFINE_STATIC_LOCAL(HashSet<AtomicString>, blockTags, ());
-    if (blockTags.isEmpty()) {
-        blockTags.add(addressTag.localName());
-        blockTags.add(articleTag.localName());
-        blockTags.add(asideTag.localName());
-        blockTags.add(blockquoteTag.localName());
-        blockTags.add(ddTag.localName());
-        blockTags.add(divTag.localName());
-        blockTags.add(dlTag.localName());
-        blockTags.add(dtTag.localName());
-        blockTags.add(footerTag.localName());
-        blockTags.add(h1Tag.localName());
-        blockTags.add(h2Tag.localName());
-        blockTags.add(h3Tag.localName());
-        blockTags.add(h4Tag.localName());
-        blockTags.add(h5Tag.localName());
-        blockTags.add(h6Tag.localName());
-        blockTags.add(headerTag.localName());
-        blockTags.add(hgroupTag.localName());
-        blockTags.add(navTag.localName());
-        blockTags.add(pTag.localName());
-        blockTags.add(preTag.localName());
-        blockTags.add(sectionTag.localName());
-    }
-    return blockTags.contains(blockTag);
-}
-
 static Node* firstInSpecialElement(const Position& pos)
 {
     // FIXME: This begins at pos.node(), which doesn't necessarily contain pos (suppose pos was [img, 0]).  See <rdar://problem/5027702>.
@@ -739,7 +706,7 @@ HTMLElement* enclosingList(Node* node)
         
     Node* root = highestEditableRoot(Position(node, 0));
     
-    for (Node* n = node->parentNode(); n; n = n->parentNode()) {
+    for (ContainerNode* n = node->parentNode(); n; n = n->parentNode()) {
         if (n->hasTagName(ulTag) || n->hasTagName(olTag))
             return static_cast<HTMLElement*>(n);
         if (n == root)
@@ -1069,6 +1036,9 @@ bool lineBreakExistsAtPosition(const Position& position)
     if (position.anchorNode()->hasTagName(brTag) && position.atFirstEditingPositionForNode())
         return true;
     
+    if (!position.anchorNode()->renderer())
+        return false;
+    
     if (!position.anchorNode()->isTextNode() || !position.anchorNode()->renderer()->style()->preserveNewline())
         return false;
     
diff --git a/WebCore/editing/htmlediting.h b/WebCore/editing/htmlediting.h
index aaf6ef2..1892357 100644
--- a/WebCore/editing/htmlediting.h
+++ b/WebCore/editing/htmlediting.h
@@ -228,8 +228,6 @@ VisibleSelection selectionForParagraphIteration(const VisibleSelection&);
     
 String stringWithRebalancedWhitespace(const String&, bool, bool);
 const String& nonBreakingSpaceString();
-bool validBlockTag(const AtomicString&);
-    
 
 }
 
diff --git a/WebCore/editing/markup.cpp b/WebCore/editing/markup.cpp
index 82499bf..75d567e 100644
--- a/WebCore/editing/markup.cpp
+++ b/WebCore/editing/markup.cpp
@@ -52,6 +52,7 @@
 #include "InlineTextBox.h"
 #include "KURL.h"
 #include "Logging.h"
+#include "MarkupAccumulator.h"
 #include "ProcessingInstruction.h"
 #include "Range.h"
 #include "TextIterator.h"
@@ -91,456 +92,6 @@ private:
     QualifiedName m_name;
     String m_value;
 };
-    
-enum EntityMask {
-    EntityAmp = 0x0001,
-    EntityLt = 0x0002,
-    EntityGt = 0x0004,
-    EntityQuot = 0x0008,
-    EntityNbsp = 0x0010,
-
-    // Non-breaking space needs to be escaped in innerHTML for compatibility reason. See http://trac.webkit.org/changeset/32879
-    // However, we cannot do this in a XML document because it does not have the entity reference defined (See the bug 19215).
-    EntityMaskInCDATA = 0,
-    EntityMaskInPCDATA = EntityAmp | EntityLt | EntityGt,
-    EntityMaskInHTMLPCDATA = EntityMaskInPCDATA | EntityNbsp,
-    EntityMaskInAttributeValue = EntityAmp | EntityLt | EntityGt | EntityQuot,
-    EntityMaskInHTMLAttributeValue = EntityMaskInAttributeValue | EntityNbsp,
-};
-
-struct EntityDescription {
-    UChar entity;
-    const String& reference;
-    EntityMask mask;
-};
-
-static void appendCharactersReplacingEntities(Vector<UChar>& out, const UChar* content, size_t length, EntityMask entityMask)
-{
-    DEFINE_STATIC_LOCAL(const String, ampReference, ("&amp;"));
-    DEFINE_STATIC_LOCAL(const String, ltReference, ("&lt;"));
-    DEFINE_STATIC_LOCAL(const String, gtReference, ("&gt;"));
-    DEFINE_STATIC_LOCAL(const String, quotReference, ("&quot;"));
-    DEFINE_STATIC_LOCAL(const String, nbspReference, ("&nbsp;"));
-
-    static const EntityDescription entityMaps[] = {
-        { '&', ampReference, EntityAmp },
-        { '<', ltReference, EntityLt },
-        { '>', gtReference, EntityGt },
-        { '"', quotReference, EntityQuot },
-        { noBreakSpace, nbspReference, EntityNbsp },
-    };
-
-    size_t positionAfterLastEntity = 0;
-    for (size_t i = 0; i < length; i++) {
-        for (size_t m = 0; m < sizeof(entityMaps) / sizeof(EntityDescription); m++) {
-            if (content[i] == entityMaps[m].entity && entityMaps[m].mask & entityMask) {
-                out.append(content + positionAfterLastEntity, i - positionAfterLastEntity);
-                append(out, entityMaps[m].reference);
-                positionAfterLastEntity = i + 1;
-                break;
-            }
-        }
-    }
-    out.append(content + positionAfterLastEntity, length - positionAfterLastEntity);
-}
-
-typedef HashMap<AtomicStringImpl*, AtomicStringImpl*> Namespaces;
-
-class MarkupAccumulator {
-public:
-    MarkupAccumulator(Vector<Node*>* nodes, EAbsoluteURLs shouldResolveURLs, const Range* range = 0)
-        : m_nodes(nodes)
-        , m_range(range)
-        , m_shouldResolveURLs(shouldResolveURLs)
-    {
-    }
-    virtual ~MarkupAccumulator() {}
-    void appendString(const String&);
-    void appendStartTag(Node*, Namespaces* = 0);
-    void appendEndTag(Node*);
-    virtual String takeResults();
-
-protected:
-    void appendAttributeValue(Vector<UChar>& result, const String& attribute, bool documentIsHTML);
-    void appendQuotedURLAttributeValue(Vector<UChar>& result, const String& urlString);
-    void appendNodeValue(Vector<UChar>& out, const Node*, const Range*, EntityMask);
-    bool shouldAddNamespaceElement(const Element*);
-    bool shouldAddNamespaceAttribute(const Attribute&, Namespaces&);
-    void appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces&);
-    EntityMask entityMaskForText(Text* text) const;
-    virtual void appendText(Vector<UChar>& out, Text*);
-    void appendComment(Vector<UChar>& out, const String& comment);
-    void appendDocumentType(Vector<UChar>& result, const DocumentType*);
-    void appendProcessingInstruction(Vector<UChar>& out, const String& target, const String& data);
-    virtual void appendElement(Vector<UChar>& out, Element*, Namespaces*);
-    void appendOpenTag(Vector<UChar>& out, Element* element, Namespaces*);
-    void appendCloseTag(Vector<UChar>& out, Element* element);
-    void appendAttribute(Vector<UChar>& out, Element* element, const Attribute&, Namespaces*);
-    void appendCDATASection(Vector<UChar>& out, const String& section);
-    void appendStartMarkup(Vector<UChar>& result, const Node*, Namespaces*);
-    bool shouldSelfClose(const Node*);
-    void appendEndMarkup(Vector<UChar>& result, const Node*);
-
-    bool shouldResolveURLs() { return m_shouldResolveURLs == AbsoluteURLs; }
-
-    Vector<Node*>* const m_nodes;
-    const Range* const m_range;
-    Vector<String> m_succeedingMarkup;
-
-private:
-    const bool m_shouldResolveURLs;
-};
-
-void MarkupAccumulator::appendString(const String& string)
-{
-    m_succeedingMarkup.append(string);
-}
-
-void MarkupAccumulator::appendStartTag(Node* node, Namespaces* namespaces)
-{
-    Vector<UChar> markup;
-    appendStartMarkup(markup, node, namespaces);
-    m_succeedingMarkup.append(String::adopt(markup));
-    if (m_nodes)
-        m_nodes->append(node);
-}
-
-void MarkupAccumulator::appendEndTag(Node* node)
-{
-    Vector<UChar> markup;
-    appendEndMarkup(markup, node);
-    m_succeedingMarkup.append(String::adopt(markup));
-}
-
-// FIXME: This is a very inefficient way of accumulating the markup.
-// We're converting results of appendStartMarkup and appendEndMarkup from Vector<UChar> to String
-// and then back to Vector<UChar> and again to String here.
-String MarkupAccumulator::takeResults()
-{
-    size_t length = 0;
-
-    size_t postCount = m_succeedingMarkup.size();
-    for (size_t i = 0; i < postCount; ++i)
-        length += m_succeedingMarkup[i].length();
-
-    Vector<UChar> result;
-    result.reserveInitialCapacity(length);
-
-    for (size_t i = 0; i < postCount; ++i)
-        append(result, m_succeedingMarkup[i]);
-
-    return String::adopt(result);
-}
-
-void MarkupAccumulator::appendAttributeValue(Vector<UChar>& result, const String& attribute, bool documentIsHTML)
-{
-    appendCharactersReplacingEntities(result, attribute.characters(), attribute.length(),
-        documentIsHTML ? EntityMaskInHTMLAttributeValue : EntityMaskInAttributeValue);
-}
-
-void MarkupAccumulator::appendQuotedURLAttributeValue(Vector<UChar>& result, const String& urlString)
-{
-    UChar quoteChar = '\"';
-    String strippedURLString = urlString.stripWhiteSpace();
-    if (protocolIsJavaScript(strippedURLString)) {
-        // minimal escaping for javascript urls
-        if (strippedURLString.contains('"')) {
-            if (strippedURLString.contains('\''))
-                strippedURLString.replace('\"', "&quot;");
-            else
-                quoteChar = '\'';
-        }
-        result.append(quoteChar);
-        append(result, strippedURLString);
-        result.append(quoteChar);
-        return;
-    }
-
-    // FIXME: This does not fully match other browsers. Firefox percent-escapes non-ASCII characters for innerHTML.
-    result.append(quoteChar);
-    appendAttributeValue(result, urlString, false);
-    result.append(quoteChar);
-}
-
-void MarkupAccumulator::appendNodeValue(Vector<UChar>& out, const Node* node, const Range* range, EntityMask entityMask)
-{
-    String str = node->nodeValue();
-    const UChar* characters = str.characters();
-    size_t length = str.length();
-
-    if (range) {
-        ExceptionCode ec;
-        if (node == range->endContainer(ec))
-            length = range->endOffset(ec);
-        if (node == range->startContainer(ec)) {
-            size_t start = range->startOffset(ec);
-            characters += start;
-            length -= start;
-        }
-    }
-
-    appendCharactersReplacingEntities(out, characters, length, entityMask);
-}
-
-bool MarkupAccumulator::shouldAddNamespaceElement(const Element* element)
-{
-    // Don't add namespace attribute if it is already defined for this elem.
-    const AtomicString& prefix = element->prefix();
-    AtomicString attr = !prefix.isEmpty() ? "xmlns:" + prefix : "xmlns";
-    return !element->hasAttribute(attr);
-}
-
-bool MarkupAccumulator::shouldAddNamespaceAttribute(const Attribute& attribute, Namespaces& namespaces)
-{
-    namespaces.checkConsistency();
-
-    // Don't add namespace attributes twice
-    if (attribute.name() == XMLNSNames::xmlnsAttr) {
-        namespaces.set(emptyAtom.impl(), attribute.value().impl());
-        return false;
-    }
-    
-    QualifiedName xmlnsPrefixAttr(xmlnsAtom, attribute.localName(), XMLNSNames::xmlnsNamespaceURI);
-    if (attribute.name() == xmlnsPrefixAttr) {
-        namespaces.set(attribute.localName().impl(), attribute.value().impl());
-        return false;
-    }
-    
-    return true;
-}
-
-void MarkupAccumulator::appendNamespace(Vector<UChar>& result, const AtomicString& prefix, const AtomicString& namespaceURI, Namespaces& namespaces)
-{
-    namespaces.checkConsistency();
-    if (namespaceURI.isEmpty())
-        return;
-        
-    // Use emptyAtoms's impl() for both null and empty strings since the HashMap can't handle 0 as a key
-    AtomicStringImpl* pre = prefix.isEmpty() ? emptyAtom.impl() : prefix.impl();
-    AtomicStringImpl* foundNS = namespaces.get(pre);
-    if (foundNS != namespaceURI.impl()) {
-        namespaces.set(pre, namespaceURI.impl());
-        result.append(' ');
-        append(result, xmlnsAtom.string());
-        if (!prefix.isEmpty()) {
-            result.append(':');
-            append(result, prefix);
-        }
-
-        result.append('=');
-        result.append('"');
-        appendAttributeValue(result, namespaceURI, false);
-        result.append('"');
-    }
-}
-
-EntityMask MarkupAccumulator::entityMaskForText(Text* text) const
-{
-    const QualifiedName* parentName = 0;
-    if (text->parentElement())
-        parentName = &static_cast<Element*>(text->parentElement())->tagQName();
-    
-    if (parentName && (*parentName == scriptTag || *parentName == styleTag || *parentName == xmpTag))
-        return EntityMaskInCDATA;
-
-    return text->document()->isHTMLDocument() ? EntityMaskInHTMLPCDATA : EntityMaskInPCDATA;
-}
-
-void MarkupAccumulator::appendText(Vector<UChar>& out, Text* text)
-{
-    appendNodeValue(out, text, m_range, entityMaskForText(text));
-}
-
-void MarkupAccumulator::appendComment(Vector<UChar>& out, const String& comment)
-{
-    // FIXME: Comment content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "-->".
-    append(out, "<!--");
-    append(out, comment);
-    append(out, "-->");
-}
-
-void MarkupAccumulator::appendDocumentType(Vector<UChar>& result, const DocumentType* n)
-{
-    if (n->name().isEmpty())
-        return;
-
-    append(result, "<!DOCTYPE ");
-    append(result, n->name());
-    if (!n->publicId().isEmpty()) {
-        append(result, " PUBLIC \"");
-        append(result, n->publicId());
-        append(result, "\"");
-        if (!n->systemId().isEmpty()) {
-            append(result, " \"");
-            append(result, n->systemId());
-            append(result, "\"");
-        }
-    } else if (!n->systemId().isEmpty()) {
-        append(result, " SYSTEM \"");
-        append(result, n->systemId());
-        append(result, "\"");
-    }
-    if (!n->internalSubset().isEmpty()) {
-        append(result, " [");
-        append(result, n->internalSubset());
-        append(result, "]");
-    }
-    append(result, ">");
-}
-
-void MarkupAccumulator::appendProcessingInstruction(Vector<UChar>& out, const String& target, const String& data)
-{
-    // FIXME: PI data is not escaped, but XMLSerializer (and possibly other callers) this should raise an exception if it includes "?>".
-    append(out, "<?");
-    append(out, target);
-    append(out, " ");
-    append(out, data);
-    append(out, "?>");
-}
-
-void MarkupAccumulator::appendElement(Vector<UChar>& out, Element* element, Namespaces* namespaces)
-{
-    appendOpenTag(out, element, namespaces);
-
-    NamedNodeMap* attributes = element->attributes();
-    unsigned length = attributes->length();
-    for (unsigned int i = 0; i < length; i++)
-        appendAttribute(out, element, *attributes->attributeItem(i), namespaces);
-
-    appendCloseTag(out, element);
-}
-
-void MarkupAccumulator::appendOpenTag(Vector<UChar>& out, Element* element, Namespaces* namespaces)
-{
-    out.append('<');
-    append(out, element->nodeNamePreservingCase());
-    if (!element->document()->isHTMLDocument() && namespaces && shouldAddNamespaceElement(element))
-        appendNamespace(out, element->prefix(), element->namespaceURI(), *namespaces);    
-}
-
-void MarkupAccumulator::appendCloseTag(Vector<UChar>& out, Element* element)
-{
-    if (shouldSelfClose(element)) {
-        if (element->isHTMLElement())
-            out.append(' '); // XHTML 1.0 <-> HTML compatibility.
-        out.append('/');
-    }
-    out.append('>');
-}
-
-void MarkupAccumulator::appendAttribute(Vector<UChar>& out, Element* element, const Attribute& attribute, Namespaces* namespaces)
-{
-    bool documentIsHTML = element->document()->isHTMLDocument();
-
-    out.append(' ');
-
-    if (documentIsHTML)
-        append(out, attribute.name().localName());
-    else
-        append(out, attribute.name().toString());
-
-    out.append('=');
-
-    if (element->isURLAttribute(const_cast<Attribute*>(&attribute))) {
-        // We don't want to complete file:/// URLs because it may contain sensitive information
-        // about the user's system.
-        if (shouldResolveURLs() && !element->document()->url().isLocalFile())
-            appendQuotedURLAttributeValue(out, element->document()->completeURL(attribute.value()).string());
-        else
-            appendQuotedURLAttributeValue(out, attribute.value()); 
-    } else {
-        out.append('\"');
-        appendAttributeValue(out, attribute.value(), documentIsHTML);
-        out.append('\"');
-    }
-
-    if (!documentIsHTML && namespaces && shouldAddNamespaceAttribute(attribute, *namespaces))
-        appendNamespace(out, attribute.prefix(), attribute.namespaceURI(), *namespaces);
-}
-
-void MarkupAccumulator::appendCDATASection(Vector<UChar>& out, const String& section)
-{
-    // FIXME: CDATA content is not escaped, but XMLSerializer (and possibly other callers) should raise an exception if it includes "]]>".
-    append(out, "<![CDATA[");
-    append(out, section);
-    append(out, "]]>");
-}
-
-void MarkupAccumulator::appendStartMarkup(Vector<UChar>& result, const Node* node, Namespaces* namespaces)
-{
-    if (namespaces)
-        namespaces->checkConsistency();
-
-    switch (node->nodeType()) {
-    case Node::TEXT_NODE:
-        appendText(result, static_cast<Text*>(const_cast<Node*>(node)));
-        break;
-    case Node::COMMENT_NODE:
-        appendComment(result, static_cast<const Comment*>(node)->data());
-        break;
-    case Node::DOCUMENT_NODE:
-    case Node::DOCUMENT_FRAGMENT_NODE:
-        break;
-    case Node::DOCUMENT_TYPE_NODE:
-        appendDocumentType(result, static_cast<const DocumentType*>(node));
-        break;
-    case Node::PROCESSING_INSTRUCTION_NODE:
-        appendProcessingInstruction(result, static_cast<const ProcessingInstruction*>(node)->target(), static_cast<const ProcessingInstruction*>(node)->data());
-        break;
-    case Node::ELEMENT_NODE:
-        appendElement(result, static_cast<Element*>(const_cast<Node*>(node)), namespaces);
-        break;
-    case Node::CDATA_SECTION_NODE:
-        appendCDATASection(result, static_cast<const CDATASection*>(node)->data());
-        break;
-    case Node::ATTRIBUTE_NODE:
-    case Node::ENTITY_NODE:
-    case Node::ENTITY_REFERENCE_NODE:
-    case Node::NOTATION_NODE:
-    case Node::XPATH_NAMESPACE_NODE:
-        ASSERT_NOT_REACHED();
-        break;
-    }
-}
-
-static inline bool elementCannotHaveEndTag(const Node *node)
-{
-    if (!node->isHTMLElement())
-        return false;
-
-    // FIXME: ieForbidsInsertHTML may not be the right function to call here
-    // ieForbidsInsertHTML is used to disallow setting innerHTML/outerHTML
-    // or createContextualFragment.  It does not necessarily align with
-    // which elements should be serialized w/o end tags.
-    return static_cast<const HTMLElement*>(node)->ieForbidsInsertHTML();
-}
-
-// Rules of self-closure
-// 1. No elements in HTML documents use the self-closing syntax.
-// 2. Elements w/ children never self-close because they use a separate end tag.
-// 3. HTML elements which do not have a "forbidden" end tag will close with a separate end tag.
-// 4. Other elements self-close.
-bool MarkupAccumulator::shouldSelfClose(const Node* node)
-{
-    if (node->document()->isHTMLDocument())
-        return false;
-    if (node->hasChildNodes())
-        return false;
-    if (node->isHTMLElement() && !elementCannotHaveEndTag(node))
-        return false;
-    return true;
-}
-
-void MarkupAccumulator::appendEndMarkup(Vector<UChar>& result, const Node* node)
-{
-    if (!node->isElementNode() || shouldSelfClose(node) || (!node->hasChildNodes() && elementCannotHaveEndTag(node)))
-        return;
-
-    result.append('<');
-    result.append('/');
-    append(result, static_cast<const Element*>(node)->nodeNamePreservingCase());
-    result.append('>');
-}
 
 static void completeURLs(Node* node, const String& baseURL)
 {
@@ -576,11 +127,14 @@ public:
     , m_shouldAnnotate(shouldAnnotate)
     {
     }
+
+    Node* serializeNodes(Node* startNode, Node* pastEnd);
+    void appendString(const String& s) { return MarkupAccumulator::appendString(s); }
     void wrapWithNode(Node*, bool convertBlocksToInlines = false, RangeFullySelectsNode = DoesFullySelectNode);
     void wrapWithStyleNode(CSSStyleDeclaration*, Document*, bool isBlock = false);
     String takeResults();
 
-protected:
+private:
     virtual void appendText(Vector<UChar>& out, Text*);
     String renderedText(const Node*, const Range*);
     String stringValueForRange(const Node*, const Range*);
@@ -590,7 +144,6 @@ protected:
 
     bool shouldAnnotate() { return m_shouldAnnotate == AnnotateForInterchange; }
 
-private:
     Vector<String> m_reversedPrecedingMarkup;
     const EAnnotateForInterchange m_shouldAnnotate;
 };
@@ -623,29 +176,18 @@ void StyledMarkupAccumulator::wrapWithStyleNode(CSSStyleDeclaration* style, Docu
     openTag.append('\"');
     openTag.append('>');
     m_reversedPrecedingMarkup.append(String::adopt(openTag));
-    m_succeedingMarkup.append(isBlock ? divClose : styleSpanClose);
+    appendString(isBlock ? divClose : styleSpanClose);
 }
 
 String StyledMarkupAccumulator::takeResults()
 {
-    size_t length = 0;
-
-    size_t preCount = m_reversedPrecedingMarkup.size();
-    for (size_t i = 0; i < preCount; ++i)
-        length += m_reversedPrecedingMarkup[i].length();
-
-    size_t postCount = m_succeedingMarkup.size();
-    for (size_t i = 0; i < postCount; ++i)
-        length += m_succeedingMarkup[i].length();
-
     Vector<UChar> result;
-    result.reserveInitialCapacity(length);
+    result.reserveInitialCapacity(totalLength(m_reversedPrecedingMarkup) + length());
 
-    for (size_t i = preCount; i > 0; --i)
+    for (size_t i = m_reversedPrecedingMarkup.size(); i > 0; --i)
         append(result, m_reversedPrecedingMarkup[i - 1]);
 
-    for (size_t i = 0; i < postCount; ++i)
-        append(result, m_succeedingMarkup[i]);
+    concatenateMarkup(result);
 
     return String::adopt(result);
 }
@@ -779,7 +321,7 @@ void StyledMarkupAccumulator::removeExteriorStyles(CSSMutableStyleDeclaration* s
     style->removeProperty(CSSPropertyFloat);
 }
 
-static Node* serializeNodes(StyledMarkupAccumulator& accumulator, Node* startNode, Node* pastEnd)
+Node* StyledMarkupAccumulator::serializeNodes(Node* startNode, Node* pastEnd)
 {
     Vector<Node*> ancestorsToClose;
     Node* next;
@@ -807,11 +349,11 @@ static Node* serializeNodes(StyledMarkupAccumulator& accumulator, Node* startNod
                 next = pastEnd;
         } else {
             // Add the node to the markup if we're not skipping the descendants
-            accumulator.appendStartTag(n);
+            appendStartTag(n);
 
             // If node has no children, close the tag now.
             if (!n->childNodeCount()) {
-                accumulator.appendEndTag(n);
+                appendEndTag(n);
                 lastClosed = n;
             } else {
                 openedTag = true;
@@ -828,22 +370,22 @@ static Node* serializeNodes(StyledMarkupAccumulator& accumulator, Node* startNod
                 if (next != pastEnd && next->isDescendantOf(ancestor))
                     break;
                 // Not at the end of the range, close ancestors up to sibling of next node.
-                accumulator.appendEndTag(ancestor);
+                appendEndTag(ancestor);
                 lastClosed = ancestor;
                 ancestorsToClose.removeLast();
             }
 
             // Surround the currently accumulated markup with markup for ancestors we never opened as we leave the subtree(s) rooted at those ancestors.
-            Node* nextParent = next ? next->parentNode() : 0;
+            ContainerNode* nextParent = next ? next->parentNode() : 0;
             if (next != pastEnd && n != nextParent) {
                 Node* lastAncestorClosedOrSelf = n->isDescendantOf(lastClosed) ? lastClosed : n;
-                for (Node *parent = lastAncestorClosedOrSelf->parent(); parent && parent != nextParent; parent = parent->parentNode()) {
+                for (ContainerNode* parent = lastAncestorClosedOrSelf->parent(); parent && parent != nextParent; parent = parent->parentNode()) {
                     // All ancestors that aren't in the ancestorsToClose list should either be a) unrendered:
                     if (!parent->renderer())
                         continue;
                     // or b) ancestors that we never encountered during a pre-order traversal starting at startNode:
                     ASSERT(startNode->isDescendantOf(parent));
-                    accumulator.wrapWithNode(parent);
+                    wrapWithNode(parent);
                     lastClosed = parent;
                 }
             }
@@ -861,7 +403,7 @@ static Node* ancestorToRetainStructureAndAppearance(Node* commonAncestor)
         return 0;
 
     if (commonAncestorBlock->hasTagName(tbodyTag) || commonAncestorBlock->hasTagName(trTag)) {
-        Node* table = commonAncestorBlock->parentNode();
+        ContainerNode* table = commonAncestorBlock->parentNode();
         while (table && !table->hasTagName(tableTag))
             table = table->parentNode();
 
@@ -1067,11 +609,11 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
 
     Node* specialCommonAncestor = highestAncestorToWrapMarkup(updatedRange.get(), fullySelectedRoot, shouldAnnotate);
 
-    Node* lastClosed = serializeNodes(accumulator, startNode, pastEnd);
+    Node* lastClosed = accumulator.serializeNodes(startNode, pastEnd);
 
     if (specialCommonAncestor && lastClosed) {
         // Also include all of the ancestors of lastClosed up to this special ancestor.
-        for (Node* ancestor = lastClosed->parentNode(); ancestor; ancestor = ancestor->parentNode()) {
+        for (ContainerNode* ancestor = lastClosed->parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor == fullySelectedRoot && !convertBlocksToInlines) {
                 RefPtr<CSSMutableStyleDeclaration> fullySelectedRootStyle = styleFromMatchedRulesAndInlineDecl(fullySelectedRoot);
 
@@ -1106,7 +648,7 @@ String createMarkup(const Range* range, Vector<Node*>* nodes, EAnnotateForInterc
     }
 
     // Add a wrapper span with the styles that all of the nodes in the markup inherit.
-    Node* parentOfLastClosed = lastClosed ? lastClosed->parentNode() : 0;
+    ContainerNode* parentOfLastClosed = lastClosed ? lastClosed->parentNode() : 0;
     if (parentOfLastClosed && parentOfLastClosed->renderer()) {
         RefPtr<CSSMutableStyleDeclaration> style = ApplyStyleCommand::editingStyleAtPosition(Position(parentOfLastClosed, 0));
 
@@ -1163,27 +705,6 @@ PassRefPtr<DocumentFragment> createFragmentFromMarkup(Document* document, const
     return fragment.release();
 }
 
-static void serializeNodesWithNamespaces(MarkupAccumulator& accumulator, Node* node, Node* nodeToSkip, EChildrenOnly childrenOnly, const Namespaces* namespaces)
-{
-    if (node == nodeToSkip)
-        return;
-
-    Namespaces namespaceHash;
-    if (namespaces)
-        namespaceHash = *namespaces;
-
-    if (!childrenOnly)
-        accumulator.appendStartTag(node, &namespaceHash);
-
-    if (!(node->document()->isHTMLDocument() && elementCannotHaveEndTag(node))) {
-        for (Node* current = node->firstChild(); current; current = current->nextSibling())
-            serializeNodesWithNamespaces(accumulator, current, nodeToSkip, IncludeNode, &namespaceHash);
-    }
-
-    if (!childrenOnly)
-        accumulator.appendEndTag(node);
-}
-
 String createMarkup(const Node* node, EChildrenOnly childrenOnly, Vector<Node*>* nodes, EAbsoluteURLs shouldResolveURLs)
 {
     if (!node)
@@ -1197,8 +718,7 @@ String createMarkup(const Node* node, EChildrenOnly childrenOnly, Vector<Node*>*
     }
 
     MarkupAccumulator accumulator(nodes, shouldResolveURLs);
-    serializeNodesWithNamespaces(accumulator, const_cast<Node*>(node), deleteButtonContainerElement, childrenOnly, 0);
-    return accumulator.takeResults();
+    return accumulator.serializeNodes(const_cast<Node*>(node), deleteButtonContainerElement, childrenOnly);
 }
 
 static void fillContainerFromString(ContainerNode* paragraph, const String& string)
diff --git a/WebCore/features.pri b/WebCore/features.pri
index f8b4bc3..0a39b16 100644
--- a/WebCore/features.pri
+++ b/WebCore/features.pri
@@ -61,7 +61,6 @@ contains(DEFINES, ENABLE_SINGLE_THREADED=1) {
 !contains(DEFINES, ENABLE_XHTMLMP=.): DEFINES += ENABLE_XHTMLMP=0
 !contains(DEFINES, ENABLE_DATAGRID=.): DEFINES += ENABLE_DATAGRID=0
 !contains(DEFINES, ENABLE_RUBY=.): DEFINES += ENABLE_RUBY=1
-!contains(DEFINES, ENABLE_SANDBOX=.): DEFINES += ENABLE_SANDBOX=1
 !contains(DEFINES, ENABLE_METER_TAG=.): DEFINES += ENABLE_METER_TAG=1
 !contains(DEFINES, ENABLE_PROGRESS_TAG=.): DEFINES += ENABLE_PROGRESS_TAG=1
 !contains(DEFINES, ENABLE_BLOB=.): DEFINES += ENABLE_BLOB=0
diff --git a/WebCore/fileapi/Blob.cpp b/WebCore/fileapi/Blob.cpp
index d5a5602..90df3c4 100644
--- a/WebCore/fileapi/Blob.cpp
+++ b/WebCore/fileapi/Blob.cpp
@@ -86,7 +86,7 @@ PassRefPtr<Blob> Blob::slice(long long start, long long length, const String& co
     if (start >= size) {
         start = 0;
         length = 0;
-    } else if (start + length > size)
+    } else if (start + length > size || length > std::numeric_limits<long long>::max() - start)
         length = size - start;
 
     OwnPtr<BlobData> blobData = BlobData::create();
diff --git a/WebCore/fileapi/BlobBuilder.cpp b/WebCore/fileapi/BlobBuilder.cpp
index 34864a5..69443a5 100644
--- a/WebCore/fileapi/BlobBuilder.cpp
+++ b/WebCore/fileapi/BlobBuilder.cpp
@@ -41,36 +41,6 @@
 
 namespace WebCore {
 
-static CString convertToCString(const String& text, const String& endingType, ExceptionCode& ec)
-{
-    DEFINE_STATIC_LOCAL(AtomicString, transparent, ("transparent"));
-    DEFINE_STATIC_LOCAL(AtomicString, native, ("native"));
-
-    ec = 0;
-
-    if (endingType.isEmpty() || endingType == transparent)
-        return UTF8Encoding().encode(text.characters(), text.length(), EntitiesForUnencodables);
-    if (endingType == native)
-        return normalizeLineEndingsToNative(UTF8Encoding().encode(text.characters(), text.length(), EntitiesForUnencodables));
-
-    ec = SYNTAX_ERR;
-    return CString();
-}
-
-static CString concatenateTwoCStrings(const CString& a, const CString& b)
-{
-    if (a.isNull() && b.isNull())
-        return CString();
-
-    char* q;
-    CString result = CString::newUninitialized(a.length() + b.length(), q);
-    if (a.length())
-        memcpy(q, a.data(), a.length());
-    if (b.length())
-        memcpy(q + a.length(), b.data(), b.length());
-    return result;
-}
-
 BlobBuilder::BlobBuilder()
     : m_size(0)
 {
@@ -78,17 +48,30 @@ BlobBuilder::BlobBuilder()
 
 bool BlobBuilder::append(const String& text, const String& endingType, ExceptionCode& ec)
 {
-    CString cstr = convertToCString(text, endingType, ec);
-    if (ec)
-        return false;
+    bool isEndingTypeTransparent = endingType == "transparent";
+    bool isEndingTypeNative = endingType == "native";
+    if (!endingType.isEmpty() && !isEndingTypeTransparent && !isEndingTypeNative) {
+        ec = SYNTAX_ERR;
+        return 0;
+    }
+
+    CString utf8Text = UTF8Encoding().encode(text.characters(), text.length(), EntitiesForUnencodables);
 
-    m_size += cstr.length();
+    // If the last item is not a data item, create one. Otherwise, we simply append the new string to the last data item.
+    if (m_items.isEmpty() || m_items[m_items.size() - 1].type != BlobDataItem::Data)
+        m_items.append(BlobDataItem(RawData::create()));
+
+    if (!utf8Text.isNull()) {
+        Vector<char>& buffer = *m_items[m_items.size() - 1].data->mutableData();
+        size_t oldSize = buffer.size();
+
+        if (isEndingTypeNative)
+            normalizeLineEndingsToNative(utf8Text, buffer);
+        else
+            buffer.append(utf8Text.data(), utf8Text.length());
+        m_size += buffer.size() - oldSize;
+    }
 
-    // If the last item is a string, concatenate it with current string.
-    if (!m_items.isEmpty() && m_items[m_items.size() - 1].type == BlobDataItem::Data)
-        m_items[m_items.size() - 1].data = concatenateTwoCStrings(m_items[m_items.size() - 1].data, cstr);
-    else
-        m_items.append(BlobDataItem(cstr));
     return true;
 }
 
diff --git a/WebCore/fileapi/DOMFileSystem.cpp b/WebCore/fileapi/DOMFileSystem.cpp
index 2bd09c2..f38acaa 100644
--- a/WebCore/fileapi/DOMFileSystem.cpp
+++ b/WebCore/fileapi/DOMFileSystem.cpp
@@ -36,31 +36,21 @@
 #include "AsyncFileSystem.h"
 #include "DOMFilePath.h"
 #include "DirectoryEntry.h"
-#include "EntriesCallback.h"
-#include "Entry.h"
-#include "EntryArray.h"
-#include "EntryCallback.h"
 #include "ErrorCallback.h"
+#include "File.h"
 #include "FileEntry.h"
-#include "FileError.h"
 #include "FileSystemCallbacks.h"
 #include "FileWriter.h"
 #include "FileWriterCallback.h"
 #include "MetadataCallback.h"
 #include "ScriptExecutionContext.h"
-#include "VoidCallback.h"
 #include <wtf/OwnPtr.h>
 
 namespace WebCore {
 
 DOMFileSystem::DOMFileSystem(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
-    : ActiveDOMObject(context, this)
-    , m_name(name)
-    , m_asyncFileSystem(asyncFileSystem)
-{
-}
-
-DOMFileSystem::~DOMFileSystem()
+    : DOMFileSystemBase(name, asyncFileSystem)
+    , ActiveDOMObject(context, this)
 {
 }
 
@@ -85,140 +75,21 @@ void DOMFileSystem::contextDestroyed()
     ActiveDOMObject::contextDestroyed();
 }
 
-void DOMFileSystem::getMetadata(const Entry* entry, PassRefPtr<MetadataCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(entry->fullPath());
-    m_asyncFileSystem->readMetadata(platformPath, MetadataCallbacks::create(successCallback, errorCallback));
-}
-
-static bool checkValidityForForCopyOrMove(const Entry* src, Entry* parent, const String& newName)
-{
-    ASSERT(src);
-
-    if (!parent || !parent->isDirectory())
-        return false;
-
-    if (!newName.isEmpty() && !DOMFilePath::isValidName(newName))
-        return false;
-
-    // It is an error to try to copy or move an entry inside itself at any depth if it is a directory.
-    if (src->isDirectory() && DOMFilePath::isParentOf(src->fullPath(), parent->fullPath()))
-        return false;
-
-    // It is an error to copy or move an entry into its parent if a name different from its current one isn't provided.
-    if ((newName.isEmpty() || src->name() == newName) && DOMFilePath::getDirectory(src->fullPath()) == parent->fullPath())
-        return false;
-
-    return true;
-}
-
-void DOMFileSystem::move(const Entry* src, PassRefPtr<Entry> parent, const String& newName, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!checkValidityForForCopyOrMove(src, parent.get(), newName)) {
-        scheduleCallback(scriptExecutionContext(), errorCallback, FileError::create(INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    String destPath = parent->fullPath();
-    if (!newName.isEmpty())
-        destPath = DOMFilePath::append(destPath, newName);
-    else
-        destPath = DOMFilePath::append(destPath, src->name());
-
-    String srcPlatformPath = m_asyncFileSystem->virtualToPlatformPath(src->fullPath());
-    String destPlatformPath = parent->filesystem()->asyncFileSystem()->virtualToPlatformPath(destPath);
-    m_asyncFileSystem->move(srcPlatformPath, destPlatformPath, EntryCallbacks::create(successCallback, errorCallback, this, destPath, src->isDirectory()));
-}
-
-void DOMFileSystem::copy(const Entry* src, PassRefPtr<Entry> parent, const String& newName, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    if (!checkValidityForForCopyOrMove(src, parent.get(), newName)) {
-        scheduleCallback(scriptExecutionContext(), errorCallback, FileError::create(INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    String destPath = parent->fullPath();
-    if (!newName.isEmpty())
-        destPath = DOMFilePath::append(destPath, newName);
-    else
-        destPath = DOMFilePath::append(destPath, src->name());
-
-    String srcPlatformPath = m_asyncFileSystem->virtualToPlatformPath(src->fullPath());
-    String destPlatformPath = parent->filesystem()->asyncFileSystem()->virtualToPlatformPath(destPath);
-    m_asyncFileSystem->copy(srcPlatformPath, destPlatformPath, EntryCallbacks::create(successCallback, errorCallback, this, destPath, src->isDirectory()));
-}
-
-void DOMFileSystem::remove(const Entry* entry, PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    ASSERT(entry);
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(entry->fullPath());
-    m_asyncFileSystem->remove(platformPath, VoidCallbacks::create(successCallback, errorCallback));
-}
-
-void DOMFileSystem::getParent(const Entry* entry, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    ASSERT(entry);
-    String path = DOMFilePath::getDirectory(entry->fullPath());
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(path);
-    m_asyncFileSystem->directoryExists(platformPath, EntryCallbacks::create(successCallback, errorCallback, this, path, true));
-}
-
-void DOMFileSystem::getFile(const Entry* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    ASSERT(base);
-    if (!DOMFilePath::isValidPath(path)) {
-        scheduleCallback(scriptExecutionContext(), errorCallback, FileError::create(INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    String absolutePath = path;
-    if (!DOMFilePath::isAbsolute(path))
-        absolutePath = DOMFilePath::removeExtraParentReferences(DOMFilePath::append(base->fullPath(), path));
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(absolutePath);
-
-    OwnPtr<EntryCallbacks> callbacks = EntryCallbacks::create(successCallback, errorCallback, this, absolutePath, false);
-    if (flags && flags->isCreate())
-        m_asyncFileSystem->createFile(platformPath, flags->isExclusive(), callbacks.release());
-    else
-        m_asyncFileSystem->fileExists(platformPath, callbacks.release());
-}
-
-void DOMFileSystem::getDirectory(const Entry* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
-{
-    ASSERT(base);
-    if (!DOMFilePath::isValidPath(path)) {
-        scheduleCallback(scriptExecutionContext(), errorCallback, FileError::create(INVALID_MODIFICATION_ERR));
-        return;
-    }
-
-    String absolutePath = path;
-    if (!DOMFilePath::isAbsolute(path))
-        absolutePath = DOMFilePath::removeExtraParentReferences(DOMFilePath::append(base->fullPath(), path));
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(absolutePath);
-
-    OwnPtr<EntryCallbacks> callbacks = EntryCallbacks::create(successCallback, errorCallback, this, absolutePath, true);
-    if (flags && flags->isCreate())
-        m_asyncFileSystem->createDirectory(platformPath, flags->isExclusive(), callbacks.release());
-    else
-        m_asyncFileSystem->directoryExists(platformPath, callbacks.release());
-}
-
-void DOMFileSystem::createWriter(const FileEntry* file, PassRefPtr<FileWriterCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMFileSystem::createWriter(const FileEntry* fileEntry, PassRefPtr<FileWriterCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    ASSERT(file);
+    ASSERT(fileEntry);
 
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(file->fullPath());
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
 
     RefPtr<FileWriter> fileWriter = FileWriter::create(scriptExecutionContext());
     OwnPtr<FileWriterCallbacks> callbacks = FileWriterCallbacks::create(fileWriter, successCallback, errorCallback);
     m_asyncFileSystem->createWriter(fileWriter.get(), platformPath, callbacks.release());
 }
 
-void DOMFileSystem::readDirectory(const String& path, PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DOMFileSystem::createFile(const FileEntry* fileEntry, PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback>)
 {
-    ASSERT(DOMFilePath::isAbsolute(path));
-    String platformPath = m_asyncFileSystem->virtualToPlatformPath(path);
-    m_asyncFileSystem->readDirectory(platformPath, EntriesCallbacks::create(successCallback, errorCallback, this, path));
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
+    scheduleCallback(successCallback, File::create(platformPath));
 }
 
 } // namespace
diff --git a/WebCore/fileapi/DOMFileSystem.h b/WebCore/fileapi/DOMFileSystem.h
index 881ffc5..1d820f1 100644
--- a/WebCore/fileapi/DOMFileSystem.h
+++ b/WebCore/fileapi/DOMFileSystem.h
@@ -34,35 +34,24 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "ActiveDOMObject.h"
-#include "AsyncFileSystem.h"
-#include "Flags.h"
-#include "PlatformString.h"
+#include "DOMFileSystemBase.h"
 #include "ScriptExecutionContext.h"
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
 class DirectoryEntry;
-class Entry;
-class EntryCallback;
-class EntriesCallback;
-class ErrorCallback;
+class File;
+class FileCallback;
 class FileEntry;
 class FileWriterCallback;
-class MetadataCallback;
-class VoidCallback;
 
-class DOMFileSystem : public RefCounted<DOMFileSystem>, public ActiveDOMObject {
+class DOMFileSystem : public DOMFileSystemBase, public ActiveDOMObject {
 public:
     static PassRefPtr<DOMFileSystem> create(ScriptExecutionContext* context, const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
     {
         return adoptRef(new DOMFileSystem(context, name, asyncFileSystem));
     }
 
-    virtual ~DOMFileSystem();
-
-    const String& name() const { return m_name; }
     PassRefPtr<DirectoryEntry> root();
 
     // ActiveDOMObject methods.
@@ -70,28 +59,24 @@ public:
     virtual bool hasPendingActivity() const;
     virtual void contextDestroyed();
 
-    // Actual FileSystem API implementations.  All the validity checks on virtual paths are done at DOMFileSystem level.
-    void getMetadata(const Entry* entry, PassRefPtr<MetadataCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback);
-    void move(const Entry* src, PassRefPtr<Entry> parent, const String& name, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    void copy(const Entry* src, PassRefPtr<Entry> parent, const String& name, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    void remove(const Entry* entry, PassRefPtr<VoidCallback>, PassRefPtr<ErrorCallback>);
-    void getParent(const Entry* entry, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    void getFile(const Entry* base, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    void getDirectory(const Entry* base, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
-    void readDirectory(const String& path, PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>);
-    void createWriter(const FileEntry* file, PassRefPtr<FileWriterCallback>, PassRefPtr<ErrorCallback>);
+    void createWriter(const FileEntry*, PassRefPtr<FileWriterCallback>, PassRefPtr<ErrorCallback>);
+    void createFile(const FileEntry*, PassRefPtr<FileCallback>, PassRefPtr<ErrorCallback>);
 
     // Schedule a callback. This should not cross threads (should be called on the same context thread).
+    // FIXME: move this to a more generic place.
     template <typename CB, typename CBArg>
     static void scheduleCallback(ScriptExecutionContext*, PassRefPtr<CB>, PassRefPtr<CBArg>);
 
+    template <typename CB, typename CBArg>
+    void scheduleCallback(PassRefPtr<CB> callback, PassRefPtr<CBArg> callbackArg)
+    {
+        scheduleCallback(scriptExecutionContext(), callback, callbackArg);
+    }
+
 private:
     DOMFileSystem(ScriptExecutionContext*, const String& name, PassOwnPtr<AsyncFileSystem>);
 
-    AsyncFileSystem* asyncFileSystem() const { return m_asyncFileSystem.get(); }
-
     // A helper template to schedule a callback task.
-    // FIXME: move this to a more generic place.
     template <typename CB, typename CBArg>
     class DispatchCallbackTask : public ScriptExecutionContext::Task {
     public:
@@ -110,15 +95,13 @@ private:
         RefPtr<CB> m_callback;
         RefPtr<CBArg> m_callbackArg;
     };
-
-    String m_name;
-    mutable OwnPtr<AsyncFileSystem> m_asyncFileSystem;
 };
 
 template <typename CB, typename CBArg>
 void DOMFileSystem::scheduleCallback(ScriptExecutionContext* scriptExecutionContext, PassRefPtr<CB> callback, PassRefPtr<CBArg> arg)
 {
     ASSERT(scriptExecutionContext->isContextThread());
+    ASSERT(callback);
     scriptExecutionContext->postTask(new DispatchCallbackTask<CB, CBArg>(callback, arg));
 }
 
diff --git a/WebCore/fileapi/DOMFileSystemBase.cpp b/WebCore/fileapi/DOMFileSystemBase.cpp
new file mode 100644
index 0000000..fefe99f
--- /dev/null
+++ b/WebCore/fileapi/DOMFileSystemBase.cpp
@@ -0,0 +1,203 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMFileSystemBase.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFilePath.h"
+#include "DirectoryEntry.h"
+#include "EntriesCallback.h"
+#include "EntryArray.h"
+#include "EntryBase.h"
+#include "EntryCallback.h"
+#include "ErrorCallback.h"
+#include "FileError.h"
+#include "FileSystemCallbacks.h"
+#include "MetadataCallback.h"
+#include "VoidCallback.h"
+#include <wtf/OwnPtr.h>
+
+namespace WebCore {
+
+DOMFileSystemBase::DOMFileSystemBase(const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
+    : m_name(name)
+    , m_asyncFileSystem(asyncFileSystem)
+{
+}
+
+DOMFileSystemBase::~DOMFileSystemBase()
+{
+}
+
+bool DOMFileSystemBase::getMetadata(const EntryBase* entry, PassRefPtr<MetadataCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(entry->fullPath());
+    m_asyncFileSystem->readMetadata(platformPath, MetadataCallbacks::create(successCallback, errorCallback));
+    return true;
+}
+
+static bool verifyAndGetDestinationPathForCopyOrMove(const EntryBase* source, EntryBase* parent, const String& newName, String& destinationPath)
+{
+    ASSERT(source);
+
+    if (!parent || !parent->isDirectory())
+        return false;
+
+    if (!newName.isEmpty() && !DOMFilePath::isValidName(newName))
+        return false;
+
+    // It is an error to try to copy or move an entry inside itself at any depth if it is a directory.
+    if (source->isDirectory() && DOMFilePath::isParentOf(source->fullPath(), parent->fullPath()))
+        return false;
+
+    // It is an error to copy or move an entry into its parent if a name different from its current one isn't provided.
+    if ((newName.isEmpty() || source->name() == newName) && DOMFilePath::getDirectory(source->fullPath()) == parent->fullPath())
+        return false;
+
+    destinationPath = parent->fullPath();
+    if (!newName.isEmpty())
+        destinationPath = DOMFilePath::append(destinationPath, newName);
+    else
+        destinationPath = DOMFilePath::append(destinationPath, source->name());
+
+    return true;
+}
+
+static bool pathToAbsolutePath(const EntryBase* base, String path, String& absolutePath)
+{
+    ASSERT(base);
+
+    if (!DOMFilePath::isAbsolute(path))
+        path = DOMFilePath::append(base->fullPath(), path);
+    absolutePath = DOMFilePath::removeExtraParentReferences(path);
+
+    if (!DOMFilePath::isValidPath(absolutePath))
+        return false;
+    return true;
+}
+
+bool DOMFileSystemBase::move(const EntryBase* source, EntryBase* parent, const String& newName, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    String destinationPath;
+    if (!verifyAndGetDestinationPathForCopyOrMove(source, parent, newName, destinationPath))
+        return false;
+
+    String sourcePlatformPath = m_asyncFileSystem->virtualToPlatformPath(source->fullPath());
+    String destinationPlatformPath = parent->filesystem()->asyncFileSystem()->virtualToPlatformPath(destinationPath);
+    m_asyncFileSystem->move(sourcePlatformPath, destinationPlatformPath, EntryCallbacks::create(successCallback, errorCallback, this, destinationPath, source->isDirectory()));
+    return true;
+}
+
+bool DOMFileSystemBase::copy(const EntryBase* source, EntryBase* parent, const String& newName, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    String destinationPath;
+    if (!verifyAndGetDestinationPathForCopyOrMove(source, parent, newName, destinationPath))
+        return false;
+
+    String sourcePlatformPath = m_asyncFileSystem->virtualToPlatformPath(source->fullPath());
+    String destinationPlatformPath = parent->filesystem()->asyncFileSystem()->virtualToPlatformPath(destinationPath);
+    m_asyncFileSystem->copy(sourcePlatformPath, destinationPlatformPath, EntryCallbacks::create(successCallback, errorCallback, this, destinationPath, source->isDirectory()));
+    return true;
+}
+
+bool DOMFileSystemBase::remove(const EntryBase* entry, PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ASSERT(entry);
+    // We don't allow calling remove() on the root directory.
+    if (entry->fullPath() == String(DOMFilePath::root))
+        return false;
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(entry->fullPath());
+    m_asyncFileSystem->remove(platformPath, VoidCallbacks::create(successCallback, errorCallback));
+    return true;
+}
+
+bool DOMFileSystemBase::removeRecursively(const EntryBase* entry, PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ASSERT(entry && entry->isDirectory());
+    // We don't allow calling remove() on the root directory.
+    if (entry->fullPath() == String(DOMFilePath::root))
+        return false;
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(entry->fullPath());
+    m_asyncFileSystem->removeRecursively(platformPath, VoidCallbacks::create(successCallback, errorCallback));
+    return true;
+}
+
+bool DOMFileSystemBase::getParent(const EntryBase* entry, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ASSERT(entry);
+    String path = DOMFilePath::getDirectory(entry->fullPath());
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(path);
+    m_asyncFileSystem->directoryExists(platformPath, EntryCallbacks::create(successCallback, errorCallback, this, path, true));
+    return true;
+}
+
+bool DOMFileSystemBase::getFile(const EntryBase* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    String absolutePath;
+    if (!pathToAbsolutePath(base, path, absolutePath))
+        return false;
+
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(absolutePath);
+    OwnPtr<EntryCallbacks> callbacks = EntryCallbacks::create(successCallback, errorCallback, this, absolutePath, false);
+    if (flags && flags->isCreate())
+        m_asyncFileSystem->createFile(platformPath, flags->isExclusive(), callbacks.release());
+    else
+        m_asyncFileSystem->fileExists(platformPath, callbacks.release());
+    return true;
+}
+
+bool DOMFileSystemBase::getDirectory(const EntryBase* base, const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    String absolutePath;
+    if (!pathToAbsolutePath(base, path, absolutePath))
+        return false;
+
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(absolutePath);
+    OwnPtr<EntryCallbacks> callbacks = EntryCallbacks::create(successCallback, errorCallback, this, absolutePath, true);
+    if (flags && flags->isCreate())
+        m_asyncFileSystem->createDirectory(platformPath, flags->isExclusive(), callbacks.release());
+    else
+        m_asyncFileSystem->directoryExists(platformPath, callbacks.release());
+    return true;
+}
+
+bool DOMFileSystemBase::readDirectory(DirectoryReaderBase* reader, const String& path, PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+{
+    ASSERT(DOMFilePath::isAbsolute(path));
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(path);
+    m_asyncFileSystem->readDirectory(platformPath, EntriesCallbacks::create(successCallback, errorCallback, reader, path));
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DOMFileSystemBase.h b/WebCore/fileapi/DOMFileSystemBase.h
new file mode 100644
index 0000000..36e35b4
--- /dev/null
+++ b/WebCore/fileapi/DOMFileSystemBase.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMFileSystemBase_h
+#define DOMFileSystemBase_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "Flags.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DirectoryEntry;
+class DirectoryReaderBase;
+class EntriesCallback;
+class EntryBase;
+class EntryCallback;
+class ErrorCallback;
+class MetadataCallback;
+class VoidCallback;
+
+// A common base class for DOMFileSystem and DOMFileSystemSync.
+class DOMFileSystemBase : public RefCounted<DOMFileSystemBase> {
+public:
+    static PassRefPtr<DOMFileSystemBase> create(const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
+    {
+        return adoptRef(new DOMFileSystemBase(name, asyncFileSystem));
+    }
+    virtual ~DOMFileSystemBase();
+
+    const String& name() const { return m_name; }
+    AsyncFileSystem* asyncFileSystem() const { return m_asyncFileSystem.get(); }
+
+    // Actual FileSystem API implementations.  All the validity checks on virtual paths are done at this level.
+    // They return false for immediate errors that don't involve lower AsyncFileSystem layer (e.g. for name validation errors).  Otherwise they return true (but later may call back with an runtime error).
+    bool getMetadata(const EntryBase*, PassRefPtr<MetadataCallback>, PassRefPtr<ErrorCallback>);
+    bool move(const EntryBase* source, EntryBase* parent, const String& name, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool copy(const EntryBase* source, EntryBase* parent, const String& name, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool remove(const EntryBase*, PassRefPtr<VoidCallback>, PassRefPtr<ErrorCallback>);
+    bool removeRecursively(const EntryBase*, PassRefPtr<VoidCallback>, PassRefPtr<ErrorCallback>);
+    bool getParent(const EntryBase*, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool getFile(const EntryBase*, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool getDirectory(const EntryBase*, const String& path, PassRefPtr<Flags>, PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>);
+    bool readDirectory(DirectoryReaderBase*, const String& path, PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>);
+
+protected:
+    DOMFileSystemBase(const String& name, PassOwnPtr<AsyncFileSystem>);
+    friend class DOMFileSystemSync;
+
+    String m_name;
+    mutable OwnPtr<AsyncFileSystem> m_asyncFileSystem;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DOMFileSystemBase_h
diff --git a/WebCore/fileapi/DOMFileSystemSync.cpp b/WebCore/fileapi/DOMFileSystemSync.cpp
new file mode 100644
index 0000000..3de64a7
--- /dev/null
+++ b/WebCore/fileapi/DOMFileSystemSync.cpp
@@ -0,0 +1,71 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DOMFileSystemSync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFilePath.h"
+#include "DirectoryEntrySync.h"
+#include "File.h"
+#include "FileEntrySync.h"
+
+namespace WebCore {
+
+PassRefPtr<DOMFileSystemSync> DOMFileSystemSync::create(DOMFileSystemBase* fileSystem)
+{
+    return adoptRef(new DOMFileSystemSync(fileSystem->m_name, fileSystem->m_asyncFileSystem.release()));
+}
+
+DOMFileSystemSync::DOMFileSystemSync(const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
+    : DOMFileSystemBase(name, asyncFileSystem)
+{
+}
+
+DOMFileSystemSync::~DOMFileSystemSync()
+{
+}
+
+PassRefPtr<DirectoryEntrySync> DOMFileSystemSync::root()
+{
+    return DirectoryEntrySync::create(this, DOMFilePath::root);
+}
+
+PassRefPtr<File> DOMFileSystemSync::createFile(const FileEntrySync* fileEntry, ExceptionCode& ec)
+{
+    ec = 0;
+    String platformPath = m_asyncFileSystem->virtualToPlatformPath(fileEntry->fullPath());
+    return File::create(platformPath);
+}
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DOMFileSystemSync.h b/WebCore/fileapi/DOMFileSystemSync.h
new file mode 100644
index 0000000..1856747
--- /dev/null
+++ b/WebCore/fileapi/DOMFileSystemSync.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DOMFileSystemSync_h
+#define DOMFileSystemSync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFileSystemBase.h"
+
+namespace WebCore {
+
+class DirectoryEntrySync;
+class File;
+class FileEntrySync;
+
+typedef int ExceptionCode;
+
+class DOMFileSystemSync : public DOMFileSystemBase {
+public:
+    static PassRefPtr<DOMFileSystemSync> create(const String& name, PassOwnPtr<AsyncFileSystem> asyncFileSystem)
+    {
+        return adoptRef(new DOMFileSystemSync(name, asyncFileSystem));
+    }
+
+    static PassRefPtr<DOMFileSystemSync> create(DOMFileSystemBase*);
+
+    virtual ~DOMFileSystemSync();
+
+    PassRefPtr<DirectoryEntrySync> root();
+
+    PassRefPtr<File> createFile(const FileEntrySync*, ExceptionCode&);
+
+private:
+    DOMFileSystemSync(const String& name, PassOwnPtr<AsyncFileSystem>);
+};
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DOMFileSystemSync_h
diff --git a/WebCore/fileapi/DOMFileSystemSync.idl b/WebCore/fileapi/DOMFileSystemSync.idl
new file mode 100644
index 0000000..b51d8cc
--- /dev/null
+++ b/WebCore/fileapi/DOMFileSystemSync.idl
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        NoStaticTables
+    ] DOMFileSystemSync {
+        readonly attribute DOMString name;
+        readonly attribute DirectoryEntrySync root;
+    };
+}
diff --git a/WebCore/fileapi/DirectoryEntry.cpp b/WebCore/fileapi/DirectoryEntry.cpp
index 95c12e4..765fcd5 100644
--- a/WebCore/fileapi/DirectoryEntry.cpp
+++ b/WebCore/fileapi/DirectoryEntry.cpp
@@ -36,10 +36,12 @@
 #include "DirectoryReader.h"
 #include "EntryCallback.h"
 #include "ErrorCallback.h"
+#include "FileError.h"
+#include "VoidCallback.h"
 
 namespace WebCore {
 
-DirectoryEntry::DirectoryEntry(DOMFileSystem* fileSystem, const String& fullPath)
+DirectoryEntry::DirectoryEntry(DOMFileSystemBase* fileSystem, const String& fullPath)
     : Entry(fileSystem, fullPath)
 {
 }
@@ -49,16 +51,27 @@ PassRefPtr<DirectoryReader> DirectoryEntry::createReader()
     return DirectoryReader::create(m_fileSystem, m_fullPath);
 }
 
-void DirectoryEntry::getFile(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DirectoryEntry::getFile(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
 {
-    m_fileSystem->getFile(this, path, flags, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->getFile(this, path, flags, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-void DirectoryEntry::getDirectory(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void DirectoryEntry::getDirectory(const String& path, PassRefPtr<Flags> flags, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
 {
-    m_fileSystem->getDirectory(this, path, flags, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->getDirectory(this, path, flags, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-} // namespace
+void DirectoryEntry::removeRecursively(PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef) const
+{
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->removeRecursively(this, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
+}
+
+}
 
 #endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DirectoryEntry.h b/WebCore/fileapi/DirectoryEntry.h
index c76b204..dd0159e 100644
--- a/WebCore/fileapi/DirectoryEntry.h
+++ b/WebCore/fileapi/DirectoryEntry.h
@@ -41,13 +41,15 @@
 
 namespace WebCore {
 
+class DOMFileSystemBase;
 class DirectoryReader;
 class EntryCallback;
 class ErrorCallback;
+class VoidCallback;
 
 class DirectoryEntry : public Entry {
 public:
-    static PassRefPtr<DirectoryEntry> create(DOMFileSystem* fileSystem, const String& fullPath)
+    static PassRefPtr<DirectoryEntry> create(DOMFileSystemBase* fileSystem, const String& fullPath)
     {
         return adoptRef(new DirectoryEntry(fileSystem, fullPath));
     }
@@ -56,9 +58,10 @@ public:
     PassRefPtr<DirectoryReader> createReader();
     void getFile(const String& path, PassRefPtr<Flags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
     void getDirectory(const String& path, PassRefPtr<Flags> = 0, PassRefPtr<EntryCallback> = 0, PassRefPtr<ErrorCallback> = 0);
+    void removeRecursively(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> = 0) const;
 
 private:
-    DirectoryEntry(DOMFileSystem* fileSystem, const String& fullPath);
+    DirectoryEntry(DOMFileSystemBase*, const String& fullPath);
 };
 
 } // namespace
diff --git a/WebCore/fileapi/DirectoryEntry.idl b/WebCore/fileapi/DirectoryEntry.idl
index 2880ed0..0e38153 100644
--- a/WebCore/fileapi/DirectoryEntry.idl
+++ b/WebCore/fileapi/DirectoryEntry.idl
@@ -38,5 +38,6 @@ module storage {
         DirectoryReader createReader();
         [Custom] void getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] Flags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         [Custom] void getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in [Optional] Flags flags, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        void removeRecursively(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
 }
diff --git a/WebCore/fileapi/DirectoryEntrySync.cpp b/WebCore/fileapi/DirectoryEntrySync.cpp
new file mode 100644
index 0000000..d8d22c2
--- /dev/null
+++ b/WebCore/fileapi/DirectoryEntrySync.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DirectoryEntrySync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DirectoryReaderSync.h"
+#include "EntrySync.h"
+#include "FileEntrySync.h"
+#include "SyncCallbackHelper.h"
+
+namespace WebCore {
+
+DirectoryEntrySync::DirectoryEntrySync(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : EntrySync(fileSystem, fullPath)
+{
+}
+
+PassRefPtr<DirectoryReaderSync> DirectoryEntrySync::createReader(ExceptionCode&)
+{
+    return DirectoryReaderSync::create(m_fileSystem, m_fullPath);
+}
+
+PassRefPtr<FileEntrySync> DirectoryEntrySync::getFile(const String& path, PassRefPtr<Flags> flags, ExceptionCode& ec)
+{
+    ec = 0;
+    EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->getFile(this, path, flags, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+    return static_pointer_cast<FileEntrySync>(helper.getResult(ec));
+}
+
+PassRefPtr<DirectoryEntrySync> DirectoryEntrySync::getDirectory(const String& path, PassRefPtr<Flags> flags, ExceptionCode& ec)
+{
+    ec = 0;
+    EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->getDirectory(this, path, flags, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+    return static_pointer_cast<DirectoryEntrySync>(helper.getResult(ec));
+}
+
+void DirectoryEntrySync::removeRecursively(ExceptionCode& ec)
+{
+    ec = 0;
+    VoidSyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->removeRecursively(this, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return;
+    }
+    helper.getResult(ec);
+}
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DirectoryEntrySync.h b/WebCore/fileapi/DirectoryEntrySync.h
new file mode 100644
index 0000000..9a3e0df
--- /dev/null
+++ b/WebCore/fileapi/DirectoryEntrySync.h
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DirectoryEntrySync_h
+#define DirectoryEntrySync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "EntrySync.h"
+#include "Flags.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DirectoryReaderSync;
+class FileEntrySync;
+
+class DirectoryEntrySync : public EntrySync {
+public:
+    static PassRefPtr<DirectoryEntrySync> create(DOMFileSystemBase* fileSystem, const String& fullPath)
+    {
+        return adoptRef(new DirectoryEntrySync(fileSystem, fullPath));
+    }
+    virtual bool isDirectory() const { return true; }
+
+    PassRefPtr<DirectoryReaderSync> createReader(ExceptionCode&);
+    PassRefPtr<FileEntrySync> getFile(const String& path, PassRefPtr<Flags>, ExceptionCode&);
+    PassRefPtr<DirectoryEntrySync> getDirectory(const String& path, PassRefPtr<Flags>, ExceptionCode&);
+    void removeRecursively(ExceptionCode&);
+
+private:
+    friend class EntrySync;
+    DirectoryEntrySync(DOMFileSystemBase*, const String& fullPath);
+};
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DirectoryEntrySync_h
diff --git a/WebCore/fileapi/DirectoryEntrySync.idl b/WebCore/fileapi/DirectoryEntrySync.idl
new file mode 100644
index 0000000..268b2a9
--- /dev/null
+++ b/WebCore/fileapi/DirectoryEntrySync.idl
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        GenerateNativeConverter,
+        GenerateToJS,
+        NoStaticTables
+    ] DirectoryEntrySync : EntrySync {
+        DirectoryReaderSync createReader() raises (FileException);
+        [Custom] FileEntrySync getFile(in [ConvertUndefinedOrNullToNullString] DOMString path, in Flags flags) raises (FileException);
+        [Custom] DirectoryEntrySync getDirectory(in [ConvertUndefinedOrNullToNullString] DOMString path, in Flags flags) raises (FileException);
+        void removeRecursively() raises (FileException);
+    };
+}
diff --git a/WebCore/fileapi/DirectoryReader.cpp b/WebCore/fileapi/DirectoryReader.cpp
index b0eef1c..3437675 100644
--- a/WebCore/fileapi/DirectoryReader.cpp
+++ b/WebCore/fileapi/DirectoryReader.cpp
@@ -33,23 +33,27 @@
 
 #if ENABLE(FILE_SYSTEM)
 
-#include "DOMFileSystem.h"
 #include "EntriesCallback.h"
+#include "EntryArray.h"
 #include "ErrorCallback.h"
+#include "FileError.h"
 
 namespace WebCore {
 
-DirectoryReader::DirectoryReader(PassRefPtr<DOMFileSystem> fileSystem, const String& fullPath)
-    : m_fileSystem(fileSystem)
-    , m_fullPath(fullPath)
+DirectoryReader::DirectoryReader(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : DirectoryReaderBase(fileSystem, fullPath)
 {
 }
 
 void DirectoryReader::readEntries(PassRefPtr<EntriesCallback> entriesCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    m_fileSystem->readDirectory(m_fullPath, entriesCallback, errorCallback);
+    if (!m_hasMoreEntries) {
+        filesystem()->scheduleCallback(entriesCallback, EntryArray::create());
+        return;
+    }
+    filesystem()->readDirectory(this, m_fullPath, entriesCallback, errorCallback);
 }
 
-} // namespace
+}
 
 #endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DirectoryReader.h b/WebCore/fileapi/DirectoryReader.h
index 0e2ef0f..806fdf1 100644
--- a/WebCore/fileapi/DirectoryReader.h
+++ b/WebCore/fileapi/DirectoryReader.h
@@ -34,6 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "DOMFileSystem.h"
+#include "DirectoryReaderBase.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -41,25 +42,25 @@
 namespace WebCore {
 
 class EntriesCallback;
+class EntriesCallbacks;
 class ErrorCallback;
 
-class DirectoryReader : public RefCounted<DirectoryReader> {
+class DirectoryReader : public DirectoryReaderBase {
 public:
-    static PassRefPtr<DirectoryReader> create(PassRefPtr<DOMFileSystem> fileSystem, const String& path)
+    static PassRefPtr<DirectoryReader> create(DOMFileSystemBase* fileSystem, const String& fullPath)
     {
-        return adoptRef(new DirectoryReader(fileSystem, path));
+        return adoptRef(new DirectoryReader(fileSystem, fullPath));
     }
 
-    void readEntries(PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback = 0);
+    void readEntries(PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback> = 0);
 
-private:
-    DirectoryReader(PassRefPtr<DOMFileSystem> fileSystem, const String& path);
+    DOMFileSystem* filesystem() const { return static_cast<DOMFileSystem*>(m_fileSystem); }
 
-    RefPtr<DOMFileSystem> m_fileSystem;
-    String m_fullPath;
+private:
+    DirectoryReader(DOMFileSystemBase*, const String& fullPath);
 };
 
-} // namespace
+}
 
 #endif // ENABLE(FILE_SYSTEM)
 
diff --git a/WebCore/bindings/v8/ScriptString.h b/WebCore/fileapi/DirectoryReaderBase.h
index 414818a..5a2c048 100644
--- a/WebCore/bindings/v8/ScriptString.h
+++ b/WebCore/fileapi/DirectoryReaderBase.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008, 2009 Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,47 +28,41 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptString_h
-#define ScriptString_h
+#ifndef DirectoryReaderBase_h
+#define DirectoryReaderBase_h
+
+#if ENABLE(FILE_SYSTEM)
 
+#include "DOMFileSystemBase.h"
 #include "PlatformString.h"
-#include "ScriptStringImpl.h"
-#include "V8Binding.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-class ScriptString {
+class DirectoryReaderBase : public RefCounted<DirectoryReaderBase> {
 public:
-    ScriptString() : m_impl(0) {}
-    ScriptString(const String& s) : m_impl(ScriptStringImpl::create(s)) {}
-    ScriptString(const char* s) : m_impl(ScriptStringImpl::create(s)) {}
-
-    operator String() const { return m_impl->toString(); }
+    DOMFileSystemBase* filesystem() const { return m_fileSystem; }
+    void setHasMoreEntries(bool hasMoreEntries) { m_hasMoreEntries = hasMoreEntries; }
 
-    bool isNull() const { return !m_impl.get() || m_impl->isNull(); }
-    size_t size() const { return m_impl->size(); }
-
-    ScriptString& operator=(const char* s)
+protected:
+    DirectoryReaderBase(DOMFileSystemBase* fileSystem, const String& fullPath)
+        : m_fileSystem(fileSystem)
+        , m_fullPath(fullPath)
+        , m_hasMoreEntries(true)
     {
-        m_impl = ScriptStringImpl::create(s);
-        return *this;
     }
 
-    ScriptString& operator+=(const String& s)
-    {
-        m_impl->append(s);
-        return *this;
-    }
+    DOMFileSystemBase* m_fileSystem;
 
-    v8::Handle<v8::Value> v8StringOrNull() const
-    {
-        return isNull() ? v8::Handle<v8::Value>(v8::Null()) : v8::Handle<v8::Value>(m_impl->v8StringHandle());
-    }
+    // This is a virtual path.
+    String m_fullPath;
 
-private:
-    RefPtr<ScriptStringImpl> m_impl;
+    bool m_hasMoreEntries;
 };
 
 } // namespace WebCore
 
-#endif // ScriptString_h
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DirectoryReaderBase_h
diff --git a/WebCore/fileapi/DirectoryReaderSync.cpp b/WebCore/fileapi/DirectoryReaderSync.cpp
new file mode 100644
index 0000000..6c66a15
--- /dev/null
+++ b/WebCore/fileapi/DirectoryReaderSync.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DirectoryReaderSync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DirectoryEntry.h"
+#include "DirectoryEntrySync.h"
+#include "EntryArraySync.h"
+#include "EntrySync.h"
+#include "ExceptionCode.h"
+#include "FileEntrySync.h"
+#include "FileError.h"
+#include "SyncCallbackHelper.h"
+
+namespace WebCore {
+
+DirectoryReaderSync::DirectoryReaderSync(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : DirectoryReaderBase(fileSystem, fullPath)
+{
+}
+
+PassRefPtr<EntryArraySync> DirectoryReaderSync::readEntries(ExceptionCode& ec)
+{
+    ec = 0;
+    if (!m_hasMoreEntries)
+        return EntryArraySync::create();
+
+    EntriesSyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->readDirectory(this, m_fullPath, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        setHasMoreEntries(false);
+        return 0;
+    }
+    return helper.getResult(ec);
+}
+
+} // namespace
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/DirectoryReaderSync.h b/WebCore/fileapi/DirectoryReaderSync.h
new file mode 100644
index 0000000..39119b7
--- /dev/null
+++ b/WebCore/fileapi/DirectoryReaderSync.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DirectoryReaderSync_h
+#define DirectoryReaderSync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DirectoryReaderBase.h"
+#include "EntryArraySync.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DirectoryReaderSync : public DirectoryReaderBase {
+public:
+    static PassRefPtr<DirectoryReaderSync> create(DOMFileSystemBase* fileSystem, const String& fullPath)
+    {
+        return adoptRef(new DirectoryReaderSync(fileSystem, fullPath));
+    }
+
+    PassRefPtr<EntryArraySync> readEntries(ExceptionCode&);
+
+private:
+    DirectoryReaderSync(DOMFileSystemBase*, const String& fullPath);
+};
+
+} // namespace
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // DirectoryReaderSync_h
diff --git a/WebCore/fileapi/DirectoryReaderSync.idl b/WebCore/fileapi/DirectoryReaderSync.idl
new file mode 100644
index 0000000..aa39928
--- /dev/null
+++ b/WebCore/fileapi/DirectoryReaderSync.idl
@@ -0,0 +1,38 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        NoStaticTables
+    ] DirectoryReaderSync {
+        EntryArraySync readEntries() raises (FileException);
+    };
+}
diff --git a/WebCore/fileapi/Entry.cpp b/WebCore/fileapi/Entry.cpp
index 969ae2b..2183b33 100644
--- a/WebCore/fileapi/Entry.cpp
+++ b/WebCore/fileapi/Entry.cpp
@@ -32,46 +32,54 @@
 
 #if ENABLE(FILE_SYSTEM)
 
-#include "DOMFilePath.h"
-#include "DOMFileSystem.h"
+#include "DirectoryEntry.h"
 #include "EntryCallback.h"
 #include "ErrorCallback.h"
 #include "FileError.h"
+#include "FileSystemCallbacks.h"
 #include "MetadataCallback.h"
 #include "VoidCallback.h"
 
 namespace WebCore {
 
-Entry::Entry(DOMFileSystem* fileSystem, const String& fullPath)
-    : m_fileSystem(fileSystem)
-    , m_fullPath(fullPath)
-    , m_name(DOMFilePath::getName(fullPath))
+Entry::Entry(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : EntryBase(fileSystem, fullPath)
 {
 }
 
-void Entry::getMetadata(PassRefPtr<MetadataCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
+void Entry::getMetadata(PassRefPtr<MetadataCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef)
 {
-    m_fileSystem->getMetadata(this, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->getMetadata(this, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-void Entry::moveTo(PassRefPtr<Entry> parent, const String& name, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback) const
+void Entry::moveTo(PassRefPtr<DirectoryEntry> parent, const String& name, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef) const
 {
-    m_fileSystem->move(this, parent, name, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->move(this, parent.get(), name, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-void Entry::copyTo(PassRefPtr<Entry> parent, const String& name, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback) const
+void Entry::copyTo(PassRefPtr<DirectoryEntry> parent, const String& name, PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef) const
 {
-    m_fileSystem->copy(this, parent, name, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->copy(this, parent.get(), name, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-void Entry::remove(PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback) const
+void Entry::remove(PassRefPtr<VoidCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef) const
 {
-    m_fileSystem->remove(this, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->remove(this, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
-void Entry::getParent(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback) const
+void Entry::getParent(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallbackRef) const
 {
-    m_fileSystem->getParent(this, successCallback, errorCallback);
+    RefPtr<ErrorCallback> errorCallback(errorCallbackRef);
+    if (!m_fileSystem->getParent(this, successCallback, errorCallback))
+        filesystem()->scheduleCallback(errorCallback.release(), FileError::create(INVALID_MODIFICATION_ERR));
 }
 
 String Entry::toURI(const String&)
diff --git a/WebCore/fileapi/Entry.h b/WebCore/fileapi/Entry.h
index 9af532f..36f85eb 100644
--- a/WebCore/fileapi/Entry.h
+++ b/WebCore/fileapi/Entry.h
@@ -34,42 +34,33 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "DOMFileSystem.h"
+#include "EntryBase.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
 namespace WebCore {
 
+class DirectoryEntry;
 class EntryCallback;
+class EntrySync;
 class ErrorCallback;
 class MetadataCallback;
 class VoidCallback;
 
-class Entry : public RefCounted<Entry> {
+class Entry : public EntryBase {
 public:
-    virtual ~Entry() { }
+    DOMFileSystem* filesystem() const { return static_cast<DOMFileSystem*>(m_fileSystem); }
 
-    virtual bool isFile() const { return false; }
-    virtual bool isDirectory() const { return false; }
+    void getMetadata(PassRefPtr<MetadataCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0);
+    void moveTo(PassRefPtr<DirectoryEntry> parent, const String& name = String(), PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
+    void copyTo(PassRefPtr<DirectoryEntry> parent, const String& name = String(), PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
+    void remove(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
+    void getParent(PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
 
-    const String& fullPath() const { return m_fullPath; }
-    const String& name() const { return m_name; }
-
-    DOMFileSystem* filesystem() const { return m_fileSystem; }
-
-    virtual void getMetadata(PassRefPtr<MetadataCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0);
-    virtual void moveTo(PassRefPtr<Entry> parent, const String& name = String(), PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
-    virtual void copyTo(PassRefPtr<Entry> parent, const String& name = String(), PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
-    virtual void remove(PassRefPtr<VoidCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
-    virtual void getParent(PassRefPtr<EntryCallback> successCallback = 0, PassRefPtr<ErrorCallback> errorCallback = 0) const;
-
-    virtual String toURI(const String& mimeType = String());
+    String toURI(const String& mimeType = String());
 
 protected:
-    Entry(DOMFileSystem* fileSystem, const String& fullPath);
-
-    DOMFileSystem* m_fileSystem;
-    String m_fullPath;
-    String m_name;
+    Entry(DOMFileSystemBase*, const String& fullPath);
 };
 
 } // namespace WebCore
diff --git a/WebCore/fileapi/Entry.idl b/WebCore/fileapi/Entry.idl
index d363bcd..f6fcdb3 100644
--- a/WebCore/fileapi/Entry.idl
+++ b/WebCore/fileapi/Entry.idl
@@ -41,8 +41,8 @@ module storage {
         readonly attribute DOMFileSystem filesystem;
 
         void getMetadata(in [Optional, Callback] MetadataCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
-        void moveTo(in Entry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
-        void copyTo(in Entry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        void moveTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
+        void copyTo(in DirectoryEntry parent, in [Optional, ConvertUndefinedOrNullToNullString] DOMString name, in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void remove(in [Optional, Callback] VoidCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
         void getParent(in [Optional, Callback] EntryCallback successCallback, in [Optional, Callback] ErrorCallback errorCallback);
     };
diff --git a/WebCore/fileapi/EntryArraySync.cpp b/WebCore/fileapi/EntryArraySync.cpp
new file mode 100644
index 0000000..1e2fa91
--- /dev/null
+++ b/WebCore/fileapi/EntryArraySync.cpp
@@ -0,0 +1,63 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EntryArraySync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "EntryArray.h"
+
+namespace WebCore {
+
+PassRefPtr<EntryArraySync> EntryArraySync::create(EntryArray* entries)
+{
+    RefPtr<EntryArraySync> entriesSync = adoptRef(new EntryArraySync());
+    if (entries) {
+        for (unsigned i = 0; i < entries->length(); ++i)
+            entriesSync->append(EntrySync::create(entries->item(i)));
+    }
+    return entriesSync.release();
+}
+
+EntryArraySync::EntryArraySync()
+{
+}
+
+EntrySync* EntryArraySync::item(unsigned index) const
+{
+    if (index >= m_entries.size())
+        return 0;
+    return m_entries[index].get();
+}
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/EntryArraySync.h b/WebCore/fileapi/EntryArraySync.h
new file mode 100644
index 0000000..46cf409
--- /dev/null
+++ b/WebCore/fileapi/EntryArraySync.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EntryArraySync_h
+#define EntryArraySync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "EntrySync.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class EntryArray;
+
+class EntryArraySync : public RefCounted<EntryArraySync> {
+public:
+    static PassRefPtr<EntryArraySync> create()
+    {
+        return adoptRef(new EntryArraySync());
+    }
+
+    static PassRefPtr<EntryArraySync> create(EntryArray*);
+
+    unsigned length() const { return m_entries.size(); }
+    EntrySync* item(unsigned index) const;
+
+    bool isEmpty() const { return m_entries.isEmpty(); }
+    void clear() { m_entries.clear(); }
+    void append(PassRefPtr<EntrySync> entry) { m_entries.append(entry); }
+
+private:
+    EntryArraySync();
+
+    Vector<RefPtr<EntrySync> > m_entries;
+};
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // EntryArraySync_h
diff --git a/WebCore/fileapi/EntryArraySync.idl b/WebCore/fileapi/EntryArraySync.idl
new file mode 100644
index 0000000..bd54f33
--- /dev/null
+++ b/WebCore/fileapi/EntryArraySync.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        HasIndexGetter,
+        NoStaticTables
+    ] EntryArraySync {
+        readonly attribute unsigned long length;
+        EntrySync item(in [IsIndex] unsigned long index);
+    };
+}
diff --git a/WebCore/bindings/js/ScriptString.h b/WebCore/fileapi/EntryBase.h
index 7401818..2aaeba8 100644
--- a/WebCore/bindings/js/ScriptString.h
+++ b/WebCore/fileapi/EntryBase.h
@@ -1,10 +1,10 @@
 /*
- * Copyright (c) 2008, Google Inc. All rights reserved.
- * 
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
- * 
+ *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ -14,7 +14,7 @@
  *     * Neither the name of Google Inc. nor the names of its
  * contributors may be used to endorse or promote products derived from
  * this software without specific prior written permission.
- * 
+ *
  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,61 +28,54 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef ScriptString_h
-#define ScriptString_h
+#ifndef EntryBase_h
+#define EntryBase_h
 
-#include "JSDOMBinding.h"
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFilePath.h"
 #include "PlatformString.h"
-#include <runtime/UString.h>
-#include <runtime/StringBuilder.h>
-#include <wtf/Forward.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
 
 namespace WebCore {
 
-class ScriptString {
+class DOMFileSystemBase;
+class EntrySync;
+
+// A common base class for Entry and EntrySync.
+class EntryBase : public RefCounted<EntryBase> {
 public:
-    ScriptString() {}
-    ScriptString(const char* s) : m_str(s) {}
-    ScriptString(const String& s) : m_str(stringToUString(s)) {}
-    ScriptString(const JSC::UString& s) : m_str(s) {}
+    virtual ~EntryBase() { }
 
-    operator JSC::UString() const { return m_str; }
-    operator String() const { return ustringToString(m_str); }
-    const JSC::UString& ustring() const { return m_str; }
+    DOMFileSystemBase* filesystem() const { return m_fileSystem; }
 
-    bool isNull() const { return m_str.isNull(); }
-    size_t size() const { return m_str.length(); }
+    virtual bool isFile() const { return false; }
+    virtual bool isDirectory() const { return false; }
 
-    ScriptString& operator=(const char* s)
-    {
-        m_str = s;
-        return *this;
-    }
+    const String& fullPath() const { return m_fullPath; }
+    const String& name() const { return m_name; }
 
-    ScriptString& operator+=(const String& s)
+protected:
+    EntryBase(DOMFileSystemBase* fileSystem, const String& fullPath)
+        : m_fileSystem(fileSystem)
+        , m_fullPath(fullPath)
+        , m_name(DOMFilePath::getName(fullPath))
     {
-        JSC::StringBuilder buffer;
-        buffer.append(m_str);
-        buffer.append(stringToUString(s));
-        m_str = buffer.build();
-        return *this;
     }
 
-    bool operator==(const ScriptString& s) const
-    {
-        return m_str == s.m_str;
-    }
+    friend class EntrySync;
 
-    bool operator!=(const ScriptString& s) const
-    {
-        // Avoid exporting an extra symbol by re-using "==" operator.
-        return !(m_str == s.m_str);
-    }
+    DOMFileSystemBase* m_fileSystem;
 
-private:
-    JSC::UString m_str;
+    // This is a virtual path.
+    String m_fullPath;
+
+    String m_name;
 };
 
-} // namespace WebCore
+}
+
+#endif // ENABLE(FILE_SYSTEM)
 
-#endif // ScriptString_h
+#endif // EntryBase_h
diff --git a/WebCore/fileapi/EntrySync.cpp b/WebCore/fileapi/EntrySync.cpp
new file mode 100644
index 0000000..ad007db
--- /dev/null
+++ b/WebCore/fileapi/EntrySync.cpp
@@ -0,0 +1,111 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "EntrySync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFilePath.h"
+#include "DOMFileSystemSync.h"
+#include "DirectoryEntry.h"
+#include "DirectoryEntrySync.h"
+#include "FileEntrySync.h"
+#include "Metadata.h"
+#include "SyncCallbackHelper.h"
+
+namespace WebCore {
+
+PassRefPtr<EntrySync> EntrySync::create(EntryBase* entry)
+{
+    if (entry->isFile())
+        return adoptRef(new FileEntrySync(entry->m_fileSystem, entry->m_fullPath));
+    return adoptRef(new DirectoryEntrySync(entry->m_fileSystem, entry->m_fullPath));
+}
+
+PassRefPtr<Metadata> EntrySync::getMetadata(ExceptionCode& ec)
+{
+    ec = 0;
+    MetadataSyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->getMetadata(this, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+    return helper.getResult(ec);
+}
+
+PassRefPtr<EntrySync> EntrySync::moveTo(PassRefPtr<DirectoryEntrySync> parent, const String& name, ExceptionCode& ec) const
+{
+    ec = 0;
+    EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->move(this, parent.get(), name, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+    return helper.getResult(ec);
+}
+
+PassRefPtr<EntrySync> EntrySync::copyTo(PassRefPtr<DirectoryEntrySync> parent, const String& name, ExceptionCode& ec) const
+{
+    ec = 0;
+    EntrySyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->copy(this, parent.get(), name, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+    return helper.getResult(ec);
+}
+
+void EntrySync::remove(ExceptionCode& ec) const
+{
+    ec = 0;
+    VoidSyncCallbackHelper helper(m_fileSystem->asyncFileSystem());
+    if (!m_fileSystem->remove(this, helper.successCallback(), helper.errorCallback())) {
+        ec = INVALID_MODIFICATION_ERR;
+        return;
+    }
+    helper.getResult(ec);
+}
+
+PassRefPtr<EntrySync> EntrySync::getParent() const
+{
+    // Sync verion of getParent doesn't throw exceptions.
+    String parentPath = DOMFilePath::getDirectory(fullPath());
+    return DirectoryEntrySync::create(m_fileSystem, parentPath);
+}
+
+EntrySync::EntrySync(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : EntryBase(fileSystem, fullPath)
+{
+}
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/EntrySync.h b/WebCore/fileapi/EntrySync.h
new file mode 100644
index 0000000..24a0101
--- /dev/null
+++ b/WebCore/fileapi/EntrySync.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EntrySync_h
+#define EntrySync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DOMFileSystemSync.h"
+#include "EntryBase.h"
+#include "ExceptionCode.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class DirectoryEntrySync;
+class Metadata;
+
+class EntrySync : public EntryBase {
+public:
+    static PassRefPtr<EntrySync> create(EntryBase*);
+
+    DOMFileSystemSync* filesystem() const { return static_cast<DOMFileSystemSync*>(m_fileSystem); }
+
+    PassRefPtr<Metadata> getMetadata(ExceptionCode&);
+    PassRefPtr<EntrySync> moveTo(PassRefPtr<DirectoryEntrySync> parent, const String& name, ExceptionCode&) const;
+    PassRefPtr<EntrySync> copyTo(PassRefPtr<DirectoryEntrySync> parent, const String& name, ExceptionCode&) const;
+    void remove(ExceptionCode&) const;
+    PassRefPtr<EntrySync> getParent() const;
+
+protected:
+    EntrySync(DOMFileSystemBase*, const String& fullPath);
+};
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // EntrySync_h
diff --git a/WebCore/fileapi/EntrySync.idl b/WebCore/fileapi/EntrySync.idl
new file mode 100644
index 0000000..fb7ee3c
--- /dev/null
+++ b/WebCore/fileapi/EntrySync.idl
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        CustomToJS,
+        NoStaticTables
+    ] EntrySync {
+        readonly attribute boolean isFile;
+        readonly attribute boolean isDirectory;
+        readonly attribute DOMString name;
+        readonly attribute DOMString fullPath;
+        readonly attribute DOMFileSystemSync filesystem;
+
+        Metadata getMetadata() raises (FileException);
+        EntrySync moveTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
+        EntrySync copyTo(in DirectoryEntrySync parent, in [ConvertUndefinedOrNullToNullString] DOMString name) raises (FileException);
+        void remove() raises (FileException);
+        DirectoryEntrySync getParent();
+    };
+}
diff --git a/WebCore/fileapi/FileEntry.cpp b/WebCore/fileapi/FileEntry.cpp
index 2d1e623..29cbd33 100644
--- a/WebCore/fileapi/FileEntry.cpp
+++ b/WebCore/fileapi/FileEntry.cpp
@@ -33,25 +33,27 @@
 
 #if ENABLE(FILE_SYSTEM)
 
+#include "DOMFileSystem.h"
 #include "ErrorCallback.h"
+#include "File.h"
 #include "FileCallback.h"
 #include "FileWriterCallback.h"
 
 namespace WebCore {
 
-FileEntry::FileEntry(DOMFileSystem* fileSystem, const String& fullPath)
+FileEntry::FileEntry(DOMFileSystemBase* fileSystem, const String& fullPath)
     : Entry(fileSystem, fullPath)
 {
 }
 
-void FileEntry::createWriter(PassRefPtr<FileWriterCallback>, PassRefPtr<ErrorCallback>)
+void FileEntry::createWriter(PassRefPtr<FileWriterCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    // FIXME: to be implemented.
+    filesystem()->createWriter(this, successCallback, errorCallback);
 }
 
-void FileEntry::file(PassRefPtr<FileCallback>, PassRefPtr<ErrorCallback>)
+void FileEntry::file(PassRefPtr<FileCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback)
 {
-    // FIXME: to be implemented.
+    filesystem()->createFile(this, successCallback, errorCallback);
 }
 
 } // namespace
diff --git a/WebCore/fileapi/FileEntry.h b/WebCore/fileapi/FileEntry.h
index 2c85d73..216cca2 100644
--- a/WebCore/fileapi/FileEntry.h
+++ b/WebCore/fileapi/FileEntry.h
@@ -39,11 +39,11 @@
 
 namespace WebCore {
 
-class DOMFileSystem;
+class DOMFileSystemBase;
 
 class FileEntry : public Entry {
 public:
-    static PassRefPtr<FileEntry> create(DOMFileSystem* fileSystem, const String& fullPath)
+    static PassRefPtr<FileEntry> create(DOMFileSystemBase* fileSystem, const String& fullPath)
     {
         return adoptRef(new FileEntry(fileSystem, fullPath));
     }
@@ -54,7 +54,7 @@ public:
     virtual bool isFile() const { return true; }
 
 private:
-    FileEntry(DOMFileSystem* fileSystem, const String& fullPath);
+    FileEntry(DOMFileSystemBase* fileSystem, const String& fullPath);
 };
 
 } // namespace
diff --git a/WebCore/fileapi/FileEntrySync.cpp b/WebCore/fileapi/FileEntrySync.cpp
new file mode 100644
index 0000000..8fc5a77
--- /dev/null
+++ b/WebCore/fileapi/FileEntrySync.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FileEntrySync.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "File.h"
+
+namespace WebCore {
+
+FileEntrySync::FileEntrySync(DOMFileSystemBase* fileSystem, const String& fullPath)
+    : EntrySync(fileSystem, fullPath)
+{
+}
+
+PassRefPtr<File> FileEntrySync::file(ExceptionCode& ec)
+{
+    return filesystem()->createFile(this, ec);
+}
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebCore/fileapi/FileEntrySync.h b/WebCore/fileapi/FileEntrySync.h
new file mode 100644
index 0000000..d027f63
--- /dev/null
+++ b/WebCore/fileapi/FileEntrySync.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef FileEntrySync_h
+#define FileEntrySync_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "EntrySync.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class File;
+
+class FileEntrySync : public EntrySync {
+public:
+    static PassRefPtr<FileEntrySync> create(DOMFileSystemBase* fileSystem, const String& fullPath)
+    {
+        return adoptRef(new FileEntrySync(fileSystem, fullPath));
+    }
+
+    virtual bool isFile() const { return true; }
+
+    PassRefPtr<File> file(ExceptionCode&);
+
+private:
+    friend class EntrySync;
+    FileEntrySync(DOMFileSystemBase*, const String& fullPath);
+};
+
+}
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // FileEntrySync_h
diff --git a/WebCore/fileapi/FileEntrySync.idl b/WebCore/fileapi/FileEntrySync.idl
new file mode 100644
index 0000000..e2d2871
--- /dev/null
+++ b/WebCore/fileapi/FileEntrySync.idl
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module storage {
+    interface [
+        Conditional=FILE_SYSTEM,
+        GenerateNativeConverter,
+        GenerateToJS,
+        NoStaticTables
+    ] FileEntrySync : EntrySync {
+        File file() raises (FileException);
+    };
+}
diff --git a/WebCore/fileapi/FileReader.cpp b/WebCore/fileapi/FileReader.cpp
index 8036468..0b7b46d 100644
--- a/WebCore/fileapi/FileReader.cpp
+++ b/WebCore/fileapi/FileReader.cpp
@@ -43,6 +43,7 @@
 #include "ProgressEvent.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptExecutionContext.h"
 #include "TextResourceDecoder.h"
 #include "ThreadableBlobRegistry.h"
@@ -57,7 +58,6 @@ FileReader::FileReader(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_state(None)
     , m_readType(ReadFileAsBinaryString)
-    , m_result("")
     , m_isRawDataConverted(false)
     , m_bytesLoaded(0)
     , m_totalBytes(0)
@@ -144,7 +144,7 @@ void FileReader::abort()
 
     terminate();
 
-    m_result = "";
+    m_builder.clear();
     m_error = FileError::create(ABORT_ERR);
 
     fireEvent(eventNames().errorEvent);
@@ -212,7 +212,7 @@ void FileReader::didReceiveData(const char* data, int lengthReceived)
 
     switch (m_readType) {
     case ReadFileAsBinaryString:
-        m_result += String(data, static_cast<unsigned>(lengthReceived));
+        m_builder.append(data, static_cast<unsigned>(lengthReceived));
         break;
     case ReadFileAsText:
     case ReadFileAsDataURL:
@@ -296,30 +296,30 @@ FileReader::ReadyState FileReader::readyState() const
     return EMPTY;
 }
 
-const ScriptString& FileReader::result()
+String FileReader::result()
 {
     // If reading as binary string, we can return the result immediately.
     if (m_readType == ReadFileAsBinaryString)
-        return m_result;
+        return m_builder.toString();
 
     // If we already convert the raw data received so far, we can return the result now.
     if (m_isRawDataConverted)
-        return m_result;
+        return m_builder.toString();
     m_isRawDataConverted = true;
 
     if (m_readType == ReadFileAsText)
         convertToText();
     // For data URL, we only do the coversion until we receive all the raw data.
     else if (m_readType == ReadFileAsDataURL && m_state == Completed)
-        convertToDataURL(m_rawData, m_fileType, m_result);
+        convertToDataURL(m_rawData, m_fileType, m_builder);
 
-    return m_result;
+    return m_builder.toString();
 }
 
 void FileReader::convertToText()
 {
     if (!m_rawData.size()) {
-        m_result = "";
+        m_builder.clear();
         return;
     }
 
@@ -330,28 +330,31 @@ void FileReader::convertToText()
     // FIXME: consider supporting incremental decoding to improve the perf.
     if (!m_decoder)
         m_decoder = TextResourceDecoder::create("text/plain", m_encoding.isValid() ? m_encoding : UTF8Encoding());
-    m_result = m_decoder->decode(&m_rawData.at(0), m_rawData.size());
+    m_builder.clear();
+    m_builder.append(m_decoder->decode(&m_rawData.at(0), m_rawData.size()));
 
     if (m_state == Completed && !m_error)
-        m_result += m_decoder->flush();
+        m_builder.append(m_decoder->flush());
 }
 
-void FileReader::convertToDataURL(const Vector<char>& rawData, const String& fileType, ScriptString& result)
+void FileReader::convertToDataURL(const Vector<char>& rawData, const String& fileType, StringBuilder& builder)
 {
-    result = "data:";
+    builder.clear();
+    builder.append("data:");
 
     if (!rawData.size())
         return;
 
-    result += fileType;
-    if (!fileType.isEmpty())
-        result += ";";
-    result += "base64,";
+    if (!fileType.isEmpty()) {
+        builder.append(fileType);
+        builder.append(";base64,");
+    } else
+        builder.append("base64,");
 
     Vector<char> out;
     base64Encode(rawData, out);
     out.append('\0');
-    result += out.data();
+    builder.append(out.data());
 }
 
 } // namespace WebCore
diff --git a/WebCore/fileapi/FileReader.h b/WebCore/fileapi/FileReader.h
index 68c0f83..f914dad 100644
--- a/WebCore/fileapi/FileReader.h
+++ b/WebCore/fileapi/FileReader.h
@@ -37,14 +37,14 @@
 #include "EventTarget.h"
 #include "FileError.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "ScriptString.h"
 #include "TextEncoding.h"
 #include "ThreadableLoaderClient.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -77,11 +77,11 @@ public:
 
     ReadyState readyState() const;
     PassRefPtr<FileError> error() { return m_error; }
-    const ScriptString& result();
+    String result();
 
     // Helper methods, also used by FileReaderSync.
     static ExceptionCode httpStatusCodeToExceptionCode(int httpStatusCode);
-    static void convertToDataURL(const Vector<char>& rawData, const String& fileType, ScriptString& result);
+    static void convertToDataURL(const Vector<char>& rawData, const String& fileType, StringBuilder&);
 
     // ActiveDOMObject
     virtual bool canSuspend() const;
@@ -147,13 +147,7 @@ private:
     ReadType m_readType;
     TextEncoding m_encoding;
 
-    // Like XMLHttpRequest.m_responseText, we keep this as a ScriptString, not a WTF::String.
-    // That's because these strings can easily get huge (they are filled from the file) and
-    // because JS can easily observe many intermediate states, so it's very useful to be
-    // able to share the buffer with JavaScript versions of the whole or partial string.
-    // In contrast, this string doesn't interact much with the rest of the engine so it's not that
-    // big a cost that it isn't a String.
-    ScriptString m_result;
+    StringBuilder m_builder;
 
     // The raw data. We have to keep track of all the raw data for it to be converted to text or data URL data.
     Vector<char> m_rawData;
diff --git a/WebCore/fileapi/FileReader.idl b/WebCore/fileapi/FileReader.idl
index b36e9d3..febb231 100644
--- a/WebCore/fileapi/FileReader.idl
+++ b/WebCore/fileapi/FileReader.idl
@@ -34,7 +34,8 @@ module html {
         CanBeConstructed,
         CallWith=ScriptExecutionContext,
         EventTarget,
-        NoStaticTables
+        NoStaticTables,
+        V8CustomConstructor
     ] FileReader {
         // ready states
         const unsigned short EMPTY = 0;
@@ -43,9 +44,9 @@ module html {
         readonly attribute unsigned short readyState;
 
         // async read methods
-        void readAsBinaryString(in Blob fileBlob);
-        void readAsText(in Blob fileBlob, in [Optional] DOMString encoding);
-        void readAsDataURL(in File file);
+        void readAsBinaryString(in Blob blob);
+        void readAsText(in Blob blob, in [Optional] DOMString encoding);
+        void readAsDataURL(in Blob blob);
 
         void abort();
 
diff --git a/WebCore/fileapi/FileReaderSync.cpp b/WebCore/fileapi/FileReaderSync.cpp
index 6c76714..6425bcf 100644
--- a/WebCore/fileapi/FileReaderSync.cpp
+++ b/WebCore/fileapi/FileReaderSync.cpp
@@ -39,6 +39,7 @@
 #include "BlobURL.h"
 #include "FileReader.h"
 #include "ResourceRequest.h"
+#include "ResourceResponse.h"
 #include "ScriptExecutionContext.h"
 #include "TextEncoding.h"
 #include "TextResourceDecoder.h"
@@ -50,7 +51,7 @@ namespace WebCore {
 class FileReaderSyncLoader : public ThreadableLoaderClient {
 public:
     // If the output result is provided, use it. Otherwise, save it as the raw data.
-    FileReaderSyncLoader(ScriptString* result);
+    FileReaderSyncLoader(StringBuilder*);
 
     // Returns the http status code.
     void start(ScriptExecutionContext*, const ResourceRequest&, ExceptionCode&);
@@ -65,7 +66,7 @@ public:
 
 private:
     // The output result. The caller provides this in order to load the binary data directly.
-    ScriptString* m_result;
+    StringBuilder* m_builder;
 
     // The raw data. The caller does not provide the above output result and we need to save it here.
     Vector<char> m_rawData;
@@ -73,8 +74,8 @@ private:
     int m_httpStatusCode;    
 };
 
-FileReaderSyncLoader::FileReaderSyncLoader(ScriptString* result)
-    : m_result(result)
+FileReaderSyncLoader::FileReaderSyncLoader(StringBuilder* builder)
+    : m_builder(builder)
     , m_httpStatusCode(0)
 {
 }
@@ -100,8 +101,8 @@ void FileReaderSyncLoader::didReceiveResponse(const ResourceResponse& response)
 
 void FileReaderSyncLoader::didReceiveData(const char* data, int lengthReceived)
 {
-    if (m_result)
-        *m_result += String(data, static_cast<unsigned>(lengthReceived));
+    if (m_builder)
+        m_builder->append(data, static_cast<unsigned>(lengthReceived));
     else
         m_rawData.append(data, static_cast<unsigned>(lengthReceived));
 }
@@ -116,37 +117,32 @@ void FileReaderSyncLoader::didFail(const ResourceError&)
     m_httpStatusCode = 500;
 }
 
-FileReaderSync::FileReaderSync()
-    : m_result("")
-{
-}
-
-const ScriptString& FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
+String FileReaderSync::readAsBinaryString(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
     if (!blob)
-        return m_result;
+        return m_builder.toString();
 
     read(scriptExecutionContext, blob, ReadAsBinaryString, ec);
-    return m_result;
+    return m_builder.toString();
 }
 
-const ScriptString& FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, const String& encoding, ExceptionCode& ec)
+String FileReaderSync::readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, const String& encoding, ExceptionCode& ec)
 {
     if (!blob)
-        return m_result;
+        return m_builder.toString();
 
     m_encoding = encoding;
     read(scriptExecutionContext, blob, ReadAsText, ec);
-    return m_result;
+    return m_builder.toString();
 }
 
-const ScriptString& FileReaderSync::readAsDataURL(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
+String FileReaderSync::readAsDataURL(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
 {
     if (!blob)
-        return m_result;
+        return m_builder.toString();
 
     read(scriptExecutionContext, blob, ReadAsDataURL, ec);
-    return m_result;
+    return m_builder.toString();
 }
 
 void FileReaderSync::read(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ReadType readType, ExceptionCode& ec)
@@ -158,7 +154,7 @@ void FileReaderSync::read(ScriptExecutionContext* scriptExecutionContext, Blob*
     ResourceRequest request(urlForReading);
     request.setHTTPMethod("GET");
 
-    FileReaderSyncLoader loader((readType == ReadAsBinaryString) ? &m_result : 0);
+    FileReaderSyncLoader loader((readType == ReadAsBinaryString) ? &m_builder : 0);
     loader.start(scriptExecutionContext, request, ec);
     ThreadableBlobRegistry::unregisterBlobURL(urlForReading);
     if (ec)
@@ -169,17 +165,17 @@ void FileReaderSync::read(ScriptExecutionContext* scriptExecutionContext, Blob*
         // Nothing to do since we need no conversion.
         return;
     case ReadAsText:
-        convertToText(loader.rawData().data(), loader.rawData().size(), m_result);
+        convertToText(loader.rawData().data(), loader.rawData().size(), m_builder);
         return;
     case ReadAsDataURL:
-        FileReader::convertToDataURL(loader.rawData(), blob->type(), m_result);
+        FileReader::convertToDataURL(loader.rawData(), blob->type(), m_builder);
         return;
     }
 
     ASSERT_NOT_REACHED();
 }
 
-void FileReaderSync::convertToText(const char* data, int size, ScriptString& result)
+void FileReaderSync::convertToText(const char* data, int size, StringBuilder& builder)
 {
     if (!size)
         return;
@@ -190,8 +186,9 @@ void FileReaderSync::convertToText(const char* data, int size, ScriptString& res
     // provided encoding.     
     // FIXME: consider supporting incremental decoding to improve the perf.
     RefPtr<TextResourceDecoder> decoder = TextResourceDecoder::create("text/plain", m_encoding.isEmpty() ? UTF8Encoding() : TextEncoding(m_encoding));
-    result = decoder->decode(data, size);
-    result += decoder->flush();
+    builder.clear();
+    builder.append(decoder->decode(data, size));
+    builder.append(decoder->flush());
 }
 
 } // namespace WebCore
diff --git a/WebCore/fileapi/FileReaderSync.h b/WebCore/fileapi/FileReaderSync.h
index a517cab..cb0e00d 100644
--- a/WebCore/fileapi/FileReaderSync.h
+++ b/WebCore/fileapi/FileReaderSync.h
@@ -34,9 +34,9 @@
 #if ENABLE(BLOB)
 
 #include "ExceptionCode.h"
-#include "ScriptString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -52,13 +52,13 @@ public:
 
     virtual ~FileReaderSync() { }
 
-    const ScriptString& readAsBinaryString(ScriptExecutionContext*, Blob*, ExceptionCode&);
-    const ScriptString& readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
+    String readAsBinaryString(ScriptExecutionContext*, Blob*, ExceptionCode&);
+    String readAsText(ScriptExecutionContext* scriptExecutionContext, Blob* blob, ExceptionCode& ec)
     {
         return readAsText(scriptExecutionContext, blob, "", ec);
     }
-    const ScriptString& readAsText(ScriptExecutionContext*, Blob*, const String& encoding, ExceptionCode&);
-    const ScriptString& readAsDataURL(ScriptExecutionContext*, Blob*, ExceptionCode&);
+    String readAsText(ScriptExecutionContext*, Blob*, const String& encoding, ExceptionCode&);
+    String readAsDataURL(ScriptExecutionContext*, Blob*, ExceptionCode&);
 
 private:
     enum ReadType {
@@ -67,18 +67,12 @@ private:
         ReadAsDataURL
     };
 
-    FileReaderSync();
-    
+    FileReaderSync() { }
+
     void read(ScriptExecutionContext*, Blob*, ReadType, ExceptionCode&);
-    void convertToText(const char* data, int size, ScriptString& result);
-
-    // Like XMLHttpRequest.m_responseText, we keep this as a ScriptString, not a WTF::String.
-    // That's because these strings can easily get huge (they are filled from the file) and
-    // because JS can easily observe many intermediate states, so it's very useful to be
-    // able to share the buffer with JavaScript versions of the whole or partial string.
-    // In contrast, this string doesn't interact much with the rest of the engine so it's not that
-    // big a cost that it isn't a String.
-    ScriptString m_result;
+    void convertToText(const char* data, int size, StringBuilder&);
+
+    StringBuilder m_builder;
 
     String m_encoding;
 };
diff --git a/WebCore/fileapi/FileSystemCallbacks.cpp b/WebCore/fileapi/FileSystemCallbacks.cpp
index 550b509..e5f404e 100644
--- a/WebCore/fileapi/FileSystemCallbacks.cpp
+++ b/WebCore/fileapi/FileSystemCallbacks.cpp
@@ -36,8 +36,9 @@
 #include "AsyncFileSystem.h"
 #include "AsyncFileWriter.h"
 #include "DOMFilePath.h"
-#include "DOMFileSystem.h"
+#include "DOMFileSystemBase.h"
 #include "DirectoryEntry.h"
+#include "DirectoryReader.h"
 #include "EntriesCallback.h"
 #include "EntryArray.h"
 #include "EntryCallback.h"
@@ -110,12 +111,12 @@ void FileSystemCallbacksBase::didFail(int code)
 
 // EntryCallbacks -------------------------------------------------------------
 
-PassOwnPtr<EntryCallbacks> EntryCallbacks::create(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystem* fileSystem, const String& expectedPath, bool isDirectory)
+PassOwnPtr<EntryCallbacks> EntryCallbacks::create(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystemBase* fileSystem, const String& expectedPath, bool isDirectory)
 {
     return adoptPtr(new EntryCallbacks(successCallback, errorCallback, fileSystem, expectedPath, isDirectory));
 }
 
-EntryCallbacks::EntryCallbacks(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystem* fileSystem, const String& expectedPath, bool isDirectory)
+EntryCallbacks::EntryCallbacks(PassRefPtr<EntryCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystemBase* fileSystem, const String& expectedPath, bool isDirectory)
     : FileSystemCallbacksBase(errorCallback)
     , m_successCallback(successCallback)
     , m_fileSystem(fileSystem)
@@ -137,39 +138,34 @@ void EntryCallbacks::didSucceed()
 
 // EntriesCallbacks -----------------------------------------------------------
 
-PassOwnPtr<EntriesCallbacks> EntriesCallbacks::create(PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystem* fileSystem, const String& basePath)
+PassOwnPtr<EntriesCallbacks> EntriesCallbacks::create(PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DirectoryReaderBase* directoryReader, const String& basePath)
 {
-    return adoptPtr(new EntriesCallbacks(successCallback, errorCallback, fileSystem, basePath));
+    return adoptPtr(new EntriesCallbacks(successCallback, errorCallback, directoryReader, basePath));
 }
 
-EntriesCallbacks::EntriesCallbacks(PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DOMFileSystem* fileSystem, const String& basePath)
+EntriesCallbacks::EntriesCallbacks(PassRefPtr<EntriesCallback> successCallback, PassRefPtr<ErrorCallback> errorCallback, DirectoryReaderBase* directoryReader, const String& basePath)
     : FileSystemCallbacksBase(errorCallback)
     , m_successCallback(successCallback)
-    , m_fileSystem(fileSystem)
+    , m_directoryReader(directoryReader)
     , m_basePath(basePath)
     , m_entries(EntryArray::create())
 {
+    ASSERT(m_directoryReader);
 }
 
 void EntriesCallbacks::didReadDirectoryEntry(const String& name, bool isDirectory)
 {
     if (isDirectory)
-        m_entries->append(DirectoryEntry::create(m_fileSystem, DOMFilePath::append(m_basePath, name)));
+        m_entries->append(DirectoryEntry::create(m_directoryReader->filesystem(), DOMFilePath::append(m_basePath, name)));
     else
-        m_entries->append(FileEntry::create(m_fileSystem, DOMFilePath::append(m_basePath, name)));
+        m_entries->append(FileEntry::create(m_directoryReader->filesystem(), DOMFilePath::append(m_basePath, name)));
 }
 
 void EntriesCallbacks::didReadDirectoryEntries(bool hasMore)
 {
-    if (m_successCallback) {
+    m_directoryReader->setHasMoreEntries(hasMore);
+    if (m_successCallback)
         m_successCallback->handleEvent(m_entries.get());
-        if (!m_entries->isEmpty() && !hasMore) {
-            // If we have returned some entries and there're no more coming entries (hasMore==false), call back once more with an empty array.
-            m_successCallback->handleEvent(EntryArray::create().get());
-            m_successCallback.clear();
-        }
-        m_entries->clear();
-    }
 }
 
 // FileSystemCallbacks --------------------------------------------------------
diff --git a/WebCore/fileapi/FileSystemCallbacks.h b/WebCore/fileapi/FileSystemCallbacks.h
index 3647ad3..c600a76 100644
--- a/WebCore/fileapi/FileSystemCallbacks.h
+++ b/WebCore/fileapi/FileSystemCallbacks.h
@@ -41,7 +41,8 @@
 namespace WebCore {
 
 class AsyncFileWriter;
-class DOMFileSystem;
+class DOMFileSystemBase;
+class DirectoryReaderBase;
 class ErrorCallback;
 class EntriesCallback;
 class EntryArray;
@@ -85,27 +86,27 @@ protected:
 
 class EntryCallbacks : public FileSystemCallbacksBase {
 public:
-    static PassOwnPtr<EntryCallbacks> create(PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>, DOMFileSystem*, const String& expectedPath, bool isDirectory);
+    static PassOwnPtr<EntryCallbacks> create(PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>, DOMFileSystemBase*, const String& expectedPath, bool isDirectory);
     virtual void didSucceed();
 
 private:
-    EntryCallbacks(PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>, DOMFileSystem*, const String& expectedPath, bool isDirectory);
+    EntryCallbacks(PassRefPtr<EntryCallback>, PassRefPtr<ErrorCallback>, DOMFileSystemBase*, const String& expectedPath, bool isDirectory);
     RefPtr<EntryCallback> m_successCallback;
-    DOMFileSystem* m_fileSystem;
+    DOMFileSystemBase* m_fileSystem;
     String m_expectedPath;
     bool m_isDirectory;
 };
 
 class EntriesCallbacks : public FileSystemCallbacksBase {
 public:
-    static PassOwnPtr<EntriesCallbacks> create(PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>, DOMFileSystem*, const String& basePath);
+    static PassOwnPtr<EntriesCallbacks> create(PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>, DirectoryReaderBase*, const String& basePath);
     virtual void didReadDirectoryEntry(const String& name, bool isDirectory);
     virtual void didReadDirectoryEntries(bool hasMore);
 
 private:
-    EntriesCallbacks(PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>, DOMFileSystem*, const String& basePath);
+    EntriesCallbacks(PassRefPtr<EntriesCallback>, PassRefPtr<ErrorCallback>, DirectoryReaderBase*, const String& basePath);
     RefPtr<EntriesCallback> m_successCallback;
-    DOMFileSystem* m_fileSystem;
+    DirectoryReaderBase* m_directoryReader;
     String m_basePath;
     RefPtr<EntryArray> m_entries;
 };
diff --git a/WebCore/fileapi/FileWriter.cpp b/WebCore/fileapi/FileWriter.cpp
index 8367bf9..bc76984 100644
--- a/WebCore/fileapi/FileWriter.cpp
+++ b/WebCore/fileapi/FileWriter.cpp
@@ -46,6 +46,7 @@ FileWriter::FileWriter(ScriptExecutionContext* context)
     : ActiveDOMObject(context, this)
     , m_readyState(INIT)
     , m_position(0)
+    , m_startedWriting(false)
     , m_bytesWritten(0)
     , m_bytesToWrite(0)
     , m_truncateLength(-1)
@@ -81,6 +82,7 @@ void FileWriter::stop()
 {
     if (m_writer && m_readyState == WRITING)
         m_writer->abort();
+    m_blobBeingWritten.clear();
     m_readyState = DONE;
 }
 
@@ -92,8 +94,15 @@ void FileWriter::write(Blob* data, ExceptionCode& ec)
         m_error = FileError::create(ec);
         return;
     }
+    if (!data) {
+        ec = TYPE_MISMATCH_ERR;
+        m_error = FileError::create(ec);
+        return;
+    }
 
+    m_blobBeingWritten = data;
     m_readyState = WRITING;
+    m_startedWriting = false;
     m_bytesWritten = 0;
     m_bytesToWrite = data->size();
     m_writer->write(m_position, data);
@@ -149,18 +158,21 @@ void FileWriter::abort(ExceptionCode& ec)
 
 void FileWriter::didWrite(long long bytes, bool complete)
 {
-    ASSERT(bytes > 0);
     ASSERT(bytes + m_bytesWritten > 0);
     ASSERT(bytes + m_bytesWritten <= m_bytesToWrite);
-    if (!m_bytesWritten)
+    if (!m_startedWriting) {
         fireEvent(eventNames().writestartEvent);
+        m_startedWriting = true;
+    }
     m_bytesWritten += bytes;
-    ASSERT((m_bytesWritten == m_bytesToWrite) == complete);
+    ASSERT((m_bytesWritten == m_bytesToWrite) || !complete);
     m_position += bytes;
     if (m_position > m_length)
         m_length = m_position;
-    fireEvent(eventNames().writeEvent);
+    fireEvent(eventNames().progressEvent);
     if (complete) {
+        m_blobBeingWritten.clear();
+        fireEvent(eventNames().writeEvent);
         m_readyState = DONE;
         fireEvent(eventNames().writeendEvent);
     }
@@ -186,6 +198,7 @@ void FileWriter::didFail(ExceptionCode ec)
     if (ABORT_ERR == ec)
         fireEvent(eventNames().abortEvent);
     fireEvent(eventNames().errorEvent);
+    m_blobBeingWritten.clear();
     m_readyState = DONE;
     fireEvent(eventNames().writeendEvent);
 }
diff --git a/WebCore/fileapi/FileWriter.h b/WebCore/fileapi/FileWriter.h
index 4bb91ef..454081c 100644
--- a/WebCore/fileapi/FileWriter.h
+++ b/WebCore/fileapi/FileWriter.h
@@ -119,9 +119,11 @@ private:
     ReadyState m_readyState;
     long long m_position;
     long long m_length;
+    bool m_startedWriting;
     long long m_bytesWritten;
     long long m_bytesToWrite;
     long long m_truncateLength;
+    RefPtr<Blob> m_blobBeingWritten;
 };
 
 } // namespace WebCore
diff --git a/WebCore/fileapi/LocalFileSystem.cpp b/WebCore/fileapi/LocalFileSystem.cpp
index 567aafe..c7347b8 100644
--- a/WebCore/fileapi/LocalFileSystem.cpp
+++ b/WebCore/fileapi/LocalFileSystem.cpp
@@ -81,7 +81,7 @@ static void openFileSystem(ScriptExecutionContext*, const String& basePath, cons
     AsyncFileSystem::openFileSystem(basePath, identifier, type, callbacks);
 }
 
-void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool)
 {
     // AsyncFileSystem::openFileSystem calls callbacks synchronously, so the method needs to be called asynchronously.
     context->postTask(createCallbackTask(&openFileSystem, fileSystemBasePath(), context->securityOrigin()->databaseIdentifier(), type, callbacks));
diff --git a/WebCore/fileapi/LocalFileSystem.h b/WebCore/fileapi/LocalFileSystem.h
index bb1d045..9d8ae65 100644
--- a/WebCore/fileapi/LocalFileSystem.h
+++ b/WebCore/fileapi/LocalFileSystem.h
@@ -52,7 +52,7 @@ public:
     // calling this one.
     static LocalFileSystem& localFileSystem();
 
-    void requestFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, long long size, PassOwnPtr<AsyncFileSystemCallbacks>);
+    void requestFileSystem(ScriptExecutionContext*, AsyncFileSystem::Type, long long size, PassOwnPtr<AsyncFileSystemCallbacks>, bool synchronous = false);
 
 #if !PLATFORM(CHROMIUM)
     // This call is not thread-safe; must be called before any worker threads are created.
diff --git a/WebCore/fileapi/Metadata.h b/WebCore/fileapi/Metadata.h
index 1fec943..b70806b 100644
--- a/WebCore/fileapi/Metadata.h
+++ b/WebCore/fileapi/Metadata.h
@@ -44,6 +44,11 @@ public:
         return adoptRef(new Metadata(modificationTime));
     }
 
+    static PassRefPtr<Metadata> create(Metadata* metadata)
+    {
+        return adoptRef(new Metadata(metadata->m_modificationTime));
+    }
+
     // Needs to return epoch time in milliseconds for Date.
     double modificationTime() const { return m_modificationTime * 1000.0; }
 
diff --git a/WebCore/fileapi/SyncCallbackHelper.h b/WebCore/fileapi/SyncCallbackHelper.h
new file mode 100644
index 0000000..1612e93
--- /dev/null
+++ b/WebCore/fileapi/SyncCallbackHelper.h
@@ -0,0 +1,185 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef SyncCallbackHelper_h
+#define SyncCallbackHelper_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "DirectoryEntry.h"
+#include "EntriesCallback.h"
+#include "EntryArraySync.h"
+#include "EntryCallback.h"
+#include "ErrorCallback.h"
+#include "ExceptionCode.h"
+#include "FileEntry.h"
+#include "FileError.h"
+#include "FileSystemCallback.h"
+#include "MetadataCallback.h"
+#include "VoidCallback.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+
+namespace WebCore {
+
+class AsyncFileSystem;
+class DirectoryEntrySync;
+class EntryArraySync;
+class EntrySync;
+class FileEntrySync;
+
+// A helper template for FileSystemSync implementation.
+template <typename SuccessCallback, typename ObserverType, typename CallbackArg, typename ResultType>
+class SyncCallbackHelper : public Noncopyable {
+public:
+    typedef SyncCallbackHelper<SuccessCallback, ObserverType, CallbackArg, ResultType> HelperType;
+    SyncCallbackHelper(ObserverType* observer = 0)
+        : m_observer(observer)
+        , m_successCallback(SuccessCallbackImpl::create(this))
+        , m_errorCallback(ErrorCallbackImpl::create(this))
+        , m_error(0)
+        , m_completed(false)
+    {
+    }
+
+    PassRefPtr<ResultType> getResult(ExceptionCode& ec)
+    {
+        if (m_observer) {
+            while (!m_completed) {
+                if (!m_observer->waitForOperationToComplete()) {
+                    m_error = ABORT_ERR;
+                    break;
+                }
+            }
+        }
+        ec = m_error;
+        return m_result.release();
+    }
+
+    PassRefPtr<SuccessCallback> successCallback() { return m_successCallback; }
+    PassRefPtr<ErrorCallback> errorCallback() { return m_errorCallback; }
+
+private:
+    class SuccessCallbackImpl : public SuccessCallback {
+    public:
+        static PassRefPtr<SuccessCallbackImpl> create(HelperType* helper)
+        {
+            return adoptRef(new SuccessCallbackImpl(helper));
+        }
+
+        virtual void handleEvent()
+        {
+            m_helper->setError(0);
+        }
+
+        virtual bool handleEvent(CallbackArg* arg)
+        {
+            m_helper->setResult(ResultType::create(arg));
+            return true;
+        }
+
+    private:
+        SuccessCallbackImpl(HelperType* helper)
+            : m_helper(helper)
+        {
+        }
+        HelperType* m_helper;
+    };
+
+    class ErrorCallbackImpl : public ErrorCallback {
+    public:
+        static PassRefPtr<ErrorCallbackImpl> create(HelperType* helper)
+        {
+            return adoptRef(new ErrorCallbackImpl(helper));
+        }
+
+        virtual bool handleEvent(FileError* error)
+        {
+            ASSERT(error);
+            m_helper->setError(error->code());
+            return true;
+        }
+
+    private:
+        ErrorCallbackImpl(HelperType* helper)
+            : m_helper(helper)
+        {
+        }
+        HelperType* m_helper;
+    };
+
+    friend class SuccessCallbackImpl;
+    friend class ErrorCallbackImpl;
+
+    void setError(ExceptionCode ec)
+    {
+        m_error = ec;
+        m_completed = true;
+    }
+
+    void setResult(PassRefPtr<ResultType> result)
+    {
+        m_result = result;
+        m_completed = true;
+    }
+
+    ObserverType* m_observer;
+    RefPtr<SuccessCallbackImpl> m_successCallback;
+    RefPtr<ErrorCallbackImpl> m_errorCallback;
+    RefPtr<ResultType> m_result;
+    ExceptionCode m_error;
+    bool m_completed;
+};
+
+struct EmptyType : public RefCounted<EmptyType> {
+    static PassRefPtr<EmptyType> create(EmptyType*)
+    {
+        return 0;
+    }
+};
+
+struct EmptyObserverType {
+    bool waitForOperationToComplete()
+    {
+        return false;
+    }
+};
+
+typedef SyncCallbackHelper<EntryCallback, AsyncFileSystem, Entry, EntrySync> EntrySyncCallbackHelper;
+typedef SyncCallbackHelper<EntriesCallback, AsyncFileSystem, EntryArray, EntryArraySync> EntriesSyncCallbackHelper;
+typedef SyncCallbackHelper<MetadataCallback, AsyncFileSystem, Metadata, Metadata> MetadataSyncCallbackHelper;
+typedef SyncCallbackHelper<VoidCallback, AsyncFileSystem, EmptyType, EmptyType> VoidSyncCallbackHelper;
+typedef SyncCallbackHelper<FileSystemCallback, EmptyObserverType, DOMFileSystem, DOMFileSystemSync> FileSystemSyncCallbackHelper;
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // SyncCallbackHelper_h
diff --git a/WebCore/fileapi/ThreadableBlobRegistry.cpp b/WebCore/fileapi/ThreadableBlobRegistry.cpp
index f74c680..2ec421b 100644
--- a/WebCore/fileapi/ThreadableBlobRegistry.cpp
+++ b/WebCore/fileapi/ThreadableBlobRegistry.cpp
@@ -41,8 +41,9 @@ namespace WebCore {
 struct BlobRegistryContext {
     BlobRegistryContext(const KURL& url, PassOwnPtr<BlobData> blobData)
         : url(url.copy())
-        , blobData(blobData->copy())
+        , blobData(blobData)
     {
+        this->blobData->detachFromCurrentThread();
     }
 
     BlobRegistryContext(const KURL& url, const KURL& srcURL)
diff --git a/WebCore/history/HistoryItem.cpp b/WebCore/history/HistoryItem.cpp
index 8a84e2e..34b54a1 100644
--- a/WebCore/history/HistoryItem.cpp
+++ b/WebCore/history/HistoryItem.cpp
@@ -32,8 +32,9 @@
 #include "PageCache.h"
 #include "ResourceRequest.h"
 #include <stdio.h>
-#include <wtf/text/CString.h>
 #include <wtf/CurrentTime.h>
+#include <wtf/MathExtras.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -490,9 +491,26 @@ void HistoryItem::clearChildren()
     m_children.clear();
 }
 
+// We do same-document navigation if going to a different item and if either of the following is true:
+// - The other item corresponds to the same document (for history entries created via pushState or fragment changes).
+// - The other item corresponds to the same set of documents, including frames (for history entries created via regular navigation)
+bool HistoryItem::shouldDoSameDocumentNavigationTo(HistoryItem* otherItem) const
+{
+    if (this == otherItem)
+        return false;
+
+    if (stateObject() || otherItem->stateObject())
+        return documentSequenceNumber() == otherItem->documentSequenceNumber();
+    
+    if ((url().hasFragmentIdentifier() || otherItem->url().hasFragmentIdentifier()) && equalIgnoringFragmentIdentifier(url(), otherItem->url()))
+        return documentSequenceNumber() == otherItem->documentSequenceNumber();        
+    
+    return hasSameDocumentTree(otherItem);
+}
+
 // Does a recursive check that this item and its descendants have the same
 // document sequence numbers as the other item.
-bool HistoryItem::hasSameDocuments(HistoryItem* otherItem)
+bool HistoryItem::hasSameDocumentTree(HistoryItem* otherItem) const
 {
     if (documentSequenceNumber() != otherItem->documentSequenceNumber())
         return false;
@@ -503,7 +521,7 @@ bool HistoryItem::hasSameDocuments(HistoryItem* otherItem)
     for (size_t i = 0; i < children().size(); i++) {
         HistoryItem* child = children()[i].get();
         HistoryItem* otherChild = otherItem->childItemWithDocumentSequenceNumber(child->documentSequenceNumber());
-        if (!otherChild || !child->hasSameDocuments(otherChild))
+        if (!otherChild || !child->hasSameDocumentTree(otherChild))
             return false;
     }
 
@@ -512,7 +530,7 @@ bool HistoryItem::hasSameDocuments(HistoryItem* otherItem)
 
 // Does a non-recursive check that this item and its immediate children have the
 // same frames as the other item.
-bool HistoryItem::hasSameFrames(HistoryItem* otherItem)
+bool HistoryItem::hasSameFrames(HistoryItem* otherItem) const
 {
     if (target() != otherItem->target())
         return false;
diff --git a/WebCore/history/HistoryItem.h b/WebCore/history/HistoryItem.h
index b11a92e..ef9ac23 100644
--- a/WebCore/history/HistoryItem.h
+++ b/WebCore/history/HistoryItem.h
@@ -161,8 +161,8 @@ public:
     bool hasChildren() const;
     void clearChildren();
     
-    bool hasSameDocuments(HistoryItem* otherItem);
-    bool hasSameFrames(HistoryItem* otherItem);
+    bool shouldDoSameDocumentNavigationTo(HistoryItem* otherItem) const;
+    bool hasSameFrames(HistoryItem* otherItem) const;
 
     // This should not be called directly for HistoryItems that are already included
     // in GlobalHistory. The WebKit api for this is to use -[WebHistory setLastVisitedTimeInterval:forItem:] instead.
@@ -218,6 +218,8 @@ private:
     void padDailyCountsForNewVisit(double time);
     void collapseDailyVisitsToWeekly();
     void recordVisitAtTime(double, VisitCountBehavior = IncreaseVisitCount);
+    
+    bool hasSameDocumentTree(HistoryItem* otherItem) const;
 
     HistoryItem* findTargetItem();
 
diff --git a/WebCore/history/PageCache.cpp b/WebCore/history/PageCache.cpp
index a5b29ce..fedc1e3 100644
--- a/WebCore/history/PageCache.cpp
+++ b/WebCore/history/PageCache.cpp
@@ -31,6 +31,8 @@
 #include "Cache.h"
 #include "CachedPage.h"
 #include "DOMWindow.h"
+#include "DeviceMotionController.h"
+#include "DeviceOrientationController.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
@@ -45,6 +47,7 @@
 #include "SystemTime.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 using namespace std;
 
@@ -74,7 +77,7 @@ static void pageCacheLog(const String& prefix, const String& message)
     LOG(PageCache, "%s%s", prefix.utf8().data(), message.utf8().data());
 }
     
-#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), String::format(__VA_ARGS__))
+#define PCLOG(...) pageCacheLog(pageCacheLogPrefix(indentLevel), makeString(__VA_ARGS__))
     
 static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
 {
@@ -88,9 +91,9 @@ static bool logCanCacheFrameDecision(Frame* frame, int indentLevel)
     PCLOG("+---");
     KURL newURL = frame->loader()->provisionalDocumentLoader() ? frame->loader()->provisionalDocumentLoader()->url() : KURL();
     if (!newURL.isEmpty())
-        PCLOG(" Determining if frame can be cached navigating from (%s) to (%s):", currentURL.string().utf8().data(), newURL.string().utf8().data());
+        PCLOG(" Determining if frame can be cached navigating from (", currentURL.string(), ") to (", newURL.string(), "):");
     else
-        PCLOG(" Determining if subframe with URL (%s) can be cached:", currentURL.string().utf8().data());
+        PCLOG(" Determining if subframe with URL (", currentURL.string(), ") can be cached:");
     
     bool cannotCache = false;
     
@@ -201,6 +204,16 @@ static void logCanCachePageDecision(Page* page)
         PCLOG("   -Page settings says b/f cache disabled");
         cannotCache = true;
     }
+#if ENABLE(DEVICE_ORIENTATION)
+    if (page->deviceMotionController() && page->deviceMotionController()->isActive()) {
+        PCLOG("   -Page is using DeviceMotion");
+        cannotCache = true;
+    }
+    if (page->deviceOrientationController() && page->deviceOrientationController()->isActive()) {
+        PCLOG("   -Page is using DeviceOrientation");
+        cannotCache = true;
+    }
+#endif
     if (loadType == FrameLoadTypeReload) {
         PCLOG("   -Load type is: Reload");
         cannotCache = true;
@@ -297,7 +310,11 @@ bool PageCache::canCache(Page* page)
         && page->backForwardList()->enabled()
         && page->backForwardList()->capacity() > 0
         && page->settings()->usesPageCache()
-        && loadType != FrameLoadTypeReload 
+#if ENABLE(DEVICE_ORIENTATION)
+        && !(page->deviceMotionController() && page->deviceMotionController()->isActive())
+        && !(page->deviceOrientationController() && page->deviceOrientationController()->isActive())
+#endif
+        && loadType != FrameLoadTypeReload
         && loadType != FrameLoadTypeReloadFromOrigin
         && loadType != FrameLoadTypeSame;
 }
diff --git a/WebCore/html/BaseDateAndTimeInputType.cpp b/WebCore/html/BaseDateAndTimeInputType.cpp
new file mode 100644
index 0000000..e1126d4
--- /dev/null
+++ b/WebCore/html/BaseDateAndTimeInputType.cpp
@@ -0,0 +1,148 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "BaseDateAndTimeInputType.h"
+
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include <limits>
+#include <wtf/MathExtras.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+using namespace HTMLNames;
+using namespace std;
+
+static const double msecPerMinute = 60 * 1000;
+static const double msecPerSecond = 1000;
+
+double BaseDateAndTimeInputType::valueAsDate() const
+{
+    return parseToDouble(element()->value(), DateComponents::invalidMilliseconds());
+}
+
+void BaseDateAndTimeInputType::setValueAsDate(double value, ExceptionCode&) const
+{
+    element()->setValue(serialize(value));
+}
+
+double BaseDateAndTimeInputType::valueAsNumber() const
+{
+    return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
+}
+
+void BaseDateAndTimeInputType::setValueAsNumber(double newValue, ExceptionCode&) const
+{
+    element()->setValue(serialize(newValue));
+}
+
+bool BaseDateAndTimeInputType::typeMismatchFor(const String& value) const
+{
+    return !value.isEmpty() && !parseToDateComponents(value, 0);
+}
+
+bool BaseDateAndTimeInputType::typeMismatch() const
+{
+    return typeMismatchFor(element()->value());
+}
+
+bool BaseDateAndTimeInputType::rangeUnderflow(const String& value) const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double doubleValue = parseToDouble(value, nan);
+    return isfinite(doubleValue) && doubleValue < minimum();
+}
+
+bool BaseDateAndTimeInputType::rangeOverflow(const String& value) const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double doubleValue = parseToDouble(value, nan);
+    return isfinite(doubleValue) && doubleValue > maximum();
+}
+
+bool BaseDateAndTimeInputType::stepMismatch(const String& value, double step) const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double doubleValue = parseToDouble(value, nan);
+    doubleValue = fabs(doubleValue - stepBase());
+    if (!isfinite(doubleValue))
+        return false;
+    ASSERT(round(doubleValue) == doubleValue);
+    ASSERT(round(step) == step);
+    return fmod(doubleValue, step);
+}
+
+double BaseDateAndTimeInputType::stepBase() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), defaultStepBase());
+}
+
+double BaseDateAndTimeInputType::parseToDouble(const String& src, double defaultValue) const
+{
+    DateComponents date;
+    if (!parseToDateComponents(src, &date))
+        return defaultValue;
+    double msec = date.millisecondsSinceEpoch();
+    ASSERT(isfinite(msec));
+    return msec;
+}
+
+bool BaseDateAndTimeInputType::parseToDateComponents(const String& source, DateComponents* out) const
+{
+    if (source.isEmpty())
+        return false;
+    DateComponents ignoredResult;
+    if (!out)
+        out = &ignoredResult;
+    return parseToDateComponentsInternal(source.characters(), source.length(), out);
+}
+
+String BaseDateAndTimeInputType::serialize(double value) const
+{
+    if (!isfinite(value))
+        return String();
+    DateComponents date;
+    if (!setMillisecondToDateComponents(value, &date))
+        return String();
+    double step;
+    if (!element()->getAllowedValueStep(&step))
+        return date.toString();
+    if (!fmod(step, msecPerMinute))
+        return date.toString(DateComponents::None);
+    if (!fmod(step, msecPerSecond))
+        return date.toString(DateComponents::Second);
+    return date.toString(DateComponents::Millisecond);
+}
+
+} // namespace WebCore
diff --git a/WebCore/html/BaseDateAndTimeInputType.h b/WebCore/html/BaseDateAndTimeInputType.h
new file mode 100644
index 0000000..83c1e93
--- /dev/null
+++ b/WebCore/html/BaseDateAndTimeInputType.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BaseDateAndTimeInputType_h
+#define BaseDateAndTimeInputType_h
+
+#include "TextFieldInputType.h"
+#include <wtf/unicode/Unicode.h>
+
+namespace WebCore {
+
+// A super class of date, datetime, datetime-local, month, time, and week types.
+class BaseDateAndTimeInputType : public TextFieldInputType {
+protected:
+    BaseDateAndTimeInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    virtual double parseToDouble(const String&, double) const;
+    virtual bool parseToDateComponents(const String&, DateComponents*) const;
+    // A helper for parseToDateComponents().
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const = 0;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const = 0;
+
+private:
+    virtual double valueAsDate() const;
+    virtual void setValueAsDate(double, ExceptionCode&) const;
+    virtual double valueAsNumber() const;
+    virtual void setValueAsNumber(double, ExceptionCode&) const;
+    virtual bool typeMismatchFor(const String&) const;
+    virtual bool typeMismatch() const;
+    virtual bool rangeUnderflow(const String&) const;
+    virtual bool rangeOverflow(const String&) const;
+    virtual bool stepMismatch(const String&, double) const;
+    virtual double stepBase() const;
+    virtual String serialize(double) const;
+};
+
+} // namespace WebCore
+
+#endif // BaseDateAndTimeInputType_h
diff --git a/WebCore/html/ButtonInputType.cpp b/WebCore/html/ButtonInputType.cpp
index 7f56970..deaf30f 100644
--- a/WebCore/html/ButtonInputType.cpp
+++ b/WebCore/html/ButtonInputType.cpp
@@ -45,4 +45,9 @@ const AtomicString& ButtonInputType::formControlType() const
     return InputTypeNames::button();
 }
 
+bool ButtonInputType::supportsValidation() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/ButtonInputType.h b/WebCore/html/ButtonInputType.h
index 99b3574..7efbad2 100644
--- a/WebCore/html/ButtonInputType.h
+++ b/WebCore/html/ButtonInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     ButtonInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsValidation() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/CheckboxInputType.cpp b/WebCore/html/CheckboxInputType.cpp
index 1c7ea4b..572dde0 100644
--- a/WebCore/html/CheckboxInputType.cpp
+++ b/WebCore/html/CheckboxInputType.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "CheckboxInputType.h"
 
+#include "HTMLInputElement.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -45,4 +46,9 @@ const AtomicString& CheckboxInputType::formControlType() const
     return InputTypeNames::checkbox();
 }
 
+bool CheckboxInputType::valueMissing(const String&) const
+{
+    return !element()->checked();
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/CheckboxInputType.h b/WebCore/html/CheckboxInputType.h
index 6a152e9..e041a07 100644
--- a/WebCore/html/CheckboxInputType.h
+++ b/WebCore/html/CheckboxInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     CheckboxInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool valueMissing(const String&) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/ColorInputType.cpp b/WebCore/html/ColorInputType.cpp
index c68acea..56bfd08 100644
--- a/WebCore/html/ColorInputType.cpp
+++ b/WebCore/html/ColorInputType.cpp
@@ -31,10 +31,28 @@
 #include "config.h"
 #include "ColorInputType.h"
 
+#include "Color.h"
+#include "HTMLInputElement.h"
 #include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
+static bool isValidColorString(const String& value)
+{
+    if (value.isEmpty())
+        return false;
+    if (value[0] == '#') {
+        // We don't accept #rgb and #aarrggbb formats.
+        if (value.length() != 7)
+            return false;
+    }
+    // This accepts named colors such as "white".
+    // FIXME: Reject named colors, accept only #rrggbb.
+    Color color(value);
+    return color.isValid() && !color.hasAlpha();
+}
+
 PassOwnPtr<InputType> ColorInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new ColorInputType(element));
@@ -45,4 +63,26 @@ const AtomicString& ColorInputType::formControlType() const
     return InputTypeNames::color();
 }
 
+bool ColorInputType::typeMismatchFor(const String& value) const
+{
+    // FIXME: Should not accept an empty value. Remove it when we implement value
+    // sanitization for type=color.
+    if (value.isEmpty())
+        return false;
+    return !isValidColorString(value);
+}
+
+bool ColorInputType::typeMismatch() const
+{
+    // FIXME: Should return false. We don't implement value sanitization for
+    // type=color yet.
+    String value = element()->value();
+    return !value.isEmpty() && !isValidColorString(value);
+}
+
+bool ColorInputType::supportsRequired() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/ColorInputType.h b/WebCore/html/ColorInputType.h
index 7259346..ea3798b 100644
--- a/WebCore/html/ColorInputType.h
+++ b/WebCore/html/ColorInputType.h
@@ -42,6 +42,9 @@ public:
 private:
     ColorInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool typeMismatchFor(const String&) const;
+    virtual bool typeMismatch() const;
+    virtual bool supportsRequired() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/DOMFormData.cpp b/WebCore/html/DOMFormData.cpp
index f848898..0ece637 100644
--- a/WebCore/html/DOMFormData.cpp
+++ b/WebCore/html/DOMFormData.cpp
@@ -32,6 +32,8 @@
 #include "DOMFormData.h"
 
 #include "Blob.h"
+#include "HTMLFormControlElement.h"
+#include "HTMLFormElement.h"
 #include "PlatformString.h"
 #include "TextEncoding.h"
 
@@ -42,6 +44,19 @@ DOMFormData::DOMFormData(const TextEncoding& encoding)
 {
 }
 
+DOMFormData::DOMFormData(HTMLFormElement* form)
+    : FormDataList(UTF8Encoding())
+{
+    if (!form)
+        return;
+
+    for (unsigned i = 0; i < form->associatedElements().size(); ++i) {
+        HTMLFormControlElement* control = form->associatedElements()[i];
+        if (!control->disabled())
+            control->appendFormData(*this, true);
+    }
+}
+
 void DOMFormData::append(const String& name, const String& value)
 {
     if (!name.isEmpty())
diff --git a/WebCore/html/DOMFormData.h b/WebCore/html/DOMFormData.h
index 6c24858..967d64d 100644
--- a/WebCore/html/DOMFormData.h
+++ b/WebCore/html/DOMFormData.h
@@ -39,18 +39,20 @@
 namespace WebCore {
 
 class Blob;
+class HTMLFormElement;
 class TextEncoding;
 
 class DOMFormData : public FormDataList, public RefCounted<DOMFormData> {
 public:
-    static PassRefPtr<DOMFormData> create() { return adoptRef(new DOMFormData(UTF8Encoding())); }
+    static PassRefPtr<DOMFormData> create(HTMLFormElement* form) { return adoptRef(new DOMFormData(form)); }
     static PassRefPtr<DOMFormData> create(const TextEncoding& encoding) { return adoptRef(new DOMFormData(encoding)); }
 
     void append(const String& name, const String& value);
     void append(const String& name, Blob*);
 
 private:
-    DOMFormData(const TextEncoding&);
+    explicit DOMFormData(const TextEncoding&);
+    explicit DOMFormData(HTMLFormElement*);
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/DOMFormData.idl b/WebCore/html/DOMFormData.idl
index c339381..4418428 100644
--- a/WebCore/html/DOMFormData.idl
+++ b/WebCore/html/DOMFormData.idl
@@ -32,6 +32,8 @@ module html {
 
     interface [
         CanBeConstructed,
+        CustomConstructFunction,
+        V8CustomConstructor,
         GenerateNativeConverter,
         GenerateToJS
     ] DOMFormData {
diff --git a/WebCore/html/DOMTokenList.cpp b/WebCore/html/DOMTokenList.cpp
index 8ee45a2..aa0a74b 100644
--- a/WebCore/html/DOMTokenList.cpp
+++ b/WebCore/html/DOMTokenList.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2010, Google Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,8 +27,9 @@
 
 #include "Element.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "SpaceSplitString.h"
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -43,7 +44,7 @@ static bool validateToken(const AtomicString& token, ExceptionCode& ec)
 
     unsigned length = token.length();
     for (unsigned i = 0; i < length; ++i) {
-        if (isClassWhitespace(token[i])) {
+        if (isHTMLSpace(token[i])) {
             ec = INVALID_CHARACTER_ERR;
             return false;
         }
@@ -71,7 +72,7 @@ void DOMTokenList::deref()
 
 unsigned DOMTokenList::length() const
 {
-    return classNames().size();
+    return m_element->hasClass() ? classNames().size() : 0;
 }
 
 const AtomicString DOMTokenList::item(unsigned index) const
@@ -90,7 +91,7 @@ bool DOMTokenList::contains(const AtomicString& token, ExceptionCode& ec) const
 
 bool DOMTokenList::containsInternal(const AtomicString& token) const
 {
-    return classNames().contains(token);
+    return m_element->hasClass() && classNames().contains(token);
 }
 
 void DOMTokenList::add(const AtomicString& token, ExceptionCode& ec)
@@ -139,25 +140,25 @@ void DOMTokenList::removeInternal(const AtomicString& token) const
 
     // Step 5
     while (position < inputLength) {
-        if (isClassWhitespace(input[position])) { // 6
+        if (isHTMLSpace(input[position])) { // 6
             output.append(input[position++]); // 6.1, 6.2
             continue; // 6.3
         }
 
         // Step 7
         Vector<UChar> s;
-        while (position < inputLength && !isClassWhitespace(input[position]))
+        while (position < inputLength && isNotHTMLSpace(input[position]))
             s.append(input[position++]);
 
         // Step 8
         if (s == token) {
             // Step 8.1
-            while (position < inputLength && isClassWhitespace(input[position]))
+            while (position < inputLength && isHTMLSpace(input[position]))
                 ++position;
 
             // Step 8.2
             size_t j = output.size();
-            while (j > 0 && isClassWhitespace(output[j - 1]))
+            while (j > 0 && isHTMLSpace(output[j - 1]))
                 --j;
             output.resize(j);
 
@@ -198,6 +199,7 @@ void DOMTokenList::reset(const String& newClassName)
 
 const SpaceSplitString& DOMTokenList::classNames() const
 {
+    ASSERT(m_element->hasClass());
     if (!m_classNamesForQuirksMode.isNull())
         return m_classNamesForQuirksMode;
     return m_element->attributeMap()->classNames();
diff --git a/WebCore/html/DateInputType.cpp b/WebCore/html/DateInputType.cpp
index 0605846..3409d3b 100644
--- a/WebCore/html/DateInputType.cpp
+++ b/WebCore/html/DateInputType.cpp
@@ -31,10 +31,18 @@
 #include "config.h"
 #include "DateInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double dateDefaultStep = 1.0;
+static const double dateStepScaleFactor = 86400000.0;
+
 PassOwnPtr<InputType> DateInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new DateInputType(element));
@@ -45,4 +53,42 @@ const AtomicString& DateInputType::formControlType() const
     return InputTypeNames::date();
 }
 
+double DateInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumDate());
+}
+
+double DateInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumDate());
+}
+
+double DateInputType::defaultStep() const
+{
+    return dateDefaultStep;
+}
+
+double DateInputType::stepScaleFactor() const
+{
+    return dateStepScaleFactor;
+}
+
+bool DateInputType::parsedStepValueShouldBeInteger() const
+{
+    return true;
+}
+
+bool DateInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseDate(characters, length, 0, end) && end == length;
+}
+
+bool DateInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMillisecondsSinceEpochForDate(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/DateInputType.h b/WebCore/html/DateInputType.h
index e6f60d7..965d9ea 100644
--- a/WebCore/html/DateInputType.h
+++ b/WebCore/html/DateInputType.h
@@ -31,17 +31,24 @@
 #ifndef DateInputType_h
 #define DateInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class DateInputType : public TextFieldInputType {
+class DateInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    DateInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    DateInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool parsedStepValueShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/DateTimeInputType.cpp b/WebCore/html/DateTimeInputType.cpp
index 0bf5e04..c78a540 100644
--- a/WebCore/html/DateTimeInputType.cpp
+++ b/WebCore/html/DateTimeInputType.cpp
@@ -31,10 +31,18 @@
 #include "config.h"
 #include "DateTimeInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double dateTimeDefaultStep = 60.0;
+static const double dateTimeStepScaleFactor = 1000.0;
+
 PassOwnPtr<InputType> DateTimeInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new DateTimeInputType(element));
@@ -45,4 +53,42 @@ const AtomicString& DateTimeInputType::formControlType() const
     return InputTypeNames::datetime();
 }
 
+double DateTimeInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumDateTime());
+}
+
+double DateTimeInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumDateTime());
+}
+
+double DateTimeInputType::defaultStep() const
+{
+    return dateTimeDefaultStep;
+}
+
+double DateTimeInputType::stepScaleFactor() const
+{
+    return dateTimeStepScaleFactor;
+}
+
+bool DateTimeInputType::scaledStepValeuShouldBeInteger() const
+{
+    return true;
+}
+
+bool DateTimeInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseDateTime(characters, length, 0, end) && end == length;
+}
+
+bool DateTimeInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMillisecondsSinceEpochForDateTime(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/DateTimeInputType.h b/WebCore/html/DateTimeInputType.h
index f24ebfb..140975b 100644
--- a/WebCore/html/DateTimeInputType.h
+++ b/WebCore/html/DateTimeInputType.h
@@ -31,17 +31,24 @@
 #ifndef DateTimeInputType_h
 #define DateTimeInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class DateTimeInputType : public TextFieldInputType {
+class DateTimeInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    DateTimeInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    DateTimeInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool scaledStepValeuShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/DateTimeLocalInputType.cpp b/WebCore/html/DateTimeLocalInputType.cpp
index 33c6cfa..1ec2a47 100644
--- a/WebCore/html/DateTimeLocalInputType.cpp
+++ b/WebCore/html/DateTimeLocalInputType.cpp
@@ -31,10 +31,18 @@
 #include "config.h"
 #include "DateTimeLocalInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double dateTimeLocalDefaultStep = 60.0;
+static const double dateTimeLocalStepScaleFactor = 1000.0;
+
 PassOwnPtr<InputType> DateTimeLocalInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new DateTimeLocalInputType(element));
@@ -45,4 +53,54 @@ const AtomicString& DateTimeLocalInputType::formControlType() const
     return InputTypeNames::datetimelocal();
 }
 
+double DateTimeLocalInputType::valueAsDate() const
+{
+    // valueAsDate doesn't work for the datetime-local type according to the standard.
+    return DateComponents::invalidMilliseconds();
+}
+
+void DateTimeLocalInputType::setValueAsDate(double value, ExceptionCode& ec) const
+{
+    // valueAsDate doesn't work for the datetime-local type according to the standard.
+    InputType::setValueAsDate(value, ec);
+}
+
+double DateTimeLocalInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumDateTime());
+}
+
+double DateTimeLocalInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumDateTime());
+}
+
+double DateTimeLocalInputType::defaultStep() const
+{
+    return dateTimeLocalDefaultStep;
+}
+
+double DateTimeLocalInputType::stepScaleFactor() const
+{
+    return dateTimeLocalStepScaleFactor;
+}
+
+bool DateTimeLocalInputType::scaledStepValeuShouldBeInteger() const
+{
+    return true;
+}
+
+bool DateTimeLocalInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
+}
+
+bool DateTimeLocalInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMillisecondsSinceEpochForDateTimeLocal(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/DateTimeLocalInputType.h b/WebCore/html/DateTimeLocalInputType.h
index 1a3d866..966e294 100644
--- a/WebCore/html/DateTimeLocalInputType.h
+++ b/WebCore/html/DateTimeLocalInputType.h
@@ -31,17 +31,26 @@
 #ifndef DateTimeLocalInputType_h
 #define DateTimeLocalInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class DateTimeLocalInputType : public TextFieldInputType {
+class DateTimeLocalInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    DateTimeLocalInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    DateTimeLocalInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double valueAsDate() const;
+    virtual void setValueAsDate(double, ExceptionCode&) const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool scaledStepValeuShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/EmailInputType.cpp b/WebCore/html/EmailInputType.cpp
index 4472310..78bda9c 100644
--- a/WebCore/html/EmailInputType.cpp
+++ b/WebCore/html/EmailInputType.cpp
@@ -1,40 +1,54 @@
 /*
+ * This file is part of the WebKit project.
+ *
+ * Copyright (C) 2009 Michelangelo De Simone <micdesim@gmail.com>
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
  *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
  *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "EmailInputType.h"
 
+#include "HTMLInputElement.h"
+#include "RegularExpression.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+static const char emailPattern[] =
+    "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+" // local part
+    "@"
+    "[a-z0-9-]+(\\.[a-z0-9-]+)+"; // domain part
+
+static bool isValidEmailAddress(const String& address)
+{
+    int addressLength = address.length();
+    if (!addressLength)
+        return false;
+
+    DEFINE_STATIC_LOCAL(const RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
+
+    int matchLength;
+    int matchOffset = regExp.match(address, 0, &matchLength);
+
+    return !matchOffset && matchLength == addressLength;
+}
+
 PassOwnPtr<InputType> EmailInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new EmailInputType(element));
@@ -45,4 +59,24 @@ const AtomicString& EmailInputType::formControlType() const
     return InputTypeNames::email();
 }
 
+bool EmailInputType::typeMismatchFor(const String& value) const
+{
+    if (value.isEmpty())
+        return false;
+    if (!element()->multiple())
+        return !isValidEmailAddress(value);
+    Vector<String> addresses;
+    value.split(',', addresses);
+    for (unsigned i = 0; i < addresses.size(); ++i) {
+        if (!isValidEmailAddress(addresses[i]))
+            return true;
+    }
+    return false;
+}
+
+bool EmailInputType::typeMismatch() const
+{
+    return typeMismatchFor(element()->value());
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/EmailInputType.h b/WebCore/html/EmailInputType.h
index bbf6f73..b77a9ad 100644
--- a/WebCore/html/EmailInputType.h
+++ b/WebCore/html/EmailInputType.h
@@ -42,6 +42,8 @@ public:
 private:
     EmailInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool typeMismatchFor(const String&) const;
+    virtual bool typeMismatch() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/FTPDirectoryDocument.cpp b/WebCore/html/FTPDirectoryDocument.cpp
index 6475ea9..2a08696 100644
--- a/WebCore/html/FTPDirectoryDocument.cpp
+++ b/WebCore/html/FTPDirectoryDocument.cpp
@@ -39,6 +39,7 @@
 #include "Text.h"
 
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 
@@ -253,9 +254,9 @@ static String processFileDateString(const FTPTime& fileTime)
     String dateString;
 
     if (fileTime.tm_year > -1)
-        dateString = String::format("%s %i, %i", months[month], fileTime.tm_mday, fileTime.tm_year);
+        dateString = makeString(months[month], ' ', String::number(fileTime.tm_mday), ", ", String::number(fileTime.tm_year));
     else
-        dateString = String::format("%s %i, %i", months[month], fileTime.tm_mday, now.tm_year);
+        dateString = makeString(months[month], ' ', String::number(fileTime.tm_mday), ", ", String::number(now.tm_year));
 
     return dateString + timeOfDay;
 }
diff --git a/WebCore/html/FileInputType.cpp b/WebCore/html/FileInputType.cpp
index 0e08362..6cb17f2 100644
--- a/WebCore/html/FileInputType.cpp
+++ b/WebCore/html/FileInputType.cpp
@@ -32,6 +32,7 @@
 #include "FileInputType.h"
 
 #include <wtf/PassOwnPtr.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -45,4 +46,9 @@ const AtomicString& FileInputType::formControlType() const
     return InputTypeNames::file();
 }
 
+bool FileInputType::valueMissing(const String& value) const
+{
+    return value.isEmpty();
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/FileInputType.h b/WebCore/html/FileInputType.h
index cebfab7..2cbfe67 100644
--- a/WebCore/html/FileInputType.h
+++ b/WebCore/html/FileInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     FileInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool valueMissing(const String&) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/HTMLAnchorElement.cpp b/WebCore/html/HTMLAnchorElement.cpp
index 8beccc2..dcdde28 100644
--- a/WebCore/html/HTMLAnchorElement.cpp
+++ b/WebCore/html/HTMLAnchorElement.cpp
@@ -30,6 +30,7 @@
 #include "FrameLoaderTypes.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "Page.h"
@@ -37,6 +38,7 @@
 #include "RenderImage.h"
 #include "ResourceHandle.h"
 #include "Settings.h"
+#include "UserGestureIndicator.h"
 
 namespace WebCore {
 
@@ -145,7 +147,7 @@ void HTMLAnchorElement::defaultEventHandler(Event* event)
         }
 
         if (isLinkClick(event) && treatLinkAsLiveForEventType(eventType(event))) {
-            String url = deprecatedParseURL(getAttribute(hrefAttr));
+            String url = stripLeadingAndTrailingHTMLSpaces(getAttribute(hrefAttr));
             appendServerMapMousePosition(url, event);
             handleLinkClick(event, document(), url, getAttribute(targetAttr), hasRel(RelationNoReferrer));
             sendPings(document()->completeURL(url));
@@ -210,7 +212,7 @@ void HTMLAnchorElement::parseMappedAttribute(Attribute* attr)
         if (wasLink != isLink())
             setNeedsStyleRecalc();
         if (isLink()) {
-            String parsedURL = deprecatedParseURL(attr->value());
+            String parsedURL = stripLeadingAndTrailingHTMLSpaces(attr->value());
             if (document()->isDNSPrefetchEnabled()) {
                 if (protocolIs(parsedURL, "http") || protocolIs(parsedURL, "https") || parsedURL.startsWith("//"))
                     ResourceHandle::prepareForURL(document()->completeURL(parsedURL));
@@ -261,7 +263,7 @@ bool HTMLAnchorElement::draggable() const
 
 KURL HTMLAnchorElement::href() const
 {
-    return document()->completeURL(deprecatedParseURL(getAttribute(hrefAttr)));
+    return document()->completeURL(stripLeadingAndTrailingHTMLSpaces(getAttribute(hrefAttr)));
 }
 
 void HTMLAnchorElement::setHref(const AtomicString& value)
@@ -448,6 +450,13 @@ String HTMLAnchorElement::origin() const
     return origin->toString();
 }
 
+String HTMLAnchorElement::getParameter(const String& name) const
+{
+    ParsedURLParameters parameters;
+    href().copyParsedQueryTo(parameters);
+    return parameters.get(name);
+}
+
 void HTMLAnchorElement::setSearch(const String& value)
 {
     KURL url = href();
@@ -542,7 +551,9 @@ void handleLinkClick(Event* event, Document* document, const String& url, const
     Frame* frame = document->frame();
     if (!frame)
         return;
-    frame->loader()->urlSelected(document->completeURL(url), target, event, false, false, true, hideReferrer ? NoReferrer : SendReferrer);
+    // FIXME: This seems wrong.  Why are we manufactuing a user gesture?
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+    frame->loader()->urlSelected(document->completeURL(url), target, event, false, false, hideReferrer ? NoReferrer : SendReferrer);
 }
 
 }
diff --git a/WebCore/html/HTMLAnchorElement.h b/WebCore/html/HTMLAnchorElement.h
index a7e7eec..71837ca 100644
--- a/WebCore/html/HTMLAnchorElement.h
+++ b/WebCore/html/HTMLAnchorElement.h
@@ -84,6 +84,8 @@ public:
 
     String origin() const;
 
+    String getParameter(const String&) const;
+
     String text() const;
 
     String toString() const;
diff --git a/WebCore/html/HTMLAnchorElement.idl b/WebCore/html/HTMLAnchorElement.idl
index c918fde..432df69 100644
--- a/WebCore/html/HTMLAnchorElement.idl
+++ b/WebCore/html/HTMLAnchorElement.idl
@@ -53,6 +53,8 @@ module html {
         readonly attribute [ConvertNullToNullString] DOMString origin;
 #endif
 
+        DOMString getParameter(in DOMString name);
+
         readonly attribute DOMString text;
 
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
diff --git a/WebCore/html/HTMLAreaElement.cpp b/WebCore/html/HTMLAreaElement.cpp
index 3547cd9..0155bce 100644
--- a/WebCore/html/HTMLAreaElement.cpp
+++ b/WebCore/html/HTMLAreaElement.cpp
@@ -174,12 +174,17 @@ HTMLImageElement* HTMLAreaElement::imageElement() const
 
 bool HTMLAreaElement::isKeyboardFocusable(KeyboardEvent*) const
 {
-    return supportsFocus();
+    return isFocusable();
+}
+    
+bool HTMLAreaElement::isMouseFocusable() const
+{
+    return isFocusable();
 }
 
 bool HTMLAreaElement::isFocusable() const
 {
-    return supportsFocus();
+    return supportsFocus() && Element::tabIndex() >= 0;
 }
     
 void HTMLAreaElement::dispatchBlurEvent()
@@ -192,7 +197,10 @@ void HTMLAreaElement::dispatchBlurEvent()
     
 void HTMLAreaElement::updateFocusAppearance(bool restorePreviousSelection)
 {
-    Node* parent = parentNode();
+    if (!isFocusable())
+        return;
+    
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->hasTagName(mapTag))
         return;
     
diff --git a/WebCore/html/HTMLAreaElement.h b/WebCore/html/HTMLAreaElement.h
index 10784c3..42d4198 100644
--- a/WebCore/html/HTMLAreaElement.h
+++ b/WebCore/html/HTMLAreaElement.h
@@ -54,6 +54,7 @@ private:
     virtual bool supportsFocus() const;
     virtual String target() const;
     virtual bool isKeyboardFocusable(KeyboardEvent*) const;
+    virtual bool isMouseFocusable() const;
     virtual bool isFocusable() const;
     virtual void updateFocusAppearance(bool /*restorePreviousSelection*/);
     virtual void dispatchBlurEvent();
diff --git a/WebCore/html/HTMLAttributeNames.in b/WebCore/html/HTMLAttributeNames.in
index 7a80c13..d5c48c4 100644
--- a/WebCore/html/HTMLAttributeNames.in
+++ b/WebCore/html/HTMLAttributeNames.in
@@ -206,6 +206,7 @@ onseeked
 onseeking
 onselect
 onselectstart
+onwebkitspeechchange
 onstalled
 onstorage
 onsuspend
@@ -258,7 +259,7 @@ size
 sortable
 sortdirection
 span
-webkitspeech
+x-webkit-speech
 spellcheck
 src
 standby
diff --git a/WebCore/html/HTMLBodyElement.cpp b/WebCore/html/HTMLBodyElement.cpp
index 60126f7..c394f3d 100644
--- a/WebCore/html/HTMLBodyElement.cpp
+++ b/WebCore/html/HTMLBodyElement.cpp
@@ -33,6 +33,7 @@
 #include "FrameView.h"
 #include "HTMLFrameElementBase.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "ScriptEventListener.h"
 
 #ifdef ANDROID_META_SUPPORT
@@ -100,7 +101,7 @@ bool HTMLBodyElement::mapToEntry(const QualifiedName& attrName, MappedAttributeE
 void HTMLBodyElement::parseMappedAttribute(Attribute* attr)
 {
     if (attr->name() == backgroundAttr) {
-        String url = deprecatedParseURL(attr->value());
+        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
             addCSSImageProperty(attr, CSSPropertyBackgroundImage, document()->completeURL(url).string());
     } else if (attr->name() == marginwidthAttr || attr->name() == leftmarginAttr) {
@@ -218,6 +219,9 @@ void HTMLBodyElement::insertedIntoDocument()
     // But without it we hang during WebKit tests; need to fix that and remove this.
     if (FrameView* view = document()->view())
         view->scheduleRelayout();
+
+    if (document() && document()->page())
+        document()->page()->updateViewportArguments();
 }
 
 bool HTMLBodyElement::isURLAttribute(Attribute *attr) const
@@ -225,6 +229,11 @@ bool HTMLBodyElement::isURLAttribute(Attribute *attr) const
     return attr->name() == backgroundAttr;
 }
 
+bool HTMLBodyElement::supportsFocus() const
+{
+    return isContentEditable() || HTMLElement::supportsFocus();
+}
+
 String HTMLBodyElement::aLink() const
 {
     return getAttribute(alinkAttr);
diff --git a/WebCore/html/HTMLBodyElement.h b/WebCore/html/HTMLBodyElement.h
index d6ef185..df7bfec 100644
--- a/WebCore/html/HTMLBodyElement.h
+++ b/WebCore/html/HTMLBodyElement.h
@@ -77,6 +77,8 @@ private:
     void createLinkDecl();
     
     virtual bool isURLAttribute(Attribute*) const;
+    
+    virtual bool supportsFocus() const;
 
     virtual int scrollLeft() const;
     virtual void setScrollLeft(int scrollLeft);
diff --git a/WebCore/html/HTMLCanvasElement.cpp b/WebCore/html/HTMLCanvasElement.cpp
index 634fe13..fea70d1 100644
--- a/WebCore/html/HTMLCanvasElement.cpp
+++ b/WebCore/html/HTMLCanvasElement.cpp
@@ -260,9 +260,9 @@ void HTMLCanvasElement::paint(GraphicsContext* context, const IntRect& r)
         ImageBuffer* imageBuffer = buffer();
         if (imageBuffer) {
             if (imageBuffer->drawsUsingCopy())
-                context->drawImage(copiedImage(), DeviceColorSpace, r);
+                context->drawImage(copiedImage(), ColorSpaceDeviceRGB, r);
             else
-                context->drawImageBuffer(imageBuffer, DeviceColorSpace, r);
+                context->drawImageBuffer(imageBuffer, ColorSpaceDeviceRGB, r);
         }
     }
 }
diff --git a/WebCore/html/HTMLElement.cpp b/WebCore/html/HTMLElement.cpp
index a56efdc..1483fbc 100644
--- a/WebCore/html/HTMLElement.cpp
+++ b/WebCore/html/HTMLElement.cpp
@@ -456,7 +456,7 @@ void HTMLElement::setOuterText(const String &text, ExceptionCode& ec)
         return;
     }
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent) {
         ec = NO_MODIFICATION_ALLOWED_ERR;
         return;
@@ -507,9 +507,8 @@ Node* HTMLElement::insertAdjacent(const String& where, Node* newChild, Exception
     // Opera also appears to disallow such usage.
 
     if (equalIgnoringCase(where, "beforeBegin")) {
-        if (Node* p = parent())
-            return p->insertBefore(newChild, this, ec) ? newChild : 0;
-        return 0;
+        ContainerNode* parent = this->parent();
+        return (parent && parent->insertBefore(newChild, this, ec)) ? newChild : 0;
     }
 
     if (equalIgnoringCase(where, "afterBegin"))
@@ -519,9 +518,8 @@ Node* HTMLElement::insertAdjacent(const String& where, Node* newChild, Exception
         return appendChild(newChild, ec) ? newChild : 0;
 
     if (equalIgnoringCase(where, "afterEnd")) {
-        if (Node* p = parent())
-            return p->insertBefore(newChild, nextSibling(), ec) ? newChild : 0;
-        return 0;
+        ContainerNode* parent = this->parent();
+        return (parent && parent->insertBefore(newChild, nextSibling(), ec)) ? newChild : 0;
     }
     
     // IE throws COM Exception E_INVALIDARG; this is the best DOM exception alternative.
@@ -546,7 +544,7 @@ Element* HTMLElement::insertAdjacentElement(const String& where, Element* newChi
 static Element* contextElementForInsertion(const String& where, Element* element, ExceptionCode& ec)
 {
     if (equalIgnoringCase(where, "beforeBegin") || equalIgnoringCase(where, "afterEnd")) {
-        Node* parent = element->parentNode();
+        ContainerNode* parent = element->parentNode();
         if (parent && parent->isDocumentNode()) {
             ec = NO_MODIFICATION_ALLOWED_ERR;
             return 0;
@@ -793,9 +791,10 @@ RenderObject* HTMLElement::createRenderer(RenderArena* arena, RenderStyle* style
 
 HTMLFormElement* HTMLElement::findFormAncestor() const
 {
-    for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode())
+    for (ContainerNode* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
         if (ancestor->hasTagName(formTag))
             return static_cast<HTMLFormElement*>(ancestor);
+    }
     return 0;
 }
 
diff --git a/WebCore/html/HTMLEmbedElement.cpp b/WebCore/html/HTMLEmbedElement.cpp
index e88ee81..c4f007c 100644
--- a/WebCore/html/HTMLEmbedElement.cpp
+++ b/WebCore/html/HTMLEmbedElement.cpp
@@ -25,13 +25,16 @@
 #include "HTMLEmbedElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "CSSPropertyNames.h"
+#include "DocumentLoader.h"
 #include "Frame.h"
 #include "HTMLDocument.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLParserIdioms.h"
+#include "MainResourceLoader.h"
+#include "PluginDocument.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
 #include "RenderWidget.h"
@@ -94,9 +97,9 @@ void HTMLEmbedElement::parseMappedAttribute(Attribute* attr)
         if (!isImageType() && m_imageLoader)
             m_imageLoader.clear();
     } else if (attr->name() == codeAttr)
-        m_url = deprecatedParseURL(value.string());
+        m_url = stripLeadingAndTrailingHTMLSpaces(value.string());
     else if (attr->name() == srcAttr) {
-        m_url = deprecatedParseURL(value.string());
+        m_url = stripLeadingAndTrailingHTMLSpaces(value.string());
         if (renderer() && isImageType()) {
             if (!m_imageLoader)
                 m_imageLoader = adoptPtr(new HTMLImageLoader(this));
@@ -158,8 +161,20 @@ void HTMLEmbedElement::updateWidget(bool onlyCreateNonNetscapePlugins)
     Vector<String> paramValues;
     parametersForPlugin(paramNames, paramValues);
 
-    if (!dispatchBeforeLoadEvent(m_url))
+    ASSERT(!m_inBeforeLoadEventHandler);
+    m_inBeforeLoadEventHandler = true;
+    bool beforeLoadAllowedLoad = dispatchBeforeLoadEvent(m_url);
+    m_inBeforeLoadEventHandler = false;
+
+    if (!beforeLoadAllowedLoad) {
+        if (document()->isPluginDocument()) {
+            // Plugins inside plugin documents load differently than other plugins. By the time
+            // we are here in a plugin document, the load of the plugin (which is the plugin document's
+            // main resource) has already started. We need to explicitly cancel the main resource load here.
+            toPluginDocument(document())->cancelManualPluginLoad();
+        }
         return;
+    }
 
     SubframeLoader* loader = document()->frame()->loader()->subframeLoader();
     // FIXME: beforeLoad could have detached the renderer!  Just like in the <object> case above.
@@ -177,7 +192,7 @@ bool HTMLEmbedElement::rendererIsNeeded(RenderStyle* style)
 
     // If my parent is an <object> and is not set to use fallback content, I
     // should be ignored and not get a renderer.
-    Node* p = parentNode();
+    ContainerNode* p = parentNode();
     if (p && p->hasTagName(objectTag)) {
         ASSERT(p->renderer());
         if (!static_cast<HTMLObjectElement*>(p)->useFallbackContent()) {
diff --git a/WebCore/html/HTMLFormControlElement.cpp b/WebCore/html/HTMLFormControlElement.cpp
index 2080d91..51b9e20 100644
--- a/WebCore/html/HTMLFormControlElement.cpp
+++ b/WebCore/html/HTMLFormControlElement.cpp
@@ -255,7 +255,7 @@ bool HTMLFormControlElement::isKeyboardFocusable(KeyboardEvent* event) const
 
 bool HTMLFormControlElement::isMouseFocusable() const
 {
-#if PLATFORM(GTK)
+#if PLATFORM(GTK) || PLATFORM(QT)
     return HTMLElement::isMouseFocusable();
 #else
     return false;
@@ -440,7 +440,7 @@ bool HTMLFormControlElementWithState::autoComplete() const
 bool HTMLFormControlElementWithState::shouldSaveAndRestoreFormControlState() const
 {
     // We don't save/restore control state in a form with autocomplete=off.
-    return autoComplete();
+    return attached() && autoComplete();
 }
 
 void HTMLFormControlElementWithState::finishParsingChildren()
@@ -592,10 +592,10 @@ int HTMLTextFormControlElement::selectionEnd()
     return toRenderTextControl(renderer())->selectionEnd();
 }
 
-VisibleSelection HTMLTextFormControlElement::selection() const
+PassRefPtr<Range> HTMLTextFormControlElement::selection() const
 {
     if (!renderer() || !isTextFormControl() || cachedSelectionStart() < 0 || cachedSelectionEnd() < 0)
-        return VisibleSelection();
+        return 0;
     return toRenderTextControl(renderer())->selection(cachedSelectionStart(), cachedSelectionEnd());
 }
 
diff --git a/WebCore/html/HTMLFormControlElement.h b/WebCore/html/HTMLFormControlElement.h
index eae7f0a..4792dba 100644
--- a/WebCore/html/HTMLFormControlElement.h
+++ b/WebCore/html/HTMLFormControlElement.h
@@ -177,6 +177,8 @@ public:
 
     virtual ~HTMLTextFormControlElement();
 
+    // The derived class should return true if placeholder processing is needed.
+    virtual bool supportsPlaceholder() const = 0;
     String strippedPlaceholder() const;
 
     int selectionStart();
@@ -185,7 +187,7 @@ public:
     void setSelectionEnd(int);
     void select();
     void setSelectionRange(int start, int end);
-    VisibleSelection selection() const;
+    PassRefPtr<Range> selection() const;
 
 protected:
     HTMLTextFormControlElement(const QualifiedName&, Document*, HTMLFormElement*);
@@ -204,8 +206,6 @@ private:
     virtual int cachedSelectionStart() const = 0;
     virtual int cachedSelectionEnd() const = 0;
 
-    // The derived class should return true if placeholder processing is needed.
-    virtual bool supportsPlaceholder() const = 0;
     // Returns true if user-editable value is empty. Used to check placeholder visibility.
     virtual bool isEmptyValue() const = 0;
     // Called in dispatchFocusEvent(), after placeholder process, before calling parent's dispatchFocusEvent().
diff --git a/WebCore/html/HTMLFormElement.cpp b/WebCore/html/HTMLFormElement.cpp
index db5da66..31a72bd 100644
--- a/WebCore/html/HTMLFormElement.cpp
+++ b/WebCore/html/HTMLFormElement.cpp
@@ -107,7 +107,7 @@ bool HTMLFormElement::rendererIsNeeded(RenderStyle* style)
     if (!isDemoted())
         return HTMLElement::rendererIsNeeded(style);
 
-    Node* node = parentNode();
+    ContainerNode* node = parentNode();
     RenderObject* parentRenderer = node->renderer();
     bool parentIsTableElementPart = (parentRenderer->isTable() && node->hasTagName(tableTag))
         || (parentRenderer->isTableRow() && node->hasTagName(trTag))
diff --git a/WebCore/html/HTMLFrameElementBase.cpp b/WebCore/html/HTMLFrameElementBase.cpp
index 8cca465..f8d682c 100644
--- a/WebCore/html/HTMLFrameElementBase.cpp
+++ b/WebCore/html/HTMLFrameElementBase.cpp
@@ -25,7 +25,6 @@
 #include "HTMLFrameElementBase.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "Document.h"
 #include "EventNames.h"
 #include "FocusController.h"
@@ -35,6 +34,7 @@
 #include "FrameView.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "KURL.h"
 #include "Page.h"
 #include "RenderEmbeddedObject.h"
@@ -112,7 +112,7 @@ void HTMLFrameElementBase::openURL(bool lockHistory, bool lockBackForwardList)
 void HTMLFrameElementBase::parseMappedAttribute(Attribute* attr)
 {
     if (attr->name() == srcAttr)
-        setLocation(deprecatedParseURL(attr->value()));
+        setLocation(stripLeadingAndTrailingHTMLSpaces(attr->value()));
     else if (isIdAttributeName(attr->name())) {
         // Important to call through to base for the id attribute so the hasID bit gets set.
         HTMLFrameOwnerElement::parseMappedAttribute(attr);
diff --git a/WebCore/html/HTMLFrameSetElement.cpp b/WebCore/html/HTMLFrameSetElement.cpp
index 48c19a1..d7a47d7 100644
--- a/WebCore/html/HTMLFrameSetElement.cpp
+++ b/WebCore/html/HTMLFrameSetElement.cpp
@@ -164,7 +164,7 @@ void HTMLFrameSetElement::attach()
 {
     // Inherit default settings from parent frameset
     // FIXME: This is not dynamic.
-    for (Node* node = parentNode(); node; node = node->parentNode()) {
+    for (ContainerNode* node = parentNode(); node; node = node->parentNode()) {
         if (node->hasTagName(framesetTag)) {
             HTMLFrameSetElement* frameset = static_cast<HTMLFrameSetElement*>(node);
             if (!frameBorderSet)
@@ -186,7 +186,7 @@ void HTMLFrameSetElement::attach()
 
 void HTMLFrameSetElement::defaultEventHandler(Event* evt)
 {
-    if (evt->isMouseEvent() && !noresize && renderer()) {
+    if (evt->isMouseEvent() && !noresize && renderer() && renderer()->isFrameSet()) {
         if (toRenderFrameSet(renderer())->userResize(static_cast<MouseEvent*>(evt))) {
             evt->setDefaultHandled();
             return;
diff --git a/WebCore/html/HTMLHtmlElement.cpp b/WebCore/html/HTMLHtmlElement.cpp
index 6007805..59c0d3e 100644
--- a/WebCore/html/HTMLHtmlElement.cpp
+++ b/WebCore/html/HTMLHtmlElement.cpp
@@ -27,6 +27,7 @@
 #include "ApplicationCacheHost.h"
 #include "Document.h"
 #include "DocumentLoader.h"
+#include "DocumentParser.h"
 #include "Frame.h"
 #include "HTMLNames.h"
 
@@ -56,11 +57,10 @@ bool HTMLHtmlElement::isURLAttribute(Attribute* attribute) const
 }
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
-void HTMLHtmlElement::insertedIntoDocument()
+void HTMLHtmlElement::insertedByParser()
 {
-    HTMLElement::insertedIntoDocument();
-    
-    if (!document()->parsing())
+    // When parsing a fragment, its dummy document has a null parser.
+    if (!document()->parser() || !document()->parser()->documentWasLoadedAsPartOfNavigation())
         return;
 
     if (!document()->frame())
@@ -70,12 +70,8 @@ void HTMLHtmlElement::insertedIntoDocument()
     if (!documentLoader)
         return;
 
-    // Check the manifest attribute
-    // FIXME: Revisit this when we get a clarification from whatwg on how to handle empty
-    // manifest attributes. As spec'd, and coded here, the system will initiate an update
-    // passing in the document URL as the manifest URL. That's not a good thing.
     const AtomicString& manifest = getAttribute(manifestAttr);
-    if (manifest.isNull())
+    if (manifest.isEmpty())
         documentLoader->applicationCacheHost()->selectCacheWithoutManifest();
     else
         documentLoader->applicationCacheHost()->selectCacheWithManifest(document()->completeURL(manifest));
diff --git a/WebCore/html/HTMLHtmlElement.h b/WebCore/html/HTMLHtmlElement.h
index 47503f7..9cad44e 100644
--- a/WebCore/html/HTMLHtmlElement.h
+++ b/WebCore/html/HTMLHtmlElement.h
@@ -33,14 +33,14 @@ public:
     static PassRefPtr<HTMLHtmlElement> create(Document*);
     static PassRefPtr<HTMLHtmlElement> create(const QualifiedName&, Document*);
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    void insertedByParser();
+#endif
+
 private:
     HTMLHtmlElement(const QualifiedName&, Document*);
 
     virtual bool isURLAttribute(Attribute*) const;
-
-#if ENABLE(OFFLINE_WEB_APPLICATIONS)
-    virtual void insertedIntoDocument();
-#endif
 };
 
 } // namespace
diff --git a/WebCore/html/HTMLIFrameElement.cpp b/WebCore/html/HTMLIFrameElement.cpp
index b3fffe3..06af093 100644
--- a/WebCore/html/HTMLIFrameElement.cpp
+++ b/WebCore/html/HTMLIFrameElement.cpp
@@ -67,7 +67,6 @@ bool HTMLIFrameElement::mapToEntry(const QualifiedName& attrName, MappedAttribut
     return HTMLFrameElementBase::mapToEntry(attrName, result);
 }
 
-#if ENABLE(SANDBOX)
 static SandboxFlags parseSandboxAttribute(Attribute* attribute)
 {
     if (attribute->isNull())
@@ -103,7 +102,6 @@ static SandboxFlags parseSandboxAttribute(Attribute* attribute)
 
     return flags;
 }
-#endif
 
 void HTMLIFrameElement::parseMappedAttribute(Attribute* attr)
 {
@@ -127,11 +125,8 @@ void HTMLIFrameElement::parseMappedAttribute(Attribute* attr)
         if (!attr->isNull() && !attr->value().toInt())
             // Add a rule that nulls out our border width.
             addCSSLength(attr, CSSPropertyBorderWidth, "0");
-    }
-#if ENABLE(SANDBOX)
-    else if (attr->name() == sandboxAttr)
+    } else if (attr->name() == sandboxAttr)
         setSandboxFlags(parseSandboxAttribute(attr));
-#endif
     else
         HTMLFrameElementBase::parseMappedAttribute(attr);
 }
diff --git a/WebCore/html/HTMLImageElement.cpp b/WebCore/html/HTMLImageElement.cpp
index 29ea592..d66075e 100644
--- a/WebCore/html/HTMLImageElement.cpp
+++ b/WebCore/html/HTMLImageElement.cpp
@@ -24,7 +24,6 @@
 #include "HTMLImageElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "EventNames.h"
@@ -32,6 +31,7 @@
 #include "HTMLDocument.h"
 #include "HTMLFormElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "RenderImage.h"
 #include "ScriptEventListener.h"
 
@@ -131,7 +131,7 @@ void HTMLImageElement::parseMappedAttribute(Attribute* attr)
         if (attr->value().string()[0] == '#')
             usemap = attr->value();
         else
-            usemap = document()->completeURL(deprecatedParseURL(attr->value())).string();
+            usemap = document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attr->value())).string();
         setIsLink(!attr->isNull());
     } else if (attrName == ismapAttr)
         ismap = true;
@@ -237,7 +237,7 @@ void HTMLImageElement::insertedIntoTree(bool deep)
 {
     if (!m_form) {
         // m_form can be non-null if it was set in constructor.
-        for (Node* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
+        for (ContainerNode* ancestor = parentNode(); ancestor; ancestor = ancestor->parentNode()) {
             if (ancestor->hasTagName(formTag)) {
                 m_form = static_cast<HTMLFormElement*>(ancestor);
                 m_form->registerImgElement(this);
diff --git a/WebCore/html/HTMLImageLoader.cpp b/WebCore/html/HTMLImageLoader.cpp
index 6e31d9b..f620542 100644
--- a/WebCore/html/HTMLImageLoader.cpp
+++ b/WebCore/html/HTMLImageLoader.cpp
@@ -22,13 +22,13 @@
 #include "config.h"
 #include "HTMLImageLoader.h"
 
-#include "CSSHelper.h"
 #include "CachedImage.h"
 #include "Element.h"
 #include "Event.h"
 #include "EventNames.h"
 #include "HTMLNames.h"
 #include "HTMLObjectElement.h"
+#include "HTMLParserIdioms.h"
 
 #if USE(JSC)
 #include "JSDOMWindowBase.h"
@@ -55,7 +55,7 @@ void HTMLImageLoader::dispatchLoadEvent()
 
 String HTMLImageLoader::sourceURI(const AtomicString& attr) const
 {
-    return deprecatedParseURL(attr);
+    return stripLeadingAndTrailingHTMLSpaces(attr);
 }
 
 void HTMLImageLoader::notifyFinished(CachedResource*)
diff --git a/WebCore/html/HTMLInputElement.cpp b/WebCore/html/HTMLInputElement.cpp
index ef7c42f..9807a55 100644
--- a/WebCore/html/HTMLInputElement.cpp
+++ b/WebCore/html/HTMLInputElement.cpp
@@ -56,7 +56,6 @@
 #include "LocalizedStrings.h"
 #include "MouseEvent.h"
 #include "Page.h"
-#include "RegularExpression.h"
 #include "RenderButton.h"
 #include "RenderFileUploadControl.h"
 #include "RenderImage.h"
@@ -65,6 +64,7 @@
 #include "RenderTextControlSingleLine.h"
 #include "RenderTheme.h"
 #include "ScriptEventListener.h"
+#include "Settings.h"
 #include "StepRange.h"
 #include "TextEvent.h"
 #ifdef ANDROID_ACCEPT_CHANGES_TO_FOCUSED_TEXTFIELDS
@@ -84,72 +84,12 @@ using namespace HTMLNames;
 
 const int maxSavedResults = 256;
 
-// Constant values for getAllowedValueStep().
-static const double dateDefaultStep = 1.0;
-static const double dateStepScaleFactor = 86400000.0;
-static const double dateTimeDefaultStep = 60.0;
-static const double dateTimeStepScaleFactor = 1000.0;
-static const double monthDefaultStep = 1.0;
-static const double monthStepScaleFactor = 1.0;
-static const double numberDefaultStep = 1.0;
-static const double numberStepScaleFactor = 1.0;
-static const double timeDefaultStep = 60.0;
-static const double timeStepScaleFactor = 1000.0;
-static const double weekDefaultStep = 1.0;
-static const double weekStepScaleFactor = 604800000.0;
-
-// Constant values for minimum().
-static const double numberDefaultMinimum = -DBL_MAX;
-static const double rangeDefaultMinimum = 0.0;
-
-// Constant values for maximum().
-static const double numberDefaultMaximum = DBL_MAX;
-static const double rangeDefaultMaximum = 100.0;
-
-static const double defaultStepBase = 0.0;
-static const double weekDefaultStepBase = -259200000.0; // The first day of 1970-W01.
-
-static const double msecPerMinute = 60 * 1000;
-static const double msecPerSecond = 1000;
-
-static const char emailPattern[] =
-    "[a-z0-9!#$%&'*+/=?^_`{|}~.-]+" // local part
-    "@"
-    "[a-z0-9-]+(\\.[a-z0-9-]+)+"; // domain part
-
 static bool isNumberCharacter(UChar ch)
 {
     return ch == '+' || ch == '-' || ch == '.' || ch == 'e' || ch == 'E'
         || (ch >= '0' && ch <= '9');
 }
 
-static bool isValidColorString(const String& value)
-{
-    if (value.isEmpty())
-        return false;
-    if (value[0] == '#') {
-        // We don't accept #rgb and #aarrggbb formats.
-        if (value.length() != 7)
-            return false;
-    }
-    Color color(value); // This accepts named colors such as "white".
-    return color.isValid() && !color.hasAlpha();
-}
-
-static bool isValidEmailAddress(const String& address)
-{
-    int addressLength = address.length();
-    if (!addressLength)
-        return false;
-
-    DEFINE_STATIC_LOCAL(const RegularExpression, regExp, (emailPattern, TextCaseInsensitive));
-
-    int matchLength;
-    int matchOffset = regExp.match(address, 0, &matchLength);
-
-    return !matchOffset && matchLength == addressLength;
-}
-
 HTMLInputElement::HTMLInputElement(const QualifiedName& tagName, Document* document, HTMLFormElement* form)
     : HTMLTextFormControlElement(tagName, document, form)
     , m_xPos(0)
@@ -199,17 +139,10 @@ bool HTMLInputElement::autoComplete() const
     return HTMLTextFormControlElement::autoComplete();
 }
 
-static inline CheckedRadioButtons& checkedRadioButtons(const HTMLInputElement* element)
-{
-    if (HTMLFormElement* form = element->form())
-        return form->checkedRadioButtons();
-    return element->document()->checkedRadioButtons();
-}
-
 void HTMLInputElement::updateCheckedRadioButtons()
 {
     if (attached() && checked())
-        checkedRadioButtons(this).addButton(this);
+        checkedRadioButtons().addButton(this);
 
     if (form()) {
         const Vector<HTMLFormControlElement*>& controls = form()->associatedElements();
@@ -250,7 +183,7 @@ bool HTMLInputElement::isValidValue(const String& value) const
         ASSERT_NOT_REACHED();
         return false;
     }
-    return !typeMismatch(value)
+    return !m_inputType->typeMismatchFor(value)
         && !stepMismatch(value)
         && !rangeUnderflow(value)
         && !rangeOverflow(value)
@@ -259,93 +192,16 @@ bool HTMLInputElement::isValidValue(const String& value) const
         && !valueMissing(value);
 }
 
-bool HTMLInputElement::typeMismatch(const String& value) const
+bool HTMLInputElement::typeMismatch() const
 {
-    switch (deprecatedInputType()) {
-    case COLOR:
-        return !isValidColorString(value);
-    case NUMBER:
-        ASSERT(parseToDoubleForNumberType(value, 0));
-        return false;
-    case URL:
-        return !KURL(KURL(), value).isValid();
-    case EMAIL: {
-        if (!multiple())
-            return !isValidEmailAddress(value);
-        Vector<String> addresses;
-        value.split(',', addresses);
-        for (unsigned i = 0; i < addresses.size(); ++i) {
-            if (!isValidEmailAddress(addresses[i]))
-                return true;
-        }
-        return false;
-    }
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case TIME:
-    case WEEK:
-        return !parseToDateComponents(deprecatedInputType(), value, 0);
-    case BUTTON:
-    case CHECKBOX:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RANGE:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-        return false;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->typeMismatch();
 }
 
 bool HTMLInputElement::valueMissing(const String& value) const
 {
     if (!isRequiredFormControl() || readOnly() || disabled())
         return false;
-
-    switch (deprecatedInputType()) {
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case EMAIL:
-    case FILE:
-    case MONTH:
-    case NUMBER:
-    case PASSWORD:
-    case SEARCH:
-    case TELEPHONE:
-    case TEXT:
-    case TIME:
-    case URL:
-    case WEEK:
-        return value.isEmpty();
-    case CHECKBOX:
-        return !checked();
-    case RADIO:
-        return !checkedRadioButtons(this).checkedButtonForGroup(name());
-    case COLOR:
-        return false;
-    case BUTTON:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case RANGE:
-    case RESET:
-    case SUBMIT:
-        break;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->valueMissing(value);
 }
 
 bool HTMLInputElement::patternMismatch(const String& value) const
@@ -373,199 +229,22 @@ bool HTMLInputElement::tooLong(const String& value, NeedsToCheckDirtyFlag check)
 
 bool HTMLInputElement::rangeUnderflow(const String& value) const
 {
-    const double nan = numeric_limits<double>::quiet_NaN();
-    switch (deprecatedInputType()) {
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case NUMBER:
-    case TIME:
-    case WEEK: {
-        double doubleValue = parseToDouble(value, nan);
-        return isfinite(doubleValue) && doubleValue < minimum();
-    }
-    case RANGE: // Guaranteed by sanitization.
-        ASSERT(parseToDouble(value, nan) >= minimum());
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    return false;
+    return m_inputType->rangeUnderflow(value);
 }
 
 bool HTMLInputElement::rangeOverflow(const String& value) const
 {
-    const double nan = numeric_limits<double>::quiet_NaN();
-    switch (deprecatedInputType()) {
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case NUMBER:
-    case TIME:
-    case WEEK: {
-        double doubleValue = parseToDouble(value, nan);
-        return isfinite(doubleValue) && doubleValue > maximum();
-    }
-    case RANGE: // Guaranteed by sanitization.
-        ASSERT(parseToDouble(value, nan) <= maximum());
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    return false;
+    return m_inputType->rangeOverflow(value);
 }
 
 double HTMLInputElement::minimum() const
 {
-    switch (deprecatedInputType()) {
-    case DATE:
-        return parseToDouble(getAttribute(minAttr), DateComponents::minimumDate());
-    case DATETIME:
-    case DATETIMELOCAL:
-        return parseToDouble(getAttribute(minAttr), DateComponents::minimumDateTime());
-    case MONTH:
-        return parseToDouble(getAttribute(minAttr), DateComponents::minimumMonth());
-    case NUMBER:
-        return parseToDouble(getAttribute(minAttr), numberDefaultMinimum);
-    case RANGE:
-        return parseToDouble(getAttribute(minAttr), rangeDefaultMinimum);
-    case TIME:
-        return parseToDouble(getAttribute(minAttr), DateComponents::minimumTime());
-    case WEEK:
-        return parseToDouble(getAttribute(minAttr), DateComponents::minimumWeek());
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
+    return m_inputType->minimum();
 }
 
 double HTMLInputElement::maximum() const
 {
-    switch (deprecatedInputType()) {
-    case DATE:
-        return parseToDouble(getAttribute(maxAttr), DateComponents::maximumDate());
-    case DATETIME:
-    case DATETIMELOCAL:
-        return parseToDouble(getAttribute(maxAttr), DateComponents::maximumDateTime());
-    case MONTH:
-        return parseToDouble(getAttribute(maxAttr), DateComponents::maximumMonth());
-    case NUMBER:
-        return parseToDouble(getAttribute(maxAttr), numberDefaultMaximum);
-    case RANGE: {
-        double max = parseToDouble(getAttribute(maxAttr), rangeDefaultMaximum);
-        // A remedy for the inconsistent min/max values for RANGE.
-        // Sets the maximum to the default or the minimum value.
-        double min = minimum();
-        if (max < min)
-            max = std::max(min, rangeDefaultMaximum);
-        return max;
-    }
-    case TIME:
-        return parseToDouble(getAttribute(maxAttr), DateComponents::maximumTime());
-    case WEEK:
-        return parseToDouble(getAttribute(maxAttr), DateComponents::maximumWeek());
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-double HTMLInputElement::stepBase() const
-{
-    switch (deprecatedInputType()) {
-    case RANGE:
-        return minimum();
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case NUMBER:
-    case TIME:
-        return parseToDouble(getAttribute(minAttr), defaultStepBase);
-    case WEEK:
-        return parseToDouble(getAttribute(minAttr), weekDefaultStepBase);
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    ASSERT_NOT_REACHED();
-    return 0.0;
+    return m_inputType->maximum();
 }
 
 bool HTMLInputElement::stepMismatch(const String& value) const
@@ -573,126 +252,15 @@ bool HTMLInputElement::stepMismatch(const String& value) const
     double step;
     if (!getAllowedValueStep(&step))
         return false;
-    switch (deprecatedInputType()) {
-    case RANGE:
-        // stepMismatch doesn't occur for RANGE. RenderSlider guarantees the
-        // value matches to step on user input, and sanitation takes care
-        // of the general case.
-        return false;
-    case NUMBER: {
-        double doubleValue;
-        if (!parseToDoubleForNumberType(value, &doubleValue))
-            return false;
-        doubleValue = fabs(doubleValue - stepBase());
-        if (isinf(doubleValue))
-            return false;
-        // double's fractional part size is DBL_MAN_DIG-bit.  If the current
-        // value is greater than step*2^DBL_MANT_DIG, the following fmod() makes
-        // no sense.
-        if (doubleValue / pow(2.0, DBL_MANT_DIG) > step)
-            return false;
-        double remainder = fmod(doubleValue, step);
-        // Accepts errors in lower 7-bit.
-        double acceptableError = step / pow(2.0, DBL_MANT_DIG - 7);
-        return acceptableError < remainder && remainder < (step - acceptableError);
-    }
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case TIME:
-    case WEEK: {
-        const double nan = numeric_limits<double>::quiet_NaN();
-        double doubleValue = parseToDouble(value, nan);
-        doubleValue = fabs(doubleValue - stepBase());
-        if (!isfinite(doubleValue))
-            return false;
-        ASSERT(round(doubleValue) == doubleValue);
-        ASSERT(round(step) == step);
-        return fmod(doubleValue, step);
-    }
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
-    }
-    // Non-supported types should be rejected by getAllowedValueStep().
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool HTMLInputElement::getStepParameters(double* defaultStep, double* stepScaleFactor) const
-{
-    ASSERT(defaultStep);
-    ASSERT(stepScaleFactor);
-    switch (deprecatedInputType()) {
-    case NUMBER:
-    case RANGE:
-        *defaultStep = numberDefaultStep;
-        *stepScaleFactor = numberStepScaleFactor;
-        return true;
-    case DATE:
-        *defaultStep = dateDefaultStep;
-        *stepScaleFactor = dateStepScaleFactor;
-        return true;
-    case DATETIME:
-    case DATETIMELOCAL:
-        *defaultStep = dateTimeDefaultStep;
-        *stepScaleFactor = dateTimeStepScaleFactor;
-        return true;
-    case MONTH:
-        *defaultStep = monthDefaultStep;
-        *stepScaleFactor = monthStepScaleFactor;
-        return true;
-    case TIME:
-        *defaultStep = timeDefaultStep;
-        *stepScaleFactor = timeStepScaleFactor;
-        return true;
-    case WEEK:
-        *defaultStep = weekDefaultStep;
-        *stepScaleFactor = weekStepScaleFactor;
-        return true;
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        return false;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->stepMismatch(value, step);
 }
 
 bool HTMLInputElement::getAllowedValueStep(double* step) const
 {
     ASSERT(step);
-    double defaultStep;
-    double stepScaleFactor;
-    if (!getStepParameters(&defaultStep, &stepScaleFactor))
+    double defaultStep = m_inputType->defaultStep();
+    double stepScaleFactor = m_inputType->stepScaleFactor();
+    if (!isfinite(defaultStep) || !isfinite(stepScaleFactor))
         return false;
     const AtomicString& stepString = getAttribute(stepAttr);
     if (stepString.isEmpty()) {
@@ -706,12 +274,12 @@ bool HTMLInputElement::getAllowedValueStep(double* step) const
         *step = defaultStep * stepScaleFactor;
         return true;
     }
-    // For DATE, MONTH, WEEK, the parsed value should be an integer.
-    if (deprecatedInputType() == DATE || deprecatedInputType() == MONTH || deprecatedInputType() == WEEK)
+    // For date, month, week, the parsed value should be an integer for some types.
+    if (m_inputType->parsedStepValueShouldBeInteger())
         parsed = max(round(parsed), 1.0);
     double result = parsed * stepScaleFactor;
-    // For DATETIME, DATETIMELOCAL, TIME, the result should be an integer.
-    if (deprecatedInputType() == DATETIME || deprecatedInputType() == DATETIMELOCAL || deprecatedInputType() == TIME)
+    // For datetime, datetime-local, time, the result should be an integer.
+    if (m_inputType->scaledStepValeuShouldBeInteger())
         result = max(round(result), 1.0);
     ASSERT(result > 0);
     *step = result;
@@ -726,7 +294,7 @@ void HTMLInputElement::applyStep(double count, ExceptionCode& ec)
         return;
     }
     const double nan = numeric_limits<double>::quiet_NaN();
-    double current = parseToDouble(value(), nan);
+    double current = m_inputType->parseToDouble(value(), nan);
     if (!isfinite(current)) {
         ec = INVALID_STATE_ERR;
         return;
@@ -736,13 +304,13 @@ void HTMLInputElement::applyStep(double count, ExceptionCode& ec)
         ec = INVALID_STATE_ERR;
         return;
     }
-    if (newValue < minimum()) {
+    if (newValue < m_inputType->minimum()) {
         ec = INVALID_STATE_ERR;
         return;
     }
-    double base = stepBase();
+    double base = m_inputType->stepBase();
     newValue = base + round((newValue - base) / step) * step;
-    if (newValue > maximum()) {
+    if (newValue > m_inputType->maximum()) {
         ec = INVALID_STATE_ERR;
         return;
     }
@@ -770,6 +338,9 @@ bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
         return false;
 
     if (deprecatedInputType() == RADIO) {
+        // When using Spatial Navigation, every radio button should be focusable.
+        if (document()->frame() && document()->frame()->settings() && document()->frame()->settings()->isSpatialNavigationEnabled())
+            return true;
 
         // Never allow keyboard tabbing to leave you in the same radio group.  Always
         // skip any other elements in the group.
@@ -781,7 +352,7 @@ bool HTMLInputElement::isKeyboardFocusable(KeyboardEvent* event) const
         }
         
         // Allow keyboard focus if we're checked or if nothing in the group is checked.
-        return checked() || !checkedRadioButtons(this).checkedButtonForGroup(name());
+        return checked() || !checkedRadioButtons().checkedButtonForGroup(name());
     }
     
     return true;
@@ -847,33 +418,32 @@ void HTMLInputElement::setType(const String& t)
         setAttribute(typeAttr, t);
 }
 
-typedef HashMap<String, HTMLInputElement::DeprecatedInputType, CaseFoldingHash> InputTypeMap;
-static PassOwnPtr<InputTypeMap> createTypeMap()
+PassOwnPtr<HTMLInputElement::InputTypeMap> HTMLInputElement::createTypeMap()
 {
     OwnPtr<InputTypeMap> map = adoptPtr(new InputTypeMap);
-    map->add("button", HTMLInputElement::BUTTON);
-    map->add("checkbox", HTMLInputElement::CHECKBOX);
-    map->add("color", HTMLInputElement::COLOR);
-    map->add("date", HTMLInputElement::DATE);
-    map->add("datetime", HTMLInputElement::DATETIME);
-    map->add("datetime-local", HTMLInputElement::DATETIMELOCAL);
-    map->add("email", HTMLInputElement::EMAIL);
-    map->add("file", HTMLInputElement::FILE);
-    map->add("hidden", HTMLInputElement::HIDDEN);
-    map->add("image", HTMLInputElement::IMAGE);
-    map->add("khtml_isindex", HTMLInputElement::ISINDEX);
-    map->add("month", HTMLInputElement::MONTH);
-    map->add("number", HTMLInputElement::NUMBER);
-    map->add("password", HTMLInputElement::PASSWORD);
-    map->add("radio", HTMLInputElement::RADIO);
-    map->add("range", HTMLInputElement::RANGE);
-    map->add("reset", HTMLInputElement::RESET);
-    map->add("search", HTMLInputElement::SEARCH);
-    map->add("submit", HTMLInputElement::SUBMIT);
-    map->add("tel", HTMLInputElement::TELEPHONE);
-    map->add("time", HTMLInputElement::TIME);
-    map->add("url", HTMLInputElement::URL);
-    map->add("week", HTMLInputElement::WEEK);
+    map->add("button", BUTTON);
+    map->add("checkbox", CHECKBOX);
+    map->add("color", COLOR);
+    map->add("date", DATE);
+    map->add("datetime", DATETIME);
+    map->add("datetime-local", DATETIMELOCAL);
+    map->add("email", EMAIL);
+    map->add("file", FILE);
+    map->add("hidden", HIDDEN);
+    map->add("image", IMAGE);
+    map->add("khtml_isindex", ISINDEX);
+    map->add("month", MONTH);
+    map->add("number", NUMBER);
+    map->add("password", PASSWORD);
+    map->add("radio", RADIO);
+    map->add("range", RANGE);
+    map->add("reset", RESET);
+    map->add("search", SEARCH);
+    map->add("submit", SUBMIT);
+    map->add("tel", TELEPHONE);
+    map->add("time", TIME);
+    map->add("url", URL);
+    map->add("week", WEEK);
     // No need to register "text" because it is the default type.
     return map.release();
 }
@@ -897,7 +467,7 @@ void HTMLInputElement::updateType()
             // Useful in case we were called from inside parseMappedAttribute.
             setAttribute(typeAttr, type());
         else {
-            checkedRadioButtons(this).removeButton(this);
+            checkedRadioButtons().removeButton(this);
 
             if (newType == FILE && !m_fileList)
                 m_fileList = FileList::create();
@@ -947,7 +517,7 @@ void HTMLInputElement::updateType()
                     updateFocusAppearance(true);
             }
 
-            checkedRadioButtons(this).addButton(this);
+            checkedRadioButtons().addButton(this);
         }
 
         setNeedsValidityCheck();
@@ -1115,9 +685,9 @@ bool HTMLInputElement::mapToEntry(const QualifiedName& attrName, MappedAttribute
 void HTMLInputElement::parseMappedAttribute(Attribute* attr)
 {
     if (attr->name() == nameAttr) {
-        checkedRadioButtons(this).removeButton(this);
+        checkedRadioButtons().removeButton(this);
         m_data.setName(attr->value());
-        checkedRadioButtons(this).addButton(this);
+        checkedRadioButtons().addButton(this);
         HTMLFormControlElementWithState::parseMappedAttribute(attr);
     } else if (attr->name() == autocompleteAttr) {
         if (equalIgnoringCase(attr->value(), "off")) {
@@ -1219,7 +789,8 @@ void HTMLInputElement::parseMappedAttribute(Attribute* attr)
       if (renderer())
           renderer()->updateFromElement();
       setNeedsStyleRecalc();
-    }
+    } else if (attr->name() == onwebkitspeechchangeAttr)
+        setAttributeEventListener(eventNames().webkitspeechchangeEvent, createAttributeEventListener(this, attr));
 #endif
     else
         HTMLTextFormControlElement::parseMappedAttribute(attr);
@@ -1461,7 +1032,7 @@ void HTMLInputElement::setChecked(bool nowChecked, bool sendChangeEvent)
     if (checked() == nowChecked)
         return;
 
-    checkedRadioButtons(this).removeButton(this);
+    checkedRadioButtons().removeButton(this);
 
     m_useDefaultChecked = false;
     m_checked = nowChecked;
@@ -1584,6 +1155,7 @@ String HTMLInputElement::valueWithDefault() const
             v = submitButtonDefaultLabel();
             break;
         }
+<<<<<<< HEAD
     }
     return v;
 }
@@ -1825,144 +1397,97 @@ double HTMLInputElement::valueAsNumber() const
     case TEXT:
     case URL:
         return nan;
+=======
+>>>>>>> webkit.org at r70209
     }
-    ASSERT_NOT_REACHED();
-    return nan;
+    return v;
 }
 
-void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec)
+void HTMLInputElement::setValueForUser(const String& value)
 {
-    if (!isfinite(newValue)) {
-        ec = NOT_SUPPORTED_ERR;
-        return;
-    }
-    switch (deprecatedInputType()) {
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case NUMBER:
-    case RANGE:
-    case TIME:
-    case WEEK:
-        setValue(serialize(newValue));
+    // Call setValue and make it send a change event.
+    setValue(value, true);
+}
+
+const String& HTMLInputElement::suggestedValue() const
+{
+    return m_data.suggestedValue();
+}
+
+void HTMLInputElement::setSuggestedValue(const String& value)
+{
+    if (deprecatedInputType() != TEXT)
         return;
+    setFormControlValueMatchesRenderer(false);
+    m_data.setSuggestedValue(sanitizeValue(value));
+    updatePlaceholderVisibility(false);
+    if (renderer())
+        renderer()->updateFromElement();
+    setNeedsStyleRecalc();
+}
 
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        ec = INVALID_STATE_ERR;
+void HTMLInputElement::setValue(const String& value, bool sendChangeEvent)
+{
+    // For security reasons, we don't allow setting the filename, but we do allow clearing it.
+    // The HTML5 spec (as of the 10/24/08 working draft) says that the value attribute isn't applicable to the file upload control
+    // but we don't want to break existing websites, who may be relying on this method to clear things.
+    if (deprecatedInputType() == FILE && !value.isEmpty())
         return;
+
+    setFormControlValueMatchesRenderer(false);
+    if (storesValueSeparateFromAttribute()) {
+        if (deprecatedInputType() == FILE)
+            m_fileList->clear();
+        else {
+            m_data.setValue(sanitizeValue(value));
+            if (isTextField())
+                updatePlaceholderVisibility(false);
+        }
+        setNeedsStyleRecalc();
+    } else
+        setAttribute(valueAttr, sanitizeValue(value));
+
+    setNeedsValidityCheck();
+
+    if (isTextField()) {
+        unsigned max = m_data.value().length();
+        if (document()->focusedNode() == this)
+            InputElement::updateSelectionRange(this, this, max, max);
+        else
+            cacheSelection(max, max);
+        m_data.setSuggestedValue(String());
     }
-    ASSERT_NOT_REACHED();
+
+    // Don't dispatch the change event when focused, it will be dispatched
+    // when the control loses focus.
+    if (sendChangeEvent && document()->focusedNode() != this)
+        dispatchFormControlChangeEvent();
+
+    InputElement::notifyFormStateChanged(this);
 }
 
-String HTMLInputElement::serializeForDateTimeTypes(double value) const
+double HTMLInputElement::valueAsDate() const
 {
-    bool success = false;
-    DateComponents date;
-    switch (deprecatedInputType()) {
-    case DATE:
-        success = date.setMillisecondsSinceEpochForDate(value);
-        break;
-    case DATETIME:
-        success = date.setMillisecondsSinceEpochForDateTime(value);
-        break;
-    case DATETIMELOCAL:
-        success = date.setMillisecondsSinceEpochForDateTimeLocal(value);
-        break;
-    case MONTH:
-        success = date.setMonthsSinceEpoch(value);
-        break;
-    case TIME:
-        success = date.setMillisecondsSinceMidnight(value);
-        break;
-    case WEEK:
-        success = date.setMillisecondsSinceEpochForWeek(value);
-        break;
-    case NUMBER:
-    case RANGE:
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        ASSERT_NOT_REACHED();
-        return String();
-    }
-    if (!success)
-        return String();
+    return m_inputType->valueAsDate();
+}
 
-    double step;
-    if (!getAllowedValueStep(&step))
-        return date.toString();
-    if (!fmod(step, msecPerMinute))
-        return date.toString(DateComponents::None);
-    if (!fmod(step, msecPerSecond))
-        return date.toString(DateComponents::Second);
-    return date.toString(DateComponents::Millisecond);
+void HTMLInputElement::setValueAsDate(double value, ExceptionCode& ec)
+{
+    m_inputType->setValueAsDate(value, ec);
 }
 
-String HTMLInputElement::serialize(double value) const
+double HTMLInputElement::valueAsNumber() const
 {
-    if (!isfinite(value))
-        return String();
-    switch (deprecatedInputType()) {
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case MONTH:
-    case TIME:
-    case WEEK:
-        return serializeForDateTimeTypes(value);
-    case NUMBER:
-    case RANGE:
-        return serializeForNumberType(value);
+    return m_inputType->valueAsNumber();
+}
 
-    case BUTTON:
-    case CHECKBOX:
-    case COLOR:
-    case EMAIL:
-    case FILE:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case PASSWORD:
-    case RADIO:
-    case RESET:
-    case SEARCH:
-    case SUBMIT:
-    case TELEPHONE:
-    case TEXT:
-    case URL:
-        break;
+void HTMLInputElement::setValueAsNumber(double newValue, ExceptionCode& ec)
+{
+    if (!isfinite(newValue)) {
+        ec = NOT_SUPPORTED_ERR;
+        return;
     }
-    ASSERT_NOT_REACHED();
-    return String();
+    m_inputType->setValueAsNumber(newValue, ec);
 }
 
 String HTMLInputElement::placeholder() const
@@ -2090,7 +1615,7 @@ void* HTMLInputElement::preDispatchEventHandler(Event* evt)
             // We really want radio groups to end up in sane states, i.e., to have something checked.
             // Therefore if nothing is currently selected, we won't allow this action to be "undone", since
             // we want some object in the radio group to actually get selected.
-            HTMLInputElement* currRadio = checkedRadioButtons(this).checkedButtonForGroup(name());
+            HTMLInputElement* currRadio = checkedRadioButtons().checkedButtonForGroup(name());
             if (currRadio) {
                 // We have a radio button selected that is not us.  Cache it in our result field and ref it so
                 // that it can't be destroyed.
@@ -2326,29 +1851,32 @@ void HTMLInputElement::defaultEventHandler(Event* evt)
             // Right and down mean "next radio button".
             // Tested in WinIE, and even for RTL, left still means previous radio button (and so moves
             // to the right).  Seems strange, but we'll match it.
-            bool forward = (key == "Down" || key == "Right");
-            
-            // We can only stay within the form's children if the form hasn't been demoted to a leaf because
-            // of malformed HTML.
-            Node* n = this;
-            while ((n = (forward ? n->traverseNextNode() : n->traversePreviousNode()))) {
-                // Once we encounter a form element, we know we're through.
-                if (n->hasTagName(formTag))
-                    break;
-                    
-                // Look for more radio buttons.
-                if (n->hasTagName(inputTag)) {
-                    HTMLInputElement* elt = static_cast<HTMLInputElement*>(n);
-                    if (elt->form() != form())
+            // However, when using Spatial Navigation, we need to be able to navigate without changing the selection.
+            if (!document()->frame() || !document()->frame()->settings() || !document()->frame()->settings()->isSpatialNavigationEnabled()) {
+                bool forward = (key == "Down" || key == "Right");
+
+                // We can only stay within the form's children if the form hasn't been demoted to a leaf because
+                // of malformed HTML.
+                Node* n = this;
+                while ((n = (forward ? n->traverseNextNode() : n->traversePreviousNode()))) {
+                    // Once we encounter a form element, we know we're through.
+                    if (n->hasTagName(formTag))
                         break;
+
+                    // Look for more radio buttons.
                     if (n->hasTagName(inputTag)) {
-                        HTMLInputElement* inputElt = static_cast<HTMLInputElement*>(n);
-                        if (inputElt->deprecatedInputType() == RADIO && inputElt->name() == name() && inputElt->isFocusable()) {
-                            inputElt->setChecked(true);
-                            document()->setFocusedNode(inputElt);
-                            inputElt->dispatchSimulatedClick(evt, false, false);
-                            evt->setDefaultHandled();
+                        HTMLInputElement* elt = static_cast<HTMLInputElement*>(n);
+                        if (elt->form() != form())
                             break;
+                        if (n->hasTagName(inputTag)) {
+                            HTMLInputElement* inputElt = static_cast<HTMLInputElement*>(n);
+                            if (inputElt->deprecatedInputType() == RADIO && inputElt->name() == name() && inputElt->isFocusable()) {
+                                inputElt->setChecked(true);
+                                document()->setFocusedNode(inputElt);
+                                inputElt->dispatchSimulatedClick(evt, false, false);
+                                evt->setDefaultHandled();
+                                break;
+                            }
                         }
                     }
                 }
@@ -2500,11 +2028,11 @@ void HTMLInputElement::handleKeyEventForRange(KeyboardEvent* event)
 
     ExceptionCode ec;
     if (equalIgnoringCase(getAttribute(stepAttr), "any")) {
-        double min = minimum();
-        double max = maximum();
+        double min = m_inputType->minimum();
+        double max = m_inputType->maximum();
         // FIXME: Is 1/100 reasonable?
         double step = (max - min) / 100;
-        double current = parseToDouble(value(), numeric_limits<double>::quiet_NaN());
+        double current = m_inputType->parseToDouble(value(), numeric_limits<double>::quiet_NaN());
         ASSERT(isfinite(current));
         double newValue;
         if (key == "Up" || key == "Right") {
@@ -2678,40 +2206,7 @@ void HTMLInputElement::unregisterForActivationCallbackIfNeeded()
 
 bool HTMLInputElement::isRequiredFormControl() const
 {
-    if (!required())
-        return false;
-
-    switch (deprecatedInputType()) {
-    case CHECKBOX:
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case EMAIL:
-    case FILE:
-    case MONTH:
-    case NUMBER:
-    case PASSWORD:
-    case RADIO:
-    case SEARCH:
-    case TELEPHONE:
-    case TEXT:
-    case TIME:
-    case URL:
-    case WEEK:
-        return true;
-    case BUTTON:
-    case COLOR:
-    case HIDDEN:
-    case IMAGE:
-    case ISINDEX:
-    case RANGE:
-    case RESET:
-    case SUBMIT:
-        return false;
-    }
-
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_inputType->supportsRequired() && required();
 }
 
 void HTMLInputElement::cacheSelection(int start, int end)
@@ -2771,66 +2266,7 @@ void HTMLInputElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls) cons
 
 bool HTMLInputElement::recalcWillValidate() const
 {
-    switch (deprecatedInputType()) {
-    case CHECKBOX:
-    case COLOR:
-    case DATE:
-    case DATETIME:
-    case DATETIMELOCAL:
-    case EMAIL:
-    case FILE:
-    case ISINDEX:
-    case MONTH:
-    case NUMBER:
-    case PASSWORD:
-    case RADIO:
-    case RANGE:
-    case SEARCH:
-    case TELEPHONE:
-    case TEXT:
-    case TIME:
-    case URL:
-    case WEEK:
-        return HTMLFormControlElementWithState::recalcWillValidate();
-    case BUTTON:
-    case HIDDEN:
-    case IMAGE:
-    case RESET:
-    case SUBMIT:
-        return false;
-    }
-    ASSERT_NOT_REACHED();
-    return false;
-}
-
-bool HTMLInputElement::parseToDateComponents(DeprecatedInputType type, const String& formString, DateComponents* out)
-{
-    if (formString.isEmpty())
-        return false;
-    DateComponents ignoredResult;
-    if (!out)
-        out = &ignoredResult;
-    const UChar* characters = formString.characters();
-    unsigned length = formString.length();
-    unsigned end;
-
-    switch (type) {
-    case DATE:
-        return out->parseDate(characters, length, 0, end) && end == length;
-    case DATETIME:
-        return out->parseDateTime(characters, length, 0, end) && end == length;
-    case DATETIMELOCAL:
-        return out->parseDateTimeLocal(characters, length, 0, end) && end == length;
-    case MONTH:
-        return out->parseMonth(characters, length, 0, end) && end == length;
-    case WEEK:
-        return out->parseWeek(characters, length, 0, end) && end == length;
-    case TIME:
-        return out->parseTime(characters, length, 0, end) && end == length;
-    default:
-        ASSERT_NOT_REACHED();
-        return false;
-    }
+    return m_inputType->supportsValidation() && HTMLFormControlElementWithState::recalcWillValidate();
 }
 
 #if ENABLE(DATALIST)
@@ -2924,9 +2360,9 @@ void HTMLInputElement::stepUpFromRenderer(int n)
 
     const double nan = numeric_limits<double>::quiet_NaN();
     String currentStringValue = value();
-    double current = parseToDouble(currentStringValue, nan);
-    if (!isfinite(current) || (n > 0 && current < minimum()) || (n < 0 && current > maximum()))
-        setValue(serialize(n > 0 ? minimum() : maximum()));
+    double current = m_inputType->parseToDouble(currentStringValue, nan);
+    if (!isfinite(current) || (n > 0 && current < m_inputType->minimum()) || (n < 0 && current > m_inputType->maximum()))
+        setValue(m_inputType->serialize(n > 0 ? m_inputType->minimum() : m_inputType->maximum()));
     else {
         ExceptionCode ec;
         stepUp(n, ec);
@@ -2982,6 +2418,12 @@ bool HTMLInputElement::isSpeechEnabled() const
     }
     return false;
 }
+
+void HTMLInputElement::dispatchWebkitSpeechChangeEvent()
+{
+    ASSERT(isSpeechEnabled());
+    dispatchEvent(Event::create(eventNames().webkitspeechchangeEvent, true, false));
+}
 #endif
 
 } // namespace
diff --git a/WebCore/html/HTMLInputElement.h b/WebCore/html/HTMLInputElement.h
index 88e2bf7..e584a78 100644
--- a/WebCore/html/HTMLInputElement.h
+++ b/WebCore/html/HTMLInputElement.h
@@ -25,6 +25,7 @@
 #define HTMLInputElement_h
 
 #include "HTMLFormControlElement.h"
+#include "HTMLFormElement.h"
 #include "InputElement.h"
 #include <wtf/OwnPtr.h>
 
@@ -41,40 +42,15 @@ class VisibleSelection;
 
 class HTMLInputElement : public HTMLTextFormControlElement, public InputElement {
 public:
-    enum DeprecatedInputType {
-        TEXT = 0, // TEXT must be 0.
-        PASSWORD,
-        ISINDEX,
-        CHECKBOX,
-        RADIO,
-        SUBMIT,
-        RESET,
-        FILE,
-        HIDDEN,
-        IMAGE,
-        BUTTON,
-        SEARCH,
-        RANGE,
-        EMAIL,
-        NUMBER,
-        TELEPHONE,
-        URL,
-        COLOR,
-        DATE,
-        DATETIME,
-        DATETIMELOCAL,
-        MONTH,
-        TIME,
-        WEEK,
-    };
-
     static PassRefPtr<HTMLInputElement> create(const QualifiedName&, Document*, HTMLFormElement*);
     virtual ~HTMLInputElement();
 
+    DEFINE_ATTRIBUTE_EVENT_LISTENER(webkitspeechchange);
+
     bool autoComplete() const;
 
     // For ValidityState
-    bool typeMismatch(const String&) const;
+    bool typeMismatch() const;
     // valueMissing() ignores the specified string value for CHECKBOX and RADIO.
     bool valueMissing(const String&) const;
     bool patternMismatch(const String&) const;
@@ -125,7 +101,8 @@ public:
 
 #if ENABLE(INPUT_SPEECH)
     virtual bool isSpeechEnabled() const;
-#endif    
+    void dispatchWebkitSpeechChangeEvent();
+#endif
 
     bool checked() const { return m_checked; }
     void setChecked(bool, bool sendChangeEvent = false);
@@ -175,8 +152,6 @@ public:
     virtual bool isActivatedSubmit() const;
     virtual void setActivatedSubmit(bool flag);
 
-    DeprecatedInputType deprecatedInputType() const { return static_cast<DeprecatedInputType>(m_deprecatedTypeNumber); }
-
     String altText() const;
 
     int maxResults() const { return m_maxResults; }
@@ -212,11 +187,6 @@ public:
     void addSearchResult();
     void onSearch();
 
-    // Parses the specified string as the DeprecatedInputType, and returns true if it is successfully parsed.
-    // An instance pointed by the DateComponents* parameter will have parsed values and be
-    // modified even if the parsing fails.  The DateComponents* parameter may be 0.
-    static bool parseToDateComponents(DeprecatedInputType, const String&, DateComponents*);
-
 #if ENABLE(DATALIST)
     HTMLElement* list() const;
     HTMLOptionElement* selectedOption() const;
@@ -226,14 +196,52 @@ public:
     void setWapInputFormat(String& mask);
 #endif
 
+    inline CheckedRadioButtons& checkedRadioButtons() const
+    {
+        if (HTMLFormElement* formElement = form())
+            return formElement->checkedRadioButtons();
+        return document()->checkedRadioButtons();
+    }
+
 protected:
     HTMLInputElement(const QualifiedName&, Document*, HTMLFormElement* = 0);
 
     virtual void defaultEventHandler(Event*);
 
 private:
+    enum DeprecatedInputType {
+        TEXT = 0, // TEXT must be 0.
+        PASSWORD,
+        ISINDEX,
+        CHECKBOX,
+        RADIO,
+        SUBMIT,
+        RESET,
+        FILE,
+        HIDDEN,
+        IMAGE,
+        BUTTON,
+        SEARCH,
+        RANGE,
+        EMAIL,
+        NUMBER,
+        TELEPHONE,
+        URL,
+        COLOR,
+        DATE,
+        DATETIME,
+        DATETIMELOCAL,
+        MONTH,
+        TIME,
+        WEEK,
+    };
+
     enum AutoCompleteSetting { Uninitialized, On, Off };
 
+    typedef HashMap<String, HTMLInputElement::DeprecatedInputType, CaseFoldingHash> InputTypeMap;
+    static PassOwnPtr<InputTypeMap> createTypeMap();
+    DeprecatedInputType deprecatedInputType() const { return static_cast<DeprecatedInputType>(m_deprecatedTypeNumber); }
+
     virtual void willMoveToNewOwnerDocument();
     virtual void didMoveToNewOwnerDocument();
 
@@ -326,26 +334,8 @@ private:
     void handleBeforeTextInsertedEvent(Event*);
     void handleKeyEventForRange(KeyboardEvent*);
     PassRefPtr<HTMLFormElement> createTemporaryFormForIsIndex();
-    // Helper for getAllowedValueStep();
-    bool getStepParameters(double* defaultStep, double* stepScaleFactor) const;
     // Helper for stepUp()/stepDown().  Adds step value * count to the current value.
     void applyStep(double count, ExceptionCode&);
-    // Helper for applyStepForNumberOrRange().
-    double stepBase() const;
-
-    // Parses the specified string for the current type, and return
-    // the double value for the parsing result if the parsing
-    // succeeds; Returns defaultValue otherwise. This function can
-    // return NaN or Infinity only if defaultValue is NaN or Infinity.
-    double parseToDouble(const String&, double defaultValue) const;
-    // Create a string representation of the specified double value for the
-    // current input type. If NaN or Infinity is specified, this returns an
-    // emtpy string. This should not be called for types without valueAsNumber.
-    String serialize(double) const;
-    // Create a string representation of the specified double value for the
-    // current input type. The type must be one of DATE, DATETIME,
-    // DATETIMELOCAL, MONTH, TIME, and WEEK.
-    String serializeForDateTimeTypes(double) const;
 
 #if ENABLE(DATALIST)
     HTMLDataListElement* dataList() const;
diff --git a/WebCore/html/HTMLInputElement.idl b/WebCore/html/HTMLInputElement.idl
index 19dfa5a..1ca7d6c 100644
--- a/WebCore/html/HTMLInputElement.idl
+++ b/WebCore/html/HTMLInputElement.idl
@@ -56,7 +56,7 @@ module html {
 #endif
         attribute [Reflect, URL] DOMString src;
         attribute [Reflect] DOMString step;
-        attribute [ConvertNullToNullString, JSCCustomGetter] DOMString type; // readonly dropped as part of DOM level 2
+        attribute [ConvertNullToNullString] DOMString type; // readonly dropped as part of DOM level 2
         attribute [Reflect] DOMString useMap;
         attribute [ConvertNullToNullString] DOMString value;
 #if !defined(LANGUAGE_CPP) || !LANGUAGE_CPP
@@ -100,7 +100,8 @@ module html {
         readonly attribute NodeList labels;
 
 #if defined(ENABLE_INPUT_SPEECH) && ENABLE_INPUT_SPEECH
-        attribute [Reflect, EnabledAtRuntime] boolean webkitspeech;
+        attribute [Reflect, EnabledAtRuntime] boolean webkitSpeech;
+        attribute [DontEnum] EventListener onwebkitspeechchange;
 #endif
     };
 
diff --git a/WebCore/html/HTMLLegendElement.cpp b/WebCore/html/HTMLLegendElement.cpp
index acc4a59..f998118 100644
--- a/WebCore/html/HTMLLegendElement.cpp
+++ b/WebCore/html/HTMLLegendElement.cpp
@@ -57,7 +57,7 @@ const AtomicString& HTMLLegendElement::formControlType() const
 HTMLFormControlElement* HTMLLegendElement::associatedControl()
 {
     // Check if there's a fieldset belonging to this legend.
-    Node* fieldset = parentNode();
+    ContainerNode* fieldset = parentNode();
     while (fieldset && !fieldset->hasTagName(fieldsetTag))
         fieldset = fieldset->parentNode();
     if (!fieldset)
diff --git a/WebCore/html/HTMLLinkElement.cpp b/WebCore/html/HTMLLinkElement.cpp
index 939b375..6a5c2f6 100644
--- a/WebCore/html/HTMLLinkElement.cpp
+++ b/WebCore/html/HTMLLinkElement.cpp
@@ -25,7 +25,6 @@
 #include "HTMLLinkElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "CachedCSSStyleSheet.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
@@ -34,6 +33,7 @@
 #include "FrameLoaderClient.h"
 #include "FrameTree.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "MediaList.h"
 #include "MediaQueryEvaluator.h"
 #include "Page.h"
@@ -118,7 +118,7 @@ void HTMLLinkElement::parseMappedAttribute(Attribute* attr)
         tokenizeRelAttribute(attr->value(), m_relAttribute);
         process();
     } else if (attr->name() == hrefAttr) {
-        m_url = document()->completeURL(deprecatedParseURL(attr->value()));
+        m_url = document()->completeURL(stripLeadingAndTrailingHTMLSpaces(attr->value()));
         process();
     } else if (attr->name() == typeAttr) {
         m_type = attr->value();
diff --git a/WebCore/html/HTMLMediaElement.cpp b/WebCore/html/HTMLMediaElement.cpp
index 6399f60..3f6c286 100644
--- a/WebCore/html/HTMLMediaElement.cpp
+++ b/WebCore/html/HTMLMediaElement.cpp
@@ -34,7 +34,6 @@
 #include "ClientRect.h"
 #include "ClientRectList.h"
 #include "ContentType.h"
-#include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Event.h"
@@ -126,6 +125,7 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     , m_lastTimeUpdateEventMovieTime(numeric_limits<float>::max())
     , m_loadState(WaitingForSource)
     , m_currentSourceNode(0)
+    , m_nextChildNodeToConsider(0)
     , m_player(0)
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     , m_proxyWidget(0)
@@ -137,7 +137,6 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     , m_playing(false)
     , m_isWaitingUntilMediaCanStart(false)
     , m_shouldDelayLoadEvent(false)
-    , m_isWaitingToDecrementLoadEventDelayCount(false)
     , m_haveFiredLoadedData(false)
     , m_inActiveDocument(true)
     , m_autoplaying(true)
@@ -157,12 +156,14 @@ HTMLMediaElement::HTMLMediaElement(const QualifiedName& tagName, Document* docum
     , m_loadInitiatedByUserGesture(false)
     , m_completelyLoaded(false)
 {
+    LOG(Media, "HTMLMediaElement::HTMLMediaElement");
     document->registerForDocumentActivationCallbacks(this);
     document->registerForMediaVolumeCallbacks(this);
 }
 
 HTMLMediaElement::~HTMLMediaElement()
 {
+    LOG(Media, "HTMLMediaElement::~HTMLMediaElement");
     if (m_isWaitingUntilMediaCanStart)
         document()->removeMediaCanStartListener(this);
     setShouldDelayLoadEvent(false);
@@ -326,6 +327,7 @@ RenderObject* HTMLMediaElement::createRenderer(RenderArena* arena, RenderStyle*)
  
 void HTMLMediaElement::insertedIntoDocument()
 {
+    LOG(Media, "HTMLMediaElement::removedFromDocument");
     HTMLElement::insertedIntoDocument();
     if (!getAttribute(srcAttr).isEmpty() && m_networkState == NETWORK_EMPTY)
         scheduleLoad();
@@ -333,6 +335,7 @@ void HTMLMediaElement::insertedIntoDocument()
 
 void HTMLMediaElement::removedFromDocument()
 {
+    LOG(Media, "HTMLMediaElement::removedFromDocument");
     if (m_networkState > NETWORK_EMPTY)
         pause(processingUserGesture());
     if (m_isFullscreen)
@@ -372,6 +375,7 @@ void HTMLMediaElement::recalcStyle(StyleChange change)
 
 void HTMLMediaElement::scheduleLoad()
 {
+    LOG(Media, "HTMLMediaElement::scheduleLoad");
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     createMediaPlayerProxy();
 #endif
@@ -400,15 +404,6 @@ void HTMLMediaElement::scheduleEvent(const AtomicString& eventName)
 
 void HTMLMediaElement::asyncEventTimerFired(Timer<HTMLMediaElement>*)
 {
-    // If we are waiting to release our delay on the load event, do that first and post
-    // the pending events on the next go around.
-    if (m_isWaitingToDecrementLoadEventDelayCount) {
-        setShouldDelayLoadEvent(false);
-        if (!m_asyncEventTimer.isActive())
-            m_asyncEventTimer.startOneShot(0);
-        return;
-    }
-
     Vector<RefPtr<Event> > pendingEvents;
     ExceptionCode ec = 0;
 
@@ -541,6 +536,7 @@ void HTMLMediaElement::prepareForLoad()
     m_displayMode = Unknown;
 
     // 1 - Abort any already-running instance of the resource selection algorithm for this element.
+    m_loadState = WaitingForSource;
     m_currentSourceNode = 0;
 
     // 2 - If there are any tasks from the media element's media element event task source in 
@@ -879,7 +875,7 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
     LOG(Media, "HTMLMediaElement::setNetworkState(%d) - current state is %d", static_cast<int>(state), static_cast<int>(m_networkState));
 
     if (state == MediaPlayer::Empty) {
-        // just update the cached state and leave, we can't do anything 
+        // Just update the cached state and leave, we can't do anything.
         m_networkState = NETWORK_EMPTY;
         return;
     }
@@ -890,12 +886,17 @@ void HTMLMediaElement::setNetworkState(MediaPlayer::NetworkState state)
         // If we failed while trying to load a <source> element, the movie was never parsed, and there are more
         // <source> children, schedule the next one
         if (m_readyState < HAVE_METADATA && m_loadState == LoadingFromSourceElement) {
-            m_currentSourceNode->scheduleErrorEvent();
+
+            if (m_currentSourceNode)
+                m_currentSourceNode->scheduleErrorEvent();
+            else
+                LOG(Media, "HTMLMediaElement::setNetworkState - error event not sent, <source> was removed");
+
             if (havePotentialSourceChild()) {
-                LOG(Media, "HTMLMediaElement::setNetworkState scheduling next <source>");
+                LOG(Media, "HTMLMediaElement::setNetworkState - scheduling next <source>");
                 scheduleNextSourceChild();
             } else {
-                LOG(Media, "HTMLMediaElement::setNetworkState no more <source> elements, waiting");
+                LOG(Media, "HTMLMediaElement::setNetworkState - no more <source> elements, waiting");
                 waitForSourceChange();
             }
 
@@ -1431,7 +1432,7 @@ float HTMLMediaElement::volume() const
 
 void HTMLMediaElement::setVolume(float vol, ExceptionCode& ec)
 {
-    LOG(Media, "HTMLMediaElement::setControls(%f)", vol);
+    LOG(Media, "HTMLMediaElement::setVolume(%f)", vol);
 
     if (vol < 0.0f || vol > 1.0f) {
         ec = INDEX_SIZE_ERR;
@@ -1579,11 +1580,15 @@ float HTMLMediaElement::percentLoaded() const
 
 bool HTMLMediaElement::havePotentialSourceChild()
 {
-    // Stash the current <source> node so we can restore it after checking
-    // to see there is another potential
+    // Stash the current <source> node and next nodes so we can restore them after checking
+    // to see there is another potential.
     HTMLSourceElement* currentSourceNode = m_currentSourceNode;
+    Node* nextNode = m_nextChildNodeToConsider;
+
     KURL nextURL = selectNextSourceChild(0, DoNothing);
+
     m_currentSourceNode = currentSourceNode;
+    m_nextChildNodeToConsider = nextNode;
 
     return nextURL.isValid();
 }
@@ -1597,22 +1602,29 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSo
         LOG(Media, "HTMLMediaElement::selectNextSourceChild(contentType : \"%s\")", contentType ? contentType->raw().utf8().data() : "");
 #endif
 
+    if (m_nextChildNodeToConsider == sourceChildEndOfListValue()) {
+#if !LOG_DISABLED
+        if (shouldLog)
+            LOG(Media, "HTMLMediaElement::selectNextSourceChild -> 0x0000, \"\"");
+#endif
+        return KURL();
+    }
+
     KURL mediaURL;
     Node* node;
-    bool lookingForPreviousNode = m_currentSourceNode;
+    HTMLSourceElement* source = 0;
+    bool lookingForStartNode = m_nextChildNodeToConsider;
     bool canUse = false;
 
     for (node = firstChild(); !canUse && node; node = node->nextSibling()) {
-        if (!node->hasTagName(sourceTag))
+        if (lookingForStartNode && m_nextChildNodeToConsider != node)
             continue;
-
-        if (lookingForPreviousNode) {
-            if (m_currentSourceNode == static_cast<HTMLSourceElement*>(node))
-                lookingForPreviousNode = false;
+        lookingForStartNode = false;
+        
+        if (!node->hasTagName(sourceTag))
             continue;
-        }
 
-        HTMLSourceElement* source = static_cast<HTMLSourceElement*>(node);
+        source = static_cast<HTMLSourceElement*>(node);
 
         // If candidate does not have a src attribute, or if its src attribute's value is the empty string ... jump down to the failed step below
         mediaURL = source->getNonEmptyURLAttribute(srcAttr);
@@ -1647,26 +1659,108 @@ KURL HTMLMediaElement::selectNextSourceChild(ContentType *contentType, InvalidSo
         if (!isSafeToLoadURL(mediaURL, actionIfInvalid) || !dispatchBeforeLoadEvent(mediaURL.string()))
             goto check_again;
 
-        // Making it this far means the <source> looks reasonable
+        // Making it this far means the <source> looks reasonable.
         canUse = true;
-        if (contentType)
-            *contentType = ContentType(source->type());
 
 check_again:
         if (!canUse && actionIfInvalid == Complain)
             source->scheduleErrorEvent();
-        m_currentSourceNode = static_cast<HTMLSourceElement*>(node);
     }
 
-    if (!canUse)
+    if (canUse) {
+        if (contentType)
+            *contentType = ContentType(source->type());
+        m_currentSourceNode = source;
+        m_nextChildNodeToConsider = source->nextSibling();
+        if (!m_nextChildNodeToConsider)
+            m_nextChildNodeToConsider = sourceChildEndOfListValue();
+    } else {
         m_currentSourceNode = 0;
+        m_nextChildNodeToConsider = sourceChildEndOfListValue();
+    }
+
 #if !LOG_DISABLED
     if (shouldLog)
-        LOG(Media, "HTMLMediaElement::selectNextSourceChild -> %s", canUse ? urlForLogging(mediaURL.string()).utf8().data() : "");
+        LOG(Media, "HTMLMediaElement::selectNextSourceChild -> %p, %s", m_currentSourceNode, canUse ? urlForLogging(mediaURL.string()).utf8().data() : "");
 #endif
     return canUse ? mediaURL : KURL();
 }
 
+void HTMLMediaElement::sourceWasAdded(HTMLSourceElement* source)
+{
+    LOG(Media, "HTMLMediaElement::sourceWasAdded(%p)", source);
+
+#if !LOG_DISABLED
+    if (source->hasTagName(sourceTag)) {
+        KURL url = source->getNonEmptyURLAttribute(srcAttr);
+        LOG(Media, "HTMLMediaElement::sourceWasAdded - 'src' is %s", urlForLogging(url).utf8().data());
+    }
+#endif
+    
+    // We should only consider a <source> element when there is not src attribute at all.
+    if (hasAttribute(srcAttr))
+        return;
+
+    // 4.8.8 - If a source element is inserted as a child of a media element that has no src 
+    // attribute and whose networkState has the value NETWORK_EMPTY, the user agent must invoke 
+    // the media element's resource selection algorithm.
+    if (networkState() == HTMLMediaElement::NETWORK_EMPTY) {
+        scheduleLoad();
+        return;
+    }
+
+    if (m_currentSourceNode && source == m_currentSourceNode->nextSibling()) {
+        LOG(Media, "HTMLMediaElement::sourceWasAdded - <source> inserted immediately after current source");
+        m_nextChildNodeToConsider = source;
+        return;
+    }
+
+    if (m_nextChildNodeToConsider != sourceChildEndOfListValue())
+        return;
+    
+    // 4.8.9.5, resource selection algorithm, source elements section:
+    // 20 - Wait until the node after pointer is a node other than the end of the list. (This step might wait forever.)
+    // 21 - Asynchronously await a stable state...
+    // 22 - Set the element's delaying-the-load-event flag back to true (this delays the load event again, in case 
+    // it hasn't been fired yet).
+    setShouldDelayLoadEvent(true);
+
+    // 23 - Set the networkState back to NETWORK_LOADING.
+    m_networkState = NETWORK_LOADING;
+    
+    // 24 - Jump back to the find next candidate step above.
+    m_nextChildNodeToConsider = source;
+    scheduleNextSourceChild();
+}
+
+void HTMLMediaElement::sourceWillBeRemoved(HTMLSourceElement* source)
+{
+    LOG(Media, "HTMLMediaElement::sourceWillBeRemoved(%p)", source);
+
+#if !LOG_DISABLED
+    if (source->hasTagName(sourceTag)) {
+        KURL url = source->getNonEmptyURLAttribute(srcAttr);
+        LOG(Media, "HTMLMediaElement::sourceWillBeRemoved - 'src' is %s", urlForLogging(url).utf8().data());
+    }
+#endif
+
+    if (source != m_currentSourceNode && source != m_nextChildNodeToConsider)
+        return;
+
+    if (source == m_nextChildNodeToConsider) {
+        m_nextChildNodeToConsider = m_nextChildNodeToConsider->nextSibling();
+        if (!m_nextChildNodeToConsider)
+            m_nextChildNodeToConsider = sourceChildEndOfListValue();
+        LOG(Media, "HTMLMediaElement::sourceRemoved - m_nextChildNodeToConsider set to %p", m_nextChildNodeToConsider);
+    } else if (source == m_currentSourceNode) {
+        // Clear the current source node pointer, but don't change the movie as the spec says:
+        // 4.8.8 - Dynamically modifying a source element and its attribute when the element is already 
+        // inserted in a video or audio element will have no effect.
+        m_currentSourceNode = 0;
+        LOG(Media, "HTMLMediaElement::sourceRemoved - m_currentSourceNode set to 0");
+    }
+}
+
 void HTMLMediaElement::mediaPlayerTimeChanged(MediaPlayer*)
 {
     LOG(Media, "HTMLMediaElement::mediaPlayerTimeChanged");
@@ -2003,6 +2097,7 @@ void HTMLMediaElement::userCancelledLoad()
     m_player.clear();
 #endif
     stopPeriodicTimers();
+    m_loadState = WaitingForSource;
 
     // 2 - Set the error attribute to a new MediaError object whose code attribute is set to MEDIA_ERR_ABORTED.
     m_error = MediaError::create(MediaError::MEDIA_ERR_ABORTED);
@@ -2338,24 +2433,9 @@ void HTMLMediaElement::setShouldDelayLoadEvent(bool shouldDelay)
     if (m_shouldDelayLoadEvent == shouldDelay)
         return;
 
-    // Don't decrement the load event delay if we are in the middle of a callback from
-    // the media engine. The load event is sent synchronously and may trigger a script that
-    // causes the document to be come inactive and that will clear the media engine, causing 
-    // the return to be a rough one.
-    if (!shouldDelay && processingMediaPlayerCallback()) {
-        m_isWaitingToDecrementLoadEventDelayCount = true;
-
-        // Instead of creating yet-another-timer, reuse the async event timer which is always
-        // used as a one-shot.
-        if (!m_asyncEventTimer.isActive())
-            m_asyncEventTimer.startOneShot(0);
-        return;
-    }
-
     LOG(Media, "HTMLMediaElement::setShouldDelayLoadEvent(%s)", boolString(shouldDelay));
 
     m_shouldDelayLoadEvent = shouldDelay;
-    m_isWaitingToDecrementLoadEventDelayCount = false;
     if (shouldDelay)
         document()->incrementLoadEventDelayCount();
     else
diff --git a/WebCore/html/HTMLMediaElement.h b/WebCore/html/HTMLMediaElement.h
index db75a9c..e5e7ae0 100644
--- a/WebCore/html/HTMLMediaElement.h
+++ b/WebCore/html/HTMLMediaElement.h
@@ -169,6 +169,9 @@ public:
 
     bool processingUserGesture() const;
 
+    void sourceWillBeRemoved(HTMLSourceElement*);
+    void sourceWasAdded(HTMLSourceElement*);
+
 protected:
     HTMLMediaElement(const QualifiedName&, Document*);
     virtual ~HTMLMediaElement();
@@ -331,7 +334,9 @@ private:
     enum LoadState { WaitingForSource, LoadingFromSrcAttr, LoadingFromSourceElement };
     LoadState m_loadState;
     HTMLSourceElement* m_currentSourceNode;
-    
+    Node* m_nextChildNodeToConsider;
+    Node* sourceChildEndOfListValue() { return static_cast<Node*>(this); }
+
     OwnPtr<MediaPlayer> m_player;
 #if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
     RefPtr<Widget> m_proxyWidget;
@@ -350,7 +355,6 @@ private:
     bool m_playing : 1;
     bool m_isWaitingUntilMediaCanStart : 1;
     bool m_shouldDelayLoadEvent : 1;
-    bool m_isWaitingToDecrementLoadEventDelayCount : 1;
     bool m_haveFiredLoadedData : 1;
     bool m_inActiveDocument : 1;
     bool m_autoplaying : 1;
diff --git a/WebCore/html/HTMLObjectElement.cpp b/WebCore/html/HTMLObjectElement.cpp
index e9c6f60..2b51286 100644
--- a/WebCore/html/HTMLObjectElement.cpp
+++ b/WebCore/html/HTMLObjectElement.cpp
@@ -25,7 +25,6 @@
 #include "HTMLObjectElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "EventNames.h"
 #include "ExceptionCode.h"
 #include "Frame.h"
@@ -34,6 +33,7 @@
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "HTMLParamElement.h"
+#include "HTMLParserIdioms.h"
 #include "MIMETypeRegistry.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
@@ -77,7 +77,7 @@ void HTMLObjectElement::parseMappedAttribute(Attribute* attr)
         if (!isImageType() && m_imageLoader)
             m_imageLoader.clear();
     } else if (attr->name() == dataAttr) {
-        m_url = deprecatedParseURL(attr->value());
+        m_url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (renderer()) {
             setNeedsWidgetUpdate(true);
             if (isImageType()) {
@@ -182,7 +182,7 @@ void HTMLObjectElement::parametersForPlugin(Vector<String>& paramNames, Vector<S
 
         // FIXME: url adjustment does not belong in this function.
         if (url.isEmpty() && urlParameter.isEmpty() && (equalIgnoringCase(name, "src") || equalIgnoringCase(name, "movie") || equalIgnoringCase(name, "code") || equalIgnoringCase(name, "url")))
-            urlParameter = deprecatedParseURL(p->value());
+            urlParameter = stripLeadingAndTrailingHTMLSpaces(p->value());
         // FIXME: serviceType calculation does not belong in this function.
         if (serviceType.isEmpty() && equalIgnoringCase(name, "type")) {
             serviceType = p->value();
@@ -279,7 +279,10 @@ void HTMLObjectElement::updateWidget(bool onlyCreateNonNetscapePlugins)
     if (onlyCreateNonNetscapePlugins && wouldLoadAsNetscapePlugin(url, serviceType))
         return;
 
+    ASSERT(!m_inBeforeLoadEventHandler);
+    m_inBeforeLoadEventHandler = true;
     bool beforeLoadAllowedLoad = dispatchBeforeLoadEvent(url);
+    m_inBeforeLoadEventHandler = false;
 
     // beforeload events can modify the DOM, potentially causing
     // RenderWidget::destroy() to be called.  Ensure we haven't been
diff --git a/WebCore/html/HTMLOptGroupElement.cpp b/WebCore/html/HTMLOptGroupElement.cpp
index 091e0f2..987eb51 100644
--- a/WebCore/html/HTMLOptGroupElement.cpp
+++ b/WebCore/html/HTMLOptGroupElement.cpp
@@ -79,7 +79,7 @@ void HTMLOptGroupElement::parseMappedAttribute(Attribute* attr)
 
 void HTMLOptGroupElement::recalcSelectOptions()
 {
-    Node* select = parentNode();
+    ContainerNode* select = parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
     if (select)
@@ -123,7 +123,7 @@ String HTMLOptGroupElement::groupLabelText() const
     
 HTMLSelectElement* HTMLOptGroupElement::ownerSelectElement() const
 {
-    Node* select = parentNode();
+    ContainerNode* select = parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
     
diff --git a/WebCore/html/HTMLOptionElement.cpp b/WebCore/html/HTMLOptionElement.cpp
index 3bf522c..67c3567 100644
--- a/WebCore/html/HTMLOptionElement.cpp
+++ b/WebCore/html/HTMLOptionElement.cpp
@@ -193,7 +193,7 @@ void HTMLOptionElement::childrenChanged(bool changedByParser, Node* beforeChange
 
 HTMLSelectElement* HTMLOptionElement::ownerSelectElement() const
 {
-    Node* select = parentNode();
+    ContainerNode* select = parentNode();
     while (select && !(select->hasTagName(selectTag) || select->hasTagName(keygenTag)))
         select = select->parentNode();
 
diff --git a/WebCore/html/HTMLPlugInElement.cpp b/WebCore/html/HTMLPlugInElement.cpp
index 25ef751..bf2722b 100644
--- a/WebCore/html/HTMLPlugInElement.cpp
+++ b/WebCore/html/HTMLPlugInElement.cpp
@@ -49,10 +49,11 @@ using namespace HTMLNames;
 
 HTMLPlugInElement::HTMLPlugInElement(const QualifiedName& tagName, Document* doc)
     : HTMLFrameOwnerElement(tagName, doc)
+    , m_inBeforeLoadEventHandler(false)
 #if ENABLE(NETSCAPE_PLUGIN_API)
     , m_NPObject(0)
-    , m_isCapturingMouseEvents(false)
 #endif
+    , m_isCapturingMouseEvents(false)
 {
 }
 
@@ -100,6 +101,12 @@ PassScriptInstance HTMLPlugInElement::getInstance() const
 
 Widget* HTMLPlugInElement::pluginWidget() const
 {
+    if (m_inBeforeLoadEventHandler) {
+        // The plug-in hasn't loaded yet, and it makes no sense to try to load if beforeload handler happened to touch the plug-in element.
+        // That would recursively call beforeload for the same element.
+        return 0;
+    }
+
     RenderWidget* renderWidget = renderWidgetForJSBindings();
     if (!renderWidget)
         return 0;
diff --git a/WebCore/html/HTMLPlugInElement.h b/WebCore/html/HTMLPlugInElement.h
index 5467177..44c6149 100644
--- a/WebCore/html/HTMLPlugInElement.h
+++ b/WebCore/html/HTMLPlugInElement.h
@@ -59,11 +59,15 @@ protected:
     virtual bool mapToEntry(const QualifiedName& attrName, MappedAttributeEntry& result) const;
     virtual void parseMappedAttribute(Attribute*);
 
+<<<<<<< HEAD
 #if PLATFORM(ANDROID)
     // in Android, plugin has a focused mode where it accepts all the touch events.
     // so need to claim that plugin element supports focus instead of using the default.
     virtual bool supportsFocus() const;
 #endif
+=======
+    bool m_inBeforeLoadEventHandler;
+>>>>>>> webkit.org at r70209
 
 private:
     virtual void defaultEventHandler(Event*);
diff --git a/WebCore/html/HTMLSourceElement.cpp b/WebCore/html/HTMLSourceElement.cpp
index 96c9829..59b3882 100644
--- a/WebCore/html/HTMLSourceElement.cpp
+++ b/WebCore/html/HTMLSourceElement.cpp
@@ -33,6 +33,7 @@
 #include "HTMLDocument.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "Logging.h"
 
 using namespace std;
 
@@ -44,6 +45,7 @@ inline HTMLSourceElement::HTMLSourceElement(const QualifiedName& tagName, Docume
     : HTMLElement(tagName, document)
     , m_errorEventTimer(this, &HTMLSourceElement::errorEventTimerFired)
 {
+    LOG(Media, "HTMLSourceElement::HTMLSourceElement - %p", this);
     ASSERT(hasTagName(sourceTag));
 }
 
@@ -55,13 +57,17 @@ PassRefPtr<HTMLSourceElement> HTMLSourceElement::create(const QualifiedName& tag
 void HTMLSourceElement::insertedIntoTree(bool deep)
 {
     HTMLElement::insertedIntoTree(deep);
-    if (parentNode() && (parentNode()->hasTagName(audioTag) ||  parentNode()->hasTagName(videoTag))) {
-        HTMLMediaElement* media = static_cast<HTMLMediaElement*>(parentNode());
-        if (media->networkState() == HTMLMediaElement::NETWORK_EMPTY)
-            media->scheduleLoad();
-    }
+    if (parentNode() && (parentNode()->hasTagName(audioTag) || parentNode()->hasTagName(videoTag)))
+        static_cast<HTMLMediaElement*>(parentNode())->sourceWasAdded(this);
 }
 
+void HTMLSourceElement::willRemove()
+{
+    if (parentNode() && (parentNode()->hasTagName(audioTag) || parentNode()->hasTagName(videoTag)))
+        static_cast<HTMLMediaElement*>(parentNode())->sourceWillBeRemoved(this);
+    HTMLElement::willRemove();
+}
+    
 void HTMLSourceElement::setSrc(const String& url)
 {
     setAttribute(srcAttr, url);
@@ -89,6 +95,7 @@ void HTMLSourceElement::setType(const String& type)
 
 void HTMLSourceElement::scheduleErrorEvent()
 {
+    LOG(Media, "HTMLSourceElement::scheduleErrorEvent - %p", this);
     if (m_errorEventTimer.isActive())
         return;
 
@@ -97,11 +104,13 @@ void HTMLSourceElement::scheduleErrorEvent()
 
 void HTMLSourceElement::cancelPendingErrorEvent()
 {
+    LOG(Media, "HTMLSourceElement::cancelPendingErrorEvent - %p", this);
     m_errorEventTimer.stop();
 }
 
 void HTMLSourceElement::errorEventTimerFired(Timer<HTMLSourceElement>*)
 {
+    LOG(Media, "HTMLSourceElement::errorEventTimerFired - %p", this);
     dispatchEvent(Event::create(eventNames().errorEvent, false, true));
 }
 
diff --git a/WebCore/html/HTMLSourceElement.h b/WebCore/html/HTMLSourceElement.h
index 8aa1d06..cc1e5d7 100644
--- a/WebCore/html/HTMLSourceElement.h
+++ b/WebCore/html/HTMLSourceElement.h
@@ -50,6 +50,7 @@ private:
     HTMLSourceElement(const QualifiedName&, Document*);
     
     virtual void insertedIntoTree(bool);
+    virtual void willRemove();
     virtual bool isURLAttribute(Attribute*) const;
 
     void errorEventTimerFired(Timer<HTMLSourceElement>*);
diff --git a/WebCore/html/HTMLTableCellElement.cpp b/WebCore/html/HTMLTableCellElement.cpp
index d90b125..0bd3cf5 100644
--- a/WebCore/html/HTMLTableCellElement.cpp
+++ b/WebCore/html/HTMLTableCellElement.cpp
@@ -123,7 +123,7 @@ void HTMLTableCellElement::parseMappedAttribute(Attribute* attr)
 // used by table cells to share style decls created by the enclosing table.
 void HTMLTableCellElement::additionalAttributeStyleDecls(Vector<CSSMutableStyleDeclaration*>& results)
 {
-    Node* p = parentNode();
+    ContainerNode* p = parentNode();
     while (p && !p->hasTagName(tableTag))
         p = p->parentNode();
     if (!p)
@@ -173,4 +173,20 @@ void HTMLTableCellElement::addSubresourceAttributeURLs(ListHashSet<KURL>& urls)
     addSubresourceURL(urls, document()->completeURL(getAttribute(backgroundAttr)));
 }
 
+HTMLTableCellElement* HTMLTableCellElement::cellAbove() const
+{
+    RenderObject* cellRenderer = renderer();
+    if (!cellRenderer)
+        return 0;
+    if (!cellRenderer->isTableCell())
+        return 0;
+
+    RenderTableCell* tableCellRenderer = toRenderTableCell(cellRenderer);
+    RenderTableCell* cellAboveRenderer = tableCellRenderer->table()->cellAbove(tableCellRenderer);
+    if (!cellAboveRenderer)
+        return 0;
+
+    return static_cast<HTMLTableCellElement*>(cellAboveRenderer->node());
 }
+
+} // namespace WebCore
diff --git a/WebCore/html/HTMLTableCellElement.h b/WebCore/html/HTMLTableCellElement.h
index 0c97413..f6d202b 100644
--- a/WebCore/html/HTMLTableCellElement.h
+++ b/WebCore/html/HTMLTableCellElement.h
@@ -53,6 +53,8 @@ public:
     void setRowSpan(int);
     String scope() const;
 
+    HTMLTableCellElement* cellAbove() const;
+
 private:
     HTMLTableCellElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/html/HTMLTableColElement.cpp b/WebCore/html/HTMLTableColElement.cpp
index 20b0f36..96af708 100644
--- a/WebCore/html/HTMLTableColElement.cpp
+++ b/WebCore/html/HTMLTableColElement.cpp
@@ -82,7 +82,7 @@ void HTMLTableColElement::additionalAttributeStyleDecls(Vector<CSSMutableStyleDe
 {
     if (!hasLocalName(colgroupTag))
         return;
-    Node* p = parentNode();
+    ContainerNode* p = parentNode();
     while (p && !p->hasTagName(tableTag))
         p = p->parentNode();
     if (!p)
diff --git a/WebCore/html/HTMLTableElement.cpp b/WebCore/html/HTMLTableElement.cpp
index ef29bf6..fe823ea 100644
--- a/WebCore/html/HTMLTableElement.cpp
+++ b/WebCore/html/HTMLTableElement.cpp
@@ -31,6 +31,7 @@
 #include "CSSValueKeywords.h"
 #include "ExceptionCode.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "HTMLTableCaptionElement.h"
 #include "HTMLTableRowElement.h"
 #include "HTMLTableRowsCollection.h"
@@ -202,7 +203,7 @@ PassRefPtr<HTMLElement> HTMLTableElement::insertRow(int index, ExceptionCode& ec
         }
     }
 
-    Node* parent;
+    ContainerNode* parent;
     if (lastRow)
         parent = row ? row->parent() : lastRow->parent();
     else {
@@ -336,7 +337,7 @@ void HTMLTableElement::parseMappedAttribute(Attribute* attr)
             m_borderColorAttr = true;
         }
     } else if (attr->name() == backgroundAttr) {
-        String url = deprecatedParseURL(attr->value());
+        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
             addCSSImageProperty(attr, CSSPropertyBackgroundImage, document()->completeURL(url).string());
     } else if (attr->name() == frameAttr) {
diff --git a/WebCore/html/HTMLTablePartElement.cpp b/WebCore/html/HTMLTablePartElement.cpp
index 316ace4..dfaecca 100644
--- a/WebCore/html/HTMLTablePartElement.cpp
+++ b/WebCore/html/HTMLTablePartElement.cpp
@@ -26,11 +26,11 @@
 #include "HTMLTablePartElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Document.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 
 namespace WebCore {
 
@@ -64,7 +64,7 @@ void HTMLTablePartElement::parseMappedAttribute(Attribute* attr)
     if (attr->name() == bgcolorAttr)
         addCSSColor(attr, CSSPropertyBackgroundColor, attr->value());
     else if (attr->name() == backgroundAttr) {
-        String url = deprecatedParseURL(attr->value());
+        String url = stripLeadingAndTrailingHTMLSpaces(attr->value());
         if (!url.isEmpty())
             addCSSImageProperty(attr, CSSPropertyBackgroundImage, document()->completeURL(url).string());
     } else if (attr->name() == bordercolorAttr) {
diff --git a/WebCore/html/HTMLTableRowElement.cpp b/WebCore/html/HTMLTableRowElement.cpp
index e9b5cec..fbc253d 100644
--- a/WebCore/html/HTMLTableRowElement.cpp
+++ b/WebCore/html/HTMLTableRowElement.cpp
@@ -56,7 +56,7 @@ PassRefPtr<HTMLTableRowElement> HTMLTableRowElement::create(const QualifiedName&
 
 int HTMLTableRowElement::rowIndex() const
 {
-    Node *table = parentNode();
+    ContainerNode* table = parentNode();
     if (!table)
         return -1;
     table = table->parentNode();
diff --git a/WebCore/html/HTMLTableSectionElement.cpp b/WebCore/html/HTMLTableSectionElement.cpp
index 982e035..5ef25f1 100644
--- a/WebCore/html/HTMLTableSectionElement.cpp
+++ b/WebCore/html/HTMLTableSectionElement.cpp
@@ -50,7 +50,7 @@ PassRefPtr<HTMLTableSectionElement> HTMLTableSectionElement::create(const Qualif
 // used by table row groups to share style decls created by the enclosing table.
 void HTMLTableSectionElement::additionalAttributeStyleDecls(Vector<CSSMutableStyleDeclaration*>& results)
 {
-    Node* p = parentNode();
+    ContainerNode* p = parentNode();
     while (p && !p->hasTagName(tableTag))
         p = p->parentNode();
     if (!p)
diff --git a/WebCore/html/HTMLVideoElement.cpp b/WebCore/html/HTMLVideoElement.cpp
index 219bb85..bbda53a 100644
--- a/WebCore/html/HTMLVideoElement.cpp
+++ b/WebCore/html/HTMLVideoElement.cpp
@@ -29,7 +29,6 @@
 #include "HTMLVideoElement.h"
 
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "CSSPropertyNames.h"
 #include "Chrome.h"
 #include "ChromeClient.h"
diff --git a/WebCore/html/HiddenInputType.cpp b/WebCore/html/HiddenInputType.cpp
index d97fe3a..76742ae 100644
--- a/WebCore/html/HiddenInputType.cpp
+++ b/WebCore/html/HiddenInputType.cpp
@@ -44,4 +44,9 @@ const AtomicString& HiddenInputType::formControlType() const {
     return InputTypeNames::hidden();
 }
 
+bool HiddenInputType::supportsValidation() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/HiddenInputType.h b/WebCore/html/HiddenInputType.h
index 564f99e..cc49f98 100644
--- a/WebCore/html/HiddenInputType.h
+++ b/WebCore/html/HiddenInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     HiddenInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsValidation() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/ImageDocument.cpp b/WebCore/html/ImageDocument.cpp
index db53837..6361f43 100644
--- a/WebCore/html/ImageDocument.cpp
+++ b/WebCore/html/ImageDocument.cpp
@@ -32,6 +32,7 @@
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "FrameView.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLImageElement.h"
 #include "HTMLNames.h"
 #include "LocalizedStrings.h"
@@ -194,6 +195,9 @@ void ImageDocument::createDocumentStructure()
     
     RefPtr<Element> rootElement = Document::createElement(htmlTag, false);
     appendChild(rootElement, ec);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    static_cast<HTMLHtmlElement*>(rootElement.get())->insertedByParser();
+#endif
 
     if (frame() && frame()->loader())
         frame()->loader()->dispatchDocumentElementAvailable();
diff --git a/WebCore/html/ImageInputType.cpp b/WebCore/html/ImageInputType.cpp
index 78b3981..604b052 100644
--- a/WebCore/html/ImageInputType.cpp
+++ b/WebCore/html/ImageInputType.cpp
@@ -45,4 +45,9 @@ const AtomicString& ImageInputType::formControlType() const
     return InputTypeNames::image();
 }
 
+bool ImageInputType::supportsValidation() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/ImageInputType.h b/WebCore/html/ImageInputType.h
index 00ac77b..be308b3 100644
--- a/WebCore/html/ImageInputType.h
+++ b/WebCore/html/ImageInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     ImageInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsValidation() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/InputType.cpp b/WebCore/html/InputType.cpp
index c3435f7..1b2303a 100644
--- a/WebCore/html/InputType.cpp
+++ b/WebCore/html/InputType.cpp
@@ -30,6 +30,7 @@
 #include "ButtonInputType.h"
 #include "CheckboxInputType.h"
 #include "ColorInputType.h"
+#include "DateComponents.h"
 #include "DateInputType.h"
 #include "DateTimeInputType.h"
 #include "DateTimeLocalInputType.h"
@@ -53,11 +54,15 @@
 #include "TimeInputType.h"
 #include "URLInputType.h"
 #include "WeekInputType.h"
+#include <limits>
+#include <wtf/Assertions.h>
 #include <wtf/HashMap.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
 
+using namespace std;
+
 typedef HashMap<String, PassOwnPtr<InputType> (*)(HTMLInputElement*), CaseFoldingHash> InputTypeFactoryMap;
 static PassOwnPtr<InputTypeFactoryMap> createInputTypeFactoryMap()
 {
@@ -117,11 +122,130 @@ bool InputType::isTextType() const
     return false;
 }
 
+double InputType::valueAsDate() const
+{
+    return DateComponents::invalidMilliseconds();
+}
+
+void InputType::setValueAsDate(double, ExceptionCode& ec) const
+{
+    ec = INVALID_STATE_ERR;
+}
+
+double InputType::valueAsNumber() const
+{
+    return numeric_limits<double>::quiet_NaN();
+}
+
+void InputType::setValueAsNumber(double, ExceptionCode& ec) const
+{
+    ec = INVALID_STATE_ERR;
+}
+
+bool InputType::supportsValidation() const
+{
+    return true;
+}
+
+bool InputType::typeMismatchFor(const String&) const
+{
+    return false;
+}
+
+bool InputType::typeMismatch() const
+{
+    return false;
+}
+
+bool InputType::supportsRequired() const
+{
+    // Almost all validatable types support @required.
+    return supportsValidation();
+}
+
+bool InputType::valueMissing(const String&) const
+{
+    return false;
+}
+
 bool InputType::patternMismatch(const String&) const
 {
     return false;
 }
 
+bool InputType::rangeUnderflow(const String&) const
+{
+    return false;
+}
+
+bool InputType::rangeOverflow(const String&) const
+{
+    return false;
+}
+
+double InputType::minimum() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+double InputType::maximum() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+bool InputType::stepMismatch(const String&, double) const
+{
+    // Non-supported types should be rejected by HTMLInputElement::getAllowedValueStep().
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+double InputType::stepBase() const
+{
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+double InputType::defaultStep() const
+{
+    return numeric_limits<double>::quiet_NaN();
+}
+
+double InputType::stepScaleFactor() const
+{
+    return numeric_limits<double>::quiet_NaN();
+}
+
+bool InputType::parsedStepValueShouldBeInteger() const
+{
+    return false;
+}
+
+bool InputType::scaledStepValeuShouldBeInteger() const
+{
+    return false;
+}
+
+double InputType::parseToDouble(const String&, double defaultValue) const
+{
+    return defaultValue;
+}
+
+bool InputType::parseToDateComponents(const String&, DateComponents*) const
+{
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+String InputType::serialize(double) const
+{
+    ASSERT_NOT_REACHED();
+    return String();
+}
+
+
 namespace InputTypeNames {
 
 // The type names must be lowercased because they will be the return values of
diff --git a/WebCore/html/InputType.h b/WebCore/html/InputType.h
index 3141f34..953b123 100644
--- a/WebCore/html/InputType.h
+++ b/WebCore/html/InputType.h
@@ -31,11 +31,13 @@
 #ifndef InputType_h
 #define InputType_h
 
+#include "ExceptionCode.h"
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
 
 namespace WebCore {
 
+class DateComponents;
 class HTMLInputElement;
 
 class InputType : public Noncopyable {
@@ -48,11 +50,53 @@ public:
     virtual bool isTextType() const;
     virtual const AtomicString& formControlType() const = 0;
 
+    virtual double valueAsDate() const;
+    virtual void setValueAsDate(double, ExceptionCode&) const;
+    virtual double valueAsNumber() const;
+    virtual void setValueAsNumber(double, ExceptionCode&) const;
+
+    // Validation-related functions
+
+    virtual bool supportsValidation() const;
+    virtual bool typeMismatchFor(const String&) const;
+    // Type check for the current input value. We do nothing for some types
+    // though typeMismatchFor() does something for them because of value
+    // sanitization.
+    virtual bool typeMismatch() const;
+    virtual bool supportsRequired() const;
+    virtual bool valueMissing(const String&) const;
     virtual bool patternMismatch(const String&) const;
+    virtual bool rangeUnderflow(const String&) const;
+    virtual bool rangeOverflow(const String&) const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual bool stepMismatch(const String&, double) const;
+    virtual double stepBase() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool parsedStepValueShouldBeInteger() const;
+    virtual bool scaledStepValeuShouldBeInteger() const;
+
+    // Parses the specified string for the type, and return
+    // the double value for the parsing result if the parsing
+    // succeeds; Returns defaultValue otherwise. This function can
+    // return NaN or Infinity only if defaultValue is NaN or Infinity.
+    virtual double parseToDouble(const String&, double defaultValue) const;
+    // Parses the specified string for this InputType, and returns true if it
+    // is successfully parsed. An instance pointed by the DateComponents*
+    // parameter will have parsed values and be modified even if the parsing
+    // fails. The DateComponents* parameter may be 0.
+    virtual bool parseToDateComponents(const String&, DateComponents*) const;
+    // Create a string representation of the specified double value for the
+    // input type. If NaN or Infinity is specified, this returns an empty
+    // string. This should not be called for types without valueAsNumber.
+    virtual String serialize(double) const;
 
 protected:
     InputType(HTMLInputElement* element) : m_element(element) { }
     HTMLInputElement* element() const { return m_element; }
+    // We can't make this a static const data member because VC++ doesn't like it.
+    static double defaultStepBase() { return 0.0; }
 
 private:
     // Raw pointer because the HTMLInputElement object owns this InputType object.
diff --git a/WebCore/html/IsIndexInputType.cpp b/WebCore/html/IsIndexInputType.cpp
index 80e0617..c3cff41 100644
--- a/WebCore/html/IsIndexInputType.cpp
+++ b/WebCore/html/IsIndexInputType.cpp
@@ -45,4 +45,9 @@ const AtomicString& IsIndexInputType::formControlType() const
     return emptyAtom;
 }
 
+bool IsIndexInputType::supportsRequired() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/IsIndexInputType.h b/WebCore/html/IsIndexInputType.h
index 93a1c08..2d4e193 100644
--- a/WebCore/html/IsIndexInputType.h
+++ b/WebCore/html/IsIndexInputType.h
@@ -43,6 +43,7 @@ public:
 private:
     IsIndexInputType(HTMLInputElement* element) : TextFieldInputType(element) { };
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsRequired() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/MediaDocument.cpp b/WebCore/html/MediaDocument.cpp
index 875141b..c4f0b14 100644
--- a/WebCore/html/MediaDocument.cpp
+++ b/WebCore/html/MediaDocument.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "HTMLEmbedElement.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLNames.h"
 #include "HTMLVideoElement.h"
 #include "KeyboardEvent.h"
@@ -71,6 +72,9 @@ void MediaDocumentParser::createDocumentStructure()
     ExceptionCode ec;
     RefPtr<Element> rootElement = document()->createElement(htmlTag, false);
     document()->appendChild(rootElement, ec);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    static_cast<HTMLHtmlElement*>(rootElement.get())->insertedByParser();
+#endif
 
     if (document()->frame())
         document()->frame()->loader()->dispatchDocumentElementAvailable();
diff --git a/WebCore/html/MonthInputType.cpp b/WebCore/html/MonthInputType.cpp
index 54f78c6..cbde5cb 100644
--- a/WebCore/html/MonthInputType.cpp
+++ b/WebCore/html/MonthInputType.cpp
@@ -31,10 +31,19 @@
 #include "config.h"
 #include "MonthInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double monthDefaultStep = 1.0;
+static const double monthStepScaleFactor = 1.0;
+
 PassOwnPtr<InputType> MonthInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new MonthInputType(element));
@@ -45,4 +54,72 @@ const AtomicString& MonthInputType::formControlType() const
     return InputTypeNames::month();
 }
 
+double MonthInputType::valueAsDate() const
+{
+    DateComponents date;
+    if (!parseToDateComponents(element()->value(), &date))
+        return DateComponents::invalidMilliseconds();
+    double msec = date.millisecondsSinceEpoch();
+    ASSERT(isfinite(msec));
+    return msec;
+}
+
+void MonthInputType::setValueAsDate(double value, ExceptionCode&) const
+{
+    DateComponents date;
+    if (!date.setMillisecondsSinceEpochForMonth(value)) {
+        element()->setValue(String());
+        return;
+    }
+    element()->setValue(date.toString());
+}
+
+double MonthInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumMonth());
+}
+
+double MonthInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumMonth());
+}
+
+double MonthInputType::defaultStep() const
+{
+    return monthDefaultStep;
+}
+
+double MonthInputType::stepScaleFactor() const
+{
+    return monthStepScaleFactor;
+}
+
+bool MonthInputType::parsedStepValueShouldBeInteger() const
+{
+    return true;
+}
+
+double MonthInputType::parseToDouble(const String& src, double defaultValue) const
+{
+    DateComponents date;
+    if (!parseToDateComponents(src, &date))
+        return defaultValue;
+    double months = date.monthsSinceEpoch();
+    ASSERT(isfinite(months));
+    return months;
+}
+
+bool MonthInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseMonth(characters, length, 0, end) && end == length;
+}
+
+bool MonthInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMonthsSinceEpoch(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/MonthInputType.h b/WebCore/html/MonthInputType.h
index d605ffa..50cf7d5 100644
--- a/WebCore/html/MonthInputType.h
+++ b/WebCore/html/MonthInputType.h
@@ -31,17 +31,27 @@
 #ifndef MonthInputType_h
 #define MonthInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class MonthInputType : public TextFieldInputType {
+class MonthInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    MonthInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    MonthInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double valueAsDate() const;
+    virtual void setValueAsDate(double, ExceptionCode&) const;
+    virtual double parseToDouble(const String&, double) const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool parsedStepValueShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/NumberInputType.cpp b/WebCore/html/NumberInputType.cpp
index 9aba5c3..a4e118c 100644
--- a/WebCore/html/NumberInputType.cpp
+++ b/WebCore/html/NumberInputType.cpp
@@ -31,10 +31,27 @@
 #include "config.h"
 #include "NumberInputType.h"
 
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
+#include <limits>
+#include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+using namespace std;
+
+// FIXME: Number values should be in the range of IEEE 754 single-precision
+// floating point number.
+// http://www.whatwg.org/specs/web-apps/current-work/multipage/common-microsyntaxes.html#real-numbers
+static const double numberDefaultMinimum = -DBL_MAX;
+static const double numberDefaultMaximum = DBL_MAX;
+
+static const double numberDefaultStep = 1.0;
+static const double numberStepScaleFactor = 1.0;
+
 PassOwnPtr<InputType> NumberInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new NumberInputType(element));
@@ -45,4 +62,98 @@ const AtomicString& NumberInputType::formControlType() const
     return InputTypeNames::number();
 }
 
+double NumberInputType::valueAsNumber() const
+{
+    return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
+}
+
+void NumberInputType::setValueAsNumber(double newValue, ExceptionCode&) const
+{
+    element()->setValue(serialize(newValue));
+}
+
+bool NumberInputType::typeMismatchFor(const String& value) const
+{
+    return !value.isEmpty() && !parseToDoubleForNumberType(value, 0);
+}
+
+bool NumberInputType::typeMismatch() const
+{
+    ASSERT(!typeMismatchFor(element()->value()));
+    return false;
+}
+
+bool NumberInputType::rangeUnderflow(const String& value) const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double doubleValue = parseToDouble(value, nan);
+    return isfinite(doubleValue) && doubleValue < minimum();
+}
+
+bool NumberInputType::rangeOverflow(const String& value) const
+{
+    const double nan = numeric_limits<double>::quiet_NaN();
+    double doubleValue = parseToDouble(value, nan);
+    return isfinite(doubleValue) && doubleValue > maximum();
+}
+
+double NumberInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), numberDefaultMinimum);
+}
+
+double NumberInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), numberDefaultMaximum);
+}
+
+bool NumberInputType::stepMismatch(const String& value, double step) const
+{
+    double doubleValue;
+    if (!parseToDoubleForNumberType(value, &doubleValue))
+        return false;
+    doubleValue = fabs(doubleValue - stepBase());
+    if (isinf(doubleValue))
+        return false;
+    // double's fractional part size is DBL_MAN_DIG-bit. If the current value
+    // is greater than step*2^DBL_MANT_DIG, the following fmod() makes no sense.
+    if (doubleValue / pow(2.0, DBL_MANT_DIG) > step)
+        return false;
+    double remainder = fmod(doubleValue, step);
+    // Accepts errors in lower 7-bit.
+    double acceptableError = step / pow(2.0, DBL_MANT_DIG - 7);
+    return acceptableError < remainder && remainder < (step - acceptableError);
+}
+
+double NumberInputType::stepBase() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), defaultStepBase());
+}
+
+double NumberInputType::defaultStep() const
+{
+    return numberDefaultStep;
+}
+
+double NumberInputType::stepScaleFactor() const
+{
+    return numberStepScaleFactor;
+}
+
+double NumberInputType::parseToDouble(const String& src, double defaultValue) const
+{
+    double numberValue;
+    if (!parseToDoubleForNumberType(src, &numberValue))
+        return defaultValue;
+    ASSERT(isfinite(numberValue));
+    return numberValue;
+}
+
+String NumberInputType::serialize(double value) const
+{
+    if (!isfinite(value))
+        return String();
+    return serializeForNumberType(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/NumberInputType.h b/WebCore/html/NumberInputType.h
index 5347249..262955e 100644
--- a/WebCore/html/NumberInputType.h
+++ b/WebCore/html/NumberInputType.h
@@ -42,6 +42,20 @@ public:
 private:
     NumberInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double valueAsNumber() const;
+    virtual void setValueAsNumber(double, ExceptionCode&) const;
+    virtual bool typeMismatchFor(const String&) const;
+    virtual bool typeMismatch() const;
+    virtual bool rangeUnderflow(const String&) const;
+    virtual bool rangeOverflow(const String&) const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual bool stepMismatch(const String&, double) const;
+    virtual double stepBase() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual double parseToDouble(const String&, double) const;
+    virtual String serialize(double) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/PluginDocument.cpp b/WebCore/html/PluginDocument.cpp
index ad11dfb..cebb949 100644
--- a/WebCore/html/PluginDocument.cpp
+++ b/WebCore/html/PluginDocument.cpp
@@ -29,8 +29,10 @@
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "HTMLEmbedElement.h"
+#include "HTMLHtmlElement.h"
 #include "HTMLNames.h"
 #include "MainResourceLoader.h"
+#include "NodeList.h"
 #include "Page.h"
 #include "RawDataDocumentParser.h"
 #include "RenderEmbeddedObject.h"
@@ -48,8 +50,6 @@ public:
         return adoptRef(new PluginDocumentParser(document));
     }
 
-    static Widget* pluginWidgetFromDocument(Document*);
-    
 private:
     PluginDocumentParser(Document* document)
         : RawDataDocumentParser(document)
@@ -64,25 +64,14 @@ private:
     HTMLEmbedElement* m_embedElement;
 };
 
-Widget* PluginDocumentParser::pluginWidgetFromDocument(Document* doc)
-{
-    ASSERT(doc);
-    RefPtr<Element> body = doc->body();
-    if (body) {
-        RefPtr<Node> node = body->firstChild();
-        if (node && node->renderer()) {
-            ASSERT(node->renderer()->isEmbeddedObject());
-            return toRenderEmbeddedObject(node->renderer())->widget();
-        }
-    }
-    return 0;
-}
-
 void PluginDocumentParser::createDocumentStructure()
 {
     ExceptionCode ec;
     RefPtr<Element> rootElement = document()->createElement(htmlTag, false);
     document()->appendChild(rootElement, ec);
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    static_cast<HTMLHtmlElement*>(rootElement.get())->insertedByParser();
+#endif
 
     if (document()->frame() && document()->frame()->loader())
         document()->frame()->loader()->dispatchDocumentElementAvailable();
@@ -103,7 +92,9 @@ void PluginDocumentParser::createDocumentStructure()
     m_embedElement->setAttribute(nameAttr, "plugin");
     m_embedElement->setAttribute(srcAttr, document()->url().string());
     m_embedElement->setAttribute(typeAttr, document()->frame()->loader()->writer()->mimeType());
-    
+
+    static_cast<PluginDocument*>(document())->setPluginNode(m_embedElement);
+
     body->appendChild(embedElement, ec);    
 }
 
@@ -125,8 +116,13 @@ void PluginDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
     document()->updateLayout();
 
     if (RenderPart* renderer = m_embedElement->renderPart()) {
-        frame->loader()->client()->redirectDataToPlugin(renderer->widget());
-        frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
+        if (Widget* widget = renderer->widget()) {
+            frame->loader()->client()->redirectDataToPlugin(widget);
+            // In a plugin document, the main resource is the plugin. If we have a null widget, that means
+            // the loading of the plugin was cancelled, which gives us a null mainResourceLoader(), so we
+            // need to have this call in a null check of the widget or of mainResourceLoader().
+            frame->loader()->activeDocumentLoader()->mainResourceLoader()->setShouldBufferData(false);
+        }
     }
 
     finish();
@@ -134,11 +130,12 @@ void PluginDocumentParser::appendBytes(DocumentWriter*, const char*, int, bool)
 
 PluginDocument::PluginDocument(Frame* frame, const KURL& url)
     : HTMLDocument(frame, url)
+    , m_shouldLoadPluginManually(true)
 {
     setCompatibilityMode(QuirksMode);
     lockCompatibilityMode();
 }
-    
+
 PassRefPtr<DocumentParser> PluginDocument::createParser()
 {
     return PluginDocumentParser::create(this);
@@ -146,16 +143,34 @@ PassRefPtr<DocumentParser> PluginDocument::createParser()
 
 Widget* PluginDocument::pluginWidget()
 {
-    return PluginDocumentParser::pluginWidgetFromDocument(this);
+    if (m_pluginNode && m_pluginNode->renderer()) {
+        ASSERT(m_pluginNode->renderer()->isEmbeddedObject());
+        return toRenderEmbeddedObject(m_pluginNode->renderer())->widget();
+    }
+    return 0;
 }
 
 Node* PluginDocument::pluginNode()
 {
-    RefPtr<Element> body_element = body();
-    if (body_element)
-        return body_element->firstChild();
+    return m_pluginNode.get();
+}
 
-    return 0;
+void PluginDocument::detach()
+{
+    // Release the plugin node so that we don't have a circular reference.
+    m_pluginNode = 0;
+    HTMLDocument::detach();
+}
+
+void PluginDocument::cancelManualPluginLoad()
+{
+    // PluginDocument::cancelManualPluginLoad should only be called once, but there are issues
+    // with how many times we call beforeload on object elements. <rdar://problem/8441094>.
+    if (!shouldLoadPluginManually())
+        return;
+
+    frame()->loader()->activeDocumentLoader()->mainResourceLoader()->cancel();
+    setShouldLoadPluginManually(false);
 }
 
 }
diff --git a/WebCore/html/PluginDocument.h b/WebCore/html/PluginDocument.h
index 3bb5d99..da0bb75 100644
--- a/WebCore/html/PluginDocument.h
+++ b/WebCore/html/PluginDocument.h
@@ -38,16 +38,44 @@ public:
         return adoptRef(new PluginDocument(frame, url));
     }
 
+    void setPluginNode(Node* pluginNode) { m_pluginNode = pluginNode; }
+
     Widget* pluginWidget();
     Node* pluginNode();
 
     virtual bool isPluginDocument() const { return true; }
 
+    virtual void detach();
+
+    void cancelManualPluginLoad();
+
+    bool shouldLoadPluginManually() { return m_shouldLoadPluginManually; }
+
 private:
     PluginDocument(Frame*, const KURL&);
 
     virtual PassRefPtr<DocumentParser> createParser();
+        
+    void setShouldLoadPluginManually(bool loadManually) { m_shouldLoadPluginManually = loadManually; }
+
+    bool m_shouldLoadPluginManually;
+    RefPtr<Node> m_pluginNode;
 };
+
+inline PluginDocument* toPluginDocument(Document* document)
+{
+    ASSERT(!document || document->isPluginDocument());
+    return static_cast<PluginDocument*>(document);
+}
+
+inline const PluginDocument* toPluginDocument(const Document* document)
+{
+    ASSERT(!document || document->isPluginDocument());
+    return static_cast<const PluginDocument*>(document);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toPluginDocument(const PluginDocument*);
     
 }
 
diff --git a/WebCore/html/RadioInputType.cpp b/WebCore/html/RadioInputType.cpp
index a1c8d04..5df4bbc 100644
--- a/WebCore/html/RadioInputType.cpp
+++ b/WebCore/html/RadioInputType.cpp
@@ -31,6 +31,7 @@
 #include "config.h"
 #include "RadioInputType.h"
 
+#include "HTMLInputElement.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -45,4 +46,9 @@ const AtomicString& RadioInputType::formControlType() const
     return InputTypeNames::radio();
 }
 
+bool RadioInputType::valueMissing(const String&) const
+{
+    return !element()->checkedRadioButtons().checkedButtonForGroup(element()->name());
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/RadioInputType.h b/WebCore/html/RadioInputType.h
index 180c6dd..2ff2c41 100644
--- a/WebCore/html/RadioInputType.h
+++ b/WebCore/html/RadioInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     RadioInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool valueMissing(const String&) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/RangeInputType.cpp b/WebCore/html/RangeInputType.cpp
index f5f7322..7448071 100644
--- a/WebCore/html/RangeInputType.cpp
+++ b/WebCore/html/RangeInputType.cpp
@@ -31,10 +31,23 @@
 #include "config.h"
 #include "RangeInputType.h"
 
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
+#include <limits>
+#include <wtf/MathExtras.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+using namespace std;
+
+static const double rangeDefaultMinimum = 0.0;
+static const double rangeDefaultMaximum = 100.0;
+static const double rangeDefaultStep = 1.0;
+static const double rangeStepScaleFactor = 1.0;
+
 PassOwnPtr<InputType> RangeInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new RangeInputType(element));
@@ -45,4 +58,88 @@ const AtomicString& RangeInputType::formControlType() const
     return InputTypeNames::range();
 }
 
+double RangeInputType::valueAsNumber() const
+{
+    return parseToDouble(element()->value(), numeric_limits<double>::quiet_NaN());
+}
+
+void RangeInputType::setValueAsNumber(double newValue, ExceptionCode&) const
+{
+    element()->setValue(serialize(newValue));
+}
+
+bool RangeInputType::supportsRequired() const
+{
+    return false;
+}
+
+bool RangeInputType::rangeUnderflow(const String& value) const
+{
+    // Guaranteed by sanitization.
+    ASSERT_UNUSED(value, parseToDouble(value, numeric_limits<double>::quiet_NaN()) >= minimum());
+    return false;
+}
+
+bool RangeInputType::rangeOverflow(const String& value) const
+{
+    // Guaranteed by sanitization.
+    ASSERT_UNUSED(value, parseToDouble(value, numeric_limits<double>::quiet_NaN()) <= maximum());
+    return false;
+}
+
+double RangeInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), rangeDefaultMinimum);
+}
+
+double RangeInputType::maximum() const
+{
+    double max = parseToDouble(element()->fastGetAttribute(maxAttr), rangeDefaultMaximum);
+    // A remedy for the inconsistent min/max values.
+    // Sets the maximum to the default or the minimum value.
+    double min = minimum();
+    if (max < min)
+        max = std::max(min, rangeDefaultMaximum);
+    return max;
+}
+
+bool RangeInputType::stepMismatch(const String&, double) const
+{
+    // stepMismatch doesn't occur for type=range. RenderSlider guarantees the
+    // value matches to step on user input, and sanitization takes care
+    // of the general case.
+    return false;
+}
+
+double RangeInputType::stepBase() const
+{
+    return minimum();
+}
+
+double RangeInputType::defaultStep() const
+{
+    return rangeDefaultStep;
+}
+
+double RangeInputType::stepScaleFactor() const
+{
+    return rangeStepScaleFactor;
+}
+
+double RangeInputType::parseToDouble(const String& src, double defaultValue) const
+{
+    double numberValue;
+    if (!parseToDoubleForNumberType(src, &numberValue))
+        return defaultValue;
+    ASSERT(isfinite(numberValue));
+    return numberValue;
+}
+
+String RangeInputType::serialize(double value) const
+{
+    if (!isfinite(value))
+        return String();
+    return serializeForNumberType(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/RangeInputType.h b/WebCore/html/RangeInputType.h
index d42c617..0ff6f60 100644
--- a/WebCore/html/RangeInputType.h
+++ b/WebCore/html/RangeInputType.h
@@ -42,6 +42,19 @@ public:
 private:
     RangeInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double valueAsNumber() const;
+    virtual void setValueAsNumber(double, ExceptionCode&) const;
+    virtual bool supportsRequired() const;
+    virtual bool rangeUnderflow(const String&) const;
+    virtual bool rangeOverflow(const String&) const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual bool stepMismatch(const String&, double) const;
+    virtual double stepBase() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual double parseToDouble(const String&, double) const;
+    virtual String serialize(double) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/ResetInputType.cpp b/WebCore/html/ResetInputType.cpp
index 8b18a8d..1db7592 100644
--- a/WebCore/html/ResetInputType.cpp
+++ b/WebCore/html/ResetInputType.cpp
@@ -45,4 +45,9 @@ const AtomicString& ResetInputType::formControlType() const
     return InputTypeNames::reset();
 }
 
+bool ResetInputType::supportsValidation() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/ResetInputType.h b/WebCore/html/ResetInputType.h
index e0d8997..3f883a3 100644
--- a/WebCore/html/ResetInputType.h
+++ b/WebCore/html/ResetInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     ResetInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsValidation() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/SubmitInputType.cpp b/WebCore/html/SubmitInputType.cpp
index dd13e6b..65934f9 100644
--- a/WebCore/html/SubmitInputType.cpp
+++ b/WebCore/html/SubmitInputType.cpp
@@ -45,4 +45,9 @@ const AtomicString& SubmitInputType::formControlType() const
     return InputTypeNames::submit();
 }
 
+bool SubmitInputType::supportsValidation() const
+{
+    return false;
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/SubmitInputType.h b/WebCore/html/SubmitInputType.h
index 7ea448e..83fa5e5 100644
--- a/WebCore/html/SubmitInputType.h
+++ b/WebCore/html/SubmitInputType.h
@@ -42,6 +42,7 @@ public:
 private:
     SubmitInputType(HTMLInputElement* element) : InputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool supportsValidation() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/TextFieldInputType.cpp b/WebCore/html/TextFieldInputType.cpp
index e681b40..82382ef 100644
--- a/WebCore/html/TextFieldInputType.cpp
+++ b/WebCore/html/TextFieldInputType.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "TextFieldInputType.h"
 
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
 bool TextFieldInputType::isTextField() const
@@ -38,4 +40,9 @@ bool TextFieldInputType::isTextField() const
     return true;
 }
 
+bool TextFieldInputType::valueMissing(const String& value) const
+{
+    return value.isEmpty();
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/TextFieldInputType.h b/WebCore/html/TextFieldInputType.h
index fb33a01..9108c42 100644
--- a/WebCore/html/TextFieldInputType.h
+++ b/WebCore/html/TextFieldInputType.h
@@ -41,6 +41,7 @@ class TextFieldInputType : public InputType {
 protected:
     TextFieldInputType(HTMLInputElement* element) : InputType(element) { }
     virtual bool isTextField() const;
+    virtual bool valueMissing(const String&) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/TimeInputType.cpp b/WebCore/html/TimeInputType.cpp
index 1564bc5..27dce90 100644
--- a/WebCore/html/TimeInputType.cpp
+++ b/WebCore/html/TimeInputType.cpp
@@ -31,10 +31,18 @@
 #include "config.h"
 #include "TimeInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double timeDefaultStep = 60.0;
+static const double timeStepScaleFactor = 1000.0;
+
 PassOwnPtr<InputType> TimeInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new TimeInputType(element));
@@ -45,4 +53,42 @@ const AtomicString& TimeInputType::formControlType() const
     return InputTypeNames::time();
 }
 
+double TimeInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumTime());
+}
+
+double TimeInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumTime());
+}
+
+double TimeInputType::defaultStep() const
+{
+    return timeDefaultStep;
+}
+
+double TimeInputType::stepScaleFactor() const
+{
+    return timeStepScaleFactor;
+}
+
+bool TimeInputType::scaledStepValeuShouldBeInteger() const
+{
+    return true;
+}
+
+bool TimeInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseTime(characters, length, 0, end) && end == length;
+}
+
+bool TimeInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMillisecondsSinceMidnight(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/TimeInputType.h b/WebCore/html/TimeInputType.h
index 9530f7d..6070fa0 100644
--- a/WebCore/html/TimeInputType.h
+++ b/WebCore/html/TimeInputType.h
@@ -31,17 +31,24 @@
 #ifndef TimeInputType_h
 #define TimeInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class TimeInputType : public TextFieldInputType {
+class TimeInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    TimeInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    TimeInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool scaledStepValeuShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/URLInputType.cpp b/WebCore/html/URLInputType.cpp
index 2afdcde..517ffad 100644
--- a/WebCore/html/URLInputType.cpp
+++ b/WebCore/html/URLInputType.cpp
@@ -31,6 +31,8 @@
 #include "config.h"
 #include "URLInputType.h"
 
+#include "HTMLInputElement.h"
+#include "KURL.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
@@ -45,4 +47,14 @@ const AtomicString& URLInputType::formControlType() const
     return InputTypeNames::url();
 }
 
+bool URLInputType::typeMismatchFor(const String& value) const
+{
+    return !value.isEmpty() && !KURL(KURL(), value).isValid();
+}
+
+bool URLInputType::typeMismatch() const
+{
+    return typeMismatchFor(element()->value());
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/URLInputType.h b/WebCore/html/URLInputType.h
index 85d4f9f..82ab1b7 100644
--- a/WebCore/html/URLInputType.h
+++ b/WebCore/html/URLInputType.h
@@ -42,6 +42,8 @@ public:
 private:
     URLInputType(HTMLInputElement* element) : BaseTextInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual bool typeMismatchFor(const String&) const;
+    virtual bool typeMismatch() const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/ValidityState.cpp b/WebCore/html/ValidityState.cpp
index f18469e..57fb438 100644
--- a/WebCore/html/ValidityState.cpp
+++ b/WebCore/html/ValidityState.cpp
@@ -83,12 +83,7 @@ bool ValidityState::typeMismatch() const
 {
     if (!m_control->hasTagName(inputTag))
         return false;
-
-    HTMLInputElement* input = static_cast<HTMLInputElement*>(m_control);
-    String value = input->value();
-    if (value.isEmpty())
-        return false;
-    return input->typeMismatch(value);
+    return static_cast<HTMLInputElement*>(m_control)->typeMismatch();
 }
 
 bool ValidityState::patternMismatch() const
diff --git a/WebCore/html/WeekInputType.cpp b/WebCore/html/WeekInputType.cpp
index 0b4ab30..a5836dc 100644
--- a/WebCore/html/WeekInputType.cpp
+++ b/WebCore/html/WeekInputType.cpp
@@ -31,10 +31,19 @@
 #include "config.h"
 #include "WeekInputType.h"
 
+#include "DateComponents.h"
+#include "HTMLInputElement.h"
+#include "HTMLNames.h"
 #include <wtf/PassOwnPtr.h>
 
 namespace WebCore {
 
+using namespace HTMLNames;
+
+static const double weekDefaultStepBase = -259200000.0; // The first day of 1970-W01.
+static const double weekDefaultStep = 1.0;
+static const double weekStepScaleFactor = 604800000.0;
+
 PassOwnPtr<InputType> WeekInputType::create(HTMLInputElement* element)
 {
     return adoptPtr(new WeekInputType(element));
@@ -45,4 +54,47 @@ const AtomicString& WeekInputType::formControlType() const
     return InputTypeNames::week();
 }
 
+double WeekInputType::minimum() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), DateComponents::minimumWeek());
+}
+
+double WeekInputType::maximum() const
+{
+    return parseToDouble(element()->fastGetAttribute(maxAttr), DateComponents::maximumWeek());
+}
+
+double WeekInputType::stepBase() const
+{
+    return parseToDouble(element()->fastGetAttribute(minAttr), weekDefaultStepBase);
+}
+
+double WeekInputType::defaultStep() const
+{
+    return weekDefaultStep;
+}
+
+double WeekInputType::stepScaleFactor() const
+{
+    return weekStepScaleFactor;
+}
+
+bool WeekInputType::parsedStepValueShouldBeInteger() const
+{
+    return true;
+}
+
+bool WeekInputType::parseToDateComponentsInternal(const UChar* characters, unsigned length, DateComponents* out) const
+{
+    ASSERT(out);
+    unsigned end;
+    return out->parseWeek(characters, length, 0, end) && end == length;
+}
+
+bool WeekInputType::setMillisecondToDateComponents(double value, DateComponents* date) const
+{
+    ASSERT(date);
+    return date->setMillisecondsSinceEpochForWeek(value);
+}
+
 } // namespace WebCore
diff --git a/WebCore/html/WeekInputType.h b/WebCore/html/WeekInputType.h
index 7b6ee23..437164b 100644
--- a/WebCore/html/WeekInputType.h
+++ b/WebCore/html/WeekInputType.h
@@ -31,17 +31,25 @@
 #ifndef WeekInputType_h
 #define WeekInputType_h
 
-#include "TextFieldInputType.h"
+#include "BaseDateAndTimeInputType.h"
 
 namespace WebCore {
 
-class WeekInputType : public TextFieldInputType {
+class WeekInputType : public BaseDateAndTimeInputType {
 public:
     static PassOwnPtr<InputType> create(HTMLInputElement*);
 
 private:
-    WeekInputType(HTMLInputElement* element) : TextFieldInputType(element) { }
+    WeekInputType(HTMLInputElement* element) : BaseDateAndTimeInputType(element) { }
     virtual const AtomicString& formControlType() const;
+    virtual double minimum() const;
+    virtual double maximum() const;
+    virtual double stepBase() const;
+    virtual double defaultStep() const;
+    virtual double stepScaleFactor() const;
+    virtual bool parsedStepValueShouldBeInteger() const;
+    virtual bool parseToDateComponentsInternal(const UChar*, unsigned length, DateComponents*) const;
+    virtual bool setMillisecondToDateComponents(double, DateComponents*) const;
 };
 
 } // namespace WebCore
diff --git a/WebCore/html/canvas/ArrayBuffer.cpp b/WebCore/html/canvas/ArrayBuffer.cpp
index 3b204ff..014cc1e 100644
--- a/WebCore/html/canvas/ArrayBuffer.cpp
+++ b/WebCore/html/canvas/ArrayBuffer.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBuffer.h"
 
@@ -93,4 +93,4 @@ void* ArrayBuffer::tryAllocate(unsigned numElements, unsigned elementByteSize)
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/ArrayBuffer.idl b/WebCore/html/canvas/ArrayBuffer.idl
index 92098e5..79a4685 100644
--- a/WebCore/html/canvas/ArrayBuffer.idl
+++ b/WebCore/html/canvas/ArrayBuffer.idl
@@ -26,10 +26,11 @@
 module html {
 
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
-        V8CustomConstructor
+        NoStaticTables,
+        V8CustomConstructor,
     ] ArrayBuffer {
         readonly attribute int byteLength;
     };
diff --git a/WebCore/html/canvas/ArrayBufferView.cpp b/WebCore/html/canvas/ArrayBufferView.cpp
index 485d18b..7f41bda 100644
--- a/WebCore/html/canvas/ArrayBufferView.cpp
+++ b/WebCore/html/canvas/ArrayBufferView.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "ArrayBufferView.h"
 
@@ -106,4 +106,4 @@ void ArrayBufferView::calculateOffsetAndLength(int start, int end, unsigned arra
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/ArrayBufferView.idl b/WebCore/html/canvas/ArrayBufferView.idl
index 450345e..74a3fe3 100644
--- a/WebCore/html/canvas/ArrayBufferView.idl
+++ b/WebCore/html/canvas/ArrayBufferView.idl
@@ -24,7 +24,7 @@
  */
 
 module html {
-    interface [Conditional=3D_CANVAS, CustomToJS, OmitConstructor] ArrayBufferView {
+    interface [Conditional=3D_CANVAS|BLOB, CustomToJS, NoStaticTables, OmitConstructor] ArrayBufferView {
         readonly attribute ArrayBuffer buffer;
         readonly attribute unsigned long byteOffset;
         readonly attribute unsigned long byteLength;
diff --git a/WebCore/html/canvas/CanvasGradient.cpp b/WebCore/html/canvas/CanvasGradient.cpp
index fd48194..7c98a82 100644
--- a/WebCore/html/canvas/CanvasGradient.cpp
+++ b/WebCore/html/canvas/CanvasGradient.cpp
@@ -27,6 +27,8 @@
 #include "config.h"
 #include "CanvasGradient.h"
 
+#include "CanvasPattern.h"
+#include "CanvasStyle.h"
 #include "CSSParser.h"
 #include "ExceptionCode.h"
 
@@ -52,7 +54,7 @@ void CanvasGradient::addColorStop(float value, const String& color, ExceptionCod
     }
 
     RGBA32 rgba = 0;
-    if (!CSSParser::parseColor(rgba, color)) {
+    if (!parseColorOrCurrentColor(rgba, color, 0 /*canvas*/)) {
         if (!m_dashbardCompatibilityMode)
             ec = SYNTAX_ERR;
         return;
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.cpp b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
index 161a891..b1d7b23 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.cpp
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.cpp
@@ -128,10 +128,10 @@ CanvasRenderingContext2D::CanvasRenderingContext2D(HTMLCanvasElement* canvas, bo
         return;
     if (!p->settings()->accelerated2dCanvasEnabled())
         return;
-    m_context3D = p->chrome()->client()->getSharedGraphicsContext3D();
-    if (m_context3D) {
-        if (GraphicsContext* c = drawingContext()) {
-            m_drawingBuffer = DrawingBuffer::create(m_context3D.get(), IntSize(canvas->width(), canvas->height()));
+    if (GraphicsContext* c = drawingContext()) {
+        m_context3D = p->sharedGraphicsContext3D();
+        if (m_context3D) {
+            m_drawingBuffer = m_context3D->graphicsContext3D()->createDrawingBuffer(IntSize(canvas->width(), canvas->height()));
             c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas->width(), canvas->height()));
         }
     }
@@ -167,8 +167,8 @@ void CanvasRenderingContext2D::reset()
     m_stateStack.first() = State();
     m_path.clear();
 #if ENABLE(ACCELERATED_2D_CANVAS)
-    if (m_context3D) {
-        if (GraphicsContext* c = drawingContext()) {
+    if (GraphicsContext* c = drawingContext()) {
+        if (m_context3D) {
             m_drawingBuffer->reset(IntSize(canvas()->width(), canvas()->height()));
             c->setSharedGraphicsContext3D(m_context3D.get(), m_drawingBuffer.get(), IntSize(canvas()->width(), canvas()->height()));
         }
@@ -231,7 +231,7 @@ void CanvasRenderingContext2D::setAllAttributesToDefault()
     if (!context)
         return;
 
-    context->setShadow(FloatSize(), 0, Color::transparent, DeviceColorSpace);
+    context->setShadow(FloatSize(), 0, Color::transparent, ColorSpaceDeviceRGB);
     context->setAlpha(1);
     context->setCompositeOperation(CompositeSourceOver);
 }
@@ -249,7 +249,13 @@ void CanvasRenderingContext2D::setStrokeStyle(PassRefPtr<CanvasStyle> style)
     if (state().m_strokeStyle && state().m_strokeStyle->isEquivalentColor(*style))
         return;
 
-    checkOrigin(style->canvasPattern());
+    if (style->isCurrentColor()) {
+        if (style->hasOverrideAlpha())
+            style = CanvasStyle::createFromRGBA(colorWithOverrideAlpha(currentColor(canvas()), style->overrideAlpha()));
+        else
+            style = CanvasStyle::createFromRGBA(currentColor(canvas()));
+    } else
+        checkOrigin(style->canvasPattern());
 
     state().m_strokeStyle = style;
     GraphicsContext* c = drawingContext();
@@ -272,7 +278,13 @@ void CanvasRenderingContext2D::setFillStyle(PassRefPtr<CanvasStyle> style)
     if (state().m_fillStyle && state().m_fillStyle->isEquivalentColor(*style))
         return;
 
-    checkOrigin(style->canvasPattern());
+    if (style->isCurrentColor()) {
+        if (style->hasOverrideAlpha())
+            style = CanvasStyle::createFromRGBA(colorWithOverrideAlpha(currentColor(canvas()), style->overrideAlpha()));
+        else
+            style = CanvasStyle::createFromRGBA(currentColor(canvas()));
+    } else
+        checkOrigin(style->canvasPattern());
 
     state().m_fillStyle = style;
     GraphicsContext* c = drawingContext();
@@ -394,7 +406,7 @@ String CanvasRenderingContext2D::shadowColor() const
 
 void CanvasRenderingContext2D::setShadowColor(const String& color)
 {
-    if (!CSSParser::parseColor(state().m_shadowColor, color))
+    if (!parseColorOrCurrentColor(state().m_shadowColor, color, canvas()))
         return;
 
     applyShadow();
@@ -982,7 +994,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur)
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color)
 {
-    if (!CSSParser::parseColor(state().m_shadowColor, color))
+    if (!parseColorOrCurrentColor(state().m_shadowColor, color, canvas()))
         return;
 
     state().m_shadowOffset = FloatSize(width, height);
@@ -1000,14 +1012,14 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, DeviceColorSpace);
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, const String& color, float alpha)
 {
     RGBA32 rgba;
 
-    if (!CSSParser::parseColor(rgba, color))
+    if (!parseColorOrCurrentColor(rgba, color, canvas()))
         return;
 
     state().m_shadowColor = colorWithOverrideAlpha(rgba, alpha);
@@ -1018,7 +1030,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, DeviceColorSpace);
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float grayLevel, float alpha)
@@ -1031,7 +1043,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, DeviceColorSpace);
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float r, float g, float b, float a)
@@ -1044,7 +1056,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     if (!c)
         return;
 
-    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, DeviceColorSpace);
+    c->setShadow(IntSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 void CanvasRenderingContext2D::setShadow(float width, float height, float blur, float c, float m, float y, float k, float a)
@@ -1064,7 +1076,7 @@ void CanvasRenderingContext2D::setShadow(float width, float height, float blur,
     CGContextSetShadowWithColor(dc->platformContext(), adjustedShadowSize(width, -height), blur, shadowColor);
     CGColorRelease(shadowColor);
 #else
-    dc->setShadow(IntSize(width, -height), blur, state().m_shadowColor, DeviceColorSpace);
+    dc->setShadow(IntSize(width, -height), blur, state().m_shadowColor, ColorSpaceDeviceRGB);
 #endif
 }
 
@@ -1084,7 +1096,7 @@ void CanvasRenderingContext2D::applyShadow()
 
     float width = state().m_shadowOffset.width();
     float height = state().m_shadowOffset.height();
-    c->setShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, DeviceColorSpace);
+    c->setShadow(FloatSize(width, -height), state().m_shadowBlur, state().m_shadowColor, ColorSpaceDeviceRGB);
 }
 
 static IntSize size(HTMLImageElement* image)
@@ -1186,7 +1198,7 @@ void CanvasRenderingContext2D::drawImage(HTMLImageElement* image, const FloatRec
 
     FloatRect sourceRect = c->roundToDevicePixels(normalizedSrcRect);
     FloatRect destRect = c->roundToDevicePixels(normalizedDstRect);
-    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
+    c->drawImage(cachedImage->image(), ColorSpaceDeviceRGB, destRect, sourceRect, state().m_globalComposite);
     didDraw(destRect);
 }
 
@@ -1268,7 +1280,7 @@ void CanvasRenderingContext2D::drawImage(HTMLCanvasElement* sourceCanvas, const
     sourceCanvas->makeRenderingResultsAvailable();
 #endif
 
-    c->drawImageBuffer(buffer, DeviceColorSpace, destRect, sourceRect, state().m_globalComposite);
+    c->drawImageBuffer(buffer, ColorSpaceDeviceRGB, destRect, sourceRect, state().m_globalComposite);
     didDraw(destRect);
 }
 
@@ -1371,7 +1383,7 @@ void CanvasRenderingContext2D::drawImageFromRect(HTMLImageElement* image,
         op = CompositeSourceOver;
 
     FloatRect destRect = FloatRect(dx, dy, dw, dh);
-    c->drawImage(cachedImage->image(), DeviceColorSpace, destRect, FloatRect(sx, sy, sw, sh), op);
+    c->drawImage(cachedImage->image(), ColorSpaceDeviceRGB, destRect, FloatRect(sx, sy, sw, sh), op);
     didDraw(destRect);
 }
 
@@ -1402,9 +1414,9 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createLinearGradient(float
         return 0;
     }
 
-    PassRefPtr<CanvasGradient> gradient = CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
+    RefPtr<CanvasGradient> gradient = CanvasGradient::create(FloatPoint(x0, y0), FloatPoint(x1, y1));
     prepareGradientForDashboard(gradient.get());
-    return gradient;
+    return gradient.release();
 }
 
 PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float x0, float y0, float r0, float x1, float y1, float r1, ExceptionCode& ec)
@@ -1413,9 +1425,15 @@ PassRefPtr<CanvasGradient> CanvasRenderingContext2D::createRadialGradient(float
         ec = NOT_SUPPORTED_ERR;
         return 0;
     }
-    PassRefPtr<CanvasGradient> gradient =  CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
+
+    if (r0 < 0 || r1 < 0) {
+        ec = INDEX_SIZE_ERR;
+        return 0;
+    }
+
+    RefPtr<CanvasGradient> gradient = CanvasGradient::create(FloatPoint(x0, y0), r0, FloatPoint(x1, y1), r1);
     prepareGradientForDashboard(gradient.get());
-    return gradient;
+    return gradient.release();
 }
 
 PassRefPtr<CanvasPattern> CanvasRenderingContext2D::createPattern(HTMLImageElement* image,
@@ -1513,7 +1531,7 @@ static PassRefPtr<ImageData> createEmptyImageData(const IntSize& size)
 {
     RefPtr<ImageData> data = ImageData::create(size.width(), size.height());
     memset(data->data()->data()->data(), 0, data->data()->data()->length());
-    return data.get();
+    return data.release();
 }
 
 PassRefPtr<ImageData> CanvasRenderingContext2D::createImageData(PassRefPtr<ImageData> imageData, ExceptionCode& ec) const
@@ -1614,16 +1632,16 @@ void CanvasRenderingContext2D::putImageData(ImageData* data, float dx, float dy,
     FloatRect clipRect(dirtyX, dirtyY, dirtyWidth, dirtyHeight);
     clipRect.intersect(IntRect(0, 0, data->width(), data->height()));
     IntSize destOffset(static_cast<int>(dx), static_cast<int>(dy));
-    IntRect sourceRect = enclosingIntRect(clipRect);
-    sourceRect.move(destOffset);
-    sourceRect.intersect(IntRect(IntPoint(), buffer->size()));
-    if (sourceRect.isEmpty())
+    IntRect destRect = enclosingIntRect(clipRect);
+    destRect.move(destOffset);
+    destRect.intersect(IntRect(IntPoint(), buffer->size()));
+    if (destRect.isEmpty())
         return;
+    IntRect sourceRect(destRect);
     sourceRect.move(-destOffset);
-    IntPoint destPoint(destOffset.width(), destOffset.height());
 
-    buffer->putUnmultipliedImageData(data, sourceRect, destPoint);
-    didDraw(sourceRect, CanvasDidDrawApplyNone); // ignore transform, shadow and clip
+    buffer->putUnmultipliedImageData(data, sourceRect, IntPoint(destOffset));
+    didDraw(destRect, CanvasDidDrawApplyNone); // ignore transform, shadow and clip
 }
 
 String CanvasRenderingContext2D::font() const
@@ -1732,7 +1750,7 @@ PassRefPtr<TextMetrics> CanvasRenderingContext2D::measureText(const String& text
     Font::setCodePath(oldCodePath);
 #endif
 
-    return metrics;
+    return metrics.release();
 }
 
 void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, float y, bool fill, float /*maxWidth*/, bool /*useMaxWidth*/)
@@ -1749,7 +1767,7 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
     // FIXME: Need to turn off font smoothing.
 
     RenderStyle* computedStyle = canvas()->computedStyle();
-    bool rtl = computedStyle ? computedStyle->direction() == RTL : false;
+    bool rtl = computedStyle ? !computedStyle->isLeftToRightDirection() : false;
     bool override = computedStyle ? computedStyle->unicodeBidi() == Override : false;
 
     unsigned length = text.length();
@@ -1812,9 +1830,9 @@ void CanvasRenderingContext2D::drawTextInternal(const String& text, float x, flo
         GraphicsContext* maskImageContext = maskImage->context();
 
         if (fill)
-            maskImageContext->setFillColor(Color::black, DeviceColorSpace);
+            maskImageContext->setFillColor(Color::black, ColorSpaceDeviceRGB);
         else {
-            maskImageContext->setStrokeColor(Color::black, DeviceColorSpace);
+            maskImageContext->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
             maskImageContext->setStrokeThickness(c->strokeThickness());
         }
 
diff --git a/WebCore/html/canvas/CanvasRenderingContext2D.h b/WebCore/html/canvas/CanvasRenderingContext2D.h
index 2c88a31..f51c5e9 100644
--- a/WebCore/html/canvas/CanvasRenderingContext2D.h
+++ b/WebCore/html/canvas/CanvasRenderingContext2D.h
@@ -294,7 +294,7 @@ private:
 #endif
 
 #if ENABLE(ACCELERATED_2D_CANVAS)
-    OwnPtr<DrawingBuffer> m_drawingBuffer;
+    RefPtr<DrawingBuffer> m_drawingBuffer;
     RefPtr<SharedGraphicsContext3D> m_context3D;
 #endif
 };
diff --git a/WebCore/html/canvas/CanvasStyle.cpp b/WebCore/html/canvas/CanvasStyle.cpp
index fd3c6e5..a4e87e3 100644
--- a/WebCore/html/canvas/CanvasStyle.cpp
+++ b/WebCore/html/canvas/CanvasStyle.cpp
@@ -30,9 +30,11 @@
 #include "CanvasStyle.h"
 
 #include "CSSParser.h"
+#include "CSSPropertyNames.h"
 #include "CanvasGradient.h"
 #include "CanvasPattern.h"
 #include "GraphicsContext.h"
+#include "HTMLCanvasElement.h"
 #include <wtf/Assertions.h>
 #include <wtf/PassRefPtr.h>
 
@@ -49,6 +51,49 @@
 
 namespace WebCore {
 
+enum ColorParseResult { ParsedRGBA, ParsedCurrentColor, ParseFailed };
+
+static ColorParseResult parseColor(RGBA32& parsedColor, const String& colorString)
+{
+    if (equalIgnoringCase(colorString, "currentcolor"))
+        return ParsedCurrentColor;
+    if (CSSParser::parseColor(parsedColor, colorString))
+        return ParsedRGBA;
+    return ParseFailed;
+}
+
+RGBA32 currentColor(HTMLCanvasElement* canvas)
+{
+    if (!canvas || !canvas->inDocument())
+        return Color::black;
+    RGBA32 rgba = Color::black;
+    CSSParser::parseColor(rgba, canvas->style()->getPropertyValue(CSSPropertyColor));
+    return rgba;
+}
+
+bool parseColorOrCurrentColor(RGBA32& parsedColor, const String& colorString, HTMLCanvasElement* canvas)
+{
+    ColorParseResult parseResult = parseColor(parsedColor, colorString);
+    switch (parseResult) {
+    case ParsedRGBA:
+        return true;
+    case ParsedCurrentColor:
+        parsedColor = currentColor(canvas);
+        return true;
+    case ParseFailed:
+        return false;
+    default:
+        ASSERT_NOT_REACHED();
+        return false;
+    }
+}
+
+CanvasStyle::CanvasStyle(Type type, float overrideAlpha)
+    : m_type(type)
+    , m_overrideAlpha(overrideAlpha)
+{
+}
+
 CanvasStyle::CanvasStyle(RGBA32 rgba)
     : m_type(RGBA)
     , m_rgba(rgba)
@@ -89,17 +134,35 @@ CanvasStyle::CanvasStyle(PassRefPtr<CanvasPattern> pattern)
 PassRefPtr<CanvasStyle> CanvasStyle::createFromString(const String& color)
 {
     RGBA32 rgba;
-    if (!CSSParser::parseColor(rgba, color))
+    ColorParseResult parseResult = parseColor(rgba, color);
+    switch (parseResult) {
+    case ParsedRGBA:
+        return adoptRef(new CanvasStyle(rgba));
+    case ParsedCurrentColor:
+        return adoptRef(new CanvasStyle(CurrentColor));
+    case ParseFailed:
         return 0;
-    return adoptRef(new CanvasStyle(rgba));
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
 }
 
 PassRefPtr<CanvasStyle> CanvasStyle::createFromStringWithOverrideAlpha(const String& color, float alpha)
 {
     RGBA32 rgba;
-    if (!CSSParser::parseColor(rgba, color))
+    ColorParseResult parseResult = parseColor(rgba, color);
+    switch (parseResult) {
+    case ParsedRGBA:
+        return adoptRef(new CanvasStyle(colorWithOverrideAlpha(rgba, alpha)));
+    case ParsedCurrentColor:
+        return adoptRef(new CanvasStyle(CurrentColorWithOverrideAlpha, alpha));
+    case ParseFailed:
+        return 0;
+    default:
+        ASSERT_NOT_REACHED();
         return 0;
-    return adoptRef(new CanvasStyle(colorWithOverrideAlpha(rgba, alpha)));
+    }
 }
 
 PassRefPtr<CanvasStyle> CanvasStyle::createFromGradient(PassRefPtr<CanvasGradient> gradient)
@@ -121,16 +184,18 @@ bool CanvasStyle::isEquivalentColor(const CanvasStyle& other) const
         return false;
 
     switch (m_type) {
-    case CanvasStyle::RGBA:
+    case RGBA:
         return m_rgba == other.m_rgba;
-    case CanvasStyle::CMYKA:
+    case CMYKA:
         return m_cmyka.c == other.m_cmyka.c
             && m_cmyka.m == other.m_cmyka.m
             && m_cmyka.y == other.m_cmyka.y
             && m_cmyka.k == other.m_cmyka.k
             && m_cmyka.a == other.m_cmyka.a;
-    case CanvasStyle::Gradient:
-    case CanvasStyle::ImagePattern:
+    case Gradient:
+    case ImagePattern:
+    case CurrentColor:
+    case CurrentColorWithOverrideAlpha:
         return false;
     }
 
@@ -164,7 +229,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
         return;
     switch (m_type) {
     case RGBA:
-        context->setStrokeColor(m_rgba, DeviceColorSpace);
+        context->setStrokeColor(m_rgba, ColorSpaceDeviceRGB);
         break;
     case CMYKA: {
         // FIXME: Do this through platform-independent GraphicsContext API.
@@ -178,7 +243,7 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
         currentPen.setColor(clr);
         context->platformContext()->setPen(currentPen);
 #else
-        context->setStrokeColor(m_rgba, DeviceColorSpace);
+        context->setStrokeColor(m_rgba, ColorSpaceDeviceRGB);
 #endif
         break;
     }
@@ -188,6 +253,10 @@ void CanvasStyle::applyStrokeColor(GraphicsContext* context)
     case ImagePattern:
         context->setStrokePattern(canvasPattern()->pattern());
         break;
+    case CurrentColor:
+    case CurrentColorWithOverrideAlpha:
+        ASSERT_NOT_REACHED();
+        break;
     }
 }
 
@@ -197,7 +266,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
         return;
     switch (m_type) {
     case RGBA:
-        context->setFillColor(m_rgba, DeviceColorSpace);
+        context->setFillColor(m_rgba, ColorSpaceDeviceRGB);
         break;
     case CMYKA: {
         // FIXME: Do this through platform-independent GraphicsContext API.
@@ -211,7 +280,7 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
         currentBrush.setColor(clr);
         context->platformContext()->setBrush(currentBrush);
 #else
-        context->setFillColor(m_rgba, DeviceColorSpace);
+        context->setFillColor(m_rgba, ColorSpaceDeviceRGB);
 #endif
         break;
     }
@@ -221,6 +290,10 @@ void CanvasStyle::applyFillColor(GraphicsContext* context)
     case ImagePattern:
         context->setFillPattern(canvasPattern()->pattern());
         break;
+    case CurrentColor:
+    case CurrentColorWithOverrideAlpha:
+        ASSERT_NOT_REACHED();
+        break;
     }
 }
 
diff --git a/WebCore/html/canvas/CanvasStyle.h b/WebCore/html/canvas/CanvasStyle.h
index 3ca760a..91dc923 100644
--- a/WebCore/html/canvas/CanvasStyle.h
+++ b/WebCore/html/canvas/CanvasStyle.h
@@ -29,12 +29,14 @@
 
 #include "Color.h"
 #include "PlatformString.h"
+#include <wtf/Assertions.h>
 
 namespace WebCore {
 
     class CanvasGradient;
     class CanvasPattern;
     class GraphicsContext;
+    class HTMLCanvasElement;
 
     class CanvasStyle : public RefCounted<CanvasStyle> {
     public:
@@ -47,7 +49,11 @@ namespace WebCore {
         static PassRefPtr<CanvasStyle> createFromGradient(PassRefPtr<CanvasGradient>);
         static PassRefPtr<CanvasStyle> createFromPattern(PassRefPtr<CanvasPattern>);
 
-        String color() const { return Color(m_rgba).serialized(); }
+        bool isCurrentColor() const { return m_type == CurrentColor || m_type == CurrentColorWithOverrideAlpha; }
+        bool hasOverrideAlpha() const { return m_type == CurrentColorWithOverrideAlpha; }
+        float overrideAlpha() const { ASSERT(m_type == CurrentColorWithOverrideAlpha); return m_overrideAlpha; }
+
+        String color() const { ASSERT(m_type == RGBA || m_type == CMYKA); return Color(m_rgba).serialized(); }
         CanvasGradient* canvasGradient() const { return m_gradient.get(); }
         CanvasPattern* canvasPattern() const { return m_pattern.get(); }
 
@@ -59,6 +65,9 @@ namespace WebCore {
         bool isEquivalentCMYKA(float c, float m, float y, float k, float a) const;
 
     private:
+        enum Type { RGBA, CMYKA, Gradient, ImagePattern, CurrentColor, CurrentColorWithOverrideAlpha };
+
+        CanvasStyle(Type, float overrideAlpha = 0);
         CanvasStyle(RGBA32 rgba);
         CanvasStyle(float grayLevel, float alpha);
         CanvasStyle(float r, float g, float b, float a);
@@ -66,11 +75,12 @@ namespace WebCore {
         CanvasStyle(PassRefPtr<CanvasGradient>);
         CanvasStyle(PassRefPtr<CanvasPattern>);
 
-        enum Type { RGBA, CMYKA, Gradient, ImagePattern };
-
         Type m_type;
 
-        RGBA32 m_rgba;
+        union {
+            RGBA32 m_rgba;
+            float m_overrideAlpha;
+        };
 
         RefPtr<CanvasGradient> m_gradient;
         RefPtr<CanvasPattern> m_pattern;
@@ -86,6 +96,9 @@ namespace WebCore {
         } m_cmyka;
     };
 
+    RGBA32 currentColor(HTMLCanvasElement*);
+    bool parseColorOrCurrentColor(RGBA32& parsedColor, const String& colorString, HTMLCanvasElement*);
+
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/html/canvas/Float32Array.cpp b/WebCore/html/canvas/Float32Array.cpp
index e6e8439..e918d8f 100644
--- a/WebCore/html/canvas/Float32Array.cpp
+++ b/WebCore/html/canvas/Float32Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Float32Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Float32Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Float32Array.idl b/WebCore/html/canvas/Float32Array.idl
index 5a939ca..c3c0a2d 100644
--- a/WebCore/html/canvas/Float32Array.idl
+++ b/WebCore/html/canvas/Float32Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Float32Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Int16Array.cpp b/WebCore/html/canvas/Int16Array.cpp
index f3f9742..635ea5e 100644
--- a/WebCore/html/canvas/Int16Array.cpp
+++ b/WebCore/html/canvas/Int16Array.cpp
@@ -25,7 +25,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Int16Array.h"
 
@@ -58,4 +58,4 @@ PassRefPtr<ArrayBufferView> Int16Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Int16Array.idl b/WebCore/html/canvas/Int16Array.idl
index 02417f8..7980a69 100644
--- a/WebCore/html/canvas/Int16Array.idl
+++ b/WebCore/html/canvas/Int16Array.idl
@@ -25,13 +25,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Int16Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Int32Array.cpp b/WebCore/html/canvas/Int32Array.cpp
index 423c36b..cc926a3 100644
--- a/WebCore/html/canvas/Int32Array.cpp
+++ b/WebCore/html/canvas/Int32Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Int32Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Int32Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Int32Array.h b/WebCore/html/canvas/Int32Array.h
index 72fb579..bd05450 100644
--- a/WebCore/html/canvas/Int32Array.h
+++ b/WebCore/html/canvas/Int32Array.h
@@ -37,8 +37,10 @@ class Int32Array : public IntegralTypedArrayBase<int> {
     static PassRefPtr<Int32Array> create(int* array, unsigned length);
     static PassRefPtr<Int32Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
+#if !COMPILER(RVCT)
     using TypedArrayBase<int>::set;
     using IntegralTypedArrayBase<int>::set;
+#endif
 
   private:
     Int32Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/WebCore/html/canvas/Int32Array.idl b/WebCore/html/canvas/Int32Array.idl
index 6977d00..bd1554d 100644
--- a/WebCore/html/canvas/Int32Array.idl
+++ b/WebCore/html/canvas/Int32Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Int32Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Int8Array.cpp b/WebCore/html/canvas/Int8Array.cpp
index 20ff32a..c2dd2fa 100644
--- a/WebCore/html/canvas/Int8Array.cpp
+++ b/WebCore/html/canvas/Int8Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Int8Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Int8Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Int8Array.idl b/WebCore/html/canvas/Int8Array.idl
index 4dba9e4..ec0bdb7 100644
--- a/WebCore/html/canvas/Int8Array.idl
+++ b/WebCore/html/canvas/Int8Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Int8Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Uint16Array.cpp b/WebCore/html/canvas/Uint16Array.cpp
index 4656173..a0f891c 100644
--- a/WebCore/html/canvas/Uint16Array.cpp
+++ b/WebCore/html/canvas/Uint16Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Uint16Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Uint16Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Uint16Array.idl b/WebCore/html/canvas/Uint16Array.idl
index de1e5e0..75a7499 100644
--- a/WebCore/html/canvas/Uint16Array.idl
+++ b/WebCore/html/canvas/Uint16Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Uint16Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Uint32Array.cpp b/WebCore/html/canvas/Uint32Array.cpp
index 3f43bef..f49a83a 100644
--- a/WebCore/html/canvas/Uint32Array.cpp
+++ b/WebCore/html/canvas/Uint32Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Uint32Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Uint32Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Uint32Array.idl b/WebCore/html/canvas/Uint32Array.idl
index ce632dd..06e17c6 100644
--- a/WebCore/html/canvas/Uint32Array.idl
+++ b/WebCore/html/canvas/Uint32Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Uint32Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/Uint8Array.cpp b/WebCore/html/canvas/Uint8Array.cpp
index 13b7022..6c785f9 100644
--- a/WebCore/html/canvas/Uint8Array.cpp
+++ b/WebCore/html/canvas/Uint8Array.cpp
@@ -26,7 +26,7 @@
 
 #include "config.h"
 
-#if ENABLE(3D_CANVAS)
+#if ENABLE(3D_CANVAS) || ENABLE(BLOB)
 
 #include "Uint8Array.h"
 
@@ -59,4 +59,4 @@ PassRefPtr<ArrayBufferView> Uint8Array::slice(int start, int end) const
 
 }
 
-#endif // ENABLE(3D_CANVAS)
+#endif // ENABLE(3D_CANVAS) || ENABLE(BLOB)
diff --git a/WebCore/html/canvas/Uint8Array.h b/WebCore/html/canvas/Uint8Array.h
index 6e20b42..fce63da 100644
--- a/WebCore/html/canvas/Uint8Array.h
+++ b/WebCore/html/canvas/Uint8Array.h
@@ -39,8 +39,10 @@ class Uint8Array : public IntegralTypedArrayBase<unsigned char> {
     static PassRefPtr<Uint8Array> create(unsigned char* array, unsigned length);
     static PassRefPtr<Uint8Array> create(PassRefPtr<ArrayBuffer> buffer, unsigned byteOffset, unsigned length);
 
+#if !COMPILER(RVCT)
     using TypedArrayBase<unsigned char>::set;
     using IntegralTypedArrayBase<unsigned char>::set;
+#endif
 
   private:
     Uint8Array(PassRefPtr<ArrayBuffer> buffer,
diff --git a/WebCore/html/canvas/Uint8Array.idl b/WebCore/html/canvas/Uint8Array.idl
index c520844..bd28023 100644
--- a/WebCore/html/canvas/Uint8Array.idl
+++ b/WebCore/html/canvas/Uint8Array.idl
@@ -26,13 +26,14 @@
 
 module html {
     interface [
-        Conditional=3D_CANVAS,
+        Conditional=3D_CANVAS|BLOB,
         CanBeConstructed,
         CustomConstructFunction,
         V8CustomConstructor,
         HasNumericIndexGetter,
         HasCustomIndexSetter,
         GenerateNativeConverter,
+        NoStaticTables,
         CustomToJS,
         DontCheckEnums
     ] Uint8Array : ArrayBufferView {
diff --git a/WebCore/html/canvas/WebGLProgram.cpp b/WebCore/html/canvas/WebGLProgram.cpp
index 0853b67..e4ffa80 100644
--- a/WebCore/html/canvas/WebGLProgram.cpp
+++ b/WebCore/html/canvas/WebGLProgram.cpp
@@ -40,7 +40,7 @@ PassRefPtr<WebGLProgram> WebGLProgram::create(WebGLRenderingContext* ctx)
 
 WebGLProgram::WebGLProgram(WebGLRenderingContext* ctx)
     : WebGLObject(ctx)
-    , m_linkFailure(false)
+    , m_linkStatus(false)
 {
     setObject(context()->graphicsContext3D()->createProgram());
 }
diff --git a/WebCore/html/canvas/WebGLProgram.h b/WebCore/html/canvas/WebGLProgram.h
index e5548eb..3b88fdd 100644
--- a/WebCore/html/canvas/WebGLProgram.h
+++ b/WebCore/html/canvas/WebGLProgram.h
@@ -50,11 +50,8 @@ public:
 
     bool isUsingVertexAttrib0() const;
 
-    // Return true means getProgramParameter(LINK_STATUS) should return
-    // false; return false means we should actually call
-    // getProgramParameter(LINK_STATUS) to find out.
-    bool isLinkFailureFlagSet() const { return m_linkFailure; }
-    void setLinkFailureFlag(bool failed) { m_linkFailure = failed; }
+    bool getLinkStatus() const { return m_linkStatus; }
+    void setLinkStatus(bool status) { m_linkStatus = status; }
 
     WebGLShader* getAttachedShader(GraphicsContext3D::WebGLEnumType);
     bool attachShader(WebGLShader*);
@@ -70,7 +67,7 @@ private:
 
     Vector<int> m_activeAttribLocations;
 
-    bool m_linkFailure;
+    bool m_linkStatus;
 
     RefPtr<WebGLShader> m_vertexShader;
     RefPtr<WebGLShader> m_fragmentShader;
diff --git a/WebCore/html/canvas/WebGLRenderingContext.cpp b/WebCore/html/canvas/WebGLRenderingContext.cpp
index d1bb0cd..a8751da 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.cpp
+++ b/WebCore/html/canvas/WebGLRenderingContext.cpp
@@ -88,15 +88,15 @@ PassOwnPtr<WebGLRenderingContext> WebGLRenderingContext::create(HTMLCanvasElemen
 {
     HostWindow* hostWindow = canvas->document()->view()->root()->hostWindow();
     GraphicsContext3D::Attributes emptyAttributes;
-    OwnPtr<GraphicsContext3D> context(GraphicsContext3D::create(attrs ? attrs->attributes() : emptyAttributes, hostWindow));
+    RefPtr<GraphicsContext3D> context(GraphicsContext3D::create(attrs ? attrs->attributes() : emptyAttributes, hostWindow));
 
     if (!context)
         return 0;
         
-    return new WebGLRenderingContext(canvas, context.release());
+    return new WebGLRenderingContext(canvas, context);
 }
 
-WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, PassOwnPtr<GraphicsContext3D> context)
+WebGLRenderingContext::WebGLRenderingContext(HTMLCanvasElement* passedCanvas, PassRefPtr<GraphicsContext3D> context)
     : CanvasRenderingContext(passedCanvas)
     , m_context(context)
     , m_needsUpdate(true)
@@ -1484,10 +1484,7 @@ WebGLGetInfo WebGLRenderingContext::getProgramParameter(WebGLProgram* program, u
         m_context->getProgramiv(objectOrZero(program), pname, &value);
         return WebGLGetInfo(static_cast<bool>(value));
     case GraphicsContext3D::LINK_STATUS:
-        if (program->isLinkFailureFlagSet())
-            return WebGLGetInfo(false);
-        m_context->getProgramiv(objectOrZero(program), pname, &value);
-        return WebGLGetInfo(static_cast<bool>(value));
+        return WebGLGetInfo(program->getLinkStatus());
     case GraphicsContext3D::INFO_LOG_LENGTH:
     case GraphicsContext3D::ATTACHED_SHADERS:
     case GraphicsContext3D::ACTIVE_ATTRIBUTES:
@@ -1897,14 +1894,17 @@ void WebGLRenderingContext::linkProgram(WebGLProgram* program, ExceptionCode& ec
         return;
     if (!isGLES2Compliant()) {
         if (!program->getAttachedShader(GraphicsContext3D::VERTEX_SHADER) || !program->getAttachedShader(GraphicsContext3D::FRAGMENT_SHADER)) {
-            program->setLinkFailureFlag(true);
+            program->setLinkStatus(false);
             return;
         }
-        program->setLinkFailureFlag(false);
     }
 
     m_context->linkProgram(objectOrZero(program));
     program->cacheActiveAttribLocations();
+    // cache link status
+    int value = 0;
+    m_context->getProgramiv(objectOrZero(program), GraphicsContext3D::LINK_STATUS, &value);
+    program->setLinkStatus(static_cast<bool>(value));
     cleanupAfterGraphicsCall(false);
 }
 
@@ -2714,11 +2714,12 @@ void WebGLRenderingContext::uniformMatrix4fv(const WebGLUniformLocation* locatio
 
 void WebGLRenderingContext::useProgram(WebGLProgram* program, ExceptionCode& ec)
 {
+    UNUSED_PARAM(ec);
     if (program && program->context() != this) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         return;
     }
-    if (program && program->object() && !getProgramParameter(program, GraphicsContext3D::LINK_STATUS, ec).getBool()) {
+    if (program && program->object() && !program->getLinkStatus()) {
         m_context->synthesizeGLError(GraphicsContext3D::INVALID_OPERATION);
         cleanupAfterGraphicsCall(false);
         return;
diff --git a/WebCore/html/canvas/WebGLRenderingContext.h b/WebCore/html/canvas/WebGLRenderingContext.h
index f507054..c4c856c 100644
--- a/WebCore/html/canvas/WebGLRenderingContext.h
+++ b/WebCore/html/canvas/WebGLRenderingContext.h
@@ -291,7 +291,7 @@ public:
   private:
     friend class WebGLObject;
 
-    WebGLRenderingContext(HTMLCanvasElement*, PassOwnPtr<GraphicsContext3D>);
+    WebGLRenderingContext(HTMLCanvasElement*, PassRefPtr<GraphicsContext3D>);
 
     void addObject(WebGLObject*);
     void detachAndRemoveAllObjects();
@@ -329,7 +329,7 @@ public:
 
     PassRefPtr<Image> videoFrameToImage(HTMLVideoElement* video);
 
-    OwnPtr<GraphicsContext3D> m_context;
+    RefPtr<GraphicsContext3D> m_context;
     bool m_needsUpdate;
     bool m_markedCanvasDirty;
     // FIXME: I think this is broken -- it does not increment any
diff --git a/WebCore/html/parser/CSSPreloadScanner.cpp b/WebCore/html/parser/CSSPreloadScanner.cpp
index 6ac923d..23364f9 100644
--- a/WebCore/html/parser/CSSPreloadScanner.cpp
+++ b/WebCore/html/parser/CSSPreloadScanner.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2008, 2010 Apple Inc. All Rights Reserved.
  * Copyright (C) 2009 Torch Mobile, Inc. http://www.torchmobile.com/
  * Copyright (C) 2010 Google Inc. All Rights Reserved.
  *
@@ -28,23 +28,18 @@
 #include "config.h"
 #include "CSSPreloadScanner.h"
 
-#include "CSSHelper.h"
 #include "CachedCSSStyleSheet.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
+#include "HTMLParserIdioms.h"
 #include "HTMLToken.h"
 
 namespace WebCore {
 
-static inline bool isWhitespace(UChar c)
-{
-    return c == ' ' || c == '\n' || c == '\r' || c == '\t';
-}
-
 CSSPreloadScanner::CSSPreloadScanner(Document* document)
-    : m_document(document)
+    : m_state(Initial)
+    , m_document(document)
 {
-    reset();
 }
 
 void CSSPreloadScanner::reset()
@@ -59,10 +54,8 @@ void CSSPreloadScanner::scan(const HTMLToken& token, bool scanningBody)
     m_scanningBody = scanningBody;
 
     const HTMLToken::DataVector& characters = token.characters();
-    for (HTMLToken::DataVector::const_iterator iter = characters.begin();
-         iter != characters.end(); ++iter) {
+    for (HTMLToken::DataVector::const_iterator iter = characters.begin(); iter != characters.end(); ++iter)
         tokenize(*iter);
-    }
 }
 
 inline void CSSPreloadScanner::tokenize(UChar c)
@@ -104,7 +97,7 @@ inline void CSSPreloadScanner::tokenize(UChar c)
             m_state = Initial;
         break;
     case Rule:
-        if (isWhitespace(c))
+        if (isHTMLSpace(c))
             m_state = AfterRule;
         else if (c == ';')
             m_state = Initial;
@@ -112,7 +105,7 @@ inline void CSSPreloadScanner::tokenize(UChar c)
             m_rule.append(c);
         break;
     case AfterRule:
-        if (isWhitespace(c))
+        if (isHTMLSpace(c))
             ;
         else if (c == ';')
             m_state = Initial;
@@ -122,7 +115,7 @@ inline void CSSPreloadScanner::tokenize(UChar c)
         }
         break;
     case RuleValue:
-        if (isWhitespace(c))
+        if (isHTMLSpace(c))
             m_state = AfterRuleValue;
         else if (c == ';') {
             emitRule();
@@ -131,7 +124,7 @@ inline void CSSPreloadScanner::tokenize(UChar c)
             m_ruleValue.append(c);
         break;
     case AfterRuleValue:
-        if (isWhitespace(c))
+        if (isHTMLSpace(c))
             ;
         else if (c == ';') {
             emitRule();
@@ -144,14 +137,56 @@ inline void CSSPreloadScanner::tokenize(UChar c)
     }
 }
 
+static String parseCSSStringOrURL(const UChar* characters, size_t length)
+{
+    size_t offset = 0;
+    size_t reducedLength = length;
+
+    while (reducedLength && isHTMLSpace(characters[offset])) {
+        ++offset;
+        --reducedLength;
+    }
+    while (reducedLength && isHTMLSpace(characters[offset + reducedLength - 1]))
+        --reducedLength;
+
+    if (reducedLength >= 5
+            && (characters[offset] == 'u' || characters[offset] == 'U')
+            && (characters[offset + 1] == 'r' || characters[offset + 1] == 'R')
+            && (characters[offset + 2] == 'l' || characters[offset + 2] == 'L')
+            && characters[offset + 3] == '('
+            && characters[offset + reducedLength - 1] == ')') {
+        offset += 4;
+        reducedLength -= 5;
+    }
+
+    while (reducedLength && isHTMLSpace(characters[offset])) {
+        ++offset;
+        --reducedLength;
+    }
+    while (reducedLength && isHTMLSpace(characters[offset + reducedLength - 1]))
+        --reducedLength;
+
+    if (reducedLength < 2 || characters[offset] != characters[offset + reducedLength - 1] || !(characters[offset] == '\'' || characters[offset] == '"'))
+        return String();
+    offset++;
+    reducedLength -= 2;
+
+    while (reducedLength && isHTMLSpace(characters[offset])) {
+        ++offset;
+        --reducedLength;
+    }
+    while (reducedLength && isHTMLSpace(characters[offset + reducedLength - 1]))
+        --reducedLength;
+
+    return String(characters + offset, reducedLength);
+}
+
 void CSSPreloadScanner::emitRule()
 {
-    String rule(m_rule.data(), m_rule.size());
-    if (equalIgnoringCase(rule, "import") && !m_ruleValue.isEmpty()) {
-        String value(m_ruleValue.data(), m_ruleValue.size());
-        String url = deprecatedParseURL(value);
-        if (!url.isEmpty())
-            m_document->cachedResourceLoader()->preload(CachedResource::CSSStyleSheet, url, String(), m_scanningBody);
+    if (equalIgnoringCase("import", m_rule.data(), m_rule.size())) {
+        String value = parseCSSStringOrURL(m_ruleValue.data(), m_ruleValue.size());
+        if (!value.isEmpty())
+            m_document->cachedResourceLoader()->preload(CachedResource::CSSStyleSheet, value, String(), m_scanningBody);
     }
     m_rule.clear();
     m_ruleValue.clear();
diff --git a/WebCore/html/parser/HTMLConstructionSite.cpp b/WebCore/html/parser/HTMLConstructionSite.cpp
index 6215bba..7201ac7 100644
--- a/WebCore/html/parser/HTMLConstructionSite.cpp
+++ b/WebCore/html/parser/HTMLConstructionSite.cpp
@@ -168,9 +168,12 @@ void HTMLConstructionSite::dispatchDocumentElementAvailableIfNeeded()
 
 void HTMLConstructionSite::insertHTMLHtmlStartTagBeforeHTML(AtomicHTMLToken& token)
 {
-    RefPtr<Element> element = HTMLHtmlElement::create(m_document);
+    RefPtr<HTMLHtmlElement> element = HTMLHtmlElement::create(m_document);
     element->setAttributeMap(token.takeAtributes(), m_fragmentScriptingPermission);
-    m_openElements.pushHTMLHtmlElement(attach(m_document, element.release()));
+    m_openElements.pushHTMLHtmlElement(attach<Element>(m_document, element.get()));
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    element->insertedByParser();
+#endif
     dispatchDocumentElementAvailableIfNeeded();
 }
 
@@ -234,13 +237,6 @@ PassRefPtr<Element> HTMLConstructionSite::attachToCurrent(PassRefPtr<Element> ch
     return attach(currentElement(), child);
 }
 
-void HTMLConstructionSite::insertHTMLHtmlElement(AtomicHTMLToken& token)
-{
-    ASSERT(!shouldFosterParent());
-    m_openElements.pushHTMLHtmlElement(attachToCurrent(createHTMLElement(token)));
-    dispatchDocumentElementAvailableIfNeeded();
-}
-
 void HTMLConstructionSite::insertHTMLHeadElement(AtomicHTMLToken& token)
 {
     ASSERT(!shouldFosterParent());
diff --git a/WebCore/html/parser/HTMLConstructionSite.h b/WebCore/html/parser/HTMLConstructionSite.h
index 6bed6a7..8b09bf5 100644
--- a/WebCore/html/parser/HTMLConstructionSite.h
+++ b/WebCore/html/parser/HTMLConstructionSite.h
@@ -54,7 +54,6 @@ public:
     void insertHTMLElement(AtomicHTMLToken&);
     void insertSelfClosingHTMLElement(AtomicHTMLToken&);
     void insertFormattingElement(AtomicHTMLToken&);
-    void insertHTMLHtmlElement(AtomicHTMLToken&);
     void insertHTMLHeadElement(AtomicHTMLToken&);
     void insertHTMLBodyElement(AtomicHTMLToken&);
     void insertHTMLFormElement(AtomicHTMLToken&, bool isDemoted = false);
diff --git a/WebCore/html/parser/HTMLDocumentParser.cpp b/WebCore/html/parser/HTMLDocumentParser.cpp
index dc19c96..743e5d5 100644
--- a/WebCore/html/parser/HTMLDocumentParser.cpp
+++ b/WebCore/html/parser/HTMLDocumentParser.cpp
@@ -36,11 +36,13 @@
 #include "HTMLScriptRunner.h"
 #include "HTMLTreeBuilder.h"
 #include "HTMLDocument.h"
+#include "InspectorInstrumentation.h"
 #include "NestingLevelIncrementer.h"
 #include "Settings.h"
 #include "XSSAuditor.h"
 #include <wtf/CurrentTime.h>
 
+<<<<<<< HEAD
 #ifdef ANDROID_INSTRUMENT
 #include "TimeCounter.h"
 #endif
@@ -49,6 +51,8 @@
 #include "InspectorTimelineAgent.h"
 #endif
 
+=======
+>>>>>>> webkit.org at r70209
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -214,9 +218,12 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
     // ASSERT that this object is both attached to the Document and protected.
     ASSERT(refCount() >= 2);
 
-    // We tell the InspectorTimelineAgent about every pump, even if we
+    // We tell the InspectorInstrumentation about every pump, even if we
     // end up pumping nothing.  It can filter out empty pumps itself.
-    willPumpLexer();
+    // FIXME: m_input.current().length() is only accurate if we
+    // end up parsing the whole buffer in this pump.  We should pass how
+    // much we parsed as part of didWriteHTML instead of willWriteHTML.
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willWriteHTML(document(), m_input.current().length(), m_tokenizer->lineNumber());
 
     HTMLParserScheduler::PumpSession session;
     // FIXME: This loop body has is now too long and needs cleanup.
@@ -260,26 +267,7 @@ void HTMLDocumentParser::pumpTokenizer(SynchronousMode mode)
         m_preloadScanner->scan();
     }
 
-    didPumpLexer();
-}
-
-void HTMLDocumentParser::willPumpLexer()
-{
-#if ENABLE(INSPECTOR)
-    // FIXME: m_input.current().length() is only accurate if we
-    // end up parsing the whole buffer in this pump.  We should pass how
-    // much we parsed as part of didWriteHTML instead of willWriteHTML.
-    if (InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent())
-        timelineAgent->willWriteHTML(m_input.current().length(), m_tokenizer->lineNumber());
-#endif
-}
-
-void HTMLDocumentParser::didPumpLexer()
-{
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = document()->inspectorTimelineAgent())
-        timelineAgent->didWriteHTML(m_tokenizer->lineNumber());
-#endif
+    InspectorInstrumentation::didWriteHTML(cookie, m_tokenizer->lineNumber());
 }
 
 bool HTMLDocumentParser::hasInsertionPoint()
diff --git a/WebCore/html/parser/HTMLDocumentParser.h b/WebCore/html/parser/HTMLDocumentParser.h
index e65a582..d9625f1 100644
--- a/WebCore/html/parser/HTMLDocumentParser.h
+++ b/WebCore/html/parser/HTMLDocumentParser.h
@@ -103,9 +103,6 @@ private:
     // CachedResourceClient
     virtual void notifyFinished(CachedResource*);
 
-    void willPumpLexer();
-    void didPumpLexer();
-
     enum SynchronousMode {
         AllowYield,
         ForceSynchronous,
diff --git a/WebCore/html/parser/HTMLElementStack.cpp b/WebCore/html/parser/HTMLElementStack.cpp
index 123778d..6b96291 100644
--- a/WebCore/html/parser/HTMLElementStack.cpp
+++ b/WebCore/html/parser/HTMLElementStack.cpp
@@ -113,6 +113,12 @@ inline bool isButtonScopeMarker(Element* element)
         || element->hasTagName(buttonTag);
 }
 
+inline bool isSelectScopeMarker(Element* element)
+{
+    return !element->hasTagName(optgroupTag)
+        && !element->hasTagName(optionTag);
+}
+
 }
 
 HTMLElementStack::ElementRecord::ElementRecord(PassRefPtr<Element> element, PassOwnPtr<ElementRecord> next)
@@ -486,6 +492,17 @@ bool HTMLElementStack::inButtonScope(const QualifiedName& tagName) const
     return inButtonScope(tagName.localName());
 }
 
+bool HTMLElementStack::inSelectScope(const AtomicString& targetTag) const
+{
+    return inScopeCommon<isSelectScopeMarker>(m_top.get(), targetTag);
+}
+
+bool HTMLElementStack::inSelectScope(const QualifiedName& tagName) const
+{
+    // FIXME: Is localName() right for non-html elements?
+    return inSelectScope(tagName.localName());
+}
+
 Element* HTMLElementStack::htmlElement() const
 {
     ASSERT(m_htmlElement);
diff --git a/WebCore/html/parser/HTMLElementStack.h b/WebCore/html/parser/HTMLElementStack.h
index 47fa603..8a8e160 100644
--- a/WebCore/html/parser/HTMLElementStack.h
+++ b/WebCore/html/parser/HTMLElementStack.h
@@ -117,6 +117,8 @@ public:
     bool inTableScope(const QualifiedName&) const;
     bool inButtonScope(const AtomicString& tagName) const;
     bool inButtonScope(const QualifiedName&) const;
+    bool inSelectScope(const AtomicString& tagName) const;
+    bool inSelectScope(const QualifiedName&) const;
 
     bool hasOnlyHTMLElementsInScope() const;
     bool hasNumberedHeaderElementInScope() const;
diff --git a/WebCore/html/parser/HTMLParserIdioms.cpp b/WebCore/html/parser/HTMLParserIdioms.cpp
index a558cf5..f093eb2 100644
--- a/WebCore/html/parser/HTMLParserIdioms.cpp
+++ b/WebCore/html/parser/HTMLParserIdioms.cpp
@@ -43,7 +43,7 @@ String stripLeadingAndTrailingHTMLSpaces(const String& string)
     }
 
     if (numLeadingSpaces == length)
-        return emptyAtom;
+        return string.isNull() ? string : emptyAtom.string();
 
     unsigned numTrailingSpaces;
     for (numTrailingSpaces = 0; numTrailingSpaces < length; ++numTrailingSpaces) {
@@ -53,7 +53,7 @@ String stripLeadingAndTrailingHTMLSpaces(const String& string)
 
     ASSERT(numLeadingSpaces + numTrailingSpaces < length);
 
-    return string.substring(numLeadingSpaces, length - numTrailingSpaces);
+    return string.substring(numLeadingSpaces, length - (numLeadingSpaces + numTrailingSpaces));
 }
 
 String serializeForNumberType(double number)
diff --git a/WebCore/html/parser/HTMLParserIdioms.h b/WebCore/html/parser/HTMLParserIdioms.h
index f4704f7..4839138 100644
--- a/WebCore/html/parser/HTMLParserIdioms.h
+++ b/WebCore/html/parser/HTMLParserIdioms.h
@@ -52,8 +52,17 @@ bool parseHTMLInteger(const String&, int&);
 
 inline bool isHTMLSpace(UChar character)
 {
-    // FIXME: Consider branch permutations as we did in isASCIISpace.
-    return character == '\t' || character == '\x0A' || character == '\x0C' || character == '\x0D' || character == ' ';
+    // Histogram from Apple's page load test combined with some ad hoc browsing some other test suites.
+    //
+    //     82%: 216330 non-space characters, all > U+0020
+    //     11%:  30017 plain space characters, U+0020
+    //      5%:  12099 newline characters, U+000A
+    //      2%:   5346 tab characters, U+0009
+    //
+    // No other characters seen. No U+000C or U+000D, and no other control characters.
+    // Accordingly, we check for non-spaces first, then space, then newline, then tab, then the other characters.
+
+    return character <= ' ' && (character == ' ' || character == '\n' || character == '\t' || character == '\r' || character == '\f');
 }
 
 inline bool isNotHTMLSpace(UChar character)
diff --git a/WebCore/html/parser/HTMLPreloadScanner.cpp b/WebCore/html/parser/HTMLPreloadScanner.cpp
index 7859dd8..5c86579 100644
--- a/WebCore/html/parser/HTMLPreloadScanner.cpp
+++ b/WebCore/html/parser/HTMLPreloadScanner.cpp
@@ -28,13 +28,13 @@
 #include "config.h"
 #include "HTMLPreloadScanner.h"
 
-#include "CSSHelper.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
 #include "HTMLDocumentParser.h"
 #include "HTMLTokenizer.h"
 #include "HTMLLinkElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 
 namespace WebCore {
 
@@ -90,7 +90,7 @@ public:
         // http://www.whatwg.org/specs/web-apps/current-work/multipage/tokenization.html#attribute-name-state
         if (!m_urlToLoad.isEmpty())
             return;
-        m_urlToLoad = deprecatedParseURL(attributeValue);
+        m_urlToLoad = stripLeadingAndTrailingHTMLSpaces(attributeValue);
     }
 
     void preload(Document* document, bool scanningBody)
diff --git a/WebCore/html/parser/HTMLTreeBuilder.cpp b/WebCore/html/parser/HTMLTreeBuilder.cpp
index 355dc8d..5f90285 100644
--- a/WebCore/html/parser/HTMLTreeBuilder.cpp
+++ b/WebCore/html/parser/HTMLTreeBuilder.cpp
@@ -1422,7 +1422,7 @@ void HTMLTreeBuilder::processStartTag(AtomicHTMLToken& token)
             || token.name() == keygenTag
             || token.name() == textareaTag) {
             parseError(token);
-            if (!m_tree.openElements()->inTableScope(selectTag)) {
+            if (!m_tree.openElements()->inSelectScope(selectTag)) {
                 ASSERT(isParsingFragment());
                 return;
             }
@@ -1849,7 +1849,7 @@ void HTMLTreeBuilder::processEndTagForInCell(AtomicHTMLToken& token)
         || token.name() == trTag
         || isTableBodyContextTag(token.name())) {
         if (!m_tree.openElements()->inTableScope(token.name())) {
-            ASSERT(isParsingFragment());
+            ASSERT(isTableBodyContextTag(token.name()) || isParsingFragment());
             parseError(token);
             return;
         }
@@ -2279,7 +2279,7 @@ void HTMLTreeBuilder::processEndTag(AtomicHTMLToken& token)
             return;
         }
         if (token.name() == selectTag) {
-            if (!m_tree.openElements()->inTableScope(token.name())) {
+            if (!m_tree.openElements()->inSelectScope(token.name())) {
                 ASSERT(isParsingFragment());
                 parseError(token);
                 return;
diff --git a/WebCore/inspector/CodeGeneratorInspector.pm b/WebCore/inspector/CodeGeneratorInspector.pm
index 80e243b..a566576 100644
--- a/WebCore/inspector/CodeGeneratorInspector.pm
+++ b/WebCore/inspector/CodeGeneratorInspector.pm
@@ -28,6 +28,11 @@ $typeTransform{"Debug"} = {
     "header" => "InspectorDebuggerAgent.h",
     "domainAccessor" => "m_inspectorController->debuggerAgent()",
 };
+$typeTransform{"Resource"} = {
+    "forward" => "InspectorResourceAgent",
+    "header" => "InspectorResourceAgent.h",
+    "domainAccessor" => "m_inspectorController->m_resourceAgent",
+};
 $typeTransform{"DOM"} = {
     "forward" => "InspectorDOMAgent",
     "header" => "InspectorDOMAgent.h",
@@ -114,6 +119,14 @@ $typeTransform{"unsigned int"} = {
     "header" => "",
     "JSONType" => "Number"
 };
+$typeTransform{"double"} = {
+    "param" => "double",
+    "variable" => "double",
+    "defaultValue" => "0.0",
+    "forward" => "",
+    "header" => "",
+    "JSONType" => "Number"
+};
 $typeTransform{"boolean"} = {
     "param" => "bool",
     "variable"=> "bool",
@@ -306,7 +319,7 @@ sub generateBackendFunction
     my $domainAccessor = $typeTransform{$domain}->{"domainAccessor"};
     $backendTypes{$domain} = 1;
     push(@function, "    if (!$domainAccessor)");
-    push(@function, "        protocolErrors->pushString(String::format(\"Protocol Error: %s handler is not available.\", \"$domain\"));");
+    push(@function, "        protocolErrors->pushString(\"Protocol Error: $domain handler is not available.\");");
     push(@function, "");
 
     if (scalar(@inArgs)) {
@@ -316,7 +329,7 @@ sub generateBackendFunction
         push(@function, "");
         push(@function, "    RefPtr<InspectorObject> argumentsContainer;");
         push(@function, "    if (!(argumentsContainer = requestMessageObject->getObject(\"arguments\"))) {");
-        push(@function, "        protocolErrors->pushString(String::format(\"Protocol Error: 'arguments' property with type 'object' was not found.\"));");
+        push(@function, "        protocolErrors->pushString(\"Protocol Error: 'arguments' property with type 'object' was not found.\");");
         push(@function, "    } else {");
         push(@function, "        InspectorObject::const_iterator argumentsEndIterator = argumentsContainer->end();");
 
@@ -329,10 +342,10 @@ sub generateBackendFunction
             push(@function, "");
             push(@function, "        InspectorObject::const_iterator ${name}ValueIterator = argumentsContainer->find(\"$name\");");
             push(@function, "        if (${name}ValueIterator == argumentsEndIterator) {");
-            push(@function, "            protocolErrors->pushString(String::format(\"Protocol Error: Argument '%s' with type '%s' was not found.\", \"$name\", \"$JSONType\"));");
+            push(@function, "            protocolErrors->pushString(\"Protocol Error: Argument '$name' with type '$JSONType' was not found.\");");
             push(@function, "        } else {");
             push(@function, "            if (!${name}ValueIterator->second->as$JSONType(&$name)) {");
-            push(@function, "                protocolErrors->pushString(String::format(\"Protocol Error: Argument '%s' has wrong type. It should be '%s'.\", \"$name\", \"$JSONType\"));");
+            push(@function, "                protocolErrors->pushString(\"Protocol Error: Argument '$name' has wrong type. It should be '$JSONType'.\");");
             push(@function, "            }");
             push(@function, "        }");
         }
@@ -446,7 +459,7 @@ $mapEntries
 
     HashMap<String, CallHandler>::iterator it = dispatchMap.find(command);
     if (it == dispatchMap.end()) {
-        reportProtocolError(callId, String::format("Protocol Error: Invalid command was received. '%s' wasn't found.", command.utf8().data()));
+        reportProtocolError(callId, makeString("Protocol Error: Invalid command was received. '", command, "' wasn't found."));
         return;
     }
 
@@ -606,7 +619,7 @@ sub generateSource
     my @sourceContent = split("\r", $licenseTemplate);
     push(@sourceContent, "\n#include \"config.h\"");
     push(@sourceContent, "#include \"$className.h\"");
-    push(@sourceContent, "#include <wtf/text/CString.h>");
+    push(@sourceContent, "#include <wtf/text/StringConcatenate.h>");
     push(@sourceContent, "");
     push(@sourceContent, "#if ENABLE(INSPECTOR)");
     push(@sourceContent, "");
diff --git a/WebCore/inspector/ConsoleMessage.cpp b/WebCore/inspector/ConsoleMessage.cpp
index f3bd6bc..67930cd 100644
--- a/WebCore/inspector/ConsoleMessage.cpp
+++ b/WebCore/inspector/ConsoleMessage.cpp
@@ -67,7 +67,7 @@ PassRefPtr<InspectorObject> ConsoleMessage::CallFrame::buildInspectorObject() co
 {
     RefPtr<InspectorObject> frame = InspectorObject::create();
     frame->setString("functionName", m_functionName);
-    frame->setString("sourceURL", m_sourceURL.string());
+    frame->setString("sourceURL", m_sourceURL);
     frame->setNumber("lineNumber", m_lineNumber);
     return frame;
 }
@@ -100,7 +100,7 @@ ConsoleMessage::ConsoleMessage(MessageSource s, MessageType t, MessageLevel l, c
 {
     const ScriptCallFrame& lastCaller = callStack->at(0);
     m_line = lastCaller.lineNumber();
-    m_url = lastCaller.sourceURL().string();
+    m_url = lastCaller.sourceURL();
 
     if (storeTrace) {
         for (unsigned i = 0; i < callStack->size(); ++i)
@@ -155,22 +155,20 @@ void ConsoleMessage::updateRepeatCountInConsole(InspectorFrontend* frontend)
 }
 #endif // ENABLE(INSPECTOR)
 
-bool ConsoleMessage::isEqual(ScriptState* state, ConsoleMessage* msg) const
+bool ConsoleMessage::isEqual(ConsoleMessage* msg) const
 {
 #if ENABLE(INSPECTOR)
     if (msg->m_arguments.size() != m_arguments.size())
         return false;
-    if (!state && msg->m_arguments.size())
+    if (!msg->m_scriptState.get() && msg->m_arguments.size()) {
+        ASSERT_NOT_REACHED();
         return false;
+    }
 
-    ASSERT_ARG(state, state || msg->m_arguments.isEmpty());
-
-    for (size_t i = 0; i < msg->m_arguments.size(); ++i) {
-        if (!m_arguments[i].isEqual(state, msg->m_arguments[i]))
+    for (size_t i = 0; i < m_arguments.size(); ++i) {
+        if (!m_arguments[i].isEqual(msg->m_scriptState.get(), msg->m_arguments[i]))
             return false;
     }
-#else
-    UNUSED_PARAM(state);
 #endif // ENABLE(INSPECTOR)
 
     size_t frameCount = msg->m_frames.size();
diff --git a/WebCore/inspector/ConsoleMessage.h b/WebCore/inspector/ConsoleMessage.h
index d10fa3d..6c3f2c7 100644
--- a/WebCore/inspector/ConsoleMessage.h
+++ b/WebCore/inspector/ConsoleMessage.h
@@ -55,7 +55,7 @@ public:
     void updateRepeatCountInConsole(InspectorFrontend* frontend);
 #endif
     void incrementCount() { ++m_repeatCount; }
-    bool isEqual(ScriptState*, ConsoleMessage* msg) const;
+    bool isEqual(ConsoleMessage* msg) const;
 
     MessageSource source() const { return m_source; }
     const String& message() const { return m_message; }
@@ -72,7 +72,7 @@ private:
 
     private:
         String m_functionName;
-        KURL m_sourceURL;
+        String m_sourceURL;
         unsigned m_lineNumber;
     };
 
diff --git a/WebCore/inspector/Inspector.idl b/WebCore/inspector/Inspector.idl
index a08a622..85c30a8 100644
--- a/WebCore/inspector/Inspector.idl
+++ b/WebCore/inspector/Inspector.idl
@@ -32,7 +32,6 @@
 
 module core {
     interface [Conditional=INSPECTOR] Inspector {
-        [notify] void addConsoleMessage(out Object messageObj);
         [notify] void addRecordToTimeline(out Object record);
         [notify] void addNodesToSearchResult(out Array nodeIds);
         [notify] void attributesUpdated(out long id, out Array attributes);
@@ -41,11 +40,12 @@ module core {
         [notify] void childNodeCountUpdated(out long id, out int newValue);
         [notify] void childNodeInserted(out long parentId, out long prevId, out Object node);
         [notify] void childNodeRemoved(out long parentId, out long id);
-        [notify] void consoleMessagesCleared();
         [notify] void didCommitLoad();
         [notify] void evaluateForTestInFrontend(out long testCallId, out String script);
         [notify] void disconnectFromBackend();
+        [notify] void domContentEventFired(out double time);
         [notify] void inspectedURLChanged(out String url);
+        [notify] void loadEventFired(out double time);
         [notify] void removeResource(out unsigned long identifier);
         [notify] void reset();
         [notify] void resetProfilesPanel();
@@ -55,8 +55,6 @@ module core {
         [notify] void showPanel(out String panel);
         [notify] void timelineProfilerWasStarted();
         [notify] void timelineProfilerWasStopped();
-        [notify] void updateConsoleMessageExpiredCount(out unsigned long count);
-        [notify] void updateConsoleMessageRepeatCount(out unsigned long count);
         [notify] void updateFocusedNode(out long nodeId);
         [notify] void updateResource(out Value resource);
 
@@ -108,12 +106,31 @@ module core {
         [handler=Controller] void setMonitoringXHREnabled(in boolean enable, out boolean newState);
 
         [handler=Controller] void setResourceTrackingEnabled(in boolean enabled, in boolean always, out boolean newState);
-        [handler=Controller] void getResourceContent(in unsigned long identifier, out String content);
+        [handler=Controller] void getResourceContent(in unsigned long identifier, in boolean encode, out String content);
         [handler=Controller] void reloadPage();
 
         [handler=Controller] void startTimelineProfiler();
         [handler=Controller] void stopTimelineProfiler();
 
+        [handler=Resource] void cachedResources(out Array resources);
+        [handler=Resource] void resourceContent(in unsigned long frameID, in String url, out String content);
+        [notify] void identifierForInitialRequest(out long identifier, out String url, out unsigned long frameID, out boolean isMainResource);
+        [notify] void willSendRequest(out long identifier, out double time, out Object request, out Object redirectResponse);
+        [notify] void markResourceAsCached(out long identifier);
+        [notify] void didReceiveResponse(out long identifier, out double time, out String resourceType, out Object response);
+        [notify] void didReceiveContentLength(out long identifier, out double time, out long lengthReceived);
+        [notify] void didFinishLoading(out long identifier, out double finishTime);
+        [notify] void didFailLoading(out long identifier, out double time, out String localizedDescription);
+        [notify] void didLoadResourceFromMemoryCache(out double time, out unsigned long frameID, out Object resource);
+        [notify] void setOverrideContent(out long identifier, out String sourceString, out String type);
+        [notify] void didCommitLoad(out unsigned long frameID);
+        [notify] void frameDetachedFromParent(out unsigned long frameID);
+
+        [notify] void didCreateWebSocket(out unsigned long identifier, out String requestURL);
+        [notify] void willSendWebSocketHandshakeRequest(out unsigned long identifier, out double time, out Object request);
+        [notify] void didReceiveWebSocketHandshakeResponse(out unsigned long identifier, out double time, out Object response);
+        [notify] void didCloseWebSocket(out unsigned long identifier, out double time);
+
 #if defined(ENABLE_JAVASCRIPT_DEBUGGER) && ENABLE_JAVASCRIPT_DEBUGGER
         [handler=Backend] void enableDebugger(in boolean always);
         [handler=Controller] void disableDebugger(in boolean always);
@@ -135,8 +152,8 @@ module core {
         [handler=Debug] void editScriptSource(in String sourceID, in String newContent, out boolean success, out String result, out Value newCallFrames);
         [handler=Debug] void getScriptSource(in String sourceID, out String scriptSource);
 
-        [handler=Controller] void setNativeBreakpoint(in Object breakpoint, out unsigned int breakpointId);
-        [handler=Controller] void removeNativeBreakpoint(in unsigned int breakpointId);
+        [handler=Controller] void setNativeBreakpoint(in Object breakpoint, out String breakpointId);
+        [handler=Controller] void removeNativeBreakpoint(in String breakpointId);
 
         [handler=Controller] void enableProfiler(in boolean always);
         [handler=Controller] void disableProfiler(in boolean always);
@@ -171,10 +188,15 @@ module core {
         [handler=DOM] void performSearch(in String query, in boolean runSynchronously);
         [handler=DOM] void searchCanceled();
         [handler=DOM] void pushNodeByPathToFrontend(in String path, out long nodeId);
-        [handler=DOM] void setDOMBreakpoint(in long nodeId, in long type);
-        [handler=DOM] void removeDOMBreakpoint(in long nodeId, in long type);
+
+        [handler=Controller] void setConsoleMessagesEnabled(in boolean enabled, out boolean newState);
+        [notify] void addConsoleMessage(out Object messageObj);
+        [notify] void updateConsoleMessageExpiredCount(out unsigned long count);
+        [notify] void updateConsoleMessageRepeatCount(out unsigned long count);
 
         [handler=Controller] void clearConsoleMessages();
+        [notify] void consoleMessagesCleared();
+
         [handler=Controller] void highlightDOMNode(in long nodeId);
         [handler=Controller] void hideDOMNodeHighlight();
         [handler=Controller] void openInInspectedWindow(in String url);
@@ -185,7 +207,7 @@ module core {
         [handler=DOM] void getComputedStyle(in long nodeId, out Value style);
         [handler=DOM] void getStyleSheet(in long styleSheetId, out Object styleSheet);
         [handler=DOM] void getStyleSourceData(in long styleSheetId, out Object styleSourceData);
-        [handler=DOM] void applyStyleText(in long styleId, in String styleText, in String propertyName, out boolean success, out Value style, out Array changedProperties);
+        [handler=DOM] void applyStyleText(in long styleId, in String styleText, in String propertyName, out boolean success, out Value style);
         [handler=DOM] void setStyleText(in long styleId, in String styleText, out boolean success);
         [handler=DOM] void setStyleProperty(in long styleId, in String name, in String value, out boolean success);
         [handler=DOM] void toggleStyleEnabled(in long styleId, in String propertyName, in boolean disabled, out Value style);
diff --git a/WebCore/inspector/InspectorApplicationCacheAgent.cpp b/WebCore/inspector/InspectorApplicationCacheAgent.cpp
index 918643b..ced61c5 100644
--- a/WebCore/inspector/InspectorApplicationCacheAgent.cpp
+++ b/WebCore/inspector/InspectorApplicationCacheAgent.cpp
@@ -48,7 +48,7 @@ InspectorApplicationCacheAgent::InspectorApplicationCacheAgent(InspectorControll
 
 void InspectorApplicationCacheAgent::didReceiveManifestResponse(unsigned long identifier, const ResourceResponse& response)
 {
-    m_inspectorController->didReceiveResponse(identifier, response);
+    m_inspectorController->didReceiveResponse(identifier, 0, response);
 }
 
 void InspectorApplicationCacheAgent::updateApplicationCacheStatus(ApplicationCacheHost::Status status)
diff --git a/WebCore/inspector/InspectorCSSAgent.cpp b/WebCore/inspector/InspectorCSSAgent.cpp
new file mode 100644
index 0000000..e0fab85
--- /dev/null
+++ b/WebCore/inspector/InspectorCSSAgent.cpp
@@ -0,0 +1,649 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorCSSAgent.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "CSSComputedStyleDeclaration.h"
+#include "CSSMutableStyleDeclaration.h"
+#include "CSSPropertyNames.h"
+#include "CSSPropertySourceData.h"
+#include "CSSRule.h"
+#include "CSSRuleList.h"
+#include "CSSStyleRule.h"
+#include "CSSStyleSelector.h"
+#include "CSSStyleSheet.h"
+#include "DOMWindow.h"
+#include "HTMLHeadElement.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorFrontend.h"
+#include "InspectorValues.h"
+#include "Node.h"
+#include "StyleSheetList.h"
+
+#include <wtf/HashSet.h>
+#include <wtf/ListHashSet.h>
+#include <wtf/Vector.h>
+#include <wtf/text/CString.h>
+
+
+// cssProperty = {
+//    name          : <string>,
+//    value         : <string>,
+//    priority      : <string>, // "" for non-parsedOk properties
+//    implicit      : <boolean>,
+//    parsedOk      : <boolean>, // whether property is understood by WebCore
+//    status        : <string>, // "disabled" | "active" | "inactive" | "style"
+//    shorthandName : <string>,
+//    startOffset   : <number>, // Optional - property text start offset in enclosing style declaration. Absent for computed styles and such.
+//    endOffset     : <number>, // Optional - property text end offset in enclosing style declaration. Absent for computed styles and such.
+// }
+//
+// status:
+// "disabled" == property disabled by user
+// "active" == property participates in the computed style calculation
+// "inactive" == property does no participate in the computed style calculation (i.e. overridden by a subsequent property with the same name)
+// "style" == property is active and originates from the WebCore CSSStyleDeclaration rather than CSS source code (e.g. implicit longhand properties)
+//
+//
+// cssStyle = {
+//    styleId         : <number>, // Optional
+//    styleSheetId    : <number>, // Parent: -1 for inline styles (<foo style="..">)
+//    cssProperties   : [
+//                          #cssProperty,
+//                          ...
+//                          #cssProperty
+//                    ],
+//    shorthandValues : {
+//                          shorthandName1 : shorthandValue1,
+//                          shorthandName2 : shorthandValue2
+//                      },
+//    cssText         : <string>, // declaration text
+//    properties      : { } // ???
+// }
+//
+// // TODO:
+// // - convert disabledProperties to enabled flag.
+// // - convert width, height to properties
+//
+// cssRule = {
+//    ruleId       : <number>,
+//    selectorText : <string>
+//    sourceURL    : <string>
+//    sourceLine   : <string>
+//    styleSheetId : <number> // also found in style
+//    origin       : <string> // "" || "user-agent" || "user" || "inspector"
+//    style        : #cssStyle
+// }
+//
+// // TODO:
+// // - fix origin
+// // - add sourceURL
+// // - fix parentStyleSheetId
+//
+// cssStyleSheet = {
+//    styleSheetId   : <number>
+//    href           : <string>
+//    title          : <string>
+//    disabled       : <boolean>
+//    documentNodeId : <number>
+//    rules          : [
+//                         #cssRule,
+//                         ...
+//                         #cssRule
+//                     ]
+// }
+
+namespace WebCore {
+
+// static
+PassRefPtr<InspectorObject> InspectorCSSAgent::buildObjectForStyle(CSSStyleDeclaration* style, const String& fullStyleId, CSSStyleSourceData* sourceData)
+{
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    if (!fullStyleId.isEmpty())
+        result->setString("id", fullStyleId);
+
+    result->setString("width", style->getPropertyValue("width"));
+    result->setString("height", style->getPropertyValue("height"));
+    Vector<CSSPropertySourceData>* propertyData = 0;
+
+    if (sourceData) {
+        result->setNumber("startOffset", sourceData->styleBodyRange.start);
+        result->setNumber("endOffset", sourceData->styleBodyRange.end);
+        propertyData = &sourceData->propertyData;
+    }
+    populateObjectWithStyleProperties(style, result.get(), propertyData);
+
+    return result.release();
+}
+
+// static
+CSSStyleSheet* InspectorCSSAgent::parentStyleSheet(StyleBase* styleBase)
+{
+    if (!styleBase)
+        return 0;
+
+    StyleSheet* styleSheet = styleBase->stylesheet();
+    if (styleSheet && styleSheet->isCSSStyleSheet())
+        return static_cast<CSSStyleSheet*>(styleSheet);
+
+    return 0;
+}
+
+// static
+CSSStyleRule* InspectorCSSAgent::asCSSStyleRule(StyleBase* styleBase)
+{
+    if (!styleBase->isStyleRule())
+        return 0;
+    CSSRule* rule = static_cast<CSSRule*>(styleBase);
+    if (rule->type() != CSSRule::STYLE_RULE)
+        return 0;
+    return static_cast<CSSStyleRule*>(rule);
+}
+
+
+InspectorCSSAgent::InspectorCSSAgent(InspectorDOMAgent* domAgent, InspectorFrontend* frontend)
+    : m_domAgent(domAgent)
+    , m_frontend(frontend)
+    , m_lastStyleSheetId(1)
+    , m_lastRuleId(1)
+    , m_lastStyleId(1)
+{
+    m_domAgent->setDOMListener(this);
+}
+
+InspectorCSSAgent::~InspectorCSSAgent()
+{
+    reset();
+}
+
+void InspectorCSSAgent::reset()
+{
+    m_domAgent->setDOMListener(0);
+}
+
+void InspectorCSSAgent::getMatchedRulesForNode2(long nodeId, RefPtr<InspectorArray>* result)
+{
+    Element* element = elementForId(nodeId);
+    if (!element)
+        return;
+
+    CSSStyleSelector* selector = element->ownerDocument()->styleSelector();
+    RefPtr<CSSRuleList> matchedRules = selector->styleRulesForElement(element, false, true);
+    *result = buildArrayForRuleList(matchedRules.get());
+}
+
+void InspectorCSSAgent::getMatchedPseudoRulesForNode2(long nodeId, RefPtr<InspectorArray>* result)
+{
+    Element* element = elementForId(nodeId);
+    if (!element)
+        return;
+
+    CSSStyleSelector* selector = element->ownerDocument()->styleSelector();
+    for (PseudoId pseudoId = FIRST_PUBLIC_PSEUDOID; pseudoId < AFTER_LAST_INTERNAL_PSEUDOID; pseudoId = static_cast<PseudoId>(pseudoId + 1)) {
+        RefPtr<CSSRuleList> matchedRules = selector->pseudoStyleRulesForElement(element, pseudoId, false, true);
+        if (matchedRules && matchedRules->length()) {
+            RefPtr<InspectorObject> pseudoStyles = InspectorObject::create();
+            pseudoStyles->setNumber("pseudoId", static_cast<int>(pseudoId));
+            pseudoStyles->setArray("rules", buildArrayForRuleList(matchedRules.get()));
+            (*result)->pushObject(pseudoStyles.release());
+        }
+    }
+}
+
+void InspectorCSSAgent::getAttributeStylesForNode2(long nodeId, RefPtr<InspectorValue>* result)
+{
+    Element* element = elementForId(nodeId);
+    if (!element)
+        return;
+
+    *result = buildObjectForAttributeStyles(element);
+}
+
+void InspectorCSSAgent::getInlineStyleForNode2(long nodeId, RefPtr<InspectorValue>* style)
+{
+    Element* element = elementForId(nodeId);
+    if (!element)
+        return;
+
+    InspectorStyleSheetForInlineStyle* styleSheet = asInspectorStyleSheet(element);
+    if (!styleSheet)
+        return;
+
+    *style = styleSheet->buildObjectForStyle(element->style());
+}
+
+void InspectorCSSAgent::getComputedStyleForNode2(long nodeId, RefPtr<InspectorValue>* style)
+{
+    Element* element = elementForId(nodeId);
+    if (!element)
+        return;
+
+    DOMWindow* defaultView = element->ownerDocument()->defaultView();
+    if (!defaultView)
+        return;
+
+    *style = buildObjectForStyle(defaultView->getComputedStyle(element, "").get(), "");
+}
+
+void InspectorCSSAgent::getInheritedStylesForNode2(long nodeId, RefPtr<InspectorArray>* style)
+{
+    Element* element = elementForId(nodeId);
+    if (!element) {
+        *style = InspectorArray::create();
+        return;
+    }
+    RefPtr<InspectorArray> inheritedStyles = InspectorArray::create();
+    Element* parentElement = element->parentElement();
+    while (parentElement) {
+        RefPtr<InspectorObject> parentStyle = InspectorObject::create();
+        if (parentElement->style() && parentElement->style()->length()) {
+            InspectorStyleSheetForInlineStyle* styleSheet = asInspectorStyleSheet(element);
+            if (styleSheet)
+                parentStyle->setObject("inlineStyle", styleSheet->buildObjectForStyle(styleSheet->styleForId("0")));
+        }
+
+        CSSStyleSelector* parentSelector = parentElement->ownerDocument()->styleSelector();
+        RefPtr<CSSRuleList> parentMatchedRules = parentSelector->styleRulesForElement(parentElement, false, true);
+        parentStyle->setArray("matchedCSSRules", buildArrayForRuleList(parentMatchedRules.get()));
+        inheritedStyles->pushObject(parentStyle.release());
+        parentElement = parentElement->parentElement();
+    }
+    *style = inheritedStyles.release();
+}
+
+void InspectorCSSAgent::getAllStyles2(RefPtr<InspectorArray>* styles)
+{
+    const ListHashSet<RefPtr<Document> >& documents = m_domAgent->documents();
+    for (ListHashSet<RefPtr<Document> >::const_iterator it = documents.begin(); it != documents.end(); ++it) {
+        StyleSheetList* list = (*it)->styleSheets();
+        for (unsigned i = 0; i < list->length(); ++i) {
+            StyleSheet* styleSheet = list->item(i);
+            if (styleSheet->isCSSStyleSheet()) {
+                InspectorStyleSheet* inspectorStyleSheet = bindStyleSheet(static_cast<CSSStyleSheet*>(styleSheet));
+                (*styles)->pushString(inspectorStyleSheet->id());
+            }
+        }
+    }
+}
+
+void InspectorCSSAgent::getStyleSheet2(const String& styleSheetId, RefPtr<InspectorValue>* styleSheetObject)
+{
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    if (!inspectorStyleSheet)
+        return;
+
+    *styleSheetObject = inspectorStyleSheet->buildObjectForStyleSheet();
+}
+
+void InspectorCSSAgent::setStyleSheetText2(const String& styleSheetId, const String& text)
+{
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(styleSheetId);
+    if (!inspectorStyleSheet)
+        return;
+
+    inspectorStyleSheet->setText(text);
+}
+
+void InspectorCSSAgent::setStyleText2(const String& fullStyleId, const String& text, RefPtr<InspectorValue>* result)
+{
+    Vector<String> idParts;
+    fullStyleId.split(':', idParts);
+    ASSERT(idParts.size() == 2);
+
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(idParts.at(0));
+    if (!inspectorStyleSheet)
+        return;
+
+    if (!inspectorStyleSheet->setStyleText(idParts.at(1), text))
+        return;
+
+    *result = inspectorStyleSheet->buildObjectForStyle(inspectorStyleSheet->styleForId(idParts.at(1)));
+}
+
+void InspectorCSSAgent::toggleProperty2(const String&, long, bool)
+{
+    // FIXME(apavlov): implement
+}
+
+void InspectorCSSAgent::setRuleSelector2(const String& fullRuleId, const String& selector, RefPtr<InspectorValue>* result)
+{
+    Vector<String> idParts;
+    fullRuleId.split(':', idParts);
+    ASSERT(idParts.size() == 2);
+
+    InspectorStyleSheet* inspectorStyleSheet = styleSheetForId(idParts.at(0));
+    if (!inspectorStyleSheet)
+        return;
+
+    const String& ruleId = idParts.at(1);
+    bool success = inspectorStyleSheet->setRuleSelector(ruleId, selector);
+    if (!success)
+        return;
+
+    *result = inspectorStyleSheet->buildObjectForRule(inspectorStyleSheet->ruleForId(ruleId));
+}
+
+void InspectorCSSAgent::addRule2(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result)
+{
+    Node* node = m_domAgent->nodeForId(contextNodeId);
+    if (!node)
+        return;
+
+    InspectorStyleSheet* inspectorStyleSheet = viaInspectorStyleSheet(node->document(), true);
+    CSSStyleRule* newRule = inspectorStyleSheet->addRule(selector);
+    if (newRule)
+        *result = inspectorStyleSheet->buildObjectForRule(newRule);
+}
+
+void InspectorCSSAgent::getSupportedCSSProperties(RefPtr<InspectorArray>* cssProperties)
+{
+    RefPtr<InspectorArray> properties = InspectorArray::create();
+    for (int i = 0; i < numCSSProperties; ++i)
+        properties->pushString(propertyNameStrings[i]);
+
+    *cssProperties = properties.release();
+}
+
+// static
+Element* InspectorCSSAgent::inlineStyleElement(CSSStyleDeclaration* style)
+{
+    if (!style || !style->isMutableStyleDeclaration())
+        return 0;
+    Node* node = static_cast<CSSMutableStyleDeclaration*>(style)->node();
+    if (!node || !node->isStyledElement() || static_cast<StyledElement*>(node)->getInlineStyleDecl() != style)
+        return 0;
+    return static_cast<Element*>(node);
+}
+
+// static
+void InspectorCSSAgent::populateObjectWithStyleProperties(CSSStyleDeclaration* style, InspectorObject* result, Vector<CSSPropertySourceData>* propertyData)
+{
+    RefPtr<InspectorArray> properties = InspectorArray::create();
+    RefPtr<InspectorObject> shorthandValues = InspectorObject::create();
+    HashMap<String, RefPtr<InspectorObject> > propertyNameToPreviousActiveProperty;
+    HashSet<String> foundShorthands;
+    HashSet<String> sourcePropertyNames;
+    if (propertyData) {
+        for (Vector<CSSPropertySourceData>::const_iterator it = propertyData->begin(); it != propertyData->end(); ++it) {
+            const CSSPropertySourceData& propertyEntry = *it;
+            RefPtr<InspectorObject> property = InspectorObject::create();
+            properties->pushObject(property);
+            const String& name = propertyEntry.name;
+            sourcePropertyNames.add(name);
+            property->setString("name", name);
+            property->setString("value", propertyEntry.value);
+            property->setString("priority", propertyEntry.important ? "important" : "");
+            property->setString("status", "active");
+            property->setBoolean("parsedOk", propertyEntry.parsedOk);
+            property->setNumber("startOffset", propertyEntry.range.start);
+            property->setNumber("endOffset", propertyEntry.range.end);
+            if (propertyEntry.parsedOk) {
+                property->setBoolean("implicit", false);
+                String shorthand = style->getPropertyShorthand(name);
+                property->setString("shorthandName", shorthand);
+                if (!shorthand.isEmpty() && !foundShorthands.contains(shorthand)) {
+                    foundShorthands.add(shorthand);
+                    shorthandValues->setString(shorthand, shorthandValue(style, shorthand));
+                }
+            } else {
+                property->setBoolean("implicit", false);
+                property->setString("shorthandName", "");
+            }
+            HashMap<String, RefPtr<InspectorObject> >::iterator activeIt = propertyNameToPreviousActiveProperty.find(name);
+            if (activeIt != propertyNameToPreviousActiveProperty.end()) {
+                activeIt->second->setString("status", "inactive");
+                activeIt->second->setString("shorthandName", "");
+            }
+            propertyNameToPreviousActiveProperty.set(name, property);
+        }
+    }
+
+    for (int i = 0, size = style->length(); i < size; ++i) {
+        String name = style->item(i);
+        if (sourcePropertyNames.contains(name))
+            continue;
+
+        sourcePropertyNames.add(name);
+        RefPtr<InspectorObject> property = InspectorObject::create();
+        properties->pushObject(property);
+        property->setString("name", name);
+        property->setString("value", style->getPropertyValue(name));
+        property->setString("priority", style->getPropertyPriority("name"));
+        property->setBoolean("implicit", style->isPropertyImplicit(name));
+        property->setBoolean("parsedOk", true);
+        property->setString("status", "style");
+        String shorthand = style->getPropertyShorthand(name);
+        property->setString("shorthandName", shorthand);
+        if (!shorthand.isEmpty() && !foundShorthands.contains(shorthand)) {
+            foundShorthands.add(shorthand);
+            shorthandValues->setString(shorthand, shorthandValue(style, shorthand));
+        }
+    }
+
+    result->setArray("properties", properties);
+    result->setObject("shorthandValues", shorthandValues);
+}
+
+// static
+String InspectorCSSAgent::shorthandValue(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    String value = style->getPropertyValue(shorthandProperty);
+    if (value.isEmpty()) {
+        for (unsigned i = 0; i < style->length(); ++i) {
+            String individualProperty = style->item(i);
+            if (style->getPropertyShorthand(individualProperty) != shorthandProperty)
+                continue;
+            if (style->isPropertyImplicit(individualProperty))
+                continue;
+            String individualValue = style->getPropertyValue(individualProperty);
+            if (individualValue == "initial")
+                continue;
+            if (value.length())
+                value.append(" ");
+            value.append(individualValue);
+        }
+    }
+    return value;
+}
+
+// static
+String InspectorCSSAgent::shorthandPriority(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    String priority = style->getPropertyPriority(shorthandProperty);
+    if (priority.isEmpty()) {
+        for (unsigned i = 0; i < style->length(); ++i) {
+            String individualProperty = style->item(i);
+            if (style->getPropertyShorthand(individualProperty) != shorthandProperty)
+                continue;
+            priority = style->getPropertyPriority(individualProperty);
+            break;
+        }
+    }
+    return priority;
+}
+
+
+// static
+Vector<String> InspectorCSSAgent::longhandProperties(CSSStyleDeclaration* style, const String& shorthandProperty)
+{
+    Vector<String> properties;
+    HashSet<String> foundProperties;
+    for (unsigned i = 0; i < style->length(); ++i) {
+        String individualProperty = style->item(i);
+        if (foundProperties.contains(individualProperty) || style->getPropertyShorthand(individualProperty) != shorthandProperty)
+            continue;
+
+        foundProperties.add(individualProperty);
+        properties.append(individualProperty);
+    }
+    return properties;
+}
+
+InspectorStyleSheetForInlineStyle* InspectorCSSAgent::asInspectorStyleSheet(Element* element)
+{
+    NodeToInspectorStyleSheet::iterator it = m_nodeToInspectorStyleSheet.find(element);
+    if (it == m_nodeToInspectorStyleSheet.end()) {
+        CSSStyleDeclaration* style = element->isStyledElement() ? element->style() : 0;
+        if (!style)
+            return 0;
+
+        String newStyleSheetId = String::number(m_lastStyleSheetId++);
+        RefPtr<InspectorStyleSheetForInlineStyle> inspectorStyleSheet = InspectorStyleSheetForInlineStyle::create(newStyleSheetId, element, "");
+        m_idToInspectorStyleSheet.set(newStyleSheetId, inspectorStyleSheet);
+        m_nodeToInspectorStyleSheet.set(element, inspectorStyleSheet);
+        return inspectorStyleSheet.get();
+    }
+
+    return it->second.get();
+}
+
+Element* InspectorCSSAgent::elementForId(long nodeId)
+{
+    Node* node = m_domAgent->nodeForId(nodeId);
+    return (!node || node->nodeType() != Node::ELEMENT_NODE) ? 0 : static_cast<Element*>(node);
+}
+
+InspectorStyleSheet* InspectorCSSAgent::bindStyleSheet(CSSStyleSheet* styleSheet)
+{
+    RefPtr<InspectorStyleSheet> inspectorStyleSheet = m_cssStyleSheetToInspectorStyleSheet.get(styleSheet);
+    if (!inspectorStyleSheet) {
+        String id = String::number(m_lastStyleSheetId++);
+        inspectorStyleSheet = InspectorStyleSheet::create(id, styleSheet, detectOrigin(styleSheet, styleSheet->document()), m_domAgent->documentURLString(styleSheet->document()));
+        m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
+        m_cssStyleSheetToInspectorStyleSheet.set(styleSheet, inspectorStyleSheet);
+    }
+    return inspectorStyleSheet.get();
+}
+
+InspectorStyleSheet* InspectorCSSAgent::viaInspectorStyleSheet(Document* document, bool createIfAbsent)
+{
+    if (!document) {
+        ASSERT(!createIfAbsent);
+        return 0;
+    }
+
+    RefPtr<InspectorStyleSheet> inspectorStyleSheet = m_documentToInspectorStyleSheet.get(document);
+    if (inspectorStyleSheet || !createIfAbsent)
+        return inspectorStyleSheet.get();
+
+    ExceptionCode ec = 0;
+    RefPtr<Element> styleElement = document->createElement("style", ec);
+    if (!ec)
+        styleElement->setAttribute("type", "text/css", ec);
+    if (!ec)
+        document->head()->appendChild(styleElement, ec);
+    if (ec)
+        return 0;
+    StyleSheetList* styleSheets = document->styleSheets();
+    StyleSheet* styleSheet = styleSheets->item(styleSheets->length() - 1);
+    if (!styleSheet->isCSSStyleSheet())
+        return 0;
+    CSSStyleSheet* cssStyleSheet = static_cast<CSSStyleSheet*>(styleSheet);
+    String id = String::number(m_lastStyleSheetId++);
+    inspectorStyleSheet = InspectorStyleSheet::create(id, cssStyleSheet, "inspector", m_domAgent->documentURLString(document));
+    m_idToInspectorStyleSheet.set(id, inspectorStyleSheet);
+    m_cssStyleSheetToInspectorStyleSheet.set(cssStyleSheet, inspectorStyleSheet);
+    m_documentToInspectorStyleSheet.set(document, inspectorStyleSheet);
+    return inspectorStyleSheet.get();
+}
+
+InspectorStyleSheet* InspectorCSSAgent::styleSheetForId(const String& styleSheetId)
+{
+    IdToInspectorStyleSheet::iterator it = m_idToInspectorStyleSheet.find(styleSheetId);
+    return it == m_idToInspectorStyleSheet.end() ? 0 : it->second.get();
+}
+
+String InspectorCSSAgent::detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument)
+{
+    DEFINE_STATIC_LOCAL(String, userAgent, ("user-agent"));
+    DEFINE_STATIC_LOCAL(String, user, ("user"));
+    DEFINE_STATIC_LOCAL(String, inspector, ("inspector"));
+
+    String origin("");
+    if (pageStyleSheet && !pageStyleSheet->ownerNode() && pageStyleSheet->href().isEmpty())
+        origin = userAgent;
+    else if (pageStyleSheet && pageStyleSheet->ownerNode() && pageStyleSheet->ownerNode()->nodeName() == "#document")
+        origin = user;
+    else {
+        InspectorStyleSheet* viaInspectorStyleSheetForOwner = viaInspectorStyleSheet(ownerDocument, false);
+        if (viaInspectorStyleSheetForOwner && pageStyleSheet == viaInspectorStyleSheetForOwner->pageStyleSheet())
+            origin = inspector;
+    }
+    return origin;
+}
+
+PassRefPtr<InspectorArray> InspectorCSSAgent::buildArrayForRuleList(CSSRuleList* ruleList)
+{
+    RefPtr<InspectorArray> result = InspectorArray::create();
+    if (!ruleList)
+        return result.release();
+
+    for (unsigned i = 0, size = ruleList->length(); i < size; ++i) {
+        CSSStyleRule* rule = asCSSStyleRule(ruleList->item(i));
+        if (!rule)
+            continue;
+
+        InspectorStyleSheet* styleSheet = bindStyleSheet(parentStyleSheet(rule));
+        if (styleSheet)
+            result->pushObject(styleSheet->buildObjectForRule(rule));
+    }
+    return result.release();
+}
+
+PassRefPtr<InspectorObject> InspectorCSSAgent::buildObjectForAttributeStyles(Element* element)
+{
+    RefPtr<InspectorObject> styleAttributes = InspectorObject::create();
+    NamedNodeMap* attributes = element->attributes();
+    for (unsigned i = 0; attributes && i < attributes->length(); ++i) {
+        Attribute* attribute = attributes->attributeItem(i);
+        if (attribute->style()) {
+            String attributeName = attribute->localName();
+            styleAttributes->setObject(attributeName.utf8().data(), buildObjectForStyle(attribute->style(), ""));
+        }
+    }
+
+    return styleAttributes;
+}
+
+void InspectorCSSAgent::didRemoveDocument(Document* document)
+{
+    m_documentToInspectorStyleSheet.remove(document);
+}
+
+void InspectorCSSAgent::didRemoveDOMNode(Node* node)
+{
+    NodeToInspectorStyleSheet::iterator it = m_nodeToInspectorStyleSheet.find(node);
+    if (it == m_nodeToInspectorStyleSheet.end())
+        return;
+
+    m_idToInspectorStyleSheet.remove(it->second->id());
+    m_nodeToInspectorStyleSheet.remove(node);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorCSSAgent.h b/WebCore/inspector/InspectorCSSAgent.h
new file mode 100644
index 0000000..eb6013b
--- /dev/null
+++ b/WebCore/inspector/InspectorCSSAgent.h
@@ -0,0 +1,126 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorCSSAgent_h
+#define InspectorCSSAgent_h
+
+#include "Document.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorStyleSheet.h"
+#include "InspectorValues.h"
+#include "PlatformString.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class CSSRule;
+class CSSRuleList;
+class CSSStyleDeclaration;
+class CSSStyleRule;
+class CSSStyleSheet;
+class Element;
+class InspectorFrontend;
+class NameNodeMap;
+class Node;
+
+#if ENABLE(INSPECTOR)
+
+class InspectorCSSAgent : public RefCounted<InspectorCSSAgent>, public InspectorDOMAgent::DOMListener {
+public:
+    static PassRefPtr<InspectorCSSAgent> create(InspectorDOMAgent* domAgent, InspectorFrontend* frontend)
+    {
+        return adoptRef(new InspectorCSSAgent(domAgent, frontend));
+    }
+
+    static PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*, const String& fullStyleId, CSSStyleSourceData* = 0);
+    static CSSStyleSheet* parentStyleSheet(StyleBase*);
+    static CSSStyleRule* asCSSStyleRule(StyleBase*);
+
+    InspectorCSSAgent(InspectorDOMAgent* domAgent, InspectorFrontend* frontend);
+    ~InspectorCSSAgent();
+
+    void reset();
+    void getMatchedRulesForNode2(long nodeId, RefPtr<InspectorArray>* rules);
+    void getMatchedPseudoRulesForNode2(long nodeId, RefPtr<InspectorArray>* rules);
+    void getAttributeStylesForNode2(long nodeId, RefPtr<InspectorValue>* styles);
+    void getInlineStyleForNode2(long nodeId, RefPtr<InspectorValue>* style);
+    void getComputedStyleForNode2(long nodeId, RefPtr<InspectorValue>* style);
+    void getInheritedStylesForNode2(long nodeId, RefPtr<InspectorArray>* result);
+    void getAllStyles2(RefPtr<InspectorArray>* styles);
+    void getStyleSheet2(const String& styleSheetId, RefPtr<InspectorValue>* result);
+    void setStyleSheetText2(const String& styleSheetId, const String& text);
+    void setStyleText2(const String& styleId, const String& text, RefPtr<InspectorValue>* result);
+    void toggleProperty2(const String& styleId, long propertyOrdinal, bool disabled);
+    void setRuleSelector2(const String& ruleId, const String& selector, RefPtr<InspectorValue>* result);
+    void addRule2(const long contextNodeId, const String& selector, RefPtr<InspectorValue>* result);
+    void getSupportedCSSProperties(RefPtr<InspectorArray>* result);
+
+private:
+    typedef HashMap<String, RefPtr<InspectorStyleSheet> > IdToInspectorStyleSheet;
+    typedef HashMap<CSSStyleSheet*, RefPtr<InspectorStyleSheet> > CSSStyleSheetToInspectorStyleSheet;
+    typedef HashMap<Node*, RefPtr<InspectorStyleSheetForInlineStyle> > NodeToInspectorStyleSheet; // for bogus "stylesheets" with inline node styles
+    typedef HashMap<RefPtr<Document>, RefPtr<InspectorStyleSheet> > DocumentToViaInspectorStyleSheet; // "via inspector" stylesheets
+
+    static Element* inlineStyleElement(CSSStyleDeclaration*);
+    static void populateObjectWithStyleProperties(CSSStyleDeclaration*, InspectorObject* result, Vector<CSSPropertySourceData>* propertyData);
+    static String shorthandValue(CSSStyleDeclaration*, const String& shorthandProperty);
+    static String shorthandPriority(CSSStyleDeclaration*, const String& shorthandProperty);
+    static Vector<String> longhandProperties(CSSStyleDeclaration*, const String& shorthandProperty);
+
+    InspectorStyleSheetForInlineStyle* asInspectorStyleSheet(Element* element);
+    Element* elementForId(long nodeId);
+
+    InspectorStyleSheet* bindStyleSheet(CSSStyleSheet*);
+    InspectorStyleSheet* viaInspectorStyleSheet(Document*, bool createIfAbsent);
+    InspectorStyleSheet* styleSheetForId(const String& styleSheetId);
+    String detectOrigin(CSSStyleSheet* pageStyleSheet, Document* ownerDocument);
+
+    PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList* ruleList);
+    PassRefPtr<InspectorObject> buildObjectForAttributeStyles(Element* element);
+
+    // InspectorDOMAgent::DOMListener interface
+    virtual void didRemoveDocument(Document*);
+    virtual void didRemoveDOMNode(Node*);
+
+    RefPtr<InspectorDOMAgent> m_domAgent;
+    InspectorFrontend* m_frontend;
+
+    IdToInspectorStyleSheet m_idToInspectorStyleSheet;
+    CSSStyleSheetToInspectorStyleSheet m_cssStyleSheetToInspectorStyleSheet;
+    NodeToInspectorStyleSheet m_nodeToInspectorStyleSheet;
+    DocumentToViaInspectorStyleSheet m_documentToInspectorStyleSheet;
+
+    long m_lastStyleSheetId;
+    long m_lastRuleId;
+    long m_lastStyleId;
+};
+
+#endif
+
+} // namespace WebCore
+
+#endif // !defined(InspectorCSSAgent_h)
diff --git a/WebCore/inspector/InspectorCSSStore.cpp b/WebCore/inspector/InspectorCSSStore.cpp
index b019860..e0b658f 100644
--- a/WebCore/inspector/InspectorCSSStore.cpp
+++ b/WebCore/inspector/InspectorCSSStore.cpp
@@ -158,7 +158,7 @@ String InspectorCSSStore::inlineStyleSheetText(CSSStyleSheet* styleSheet)
 
 
 // All ranges are: [start; end) (start - inclusive, end - exclusive).
-bool InspectorCSSStore::getStyleSourceData(CSSStyleDeclaration* style, RefPtr<CSSStyleSourceData>* result)
+bool InspectorCSSStore::getRuleSourceData(CSSStyleDeclaration* style, RefPtr<CSSRuleSourceData>* result)
 {
     if (!style)
         return false;
@@ -166,11 +166,13 @@ bool InspectorCSSStore::getStyleSourceData(CSSStyleDeclaration* style, RefPtr<CS
     Element* element = inlineStyleElement(style);
     if (element) {
         // Inline: style="...".
+        RefPtr<CSSRuleSourceData> ruleSourceData = CSSRuleSourceData::create();
         RefPtr<CSSStyleSourceData> styleSourceData = CSSStyleSourceData::create();
         bool success = getStyleAttributeRanges(element, &styleSourceData);
         if (!success)
             return false;
-        *result = styleSourceData;
+        ruleSourceData->styleSourceData = styleSourceData.release();
+        *result = ruleSourceData;
         return true;
     }
 
@@ -178,7 +180,7 @@ bool InspectorCSSStore::getStyleSourceData(CSSStyleDeclaration* style, RefPtr<CS
     if (!styleSheet)
         return false;
 
-    Vector<RefPtr<CSSStyleSourceData> >* rangesVector = 0;
+    Vector<RefPtr<CSSRuleSourceData> >* rangesVector = 0;
     StyleSheetToOffsetsMap::iterator it = m_styleSheetToOffsets.find(styleSheet);
     if (it == m_styleSheetToOffsets.end()) {
         String text = styleSheetText(bindStyleSheet(styleSheet));
@@ -187,7 +189,7 @@ bool InspectorCSSStore::getStyleSourceData(CSSStyleDeclaration* style, RefPtr<CS
             CSSParser p;
             StyleRuleRangeMap ruleRangeMap;
             p.parseSheet(newStyleSheet.get(), text, 0, &ruleRangeMap);
-            rangesVector = new Vector<RefPtr<CSSStyleSourceData> >;
+            rangesVector = new Vector<RefPtr<CSSRuleSourceData> >;
             extractRanges(newStyleSheet.get(), ruleRangeMap, rangesVector);
             m_styleSheetToOffsets.set(styleSheet, rangesVector);
         }
@@ -211,7 +213,7 @@ bool InspectorCSSStore::getStyleSourceData(CSSStyleDeclaration* style, RefPtr<CS
     return false;
 }
 
-void InspectorCSSStore::extractRanges(CSSStyleSheet* styleSheet, const StyleRuleRangeMap& ruleRangeMap, Vector<RefPtr<CSSStyleSourceData> >* rangesVector)
+void InspectorCSSStore::extractRanges(CSSStyleSheet* styleSheet, const StyleRuleRangeMap& ruleRangeMap, Vector<RefPtr<CSSRuleSourceData> >* rangesVector)
 {
     for (unsigned i = 0, length = styleSheet->length(); i < length; ++i) {
         CSSStyleRule* rule = asCSSStyleRule(styleSheet->item(i));
@@ -237,7 +239,7 @@ bool InspectorCSSStore::getStyleAttributeRanges(Node* node, RefPtr<CSSStyleSourc
 
     RefPtr<CSSMutableStyleDeclaration> tempDeclaration = CSSMutableStyleDeclaration::create();
     CSSParser p;
-    p.parseDeclaration(tempDeclaration.get(), styleText, result->get());
+    p.parseDeclaration(tempDeclaration.get(), styleText, result);
     return true;
 }
 
diff --git a/WebCore/inspector/InspectorCSSStore.h b/WebCore/inspector/InspectorCSSStore.h
index 9b329df..25a9d15 100644
--- a/WebCore/inspector/InspectorCSSStore.h
+++ b/WebCore/inspector/InspectorCSSStore.h
@@ -55,7 +55,7 @@ typedef HashMap<CSSStyleDeclaration*, long> StyleToIdMap;
 typedef HashMap<long, RefPtr<CSSStyleDeclaration> > IdToStyleMap;
 typedef HashMap<CSSStyleRule*, long> RuleToIdMap;
 typedef HashMap<long, RefPtr<CSSStyleRule> > IdToRuleMap;
-typedef HashMap<CSSStyleSheet*, Vector<RefPtr<CSSStyleSourceData> >* > StyleSheetToOffsetsMap;
+typedef HashMap<CSSStyleSheet*, Vector<RefPtr<CSSRuleSourceData> >* > StyleSheetToOffsetsMap;
 typedef HashMap<CSSStyleSheet*, long> StyleSheetToIdMap;
 typedef HashMap<long, RefPtr<CSSStyleSheet> > IdToStyleSheetMap;
 typedef HashMap<long, String> IdToStyleSheetTextMap;
@@ -71,7 +71,7 @@ public:
     InspectorCSSStore(InspectorController* inspectorController);
     ~InspectorCSSStore();
     void reset();
-    bool getStyleSourceData(CSSStyleDeclaration*, RefPtr<CSSStyleSourceData>* result);
+    bool getRuleSourceData(CSSStyleDeclaration*, RefPtr<CSSRuleSourceData>* result);
     CSSStyleDeclaration* styleForId(long styleId);
     CSSStyleSheet* styleSheetForId(long styleSheetId);
     CSSStyleRule* ruleForId(long styleRuleId);
@@ -88,7 +88,7 @@ private:
     static CSSStyleRule* asCSSStyleRule(StyleBase*);
     String inlineStyleSheetText(CSSStyleSheet*);
     bool resourceStyleSheetText(CSSStyleSheet*, String* result);
-    void extractRanges(CSSStyleSheet*, const StyleRuleRangeMap&, Vector<RefPtr<CSSStyleSourceData> >* rangesVector);
+    void extractRanges(CSSStyleSheet*, const StyleRuleRangeMap&, Vector<RefPtr<CSSRuleSourceData> >* rangesVector);
     bool getStyleAttributeRanges(Node* parentNode, RefPtr<CSSStyleSourceData>* result);
 
     StyleToIdMap m_styleToId;
diff --git a/WebCore/inspector/InspectorClient.cpp b/WebCore/inspector/InspectorClient.cpp
new file mode 100644
index 0000000..434d697
--- /dev/null
+++ b/WebCore/inspector/InspectorClient.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorClient.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptController.h"
+#include "ScriptSourceCode.h"
+
+namespace WebCore {
+
+bool InspectorClient::doDispatchMessageOnFrontendPage(Page* frontendPage, const String& message)
+{
+    if (!frontendPage)
+        return false;
+
+    Frame* frame = frontendPage->mainFrame();
+    if (!frame)
+        return false;
+
+    ScriptController* scriptController = frame->script();
+    if (!scriptController)
+        return false;
+
+    String dispatchToFrontend("WebInspector.dispatchMessageFromBackend(");
+    dispatchToFrontend += message;
+    dispatchToFrontend += ");";
+
+    // Do not call executeInWorld here since it will end up calling Document::updateStyleForAllDocuments().
+    // As a result we might re-enter CSSStyleSelector::styleForElement() which is terrible.
+    scriptController->evaluate(ScriptSourceCode(dispatchToFrontend));
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorClient.h b/WebCore/inspector/InspectorClient.h
index bb71b13..0c78246 100644
--- a/WebCore/inspector/InspectorClient.h
+++ b/WebCore/inspector/InspectorClient.h
@@ -37,7 +37,7 @@ class Page;
 
 class InspectorClient {
 public:
-    virtual ~InspectorClient() {  }
+    virtual ~InspectorClient() { }
 
     virtual void inspectorDestroyed() = 0;
 
@@ -55,6 +55,8 @@ public:
     // However, there are some inspector controller states that should survive navigation (such as tracking resources
     // or recording timeline). Following callbacks allow embedders to track these states.
     virtual void updateInspectorStateCookie(const String&) { };
+
+    bool doDispatchMessageOnFrontendPage(Page* frontendPage, const String& message);
 };
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorController.cpp b/WebCore/inspector/InspectorController.cpp
index f2ee2c1..f99d487 100644
--- a/WebCore/inspector/InspectorController.cpp
+++ b/WebCore/inspector/InspectorController.cpp
@@ -66,8 +66,11 @@
 #include "InspectorDebuggerAgent.h"
 #include "InspectorFrontend.h"
 #include "InspectorFrontendClient.h"
+#include "InspectorInstrumentation.h"
 #include "InspectorProfilerAgent.h"
 #include "InspectorResource.h"
+#include "InspectorResourceAgent.h"
+#include "InspectorState.h"
 #include "InspectorStorageAgent.h"
 #include "InspectorTimelineAgent.h"
 #include "InspectorValues.h"
@@ -85,14 +88,15 @@
 #include "ScriptProfile.h"
 #include "ScriptProfiler.h"
 #include "ScriptSourceCode.h"
-#include "ScriptString.h"
+#include "ScriptState.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
 #include "SharedBuffer.h"
 #include "TextEncoding.h"
 #include "TextIterator.h"
+#include "UserGestureIndicator.h"
 #include "WindowFeatures.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/CurrentTime.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/RefCounted.h>
@@ -115,57 +119,34 @@ using namespace std;
 
 namespace WebCore {
 
-static const char* const frontendSettingsSettingName = "frontendSettings";
-
-static const char* const debuggerAlwaysEnabledSettingName = "debuggerEnabled";
-static const char* const lastActivePanel = "lastActivePanel";
-static const char* const monitoringXHRSettingName = "xhrMonitor";
-static const char* const resourceTrackingAlwaysEnabledSettingName = "resourceTrackingEnabled";
-static const char* const profilerAlwaysEnabledSettingName = "profilerEnabled";
-
-static const char* const monitoringXHRStateName = "monitoringXHREnabled";
-static const char* const resourceTrackingEnabledStateName = "resourceTrackingEnabled";
-static const char* const searchingForNodeEnabledStateName = "searchingForNodeEnabled";
-static const char* const timelineProfilerEnabledStateName = "timelineProfilerEnabled";
-static const char* const pauseOnExceptionsStateStateName = "pauseOnExceptionsState";
-
-static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
+static const char* const domNativeBreakpointType = "DOM";
+static const char* const eventListenerNativeBreakpointType = "EventListener";
+static const char* const xhrNativeBreakpointType = "XHR";
 
+// FIXME: move last panel setting to the front-end
+const char* const InspectorController::LastActivePanel = "lastActivePanel";
 const char* const InspectorController::ElementsPanel = "elements";
 const char* const InspectorController::ConsolePanel = "console";
 const char* const InspectorController::ScriptsPanel = "scripts";
 const char* const InspectorController::ProfilesPanel = "profiles";
 
+const unsigned InspectorController::defaultAttachedHeight = 300;
 
-static int connectedFrontendCount = 0;
-
-const String& InspectorController::inspectorStartsAttachedSettingName()
-{
-    DEFINE_STATIC_LOCAL(String, settingName, ("inspectorStartsAttached"));
-    return settingName;
-}
-
-static const unsigned defaultAttachedHeight = 300;
-static const float minimumAttachedHeight = 250.0f;
-static const float maximumAttachedHeightRatio = 0.75f;
 static const unsigned maximumConsoleMessages = 1000;
 static const unsigned expireConsoleMessagesStep = 100;
 
-unsigned InspectorController::s_inspectorControllerCount = 0;
-
 InspectorController::InspectorController(Page* page, InspectorClient* client)
     : m_inspectedPage(page)
     , m_client(client)
     , m_openingFrontend(false)
     , m_cssStore(new InspectorCSSStore(this))
+    , m_loadEventTime(-1.0)
+    , m_domContentEventTime(-1.0)
     , m_expiredConsoleMessageCount(0)
-    , m_showAfterVisible(lastActivePanel)
+    , m_showAfterVisible(LastActivePanel)
     , m_sessionSettings(InspectorObject::create())
     , m_groupLevel(0)
-    , m_searchingForNode(false)
-    , m_monitoringXHR(false)
     , m_previousMessage(0)
-    , m_resourceTrackingEnabled(false)
     , m_settingsLoaded(false)
     , m_inspectorBackend(InspectorBackend::create(this))
     , m_inspectorBackendDispatcher(new InspectorBackendDispatcher(this))
@@ -176,9 +157,9 @@ InspectorController::InspectorController(Page* page, InspectorClient* client)
     , m_profilerAgent(InspectorProfilerAgent::create(this))
 #endif
 {
+    m_state = new InspectorState(client);
     ASSERT_ARG(page, page);
     ASSERT_ARG(client, client);
-    ++s_inspectorControllerCount;
 }
 
 InspectorController::~InspectorController()
@@ -190,9 +171,6 @@ InspectorController::~InspectorController()
 
     deleteAllValues(m_frameResources);
 
-    ASSERT(s_inspectorControllerCount);
-    --s_inspectorControllerCount;
-
     releaseFrontendLifetimeAgents();
 
     m_inspectorBackend->disconnectController();
@@ -223,27 +201,39 @@ bool InspectorController::enabled() const
     return m_inspectedPage->settings()->developerExtrasEnabled();
 }
 
-String InspectorController::setting(const String& key) const
+bool InspectorController::inspectorStartsAttached()
+{
+    return m_state->getBoolean(InspectorState::inspectorStartsAttached);
+}
+
+void InspectorController::setInspectorStartsAttached(bool attached)
 {
-    Settings::iterator it = m_settings.find(key);
-    if (it != m_settings.end())
-        return it->second;
+    m_state->setBoolean(InspectorState::inspectorStartsAttached, attached);
+}
 
-    String value;
-    m_client->populateSetting(key, &value);
-    m_settings.set(key, value);
-    return value;
+void InspectorController::setInspectorAttachedHeight(long height)
+{
+    m_state->setLong(InspectorState::inspectorAttachedHeight, height);
 }
 
-void InspectorController::setSetting(const String& key, const String& value)
+int InspectorController::inspectorAttachedHeight() const
 {
-    m_settings.set(key, value);
-    m_client->storeSetting(key, value);
+    return m_state->getBoolean(InspectorState::inspectorAttachedHeight);
+}
+
+bool InspectorController::searchingForNodeInPage() const
+{
+    return m_state->getBoolean(InspectorState::searchingForNode);
+}
+
+bool InspectorController::resourceTrackingEnabled() const
+{
+    return m_state->getBoolean(InspectorState::resourceTrackingEnabled);
 }
 
 void InspectorController::saveApplicationSettings(const String& settings)
 {
-    setSetting(frontendSettingsSettingName, settings);
+    m_state->setString(InspectorState::frontendSettings, settings);
 }
 
 void InspectorController::saveSessionSettings(const String& settingsJSON)
@@ -253,50 +243,24 @@ void InspectorController::saveSessionSettings(const String& settingsJSON)
 
 void InspectorController::getInspectorState(RefPtr<InspectorObject>* state)
 {
-    (*state)->setBoolean(monitoringXHRStateName, m_monitoringXHR);
-    (*state)->setBoolean(resourceTrackingEnabledStateName, m_resourceTrackingEnabled);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     if (m_debuggerAgent)
-        (*state)->setNumber(pauseOnExceptionsStateStateName, m_debuggerAgent->pauseOnExceptionsState());
+        m_state->setLong(InspectorState::pauseOnExceptionsState, m_debuggerAgent->pauseOnExceptionsState());
 #endif
+    *state = m_state->generateStateObjectForFrontend();
 }
 
-void InspectorController::updateInspectorStateCookie()
+void InspectorController::restoreInspectorStateFromCookie(const String& inspectorStateCookie)
 {
-    RefPtr<InspectorObject> state = InspectorObject::create();
-    state->setBoolean(monitoringXHRStateName, m_monitoringXHR);
-    state->setBoolean(resourceTrackingEnabledStateName, m_resourceTrackingEnabled);
-    state->setBoolean(timelineProfilerEnabledStateName, m_timelineAgent);
-    state->setBoolean(searchingForNodeEnabledStateName, m_searchingForNode);
-    m_client->updateInspectorStateCookie(state->toJSONString());
-}
-
-void InspectorController::restoreInspectorStateFromCookie(const String& inspectorStateString)
-{
-    RefPtr<InspectorValue> inspectorStateValue = InspectorValue::parseJSON(inspectorStateString);
-    if (!inspectorStateValue)
-        return;
-
-    RefPtr<InspectorObject> inspectorState = inspectorStateValue->asObject();
-    if (!inspectorState)
-        return;
-
-    inspectorState->getBoolean(monitoringXHRStateName, &m_monitoringXHR);
-    inspectorState->getBoolean(resourceTrackingEnabledStateName, &m_resourceTrackingEnabled);
-    inspectorState->getBoolean(searchingForNodeEnabledStateName, &m_searchingForNode);
-
-    bool timelineProfilerEnabled = false;
-    inspectorState->getBoolean(timelineProfilerEnabledStateName, &timelineProfilerEnabled);
-    if (timelineProfilerEnabled)
+    m_state->restoreFromInspectorCookie(inspectorStateCookie);
+    if (m_state->getBoolean(InspectorState::timelineProfilerEnabled))
         startTimelineProfiler();
-    else
-        stopTimelineProfiler();
 }
 
 void InspectorController::getSettings(RefPtr<InspectorObject>* settings)
 {
     *settings = InspectorObject::create();
-    (*settings)->setString("application", setting(frontendSettingsSettingName));
+    (*settings)->setString("application", m_state->getString(InspectorState::frontendSettings));
     (*settings)->setString("session", m_sessionSettings->toJSONString());
 }
 
@@ -356,13 +320,32 @@ void InspectorController::hideHighlight()
     m_client->hideHighlight();
 }
 
+void InspectorController::setConsoleMessagesEnabled(bool enabled, bool* newState)
+{
+    *newState = enabled;
+    setConsoleMessagesEnabled(enabled);
+}
+
+void InspectorController::setConsoleMessagesEnabled(bool enabled)
+{
+    m_state->setBoolean(InspectorState::consoleMessagesEnabled, enabled);
+    if (!enabled)
+        return;
+
+    if (m_expiredConsoleMessageCount)
+        m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
+    unsigned messageCount = m_consoleMessages.size();
+    for (unsigned i = 0; i < messageCount; ++i)
+        m_consoleMessages[i]->addToFrontend(m_frontend.get(), m_injectedScriptHost.get());
+}
+
 void InspectorController::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, ScriptCallStack* callStack, const String& message)
 {
     if (!enabled())
         return;
 
     bool storeStackTrace = type == TraceMessageType || type == UncaughtExceptionMessageType || type == AssertMessageType;
-    addConsoleMessage(callStack->state(), new ConsoleMessage(source, type, level, message, callStack, m_groupLevel, storeStackTrace));
+    addConsoleMessage(new ConsoleMessage(source, type, level, message, callStack, m_groupLevel, storeStackTrace));
 }
 
 void InspectorController::addMessageToConsole(MessageSource source, MessageType type, MessageLevel level, const String& message, unsigned lineNumber, const String& sourceID)
@@ -370,22 +353,22 @@ void InspectorController::addMessageToConsole(MessageSource source, MessageType
     if (!enabled())
         return;
 
-    addConsoleMessage(0, new ConsoleMessage(source, type, level, message, lineNumber, sourceID, m_groupLevel));
+    addConsoleMessage(new ConsoleMessage(source, type, level, message, lineNumber, sourceID, m_groupLevel));
 }
 
-void InspectorController::addConsoleMessage(ScriptState* scriptState, PassOwnPtr<ConsoleMessage> consoleMessage)
+void InspectorController::addConsoleMessage(PassOwnPtr<ConsoleMessage> consoleMessage)
 {
     ASSERT(enabled());
     ASSERT_ARG(consoleMessage, consoleMessage);
 
-    if (m_previousMessage && m_previousMessage->isEqual(scriptState, consoleMessage.get())) {
+    if (m_previousMessage && m_previousMessage->isEqual(consoleMessage.get())) {
         m_previousMessage->incrementCount();
-        if (m_frontend)
+        if (m_state->getBoolean(InspectorState::consoleMessagesEnabled) && m_frontend)
             m_previousMessage->updateRepeatCountInConsole(m_frontend.get());
     } else {
         m_previousMessage = consoleMessage.get();
         m_consoleMessages.append(consoleMessage);
-        if (m_frontend)
+        if (m_state->getBoolean(InspectorState::consoleMessagesEnabled) && m_frontend)
             m_previousMessage->addToFrontend(m_frontend.get(), m_injectedScriptHost.get());
     }
 
@@ -412,7 +395,7 @@ void InspectorController::startGroup(MessageSource source, ScriptCallStack* call
 {
     ++m_groupLevel;
 
-    addConsoleMessage(callStack->state(), new ConsoleMessage(source, collapsed ? StartGroupCollapsedMessageType : StartGroupMessageType, LogMessageLevel, String(), callStack, m_groupLevel));
+    addConsoleMessage(new ConsoleMessage(source, collapsed ? StartGroupCollapsedMessageType : StartGroupMessageType, LogMessageLevel, String(), callStack, m_groupLevel));
 }
 
 void InspectorController::endGroup(MessageSource source, unsigned lineNumber, const String& sourceURL)
@@ -422,7 +405,7 @@ void InspectorController::endGroup(MessageSource source, unsigned lineNumber, co
 
     --m_groupLevel;
 
-    addConsoleMessage(0, new ConsoleMessage(source, EndGroupMessageType, LogMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
+    addConsoleMessage(new ConsoleMessage(source, EndGroupMessageType, LogMessageLevel, String(), lineNumber, sourceURL, m_groupLevel));
 }
 
 void InspectorController::markTimeline(const String& message)
@@ -433,12 +416,12 @@ void InspectorController::markTimeline(const String& message)
 
 void InspectorController::storeLastActivePanel(const String& panelName)
 {
-    setSetting(lastActivePanel, panelName);
+    m_state->setString(InspectorState::lastActivePanel, panelName);
 }
 
 void InspectorController::mouseDidMoveOverElement(const HitTestResult& result, unsigned)
 {
-    if (!enabled() || !m_searchingForNode)
+    if (!enabled() || !searchingForNodeInPage())
         return;
 
     Node* node = result.innerNode();
@@ -453,7 +436,7 @@ void InspectorController::handleMousePress()
     if (!enabled())
         return;
 
-    ASSERT(m_searchingForNode);
+    ASSERT(searchingForNodeInPage());
     if (!m_highlightedNode)
         return;
 
@@ -492,12 +475,11 @@ void InspectorController::inspectedWindowScriptObjectCleared(Frame* frame)
 
 void InspectorController::setSearchingForNode(bool enabled)
 {
-    if (m_searchingForNode == enabled)
+    if (searchingForNodeInPage() == enabled)
         return;
-    m_searchingForNode = enabled;
-    if (!m_searchingForNode)
+    m_state->setBoolean(InspectorState::searchingForNode, enabled);
+    if (!enabled)
         hideHighlight();
-    updateInspectorStateCookie();
 }
 
 void InspectorController::setSearchingForNode(bool enabled, bool* newState)
@@ -509,11 +491,7 @@ void InspectorController::setSearchingForNode(bool enabled, bool* newState)
 void InspectorController::setMonitoringXHREnabled(bool enabled, bool* newState)
 {
     *newState = enabled;
-    if (m_monitoringXHR == enabled)
-        return;
-    m_monitoringXHR = enabled;
-    setSetting(monitoringXHRSettingName, enabled ? "true" : "false");
-    updateInspectorStateCookie();
+    m_state->setBoolean(InspectorState::monitoringXHR, enabled);
 }
 
 void InspectorController::connectFrontend()
@@ -522,6 +500,8 @@ void InspectorController::connectFrontend()
     releaseFrontendLifetimeAgents();
     m_frontend = new InspectorFrontend(m_client);
     m_domAgent = InspectorDOMAgent::create(m_cssStore.get(), m_frontend.get());
+    // FIXME: enable resource agent once front-end is ready.
+    // m_resourceAgent = InspectorResourceAgent::create(m_inspectedPage, m_frontend.get());
 
 #if ENABLE(DATABASE)
     m_storageAgent = InspectorStorageAgent::create(m_frontend.get());
@@ -537,9 +517,9 @@ void InspectorController::connectFrontend()
     m_applicationCacheAgent = new InspectorApplicationCacheAgent(this, m_frontend.get());
 #endif
 
-    if (!connectedFrontendCount)
+    if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(true);
-    connectedFrontendCount++;
+    InspectorInstrumentation::frontendCreated();
 }
 
 void InspectorController::reuseFrontend()
@@ -577,7 +557,7 @@ void InspectorController::showPanel(const String& panel)
         return;
     }
 
-    if (panel == lastActivePanel)
+    if (panel == LastActivePanel)
         return;
 
     m_frontend->showPanel(panel);
@@ -595,10 +575,13 @@ void InspectorController::disconnectFrontend()
 {
     if (!m_frontend)
         return;
+
+    setConsoleMessagesEnabled(false);
+
     m_frontend.clear();
 
-    connectedFrontendCount--;
-    if (!connectedFrontendCount)
+    InspectorInstrumentation::frontendDeleted();
+    if (!InspectorInstrumentation::hasFrontends())
         ScriptController::setCaptureCallStackForUncaughtExceptions(false);
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
@@ -613,7 +596,7 @@ void InspectorController::disconnectFrontend()
     unbindAllResources();
     stopTimelineProfiler();
 
-    m_showAfterVisible = lastActivePanel;
+    m_showAfterVisible = LastActivePanel;
 
     hideHighlight();
 
@@ -628,6 +611,8 @@ void InspectorController::disconnectFrontend()
 
 void InspectorController::releaseFrontendLifetimeAgents()
 {
+    m_resourceAgent.clear();
+
     // m_domAgent is RefPtr. Remove DOM listeners first to ensure that there are
     // no references to the DOM agent from the DOM tree.
     if (m_domAgent)
@@ -651,8 +636,8 @@ void InspectorController::populateScriptObjects()
     if (!m_frontend)
         return;
 
-    if (m_showAfterVisible == lastActivePanel)
-        m_showAfterVisible = setting(lastActivePanel);
+    if (m_showAfterVisible == LastActivePanel)
+        m_showAfterVisible = m_state->getString(InspectorState::lastActivePanel);
 
     showPanel(m_showAfterVisible);
 
@@ -664,18 +649,16 @@ void InspectorController::populateScriptObjects()
     ResourcesMap::iterator resourcesEnd = m_resources.end();
     for (ResourcesMap::iterator it = m_resources.begin(); it != resourcesEnd; ++it)
         it->second->updateScriptObject(m_frontend.get());
+    if (m_domContentEventTime != -1.0)
+        m_frontend->domContentEventFired(m_domContentEventTime);
+    if (m_loadEventTime != -1.0)
+        m_frontend->loadEventFired(m_loadEventTime);
 
     m_domAgent->setDocument(m_inspectedPage->mainFrame()->document());
 
     if (m_nodeToFocus)
         focusNode();
 
-    if (m_expiredConsoleMessageCount)
-        m_frontend->updateConsoleMessageExpiredCount(m_expiredConsoleMessageCount);
-    unsigned messageCount = m_consoleMessages.size();
-    for (unsigned i = 0; i < messageCount; ++i)
-        m_consoleMessages[i]->addToFrontend(m_frontend.get(), m_injectedScriptHost.get());
-
 #if ENABLE(DATABASE)
     DatabaseResourcesMap::iterator databasesEnd = m_databaseResources.end();
     for (DatabaseResourcesMap::iterator it = m_databaseResources.begin(); it != databasesEnd; ++it)
@@ -710,8 +693,7 @@ void InspectorController::restoreDebugger()
     if (InspectorDebuggerAgent::isDebuggerAlwaysEnabled())
         enableDebuggerFromFrontend(false);
     else {
-        String debuggerEnabled = setting(debuggerAlwaysEnabledSettingName);
-        if (debuggerEnabled == "true" || m_attachDebuggerWhenShown)
+        if (m_state->getBoolean(InspectorState::debuggerAlwaysEnabled) || m_attachDebuggerWhenShown)
             enableDebugger();
     }
 #endif
@@ -722,11 +704,8 @@ void InspectorController::restoreProfiler()
     ASSERT(m_frontend);
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     m_profilerAgent->setFrontend(m_frontend.get());
-    if (!ScriptProfiler::isProfilerAlwaysEnabled()) {
-        String profilerEnabledSetting = setting(profilerAlwaysEnabledSettingName);
-        if (profilerEnabledSetting == "true")
-            enableProfiler();
-    }
+    if (!ScriptProfiler::isProfilerAlwaysEnabled() && m_state->getBoolean(InspectorState::profilerAlwaysEnabled))
+        enableProfiler();
 #endif
 }
 
@@ -774,6 +753,9 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didCommitLoad(loader);
+
     ASSERT(m_inspectedPage);
 
     if (loader->frame() == m_inspectedPage->mainFrame()) {
@@ -785,15 +767,21 @@ void InspectorController::didCommitLoad(DocumentLoader* loader)
 
         m_times.clear();
         m_counts.clear();
+
 #if ENABLE(JAVASCRIPT_DEBUGGER)
         if (m_debuggerAgent)
             m_debuggerAgent->clearForPageNavigation();
 
+        m_nativeBreakpoints.clear();
+        m_eventListenerBreakpoints.clear();
         m_XHRBreakpoints.clear();
+        m_lastBreakpointId = 0;
 #endif
+
 #if ENABLE(JAVASCRIPT_DEBUGGER) && USE(JSC)
         m_profilerAgent->resetState();
 #endif
+
         // unbindAllResources should be called before database and DOM storage
         // resources are cleared so that it has a chance to unbind them.
         unbindAllResources();
@@ -842,6 +830,10 @@ void InspectorController::frameDetachedFromParent(Frame* frame)
 {
     if (!enabled())
         return;
+
+    if (m_resourceAgent)
+        m_resourceAgent->frameDetachedFromParent(frame);
+
     if (ResourcesMap* resourceMap = m_frameResources.get(frame))
         removeAllResources(resourceMap);
 }
@@ -892,7 +884,7 @@ InspectorResource* InspectorController::getTrackedResource(unsigned long identif
     if (!enabled())
         return 0;
 
-    if (m_resourceTrackingEnabled)
+    if (resourceTrackingEnabled())
         return m_resources.get(identifier).get();
 
     bool isMainResource = m_mainResource && m_mainResource->identifier() == identifier;
@@ -916,6 +908,9 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didLoadResourceFromMemoryCache(loader, cachedResource);
+
     // If the resource URL is already known, we don't need to add it again since this is just a cached load.
     if (m_knownResources.contains(cachedResource->url()))
         return;
@@ -923,7 +918,7 @@ void InspectorController::didLoadResourceFromMemoryCache(DocumentLoader* loader,
     ASSERT(m_inspectedPage);
     bool isMainResource = isMainResourceLoader(loader, KURL(ParsedURLString, cachedResource->url()));
     ensureSettingsLoaded();
-    if (!isMainResource && !m_resourceTrackingEnabled)
+    if (!isMainResource && !resourceTrackingEnabled())
         return;
 
     RefPtr<InspectorResource> resource = InspectorResource::createCached(m_inspectedPage->progress()->createUniqueIdentifier(), loader, cachedResource);
@@ -946,8 +941,12 @@ void InspectorController::identifierForInitialRequest(unsigned long identifier,
     ASSERT(m_inspectedPage);
 
     bool isMainResource = isMainResourceLoader(loader, request.url());
+
+    if (m_resourceAgent)
+        m_resourceAgent->identifierForInitialRequest(identifier, request.url(), loader, isMainResource);
+
     ensureSettingsLoaded();
-    if (!isMainResource && !m_resourceTrackingEnabled)
+    if (!isMainResource && !resourceTrackingEnabled())
         return;
 
     RefPtr<InspectorResource> resource = InspectorResource::create(identifier, loader, request.url());
@@ -968,13 +967,11 @@ void InspectorController::mainResourceFiredDOMContentEvent(DocumentLoader* loade
     if (!enabled() || !isMainResourceLoader(loader, url))
         return;
 
-    if (m_mainResource) {
-        m_mainResource->markDOMContentEventTime();
-        if (m_timelineAgent)
-            m_timelineAgent->didMarkDOMContentEvent();
-        if (m_frontend)
-            m_mainResource->updateScriptObject(m_frontend.get());
-    }
+    m_domContentEventTime = currentTime();
+    if (m_timelineAgent)
+        m_timelineAgent->didMarkDOMContentEvent();
+    if (m_frontend)
+        m_frontend->domContentEventFired(m_domContentEventTime);
 }
 
 void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, const KURL& url)
@@ -982,13 +979,11 @@ void InspectorController::mainResourceFiredLoadEvent(DocumentLoader* loader, con
     if (!enabled() || !isMainResourceLoader(loader, url))
         return;
 
-    if (m_mainResource) {
-        m_mainResource->markLoadEventTime();
-        if (m_timelineAgent)
-            m_timelineAgent->didMarkLoadEvent();
-        if (m_frontend)
-            m_mainResource->updateScriptObject(m_frontend.get());
-    }
+    m_loadEventTime = currentTime();
+    if (m_timelineAgent)
+        m_timelineAgent->didMarkLoadEvent();
+    if (m_frontend)
+        m_frontend->loadEventFired(m_loadEventTime);
 }
 
 bool InspectorController::isMainResourceLoader(DocumentLoader* loader, const KURL& requestUrl)
@@ -1001,6 +996,9 @@ void InspectorController::willSendRequest(unsigned long identifier, ResourceRequ
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->willSendRequest(identifier, request, redirectResponse);
+
     bool isMainResource = (m_mainResource && m_mainResource->identifier() == identifier);
     if (m_timelineAgent)
         m_timelineAgent->willSendResourceRequest(identifier, isMainResource, request);
@@ -1010,6 +1008,10 @@ void InspectorController::willSendRequest(unsigned long identifier, ResourceRequ
         return;
 
     request.setReportLoadTiming(true);
+    // Only enable raw headers if front-end is attached, as otherwise we may lack
+    // permissions to fetch the headers.
+    if (m_frontend)
+        request.setReportRawHeaders(true);
 
     if (!redirectResponse.isNull()) {
         // Redirect may have empty URL and we'd like to not crash with invalid HashMap entry.
@@ -1043,15 +1045,21 @@ void InspectorController::markResourceAsCached(unsigned long identifier)
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->markResourceAsCached(identifier);
+
     if (RefPtr<InspectorResource> resource = getTrackedResource(identifier))
         resource->markAsCached();
 }
 
-void InspectorController::didReceiveResponse(unsigned long identifier, const ResourceResponse& response)
+void InspectorController::didReceiveResponse(unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
 {
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didReceiveResponse(identifier, loader, response);
+
     if (RefPtr<InspectorResource> resource = getTrackedResource(identifier)) {
         resource->updateResponse(response);
 
@@ -1059,9 +1067,7 @@ void InspectorController::didReceiveResponse(unsigned long identifier, const Res
             resource->updateScriptObject(m_frontend.get());
     }
     if (response.httpStatusCode() >= 400) {
-        // The ugly code below is due to that String::format() is not utf8-safe at the moment.
-        String message = String::format("Failed to load resource: the server responded with a status of %u (", response.httpStatusCode()) + response.httpStatusText() + ")";
-
+        String message = makeString("Failed to load resource: the server responded with a status of ", String::number(response.httpStatusCode()), " (", response.httpStatusText(), ')');
         addMessageToConsole(OtherMessageSource, LogMessageType, ErrorMessageLevel, message, 0, response.url().string());
     }
 }
@@ -1071,6 +1077,9 @@ void InspectorController::didReceiveContentLength(unsigned long identifier, int
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didReceiveContentLength(identifier, lengthReceived);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1086,8 +1095,11 @@ void InspectorController::didFinishLoading(unsigned long identifier, double fini
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didFinishLoading(identifier, finishTime);
+
     if (m_timelineAgent)
-        m_timelineAgent->didFinishLoadingResource(identifier, false);
+        m_timelineAgent->didFinishLoadingResource(identifier, false, finishTime);
 
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
@@ -1105,8 +1117,11 @@ void InspectorController::didFailLoading(unsigned long identifier, const Resourc
     if (!enabled())
         return;
 
+    if (m_resourceAgent)
+        m_resourceAgent->didFailLoading(identifier, error);
+
     if (m_timelineAgent)
-        m_timelineAgent->didFinishLoadingResource(identifier, true);
+        m_timelineAgent->didFinishLoadingResource(identifier, true, 0);
 
     String message = "Failed to load resource";
     if (!error.localizedDescription().isEmpty())
@@ -1125,15 +1140,18 @@ void InspectorController::didFailLoading(unsigned long identifier, const Resourc
         resource->updateScriptObject(m_frontend.get());
 }
 
-void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
+void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber)
 {
     if (!enabled())
         return;
 
-    if (m_monitoringXHR)
+    if (m_resourceAgent)
+        m_resourceAgent->setOverrideContent(identifier, sourceString, InspectorResource::XHR);
+
+    if (m_state->getBoolean(InspectorState::monitoringXHR))
         addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, "XHR finished loading: \"" + url + "\".", sendLineNumber, sendURL);
 
-    if (!m_resourceTrackingEnabled)
+    if (!resourceTrackingEnabled())
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
@@ -1148,14 +1166,20 @@ void InspectorController::resourceRetrievedByXMLHttpRequest(unsigned long identi
 
 void InspectorController::scriptImported(unsigned long identifier, const String& sourceString)
 {
-    if (!enabled() || !m_resourceTrackingEnabled)
+    if (!enabled())
+        return;
+
+    if (m_resourceAgent)
+        m_resourceAgent->setOverrideContent(identifier, sourceString, InspectorResource::Script);
+
+    if (!resourceTrackingEnabled())
         return;
 
     InspectorResource* resource = m_resources.get(identifier).get();
     if (!resource)
         return;
 
-    resource->setOverrideContent(ScriptString(sourceString), InspectorResource::Script);
+    resource->setOverrideContent(sourceString, InspectorResource::Script);
 
     if (m_frontend)
         resource->updateScriptObject(m_frontend.get());
@@ -1167,8 +1191,7 @@ void InspectorController::setResourceTrackingEnabled(bool enable)
         return;
 
     ASSERT(m_inspectedPage);
-    m_resourceTrackingEnabled = enable;
-    updateInspectorStateCookie();
+    m_state->setBoolean(InspectorState::resourceTrackingEnabled, enable);
 }
 
 void InspectorController::setResourceTrackingEnabled(bool enable, bool always, bool* newState)
@@ -1176,18 +1199,16 @@ void InspectorController::setResourceTrackingEnabled(bool enable, bool always, b
     *newState = enable;
 
     if (always)
-        setSetting(resourceTrackingAlwaysEnabledSettingName, enable ? "true" : "false");
+        m_state->setBoolean(InspectorState::resourceTrackingAlwaysEnabled, enable);
 
-    if (m_resourceTrackingEnabled == enable)
+    if (resourceTrackingEnabled() == enable)
         return;
 
     ASSERT(m_inspectedPage);
-    m_resourceTrackingEnabled = enable;
+    m_state->setBoolean(InspectorState::resourceTrackingEnabled, enable);
 
     if (enable)
-        m_inspectedPage->mainFrame()->redirectScheduler()->scheduleRefresh(true);
-
-    updateInspectorStateCookie();
+        reloadPage();
 }
 
 void InspectorController::ensureSettingsLoaded()
@@ -1196,15 +1217,10 @@ void InspectorController::ensureSettingsLoaded()
         return;
     m_settingsLoaded = true;
 
-    String resourceTrackingAlwaysEnabled = setting(resourceTrackingAlwaysEnabledSettingName);
-    if (resourceTrackingAlwaysEnabled == "true")
-        m_resourceTrackingEnabled = true;
-
-    String monitoringXHRAlwaysEnabled = setting(monitoringXHRSettingName);
-    if (monitoringXHRAlwaysEnabled == "true")
-        m_monitoringXHR = true;
+    m_state->loadFromSettings();
 
-    updateInspectorStateCookie();
+    if (m_state->getBoolean(InspectorState::resourceTrackingAlwaysEnabled))
+        m_state->setBoolean(InspectorState::resourceTrackingEnabled, true);
 }
 
 void InspectorController::startTimelineProfiler()
@@ -1219,7 +1235,7 @@ void InspectorController::startTimelineProfiler()
     if (m_frontend)
         m_frontend->timelineProfilerWasStarted();
 
-    updateInspectorStateCookie();
+    m_state->setBoolean(InspectorState::timelineProfilerEnabled, true);
 }
 
 void InspectorController::stopTimelineProfiler()
@@ -1234,7 +1250,7 @@ void InspectorController::stopTimelineProfiler()
     if (m_frontend)
         m_frontend->timelineProfilerWasStopped();
 
-    updateInspectorStateCookie();
+    m_state->setBoolean(InspectorState::timelineProfilerEnabled, false);
 }
 
 #if ENABLE(WORKERS)
@@ -1512,6 +1528,9 @@ void InspectorController::didCreateWebSocket(unsigned long identifier, const KUR
         return;
     ASSERT(m_inspectedPage);
 
+    if (m_resourceAgent)
+        m_resourceAgent->didCreateWebSocket(identifier, requestURL);
+
     RefPtr<InspectorResource> resource = InspectorResource::createWebSocket(identifier, requestURL, documentURL);
     addResource(resource.get());
 
@@ -1521,6 +1540,9 @@ void InspectorController::didCreateWebSocket(unsigned long identifier, const KUR
 
 void InspectorController::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
 {
+    if (m_resourceAgent)
+        m_resourceAgent->willSendWebSocketHandshakeRequest(identifier, request);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1532,6 +1554,9 @@ void InspectorController::willSendWebSocketHandshakeRequest(unsigned long identi
 
 void InspectorController::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
 {
+    if (m_resourceAgent)
+        m_resourceAgent->didReceiveWebSocketHandshakeResponse(identifier, response);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1545,6 +1570,9 @@ void InspectorController::didReceiveWebSocketHandshakeResponse(unsigned long ide
 
 void InspectorController::didCloseWebSocket(unsigned long identifier)
 {
+    if (m_resourceAgent)
+        m_resourceAgent->didCloseWebSocket(identifier);
+
     RefPtr<InspectorResource> resource = getTrackedResource(identifier);
     if (!resource)
         return;
@@ -1606,14 +1634,14 @@ bool InspectorController::profilerEnabled() const
 void InspectorController::enableProfiler(bool always, bool skipRecompile)
 {
     if (always)
-        setSetting(profilerAlwaysEnabledSettingName, "true");
+        m_state->setBoolean(InspectorState::profilerAlwaysEnabled, true);
     m_profilerAgent->enable(skipRecompile);
 }
 
 void InspectorController::disableProfiler(bool always)
 {
     if (always)
-        setSetting(profilerAlwaysEnabledSettingName, "false");
+        m_state->setBoolean(InspectorState::profilerAlwaysEnabled, false);
     m_profilerAgent->disable();
 }
 #endif
@@ -1623,7 +1651,7 @@ void InspectorController::enableDebuggerFromFrontend(bool always)
 {
     ASSERT(!debuggerEnabled());
     if (always)
-        setSetting(debuggerAlwaysEnabledSettingName, "true");
+        m_state->setBoolean(InspectorState::debuggerAlwaysEnabled, true);
 
     ASSERT(m_inspectedPage);
 
@@ -1654,7 +1682,7 @@ void InspectorController::disableDebugger(bool always)
         return;
 
     if (always)
-        setSetting(debuggerAlwaysEnabledSettingName, "false");
+        m_state->setBoolean(InspectorState::debuggerAlwaysEnabled, false);
 
     ASSERT(m_inspectedPage);
 
@@ -1672,29 +1700,74 @@ void InspectorController::resume()
         m_debuggerAgent->resume();
 }
 
-void InspectorController::setNativeBreakpoint(PassRefPtr<InspectorObject> breakpoint, unsigned int* breakpointId)
+void InspectorController::setNativeBreakpoint(PassRefPtr<InspectorObject> breakpoint, String* breakpointId)
 {
-    *breakpointId = 0;
+    *breakpointId = "";
     String type;
     if (!breakpoint->getString("type", &type))
         return;
-    if (type == "XHR") {
-        RefPtr<InspectorObject> condition = breakpoint->getObject("condition");
-        if (!condition)
-            return;
+    RefPtr<InspectorObject> condition = breakpoint->getObject("condition");
+    if (!condition)
+        return;
+    if (type == xhrNativeBreakpointType) {
         String url;
         if (!condition->getString("url", &url))
             return;
-        *breakpointId = ++m_lastBreakpointId;
+        *breakpointId = String::number(++m_lastBreakpointId);
         m_XHRBreakpoints.set(*breakpointId, url);
+        m_nativeBreakpoints.set(*breakpointId, type);
+    } else if (type == eventListenerNativeBreakpointType) {
+        String eventName;
+        if (!condition->getString("eventName", &eventName))
+            return;
+        if (m_eventListenerBreakpoints.contains(eventName))
+            return;
+        *breakpointId = eventName;
+        m_eventListenerBreakpoints.add(eventName);
+        m_nativeBreakpoints.set(*breakpointId, type);
+    } else if (type == domNativeBreakpointType) {
+        if (!m_domAgent)
+            return;
+        double nodeIdNumber;
+        if (!condition->getNumber("nodeId", &nodeIdNumber))
+            return;
+        double domBreakpointTypeNumber;
+        if (!condition->getNumber("type", &domBreakpointTypeNumber))
+            return;
+        long nodeId = (long) nodeIdNumber;
+        long domBreakpointType = (long) domBreakpointTypeNumber;
+        *breakpointId = m_domAgent->setDOMBreakpoint(nodeId, domBreakpointType);
+        if (!breakpointId->isEmpty())
+            m_nativeBreakpoints.set(*breakpointId, type);
+    }
+}
+
+void InspectorController::removeNativeBreakpoint(const String& breakpointId)
+{
+    String type = m_nativeBreakpoints.take(breakpointId);
+    if (type == xhrNativeBreakpointType)
+        m_XHRBreakpoints.remove(breakpointId);
+    else if (type == eventListenerNativeBreakpointType)
+        m_eventListenerBreakpoints.remove(breakpointId);
+    else if (type == domNativeBreakpointType) {
+        if (m_domAgent)
+            m_domAgent->removeDOMBreakpoint(breakpointId);
     }
 }
 
-void InspectorController::removeNativeBreakpoint(unsigned int breakpointId)
+String InspectorController::findEventListenerBreakpoint(const String& eventName)
 {
-    m_XHRBreakpoints.remove(breakpointId);
+    return m_eventListenerBreakpoints.contains(eventName) ? eventName : "";
 }
 
+String InspectorController::findXHRBreakpoint(const String& url)
+{
+    for (HashMap<String, String>::iterator it = m_XHRBreakpoints.begin(); it != m_XHRBreakpoints.end(); ++it) {
+        if (url.contains(it->second))
+            return it->first;
+    }
+    return "";
+}
 #endif
 
 void InspectorController::evaluateForTestInFrontend(long callId, const String& script)
@@ -1727,12 +1800,14 @@ String InspectorController::breakpointsSettingKey()
 
 PassRefPtr<InspectorValue> InspectorController::loadBreakpoints()
 {
-    return InspectorValue::parseJSON(setting(breakpointsSettingKey()));
+    String jsonString;
+    m_client->populateSetting(breakpointsSettingKey(), &jsonString);
+    return InspectorValue::parseJSON(jsonString);
 }
 
 void InspectorController::saveBreakpoints(PassRefPtr<InspectorObject> breakpoints)
 {
-    setSetting(breakpointsSettingKey(), breakpoints->toJSONString());
+    m_client->storeSetting(breakpointsSettingKey(), breakpoints->toJSONString());
 }
 #endif
 
@@ -1763,7 +1838,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
 
         context.addPath(quadPath);
         context.setStrokeThickness(outlineThickness);
-        context.setStrokeColor(outlineColor, DeviceColorSpace);
+        context.setStrokeColor(outlineColor, ColorSpaceDeviceRGB);
         context.strokePath();
 
         context.restore();
@@ -1771,7 +1846,7 @@ static void drawOutlinedQuad(GraphicsContext& context, const FloatQuad& quad, co
 
     // Now do the fill
     context.addPath(quadPath);
-    context.setFillColor(fillColor, DeviceColorSpace);
+    context.setFillColor(fillColor, ColorSpaceDeviceRGB);
     context.fillPath();
 }
 
@@ -1953,11 +2028,11 @@ void InspectorController::drawElementTitle(GraphicsContext& context, const IntRe
     if (titleRect.bottom() > overlayRect.bottom())
         dy += overlayRect.bottom() - titleRect.bottom() - borderWidthPx;
     titleRect.move(dx, dy);
-    context.setStrokeColor(tooltipBorderColor, DeviceColorSpace);
+    context.setStrokeColor(tooltipBorderColor, ColorSpaceDeviceRGB);
     context.setStrokeThickness(borderWidthPx);
-    context.setFillColor(tooltipBackgroundColor, DeviceColorSpace);
+    context.setFillColor(tooltipBackgroundColor, ColorSpaceDeviceRGB);
     context.drawRect(titleRect);
-    context.setFillColor(tooltipFontColor, DeviceColorSpace);
+    context.setFillColor(tooltipFontColor, ColorSpaceDeviceRGB);
     context.drawText(font, nodeTitleRun, IntPoint(titleRect.x() + rectInflatePx, titleRect.y() + font.height()));
 }
 
@@ -1972,14 +2047,15 @@ void InspectorController::openInInspectedWindow(const String& url)
     if (!newFrame)
         return;
 
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
     newFrame->loader()->setOpener(mainFrame);
     newFrame->page()->setOpenedByDOM();
-    newFrame->loader()->changeLocation(newFrame->loader()->completeURL(url), "", false, false, true);
+    newFrame->loader()->changeLocation(newFrame->loader()->completeURL(url), "", false, false);
 }
 
 void InspectorController::count(const String& title, unsigned lineNumber, const String& sourceID)
 {
-    String identifier = title + String::format("@%s:%d", sourceID.utf8().data(), lineNumber);
+    String identifier = makeString(title, '@', sourceID, ':', String::number(lineNumber));
     HashMap<String, unsigned>::iterator it = m_counts.find(identifier);
     int count;
     if (it == m_counts.end())
@@ -1991,7 +2067,7 @@ void InspectorController::count(const String& title, unsigned lineNumber, const
 
     m_counts.add(identifier, count);
 
-    String message = String::format("%s: %d", title.utf8().data(), count);
+    String message = makeString(title, ": ", String::number(count));
     addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceID);
 }
 
@@ -2049,10 +2125,14 @@ void InspectorController::setInspectorExtensionAPI(const String& source)
     m_inspectorExtensionAPI = source;
 }
 
-void InspectorController::getResourceContent(unsigned long identifier, String* content)
+void InspectorController::getResourceContent(unsigned long identifier, bool encode, String* content)
 {
     RefPtr<InspectorResource> resource = m_resources.get(identifier);
-    *content = resource ? resource->sourceString() : String();
+    if (!resource) {
+        *content = String();
+        return;
+    }
+    *content = encode ? resource->sourceBytes() : resource->sourceString();
 }
 
 bool InspectorController::resourceContentForURL(const KURL& url, Document* frameDocument, String* result)
@@ -2100,86 +2180,11 @@ bool InspectorController::resourceContentForURL(const KURL& url, Document* frame
 
 void InspectorController::reloadPage()
 {
-    m_inspectedPage->mainFrame()->redirectScheduler()->scheduleRefresh(true);
-}
-
-void InspectorController::willInsertDOMNodeImpl(Node* node, Node* parent)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (!m_debuggerAgent || !m_domAgent)
-        return;
-    PassRefPtr<InspectorValue> eventData;
-    if (m_domAgent->shouldBreakOnNodeInsertion(node, parent, &eventData))
-        m_debuggerAgent->breakProgram(DOMBreakpointDebuggerEventType, eventData);
-#endif
-}
-
-void InspectorController::didInsertDOMNodeImpl(Node* node)
-{
-    if (m_domAgent)
-        m_domAgent->didInsertDOMNode(node);
-}
-
-void InspectorController::willRemoveDOMNodeImpl(Node* node)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (!m_debuggerAgent || !m_domAgent)
-        return;
-    PassRefPtr<InspectorValue> eventData;
-    if (m_domAgent->shouldBreakOnNodeRemoval(node, &eventData))
-        m_debuggerAgent->breakProgram(DOMBreakpointDebuggerEventType, eventData);
-#endif
-}
-
-void InspectorController::didRemoveDOMNodeImpl(Node* node)
-{
-    if (m_domAgent)
-        m_domAgent->didRemoveDOMNode(node);
-}
-
-void InspectorController::willModifyDOMAttrImpl(Element* element)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (!m_debuggerAgent || !m_domAgent)
-        return;
-    PassRefPtr<InspectorValue> eventData;
-    if (m_domAgent->shouldBreakOnAttributeModification(element, &eventData))
-        m_debuggerAgent->breakProgram(DOMBreakpointDebuggerEventType, eventData);
-#endif
-}
-
-void InspectorController::didModifyDOMAttrImpl(Element* element)
-{
-    if (m_domAgent)
-        m_domAgent->didModifyDOMAttr(element);
-}
-
-void InspectorController::characterDataModifiedImpl(CharacterData* characterData)
-{
-    if (m_domAgent)
-        m_domAgent->characterDataModified(characterData);
+    // FIXME: Why do we set the user gesture indicator here?
+    UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+    m_inspectedPage->mainFrame()->navigationScheduler()->scheduleRefresh();
 }
 
-void InspectorController::instrumentWillSendXMLHttpRequestImpl(const KURL& url)
-{
-#if ENABLE(JAVASCRIPT_DEBUGGER)
-    if (m_debuggerAgent) {
-        if (!m_XHRBreakpoints.size())
-            return;
-        for (HashMap<unsigned int, String>::iterator it = m_XHRBreakpoints.begin(); it != m_XHRBreakpoints.end(); ++it) {
-            if (!url.string().contains(it->second))
-                continue;
-            RefPtr<InspectorObject> eventData = InspectorObject::create();
-            eventData->setString("type", "XHR");
-            eventData->setString("url", url);
-            m_debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
-            break;
-        }
-    }
-#endif
-}
-
-
 } // namespace WebCore
 
 #endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorController.h b/WebCore/inspector/InspectorController.h
index c6f516d..a047962 100644
--- a/WebCore/inspector/InspectorController.h
+++ b/WebCore/inspector/InspectorController.h
@@ -32,10 +32,8 @@
 #include "CharacterData.h"
 #include "Console.h"
 #include "Cookie.h"
-#include "Element.h"
 #include "Page.h"
 #include "PlatformString.h"
-#include "ScriptState.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/ListHashSet.h>
@@ -51,7 +49,6 @@ class ConsoleMessage;
 class Database;
 class Document;
 class DocumentLoader;
-class Element;
 class FloatRect;
 class GraphicsContext;
 class HitTestResult;
@@ -71,6 +68,8 @@ class InspectorFrontendClient;
 class InspectorObject;
 class InspectorProfilerAgent;
 class InspectorResource;
+class InspectorResourceAgent;
+class InspectorState;
 class InspectorStorageAgent;
 class InspectorTimelineAgent;
 class InspectorValue;
@@ -84,7 +83,6 @@ class ResourceResponse;
 class ResourceError;
 class ScriptCallStack;
 class ScriptProfile;
-class ScriptString;
 class SharedBuffer;
 class Storage;
 class StorageArea;
@@ -105,6 +103,7 @@ public:
     typedef HashMap<int, RefPtr<InspectorDatabaseResource> > DatabaseResourcesMap;
     typedef HashMap<int, RefPtr<InspectorDOMStorageResource> > DOMStorageResourcesMap;
 
+    static const char* const LastActivePanel;
     static const char* const ConsolePanel;
     static const char* const ElementsPanel;
     static const char* const ProfilesPanel;
@@ -125,13 +124,11 @@ public:
     Page* inspectedPage() const { return m_inspectedPage; }
     void reloadPage();
 
-    String setting(const String& key) const;
-    void setSetting(const String& key, const String& value);
     void saveApplicationSettings(const String& settings);
     void saveSessionSettings(const String&);
     void getSettings(RefPtr<InspectorObject>*);
 
-    void restoreInspectorStateFromCookie(const String& inspectorState);
+    void restoreInspectorStateFromCookie(const String& inspectorCookie);
 
     void inspect(Node*);
     void highlight(Node*);
@@ -143,19 +140,17 @@ public:
     void showPanel(const String&);
     void close();
 
-    // We are in transition from JS transport via webInspector to native
-    // transport via InspectorClient. After migration, webInspector parameter should
-    // be removed.
     void connectFrontend();
     void reuseFrontend();
     void disconnectFrontend();
 
+    void setConsoleMessagesEnabled(bool enabled, bool* newState);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, ScriptCallStack*, const String& message);
     void addMessageToConsole(MessageSource, MessageType, MessageLevel, const String& message, unsigned lineNumber, const String& sourceID);
     void clearConsoleMessages();
     const Vector<OwnPtr<ConsoleMessage> >& consoleMessages() const { return m_consoleMessages; }
 
-    bool searchingForNodeInPage() const { return m_searchingForNode; }
+    bool searchingForNodeInPage() const;
     void mouseDidMoveOverElement(const HitTestResult&, unsigned modifierFlags);
     void handleMousePress();
 
@@ -171,16 +166,16 @@ public:
     void identifierForInitialRequest(unsigned long identifier, DocumentLoader*, const ResourceRequest&);
     void willSendRequest(unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
     void markResourceAsCached(unsigned long identifier);
-    void didReceiveResponse(unsigned long identifier, const ResourceResponse&);
+    void didReceiveResponse(unsigned long identifier, DocumentLoader*, const ResourceResponse&);
     void didReceiveContentLength(unsigned long identifier, int lengthReceived);
     void didFinishLoading(unsigned long identifier, double finishTime);
     void didFailLoading(unsigned long identifier, const ResourceError&);
-    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const ScriptString& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
+    void resourceRetrievedByXMLHttpRequest(unsigned long identifier, const String& sourceString, const String& url, const String& sendURL, unsigned sendLineNumber);
     void scriptImported(unsigned long identifier, const String& sourceString);
 
     void setResourceTrackingEnabled(bool enabled);
     void setResourceTrackingEnabled(bool enabled, bool always, bool* newState);
-    bool resourceTrackingEnabled() const { return m_resourceTrackingEnabled; }
+    bool resourceTrackingEnabled() const;
 
     void ensureSettingsLoaded();
 
@@ -198,15 +193,6 @@ public:
     void mainResourceFiredLoadEvent(DocumentLoader*, const KURL&);
     void mainResourceFiredDOMContentEvent(DocumentLoader*, const KURL&);
 
-    static void willInsertDOMNode(Node* node, Node* parent);
-    static void didInsertDOMNode(Node*);
-    static void willRemoveDOMNode(Node*);
-    static void willModifyDOMAttr(Element*);
-    static void didModifyDOMAttr(Element*);
-    static void characterDataModified(CharacterData*);
-
-    static void instrumentWillSendXMLHttpRequest(ScriptExecutionContext*, const KURL&);
-
 #if ENABLE(WORKERS)
     enum WorkerAction { WorkerCreated, WorkerDestroyed };
 
@@ -270,9 +256,8 @@ public:
     InspectorDebuggerAgent* debuggerAgent() const { return m_debuggerAgent.get(); }
     void resume();
 
-    void setNativeBreakpoint(PassRefPtr<InspectorObject> breakpoint, unsigned int* breakpointId);
-    void removeNativeBreakpoint(unsigned int breakpointId);
-
+    void setNativeBreakpoint(PassRefPtr<InspectorObject> breakpoint, String* breakpointId);
+    void removeNativeBreakpoint(const String& breakpointId);
 #endif
 
     void evaluateForTestInFrontend(long testCallId, const String& script);
@@ -283,14 +268,20 @@ public:
     void removeAllScriptsToEvaluateOnLoad();
     void setInspectorExtensionAPI(const String& source);
 
-    static const String& inspectorStartsAttachedSettingName();
+    bool inspectorStartsAttached();
+    void setInspectorStartsAttached(bool);
+    void setInspectorAttachedHeight(long height);
+    int inspectorAttachedHeight() const;
+
+    static const unsigned defaultAttachedHeight;
 
 private:
-    void updateInspectorStateCookie();
     void getInspectorState(RefPtr<InspectorObject>* state);
+    void setConsoleMessagesEnabled(bool enabled);
 
     friend class InspectorBackend;
     friend class InspectorBackendDispatcher;
+    friend class InspectorInstrumentation;
     friend class InjectedScriptHost;
 
     void populateScriptObjects();
@@ -308,9 +299,11 @@ private:
     void releaseFrontendLifetimeAgents();
 
 #if ENABLE(JAVASCRIPT_DEBUGGER)
-
     void toggleRecordButton(bool);
     void enableDebuggerFromFrontend(bool always);
+
+    String findEventListenerBreakpoint(const String& eventName);
+    String findXHRBreakpoint(const String& url);
 #endif
 #if ENABLE(DATABASE)
     void selectDatabase(Database* database);
@@ -325,12 +318,12 @@ private:
 
     void focusNode();
 
-    void addConsoleMessage(ScriptState*, PassOwnPtr<ConsoleMessage>);
+    void addConsoleMessage(PassOwnPtr<ConsoleMessage>);
 
     void addResource(InspectorResource*);
     void removeResource(InspectorResource*);
     InspectorResource* getTrackedResource(unsigned long identifier);
-    void getResourceContent(unsigned long identifier, String* content);
+    void getResourceContent(unsigned long identifier, bool encode, String* content);
 
     void pruneResources(ResourcesMap*, DocumentLoader* loaderToKeep = 0);
     void removeAllResources(ResourcesMap* map) { pruneResources(map); }
@@ -339,20 +332,6 @@ private:
 
     void didEvaluateForTestInFrontend(long callId, const String& jsonResult);
 
-    static InspectorController* inspectorControllerForScriptExecutionContext(ScriptExecutionContext* context);
-    static InspectorController* inspectorControllerForNode(Node*);
-    static InspectorController* inspectorControllerForDocument(Document* document);
-
-    void willInsertDOMNodeImpl(Node* node, Node* parent);
-    void didInsertDOMNodeImpl(Node*);
-    void willRemoveDOMNodeImpl(Node*);
-    void didRemoveDOMNodeImpl(Node*);
-    void willModifyDOMAttrImpl(Element*);
-    void didModifyDOMAttrImpl(Element*);
-    void characterDataModifiedImpl(CharacterData*);
-
-    void instrumentWillSendXMLHttpRequestImpl(const KURL&);
-
 #if ENABLE(JAVASCRIPT_DEBUGGER)
     friend class InspectorDebuggerAgent;
     String breakpointsSettingKey();
@@ -360,17 +339,17 @@ private:
     void saveBreakpoints(PassRefPtr<InspectorObject> breakpoints);
 #endif
 
-    static unsigned s_inspectorControllerCount;
-
     Page* m_inspectedPage;
     InspectorClient* m_client;
     OwnPtr<InspectorFrontendClient> m_inspectorFrontendClient;
     bool m_openingFrontend;
     OwnPtr<InspectorFrontend> m_frontend;
     RefPtr<InspectorDOMAgent> m_domAgent;
+    RefPtr<InspectorResourceAgent> m_resourceAgent;
     RefPtr<InspectorStorageAgent> m_storageAgent;
     OwnPtr<InspectorCSSStore> m_cssStore;
     OwnPtr<InspectorTimelineAgent> m_timelineAgent;
+    OwnPtr<InspectorState> m_state;
 
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     OwnPtr<InspectorApplicationCacheAgent> m_applicationCacheAgent;
@@ -381,6 +360,8 @@ private:
     ResourcesMap m_resources;
     HashSet<String> m_knownResources;
     FrameResourcesMap m_frameResources;
+    double m_loadEventTime;
+    double m_domContentEventTime;
     Vector<OwnPtr<ConsoleMessage> > m_consoleMessages;
     unsigned m_expiredConsoleMessageCount;
     HashMap<String, double> m_times;
@@ -397,10 +378,7 @@ private:
     RefPtr<InspectorValue> m_sessionSettings;
 #endif
     unsigned m_groupLevel;
-    bool m_searchingForNode;
-    bool m_monitoringXHR;
     ConsoleMessage* m_previousMessage;
-    bool m_resourceTrackingEnabled;
     bool m_settingsLoaded;
     RefPtr<InspectorBackend> m_inspectorBackend;
     OwnPtr<InspectorBackendDispatcher> m_inspectorBackendDispatcher;
@@ -416,7 +394,10 @@ private:
     bool m_attachDebuggerWhenShown;
     OwnPtr<InspectorDebuggerAgent> m_debuggerAgent;
 
-    HashMap<unsigned int, String> m_XHRBreakpoints;
+    HashMap<String, String> m_nativeBreakpoints;
+    HashSet<String> m_eventListenerBreakpoints;
+    HashMap<String, String> m_XHRBreakpoints;
+
     unsigned int m_lastBreakpointId;
 
     OwnPtr<InspectorProfilerAgent> m_profilerAgent;
@@ -428,6 +409,7 @@ private:
 #endif
 };
 
+<<<<<<< HEAD
 inline void InspectorController::willInsertDOMNode(Node* node, Node* parent)
 {
 #if ENABLE(INSPECTOR)
@@ -518,6 +500,8 @@ inline InspectorController* InspectorController::inspectorControllerForDocument(
 #endif
 }
 
+=======
+>>>>>>> webkit.org at r70209
 } // namespace WebCore
 
 #endif // !defined(InspectorController_h)
diff --git a/WebCore/inspector/InspectorDOMAgent.cpp b/WebCore/inspector/InspectorDOMAgent.cpp
index f51da73..f5c5f8b 100644
--- a/WebCore/inspector/InspectorDOMAgent.cpp
+++ b/WebCore/inspector/InspectorDOMAgent.cpp
@@ -77,6 +77,7 @@
 #include "markup.h"
 
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/HashSet.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/OwnPtr.h>
@@ -187,6 +188,8 @@ public:
             if (!ec)
                 resultCollector.add(node);
         }
+#else
+        UNUSED_PARAM(resultCollector);
 #endif
     }
 };
@@ -203,7 +206,8 @@ public:
 enum DOMBreakpointType {
     SubtreeModified = 0,
     AttributeModified,
-    NodeRemoved
+    NodeRemoved,
+    DOMBreakpointTypesCount
 };
 
 const uint32_t inheritableDOMBreakpointTypesMask = (1 << SubtreeModified);
@@ -215,6 +219,7 @@ InspectorDOMAgent::InspectorDOMAgent(InspectorCSSStore* cssStore, InspectorFront
     : EventListener(InspectorDOMAgentType)
     , m_cssStore(cssStore)
     , m_frontend(frontend)
+    , m_domListener(0)
     , m_lastNodeId(1)
     , m_matchJobsTimer(this, &InspectorDOMAgent::onMatchJobsTimer)
 {
@@ -237,6 +242,11 @@ void InspectorDOMAgent::reset()
     ASSERT(!m_documents.size());
 }
 
+void InspectorDOMAgent::setDOMListener(DOMListener* listener)
+{
+    m_domListener = listener;
+}
+
 void InspectorDOMAgent::setDocument(Document* doc)
 {
     if (doc == mainFrameDocument())
@@ -326,6 +336,8 @@ void InspectorDOMAgent::unbind(Node* node, NodeToIdMap* nodesMap)
     if (node->isFrameOwnerElement()) {
         const HTMLFrameOwnerElement* frameOwner = static_cast<const HTMLFrameOwnerElement*>(node);
         stopListening(frameOwner->contentDocument());
+        if (m_domListener)
+            m_domListener->didRemoveDocument(frameOwner->contentDocument());
         cssStore()->removeDocument(frameOwner->contentDocument());
     }
 
@@ -473,7 +485,7 @@ void InspectorDOMAgent::removeNode(long nodeId, long* outNodeId)
     if (!node)
         return;
 
-    Node* parentNode = node->parentNode();
+    ContainerNode* parentNode = node->parentNode();
     if (!parentNode)
         return;
 
@@ -508,7 +520,7 @@ void InspectorDOMAgent::changeTagName(long nodeId, const String& tagName, long*
         newElem->appendChild(child, ec);
 
     // Replace the old node with the new node
-    Node* parent = oldNode->parentNode();
+    ContainerNode* parent = oldNode->parentNode();
     parent->insertBefore(newElem, oldNode->nextSibling(), ec);
     parent->removeChild(oldNode, ec);
 
@@ -539,7 +551,7 @@ void InspectorDOMAgent::setOuterHTML(long nodeId, const String& outerHTML, long*
 
     bool childrenRequested = m_childrenRequested.contains(nodeId);
     Node* previousSibling = node->previousSibling();
-    Node* parentNode = node->parentNode();
+    ContainerNode* parentNode = node->parentNode();
 
     HTMLElement* htmlElement = static_cast<HTMLElement*>(node);
     ExceptionCode ec = 0;
@@ -743,11 +755,17 @@ void InspectorDOMAgent::searchCanceled()
     m_searchResults.clear();
 }
 
-void InspectorDOMAgent::setDOMBreakpoint(long nodeId, long type)
+String InspectorDOMAgent::setDOMBreakpoint(long nodeId, long type)
 {
     Node* node = nodeForId(nodeId);
     if (!node)
-        return;
+        return "";
+
+    String breakpointId = createBreakpointId(nodeId, type);
+    if (m_idToBreakpoint.contains(breakpointId))
+        return "";
+
+    m_idToBreakpoint.set(breakpointId, std::make_pair(nodeId, type));
 
     uint32_t rootBit = 1 << type;
     m_breakpoints.set(node, m_breakpoints.get(node) | rootBit);
@@ -755,15 +773,19 @@ void InspectorDOMAgent::setDOMBreakpoint(long nodeId, long type)
         for (Node* child = innerFirstChild(node); child; child = innerNextSibling(child))
             updateSubtreeBreakpoints(child, rootBit, true);
     }
+
+    return breakpointId;
 }
 
-void InspectorDOMAgent::removeDOMBreakpoint(long nodeId, long type)
+void InspectorDOMAgent::removeDOMBreakpoint(const String& breakpointId)
 {
-    Node* node = nodeForId(nodeId);
+    Breakpoint breakpoint = m_idToBreakpoint.take(breakpointId);
+
+    Node* node = nodeForId(breakpoint.first);
     if (!node)
         return;
 
-    uint32_t rootBit = 1 << type;
+    uint32_t rootBit = 1 << breakpoint.second;
     uint32_t mask = m_breakpoints.get(node) & ~rootBit;
     if (mask)
         m_breakpoints.set(node, mask);
@@ -835,11 +857,7 @@ PassRefPtr<InspectorValue> InspectorDOMAgent::descriptionForDOMEvent(Node* targe
 
     long breakpointOwnerNodeId = m_documentNodeToIdMap.get(breakpointOwner);
     ASSERT(breakpointOwnerNodeId);
-
-    RefPtr<InspectorObject> breakpoint = InspectorObject::create();
-    breakpoint->setNumber("nodeId", breakpointOwnerNodeId);
-    breakpoint->setNumber("type", breakpointType);
-    description->setObject("breakpoint", breakpoint);
+    description->setString("breakpointId", createBreakpointId(breakpointOwnerNodeId, breakpointType));
 
     return description;
 }
@@ -1016,8 +1034,8 @@ unsigned InspectorDOMAgent::innerChildNodeCount(Node* node)
 
 Node* InspectorDOMAgent::innerParentNode(Node* node)
 {
-    Node* parent = node->parentNode();
-    if (parent && parent->nodeType() == Node::DOCUMENT_NODE)
+    ContainerNode* parent = node->parentNode();
+    if (parent && parent->isDocumentNode())
         return static_cast<Document*>(parent)->ownerElement();
     return parent;
 }
@@ -1058,7 +1076,7 @@ void InspectorDOMAgent::didInsertDOMNode(Node* node)
     // We could be attaching existing subtree. Forget the bindings.
     unbind(node, &m_documentNodeToIdMap);
 
-    Node* parent = node->parentNode();
+    ContainerNode* parent = node->parentNode();
     long parentId = m_documentNodeToIdMap.get(parent);
     // Return if parent is not mapped yet.
     if (!parentId)
@@ -1083,25 +1101,28 @@ void InspectorDOMAgent::didRemoveDOMNode(Node* node)
 
     if (m_breakpoints.size()) {
         // Remove subtree breakpoints.
-        m_breakpoints.remove(node);
+        removeBreakpointsForNode(node);
         Vector<Node*> stack(1, innerFirstChild(node));
         do {
             Node* node = stack.last();
             stack.removeLast();
             if (!node)
                 continue;
-            m_breakpoints.remove(node);
+            removeBreakpointsForNode(node);
             stack.append(innerFirstChild(node));
             stack.append(innerNextSibling(node));
         } while (!stack.isEmpty());
     }
 
-    Node* parent = node->parentNode();
+    ContainerNode* parent = node->parentNode();
     long parentId = m_documentNodeToIdMap.get(parent);
     // If parent is not mapped yet -> ignore the event.
     if (!parentId)
         return;
 
+    if (m_domListener)
+        m_domListener->didRemoveDOMNode(node);
+
     if (!m_childrenRequested.contains(parentId)) {
         // No children are mapped yet -> only notify on changes of hasChildren.
         if (innerChildNodeCount(parent) == 1)
@@ -1154,6 +1175,25 @@ void InspectorDOMAgent::updateSubtreeBreakpoints(Node* node, uint32_t rootMask,
         updateSubtreeBreakpoints(child, newRootMask, set);
 }
 
+void InspectorDOMAgent::removeBreakpointsForNode(Node* node)
+{
+    uint32_t mask = m_breakpoints.take(node);
+    if (!mask)
+        return;
+    long nodeId = m_documentNodeToIdMap.get(node);
+    if (!nodeId)
+        return;
+    for (int type = 0; type < DOMBreakpointTypesCount; ++type) {
+        if (mask && (1 << type))
+            m_idToBreakpoint.remove(createBreakpointId(nodeId, type));
+    }
+}
+
+String InspectorDOMAgent::createBreakpointId(long nodeId, long type)
+{
+    return makeString("dom:", String::number(nodeId), ':', String::number(type));
+}
+
 void InspectorDOMAgent::getStyles(long nodeId, bool authorOnly, RefPtr<InspectorValue>* styles)
 {
     Node* node = nodeForId(nodeId);
@@ -1221,18 +1261,25 @@ void InspectorDOMAgent::getStyleSourceData(long styleId, RefPtr<InspectorObject>
     CSSStyleDeclaration* style = cssStore()->styleForId(styleId);
     if (!style)
         return;
-    RefPtr<CSSStyleSourceData> sourceData = CSSStyleSourceData::create();
-    bool success = cssStore()->getStyleSourceData(style, &sourceData);
+    RefPtr<CSSRuleSourceData> sourceData = CSSRuleSourceData::create();
+    bool success = cssStore()->getRuleSourceData(style, &sourceData);
     if (!success)
         return;
     RefPtr<InspectorObject> result = InspectorObject::create();
+
     RefPtr<InspectorObject> bodyRange = InspectorObject::create();
     result->setObject("bodyRange", bodyRange);
-    bodyRange->setNumber("start", sourceData->styleBodyRange.start);
-    bodyRange->setNumber("end", sourceData->styleBodyRange.end);
+    bodyRange->setNumber("start", sourceData->styleSourceData->styleBodyRange.start);
+    bodyRange->setNumber("end", sourceData->styleSourceData->styleBodyRange.end);
+
+    RefPtr<InspectorObject> selectorRange = InspectorObject::create();
+    result->setObject("selectorRange", selectorRange);
+    selectorRange->setNumber("start", sourceData->selectorListRange.start);
+    selectorRange->setNumber("end", sourceData->selectorListRange.end);
+
     RefPtr<InspectorArray> propertyRanges = InspectorArray::create();
     result->setArray("propertyData", propertyRanges);
-    Vector<CSSPropertySourceData>& propertyData = sourceData->propertyData;
+    Vector<CSSPropertySourceData>& propertyData = sourceData->styleSourceData->propertyData;
     for (Vector<CSSPropertySourceData>::iterator it = propertyData.begin(); it != propertyData.end(); ++it) {
         RefPtr<InspectorObject> propertyRange = InspectorObject::create();
         propertyRange->setString("name", it->name);
@@ -1311,7 +1358,7 @@ PassRefPtr<InspectorArray> InspectorDOMAgent::buildArrayForPseudoElements(Elemen
     return result.release();
 }
 
-void InspectorDOMAgent::applyStyleText(long styleId, const String& styleText, const String& propertyName, bool* success, RefPtr<InspectorValue>* styleObject, RefPtr<InspectorArray>* changedPropertiesArray)
+void InspectorDOMAgent::applyStyleText(long styleId, const String& styleText, const String& propertyName, bool* success, RefPtr<InspectorValue>* styleObject)
 {
     CSSStyleDeclaration* style = cssStore()->styleForId(styleId);
     if (!style)
@@ -1348,7 +1395,6 @@ void InspectorDOMAgent::applyStyleText(long styleId, const String& styleText, co
 
     // Notify caller that the property was successfully deleted.
     if (!styleTextLength) {
-        (*changedPropertiesArray)->pushString(propertyName);
         *success = true;
         return;
     }
@@ -1359,7 +1405,6 @@ void InspectorDOMAgent::applyStyleText(long styleId, const String& styleText, co
     // Iterate of the properties on the test element's style declaration and
     // add them to the real style declaration. We take care to move shorthands.
     HashSet<String> foundShorthands;
-    Vector<String> changedProperties;
 
     for (unsigned i = 0; i < tempStyle->length(); ++i) {
         String name = tempStyle->item(i);
@@ -1386,11 +1431,9 @@ void InspectorDOMAgent::applyStyleText(long styleId, const String& styleText, co
         // Remove disabled property entry for property with this name.
         if (disabledStyle)
             disabledStyle->remove(name);
-        changedProperties.append(name);
     }
     *success = true;
     *styleObject = buildObjectForStyle(style, true);
-    *changedPropertiesArray = toArray(changedProperties);
 }
 
 void InspectorDOMAgent::setStyleText(long styleId, const String& cssText, bool* success)
@@ -1493,6 +1536,7 @@ void InspectorDOMAgent::getSupportedCSSProperties(RefPtr<InspectorArray>* cssPro
     RefPtr<InspectorArray> properties = InspectorArray::create();
     for (int i = 0; i < numCSSProperties; ++i)
         properties->pushString(propertyNameStrings[i]);
+
     *cssProperties = properties.release();
 }
 
diff --git a/WebCore/inspector/InspectorDOMAgent.h b/WebCore/inspector/InspectorDOMAgent.h
index 89c6fd0..03e4d8d 100644
--- a/WebCore/inspector/InspectorDOMAgent.h
+++ b/WebCore/inspector/InspectorDOMAgent.h
@@ -80,6 +80,14 @@ namespace WebCore {
 
     class InspectorDOMAgent : public EventListener {
     public:
+        struct DOMListener {
+            virtual ~DOMListener()
+            {
+            }
+            virtual void didRemoveDocument(Document*) = 0;
+            virtual void didRemoveDOMNode(Node*) = 0;
+        };
+
         static PassRefPtr<InspectorDOMAgent> create(InspectorCSSStore* cssStore, InspectorFrontend* frontend)
         {
             return adoptRef(new InspectorDOMAgent(cssStore, frontend));
@@ -112,8 +120,6 @@ namespace WebCore {
         void addInspectedNode(long nodeId);
         void performSearch(const String& whitespaceTrimmedQuery, bool runSynchronously);
         void searchCanceled();
-        void setDOMBreakpoint(long nodeId, long type);
-        void removeDOMBreakpoint(long nodeId, long type);
         bool shouldBreakOnNodeInsertion(Node* node, Node* parent, PassRefPtr<InspectorValue>* details);
         bool shouldBreakOnNodeRemoval(Node* node, PassRefPtr<InspectorValue>* details);
         bool shouldBreakOnAttributeModification(Element* element, PassRefPtr<InspectorValue>* details);
@@ -125,7 +131,7 @@ namespace WebCore {
         void getComputedStyle(long nodeId, RefPtr<InspectorValue>* styles);
         void getStyleSheet(long styleSheetId, RefPtr<InspectorObject>* styleSheetObject);
         void getStyleSourceData(long styleId, RefPtr<InspectorObject>* dataObject);
-        void applyStyleText(long styleId, const String& styleText, const String& propertyName, bool* success, RefPtr<InspectorValue>* styleObject, RefPtr<InspectorArray>* changedProperties);
+        void applyStyleText(long styleId, const String& styleText, const String& propertyName, bool* success, RefPtr<InspectorValue>* styleObject);
         void setStyleText(long styleId, const String& cssText, bool* success);
         void setStyleProperty(long styleId, const String& name, const String& value, bool* success);
         void toggleStyleEnabled(long styleId, const String& propertyName, bool disabled, RefPtr<InspectorValue>* styleObject);
@@ -148,6 +154,13 @@ namespace WebCore {
         void pushNodeByPathToFrontend(const String& path, long* nodeId);
         long inspectedNode(unsigned long num);
         void copyNode(long nodeId);
+        const ListHashSet<RefPtr<Document> >& documents() { return m_documents; }
+        void setDOMListener(DOMListener*);
+
+        String documentURLString(Document* document) const;
+
+        String setDOMBreakpoint(long nodeId, long type);
+        void removeDOMBreakpoint(const String& breakpointId);
 
     private:
         void startListening(Document* document);
@@ -164,7 +177,9 @@ namespace WebCore {
 
         bool hasBreakpoint(Node* node, long type);
         void updateSubtreeBreakpoints(Node* root, uint32_t rootMask, bool value);
+        void removeBreakpointsForNode(Node* node);
         PassRefPtr<InspectorValue> descriptionForDOMEvent(Node* target, long breakpointType, bool insertion);
+        String createBreakpointId(long nodeId, long type);
 
         PassRefPtr<InspectorObject> buildObjectForAttributeStyles(Element* element);
         PassRefPtr<InspectorArray> buildArrayForCSSRules(Document* ownerDocument, CSSRuleList*);
@@ -185,7 +200,6 @@ namespace WebCore {
         bool isWhitespace(Node* node);
 
         Document* mainFrameDocument() const;
-        String documentURLString(Document* document) const;
         InspectorCSSStore* cssStore() { return m_cssStore; }
 
         void onMatchJobsTimer(Timer<InspectorDOMAgent>*);
@@ -207,6 +221,7 @@ namespace WebCore {
 
         InspectorCSSStore* m_cssStore;
         InspectorFrontend* m_frontend;
+        DOMListener* m_domListener;
         NodeToIdMap m_documentNodeToIdMap;
         // Owns node mappings for dangling nodes.
         Vector<NodeToIdMap*> m_danglingNodeToIdMaps;
@@ -220,6 +235,8 @@ namespace WebCore {
         HashSet<RefPtr<Node> > m_searchResults;
         Vector<long> m_inspectedNodes;
         HashMap<Node*, uint32_t> m_breakpoints;
+        typedef pair<long, long> Breakpoint;
+        HashMap<String, Breakpoint> m_idToBreakpoint;
     };
 
 #endif
diff --git a/WebCore/inspector/InspectorDebuggerAgent.cpp b/WebCore/inspector/InspectorDebuggerAgent.cpp
index 4964c09..a7eacf6 100644
--- a/WebCore/inspector/InspectorDebuggerAgent.cpp
+++ b/WebCore/inspector/InspectorDebuggerAgent.cpp
@@ -38,13 +38,13 @@
 #include "PlatformString.h"
 #include "ScriptDebugServer.h"
 #include <wtf/MD5.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
 static String formatBreakpointId(const String& sourceID, unsigned lineNumber)
 {
-    return String::format("%s:%d", sourceID.utf8().data(), lineNumber);
+    return makeString(sourceID, ':', String::number(lineNumber));
 }
 
 PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InspectorController* inspectorController, InspectorFrontend* frontend)
@@ -57,8 +57,6 @@ PassOwnPtr<InspectorDebuggerAgent> InspectorDebuggerAgent::create(InspectorContr
     return agent.release();
 }
 
-InspectorDebuggerAgent* InspectorDebuggerAgent::s_debuggerAgentOnBreakpoint = 0;
-
 InspectorDebuggerAgent::InspectorDebuggerAgent(InspectorController* inspectorController, InspectorFrontend* frontend)
     : m_inspectorController(inspectorController)
     , m_frontend(frontend)
@@ -71,9 +69,6 @@ InspectorDebuggerAgent::~InspectorDebuggerAgent()
 {
     ScriptDebugServer::shared().removeListener(this, m_inspectorController->inspectedPage());
     m_pausedScriptState = 0;
-
-    if (this == s_debuggerAgentOnBreakpoint)
-        s_debuggerAgentOnBreakpoint = 0;
 }
 
 bool InspectorDebuggerAgent::isDebuggerAlwaysEnabled()
@@ -147,9 +142,23 @@ void InspectorDebuggerAgent::getScriptSource(const String& sourceID, String* scr
     *scriptSource = m_scriptIDToContent.get(sourceID);
 }
 
+void InspectorDebuggerAgent::schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data)
+{
+    m_breakProgramDetails = InspectorObject::create();
+    m_breakProgramDetails->setNumber("eventType", type);
+    m_breakProgramDetails->setValue("eventData", data);
+    ScriptDebugServer::shared().setPauseOnNextStatement(true);
+}
+
+void InspectorDebuggerAgent::cancelPauseOnNextStatement()
+{
+    m_breakProgramDetails = 0;
+    ScriptDebugServer::shared().setPauseOnNextStatement(false);
+}
+
 void InspectorDebuggerAgent::pause()
 {
-    ScriptDebugServer::shared().pause();
+    schedulePauseOnNextStatement(JavaScriptPauseEventType, InspectorObject::create());
 }
 
 void InspectorDebuggerAgent::resume()
@@ -305,6 +314,7 @@ void InspectorDebuggerAgent::didPause(ScriptState* scriptState)
 void InspectorDebuggerAgent::didContinue()
 {
     m_pausedScriptState = 0;
+    m_breakProgramDetails = 0;
     m_frontend->resumedScript();
 }
 
@@ -313,14 +323,7 @@ void InspectorDebuggerAgent::breakProgram(DebuggerEventType type, PassRefPtr<Ins
     m_breakProgramDetails = InspectorObject::create();
     m_breakProgramDetails->setNumber("eventType", type);
     m_breakProgramDetails->setValue("eventData", data);
-    s_debuggerAgentOnBreakpoint = this;
-
     ScriptDebugServer::shared().breakProgram();
-    if (!s_debuggerAgentOnBreakpoint)
-        return;
-
-    s_debuggerAgentOnBreakpoint = 0;
-    m_breakProgramDetails = 0;
 }
 
 } // namespace WebCore
diff --git a/WebCore/inspector/InspectorDebuggerAgent.h b/WebCore/inspector/InspectorDebuggerAgent.h
index 8a5379d..3825042 100644
--- a/WebCore/inspector/InspectorDebuggerAgent.h
+++ b/WebCore/inspector/InspectorDebuggerAgent.h
@@ -47,7 +47,8 @@ class InspectorObject;
 class InspectorValue;
 
 enum DebuggerEventType {
-    DOMBreakpointDebuggerEventType,
+    JavaScriptPauseEventType,
+    JavaScriptBreakpointEventType,
     NativeBreakpointDebuggerEventType
 };
 
@@ -66,8 +67,10 @@ public:
     void editScriptSource(const String& sourceID, const String& newContent, bool* success, String* result, RefPtr<InspectorValue>* newCallFrames);
     void getScriptSource(const String& sourceID, String* scriptSource);
 
-    void pause();
+    void schedulePauseOnNextStatement(DebuggerEventType type, PassRefPtr<InspectorValue> data);
+    void cancelPauseOnNextStatement();
     void breakProgram(DebuggerEventType type, PassRefPtr<InspectorValue> data);
+    void pause();
     void resume();
     void stepOverStatement();
     void stepIntoStatement();
diff --git a/WebCore/inspector/InspectorFrontendClientLocal.cpp b/WebCore/inspector/InspectorFrontendClientLocal.cpp
index 77616da..4812b2a 100644
--- a/WebCore/inspector/InspectorFrontendClientLocal.cpp
+++ b/WebCore/inspector/InspectorFrontendClientLocal.cpp
@@ -47,7 +47,6 @@
 
 namespace WebCore {
 
-static const char* const inspectorAttachedHeightName = "inspectorAttachedHeight";
 static const unsigned defaultAttachedHeight = 300;
 static const float minimumAttachedHeight = 250.0f;
 static const float maximumAttachedHeightRatio = 0.75f;
@@ -108,7 +107,7 @@ void InspectorFrontendClientLocal::changeAttachedWindowHeight(unsigned height)
 {
     unsigned totalHeight = m_frontendPage->mainFrame()->view()->visibleHeight() + m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
     unsigned attachedHeight = constrainedAttachedWindowHeight(height, totalHeight);
-    m_inspectorController->setSetting(inspectorAttachedHeightName, String::number(attachedHeight));
+    m_inspectorController->setInspectorAttachedHeight(attachedHeight);
     setAttachedWindowHeight(attachedHeight);
 }
 
@@ -134,10 +133,9 @@ void InspectorFrontendClientLocal::setAttachedWindow(bool attached)
 void InspectorFrontendClientLocal::restoreAttachedWindowHeight()
 {
     unsigned inspectedPageHeight = m_inspectorController->inspectedPage()->mainFrame()->view()->visibleHeight();
-    String attachedHeight = m_inspectorController->setting(inspectorAttachedHeightName);
+    int attachedHeight = m_inspectorController->inspectorAttachedHeight();
     bool success = true;
-    int height = attachedHeight.toInt(&success);
-    unsigned preferredHeight = success ? static_cast<unsigned>(height) : defaultAttachedHeight;
+    unsigned preferredHeight = success ? static_cast<unsigned>(attachedHeight) : defaultAttachedHeight;
     
     // This call might not go through (if the window starts out detached), but if the window is initially created attached,
     // InspectorController::attachWindow is never called, so we need to make sure to set the attachedWindowHeight.
diff --git a/WebCore/inspector/InspectorInstrumentation.cpp b/WebCore/inspector/InspectorInstrumentation.cpp
new file mode 100644
index 0000000..ae89266
--- /dev/null
+++ b/WebCore/inspector/InspectorInstrumentation.cpp
@@ -0,0 +1,462 @@
+/*
+* Copyright (C) 2010 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#include "config.h"
+#include "InspectorInstrumentation.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "DOMWindow.h"
+#include "Event.h"
+#include "InspectorController.h"
+#include "InspectorDOMAgent.h"
+#include "InspectorDebuggerAgent.h"
+#include "InspectorTimelineAgent.h"
+#include "XMLHttpRequest.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+static const char* const listenerEventCategoryType = "listener";
+static const char* const instrumentationEventCategoryType = "instrumentation";
+
+static const char* const setTimerEventName = "setTimer";
+static const char* const clearTimerEventName = "clearTimer";
+static const char* const timerFiredEventName = "timerFired";
+
+int InspectorInstrumentation::s_frontendCounter = 0;
+
+static bool eventHasListeners(const AtomicString& eventType, DOMWindow* window, Node* node, const Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    if (window && window->hasEventListeners(eventType))
+        return true;
+
+    if (node->hasEventListeners(eventType))
+        return true;
+
+    for (size_t i = 0; i < ancestors.size(); i++) {
+        ContainerNode* ancestor = ancestors[i].get();
+        if (ancestor->hasEventListeners(eventType))
+            return true;
+    }
+
+    return false;
+}
+
+void InspectorInstrumentation::willInsertDOMNodeImpl(InspectorController* inspectorController, Node* node, Node* parent)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get();
+    if (!debuggerAgent)
+        return;
+    InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get();
+    if (!domAgent)
+        return;
+    PassRefPtr<InspectorValue> eventData;
+    if (domAgent->shouldBreakOnNodeInsertion(node, parent, &eventData))
+        debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
+#endif
+}
+
+void InspectorInstrumentation::didInsertDOMNodeImpl(InspectorController* inspectorController, Node* node)
+{
+    if (InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get())
+        domAgent->didInsertDOMNode(node);
+}
+
+void InspectorInstrumentation::willRemoveDOMNodeImpl(InspectorController* inspectorController, Node* node)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get();
+    if (!debuggerAgent)
+        return;
+    InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get();
+    if (!domAgent)
+        return;
+    PassRefPtr<InspectorValue> eventData;
+    if (domAgent->shouldBreakOnNodeRemoval(node, &eventData))
+        debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
+#endif
+}
+
+void InspectorInstrumentation::didRemoveDOMNodeImpl(InspectorController* inspectorController, Node* node)
+{
+    if (InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get())
+        domAgent->didRemoveDOMNode(node);
+}
+
+void InspectorInstrumentation::willModifyDOMAttrImpl(InspectorController* inspectorController, Element* element)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get();
+    if (!debuggerAgent)
+        return;
+    InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get();
+    if (!domAgent)
+        return;
+    PassRefPtr<InspectorValue> eventData;
+    if (domAgent->shouldBreakOnAttributeModification(element, &eventData))
+        debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
+#endif
+}
+
+void InspectorInstrumentation::didModifyDOMAttrImpl(InspectorController* inspectorController, Element* element)
+{
+    if (InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get())
+        domAgent->didModifyDOMAttr(element);
+}
+
+void InspectorInstrumentation::characterDataModifiedImpl(InspectorController* inspectorController, CharacterData* characterData)
+{
+    if (InspectorDOMAgent* domAgent = inspectorController->m_domAgent.get())
+        domAgent->characterDataModified(characterData);
+}
+
+
+void InspectorInstrumentation::willSendXMLHttpRequestImpl(InspectorController* inspectorController, const String& url)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get();
+    if (!debuggerAgent)
+        return;
+
+    String breakpointId = inspectorController->findXHRBreakpoint(url);
+    if (breakpointId.isEmpty())
+        return;
+
+    RefPtr<InspectorObject> eventData = InspectorObject::create();
+    eventData->setString("breakpointId", breakpointId);
+    eventData->setString("url", url);
+    debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
+#endif
+}
+
+void InspectorInstrumentation::didScheduleResourceRequestImpl(InspectorController* inspectorController, const String& url)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+        timelineAgent->didScheduleResourceRequest(url);
+}
+
+void InspectorInstrumentation::didInstallTimerImpl(InspectorController* inspectorController, int timerId, int timeout, bool singleShot)
+{
+    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, setTimerEventName, true);
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+        timelineAgent->didInstallTimer(timerId, timeout, singleShot);
+}
+
+void InspectorInstrumentation::didRemoveTimerImpl(InspectorController* inspectorController, int timerId)
+{
+    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, clearTimerEventName, true);
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController))
+        timelineAgent->didRemoveTimer(timerId);
+}
+
+
+InspectorInstrumentationCookie InspectorInstrumentation::willCallFunctionImpl(InspectorController* inspectorController, const String& scriptName, int scriptLine)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willCallFunction(scriptName, scriptLine);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didCallFunctionImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didCallFunction();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willChangeXHRReadyStateImpl(InspectorController* inspectorController, XMLHttpRequest* request)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent && request->hasEventListeners(eventNames().readystatechangeEvent)) {
+        timelineAgent->willChangeXHRReadyState(request->url().string(), request->readyState());
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didChangeXHRReadyStateImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didChangeXHRReadyState();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventImpl(InspectorController* inspectorController, const Event& event, DOMWindow* window, Node* node, const Vector<RefPtr<ContainerNode> >& ancestors)
+{
+    pauseOnNativeEventIfNeeded(inspectorController, listenerEventCategoryType, event.type(), false);
+
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent && eventHasListeners(event.type(), window, node, ancestors)) {
+        timelineAgent->willDispatchEvent(event);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didDispatchEventImpl(const InspectorInstrumentationCookie& cookie)
+{
+    cancelPauseOnNativeEvent(cookie.first);
+
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didDispatchEvent();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventOnWindowImpl(InspectorController* inspectorController, const Event& event, DOMWindow* window)
+{
+    pauseOnNativeEventIfNeeded(inspectorController, listenerEventCategoryType, event.type(), false);
+
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent && window->hasEventListeners(event.type())) {
+        timelineAgent->willDispatchEvent(event);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didDispatchEventOnWindowImpl(const InspectorInstrumentationCookie& cookie)
+{
+    cancelPauseOnNativeEvent(cookie.first);
+
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didDispatchEvent();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willEvaluateScriptImpl(InspectorController* inspectorController, const String& url, int lineNumber)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willEvaluateScript(url, lineNumber);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didEvaluateScriptImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didEvaluateScript();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willFireTimerImpl(InspectorController* inspectorController, int timerId)
+{
+    pauseOnNativeEventIfNeeded(inspectorController, instrumentationEventCategoryType, timerFiredEventName, false);
+
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willFireTimer(timerId);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didFireTimerImpl(const InspectorInstrumentationCookie& cookie)
+{
+    cancelPauseOnNativeEvent(cookie.first);
+
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didFireTimer();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willLayoutImpl(InspectorController* inspectorController)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willLayout();
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didLayoutImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didLayout();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willLoadXHRImpl(InspectorController* inspectorController, XMLHttpRequest* request)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent && request->hasEventListeners(eventNames().loadEvent)) {
+        timelineAgent->willLoadXHR(request->url());
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didLoadXHRImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didLoadXHR();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willPaintImpl(InspectorController* inspectorController, const IntRect& rect)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willPaint(rect);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didPaintImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didPaint();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyleImpl(InspectorController* inspectorController)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willRecalculateStyle();
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didRecalculateStyleImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didRecalculateStyle();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceDataImpl(InspectorController* inspectorController, unsigned long identifier)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willReceiveResourceData(identifier);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didReceiveResourceDataImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didReceiveResourceData();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponseImpl(InspectorController* inspectorController, unsigned long identifier, const ResourceResponse& response)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willReceiveResourceResponse(identifier, response);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didReceiveResourceResponseImpl(const InspectorInstrumentationCookie& cookie)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didReceiveResourceResponse();
+}
+
+InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTMLImpl(InspectorController* inspectorController, unsigned int length, unsigned int startLine)
+{
+    int timelineAgentId = 0;
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(inspectorController);
+    if (timelineAgent) {
+        timelineAgent->willWriteHTML(length, startLine);
+        timelineAgentId = timelineAgent->id();
+    }
+    return InspectorInstrumentationCookie(inspectorController, timelineAgentId);
+}
+
+void InspectorInstrumentation::didWriteHTMLImpl(const InspectorInstrumentationCookie& cookie, unsigned int endLine)
+{
+    if (InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie))
+        timelineAgent->didWriteHTML(endLine);
+}
+
+bool InspectorInstrumentation::hasFrontend(InspectorController* inspectorController)
+{
+    return inspectorController->hasFrontend();
+}
+
+void InspectorInstrumentation::pauseOnNativeEventIfNeeded(InspectorController* inspectorController, const String& categoryType, const String& eventName, bool synchronous)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get();
+    if (!debuggerAgent)
+        return;
+    String fullEventName = String::format("%s:%s", categoryType.utf8().data(), eventName.utf8().data());
+    String breakpointId = inspectorController->findEventListenerBreakpoint(fullEventName);
+    if (breakpointId.isEmpty())
+        return;
+    RefPtr<InspectorObject> eventData = InspectorObject::create();
+    eventData->setString("breakpointId", breakpointId);
+    if (synchronous)
+        debuggerAgent->breakProgram(NativeBreakpointDebuggerEventType, eventData);
+    else
+        debuggerAgent->schedulePauseOnNextStatement(NativeBreakpointDebuggerEventType, eventData);
+#endif
+}
+
+void InspectorInstrumentation::cancelPauseOnNativeEvent(InspectorController* inspectorController)
+{
+#if ENABLE(JAVASCRIPT_DEBUGGER)
+    if (InspectorDebuggerAgent* debuggerAgent = inspectorController->m_debuggerAgent.get())
+        debuggerAgent->cancelPauseOnNextStatement();
+#endif
+}
+
+InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(InspectorController* inspectorController)
+{
+    return inspectorController->m_timelineAgent.get();
+}
+
+InspectorTimelineAgent* InspectorInstrumentation::retrieveTimelineAgent(const InspectorInstrumentationCookie& cookie)
+{
+    InspectorTimelineAgent* timelineAgent = retrieveTimelineAgent(cookie.first);
+    if (timelineAgent && timelineAgent->id() == cookie.second)
+        return timelineAgent;
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // !ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorInstrumentation.h b/WebCore/inspector/InspectorInstrumentation.h
new file mode 100644
index 0000000..e728a5e
--- /dev/null
+++ b/WebCore/inspector/InspectorInstrumentation.h
@@ -0,0 +1,500 @@
+/*
+* Copyright (C) 2010 Google Inc. All rights reserved.
+*
+* Redistribution and use in source and binary forms, with or without
+* modification, are permitted provided that the following conditions are
+* met:
+*
+*     * Redistributions of source code must retain the above copyright
+* notice, this list of conditions and the following disclaimer.
+*     * Redistributions in binary form must reproduce the above
+* copyright notice, this list of conditions and the following disclaimer
+* in the documentation and/or other materials provided with the
+* distribution.
+*     * Neither the name of Google Inc. nor the names of its
+* contributors may be used to endorse or promote products derived from
+* this software without specific prior written permission.
+*
+* THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+* "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+* LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+* A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+* OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+* DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+* THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+* (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+* OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+*/
+
+#ifndef InspectorInstrumentation_h
+#define InspectorInstrumentation_h
+
+#include "Document.h"
+#include "Frame.h"
+#include "Page.h"
+#include "ScriptExecutionContext.h"
+
+namespace WebCore {
+
+class CharacterData;
+class Element;
+class InspectorController;
+class InspectorTimelineAgent;
+class Node;
+class ResourceRequest;
+class ResourceResponse;
+class XMLHttpRequest;
+
+typedef pair<InspectorController*, int> InspectorInstrumentationCookie;
+
+class InspectorInstrumentation {
+public:
+    static void willInsertDOMNode(Document*, Node*, Node* parent);
+    static void didInsertDOMNode(Document*, Node*);
+    static void willRemoveDOMNode(Document*, Node*);
+    static void willModifyDOMAttr(Document*, Element*);
+    static void didModifyDOMAttr(Document*, Element*);
+    static void characterDataModified(Document*, CharacterData*);
+
+    static void willSendXMLHttpRequest(ScriptExecutionContext*, const String& url);
+    static void didScheduleResourceRequest(Document*, const String& url);
+    static void didInstallTimer(ScriptExecutionContext*, int timerId, int timeout, bool singleShot);
+    static void didRemoveTimer(ScriptExecutionContext*, int timerId);
+
+    static InspectorInstrumentationCookie willCallFunction(Frame*, const String& scriptName, int scriptLine);
+    static void didCallFunction(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willChangeXHRReadyState(ScriptExecutionContext*, XMLHttpRequest* request);
+    static void didChangeXHRReadyState(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willDispatchEvent(Document*, const Event& event, DOMWindow* window, Node* node, const Vector<RefPtr<ContainerNode> >& ancestors);
+    static void didDispatchEvent(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willDispatchEventOnWindow(Frame*, const Event& event, DOMWindow* window);
+    static void didDispatchEventOnWindow(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willEvaluateScript(Frame*, const String& url, int lineNumber);
+    static void didEvaluateScript(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willFireTimer(ScriptExecutionContext*, int timerId);
+    static void didFireTimer(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willLayout(Frame*);
+    static void didLayout(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willLoadXHR(ScriptExecutionContext*, XMLHttpRequest*);
+    static void didLoadXHR(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willPaint(Frame*, const IntRect& rect);
+    static void didPaint(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willRecalculateStyle(Document*);
+    static void didRecalculateStyle(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willReceiveResourceData(Frame*, unsigned long identifier);
+    static void didReceiveResourceData(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willReceiveResourceResponse(Frame*, unsigned long identifier, const ResourceResponse& response);
+    static void didReceiveResourceResponse(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willWriteHTML(Document*, unsigned int length, unsigned int startLine);
+    static void didWriteHTML(const InspectorInstrumentationCookie&, unsigned int endLine);
+
+#if ENABLE(INSPECTOR)
+    static void frontendCreated() { s_frontendCounter += 1; }
+    static void frontendDeleted() { s_frontendCounter -= 1; }
+    static bool hasFrontends() { return s_frontendCounter; }
+#else
+    static bool hasFrontends() { return false; }
+#endif
+
+private:
+#if ENABLE(INSPECTOR)
+    static void willInsertDOMNodeImpl(InspectorController*, Node* node, Node* parent);
+    static void didInsertDOMNodeImpl(InspectorController*, Node*);
+    static void willRemoveDOMNodeImpl(InspectorController*, Node*);
+    static void didRemoveDOMNodeImpl(InspectorController*, Node*);
+    static void willModifyDOMAttrImpl(InspectorController*, Element*);
+    static void didModifyDOMAttrImpl(InspectorController*, Element*);
+    static void characterDataModifiedImpl(InspectorController*, CharacterData*);
+
+    static void willSendXMLHttpRequestImpl(InspectorController*, const String& url);
+    static void didScheduleResourceRequestImpl(InspectorController*, const String& url);
+    static void didInstallTimerImpl(InspectorController*, int timerId, int timeout, bool singleShot);
+    static void didRemoveTimerImpl(InspectorController*, int timerId);
+
+    static InspectorInstrumentationCookie willCallFunctionImpl(InspectorController*, const String& scriptName, int scriptLine);
+    static void didCallFunctionImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willChangeXHRReadyStateImpl(InspectorController*, XMLHttpRequest* request);
+    static void didChangeXHRReadyStateImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willDispatchEventImpl(InspectorController*, const Event& event, DOMWindow* window, Node* node, const Vector<RefPtr<ContainerNode> >& ancestors);
+    static void didDispatchEventImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willDispatchEventOnWindowImpl(InspectorController*, const Event& event, DOMWindow* window);
+    static void didDispatchEventOnWindowImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willEvaluateScriptImpl(InspectorController*, const String& url, int lineNumber);
+    static void didEvaluateScriptImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willFireTimerImpl(InspectorController*, int timerId);
+    static void didFireTimerImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willLayoutImpl(InspectorController*);
+    static void didLayoutImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willLoadXHRImpl(InspectorController*, XMLHttpRequest* request);
+    static void didLoadXHRImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willPaintImpl(InspectorController*, const IntRect& rect);
+    static void didPaintImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willRecalculateStyleImpl(InspectorController*);
+    static void didRecalculateStyleImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willReceiveResourceDataImpl(InspectorController*, unsigned long identifier);
+    static void didReceiveResourceDataImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willReceiveResourceResponseImpl(InspectorController*, unsigned long identifier, const ResourceResponse& response);
+    static void didReceiveResourceResponseImpl(const InspectorInstrumentationCookie&);
+    static InspectorInstrumentationCookie willWriteHTMLImpl(InspectorController*, unsigned int length, unsigned int startLine);
+    static void didWriteHTMLImpl(const InspectorInstrumentationCookie&, unsigned int endLine);
+
+    static InspectorController* inspectorControllerForContext(ScriptExecutionContext*);
+    static InspectorController* inspectorControllerForDocument(Document*);
+    static InspectorController* inspectorControllerForFrame(Frame*);
+    static InspectorController* inspectorControllerForPage(Page*);
+
+    static bool hasFrontend(InspectorController*);
+    static void pauseOnNativeEventIfNeeded(InspectorController*, const String& categoryType, const String& eventName, bool synchronous);
+    static void cancelPauseOnNativeEvent(InspectorController*);
+    static InspectorTimelineAgent* retrieveTimelineAgent(InspectorController*);
+    static InspectorTimelineAgent* retrieveTimelineAgent(const InspectorInstrumentationCookie&);
+
+    static int s_frontendCounter;
+#endif
+};
+
+inline void InspectorInstrumentation::willInsertDOMNode(Document* document, Node* node, Node* parent)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        willInsertDOMNodeImpl(inspectorController, node, parent);
+#endif
+}
+
+inline void InspectorInstrumentation::didInsertDOMNode(Document* document, Node* node)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        didInsertDOMNodeImpl(inspectorController, node);
+#endif
+}
+
+inline void InspectorInstrumentation::willRemoveDOMNode(Document* document, Node* node)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document)) {
+        willRemoveDOMNodeImpl(inspectorController, node);
+        didRemoveDOMNodeImpl(inspectorController, node);
+    }
+#endif
+}
+
+inline void InspectorInstrumentation::willModifyDOMAttr(Document* document, Element* element)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        willModifyDOMAttrImpl(inspectorController, element);
+#endif
+}
+
+inline void InspectorInstrumentation::didModifyDOMAttr(Document* document, Element* element)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        didModifyDOMAttrImpl(inspectorController, element);
+#endif
+}
+
+inline void InspectorInstrumentation::characterDataModified(Document* document, CharacterData* characterData)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        characterDataModifiedImpl(inspectorController, characterData);
+#endif
+}
+
+
+inline void InspectorInstrumentation::willSendXMLHttpRequest(ScriptExecutionContext* context, const String& url)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        willSendXMLHttpRequestImpl(inspectorController, url);
+#endif
+}
+
+inline void InspectorInstrumentation::didScheduleResourceRequest(Document* document, const String& url)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        didScheduleResourceRequestImpl(inspectorController, url);
+#endif
+}
+
+inline void InspectorInstrumentation::didInstallTimer(ScriptExecutionContext* context, int timerId, int timeout, bool singleShot)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        didInstallTimerImpl(inspectorController, timerId, timeout, singleShot);
+#endif
+}
+
+inline void InspectorInstrumentation::didRemoveTimer(ScriptExecutionContext* context, int timerId)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        didRemoveTimerImpl(inspectorController, timerId);
+#endif
+}
+
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willCallFunction(Frame* frame, const String& scriptName, int scriptLine)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willCallFunctionImpl(inspectorController, scriptName, scriptLine);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didCallFunction(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didCallFunctionImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willChangeXHRReadyState(ScriptExecutionContext* context, XMLHttpRequest* request)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        return willChangeXHRReadyStateImpl(inspectorController, request);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didChangeXHRReadyState(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didChangeXHRReadyStateImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEvent(Document* document, const Event& event, DOMWindow* window, Node* node, const Vector<RefPtr<ContainerNode> >& ancestors)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        return willDispatchEventImpl(inspectorController, event, window, node, ancestors);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didDispatchEvent(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didDispatchEventImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willDispatchEventOnWindow(Frame* frame, const Event& event, DOMWindow* window)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willDispatchEventOnWindowImpl(inspectorController, event, window);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didDispatchEventOnWindow(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didDispatchEventOnWindowImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willEvaluateScript(Frame* frame, const String& url, int lineNumber)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willEvaluateScriptImpl(inspectorController, url, lineNumber);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didEvaluateScript(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didEvaluateScriptImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willFireTimer(ScriptExecutionContext* context, int timerId)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        return willFireTimerImpl(inspectorController, timerId);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didFireTimer(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didFireTimerImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willLayout(Frame* frame)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willLayoutImpl(inspectorController);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didLayout(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didLayoutImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willLoadXHR(ScriptExecutionContext* context, XMLHttpRequest* request)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForContext(context))
+        return willLoadXHRImpl(inspectorController, request);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didLoadXHR(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didLoadXHRImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willPaint(Frame* frame, const IntRect& rect)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willPaintImpl(inspectorController, rect);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didPaint(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didPaintImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willRecalculateStyle(Document* document)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        return willRecalculateStyleImpl(inspectorController);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didRecalculateStyle(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didRecalculateStyleImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceData(Frame* frame, unsigned long identifier)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willReceiveResourceDataImpl(inspectorController, identifier);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didReceiveResourceData(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didReceiveResourceDataImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willReceiveResourceResponse(Frame* frame, unsigned long identifier, const ResourceResponse& response)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForFrame(frame))
+        return willReceiveResourceResponseImpl(inspectorController, identifier, response);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didReceiveResourceResponse(const InspectorInstrumentationCookie& cookie)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didReceiveResourceResponseImpl(cookie);
+#endif
+}
+
+inline InspectorInstrumentationCookie InspectorInstrumentation::willWriteHTML(Document* document, unsigned int length, unsigned int startLine)
+{
+#if ENABLE(INSPECTOR)
+    if (InspectorController* inspectorController = inspectorControllerForDocument(document))
+        return willWriteHTMLImpl(inspectorController, length, startLine);
+#endif
+    return InspectorInstrumentationCookie();
+}
+
+inline void InspectorInstrumentation::didWriteHTML(const InspectorInstrumentationCookie& cookie, unsigned int endLine)
+{
+#if ENABLE(INSPECTOR)
+    if (hasFrontends() && cookie.first)
+        didWriteHTMLImpl(cookie, endLine);
+#endif
+}
+
+
+#if ENABLE(INSPECTOR)
+inline InspectorController* InspectorInstrumentation::inspectorControllerForContext(ScriptExecutionContext* context)
+{
+    if (hasFrontends() && context && context->isDocument())
+        return inspectorControllerForPage(static_cast<Document*>(context)->page());
+    return 0;
+}
+
+inline InspectorController* InspectorInstrumentation::inspectorControllerForDocument(Document* document)
+{
+    if (hasFrontends() && document)
+        return inspectorControllerForPage(document->page());
+    return 0;
+}
+
+inline InspectorController* InspectorInstrumentation::inspectorControllerForFrame(Frame* frame)
+{
+    if (hasFrontends() && frame)
+        return inspectorControllerForPage(frame->page());
+    return 0;
+}
+
+inline InspectorController* InspectorInstrumentation::inspectorControllerForPage(Page* page)
+{
+    if (page) {
+        if (InspectorController* inspectorController = page->inspectorController()) {
+            if (hasFrontend(inspectorController))
+                return inspectorController;
+        }
+    }
+    return 0;
+}
+#endif
+
+} // namespace WebCore
+
+#endif // !defined(InspectorInstrumentation_h)
diff --git a/WebCore/inspector/InspectorProfilerAgent.cpp b/WebCore/inspector/InspectorProfilerAgent.cpp
index 09b2b32..71c7231 100644
--- a/WebCore/inspector/InspectorProfilerAgent.cpp
+++ b/WebCore/inspector/InspectorProfilerAgent.cpp
@@ -43,7 +43,7 @@
 #include "ScriptProfile.h"
 #include "ScriptProfiler.h"
 #include <wtf/OwnPtr.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #if USE(JSC)
 #include "JSDOMWindow.h"
@@ -89,13 +89,13 @@ void InspectorProfilerAgent::addProfileFinishedMessageToConsole(PassRefPtr<Scrip
 {
     RefPtr<ScriptProfile> profile = prpProfile;
     String title = profile->title();
-    String message = String::format("Profile \"webkit-profile://%s/%s#%d\" finished.", CPUProfileType, encodeWithURLEscapeSequences(title).utf8().data(), profile->uid());
+    String message = makeString("Profile \"webkit-profile://", CPUProfileType, '/', encodeWithURLEscapeSequences(title), '#', String::number(profile->uid()), "\" finished.");
     m_inspectorController->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
 void InspectorProfilerAgent::addStartProfilingMessageToConsole(const String& title, unsigned lineNumber, const String& sourceURL)
 {
-    String message = String::format("Profile \"webkit-profile://%s/%s#0\" started.", CPUProfileType, encodeWithURLEscapeSequences(title).utf8().data());
+    String message = makeString("Profile \"webkit-profile://", CPUProfileType, '/', encodeWithURLEscapeSequences(title), "#0 \" started.");
     m_inspectorController->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lineNumber, sourceURL);
 }
 
@@ -143,7 +143,7 @@ String InspectorProfilerAgent::getCurrentUserInitiatedProfileName(bool increment
     if (incrementProfileNumber)
         m_currentUserInitiatedProfileNumber = m_nextUserInitiatedProfileNumber++;
 
-    return String::format("%s.%d", UserInitiatedProfileName, m_currentUserInitiatedProfileNumber);
+    return makeString(UserInitiatedProfileName, '.', String::number(m_currentUserInitiatedProfileNumber));
 }
 
 void InspectorProfilerAgent::getProfileHeaders(RefPtr<InspectorArray>* headers)
@@ -232,7 +232,9 @@ void InspectorProfilerAgent::stopUserInitiatedProfiling()
 
 void InspectorProfilerAgent::takeHeapSnapshot()
 {
-    String title = String::format("%s.%d", UserInitiatedProfileName, m_nextUserInitiatedHeapSnapshotNumber++);
+    String title = makeString(UserInitiatedProfileName, '.', String::number(m_nextUserInitiatedHeapSnapshotNumber));
+    ++m_nextUserInitiatedHeapSnapshotNumber;
+
     RefPtr<ScriptHeapSnapshot> snapshot = ScriptProfiler::takeHeapSnapshot(title);
     if (snapshot) {
         m_snapshots.add(snapshot->uid(), snapshot);
diff --git a/WebCore/inspector/InspectorResource.cpp b/WebCore/inspector/InspectorResource.cpp
index ac2c9a0..05b1bff 100644
--- a/WebCore/inspector/InspectorResource.cpp
+++ b/WebCore/inspector/InspectorResource.cpp
@@ -33,22 +33,24 @@
 
 #if ENABLE(INSPECTOR)
 
+#include "Base64.h"
 #include "Cache.h"
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
 #include "DocumentLoader.h"
 #include "Frame.h"
 #include "InspectorFrontend.h"
+#include "InspectorResourceAgent.h"
 #include "InspectorValues.h"
 #include "ResourceLoadTiming.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
-#include "StringBuffer.h"
 #include "TextEncoding.h"
 #include "WebSocketHandshakeRequest.h"
 #include "WebSocketHandshakeResponse.h"
 
 #include <wtf/Assertions.h>
+#include <wtf/text/StringBuffer.h>
 
 namespace WebCore {
 
@@ -86,8 +88,6 @@ InspectorResource::InspectorResource(unsigned long identifier, DocumentLoader* l
     , m_startTime(-1.0)
     , m_responseReceivedTime(-1.0)
     , m_endTime(-1.0)
-    , m_loadEventTime(-1.0)
-    , m_domContentEventTime(-1.0)
     , m_connectionID(0)
     , m_connectionReused(false)
     , m_isMainResource(false)
@@ -147,6 +147,7 @@ PassRefPtr<InspectorResource> InspectorResource::createWebSocket(unsigned long i
     RefPtr<InspectorResource> resource = adoptRef(new InspectorResource(identifier, 0, requestURL));
     resource->markWebSocket();
     resource->m_documentURL = documentURL;
+    resource->m_changes.setAll();
     return resource.release();
 }
 #endif
@@ -175,7 +176,12 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
         if (cachedResource)
             m_mimeType = cachedResource->response().mimeType();
     }
-    m_responseHeaderFields = response.httpHeaderFields();
+    if (ResourceRawHeaders* headers = response.resourceRawHeaders().get()) {
+        m_requestHeaderFields = headers->requestHeaders;
+        m_responseHeaderFields = headers->responseHeaders;
+        m_changes.set(RequestChange);
+    } else
+        m_responseHeaderFields = response.httpHeaderFields();
     m_responseStatusCode = response.httpStatusCode();
     m_responseStatusText = response.httpStatusText();
     m_suggestedFilename = response.suggestedFilename();
@@ -184,12 +190,7 @@ void InspectorResource::updateResponse(const ResourceResponse& response)
     m_connectionReused = response.connectionReused();
     m_loadTiming = response.resourceLoadTiming();
     m_cached = m_cached || response.wasCached();
-
-    if (!m_cached && m_loadTiming && m_loadTiming->requestTime)
-        m_responseReceivedTime = m_loadTiming->requestTime + m_loadTiming->receiveHeadersEnd / 1000.0;
-    else
-        m_responseReceivedTime = currentTime();
-
+    m_responseReceivedTime = currentTime();
     m_changes.set(TimingChange);
     m_changes.set(ResponseChange);
     m_changes.set(TypeChange);
@@ -257,9 +258,6 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             m_documentURL = m_frame->document()->url();
         jsonObject->setString("url", m_requestURL.string());
         jsonObject->setString("documentURL", m_documentURL.string());
-        jsonObject->setString("host", m_requestURL.host());
-        jsonObject->setString("path", m_requestURL.path());
-        jsonObject->setString("lastPathComponent", m_requestURL.lastPathComponent());
         RefPtr<InspectorObject> requestHeaders = buildHeadersObject(m_requestHeaderFields);
         jsonObject->setObject("requestHeaders", requestHeaders);
         jsonObject->setBoolean("mainResource", m_isMainResource);
@@ -315,10 +313,6 @@ void InspectorResource::updateScriptObject(InspectorFrontend* frontend)
             jsonObject->setNumber("responseReceivedTime", m_responseReceivedTime);
         if (m_endTime > 0)
             jsonObject->setNumber("endTime", m_endTime);
-        if (m_loadEventTime > 0)
-            jsonObject->setNumber("loadEventTime", m_loadEventTime);
-        if (m_domContentEventTime > 0)
-            jsonObject->setNumber("domContentEventTime", m_domContentEventTime);
         jsonObject->setBoolean("didTimingChange", true);
     }
 
@@ -342,41 +336,25 @@ void InspectorResource::releaseScriptObject(InspectorFrontend* frontend)
         frontend->removeResource(m_identifier);
 }
 
-CachedResource* InspectorResource::cachedResource() const
+static InspectorResource::Type cachedResourceType(CachedResource* cachedResource)
 {
-    // Try hard to find a corresponding CachedResource. During preloading, CachedResourceLoader may not have the resource in document resources set yet,
-    // but Inspector will already try to fetch data that is only available via CachedResource (and it won't update once the resource is added,
-    // because m_changes will not have the appropriate bits set).
-    if (!m_frame)
-        return 0;
-    const String& url = m_requestURL.string();
-    CachedResource* cachedResource = m_frame->document()->cachedResourceLoader()->cachedResource(url);
     if (!cachedResource)
-        cachedResource = cache()->resourceForURL(url);
-    return cachedResource;
-}
-
-InspectorResource::Type InspectorResource::cachedResourceType() const
-{
-    CachedResource* cachedResource = this->cachedResource();
-
-    if (!cachedResource)
-        return Other;
+        return InspectorResource::Other;
 
     switch (cachedResource->type()) {
-        case CachedResource::ImageResource:
-            return Image;
-        case CachedResource::FontResource:
-            return Font;
-        case CachedResource::CSSStyleSheet:
+    case CachedResource::ImageResource:
+        return InspectorResource::Image;
+    case CachedResource::FontResource:
+        return InspectorResource::Font;
+    case CachedResource::CSSStyleSheet:
 #if ENABLE(XSLT)
-        case CachedResource::XSLStyleSheet:
+    case CachedResource::XSLStyleSheet:
 #endif
-            return Stylesheet;
-        case CachedResource::Script:
-            return Script;
-        default:
-            return Other;
+        return InspectorResource::Stylesheet;
+    case CachedResource::Script:
+        return InspectorResource::Script;
+    default:
+        return InspectorResource::Other;
     }
 }
 
@@ -391,21 +369,21 @@ InspectorResource::Type InspectorResource::type() const
 #endif
 
     ASSERT(m_loader);
-    if (equalIgnoringFragmentIdentifier(m_requestURL, m_loader->requestURL())) {
-        InspectorResource::Type resourceType = cachedResourceType();
-        if (resourceType == Other)
-            return Doc;
-
-        return resourceType;
-    }
 
     if (m_loader->frameLoader() && equalIgnoringFragmentIdentifier(m_requestURL, m_loader->frameLoader()->iconURL()))
         return Image;
 
-    return cachedResourceType();
+    if (!m_frame)
+        return Other;
+
+    InspectorResource::Type resourceType = cachedResourceType(InspectorResourceAgent::cachedResource(m_frame.get(), m_requestURL));
+    if (equalIgnoringFragmentIdentifier(m_requestURL, m_loader->requestURL()) && resourceType == Other)
+        return Doc;
+
+    return resourceType;
 }
 
-void InspectorResource::setOverrideContent(const ScriptString& data, Type type)
+void InspectorResource::setOverrideContent(const String& data, Type type)
 {
     m_overrideContent = data;
     m_overrideContentType = type;
@@ -417,41 +395,27 @@ String InspectorResource::sourceString() const
     if (!m_overrideContent.isNull())
         return String(m_overrideContent);
 
-    String textEncodingName;
-    RefPtr<SharedBuffer> buffer = resourceData(&textEncodingName);
-    if (!buffer)
+    String result;
+    if (!InspectorResourceAgent::resourceContent(m_frame.get(), m_requestURL, &result))
         return String();
-
-    TextEncoding encoding(textEncodingName);
-    if (!encoding.isValid())
-        encoding = WindowsLatin1Encoding();
-    return encoding.decode(buffer->data(), buffer->size());
+    return result;
 }
 
-PassRefPtr<SharedBuffer> InspectorResource::resourceData(String* textEncodingName) const
+String InspectorResource::sourceBytes() const
 {
-    if (m_loader && equalIgnoringFragmentIdentifier(m_requestURL, m_loader->requestURL())) {
-        *textEncodingName = m_frame->document()->inputEncoding();
-        return m_loader->mainResourceData();
-    }
-
-    CachedResource* cachedResource = this->cachedResource();
-    if (!cachedResource)
-        return 0;
-
-    if (cachedResource->isPurgeable()) {
-        // If the resource is purgeable then make it unpurgeable to get
-        // get its data. This might fail, in which case we return an
-        // empty String.
-        // FIXME: should we do something else in the case of a purged
-        // resource that informs the user why there is no data in the
-        // inspector?
-        if (!cachedResource->makePurgeable(false))
-            return 0;
+    Vector<char> out;
+    if (!m_overrideContent.isNull()) {
+        Vector<char> data;
+        String overrideContent = m_overrideContent;
+        data.append(overrideContent.characters(), overrideContent.length());
+        base64Encode(data, out);
+        return String(out.data(), out.size());
     }
 
-    *textEncodingName = cachedResource->encoding();
-    return cachedResource->data();
+    String result;
+    if (!InspectorResourceAgent::resourceContentBase64(m_frame.get(), m_requestURL, &result))
+        return String();
+    return result;
 }
 
 void InspectorResource::startTiming()
@@ -462,14 +426,9 @@ void InspectorResource::startTiming()
 
 void InspectorResource::endTiming(double actualEndTime)
 {
-    if (actualEndTime) {
+    if (actualEndTime)
         m_endTime = actualEndTime;
-        // In case of fast load (or in case of cached resources), endTime on network stack
-        // can be less then m_responseReceivedTime measured in WebCore. Normalize it here,
-        // prefer actualEndTime to m_responseReceivedTime.
-        if (m_endTime < m_responseReceivedTime)
-            m_responseReceivedTime = m_endTime;
-    } else
+    else
         m_endTime = currentTime();
 
     m_finished = true;
@@ -477,18 +436,6 @@ void InspectorResource::endTiming(double actualEndTime)
     m_changes.set(CompletionChange);
 }
 
-void InspectorResource::markDOMContentEventTime()
-{
-    m_domContentEventTime = currentTime();
-    m_changes.set(TimingChange);
-}
-
-void InspectorResource::markLoadEventTime()
-{
-    m_loadEventTime = currentTime();
-    m_changes.set(TimingChange);
-}
-
 void InspectorResource::markFailed()
 {
     m_failed = true;
diff --git a/WebCore/inspector/InspectorResource.h b/WebCore/inspector/InspectorResource.h
index 914232e..aa6001f 100644
--- a/WebCore/inspector/InspectorResource.h
+++ b/WebCore/inspector/InspectorResource.h
@@ -33,7 +33,6 @@
 
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
-#include "ScriptString.h"
 #include "WebSocketHandshakeRequest.h"
 #include "WebSocketHandshakeResponse.h"
 
@@ -98,10 +97,9 @@ namespace WebCore {
         void updateWebSocketResponse(const WebSocketHandshakeResponse&);
 #endif
 
-        void setOverrideContent(const ScriptString& data, Type);
-
+        void setOverrideContent(const String& data, Type);
         String sourceString() const;
-        PassRefPtr<SharedBuffer> resourceData(String* textEncodingName) const;
+        String sourceBytes() const;
 
         bool isSameLoader(DocumentLoader* loader) const { return loader == m_loader; }
         void markMainResource() { m_isMainResource = true; }
@@ -116,8 +114,6 @@ namespace WebCore {
         String requestFormData() const { return m_requestFormData; }
 
         void startTiming();
-        void markLoadEventTime();
-        void markDOMContentEventTime();
         void endTiming(double actualEndTime);
 
         void markFailed();
@@ -162,9 +158,6 @@ namespace WebCore {
         InspectorResource(unsigned long identifier, DocumentLoader*, const KURL& requestURL);
         Type type() const;
 
-        Type cachedResourceType() const;
-        CachedResource* cachedResource() const;
-
 #if ENABLE(WEB_SOCKETS)
         void markWebSocket() { m_isWebSocket = true; }
 #endif
@@ -188,12 +181,10 @@ namespace WebCore {
         double m_startTime;
         double m_responseReceivedTime;
         double m_endTime;
-        double m_loadEventTime;
-        double m_domContentEventTime;
         unsigned m_connectionID;
         bool m_connectionReused;
         RefPtr<ResourceLoadTiming> m_loadTiming;
-        ScriptString m_overrideContent;
+        String m_overrideContent;
         Type m_overrideContentType;
         Changes m_changes;
         bool m_isMainResource;
diff --git a/WebCore/inspector/InspectorResourceAgent.cpp b/WebCore/inspector/InspectorResourceAgent.cpp
new file mode 100644
index 0000000..f49e1d7
--- /dev/null
+++ b/WebCore/inspector/InspectorResourceAgent.cpp
@@ -0,0 +1,432 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorResourceAgent.h"
+
+#include "Base64.h"
+#include "Cache.h"
+#include "CachedResource.h"
+#include "CachedResourceLoader.h"
+#include "Document.h"
+#include "DocumentLoader.h"
+#include "Frame.h"
+#include "FrameLoader.h"
+#include "HTTPHeaderMap.h"
+#include "InspectorFrontend.h"
+#include "InspectorValues.h"
+#include "KURL.h"
+#include "Page.h"
+#include "ProgressTracker.h"
+#include "ResourceError.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "SharedBuffer.h"
+#include "TextEncoding.h"
+#include "WebSocketHandshakeRequest.h"
+#include "WebSocketHandshakeResponse.h"
+
+#include <wtf/ListHashSet.h>
+#include <wtf/RefPtr.h>
+#include <wtf/text/StringBuffer.h>
+
+#if ENABLE(INSPECTOR)
+
+namespace WebCore {
+
+bool InspectorResourceAgent::resourceContent(Frame* frame, const KURL& url, String* result)
+{
+    if (!frame)
+        return false;
+
+    String textEncodingName;
+    RefPtr<SharedBuffer> buffer = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
+
+    if (buffer) {
+        TextEncoding encoding(textEncodingName);
+        if (!encoding.isValid())
+            encoding = WindowsLatin1Encoding();
+        *result = encoding.decode(buffer->data(), buffer->size());
+        return true;
+    }
+
+    return false;
+}
+
+bool InspectorResourceAgent::resourceContentBase64(Frame* frame, const KURL& url, String* result)
+{
+    Vector<char> out;
+    String textEncodingName;
+    RefPtr<SharedBuffer> data = InspectorResourceAgent::resourceData(frame, url, &textEncodingName);
+    if (!data) {
+        *result = String();
+        return false;
+    }
+
+    base64Encode(data->buffer(), out);
+    *result = String(out.data(), out.size());
+    return true;
+}
+
+PassRefPtr<SharedBuffer> InspectorResourceAgent::resourceData(Frame* frame, const KURL& url, String* textEncodingName)
+{
+    FrameLoader* frameLoader = frame->loader();
+    DocumentLoader* loader = frameLoader->documentLoader();
+    if (equalIgnoringFragmentIdentifier(url, loader->url())) {
+        *textEncodingName = frame->document()->inputEncoding();
+        return frameLoader->documentLoader()->mainResourceData();
+    }
+
+    CachedResource* cachedResource = InspectorResourceAgent::cachedResource(frame, url);
+    if (!cachedResource)
+        return 0;
+
+    if (cachedResource->isPurgeable()) {
+        // If the resource is purgeable then make it unpurgeable to get
+        // get its data. This might fail, in which case we return an
+        // empty String.
+        // FIXME: should we do something else in the case of a purged
+        // resource that informs the user why there is no data in the
+        // inspector?
+        if (!cachedResource->makePurgeable(false))
+            return 0;
+    }
+
+    *textEncodingName = cachedResource->encoding();
+    return cachedResource->data();
+}
+
+CachedResource* InspectorResourceAgent::cachedResource(Frame* frame, const KURL& url)
+{
+    const String& urlString = url.string();
+    CachedResource* cachedResource = frame->document()->cachedResourceLoader()->cachedResource(urlString);
+    if (!cachedResource)
+        cachedResource = cache()->resourceForURL(urlString);
+    return cachedResource;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForHeaders(const HTTPHeaderMap& headers)
+{
+    RefPtr<InspectorObject> headersObject = InspectorObject::create();
+    HTTPHeaderMap::const_iterator end = headers.end();
+    for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it)
+        headersObject->setString(it->first.string(), it->second);
+    return headersObject;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForTiming(const ResourceLoadTiming& timing)
+{
+    RefPtr<InspectorObject> timingObject = InspectorObject::create();
+    timingObject->setNumber("requestTime", timing.requestTime);
+    timingObject->setNumber("proxyStart", timing.proxyStart);
+    timingObject->setNumber("proxyEnd", timing.proxyEnd);
+    timingObject->setNumber("dnsStart", timing.dnsStart);
+    timingObject->setNumber("dnsEnd", timing.dnsEnd);
+    timingObject->setNumber("connectStart", timing.connectStart);
+    timingObject->setNumber("connectEnd", timing.connectEnd);
+    timingObject->setNumber("sslStart", timing.sslStart);
+    timingObject->setNumber("sslEnd", timing.sslEnd);
+    timingObject->setNumber("sendStart", timing.sendStart);
+    timingObject->setNumber("sendEnd", timing.sendEnd);
+    timingObject->setNumber("receiveHeadersEnd", timing.receiveHeadersEnd);
+    return timingObject;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForResourceRequest(const ResourceRequest& request)
+{
+    RefPtr<InspectorObject> requestObject = InspectorObject::create();
+    requestObject->setString("url", request.url().string());
+    requestObject->setString("httpMethod", request.httpMethod());
+    requestObject->setObject("httpHeaderFields", buildObjectForHeaders(request.httpHeaderFields()));
+    if (request.httpBody() && !request.httpBody()->isEmpty())
+        requestObject->setString("requestFormData", request.httpBody()->flattenToString());
+    return requestObject;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForResourceResponse(const ResourceResponse& response)
+{
+    RefPtr<InspectorObject> responseObject = InspectorObject::create();
+    if (response.isNull()) {
+        responseObject->setBoolean("isNull", true);
+        return responseObject;
+    }
+    responseObject->setString("url", response.url().string());
+    responseObject->setString("mimeType", response.mimeType());
+    responseObject->setNumber("expectedContentLength", response.expectedContentLength());
+    responseObject->setString("textEncodingName", response.textEncodingName());
+    responseObject->setString("suggestedFilename", response.suggestedFilename());
+    responseObject->setNumber("httpStatusCode", response.httpStatusCode());
+    responseObject->setString("httpStatusText", response.httpStatusText());
+    responseObject->setObject("httpHeaderFields", buildObjectForHeaders(response.httpHeaderFields()));
+    responseObject->setBoolean("connectionReused", response.connectionReused());
+    responseObject->setNumber("connectionID", response.connectionID());
+    responseObject->setBoolean("wasCached", response.wasCached());
+    if (response.resourceLoadTiming())
+        responseObject->setObject("timing", buildObjectForTiming(*response.resourceLoadTiming()));
+    if (response.resourceRawHeaders()) {
+        RefPtr<InspectorObject> rawHeadersObject = InspectorObject::create();
+        rawHeadersObject->setObject("requestHeaders", buildObjectForHeaders(response.resourceRawHeaders()->requestHeaders));
+        rawHeadersObject->setObject("responseHeaders", buildObjectForHeaders(response.resourceRawHeaders()->responseHeaders));
+        responseObject->setObject("rawHeaders", rawHeadersObject);
+    }
+    return responseObject;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForMainResource(Frame* frame)
+{
+    FrameLoader* frameLoader = frame->loader();
+    DocumentLoader* loader = frameLoader->documentLoader();
+
+    RefPtr<InspectorObject> resourceObject = InspectorObject::create();
+    resourceObject->setString("url", loader->url().string());
+    resourceObject->setString("host", loader->url().host());
+    resourceObject->setString("path", loader->url().path());
+    resourceObject->setString("lastPathComponent", loader->url().lastPathComponent());
+    resourceObject->setString("type", "Document");
+    resourceObject->setObject("request", buildObjectForResourceRequest(loader->request()));
+    resourceObject->setObject("response", buildObjectForResourceResponse(loader->response()));
+    return resourceObject;
+}
+
+static String cachedResourceTypeString(const CachedResource& cachedResource)
+{
+    switch (cachedResource.type()) {
+    case CachedResource::ImageResource:
+        return "Image";
+        break;
+    case CachedResource::FontResource:
+        return "Font";
+    case CachedResource::CSSStyleSheet:
+        // Fall through.
+#if ENABLE(XSLT)
+    case CachedResource::XSLStyleSheet:
+#endif
+        return "Stylesheet";
+    case CachedResource::Script:
+        return "Script";
+    default:
+        return "Other";
+    }
+}
+
+static PassRefPtr<InspectorObject> buildObjectForCachedResource(const CachedResource& cachedResource)
+{
+    RefPtr<InspectorObject> resourceObject = InspectorObject::create();
+    resourceObject->setString("url", cachedResource.url());
+    resourceObject->setString("type", cachedResourceTypeString(cachedResource));
+    resourceObject->setNumber("encodedSize", cachedResource.encodedSize());
+    resourceObject->setObject("response", buildObjectForResourceResponse(cachedResource.response()));
+    return resourceObject;
+}
+
+static PassRefPtr<InspectorObject> buildObjectForFrameResources(Frame* frame)
+{
+    RefPtr<InspectorObject> frameResources = InspectorObject::create();
+    frameResources->setNumber("frameID", reinterpret_cast<uintptr_t>(frame));
+    frameResources->setObject("mainResource", buildObjectForMainResource(frame));
+    RefPtr<InspectorArray> subresources = InspectorArray::create();
+    frameResources->setArray("subresources", subresources);
+
+    const CachedResourceLoader::DocumentResourceMap& allResources = frame->document()->cachedResourceLoader()->allCachedResources();
+    CachedResourceLoader::DocumentResourceMap::const_iterator end = allResources.end();
+    for (CachedResourceLoader::DocumentResourceMap::const_iterator it = allResources.begin(); it != end; ++it) {
+        CachedResource* cachedResource = it->second.get();
+        if (cachedResource)
+            subresources->pushValue(buildObjectForCachedResource(*cachedResource));
+    }
+    return frameResources;
+}
+
+InspectorResourceAgent::~InspectorResourceAgent()
+{
+}
+
+void InspectorResourceAgent::identifierForInitialRequest(unsigned long identifier, const KURL& url, DocumentLoader* loader, bool isMainResource)
+{
+    m_frontend->identifierForInitialRequest(identifier, url.string(), reinterpret_cast<uintptr_t>(loader->frame()), isMainResource);
+}
+
+void InspectorResourceAgent::willSendRequest(unsigned long identifier, ResourceRequest& request, const ResourceResponse& redirectResponse)
+{
+    m_frontend->willSendRequest(identifier, currentTime(), buildObjectForResourceRequest(request), buildObjectForResourceResponse(redirectResponse));
+}
+
+void InspectorResourceAgent::markResourceAsCached(unsigned long identifier)
+{
+    m_frontend->markResourceAsCached(identifier);
+}
+
+void InspectorResourceAgent::didReceiveResponse(unsigned long identifier, DocumentLoader* loader, const ResourceResponse& response)
+{
+    String type = "Other";
+    if (loader) {
+        if (equalIgnoringFragmentIdentifier(response.url(), loader->frameLoader()->iconURL()))
+            type = "Image";
+        else {
+            CachedResource* cachedResource = InspectorResourceAgent::cachedResource(loader->frame(), response.url());
+            if (cachedResource)
+                type = cachedResourceTypeString(*cachedResource);
+
+            if (equalIgnoringFragmentIdentifier(response.url(), loader->url()) && type == "Other")
+                type = "Document";
+        }
+    }
+    m_frontend->didReceiveResponse(identifier, currentTime(), type, buildObjectForResourceResponse(response));
+}
+
+void InspectorResourceAgent::didReceiveContentLength(unsigned long identifier, int lengthReceived)
+{
+    m_frontend->didReceiveContentLength(identifier, currentTime(), lengthReceived);
+}
+
+void InspectorResourceAgent::didFinishLoading(unsigned long identifier, double finishTime)
+{
+    if (!finishTime)
+        finishTime = currentTime();
+
+    m_frontend->didFinishLoading(identifier, finishTime);
+}
+
+void InspectorResourceAgent::didFailLoading(unsigned long identifier, const ResourceError& error)
+{
+    m_frontend->didFailLoading(identifier, currentTime(), error.localizedDescription());
+}
+
+void InspectorResourceAgent::didLoadResourceFromMemoryCache(DocumentLoader* loader, const CachedResource* resource)
+{
+    Frame* frame = loader->frame();
+    m_frontend->didLoadResourceFromMemoryCache(currentTime(), reinterpret_cast<uintptr_t>(frame), buildObjectForCachedResource(*resource));
+}
+
+void InspectorResourceAgent::setOverrideContent(unsigned long identifier, const String& sourceString, InspectorResource::Type type)
+{
+    String typeString;
+    switch (type) {
+    case InspectorResource::XHR:
+        typeString = "XHR";
+        break;
+    case InspectorResource::Script:
+        typeString = "Script";
+        break;
+    default:
+        typeString = "Other";
+    }
+
+    m_frontend->setOverrideContent(identifier, sourceString, typeString);
+}
+
+void InspectorResourceAgent::didCommitLoad(DocumentLoader* loader)
+{
+    Frame* frame = loader->frame();
+    m_frontend->didCommitLoad(reinterpret_cast<uintptr_t>(frame));
+}
+
+void InspectorResourceAgent::frameDetachedFromParent(Frame* frame)
+{
+    m_frontend->frameDetachedFromParent(reinterpret_cast<uintptr_t>(frame));
+}
+
+
+#if ENABLE(WEB_SOCKETS)
+
+// FIXME: More this into the front-end?
+// Create human-readable binary representation, like "01:23:45:67:89:AB:CD:EF".
+static String createReadableStringFromBinary(const unsigned char* value, size_t length)
+{
+    ASSERT(length > 0);
+    static const char hexDigits[17] = "0123456789ABCDEF";
+    size_t bufferSize = length * 3 - 1;
+    StringBuffer buffer(bufferSize);
+    size_t index = 0;
+    for (size_t i = 0; i < length; ++i) {
+        if (i > 0)
+            buffer[index++] = ':';
+        buffer[index++] = hexDigits[value[i] >> 4];
+        buffer[index++] = hexDigits[value[i] & 0xF];
+    }
+    ASSERT(index == bufferSize);
+    return String::adopt(buffer);
+}
+
+void InspectorResourceAgent::didCreateWebSocket(unsigned long identifier, const KURL& requestURL)
+{
+    m_frontend->didCreateWebSocket(identifier, requestURL.string());
+}
+
+void InspectorResourceAgent::willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest& request)
+{
+    RefPtr<InspectorObject> requestObject = InspectorObject::create();
+    requestObject->setObject("webSocketHeaderFields", buildObjectForHeaders(request.headerFields()));
+    requestObject->setString("webSocketRequestKey3", createReadableStringFromBinary(request.key3().value, sizeof(request.key3().value)));
+    m_frontend->willSendWebSocketHandshakeRequest(identifier, currentTime(), requestObject);
+}
+
+void InspectorResourceAgent::didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse& response)
+{
+    RefPtr<InspectorObject> responseObject = InspectorObject::create();
+    responseObject->setNumber("statusCode", response.statusCode());
+    responseObject->setString("statusText", response.statusText());
+    responseObject->setObject("webSocketHeaderFields", buildObjectForHeaders(response.headerFields()));
+    responseObject->setString("webSocketChallengeResponse", createReadableStringFromBinary(response.challengeResponse().value, sizeof(response.challengeResponse().value)));
+    m_frontend->didReceiveWebSocketHandshakeResponse(identifier, currentTime(), responseObject);
+}
+
+void InspectorResourceAgent::didCloseWebSocket(unsigned long identifier)
+{
+    m_frontend->didCloseWebSocket(identifier, currentTime());
+}
+#endif // ENABLE(WEB_SOCKETS)
+
+void InspectorResourceAgent::cachedResources(RefPtr<InspectorArray>* resources)
+{
+    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext(m_page->mainFrame()))
+        (*resources)->pushObject(buildObjectForFrameResources(frame));
+}
+
+void InspectorResourceAgent::resourceContent(unsigned long frameID, const String& url, String* content)
+{
+    RefPtr<InspectorArray> frameResources = InspectorArray::create();
+    for (Frame* frame = m_page->mainFrame(); frame; frame = frame->tree()->traverseNext(m_page->mainFrame())) {
+        if (reinterpret_cast<uintptr_t>(frame) != frameID)
+            continue;
+        InspectorResourceAgent::resourceContent(frame, KURL(ParsedURLString, url), content);
+        break;
+    }
+}
+
+InspectorResourceAgent::InspectorResourceAgent(Page* page, InspectorFrontend* frontend)
+    : m_page(page)
+    , m_frontend(frontend)
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorResourceAgent.h b/WebCore/inspector/InspectorResourceAgent.h
new file mode 100644
index 0000000..f0bead8
--- /dev/null
+++ b/WebCore/inspector/InspectorResourceAgent.h
@@ -0,0 +1,114 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorResourceAgent_h
+#define InspectorResourceAgent_h
+
+#include "InspectorResource.h"
+#include "PlatformString.h"
+
+#include <wtf/PassRefPtr.h>
+#include <wtf/Vector.h>
+
+#if ENABLE(INSPECTOR)
+
+namespace WTF {
+class String;
+}
+
+namespace WebCore {
+
+class CachedResource;
+class Document;
+class DocumentLoader;
+class InspectorArray;
+class InspectorObject;
+class InspectorFrontend;
+class KURL;
+class Page;
+class ResourceError;
+class ResourceRequest;
+class ResourceResponse;
+class SharedBuffer;
+
+#if ENABLE(WEB_SOCKETS)
+class WebSocketHandshakeRequest;
+class WebSocketHandshakeResponse;
+#endif
+
+class InspectorResourceAgent : public RefCounted<InspectorResourceAgent> {
+public:
+    static PassRefPtr<InspectorResourceAgent> create(Page* page, InspectorFrontend* frontend)
+    {
+        return adoptRef(new InspectorResourceAgent(page, frontend));
+    }
+
+    static bool resourceContent(Frame*, const KURL&, String* result);
+    static bool resourceContentBase64(Frame*, const KURL&, String* result);
+    static PassRefPtr<SharedBuffer> resourceData(Frame*, const KURL&, String* textEncodingName);
+    static CachedResource* cachedResource(Frame*, const KURL&);
+
+    ~InspectorResourceAgent();
+
+    void identifierForInitialRequest(unsigned long identifier, const KURL&, DocumentLoader*, bool isMainResource);
+    void willSendRequest(unsigned long identifier, ResourceRequest&, const ResourceResponse& redirectResponse);
+    void markResourceAsCached(unsigned long identifier);
+    void didReceiveResponse(unsigned long identifier, DocumentLoader* laoder, const ResourceResponse&);
+    void didReceiveContentLength(unsigned long identifier, int lengthReceived);
+    void didFinishLoading(unsigned long identifier, double finishTime);
+    void didFailLoading(unsigned long identifier, const ResourceError&);
+    void didLoadResourceFromMemoryCache(DocumentLoader*, const CachedResource*);
+    void setOverrideContent(unsigned long identifier, const String& sourceString, InspectorResource::Type);
+    void didCommitLoad(DocumentLoader*);
+    void frameDetachedFromParent(Frame*);
+
+#if ENABLE(WEB_SOCKETS)
+    void didCreateWebSocket(unsigned long identifier, const KURL& requestURL);
+    void willSendWebSocketHandshakeRequest(unsigned long identifier, const WebSocketHandshakeRequest&);
+    void didReceiveWebSocketHandshakeResponse(unsigned long identifier, const WebSocketHandshakeResponse&);
+    void didCloseWebSocket(unsigned long identifier);
+#endif
+
+    // Called from frontend 
+    void cachedResources(RefPtr<InspectorArray>*);
+    void resourceContent(unsigned long frameID, const String& url, String* content);
+
+private:
+    InspectorResourceAgent(Page* page, InspectorFrontend* frontend);
+
+    Page* m_page;
+    InspectorFrontend* m_frontend;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
+
+#endif // !defined(InspectorResourceAgent_h)
diff --git a/WebCore/inspector/InspectorState.cpp b/WebCore/inspector/InspectorState.cpp
new file mode 100644
index 0000000..44065c0
--- /dev/null
+++ b/WebCore/inspector/InspectorState.cpp
@@ -0,0 +1,184 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorState.h"
+
+#include "InspectorClient.h"
+#include "InspectorController.h"
+
+#if ENABLE(INSPECTOR)
+
+namespace WebCore {
+
+InspectorState::InspectorState(InspectorClient* client)
+    : m_client(client)
+{
+    registerBoolean(monitoringXHR, false, "monitoringXHR", "xhrMonitor");
+    registerBoolean(resourceTrackingEnabled, false, "resourceTrackingEnabled", (const char*)0);
+    registerBoolean(resourceTrackingAlwaysEnabled, false, (const char*)0, "resourceTrackingEnabled");
+    registerBoolean(timelineProfilerEnabled, false, "timelineProfilerEnabled", (const char*)0);
+    registerBoolean(searchingForNode, false, "searchingForNodeEnabled", (const char*)0);
+    registerBoolean(profilerAlwaysEnabled, false, (const char*)0, "profilerEnabled");
+    registerString(frontendSettings, "", (const char*)0, "frontendSettings");
+    registerBoolean(debuggerAlwaysEnabled, false, (const char*)0, "debuggerEnabled");
+    registerString(lastActivePanel, InspectorController::LastActivePanel, (const char*)0, "lastActivePanel");
+    registerBoolean(inspectorStartsAttached, true, (const char*)0, "InspectorStartsAttached");
+    registerLong(inspectorAttachedHeight, InspectorController::defaultAttachedHeight, (const char*)0, "inspectorAttachedHeight");
+    registerLong(pauseOnExceptionsState, 0, "pauseOnExceptionsState", (const char*)0);
+    registerBoolean(consoleMessagesEnabled, false, "consoleMessagesEnabled", (const char*)0);
+}
+
+void InspectorState::restoreFromInspectorCookie(const String& json)
+{
+    RefPtr<InspectorValue> jsonValue = InspectorValue::parseJSON(json);
+    if (!jsonValue)
+        return;
+
+    RefPtr<InspectorObject> jsonObject = jsonValue->asObject();
+    if (!jsonObject)
+        return;
+
+    for (InspectorObject::iterator i = jsonObject->begin(); i != jsonObject->end(); ++i) {
+        InspectorPropertyId id = (InspectorPropertyId)i->first.toInt();
+        ASSERT(id > 0 && id < lastPropertyId);
+        PropertyMap::iterator j = m_properties.find(id);
+        ASSERT(j != m_properties.end());
+        ASSERT(j->second.m_value->type() == i->second->type());
+        j->second.m_value = i->second;
+    }
+}
+
+PassRefPtr<InspectorObject> InspectorState::generateStateObjectForFrontend()
+{
+    RefPtr<InspectorObject> stateObject = InspectorObject::create();
+    for (PropertyMap::iterator i = m_properties.begin(); i != m_properties.end(); ++i) {
+        if (i->second.m_frontendAlias.length())
+            stateObject->setValue(i->second.m_frontendAlias, i->second.m_value);
+    }
+    return stateObject.release();
+}
+
+void InspectorState::loadFromSettings()
+{
+    for (PropertyMap::iterator i = m_properties.begin(); i != m_properties.end(); ++i) {
+        if (i->second.m_preferenceName.length()) {
+            String value;
+            m_client->populateSetting(i->second.m_preferenceName, &value);
+            switch (i->second.m_value->type()) {
+            case InspectorValue::TypeBoolean:
+                if (value.length())
+                    i->second.m_value = InspectorBasicValue::create(value == "true");
+                break;
+            case InspectorValue::TypeString:
+                i->second.m_value = InspectorString::create(value);
+                break;
+            case InspectorValue::TypeNumber:
+                if (value.length())
+                    i->second.m_value = InspectorBasicValue::create((double)value.toInt());
+                break;
+            default:
+                ASSERT(false);
+                break;
+            }
+        }
+    }
+}
+
+void InspectorState::updateCookie()
+{
+    RefPtr<InspectorObject> cookieObject = InspectorObject::create();
+    for (PropertyMap::iterator i = m_properties.begin(); i != m_properties.end(); ++i)
+        cookieObject->setValue(String::number(i->first), i->second.m_value);
+    m_client->updateInspectorStateCookie(cookieObject->toJSONString());
+}
+
+void InspectorState::setValue(InspectorPropertyId id, PassRefPtr<InspectorValue> value, const String& stringValue)
+{
+    PropertyMap::iterator i = m_properties.find(id);
+    ASSERT(i != m_properties.end());
+    i->second.m_value = value;
+    if (i->second.m_preferenceName.length())
+        m_client->storeSetting(i->second.m_preferenceName, stringValue);
+    updateCookie();
+}
+
+bool InspectorState::getBoolean(InspectorPropertyId id)
+{
+    PropertyMap::iterator i = m_properties.find(id);
+    ASSERT(i != m_properties.end());
+    bool value = false;
+    i->second.m_value->asBoolean(&value);
+    return value;
+}
+
+String InspectorState::getString(InspectorPropertyId id)
+{
+    PropertyMap::iterator i = m_properties.find(id);
+    ASSERT(i != m_properties.end());
+    String value;
+    i->second.m_value->asString(&value);
+    return value;
+}
+
+long InspectorState::getLong(InspectorPropertyId id)
+{
+    PropertyMap::iterator i = m_properties.find(id);
+    ASSERT(i != m_properties.end());
+    long value = 0;
+    i->second.m_value->asNumber(&value);
+    return value;
+}
+
+void InspectorState::registerBoolean(InspectorPropertyId propertyId, bool value, const String& frontendAlias, const String& preferenceName)
+{
+    m_properties.set(propertyId, Property::create(InspectorBasicValue::create(value), frontendAlias, preferenceName));
+}
+
+void InspectorState::registerString(InspectorPropertyId propertyId, const String& value, const String& frontendAlias, const String& preferenceName)
+{
+    m_properties.set(propertyId, Property::create(InspectorString::create(value), frontendAlias, preferenceName));
+}
+
+void InspectorState::registerLong(InspectorPropertyId propertyId, long value, const String& frontendAlias, const String& preferenceName)
+{
+    m_properties.set(propertyId, Property::create(InspectorBasicValue::create((double)value), frontendAlias, preferenceName));
+}
+
+InspectorState::Property InspectorState::Property::create(PassRefPtr<InspectorValue> value, const String& frontendAlias, const String& preferenceName)
+{
+    Property property;
+    property.m_value = value;
+    property.m_frontendAlias = frontendAlias;
+    property.m_preferenceName = preferenceName;
+    return property;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorState.h b/WebCore/inspector/InspectorState.h
new file mode 100644
index 0000000..5707600
--- /dev/null
+++ b/WebCore/inspector/InspectorState.h
@@ -0,0 +1,101 @@
+/*

+ * Copyright (C) 2010 Google Inc. All rights reserved.

+ *

+ * Redistribution and use in source and binary forms, with or without

+ * modification, are permitted provided that the following conditions

+ * are met:

+ *

+ * 1.  Redistributions of source code must retain the above copyright

+ *     notice, this list of conditions and the following disclaimer.

+ * 2.  Redistributions in binary form must reproduce the above copyright

+ *     notice, this list of conditions and the following disclaimer in the

+ *     documentation and/or other materials provided with the distribution.

+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of

+ *     its contributors may be used to endorse or promote products derived

+ *     from this software without specific prior written permission.

+ *

+ * THIS SOFTWARE IS PROVIDED BY GOOGLE AND ITS CONTRIBUTORS "AS IS" AND ANY

+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED

+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE

+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY

+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES

+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND

+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF

+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

+ */

+

+#ifndef InspectorState_h

+#define InspectorState_h

+

+#if ENABLE(INSPECTOR)

+

+#include "InspectorValues.h"

+#include "PlatformString.h"

+

+#include <wtf/HashMap.h>

+#include <wtf/RefCounted.h>

+

+namespace WebCore {

+

+class InspectorClient;

+

+class InspectorState {

+public:

+    enum InspectorPropertyId {

+        monitoringXHR = 1,

+        resourceTrackingEnabled,

+        resourceTrackingAlwaysEnabled,

+        timelineProfilerEnabled,

+        searchingForNode,

+        profilerAlwaysEnabled,

+        frontendSettings,

+        debuggerAlwaysEnabled,

+        lastActivePanel,

+        inspectorStartsAttached,

+        inspectorAttachedHeight,

+        pauseOnExceptionsState,

+        consoleMessagesEnabled,

+        lastPropertyId

+    };

+

+    InspectorState(InspectorClient* client);

+

+    PassRefPtr<InspectorObject> generateStateObjectForFrontend();

+    void restoreFromInspectorCookie(const String& jsonString);

+    void loadFromSettings();

+    String getFrontendAlias(InspectorPropertyId propertyId);

+

+    bool getBoolean(InspectorPropertyId propertyId);

+    String getString(InspectorPropertyId propertyId);

+    long getLong(InspectorPropertyId propertyId);

+

+    void setBoolean(InspectorPropertyId propertyId, bool value) { setValue(propertyId, InspectorBasicValue::create(value), value ? "true" : "false"); }

+    void setString(InspectorPropertyId propertyId, const String& value) { setValue(propertyId, InspectorString::create(value), value); }

+    void setLong(InspectorPropertyId propertyId, long value) { setValue(propertyId, InspectorBasicValue::create((double)value), String::number(value)); }

+

+private:

+    void updateCookie();

+    void setValue(InspectorPropertyId propertyId, PassRefPtr<InspectorValue> value, const String& stringValue);

+

+    struct Property {

+        static Property create(PassRefPtr<InspectorValue> value, const String& frontendAlias, const String& preferenceName);

+        String m_frontendAlias;

+        String m_preferenceName;

+        RefPtr<InspectorValue> m_value;

+    };

+    typedef HashMap<long, Property> PropertyMap;

+    PropertyMap m_properties;

+

+    void registerBoolean(InspectorPropertyId propertyId, bool value, const String& frontendAlias, const String& preferenceName);

+    void registerString(InspectorPropertyId propertyId, const String& value, const String& frontendAlias, const String& preferenceName);

+    void registerLong(InspectorPropertyId propertyId, long value, const String& frontendAlias, const String& preferenceName);

+

+    InspectorClient* m_client;

+};

+

+} // namespace WebCore

+

+#endif // ENABLE(INSPECTOR)

+#endif // !defined(InspectorState_h)

diff --git a/WebCore/inspector/InspectorStyleSheet.cpp b/WebCore/inspector/InspectorStyleSheet.cpp
new file mode 100644
index 0000000..11cd649
--- /dev/null
+++ b/WebCore/inspector/InspectorStyleSheet.cpp
@@ -0,0 +1,571 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "InspectorStyleSheet.h"
+
+#if ENABLE(INSPECTOR)
+
+#include "CSSParser.h"
+#include "CSSPropertySourceData.h"
+#include "CSSRule.h"
+#include "CSSRuleList.h"
+#include "CSSStyleRule.h"
+#include "CSSStyleSelector.h"
+#include "CSSStyleSheet.h"
+#include "Document.h"
+#include "Element.h"
+#include "HTMLHeadElement.h"
+#include "InspectorCSSAgent.h"
+#include "InspectorResourceAgent.h"
+#include "InspectorValues.h"
+#include "Node.h"
+#include "StyleSheetList.h"
+
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/Vector.h>
+
+class ParsedStyleSheet {
+public:
+    typedef Vector<RefPtr<WebCore::CSSRuleSourceData> > SourceData;
+    ParsedStyleSheet();
+
+    WebCore::CSSStyleSheet* cssStyleSheet() const { return m_parserOutput; }
+    const String& text() const { return m_text; }
+    void setText(const String& text);
+    bool hasText() const { return m_hasText; }
+    SourceData* sourceData() const { return m_sourceData.get(); }
+    void setSourceData(PassOwnPtr<SourceData> sourceData);
+    bool hasSourceData() const { return m_sourceData; }
+    RefPtr<WebCore::CSSRuleSourceData> ruleSourceDataAt(unsigned index) const;
+
+private:
+
+    // StyleSheet constructed while parsing m_text.
+    WebCore::CSSStyleSheet* m_parserOutput;
+    String m_text;
+    bool m_hasText;
+    OwnPtr<SourceData> m_sourceData;
+};
+
+ParsedStyleSheet::ParsedStyleSheet()
+    : m_parserOutput(0)
+    , m_hasText(false)
+{
+}
+
+void ParsedStyleSheet::setText(const String& text)
+{
+    m_hasText = true;
+    m_text = text;
+    setSourceData(0);
+}
+
+void ParsedStyleSheet::setSourceData(PassOwnPtr<SourceData> sourceData)
+{
+    m_sourceData = sourceData;
+}
+
+RefPtr<WebCore::CSSRuleSourceData> ParsedStyleSheet::ruleSourceDataAt(unsigned index) const
+{
+    if (!hasSourceData() || index >= m_sourceData->size())
+        return 0;
+
+    return m_sourceData->at(index);
+}
+
+namespace WebCore {
+
+InspectorStyleSheet::InspectorStyleSheet(const String& id, CSSStyleSheet* pageStyleSheet, const String& origin, const String& documentURL)
+    : m_id(id)
+    , m_pageStyleSheet(pageStyleSheet)
+    , m_origin(origin)
+    , m_documentURL(documentURL)
+    , m_isRevalidating(false)
+{
+    m_parsedStyleSheet = new ParsedStyleSheet();
+}
+
+InspectorStyleSheet::~InspectorStyleSheet()
+{
+    delete m_parsedStyleSheet;
+}
+
+bool InspectorStyleSheet::setText(const String& text)
+{
+    if (!m_parsedStyleSheet)
+        return false;
+
+    m_parsedStyleSheet->setText(text);
+    for (unsigned i = 0, size = m_pageStyleSheet->length(); i < size; ++i)
+        m_pageStyleSheet->remove(i);
+
+    m_pageStyleSheet->parseString(text, m_pageStyleSheet->useStrictParsing());
+    return true;
+}
+
+bool InspectorStyleSheet::setRuleSelector(const String& ruleId, const String& selector)
+{
+    CSSStyleRule* rule = ruleForId(ruleId);
+    if (!rule)
+        return false;
+    CSSStyleSheet* styleSheet = InspectorCSSAgent::parentStyleSheet(rule);
+    if (!styleSheet || !ensureParsedDataReady())
+        return false;
+
+    rule->setSelectorText(selector);
+    RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(rule->style());
+    if (!sourceData)
+        return false;
+
+    const String& sheetText = m_parsedStyleSheet->text();
+    String newStyleSheetText = sheetText.substring(0, sourceData->selectorListRange.start);
+    newStyleSheetText += selector;
+    newStyleSheetText += sheetText.right(sheetText.length() - sourceData->selectorListRange.end);
+    m_parsedStyleSheet->setText(newStyleSheetText);
+    return true;
+}
+
+CSSStyleRule* InspectorStyleSheet::addRule(const String& selector)
+{
+    String text;
+    bool success = styleSheetText(&text);
+    if (!success)
+        return 0;
+
+    ExceptionCode ec = 0;
+    m_pageStyleSheet->addRule(selector, "", ec);
+    if (ec)
+        return 0;
+    RefPtr<CSSRuleList> rules = m_pageStyleSheet->cssRules();
+    ASSERT(rules->length());
+    CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(rules->item(rules->length() - 1));
+    ASSERT(rule);
+
+    if (text.length())
+        text += "\n";
+
+    text += selector;
+    text += " {}";
+    m_parsedStyleSheet->setText(text);
+
+    return rule;
+}
+
+CSSStyleRule* InspectorStyleSheet::ruleForId(const String& id) const
+{
+    if (!m_pageStyleSheet)
+        return 0;
+
+    bool ok;
+    unsigned index = id.toUInt(&ok);
+    if (!ok)
+        return 0;
+
+    unsigned currentIndex = 0;
+    for (unsigned i = 0, size = m_pageStyleSheet->length(); i < size; ++i) {
+        CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(m_pageStyleSheet->item(i));
+        if (!rule)
+            continue;
+        if (index == currentIndex)
+            return rule;
+
+        ++currentIndex;
+    }
+    return 0;
+}
+
+PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyleSheet()
+{
+    CSSStyleSheet* styleSheet = pageStyleSheet();
+    if (!styleSheet)
+        return 0;
+
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    result->setString("id", id());
+    result->setBoolean("disabled", styleSheet->disabled());
+    result->setString("href", styleSheet->href());
+    result->setString("title", styleSheet->title());
+    RefPtr<CSSRuleList> cssRuleList = CSSRuleList::create(styleSheet, true);
+    RefPtr<InspectorArray> cssRules = buildArrayForRuleList(cssRuleList.get());
+    result->setArray("cssRules", cssRules.release());
+
+    String styleSheetText;
+    bool success = text(&styleSheetText);
+    if (success)
+        result->setString("text", styleSheetText);
+
+    return result.release();
+}
+
+PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForRule(CSSStyleRule* rule)
+{
+    CSSStyleSheet* styleSheet = pageStyleSheet();
+    if (!styleSheet)
+        return 0;
+
+    RefPtr<InspectorObject> result = InspectorObject::create();
+    result->setString("selectorText", rule->selectorText());
+    result->setString("cssText", rule->cssText());
+    result->setNumber("sourceLine", rule->sourceLine());
+    result->setString("documentURL", m_documentURL);
+
+    RefPtr<InspectorObject> parentStyleSheetValue = InspectorObject::create();
+    parentStyleSheetValue->setString("id", id());
+    parentStyleSheetValue->setString("href", styleSheet->href());
+    result->setObject("parentStyleSheet", parentStyleSheetValue.release());
+    result->setString("origin", m_origin);
+
+    RefPtr<CSSRuleSourceData> sourceData;
+    if (ensureParsedDataReady())
+        sourceData = ruleSourceDataFor(rule->style());
+    if (sourceData) {
+        result->setNumber("selectorStartOffset", sourceData->selectorListRange.start);
+        result->setNumber("selectorEndOffset", sourceData->selectorListRange.end);
+    }
+
+    result->setObject("style", buildObjectForStyle(rule->style()));
+    if (canBind())
+        result->setString("id", fullRuleId(rule));
+
+    return result.release();
+}
+
+PassRefPtr<InspectorObject> InspectorStyleSheet::buildObjectForStyle(CSSStyleDeclaration* style)
+{
+    RefPtr<CSSRuleSourceData> sourceData;
+    if (ensureParsedDataReady())
+        sourceData = ruleSourceDataFor(style);
+
+    RefPtr<InspectorObject> result = InspectorCSSAgent::buildObjectForStyle(style, fullStyleId(style), sourceData ? sourceData->styleSourceData.get() : 0);
+    result->setString("parentStyleSheetId", id());
+    return result.release();
+}
+
+CSSStyleDeclaration* InspectorStyleSheet::styleForId(const String& id) const
+{
+    CSSStyleRule* rule = ruleForId(id);
+    if (!rule)
+        return 0;
+
+    return rule->style();
+}
+
+bool InspectorStyleSheet::setStyleText(const String& styleId, const String& newText)
+{
+    CSSStyleDeclaration* style = styleForId(styleId);
+    if (!style)
+        return false;
+
+    return innerSetStyleText(style, newText);
+}
+
+Document* InspectorStyleSheet::ownerDocument() const
+{
+    return m_pageStyleSheet->document();
+}
+
+RefPtr<CSSRuleSourceData> InspectorStyleSheet::ruleSourceDataFor(CSSStyleDeclaration* style) const
+{
+    return m_parsedStyleSheet->ruleSourceDataAt(ruleIndexByStyle(style));
+}
+
+unsigned InspectorStyleSheet::ruleIndexByStyle(CSSStyleDeclaration* pageStyle) const
+{
+    unsigned index = 0;
+    for (unsigned i = 0, size = m_pageStyleSheet->length(); i < size; ++i) {
+        CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(m_pageStyleSheet->item(i));
+        if (!rule)
+            continue;
+        if (rule->style() == pageStyle)
+            return index;
+
+        ++index;
+    }
+    return UINT_MAX;
+}
+
+bool InspectorStyleSheet::ensureParsedDataReady()
+{
+    return ensureText() && ensureSourceData(pageStyleSheet()->ownerNode());
+}
+
+bool InspectorStyleSheet::text(String* result) const
+{
+    if (!ensureText())
+        return false;
+    *result = m_parsedStyleSheet->text();
+    return true;
+}
+
+bool InspectorStyleSheet::ensureText() const
+{
+    if (!m_parsedStyleSheet)
+        return false;
+    if (m_parsedStyleSheet->hasText())
+        return true;
+
+    String text;
+    bool success = styleSheetText(&text);
+    if (success)
+        m_parsedStyleSheet->setText(text);
+
+    return success;
+}
+
+bool InspectorStyleSheet::ensureSourceData(Node* ownerNode)
+{
+    if (m_parsedStyleSheet->hasSourceData())
+        return true;
+
+    if (!m_parsedStyleSheet->hasText())
+        return false;
+
+    RefPtr<CSSStyleSheet> newStyleSheet = CSSStyleSheet::create(ownerNode);
+    CSSParser p;
+    StyleRuleRangeMap ruleRangeMap;
+    p.parseSheet(newStyleSheet.get(), m_parsedStyleSheet->text(), 0, &ruleRangeMap);
+    OwnPtr<ParsedStyleSheet::SourceData> rangesVector(new ParsedStyleSheet::SourceData());
+
+    for (unsigned i = 0, length = newStyleSheet->length(); i < length; ++i) {
+        CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(newStyleSheet->item(i));
+        if (!rule)
+            continue;
+        StyleRuleRangeMap::iterator it = ruleRangeMap.find(rule);
+        if (it != ruleRangeMap.end())
+            rangesVector->append(it->second);
+    }
+
+    m_parsedStyleSheet->setSourceData(rangesVector.release());
+    return m_parsedStyleSheet->hasSourceData();
+}
+
+void InspectorStyleSheet::innerSetStyleSheetText(const String& newText)
+{
+    m_parsedStyleSheet->setText(newText);
+}
+
+bool InspectorStyleSheet::innerSetStyleText(CSSStyleDeclaration* style, const String& text)
+{
+    if (!pageStyleSheet())
+        return false;
+    if (!ensureParsedDataReady())
+        return false;
+
+    String patchedStyleSheetText;
+    bool success = styleSheetTextWithChangedStyle(style, text, &patchedStyleSheetText);
+    if (!success)
+        return false;
+
+    String id = ruleOrStyleId(style);
+    if (id.isEmpty())
+        return false;
+
+    ExceptionCode ec = 0;
+    style->setCssText(text, ec);
+    if (!ec)
+        innerSetStyleSheetText(patchedStyleSheetText);
+
+    return !ec;
+}
+
+bool InspectorStyleSheet::styleSheetTextWithChangedStyle(CSSStyleDeclaration* style, const String& newStyleText, String* result)
+{
+    if (!style)
+        return false;
+
+    if (!ensureParsedDataReady())
+        return false;
+
+    RefPtr<CSSRuleSourceData> sourceData = ruleSourceDataFor(style);
+    unsigned bodyStart = sourceData->styleSourceData->styleBodyRange.start;
+    unsigned bodyEnd = sourceData->styleSourceData->styleBodyRange.end;
+    ASSERT(bodyStart <= bodyEnd);
+
+    String text = m_parsedStyleSheet->text();
+    ASSERT(bodyEnd <= text.length()); // bodyEnd is exclusive
+
+    String patchedText = text.substring(0, bodyStart);
+    patchedText += newStyleText;
+    patchedText += text.substring(bodyEnd, text.length());
+    *result = patchedText;
+    return true;
+}
+
+CSSStyleRule* InspectorStyleSheet::findPageRuleWithStyle(CSSStyleDeclaration* style)
+{
+    for (unsigned i = 0, size = m_pageStyleSheet->length(); i < size; ++i) {
+        CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(m_pageStyleSheet->item(i));
+        if (!rule)
+            continue;
+        if (rule->style() == style)
+            return rule;
+    }
+    return 0;
+}
+
+String InspectorStyleSheet::fullRuleId(CSSStyleRule* rule) const
+{
+    return fullRuleOrStyleId(rule->style());
+}
+
+void InspectorStyleSheet::revalidateStyle(CSSStyleDeclaration* pageStyle)
+{
+    if (m_isRevalidating)
+        return;
+
+    m_isRevalidating = true;
+    CSSStyleSheet* parsedSheet = m_parsedStyleSheet->cssStyleSheet();
+    for (unsigned i = 0, size = parsedSheet->length(); i < size; ++i) {
+        StyleBase* styleBase = parsedSheet->item(i);
+        CSSStyleRule* parsedRule = InspectorCSSAgent::asCSSStyleRule(styleBase);
+        if (!parsedRule)
+            continue;
+        if (parsedRule->style() == pageStyle) {
+            if (parsedRule->style()->cssText() != pageStyle->cssText())
+                innerSetStyleText(pageStyle, pageStyle->cssText());
+            break;
+        }
+    }
+    m_isRevalidating = false;
+}
+
+bool InspectorStyleSheet::styleSheetText(String* result) const
+{
+    String text;
+    bool success = inlineStyleSheetText(&text);
+    if (!success)
+        success = resourceStyleSheetText(&text);
+    if (success)
+        *result = text;
+    return success;
+}
+
+bool InspectorStyleSheet::resourceStyleSheetText(String* result) const
+{
+    if (!m_pageStyleSheet)
+        return false;
+
+    return InspectorResourceAgent::resourceContent(ownerDocument()->frame(), m_pageStyleSheet->finalURL(), result);
+}
+
+bool InspectorStyleSheet::inlineStyleSheetText(String* result) const
+{
+    if (!m_pageStyleSheet)
+        return false;
+
+    Node* ownerNode = m_pageStyleSheet->ownerNode();
+    if (!ownerNode || ownerNode->nodeType() != Node::ELEMENT_NODE)
+        return false;
+    Element* ownerElement = static_cast<Element*>(ownerNode);
+    if (ownerElement->tagName().lower() != "style")
+        return false;
+    *result = ownerElement->innerText();
+    return true;
+}
+
+PassRefPtr<InspectorArray> InspectorStyleSheet::buildArrayForRuleList(CSSRuleList* ruleList)
+{
+    RefPtr<InspectorArray> result = InspectorArray::create();
+    if (!ruleList)
+        return result.release();
+
+    for (unsigned i = 0, size = ruleList->length(); i < size; ++i) {
+        CSSStyleRule* rule = InspectorCSSAgent::asCSSStyleRule(ruleList->item(i));
+        if (!rule)
+            continue;
+
+        result->pushObject(buildObjectForRule(rule));
+    }
+    return result.release();
+}
+
+
+InspectorStyleSheetForInlineStyle::InspectorStyleSheetForInlineStyle(const String& id, Element* element, const String& origin)
+    : InspectorStyleSheet(id, 0, origin, "")
+    , m_element(element)
+    , m_ruleSourceData(0)
+{
+    ASSERT(element);
+}
+
+bool InspectorStyleSheetForInlineStyle::setStyleText(const String& styleId, const String& text)
+{
+    ASSERT(styleId == "0");
+    UNUSED_PARAM(styleId);
+    ExceptionCode ec = 0;
+    m_element->setAttribute("style", text, ec);
+    m_ruleSourceData.clear();
+    return !ec;
+}
+
+Document* InspectorStyleSheetForInlineStyle::ownerDocument() const
+{
+    return m_element->document();
+}
+
+bool InspectorStyleSheetForInlineStyle::ensureParsedDataReady()
+{
+    if (m_ruleSourceData)
+        return true;
+
+    m_ruleSourceData = CSSRuleSourceData::create();
+    RefPtr<CSSStyleSourceData> sourceData = CSSStyleSourceData::create();
+    bool success = getStyleAttributeRanges(&sourceData);
+    if (!success)
+        return false;
+
+    m_ruleSourceData->styleSourceData = sourceData.release();
+    return true;
+}
+
+CSSStyleDeclaration* InspectorStyleSheetForInlineStyle::inlineStyle() const
+{
+    return m_element->style();
+}
+
+bool InspectorStyleSheetForInlineStyle::getStyleAttributeRanges(RefPtr<CSSStyleSourceData>* result)
+{
+    DEFINE_STATIC_LOCAL(String, styleAttributeName, ("style"));
+
+    if (!m_element->isStyledElement())
+        return false;
+
+    String styleText = static_cast<StyledElement*>(m_element)->getAttribute(styleAttributeName);
+    if (styleText.isEmpty()) {
+        (*result)->styleBodyRange.start = 0;
+        (*result)->styleBodyRange.end = 0;
+        return true;
+    }
+
+    RefPtr<CSSMutableStyleDeclaration> tempDeclaration = CSSMutableStyleDeclaration::create();
+    CSSParser p;
+    p.parseDeclaration(tempDeclaration.get(), styleText, result);
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorStyleSheet.h b/WebCore/inspector/InspectorStyleSheet.h
new file mode 100644
index 0000000..38ab777
--- /dev/null
+++ b/WebCore/inspector/InspectorStyleSheet.h
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InspectorStyleSheet_h
+#define InspectorStyleSheet_h
+
+#include "CSSPropertySourceData.h"
+#include "Document.h"
+#include "InspectorValues.h"
+#include "PlatformString.h"
+
+#include <wtf/HashMap.h>
+#include <wtf/HashSet.h>
+#include <wtf/OwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/UnusedParam.h>
+
+class ParsedStyleSheet;
+
+namespace WebCore {
+
+class CSSRuleList;
+class CSSStyleDeclaration;
+class Element;
+class Node;
+
+#if ENABLE(INSPECTOR)
+
+class InspectorStyleSheet : public RefCounted<InspectorStyleSheet> {
+public:
+    static PassRefPtr<InspectorStyleSheet> create(const String& id, CSSStyleSheet* pageStyleSheet, const String& origin, const String& documentURL)
+    {
+        return adoptRef(new InspectorStyleSheet(id, pageStyleSheet, origin, documentURL));
+    }
+
+    InspectorStyleSheet(const String& id, CSSStyleSheet* pageStyleSheet, const String& origin, const String& documentURL);
+    virtual ~InspectorStyleSheet();
+
+    const String& id() const { return m_id; }
+    CSSStyleSheet* pageStyleSheet() const { return m_pageStyleSheet; }
+    bool setText(const String&);
+    bool setRuleSelector(const String& ruleId, const String& selector);
+    CSSStyleRule* addRule(const String& selector);
+    CSSStyleRule* ruleForId(const String&) const;
+    PassRefPtr<InspectorObject> buildObjectForStyleSheet();
+    PassRefPtr<InspectorObject> buildObjectForRule(CSSStyleRule*);
+    PassRefPtr<InspectorObject> buildObjectForStyle(CSSStyleDeclaration*);
+    virtual CSSStyleDeclaration* styleForId(const String&) const;
+    virtual bool setStyleText(const String& styleId, const String& text);
+
+protected:
+    bool canBind() const { return m_origin != "userAgent" && m_origin != "user"; }
+    String fullRuleOrStyleId(CSSStyleDeclaration* style) const { return id() + ":" + ruleOrStyleId(style); }
+    String ruleOrStyleId(CSSStyleDeclaration* style) const { unsigned index = ruleIndexByStyle(style); return index == UINT_MAX ? "" : String::number(index); }
+    virtual Document* ownerDocument() const;
+    virtual RefPtr<CSSRuleSourceData> ruleSourceDataFor(CSSStyleDeclaration* style) const;
+    virtual unsigned ruleIndexByStyle(CSSStyleDeclaration*) const;
+    virtual bool ensureParsedDataReady();
+
+private:
+    bool text(String* result) const;
+    bool ensureText() const;
+    bool ensureSourceData(Node* ownerNode);
+    void innerSetStyleSheetText(const String& newText);
+    bool innerSetStyleText(CSSStyleDeclaration*, const String&);
+    bool styleSheetTextWithChangedStyle(CSSStyleDeclaration*, const String& newStyleText, String* result);
+    CSSStyleRule* findPageRuleWithStyle(CSSStyleDeclaration*);
+    String fullRuleId(CSSStyleRule* rule) const;
+    String fullStyleId(CSSStyleDeclaration* style) const { return fullRuleOrStyleId(style); }
+    void revalidateStyle(CSSStyleDeclaration*);
+    bool styleSheetText(String* result) const;
+    bool resourceStyleSheetText(String* result) const;
+    bool inlineStyleSheetText(String* result) const;
+    PassRefPtr<InspectorArray> buildArrayForRuleList(CSSRuleList*);
+
+    String m_id;
+    CSSStyleSheet* m_pageStyleSheet;
+    String m_origin;
+    String m_documentURL;
+    bool m_isRevalidating;
+    ParsedStyleSheet* m_parsedStyleSheet;
+};
+
+class InspectorStyleSheetForInlineStyle : public InspectorStyleSheet {
+public:
+    static PassRefPtr<InspectorStyleSheetForInlineStyle> create(const String& id, Element* element, const String& origin)
+    {
+        return adoptRef(new InspectorStyleSheetForInlineStyle(id, element, origin));
+    }
+
+    InspectorStyleSheetForInlineStyle(const String& id, Element* element, const String& origin);
+    virtual CSSStyleDeclaration* styleForId(const String& id) const { ASSERT(id == "0"); UNUSED_PARAM(id); return inlineStyle(); }
+    virtual bool setStyleText(const String& styleId, const String& text);
+
+protected:
+    virtual Document* ownerDocument() const;
+    virtual RefPtr<CSSRuleSourceData> ruleSourceDataFor(CSSStyleDeclaration* style) const { ASSERT(style == inlineStyle()); UNUSED_PARAM(style); return m_ruleSourceData; }
+    virtual unsigned ruleIndexByStyle(CSSStyleDeclaration*) const { return 0; }
+    virtual bool ensureParsedDataReady();
+
+private:
+    CSSStyleDeclaration* inlineStyle() const;
+    bool getStyleAttributeRanges(RefPtr<CSSStyleSourceData>* result);
+
+    Element* m_element;
+    RefPtr<CSSRuleSourceData> m_ruleSourceData;
+};
+
+#endif
+
+} // namespace WebCore
+
+#endif // !defined(InspectorStyleSheet_h)
diff --git a/WebCore/inspector/InspectorTimelineAgent.cpp b/WebCore/inspector/InspectorTimelineAgent.cpp
index fbb17c4..645b692 100644
--- a/WebCore/inspector/InspectorTimelineAgent.cpp
+++ b/WebCore/inspector/InspectorTimelineAgent.cpp
@@ -44,12 +44,12 @@
 
 namespace WebCore {
 
-int InspectorTimelineAgent::s_instanceCount = 0;
+int InspectorTimelineAgent::s_id = 0;
 
 InspectorTimelineAgent::InspectorTimelineAgent(InspectorFrontend* frontend)
     : m_frontend(frontend)
+    , m_id(++s_id)
 {
-    ++s_instanceCount;
     ScriptGCEvent::addEventListener(this);
     ASSERT(m_frontend);
 }
@@ -76,8 +76,6 @@ void InspectorTimelineAgent::didGC(double startTime, double endTime, size_t coll
 
 InspectorTimelineAgent::~InspectorTimelineAgent()
 {
-    ASSERT(s_instanceCount);
-    --s_instanceCount;
     ScriptGCEvent::removeEventListener(this);
 }
 
@@ -242,10 +240,11 @@ void InspectorTimelineAgent::didReceiveResourceResponse()
     didCompleteCurrentRecord(ResourceReceiveResponseTimelineRecordType);
 }
 
-void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail)
+void InspectorTimelineAgent::didFinishLoadingResource(unsigned long identifier, bool didFail, double finishTime)
 {
     pushGCEventRecords();
-    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(WTF::currentTimeMS());
+    // Sometimes network stack can provide for us exact finish loading time. In the other case we will use currentTime.
+    RefPtr<InspectorObject> record = TimelineRecordFactory::createGenericRecord(finishTime ? finishTime * 1000 : WTF::currentTimeMS());
     record->setObject("data", TimelineRecordFactory::createResourceFinishData(identifier, didFail));
     record->setNumber("type", ResourceFinishTimelineRecordType);
     setHeapSizeStatistic(record.get());
diff --git a/WebCore/inspector/InspectorTimelineAgent.h b/WebCore/inspector/InspectorTimelineAgent.h
index 6b3324b..bc1e027 100644
--- a/WebCore/inspector/InspectorTimelineAgent.h
+++ b/WebCore/inspector/InspectorTimelineAgent.h
@@ -33,9 +33,7 @@
 
 #if ENABLE(INSPECTOR)
 
-#include "Document.h"
 #include "InspectorValues.h"
-#include "ScriptExecutionContext.h"
 #include "ScriptGCEvent.h"
 #include "ScriptGCEventListener.h"
 #include <wtf/Vector.h>
@@ -77,6 +75,8 @@ public:
     InspectorTimelineAgent(InspectorFrontend* frontend);
     ~InspectorTimelineAgent();
 
+    int id() const { return m_id; }
+
     void reset();
     void resetFrontendProxyObject(InspectorFrontend*);
 
@@ -122,15 +122,12 @@ public:
     void willSendResourceRequest(unsigned long, bool isMainResource, const ResourceRequest&);
     void willReceiveResourceResponse(unsigned long, const ResourceResponse&);
     void didReceiveResourceResponse();
-    void didFinishLoadingResource(unsigned long, bool didFail);
+    void didFinishLoadingResource(unsigned long, bool didFail, double finishTime);
     void willReceiveResourceData(unsigned long identifier);
     void didReceiveResourceData();
         
     virtual void didGC(double, double, size_t);
 
-    static int instanceCount() { return s_instanceCount; }
-    static InspectorTimelineAgent* retrieve(ScriptExecutionContext*);
-
 private:
     struct TimelineRecordEntry {
         TimelineRecordEntry(PassRefPtr<InspectorObject> record, PassRefPtr<InspectorObject> data, PassRefPtr<InspectorArray> children, TimelineRecordType type)
@@ -155,7 +152,9 @@ private:
     InspectorFrontend* m_frontend;
 
     Vector<TimelineRecordEntry> m_recordStack;
-    static int s_instanceCount;
+
+    static int s_id;
+    const int m_id;
     struct GCEvent {
         GCEvent(double startTime, double endTime, size_t collectedBytes)
             : startTime(startTime), endTime(endTime), collectedBytes(collectedBytes)
@@ -169,13 +168,6 @@ private:
     GCEvents m_gcEvents;
 };
 
-inline InspectorTimelineAgent* InspectorTimelineAgent::retrieve(ScriptExecutionContext* context)
-{
-    if (context && context->isDocument())
-        return static_cast<Document*>(context)->inspectorTimelineAgent();
-    return 0;
-}
-
 } // namespace WebCore
 
 #endif // !ENABLE(INSPECTOR)
diff --git a/WebCore/inspector/InspectorValues.cpp b/WebCore/inspector/InspectorValues.cpp
index c96e953..89e9b7c 100644
--- a/WebCore/inspector/InspectorValues.cpp
+++ b/WebCore/inspector/InspectorValues.cpp
@@ -33,6 +33,8 @@
 
 #if ENABLE(INSPECTOR)
 
+#include <wtf/DecimalNumber.h>
+
 namespace WebCore {
 
 namespace {
@@ -604,9 +606,9 @@ void InspectorBasicValue::writeJSON(Vector<UChar>* output) const
         else
             output->append(falseString, 5);
     } else if (type() == TypeNumber) {
-        String value = String::format("%f", m_doubleValue);
-        value.replace(',', '.');
-        output->append(value.characters(), value.length());
+        NumberToStringBuffer buffer;
+        unsigned length = DecimalNumber(m_doubleValue).toStringDecimal(buffer, WTF::NumberToStringBufferLength);
+        output->append(buffer, length);
     }
 }
 
@@ -622,6 +624,10 @@ void InspectorString::writeJSON(Vector<UChar>* output) const
     doubleQuoteString(m_stringValue, output);
 }
 
+InspectorObject::~InspectorObject()
+{
+}
+
 bool InspectorObject::asObject(RefPtr<InspectorObject>* output)
 {
     *output = this;
@@ -696,6 +702,17 @@ void InspectorObject::writeJSON(Vector<UChar>* output) const
     output->append('}');
 }
 
+InspectorObject::InspectorObject()
+    : InspectorValue(TypeObject)
+    , m_data()
+    , m_order()
+{
+}
+
+InspectorArray::~InspectorArray()
+{
+}
+
 bool InspectorArray::asArray(RefPtr<InspectorArray>* output)
 {
     *output = this;
@@ -718,6 +735,12 @@ void InspectorArray::writeJSON(Vector<UChar>* output) const
     output->append(']');
 }
 
+InspectorArray::InspectorArray()
+    : InspectorValue(TypeArray)
+    , m_data()
+{
+}
+
 PassRefPtr<InspectorValue> InspectorArray::get(size_t index)
 {
     ASSERT(index < m_data.size());
diff --git a/WebCore/inspector/InspectorValues.h b/WebCore/inspector/InspectorValues.h
index 4036f55..391372e 100644
--- a/WebCore/inspector/InspectorValues.h
+++ b/WebCore/inspector/InspectorValues.h
@@ -166,7 +166,7 @@ public:
     {
         return adoptRef(new InspectorObject());
     }
-    ~InspectorObject() { }
+    ~InspectorObject();
 
     virtual bool asObject(RefPtr<InspectorObject>* output);
     virtual PassRefPtr<InspectorObject> asObject();
@@ -194,7 +194,7 @@ public:
     const_iterator end() const { return m_data.end(); }
 
 private:
-    InspectorObject() : InspectorValue(TypeObject) { }
+    InspectorObject();
     Dictionary m_data;
     Vector<String> m_order;
 };
@@ -205,7 +205,7 @@ public:
     {
         return adoptRef(new InspectorArray());
     }
-    ~InspectorArray() { }
+    ~InspectorArray();
 
     virtual bool asArray(RefPtr<InspectorArray>* output);
     virtual PassRefPtr<InspectorArray> asArray();
@@ -223,7 +223,7 @@ public:
     virtual void writeJSON(Vector<UChar>* output) const;
 
 private:
-    InspectorArray() : InspectorValue(TypeArray) { }
+    InspectorArray();
     Vector<RefPtr<InspectorValue> > m_data;
 };
 
diff --git a/WebCore/inspector/front-end/AuditRules.js b/WebCore/inspector/front-end/AuditRules.js
index a72de56..cd9f13e 100644
--- a/WebCore/inspector/front-end/AuditRules.js
+++ b/WebCore/inspector/front-end/AuditRules.js
@@ -42,17 +42,17 @@ WebInspector.AuditRules.CacheableResponseCodes =
     304: true // Underlying resource is cacheable
 }
 
-WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, regexp, needFullResources)
+WebInspector.AuditRules.getDomainToResourcesMap = function(resources, types, needFullResources)
 {
     var domainToResourcesMap = {};
     for (var i = 0, size = resources.length; i < size; ++i) {
         var resource = resources[i];
         if (types && types.indexOf(resource.type) === -1)
             continue;
-        var match = resource.url.match(regexp);
-        if (!match)
+        var parsedURL = resource.url.asParsedURL();
+        if (!parsedURL)
             continue;
-        var domain = match[2];
+        var domain = parsedURL.host;
         var domainResources = domainToResourcesMap[domain];
         if (domainResources === undefined) {
           domainResources = [];
@@ -128,7 +128,7 @@ WebInspector.AuditRules.CombineExternalResourcesRule = function(id, name, type,
 WebInspector.AuditRules.CombineExternalResourcesRule.prototype = {
     doRun: function(resources, result, callback)
     {
-        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, [this._type], WebInspector.URLRegExp);
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, [this._type]);
         var penalizedResourceCount = 0;
         // TODO: refactor according to the chosen i18n approach
         var summary = result.addChild("", true);
@@ -175,14 +175,14 @@ WebInspector.AuditRules.MinimizeDnsLookupsRule.prototype = {
     doRun: function(resources, result, callback)
     {
         var summary = result.addChild("");
-        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, undefined, WebInspector.URLRegExp);
+        var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources, undefined);
         for (var domain in domainToResourcesMap) {
             if (domainToResourcesMap[domain].length > 1)
                 continue;
-            var match = domain.match(WebInspector.URLRegExp);
-            if (!match)
+            var parsedURL = domain.asParsedURL();
+            if (!parsedURL)
                 continue;
-            if (!match[2].search(WebInspector.AuditRules.IPAddressRegexp))
+            if (!parsedURL.host.search(WebInspector.AuditRules.IPAddressRegexp))
                 continue; // an IP address
             summary.addSnippet(match[2]);
             result.violationCount++;
@@ -220,7 +220,6 @@ WebInspector.AuditRules.ParallelizeDownloadRule.prototype = {
         var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(
             resources,
             [WebInspector.Resource.Type.Stylesheet, WebInspector.Resource.Type.Image],
-            WebInspector.URLRegExp,
             true);
 
         var hosts = [];
@@ -647,7 +646,7 @@ WebInspector.AuditRules.ImageDimensionsRule.prototype = {
 
             const node = WebInspector.domAgent.nodeForId(imageId);
             var src = node.getAttribute("src");
-            if (!WebInspector.URLRegExp.test(src)) {
+            if (!src.asParsedURL()) {
                 for (var frameOwnerCandidate = node; frameOwnerCandidate; frameOwnerCandidate = frameOwnerCandidate.parentNode) {
                     if (frameOwnerCandidate.documentURL) {
                         var completeSrc = WebInspector.completeURL(frameOwnerCandidate.documentURL, src);
@@ -934,7 +933,6 @@ WebInspector.AuditRules.CookieSizeRule.prototype = {
 
         var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources,
                 null,
-                WebInspector.URLRegExp,
                 true);
         var matchingResourceData = {};
         this.mapResourceCookies(domainToResourcesMap, allCookies, collectorCallback.bind(this));
@@ -998,7 +996,6 @@ WebInspector.AuditRules.StaticCookielessRule.prototype = {
         var domainToResourcesMap = WebInspector.AuditRules.getDomainToResourcesMap(resources,
                 [WebInspector.Resource.Type.Stylesheet,
                  WebInspector.Resource.Type.Image],
-                WebInspector.URLRegExp,
                 true);
         var totalStaticResources = 0;
         for (var domain in domainToResourcesMap)
diff --git a/WebCore/inspector/front-end/BreakpointManager.js b/WebCore/inspector/front-end/BreakpointManager.js
index ec4e7cf..77ba89d 100644
--- a/WebCore/inspector/front-end/BreakpointManager.js
+++ b/WebCore/inspector/front-end/BreakpointManager.js
@@ -27,7 +27,8 @@
 WebInspector.BreakpointManager = function()
 {
     this._breakpoints = {};
-    this._xhrBreakpoints = {};
+    this._nativeBreakpoints = {};
+    this._domBreakpoints = {};
 }
 
 WebInspector.BreakpointManager.prototype = {
@@ -87,6 +88,7 @@ WebInspector.BreakpointManager.prototype = {
     {
         this._breakpoints = {};
         delete this._oneTimeBreakpoint;
+        this._nativeBreakpoints = {};
     },
 
     _setBreakpoint: function(sourceID, url, line, enabled, condition)
@@ -127,20 +129,144 @@ WebInspector.BreakpointManager.prototype = {
         InspectorBackend.setBreakpoint(breakpoint.sourceID, breakpoint.line, breakpoint.enabled, breakpoint.condition, didSetBreakpoint.bind(this));
     },
 
-    createXHRBreakpoint: function(url)
+    createDOMBreakpoint: function(nodeId, domEventType, disabled)
     {
-        if (url in this._xhrBreakpoints)
+        var frontendId = "dom:" + nodeId + ":" + domEventType;
+        if (frontendId in this._nativeBreakpoints)
             return;
-        this._xhrBreakpoints[url] = true;
 
-        var breakpoint = new WebInspector.XHRBreakpoint(url);
-        breakpoint.addEventListener("removed", this._xhrBreakpointRemoved.bind(this));
+        var breakpoint = new WebInspector.DOMBreakpoint(this, frontendId, nodeId, domEventType);
+        this._nativeBreakpoints[frontendId] = breakpoint;
+        this._domBreakpoints[frontendId] = breakpoint;
+        this.dispatchEventToListeners("dom-breakpoint-added", breakpoint);
+        breakpoint.enabled = !disabled;
+        return breakpoint;
+    },
+
+    createEventListenerBreakpoint: function(eventName, disabled)
+    {
+        var frontendId = eventName;
+        if (frontendId in this._nativeBreakpoints)
+            return;
+
+        var breakpoint = new WebInspector.EventListenerBreakpoint(this, frontendId, eventName);
+        this._nativeBreakpoints[frontendId] = breakpoint;
+        breakpoint.enabled = !disabled;
+        return breakpoint;
+    },
+
+    createXHRBreakpoint: function(url, disabled)
+    {
+        var frontendId = url;
+        if (frontendId in this._nativeBreakpoints)
+            return;
+
+        var breakpoint = new WebInspector.XHRBreakpoint(this, frontendId, url);
+        this._nativeBreakpoints[frontendId] = breakpoint;
         this.dispatchEventToListeners("xhr-breakpoint-added", breakpoint);
+        breakpoint.enabled = !disabled
+        return breakpoint;
     },
 
-    _xhrBreakpointRemoved: function(event)
+    _removeNativeBreakpoint: function(breakpoint)
     {
-        delete this._xhrBreakpoints[event.target.url];
+        if (breakpoint._beingSetOnBackend)
+            return;
+        if (breakpoint.enabled)
+            this._removeNativeBreakpointFromBackend(breakpoint);
+        delete this._nativeBreakpoints[breakpoint._frontendId];
+        if (breakpoint._type === "DOM")
+            delete this._domBreakpoints[breakpoint._frontendId];
+        breakpoint.dispatchEventToListeners("removed");
+    },
+
+    _setNativeBreakpointEnabled: function(breakpoint, enabled)
+    {
+        if (breakpoint._beingSetOnBackend)
+            return;
+        if (breakpoint.enabled === enabled)
+            return;
+        if (enabled)
+            this._setNativeBreakpointOnBackend(breakpoint);
+        else
+            this._removeNativeBreakpointFromBackend(breakpoint);
+    },
+
+    _setNativeBreakpointOnBackend: function(breakpoint)
+    {
+        breakpoint._beingSetOnBackend = true;
+        var data = { type: breakpoint._type, condition: breakpoint._condition() };
+        InspectorBackend.setNativeBreakpoint(data, didSetNativeBreakpoint.bind(this));
+
+        function didSetNativeBreakpoint(backendBreakpointId)
+        {
+            breakpoint._beingSetOnBackend = false;
+            if (backendBreakpointId !== "") {
+                breakpoint._backendId = backendBreakpointId;
+                this._breakpoints[backendBreakpointId] = breakpoint;
+            }
+            breakpoint.dispatchEventToListeners("enable-changed");
+        }
+    },
+
+    _removeNativeBreakpointFromBackend: function(breakpoint)
+    {
+        InspectorBackend.removeNativeBreakpoint(breakpoint._backendId);
+        delete this._breakpoints[breakpoint._backendId]
+        delete breakpoint._backendId;
+        breakpoint.dispatchEventToListeners("enable-changed");
+    },
+
+    debuggerPaused: function(details)
+    {
+        if (details.eventType !== WebInspector.DebuggerEventTypes.NativeBreakpoint)
+            return;
+
+        var breakpoint = this._breakpoints[details.eventData.breakpointId];
+        if (!breakpoint)
+            return;
+
+        breakpoint.hit = true;
+        breakpoint.dispatchEventToListeners("hit-state-changed");
+        this._lastHitBreakpoint = breakpoint;
+
+        this.dispatchEventToListeners("breakpoint-hit", { breakpoint: breakpoint, eventData: details.eventData });
+    },
+
+    debuggerResumed: function()
+    {
+        if (!this._lastHitBreakpoint)
+            return;
+        this._lastHitBreakpoint.hit = false;
+        this._lastHitBreakpoint.dispatchEventToListeners("hit-state-changed");
+        delete this._lastHitBreakpoint;
+    },
+
+    restoreDOMBreakpoints: function()
+    {
+        var domBreakpoints = this._domBreakpoints;
+        this._domBreakpoints = {};
+
+        var breakpointsToRestore = {};
+        for (var frontendId in domBreakpoints) {
+            var breakpoint = domBreakpoints[frontendId];
+            var path = breakpoint._path;
+            if (!path)
+                continue;
+            if (!breakpointsToRestore[path]) {
+                breakpointsToRestore[path] = [];
+                InspectorBackend.pushNodeByPathToFrontend(path, restoreBreakpointsForNode.bind(this, breakpointsToRestore[path]));
+            }
+            breakpointsToRestore[path].push(breakpoint);
+        }
+
+        function restoreBreakpointsForNode(breakpoints, nodeId)
+        {
+            if (!nodeId)
+                return;
+            for (var i = 0; i < breakpoints.length; ++i)
+                this.createDOMBreakpoint(nodeId, breakpoints[i]._domEventType, !breakpoints[i].enabled);
+        }
     }
 }
 
@@ -226,82 +352,237 @@ WebInspector.Breakpoint.prototype = {
 
 WebInspector.Breakpoint.prototype.__proto__ = WebInspector.Object.prototype;
 
-WebInspector.XHRBreakpoint = function(url)
+WebInspector.NativeBreakpoint = function(manager, frontendId, type)
 {
-    this._url = url;
-    this._locked = false;
-    this.enabled = true;
+    this._manager = manager;
+    this.__frontendId = frontendId;
+    this.__type = type;
 }
 
-WebInspector.XHRBreakpoint.prototype = {
+WebInspector.NativeBreakpoint.prototype = {
     get enabled()
     {
-        return "_id" in this;
+        return "_backendId" in this;
     },
 
     set enabled(enabled)
     {
-        if (this._locked)
-            return;
-        if (this.enabled === enabled)
-            return;
-        if (enabled)
-            this._setOnBackend();
-        else
-            this._removeFromBackend();
+        this._manager._setNativeBreakpointEnabled(this, enabled);
     },
 
-    get url()
+    remove: function()
     {
-        return this._url;
+        this._manager._removeNativeBreakpoint(this);
+        this._onRemove();
     },
 
-    formatLabel: function()
+    get _frontendId()
     {
-        var label = "";
-        if (!this.url.length)
-            label = WebInspector.UIString("Any XHR");
-        else
-            label = WebInspector.UIString("URL contains \"%s\"", this.url);
-        return label;
+        return this.__frontendId;
     },
 
-    compareTo: function(other)
+    get _type()
     {
-        if (this.url != other.url)
-            return this.url < other.url ? -1 : 1;
+        return this.__type;
+    },
+
+    _compare: function(x, y)
+    {
+        if (x !== y)
+            return x < y ? -1 : 1;
         return 0;
     },
 
-    remove: function()
+    _onRemove: function()
     {
-        if (this._locked)
-            return;
-        if (this.enabled)
-            this._removeFromBackend();
-        this.dispatchEventToListeners("removed");
+    }
+}
+
+WebInspector.NativeBreakpoint.prototype.__proto__ = WebInspector.Object.prototype;
+
+WebInspector.DOMBreakpoint = function(manager, frontendId, nodeId, domEventType)
+{
+    WebInspector.NativeBreakpoint.call(this, manager, frontendId, "DOM");
+    this._nodeId = nodeId;
+    this._domEventType = domEventType;
+
+    var node = WebInspector.domAgent.nodeForId(this._nodeId);
+    if (node) {
+        node.breakpoints[this._domEventType] = this;
+        this._path = node.path();
+    }
+}
+
+WebInspector.DOMBreakpoint.prototype = {
+    click: function()
+    {
+        WebInspector.updateFocusedNode(this._nodeId);
     },
 
-    _setOnBackend: function()
+    compareTo: function(other)
     {
-        this._locked = true;
-        var data = { type: "XHR", condition: { url: this.url } };
-        InspectorBackend.setNativeBreakpoint(data, didSet.bind(this));
+        return this._compare(this._domEventType, other._domEventType);
+    },
 
-        function didSet(breakpointId)
+    populateLabelElement: function(element)
+    {
+        element.appendChild(WebInspector.panels.elements.linkifyNodeById(this._nodeId));
+        element.appendChild(document.createTextNode(" - "));
+        element.appendChild(document.createTextNode(WebInspector.domBreakpointTypeLabel(this._domEventType)));
+    },
+
+    populateStatusMessageElement: function(element, eventData)
+    {
+        var substitutions = [WebInspector.domBreakpointTypeLabel(this._domEventType), WebInspector.panels.elements.linkifyNodeById(this._nodeId)];
+        var formatters = {
+            s: function(substitution)
+            {
+                return substitution;
+            }
+        };
+        function append(a, b)
         {
-            this._locked = false;
-            this._id = breakpointId;
-            this.dispatchEventToListeners("enable-changed");
+            if (typeof b === "string")
+                b = document.createTextNode(b);
+            element.appendChild(b);
         }
+        if (this._domEventType === WebInspector.DOMBreakpointTypes.SubtreeModified) {
+            var targetNode = WebInspector.panels.elements.linkifyNodeById(eventData.targetNodeId);
+            if (eventData.insertion) {
+                if (eventData.targetNodeId !== this._nodeId)
+                    WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s.", substitutions.concat(targetNode), formatters, "", append);
+                else
+                    WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node.", substitutions, formatters, "", append);
+            } else
+                WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because its descendant %s was removed.", substitutions.concat(targetNode), formatters, "", append);
+        } else
+            WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s.", substitutions, formatters, "", append);
     },
 
-    _removeFromBackend: function()
+    _condition: function()
     {
-        InspectorBackend.removeNativeBreakpoint(this._id);
-        delete this._id;
-        this.dispatchEventToListeners("enable-changed");
+        return { nodeId: this._nodeId, type: this._domEventType };
+    },
+
+    _onRemove: function()
+    {
+        var node = WebInspector.domAgent.nodeForId(this._nodeId);
+        if (node)
+            delete node.breakpoints[this._domEventType];
     }
 }
 
-WebInspector.XHRBreakpoint.prototype.__proto__ = WebInspector.Object.prototype;
+WebInspector.DOMBreakpoint.prototype.__proto__ = WebInspector.NativeBreakpoint.prototype;
+
+WebInspector.EventListenerBreakpoint = function(manager, frontendId, eventName)
+{
+    WebInspector.NativeBreakpoint.call(this, manager, frontendId, "EventListener");
+    this._eventName = eventName;
+}
+
+WebInspector.EventListenerBreakpoint.prototype = {
+    compareTo: function(other)
+    {
+        return this._compare(this._eventName, other._eventName);
+    },
+
+    populateLabelElement: function(element)
+    {
+        element.appendChild(document.createTextNode(this._uiEventName()));
+    },
+
+    populateStatusMessageElement: function(element, eventData)
+    {
+        var status = WebInspector.UIString("Paused on a \"%s\" Event Listener.", this._uiEventName());
+        element.appendChild(document.createTextNode(status));
+    },
+
+    _condition: function()
+    {
+        return { eventName: this._eventName };
+    },
+
+    _uiEventName: function()
+    {
+        if (!WebInspector.EventListenerBreakpoint._uiEventNames) {
+            WebInspector.EventListenerBreakpoint._uiEventNames = {
+                "instrumentation:setTimer": WebInspector.UIString("Set Timer"),
+                "instrumentation:clearTimer": WebInspector.UIString("Clear Timer"),
+                "instrumentation:timerFired": WebInspector.UIString("Timer Fired")
+            };
+        }
+        return WebInspector.EventListenerBreakpoint._uiEventNames[this._eventName] || this._eventName.substring(this._eventName.indexOf(":") + 1);
+    }
+}
+
+WebInspector.EventListenerBreakpoint.prototype.__proto__ = WebInspector.NativeBreakpoint.prototype;
+
+WebInspector.XHRBreakpoint = function(manager, frontendId, url)
+{
+    WebInspector.NativeBreakpoint.call(this, manager, frontendId, "XHR");
+    this._url = url;
+}
+
+WebInspector.XHRBreakpoint.prototype = {
+    compareTo: function(other)
+    {
+        return this._compare(this._url, other._url);
+    },
+
+    populateLabelElement: function(element)
+    {
+        var label;
+        if (!this._url.length)
+            label = WebInspector.UIString("Any XHR");
+        else
+            label = WebInspector.UIString("URL contains \"%s\"", this._url);
+        element.appendChild(document.createTextNode(label));
+    },
+
+    populateStatusMessageElement: function(element)
+    {
+        var status = WebInspector.UIString("Paused on a XMLHttpRequest.");
+        element.appendChild(document.createTextNode(status));
+    },
+
+    _condition: function()
+    {
+        return { url: this._url };
+    }
+}
+
+WebInspector.XHRBreakpoint.prototype.__proto__ = WebInspector.NativeBreakpoint.prototype;
+
+WebInspector.DebuggerEventTypes = {
+    JavaScriptPause: 0,
+    JavaScriptBreakpoint: 1,
+    NativeBreakpoint: 2
+};
+
+WebInspector.DOMBreakpointTypes = {
+    SubtreeModified: 0,
+    AttributeModified: 1,
+    NodeRemoved: 2
+};
+
+WebInspector.domBreakpointTypeLabel = function(type)
+{
+    if (!WebInspector._DOMBreakpointTypeLabels) {
+        WebInspector._DOMBreakpointTypeLabels = {};
+        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.SubtreeModified] = WebInspector.UIString("Subtree Modified");
+        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.AttributeModified] = WebInspector.UIString("Attribute Modified");
+        WebInspector._DOMBreakpointTypeLabels[WebInspector.DOMBreakpointTypes.NodeRemoved] = WebInspector.UIString("Node Removed");
+    }
+    return WebInspector._DOMBreakpointTypeLabels[type];
+}
+
+WebInspector.domBreakpointTypeContextMenuLabel = function(type)
+{
+    if (!WebInspector._DOMBreakpointTypeContextMenuLabels) {
+        WebInspector._DOMBreakpointTypeContextMenuLabels = {};
+        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.SubtreeModified] = WebInspector.UIString("Break on Subtree Modifications");
+        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.AttributeModified] = WebInspector.UIString("Break on Attributes Modifications");
+        WebInspector._DOMBreakpointTypeContextMenuLabels[WebInspector.DOMBreakpointTypes.NodeRemoved] = WebInspector.UIString("Break on Node Removal");
+    }
+    return WebInspector._DOMBreakpointTypeContextMenuLabels[type];
+}
diff --git a/WebCore/inspector/front-end/BreakpointsSidebarPane.js b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
index 16ab041..2151137 100644
--- a/WebCore/inspector/front-end/BreakpointsSidebarPane.js
+++ b/WebCore/inspector/front-end/BreakpointsSidebarPane.js
@@ -113,6 +113,9 @@ WebInspector.XHRBreakpointsSidebarPane.prototype = {
         if (this.urlInputElement.parentElement)
             return;
 
+        if (!this.expanded)
+            this.expanded = true;
+
         this.urlInputElement.textContent = "";
         this.bodyElement.insertBefore(this.urlInputElement, this.bodyElement.firstChild);
         WebInspector.startEditing(this.urlInputElement, this._hideEditBreakpointDialog.bind(this, false), this._hideEditBreakpointDialog.bind(this, true));
@@ -142,7 +145,11 @@ WebInspector.BreakpointItem = function(breakpoint)
     checkboxElement.addEventListener("click", this._checkboxClicked.bind(this), false);
     this._element.appendChild(checkboxElement);
 
+    if ("populateLabelElement" in this._breakpoint)
+        this._breakpoint.populateLabelElement(this._element);
+
     this._breakpoint.addEventListener("enable-changed", this._enableChanged, this);
+    this._breakpoint.addEventListener("hit-state-changed", this._hitStateChanged, this);
     this._breakpoint.addEventListener("removed", this.dispatchEventToListeners.bind(this, "removed"));
 }
 
@@ -162,6 +169,12 @@ WebInspector.BreakpointItem.prototype = {
         this._breakpoint.remove();
     },
 
+    _breakpointClicked: function(event)
+    {
+        if ("click" in this._breakpoint)
+            this._breakpoint.click();
+    },
+
     _checkboxClicked: function(event)
     {
         this._breakpoint.enabled = !this._breakpoint.enabled;
@@ -176,8 +189,12 @@ WebInspector.BreakpointItem.prototype = {
         checkbox.checked = this._breakpoint.enabled;
     },
 
-    _breakpointClicked: function(event)
+    _hitStateChanged: function(event)
     {
+        if (event.target.hit)
+            this._element.addStyleClass("breakpoint-hit");
+        else
+            this._element.removeStyleClass("breakpoint-hit");
     }
 }
 
@@ -214,33 +231,119 @@ WebInspector.JSBreakpointItem.prototype = {
 
 WebInspector.JSBreakpointItem.prototype.__proto__ = WebInspector.BreakpointItem.prototype;
 
-WebInspector.DOMBreakpointItem = function(breakpoint)
+WebInspector.EventListenerBreakpointsSidebarPane = function()
 {
-    WebInspector.BreakpointItem.call(this, breakpoint);
+    WebInspector.SidebarPane.call(this, WebInspector.UIString("Event Listener Breakpoints"));
 
-    var link = WebInspector.panels.elements.linkifyNodeById(this._breakpoint.nodeId);
-    this._element.appendChild(link);
-
-    var type = WebInspector.DOMBreakpoint.labelForType(this._breakpoint.type);
-    var typeElement = document.createTextNode(" - " + type);
-    this._element.appendChild(typeElement);
+    this.categoriesElement = document.createElement("ol");
+    this.categoriesElement.tabIndex = 0;
+    this.categoriesElement.addStyleClass("properties-tree event-listener-breakpoints");
+    this.categoriesTreeOutline = new TreeOutline(this.categoriesElement);
+    this.bodyElement.appendChild(this.categoriesElement);
 }
 
-WebInspector.DOMBreakpointItem.prototype = {
-    _breakpointClicked: function()
+WebInspector.EventListenerBreakpointsSidebarPane.prototype = {
+    _populate: function()
     {
-        WebInspector.updateFocusedNode(this._breakpoint.nodeId);
-    }
-}
+        var categories = {
+            "Mouse": { type: "listener", eventNames: ["click", "dblclick", "mousedown", "mouseup", "mouseover", "mousemove", "mouseout", "mousewheel"] },
+            "Keyboard": { type: "listener", eventNames: ["keydown", "keypress", "keyup"] },
+            "HTML frame/object":  { type: "listener", eventNames: ["load", "error", "resize", "scroll"] },
+            "Timer": { type: "instrumentation", eventNames: ["setTimer", "clearTimer", "timerFired"] }
+        };
+
+        for (var category in categories) {
+            var categoryTreeElement = new TreeElement(WebInspector.UIString(category));
+            this.categoriesTreeOutline.appendChild(categoryTreeElement);
+            categoryTreeElement.listItemElement.addStyleClass("event-category");
+            categoryTreeElement.selectable = true;
+
+            var categoryItem = {};
+            categoryItem.checkbox = this._createCheckbox(categoryTreeElement, this._categoryCheckboxClicked.bind(this, categoryItem));
+            categoryItem.children = {};
+
+            var categoryType = categories[category].type;
+            var eventNames = categories[category].eventNames;
+            for (var i = 0; i < eventNames.length; ++i) {
+                var eventName = categoryType + ":" + eventNames[i];
+
+                var breakpoint = WebInspector.breakpointManager.createEventListenerBreakpoint(eventName, true);
+                if (!breakpoint)
+                    continue;
+
+                var labelElement = document.createElement("div");
+                breakpoint.populateLabelElement(labelElement);
+                var eventNameTreeElement = new TreeElement(labelElement);
+                categoryTreeElement.appendChild(eventNameTreeElement);
+                eventNameTreeElement.listItemElement.addStyleClass("source-code");
+                eventNameTreeElement.selectable = true;
+
+                var eventNameItem = {};
+                eventNameItem.checkbox = this._createCheckbox(eventNameTreeElement, this._eventNameCheckboxClicked.bind(this, categoryItem, eventNameItem));
+                eventNameItem.breakpoint = breakpoint;
+
+                breakpoint.addEventListener("enable-changed", this._breakpointEnableChanged.bind(this, categoryItem, eventNameItem), true);
+
+                categoryItem.children[eventName] = eventNameItem;
+            }
+        }
+    },
 
-WebInspector.DOMBreakpointItem.prototype.__proto__ = WebInspector.BreakpointItem.prototype;
+    _createCheckbox: function(treeElement, checkboxClickedDelegate)
+    {
+        var checkbox = document.createElement("input");
+        checkbox.className = "checkbox-elem";
+        checkbox.type = "checkbox";
+        checkbox.addEventListener("click", checkboxClickedDelegate, true);
+        treeElement.listItemElement.insertBefore(checkbox, treeElement.listItemElement.firstChild);
+        return checkbox;
+    },
 
-WebInspector.XHRBreakpointItem = function(breakpoint)
-{
-    WebInspector.BreakpointItem.call(this, breakpoint);
+    _categoryCheckboxClicked: function(categoryItem)
+    {
+        var checkbox = categoryItem.checkbox;
+        checkbox.indeterminate = false;
+        for (var eventName in categoryItem.children) {
+            var eventNameItem = categoryItem.children[eventName];
+            eventNameItem.checkbox.checked = checkbox.checked;
+            eventNameItem.breakpoint.enabled = checkbox.checked;
+        }
+    },
+
+    _eventNameCheckboxClicked: function(categoryItem, eventNameItem)
+    {
+        this._updateCategoryCheckbox(categoryItem);
+        eventNameItem.breakpoint.enabled = eventNameItem.checkbox.checked;
+    },
+
+    _breakpointEnableChanged: function(categoryItem, eventNameItem)
+    {
+        if (eventNameItem.checkbox.checked === eventNameItem.breakpoint.enabled)
+            return;
 
-    var label = document.createTextNode(this._breakpoint.formatLabel());
-    this._element.appendChild(label);
+        eventNameItem.checkbox.checked = eventNameItem.breakpoint.enabled;
+        this._updateCategoryCheckbox(categoryItem);
+    },
+
+    _updateCategoryCheckbox: function(categoryItem)
+    {
+        var hasEnabled = false, hasDisabled = false;
+        for (var eventName in categoryItem.children) {
+            var eventNameItem = categoryItem.children[eventName];
+            if (eventNameItem.checkbox.checked)
+                hasEnabled = true;
+            else
+                hasDisabled = true;
+        }
+        categoryItem.checkbox.checked = hasEnabled;
+        categoryItem.checkbox.indeterminate = hasEnabled && hasDisabled;
+    },
+
+    reset: function()
+    {
+        this.categoriesTreeOutline.removeChildren();
+        this._populate();
+    }
 }
 
-WebInspector.XHRBreakpointItem.prototype.__proto__ = WebInspector.BreakpointItem.prototype;
+WebInspector.EventListenerBreakpointsSidebarPane.prototype.__proto__ = WebInspector.SidebarPane.prototype;
diff --git a/WebCore/inspector/front-end/CSSStyleModel.js b/WebCore/inspector/front-end/CSSStyleModel.js
index bda4064..e3e9b4f 100644
--- a/WebCore/inspector/front-end/CSSStyleModel.js
+++ b/WebCore/inspector/front-end/CSSStyleModel.js
@@ -96,13 +96,13 @@ WebInspector.CSSStyleModel.prototype = {
 
     applyStyleText: function(styleId, styleText, propertyName, successCallback, failureCallback)
     {
-        function callback(success, newPayload, changedProperties)
+        function callback(success, newPayload)
         {
             if (!success)
                 failureCallback();
             else {
                 var newStyle = newPayload ? WebInspector.CSSStyleDeclaration.parseStyle(newPayload) : null;
-                successCallback(newStyle, changedProperties);
+                successCallback(newStyle);
             }
         }
 
diff --git a/WebCore/inspector/front-end/CallStackSidebarPane.js b/WebCore/inspector/front-end/CallStackSidebarPane.js
index 6212ea1..08c1942 100644
--- a/WebCore/inspector/front-end/CallStackSidebarPane.js
+++ b/WebCore/inspector/front-end/CallStackSidebarPane.js
@@ -26,13 +26,9 @@
 WebInspector.CallStackSidebarPane = function()
 {
     WebInspector.SidebarPane.call(this, WebInspector.UIString("Call Stack"));
+    WebInspector.breakpointManager.addEventListener("breakpoint-hit", this._breakpointHit, this);
 }
 
-WebInspector.CallStackSidebarPane.DebuggerEventType = {
-    DOMBreakpoint: 0,
-    NativeBreakpoint: 1
-};
-
 WebInspector.CallStackSidebarPane.prototype = {
     update: function(callFrames, sourceIDMap)
     {
@@ -87,44 +83,6 @@ WebInspector.CallStackSidebarPane.prototype = {
         }
     },
 
-    updateStatus:  function(eventType, eventData)
-    {
-        var statusElement = document.createElement("div");
-        if (eventType === WebInspector.CallStackSidebarPane.DebuggerEventType.DOMBreakpoint) {
-            var breakpoint = eventData.breakpoint;
-            var substitutions = [WebInspector.DOMBreakpoint.labelForType(breakpoint.type), WebInspector.panels.elements.linkifyNodeById(breakpoint.nodeId)];
-            var formatters = {
-                s: function(substitution)
-                {
-                    return substitution;
-                }
-            };
-            function append(a, b)
-            {
-                if (typeof b === "string")
-                    b = document.createTextNode(b);
-                statusElement.appendChild(b);
-            }
-            if (breakpoint.type === WebInspector.DOMBreakpoint.Types.SubtreeModified) {
-                var targetNode = WebInspector.panels.elements.linkifyNodeById(eventData.targetNodeId);
-                if (eventData.insertion) {
-                    if (eventData.targetNodeId !== breakpoint.nodeId)
-                        WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because a new child was added to its descendant %s.", substitutions.concat(targetNode), formatters, "", append);
-                    else
-                        WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because a new child was added to that node.", substitutions, formatters, "", append);
-                } else
-                    WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s, because its descendant %s was removed.", substitutions.concat(targetNode), formatters, "", append);
-            } else
-                WebInspector.formatLocalized("Paused on a \"%s\" breakpoint set on %s.", substitutions, formatters, "", append);
-        } else if (eventType === WebInspector.CallStackSidebarPane.DebuggerEventType.NativeBreakpoint && eventData.type === "XHR")
-             statusElement.appendChild(document.createTextNode(WebInspector.UIString("Paused on XMLHttpRequest.")));
-        else
-            return;
-
-        statusElement.className = "info";
-        this.bodyElement.appendChild(statusElement);
-    },
-
     get selectedCallFrame()
     {
         return this._selectedCallFrame;
@@ -210,6 +168,16 @@ WebInspector.CallStackSidebarPane.prototype = {
         this._shortcuts[prevCallFrame.key] = this._selectPreviousCallFrameOnStack.bind(this);
 
         section.addRelatedKeys([ nextCallFrame.name, prevCallFrame.name ], WebInspector.UIString("Next/previous call frame"));
+    },
+
+    _breakpointHit:  function(event)
+    {
+        var breakpoint = event.data.breakpoint;
+
+        var statusMessageElement = document.createElement("div");
+        statusMessageElement.className = "info";
+        breakpoint.populateStatusMessageElement(statusMessageElement, event.data.eventData);
+        this.bodyElement.appendChild(statusMessageElement);
     }
 }
 
diff --git a/WebCore/inspector/front-end/ConsoleView.js b/WebCore/inspector/front-end/ConsoleView.js
index 6f8bd8b..8cd5d52 100644
--- a/WebCore/inspector/front-end/ConsoleView.js
+++ b/WebCore/inspector/front-end/ConsoleView.js
@@ -64,7 +64,7 @@ WebInspector.ConsoleView = function(drawer)
 
     function createDividerElement() {
         var dividerElement = document.createElement("div");
-        dividerElement.addStyleClass("divider");
+        dividerElement.addStyleClass("scope-bar-divider");
         this.filterBarElement.appendChild(dividerElement);
     }
 
@@ -360,7 +360,7 @@ WebInspector.ConsoleView.prototype = {
         }
 
         var results = [];
-        var properties = Object.sortedProperties(result);
+        var properties = Object.keys(result).sort();
 
         for (var i = 0; i < properties.length; ++i) {
             var property = properties[i];
@@ -679,25 +679,22 @@ WebInspector.ConsoleMessage.prototype = {
             case WebInspector.ConsoleMessage.MessageType.UncaughtException:
                 var ol = document.createElement("ol");
                 ol.addStyleClass("stack-trace");
-                if (this.type === WebInspector.ConsoleMessage.MessageType.Trace)
-                    ol.addStyleClass("trace-message");
                 var treeOutline = new TreeOutline(ol);
+                var messageText;
+                if (this.type === WebInspector.ConsoleMessage.MessageType.Assert)
+                    messageText = this._format(this._parameters);
+                else if (this.type === WebInspector.ConsoleMessage.MessageType.Trace)
+                    messageText = document.createTextNode("console.trace()");
+                else
+                    messageText = document.createTextNode(this._messageText);
 
-                var root = treeOutline;
-                if (this.type === WebInspector.ConsoleMessage.MessageType.UncaughtException ||
-                    this.type === WebInspector.ConsoleMessage.MessageType.Assert) {
-                    var messageText;
-                    if (this.type === WebInspector.ConsoleMessage.MessageType.Assert)
-                        messageText = this._format(this._parameters);
-                    else
-                        messageText = document.createTextNode(this._messageText);
-
-                    var content = document.createElement("div");
-                    this._addMessageHeader(content, messageText);
-                    root = new TreeElement(content, null, true);
-                    content.treeElementForTest = root;
-                    treeOutline.appendChild(root);
-                }
+                var content = document.createElement("div");
+                this._addMessageHeader(content, messageText);
+                var root = new TreeElement(content, null, true);
+                content.treeElementForTest = root;
+                treeOutline.appendChild(root);
+                if (this.type === WebInspector.ConsoleMessage.MessageType.Trace)
+                    root.expand();
 
                 this._populateStackTraceTreeElement(root);
                 this.formattedMessage = ol;
diff --git a/WebCore/inspector/front-end/CookieItemsView.js b/WebCore/inspector/front-end/CookieItemsView.js
index 1baf4a6..88cbe05 100644
--- a/WebCore/inspector/front-end/CookieItemsView.js
+++ b/WebCore/inspector/front-end/CookieItemsView.js
@@ -122,8 +122,8 @@ WebInspector.CookieItemsView.prototype = {
 
         for (var id in WebInspector.resources) {
             var resource = WebInspector.resources[id];
-            var match = resource.documentURL.match(WebInspector.GenericURLRegExp);
-            if (match && match[2] === this._cookieDomain)
+            var url = resource.documentURL.asParsedURL();
+            if (url && url.host == this._cookieDomain)
                 resourceURLsForDocumentURL.push(resource.url);
         }
 
diff --git a/WebCore/inspector/front-end/CookieParser.js b/WebCore/inspector/front-end/CookieParser.js
new file mode 100755
index 0000000..2be5df7
--- /dev/null
+++ b/WebCore/inspector/front-end/CookieParser.js
@@ -0,0 +1,204 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+// Ideally, we would rely on platform support for parsing a cookie, since
+// this would save us from any potential inconsistency. However, exposing
+// platform cookie parsing logic would require quite a bit of additional 
+// plumbing, and at least some platforms lack support for parsing Cookie,
+// which is in a format slightly different from Set-Cookie and is normally 
+// only required on the server side.
+
+WebInspector.CookieParser = function()
+{
+}
+
+WebInspector.CookieParser.prototype = {
+    get cookies()
+    {
+        return this._cookies;
+    },
+
+    parseCookie: function(cookieHeader)
+    {
+        if (!this._initialize(cookieHeader))
+            return;
+
+        for (var kv = this._extractKeyValue(); kv; kv = this._extractKeyValue()) {
+            if (kv.key.charAt(0) === "$" && this._lastCookie)
+                this._lastCookie.addAttribute(kv.key.slice(1), kv.value);
+            else if (kv.key.toLowerCase() !== "$version" && typeof kv.value === "string")
+                this._addCookie(kv);
+            this._advanceAndCheckCookieDelimiter();
+        }
+        this._flushCookie();
+        return this._cookies;
+    },
+
+    parseSetCookie: function(setCookieHeader)
+    {
+        if (!this._initialize(setCookieHeader))
+            return;
+        for (var kv = this._extractKeyValue(); kv; kv = this._extractKeyValue()) {
+            if (this._lastCookie)
+                this._lastCookie.addAttribute(kv.key, kv.value);
+            else 
+                this._addCookie(kv);
+            if (this._advanceAndCheckCookieDelimiter())
+                this._flushCookie();
+        }
+        this._flushCookie();
+        return this._cookies;
+    },
+
+    _initialize: function(headerValue)
+    {
+        this._input = headerValue;
+        if (typeof headerValue !== "string")
+            return false;
+        this._cookies = [];
+        this._lastCookie = null;
+        this._originalInputLength = this._input.length;
+        return true;
+    },
+
+    _flushCookie: function()
+    {
+        if (this._lastCookie)
+            this._lastCookie.size = this._originalInputLength - this._input.length - this._lastCookiePosition;
+        this._lastCookie = null;
+    },
+
+    _extractKeyValue: function()
+    {
+        if (!this._input || !this._input.length)
+            return null;
+        // Note: RFCs offer an option for quoted values that may contain commas and semicolons.
+        // Many browsers/platforms do not support this, however (see http://webkit.org/b/16699
+        // and http://crbug.com/12361). The logic below matches latest versions of IE, Firefox,
+        // Chrome and Safari on some old platforms. The latest version of Safari supports quoted
+        // cookie values, though. 
+        var keyValueMatch = /^[ \t]*([^\s=;]+)[ \t]*(?:=[ \t]*([^;\n]*))?/.exec(this._input);
+        if (!keyValueMatch) {
+            console.log("Failed parsing cookie header before: " + this._input);
+            return null;
+        }
+
+        var result = {
+            key: keyValueMatch[1],
+            value: keyValueMatch[2] && keyValueMatch[2].trim(),
+            position: this._originalInputLength - this._input.length
+        };
+        this._input = this._input.slice(keyValueMatch[0].length);
+        return result;
+    },
+
+    _advanceAndCheckCookieDelimiter: function()
+    {
+        var match = /^\s*[\n;]\s*/.exec(this._input);
+        if (!match)
+            return false;
+        this._input = this._input.slice(match[0].length);
+        return match[0].match("\n") !== null;
+    },
+
+    _addCookie: function(keyValue)
+    {
+        if (this._lastCookie)
+            this._lastCookie.size = keyValue.position - this._lastCookiePosition;
+        // Mozilla bug 169091: Mozilla, IE and Chrome treat signle token (w/o "=") as
+        // specifying a value for a cookie with empty name.
+        this._lastCookie = keyValue.value ? new WebInspector.Cookie(keyValue.key, keyValue.value) :
+            new WebInspector.Cookie("", keyValue.key);
+        this._lastCookiePosition = keyValue.position;
+        this._cookies.push(this._lastCookie);
+    }
+};
+
+WebInspector.CookieParser.parseCookie = function(header)
+{
+    return (new WebInspector.CookieParser()).parseCookie(header);
+}
+
+WebInspector.CookieParser.parseSetCookie = function(header)
+{
+    return (new WebInspector.CookieParser()).parseSetCookie(header);
+}
+
+WebInspector.Cookie = function(name, value)
+{
+    this.name = name;
+    this.value = value;
+    this._attributes = {};
+}
+
+WebInspector.Cookie.prototype = {
+    get httpOnly()
+    {
+        return "httponly" in this._attributes;
+    },
+
+    get secure()
+    {
+        return "secure" in this._attributes;
+    },
+
+    get session()
+    {
+        // RFC 2965 suggests using Discard attribute to mark session cookies, but this does not seem to be widely used.
+        // Check for absence of explicity max-age or expiry date instead.
+        return  !("expries" in this._attributes || "max-age" in this._attributes);
+    },
+
+    get path()
+    {
+        return this._attributes.path;
+    },
+
+    get domain()
+    {
+        return this._attributes.domain;
+    },
+
+    expires: function(requestDate)
+    {
+        return this._attributes.expires ? new Date(this._attributes.expires) :
+            (this._attributes["max-age"] ? new Date(requestDate.getTime() + 1000 * this._attributes["max-age"]) : null);
+    },
+
+    get attributes()
+    {
+        return this._attributes;
+    },
+
+    addAttribute: function(key, value)
+    {
+        this._attributes[key.toLowerCase()] = value;
+    }
+}
diff --git a/WebCore/inspector/front-end/DOMAgent.js b/WebCore/inspector/front-end/DOMAgent.js
index 279852e..5153fb1 100644
--- a/WebCore/inspector/front-end/DOMAgent.js
+++ b/WebCore/inspector/front-end/DOMAgent.js
@@ -60,6 +60,8 @@ WebInspector.DOMNode = function(doc, payload) {
     this.style = null;
     this._matchedCSSRules = [];
 
+    this.breakpoints = {};
+
     if (this.nodeType === Node.ELEMENT_NODE) {
         // HTML and BODY from internal iframes should not overwrite top-level ones.
         if (!this.ownerDocument.documentElement && this.nodeName === "HTML")
@@ -149,28 +151,6 @@ WebInspector.DOMNode.prototype = {
         return path.join(",");
     },
 
-    setBreakpoint: function(type)
-    {
-        return WebInspector.domBreakpointManager.setBreakpoint(this.id, type, true, this.path());
-    },
-
-    hasBreakpoint: function(type)
-    {
-        return !!WebInspector.domBreakpointManager.findBreakpoint(this.id, type);
-    },
-
-    removeBreakpoint: function(type)
-    {
-        var breakpoint = WebInspector.domBreakpointManager.findBreakpoint(this.id, type);
-        if (breakpoint)
-            breakpoint.remove();
-    },
-
-    removeBreakpoints: function()
-    {
-        WebInspector.domBreakpointManager.removeBreakpointsForNode(this.id);
-    },
-
     _setAttributesPayload: function(attrs)
     {
         this.attributes = [];
@@ -399,7 +379,7 @@ WebInspector.DOMAgent.prototype = {
             this.document = new WebInspector.DOMDocument(this, this._window, payload);
             this._idToDOMNode[payload.id] = this.document;
             this._bindNodes(this.document.children);
-            WebInspector.domBreakpointManager.restoreBreakpoints();
+            WebInspector.breakpointManager.restoreDOMBreakpoints();
         } else
             this.document = null;
         WebInspector.panels.elements.setDocument(this.document);
@@ -461,12 +441,13 @@ WebInspector.DOMAgent.prototype = {
 
     _removeBreakpoints: function(node)
     {
-        node.removeBreakpoints();
+        for (var type in node.breakpoints)
+            node.breakpoints[type].remove();
         if (!node.children)
             return;
         for (var i = 0; i < node.children.length; ++i)
             this._removeBreakpoints(node.children[i]);
-     }
+    }
 }
 
 WebInspector.ApplicationCache = {}
@@ -519,17 +500,12 @@ WebInspector.Cookies.buildCookiesFromString = function(rawCookieString)
 
 WebInspector.Cookies.cookieMatchesResourceURL = function(cookie, resourceURL)
 {
-    var match = resourceURL.match(WebInspector.GenericURLRegExp);
-    if (!match)
+    var url = resourceURL.asParsedURL();
+    if (!url || !this.cookieDomainMatchesResourceDomain(cookie.domain, url.host))
         return false;
-    // See WebInspector.URLRegExp for definitions of the group index constants.
-    if (!this.cookieDomainMatchesResourceDomain(cookie.domain, match[2]))
-        return false;
-    var resourcePort = match[3] ? match[3] : undefined;
-    var resourcePath = match[4] ? match[4] : '/';
-    return (resourcePath.indexOf(cookie.path) === 0
-        && (!cookie.port || resourcePort == cookie.port)
-        && (!cookie.secure || match[1].toLowerCase() === 'https'));
+    return (url.path.indexOf(cookie.path) === 0
+        && (!cookie.port || url.port == cookie.port)
+        && (!cookie.secure || url.scheme === "https"));
 }
 
 WebInspector.Cookies.cookieDomainMatchesResourceDomain = function(cookieDomain, resourceDomain)
@@ -728,166 +704,3 @@ WebInspector.childNodeRemoved = function()
 {
     this.domAgent._childNodeRemoved.apply(this.domAgent, arguments);
 }
-
-WebInspector.DOMBreakpointManager = function()
-{
-    this._breakpoints = {};
-    this._pathCache = {};
-}
-
-WebInspector.DOMBreakpointManager.prototype = {
-    setBreakpoint: function(nodeId, type, enabled, path)
-    {
-        if (!(nodeId in this._breakpoints))
-            this._breakpoints[nodeId] = {};
-        else if (type in this._breakpoints[nodeId])
-            return;
-
-        var breakpoint = new WebInspector.DOMBreakpoint(nodeId, type, enabled);
-        this._breakpoints[nodeId][type] = breakpoint;
-        breakpoint.addEventListener("removed", this._breakpointRemoved, this);
-
-        if (!(nodeId in this._pathCache))
-            this._pathCache[nodeId] = path;
-
-        this.dispatchEventToListeners("dom-breakpoint-added", breakpoint);
-    },
-
-    findBreakpoint: function(nodeId, type)
-    {
-        var nodeBreakpoints = this._breakpoints[nodeId];
-        if (nodeBreakpoints && type in nodeBreakpoints)
-            return nodeBreakpoints[type];
-    },
-
-    removeBreakpointsForNode: function(nodeId)
-    {
-        var nodeBreakpoints = this._breakpoints[nodeId];
-        for (var type in nodeBreakpoints)
-            nodeBreakpoints[type].remove();
-    },
-
-    _breakpointRemoved: function(event)
-    {
-        var breakpoint = event.target;
-
-        var nodeBreakpoints = this._breakpoints[breakpoint.nodeId];
-        delete nodeBreakpoints[breakpoint.type];
-        for (var type in nodeBreakpoints)
-            return;
-
-        delete this._breakpoints[breakpoint.nodeId];
-        delete this._pathCache[breakpoint.nodeId];
-    },
-
-    restoreBreakpoints: function()
-    {
-        var breakpoints = this._breakpoints;
-        this._breakpoints = {};
-        var pathCache = this._pathCache;
-        this._pathCache = {};
-
-        for (var oldNodeId in breakpoints) {
-            var path = pathCache[oldNodeId];
-            InspectorBackend.pushNodeByPathToFrontend(path, restoreBreakpointsForNode.bind(this, breakpoints[oldNodeId], path));
-        }
-
-        function restoreBreakpointsForNode(nodeBreakpoints, path, nodeId)
-        {
-            if (!nodeId)
-                return;
-            for (var type in nodeBreakpoints) {
-                var breakpoint = nodeBreakpoints[type];
-                this.setBreakpoint(nodeId, breakpoint.type, breakpoint.enabled, path);
-            }
-        }
-    }
-}
-
-WebInspector.DOMBreakpointManager.prototype.__proto__ = WebInspector.Object.prototype;
-
-WebInspector.DOMBreakpoint = function(nodeId, type, enabled)
-{
-    this._nodeId = nodeId;
-    this._type = type;
-    this._enabled = enabled;
-
-    if (this.enabled)
-        InspectorBackend.setDOMBreakpoint(this.nodeId, this.type);
-}
-
-WebInspector.DOMBreakpoint.Types = {
-    SubtreeModified: 0,
-    AttributeModified: 1,
-    NodeRemoved: 2
-};
-
-WebInspector.DOMBreakpoint.labelForType = function(type)
-{
-    if (!WebInspector.DOMBreakpoint._labels) {
-        WebInspector.DOMBreakpoint._labels = {};
-        WebInspector.DOMBreakpoint._labels[WebInspector.DOMBreakpoint.Types.SubtreeModified] = WebInspector.UIString("Subtree Modified");
-        WebInspector.DOMBreakpoint._labels[WebInspector.DOMBreakpoint.Types.AttributeModified] = WebInspector.UIString("Attribute Modified");
-        WebInspector.DOMBreakpoint._labels[WebInspector.DOMBreakpoint.Types.NodeRemoved] = WebInspector.UIString("Node Removed");
-    }
-    return WebInspector.DOMBreakpoint._labels[type];
-}
-
-WebInspector.DOMBreakpoint.contextMenuLabelForType = function(type)
-{
-    if (!WebInspector.DOMBreakpoint._contextMenuLabels) {
-        WebInspector.DOMBreakpoint._contextMenuLabels = {};
-        WebInspector.DOMBreakpoint._contextMenuLabels[WebInspector.DOMBreakpoint.Types.SubtreeModified] = WebInspector.UIString("Break on Subtree Modifications");
-        WebInspector.DOMBreakpoint._contextMenuLabels[WebInspector.DOMBreakpoint.Types.AttributeModified] = WebInspector.UIString("Break on Attributes Modifications");
-        WebInspector.DOMBreakpoint._contextMenuLabels[WebInspector.DOMBreakpoint.Types.NodeRemoved] = WebInspector.UIString("Break on Node Removal");
-    }
-    return WebInspector.DOMBreakpoint._contextMenuLabels[type];
-}
-
-WebInspector.DOMBreakpoint.prototype = {
-    get nodeId()
-    {
-        return this._nodeId;
-    },
-
-    get type()
-    {
-        return this._type;
-    },
-
-    get enabled()
-    {
-        return this._enabled;
-    },
-
-    set enabled(enabled)
-    {
-        if (this._enabled === enabled)
-            return;
-
-        this._enabled = enabled;
-        if (this.enabled)
-            InspectorBackend.setDOMBreakpoint(this.nodeId, this.type);
-        else
-            InspectorBackend.removeDOMBreakpoint(this.nodeId, this.type);
-
-        this.dispatchEventToListeners("enable-changed");
-    },
-
-    compareTo: function(other)
-    {
-        if (this.type != other.type)
-            return this.type < other.type ? -1 : 1;
-        return 0;
-    },
-
-    remove: function()
-    {
-        if (this.enabled)
-            InspectorBackend.removeDOMBreakpoint(this.nodeId, this.type);
-        this.dispatchEventToListeners("removed");
-    }
-}
-
-WebInspector.DOMBreakpoint.prototype.__proto__ = WebInspector.Object.prototype;
-
diff --git a/WebCore/inspector/front-end/DataGrid.js b/WebCore/inspector/front-end/DataGrid.js
index f68fe48..3007497 100644
--- a/WebCore/inspector/front-end/DataGrid.js
+++ b/WebCore/inspector/front-end/DataGrid.js
@@ -32,6 +32,7 @@ WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
 
     this._headerTable = document.createElement("table");
     this._headerTable.className = "header";
+    this._headerTableHeaders = {};
 
     this._dataTable = document.createElement("table");
     this._dataTable.className = "data";
@@ -77,9 +78,13 @@ WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
         var cell = document.createElement("th");
         cell.className = columnIdentifier + "-column";
         cell.columnIdentifier = columnIdentifier;
+        this._headerTableHeaders[columnIdentifier] = cell;
 
         var div = document.createElement("div");
-        div.textContent = column.title;
+        if (column.titleDOMFragment)
+            div.appendChild(column.titleDOMFragment);
+        else
+            div.textContent = column.title;
         cell.appendChild(div);
 
         if (column.sort) {
@@ -113,16 +118,27 @@ WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
     var fillerRow = document.createElement("tr");
     fillerRow.className = "filler";
 
-    for (var i = 0; i < this._columnCount; ++i) {
+    for (var columnIdentifier in columns) {
+        var column = columns[columnIdentifier];
         var cell = document.createElement("td");
+        cell.className = columnIdentifier + "-column";
         fillerRow.appendChild(cell);
     }
-    
+
     this._dataTableColumnGroup = columnGroup.cloneNode(true);
     this._dataTable.appendChild(this._dataTableColumnGroup);
     this.dataTableBody.appendChild(fillerRow);
 
     this.columns = columns || {};
+    this._columnsArray = [];
+    for (var columnIdentifier in columns) {
+        columns[columnIdentifier].ordinal = this._columnsArray.length;
+        this._columnsArray.push(columns[columnIdentifier]);
+    }
+
+    for (var i = 0; i < this._columnsArray.length; ++i)
+        this._columnsArray[i].bodyElement = this._dataTableColumnGroup.children[i];
+
     this.children = [];
     this.selectedNode = null;
     this.expandNodesWhenArrowing = false;
@@ -134,7 +150,7 @@ WebInspector.DataGrid = function(columns, editCallback, deleteCallback)
     this.dataGrid = this;
     this.indentWidth = 15;
     this.resizers = [];
-    this.columnWidthsInitialized = false;
+    this._columnWidthsInitialized = false;
 }
 
 WebInspector.DataGrid.prototype = {
@@ -351,7 +367,7 @@ WebInspector.DataGrid.prototype = {
 
         for (var columnIdentifier in columns)
             columns[columnIdentifier].element.style.width = widths[columnIdentifier] + "%";
-        this.columnWidthsInitialized = false;
+        this._columnWidthsInitialized = false;
         this.updateWidths();
     },
 
@@ -369,11 +385,10 @@ WebInspector.DataGrid.prototype = {
     {
         var headerTableColumns = this._headerTableColumnGroup.children;
         
-        var left = 0;
         var tableWidth = this._dataTable.offsetWidth;
         var numColumns = headerTableColumns.length;
         
-        if (!this.columnWidthsInitialized) {
+        if (!this._columnWidthsInitialized) {
             // Give all the columns initial widths now so that during a resize,
             // when the two columns that get resized get a percent value for
             // their widths, all the other columns already have percent values
@@ -384,9 +399,86 @@ WebInspector.DataGrid.prototype = {
                 this._headerTableColumnGroup.children[i].style.width = percentWidth;
                 this._dataTableColumnGroup.children[i].style.width = percentWidth;
             }
-            this.columnWidthsInitialized = true;
+            this._columnWidthsInitialized = true;
         }
-        
+        this._positionResizers();
+        this.dispatchEventToListeners("width changed");
+    },
+
+    columnWidthsMap: function()
+    {
+        var result = {};
+        for (var i = 0; i < this._columnsArray.length; ++i) {
+            var width = this._headerTableColumnGroup.children[i].style.width;
+            result[this._columnsArray[i].columnIdentifier] = parseFloat(width);
+        }
+        return result;
+    },
+
+    applyColumnWidthsMap: function(columnWidthsMap)
+    {
+        for (var columnIdentifier in this.columns) {
+            var column = this.columns[columnIdentifier];
+            var width = (columnWidthsMap[columnIdentifier] || 0) + "%";
+            this._headerTableColumnGroup.children[column.ordinal].style.width = width;
+            this._dataTableColumnGroup.children[column.ordinal].style.width = width;
+        }
+
+        // Normalize widths
+        delete this._columnWidthsInitialized;
+        this.updateWidths();
+    },
+
+    isColumnVisible: function(columnIdentifier)
+    {
+        var column = this.columns[columnIdentifier];
+        var columnElement = column.element;
+        return !columnElement.hidden;
+    },
+
+    showColumn: function(columnIdentifier)
+    {
+        var column = this.columns[columnIdentifier];
+        var columnElement = column.element;
+        if (!columnElement.hidden)
+            return;
+
+        columnElement.hidden = false;
+        columnElement.removeStyleClass("hidden");
+
+        var columnBodyElement = column.bodyElement;
+        columnBodyElement.hidden = false;
+        columnBodyElement.removeStyleClass("hidden");
+    },
+
+    hideColumn: function(columnIdentifier)
+    {
+        var column = this.columns[columnIdentifier];
+        var columnElement = column.element;
+        if (columnElement.hidden)
+            return;
+
+        var oldWidth = parseFloat(columnElement.style.width);
+
+        columnElement.hidden = true;
+        columnElement.addStyleClass("hidden");
+        columnElement.style.width = 0;
+
+        var columnBodyElement = column.bodyElement;
+        columnBodyElement.hidden = true;
+        columnBodyElement.addStyleClass("hidden");
+        columnBodyElement.style.width = 0;
+
+        this._columnWidthsInitialized = false;
+    },
+
+    _positionResizers: function()
+    {
+        var headerTableColumns = this._headerTableColumnGroup.children;
+        var numColumns = headerTableColumns.length;
+        var left = 0;
+        var previousResizer = null;
+
         // Make n - 1 resizers for n columns. 
         for (var i = 0; i < numColumns - 1; i++) {
             var resizer = this.resizers[i];
@@ -397,7 +489,6 @@ WebInspector.DataGrid.prototype = {
                 resizer = document.createElement("div");
                 resizer.addStyleClass("data-grid-resizer");
                 // This resizer is associated with the column to its right.
-                resizer.rightNeighboringColumnID = i + 1;
                 resizer.addEventListener("mousedown", this._startResizerDragging.bind(this), false);
                 this.element.appendChild(resizer);
                 this.resizers[i] = resizer;
@@ -407,10 +498,23 @@ WebInspector.DataGrid.prototype = {
             // header table in order to determine the width of the column, since
             // it is not possible to query a column for its width.
             left += this.headerTableBody.rows[0].cells[i].offsetWidth;
-            
-            resizer.style.left = left + "px";
+
+            var columnIsVisible = !this._headerTableColumnGroup.children[i].hidden;
+            if (columnIsVisible) {
+                resizer.style.removeProperty("display");
+                resizer.style.left = left + "px";
+                resizer.leftNeighboringColumnID = i;
+                if (previousResizer)
+                    previousResizer.rightNeighboringColumnID = i;
+                previousResizer = resizer;
+            } else {
+                resizer.style.setProperty("display", "none");
+                resizer.leftNeighboringColumnID = 0;
+                resizer.rightNeighboringColumnID = 0;
+            }
         }
-        this.dispatchEventToListeners("width changed");
+        if (previousResizer)
+            previousResizer.rightNeighboringColumnID = numColumns - 1;
     },
 
     addCreationNode: function(hasChildren)
@@ -474,6 +578,7 @@ WebInspector.DataGrid.prototype = {
             throw("removeChild: Node is not a child of this node.");
 
         child.deselect();
+        child._detach();
 
         this.children.remove(child, true);
 
@@ -534,17 +639,18 @@ WebInspector.DataGrid.prototype = {
         this.children = [];
     },
 
-    sortNodes: function(comparator, descending)
+    sortNodes: function(comparator, reverseMode)
     {
         function comparatorWrapper(a, b)
         {
+            if (a._dataGridNode._data.summaryRow)
+                return 1;
+            if (b._dataGridNode._data.summaryRow)
+                return -1;
+
             var aDataGirdNode = a._dataGridNode;
             var bDataGirdNode = b._dataGridNode;
-            if (!aDataGirdNode)
-                return 1; // Filler row.
-            if (!bDataGirdNode)
-                return -1; // Filler row.
-            return descending ? comparator(bDataGirdNode, aDataGirdNode) : comparator(aDataGirdNode, bDataGirdNode);
+            return reverseMode ? comparator(bDataGirdNode, aDataGirdNode) : comparator(aDataGirdNode, bDataGirdNode);
         }
 
         var tbody = this.dataTableBody;
@@ -552,15 +658,27 @@ WebInspector.DataGrid.prototype = {
         tbodyParent.removeChild(tbody);
 
         var childNodes = tbody.childNodes;
-        var sortedNodes = Array.prototype.slice.call(childNodes);
-        sortedNodes.sort(comparatorWrapper.bind(this));
+        var fillerRow = childNodes[childNodes.length - 1];
+
+        var sortedRows = Array.prototype.slice.call(childNodes, 0, childNodes.length - 1);
+        sortedRows.sort(comparatorWrapper);
+        var sortedRowsLength = sortedRows.length;
 
-        var sortedNodesLength = sortedNodes.length;
         tbody.removeChildren();
-        for (var i = 0; i < sortedNodesLength; ++i) {
-            var node = sortedNodes[i];
-            tbody.appendChild(node);
+        var previousSiblingNode = null;
+        for (var i = 0; i < sortedRowsLength; ++i) {
+            var row = sortedRows[i];
+            var node = row._dataGridNode;
+            node.previousSibling = previousSiblingNode;
+            if (previousSiblingNode)
+                previousSiblingNode.nextSibling = node;
+            tbody.appendChild(row);
+            previousSiblingNode = node;
         }
+        if (previousSiblingNode)
+            previousSiblingNode.nextSibling = null;
+
+        tbody.appendChild(fillerRow);
         tbodyParent.appendChild(tbody);
     },
 
@@ -673,13 +791,11 @@ WebInspector.DataGrid.prototype = {
 
         var sortOrder = this.sortOrder;
 
-        if (this._sortColumnCell) {
-            this._sortColumnCell.removeStyleClass("sort-ascending");
-            this._sortColumnCell.removeStyleClass("sort-descending");
-        }
+        if (this._sortColumnCell)
+            this._sortColumnCell.removeMatchingStyleClasses("sort-\\w+");
 
         if (cell == this._sortColumnCell) {
-            if (sortOrder == "ascending")
+            if (sortOrder === "ascending")
                 sortOrder = "descending";
             else
                 sortOrder = "ascending";
@@ -692,6 +808,19 @@ WebInspector.DataGrid.prototype = {
         this.dispatchEventToListeners("sorting changed");
     },
 
+    markColumnAsSortedBy: function(columnIdentifier, sortOrder)
+    {
+        if (this._sortColumnCell)
+            this._sortColumnCell.removeMatchingStyleClasses("sort-\\w+");
+        this._sortColumnCell = this._headerTableHeaders[columnIdentifier];
+        this._sortColumnCell.addStyleClass("sort-" + sortOrder);
+    },
+
+    headerTableHeader: function(columnIdentifier)
+    {
+        return this._headerTableHeaders[columnIdentifier];
+    },
+
     _mouseDownInDataTable: function(event)
     {
         var gridNode = this.dataGridNodeFromNode(event.target);
@@ -778,27 +907,28 @@ WebInspector.DataGrid.prototype = {
         // column directly to the left and the column directly to the right.
         var leftEdgeOfPreviousColumn = 0;
         var firstRowCells = this.headerTableBody.rows[0].cells;
-        for (var i = 0; i < resizer.rightNeighboringColumnID - 1; i++)
+        for (var i = 0; i < resizer.leftNeighboringColumnID; i++)
             leftEdgeOfPreviousColumn += firstRowCells[i].offsetWidth;
             
-        var rightEdgeOfNextColumn = leftEdgeOfPreviousColumn + firstRowCells[resizer.rightNeighboringColumnID - 1].offsetWidth + firstRowCells[resizer.rightNeighboringColumnID].offsetWidth;
-        
-        // Give each column some padding so that they don't disappear.               
+        var rightEdgeOfNextColumn = leftEdgeOfPreviousColumn + firstRowCells[resizer.leftNeighboringColumnID].offsetWidth + firstRowCells[resizer.rightNeighboringColumnID].offsetWidth;
+
+        // Give each column some padding so that they don't disappear.
         var leftMinimum = leftEdgeOfPreviousColumn + this.ColumnResizePadding;
         var rightMaximum = rightEdgeOfNextColumn - this.ColumnResizePadding;
-        
+
         dragPoint = Number.constrain(dragPoint, leftMinimum, rightMaximum);
-        
+
         resizer.style.left = (dragPoint - this.CenterResizerOverBorderAdjustment) + "px";
-        
+
         var percentLeftColumn = (((dragPoint - leftEdgeOfPreviousColumn) / this._dataTable.offsetWidth) * 100) + "%";
-        this._headerTableColumnGroup.children[resizer.rightNeighboringColumnID - 1].style.width = percentLeftColumn;
-        this._dataTableColumnGroup.children[resizer.rightNeighboringColumnID - 1].style.width = percentLeftColumn;
-        
+        this._headerTableColumnGroup.children[resizer.leftNeighboringColumnID].style.width = percentLeftColumn;
+        this._dataTableColumnGroup.children[resizer.leftNeighboringColumnID].style.width = percentLeftColumn;
+
         var percentRightColumn = (((rightEdgeOfNextColumn - dragPoint) / this._dataTable.offsetWidth) * 100) + "%";
         this._headerTableColumnGroup.children[resizer.rightNeighboringColumnID].style.width =  percentRightColumn;
         this._dataTableColumnGroup.children[resizer.rightNeighboringColumnID].style.width = percentRightColumn;
-        
+
+        this._positionResizers();
         event.preventDefault();
         this.dispatchEventToListeners("width changed");
     },
diff --git a/WebCore/inspector/front-end/ElementsPanel.js b/WebCore/inspector/front-end/ElementsPanel.js
index d6437fc..76c22c5 100644
--- a/WebCore/inspector/front-end/ElementsPanel.js
+++ b/WebCore/inspector/front-end/ElementsPanel.js
@@ -107,7 +107,6 @@ WebInspector.ElementsPanel = function()
     this.element.appendChild(this.sidebarResizeElement);
 
     this._registerShortcuts();
-    this._changedStyles = {};
 
     this.reset();
 }
@@ -346,115 +345,6 @@ WebInspector.ElementsPanel.prototype = {
         // TODO: Implement Shifting the oldSelector, and its contents to a newSelector
     },
 
-    addStyleChange: function(identifier, style, property)
-    {
-        if (!style.parentRule)
-            return;
-
-        var selector = style.parentRule.selectorText;
-        if (!this._changedStyles[identifier])
-            this._changedStyles[identifier] = {};
-
-        if (!this._changedStyles[identifier][selector])
-            this._changedStyles[identifier][selector] = {};
-
-        if (!this._changedStyles[identifier][selector][property])
-            WebInspector.styleChanges += 1;
-
-        this._changedStyles[identifier][selector][property] = style.getPropertyValue(property);
-    },
-
-    removeStyleChange: function(identifier, style, property)
-    {
-        if (!style.parentRule)
-            return;
-
-        var selector = style.parentRule.selectorText;
-        if (!this._changedStyles[identifier] || !this._changedStyles[identifier][selector])
-            return;
-
-        if (this._changedStyles[identifier][selector][property]) {
-            delete this._changedStyles[identifier][selector][property];
-            WebInspector.styleChanges -= 1;
-        }
-    },
-
-    generateStylesheet: function()
-    {
-        if (!WebInspector.styleChanges)
-            return;
-
-        // Merge Down to Just Selectors
-        var mergedSelectors = {};
-        for (var identifier in this._changedStyles) {
-            for (var selector in this._changedStyles[identifier]) {
-                if (!mergedSelectors[selector])
-                    mergedSelectors[selector] = this._changedStyles[identifier][selector];
-                else { // merge on selector
-                    var merge = {};
-                    for (var property in mergedSelectors[selector])
-                        merge[property] = mergedSelectors[selector][property];
-                    for (var property in this._changedStyles[identifier][selector]) {
-                        if (!merge[property])
-                            merge[property] = this._changedStyles[identifier][selector][property];
-                        else { // merge on property within a selector, include comment to notify user
-                            var value1 = merge[property];
-                            var value2 = this._changedStyles[identifier][selector][property];
-
-                            if (value1 === value2)
-                                merge[property] = [value1];
-                            else if (value1 instanceof Array)
-                                merge[property].push(value2);
-                            else
-                                merge[property] = [value1, value2];
-                        }
-                    }
-                    mergedSelectors[selector] = merge;
-                }
-            }
-        }
-
-        var builder = [];
-        builder.push("/**");
-        builder.push(" * Inspector Generated Stylesheet"); // UIString?
-        builder.push(" */\n");
-
-        var indent = "  ";
-        function displayProperty(property, value, comment) {
-            if (comment)
-                return indent + "/* " + property + ": " + value + "; */";
-            else
-                return indent + property + ": " + value + ";";
-        }
-
-        for (var selector in mergedSelectors) {
-            var psuedoStyle = mergedSelectors[selector];
-            var properties = Object.properties(psuedoStyle);
-            if (properties.length) {
-                builder.push(selector + " {");
-                for (var i = 0; i < properties.length; ++i) {
-                    var property = properties[i];
-                    var value = psuedoStyle[property];
-                    if (!(value instanceof Array))
-                        builder.push(displayProperty(property, value));
-                    else {
-                        if (value.length === 1)
-                            builder.push(displayProperty(property, value) + " /* merged from equivalent edits */"); // UIString?
-                        else {                        
-                            builder.push(indent + "/* There was a Conflict... There were Multiple Edits for '" + property + "' */"); // UIString?
-                            for (var j = 0; j < value.length; ++j)
-                                builder.push(displayProperty(property, value, true));
-                        }
-                    }
-                }
-                builder.push("}\n");
-            }
-        }
-
-        WebInspector.showConsole();
-        WebInspector.console.addMessage(WebInspector.ConsoleMessage.createTextMessage(builder.join("\n")));
-    },
-
     get rootDOMNode()
     {
         return this.treeOutline.rootDOMNode;
diff --git a/WebCore/inspector/front-end/ElementsTreeOutline.js b/WebCore/inspector/front-end/ElementsTreeOutline.js
index 1479c9a..1d546c2 100644
--- a/WebCore/inspector/front-end/ElementsTreeOutline.js
+++ b/WebCore/inspector/front-end/ElementsTreeOutline.js
@@ -759,15 +759,15 @@ WebInspector.ElementsTreeElement.prototype = {
             contextMenu.appendSeparator();
 
             var node = this.representedObject;
-            for (var key in WebInspector.DOMBreakpoint.Types) {
-                var type = WebInspector.DOMBreakpoint.Types[key];
-                var label = WebInspector.DOMBreakpoint.contextMenuLabelForType(type);
-                var hasBreakpoint = node.hasBreakpoint(type);
-                if (!hasBreakpoint)
-                    var handler = node.setBreakpoint.bind(node, type);
+            for (var key in WebInspector.DOMBreakpointTypes) {
+                var type = WebInspector.DOMBreakpointTypes[key];
+                var label = WebInspector.domBreakpointTypeContextMenuLabel(type);
+                var breakpoint = node.breakpoints[type];
+                if (!breakpoint)
+                    var handler = WebInspector.breakpointManager.createDOMBreakpoint.bind(WebInspector.breakpointManager, node.id, type);
                 else
-                    var handler = node.removeBreakpoint.bind(node, type);
-                contextMenu.appendCheckboxItem(label, handler, hasBreakpoint);
+                    var handler = breakpoint.remove.bind(breakpoint);
+                contextMenu.appendCheckboxItem(label, handler, !!breakpoint);
             }
         }
     },
diff --git a/WebCore/inspector/front-end/EventListenersSidebarPane.js b/WebCore/inspector/front-end/EventListenersSidebarPane.js
index 34dea00..e2ad259 100644
--- a/WebCore/inspector/front-end/EventListenersSidebarPane.js
+++ b/WebCore/inspector/front-end/EventListenersSidebarPane.js
@@ -183,7 +183,7 @@ WebInspector.EventListenerBar = function(eventListener, nodeId)
     this._setFunctionSubtitle();
     this.editable = false;
     this.element.className = "event-bar"; /* Changed from "section" */
-    this.propertiesElement.className = "event-properties source-code"; /* Changed from "properties" */
+    this.propertiesElement.className = "event-properties properties-tree source-code"; /* Changed from "properties" */
 }
 
 WebInspector.EventListenerBar.prototype = {
diff --git a/WebCore/inspector/front-end/ExtensionAPI.js b/WebCore/inspector/front-end/ExtensionAPI.js
index 64f5482..5d090b0 100644
--- a/WebCore/inspector/front-end/ExtensionAPI.js
+++ b/WebCore/inspector/front-end/ExtensionAPI.js
@@ -123,6 +123,16 @@ Resources.prototype = {
     get: function(id, callback)
     {
         return extensionServer.sendRequest({ command: "getResources", id: id }, callback);
+    },
+
+    getPageTimings: function(callback)
+    {
+        return extensionServer.sendRequest({ command: "getPageTimings" }, callback);
+    },
+
+    getContent: function(ids, callback)
+    {
+        return extensionServer.sendRequest({ command: "getResourceContent", ids: ids }, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/ExtensionServer.js b/WebCore/inspector/front-end/ExtensionServer.js
index bdf3a25..9ab4c0c 100644
--- a/WebCore/inspector/front-end/ExtensionServer.js
+++ b/WebCore/inspector/front-end/ExtensionServer.js
@@ -38,6 +38,8 @@ WebInspector.ExtensionServer = function()
     this._registerHandler("subscribe", this._onSubscribe.bind(this));
     this._registerHandler("unsubscribe", this._onUnsubscribe.bind(this));
     this._registerHandler("getResources", this._onGetResources.bind(this));
+    this._registerHandler("getResourceContent", this._onGetResourceContent.bind(this));
+    this._registerHandler("getPageTimings", this._onGetPageTimings.bind(this));
     this._registerHandler("createPanel", this._onCreatePanel.bind(this));
     this._registerHandler("createSidebarPane", this._onCreateSidebar.bind(this));
     this._registerHandler("log", this._onLog.bind(this));
@@ -238,7 +240,7 @@ WebInspector.ExtensionServer.prototype = {
         var id = message.id;
         var resource = null;
 
-        resource = typeof id === "number" ? WebInspector.resources[id] : WebInspector.resourceForURL(id);
+        resource = WebInspector.resources[id] || WebInspector.resourceForURL(id);
         if (!resource)
             return this._status.E_NOTFOUND(typeof id + ": " + id);
         WebInspector.panels.resources.showResource(resource, message.line);
@@ -261,10 +263,53 @@ WebInspector.ExtensionServer.prototype = {
         if (request.id)
             response = WebInspector.resources[request.id] ? resourceWrapper(request.id) : this._status.E_NOTFOUND(request.id);
         else
-            response = Object.properties(WebInspector.resources).map(resourceWrapper);
+            response = Object.keys(WebInspector.resources).map(resourceWrapper);
         return response;
     },
 
+    _onGetResourceContent: function(message, port)
+    {
+        var ids;
+        var response = [];
+
+        function onContentAvailable(id, encoded, content)
+        {
+            var resourceContent = {
+                id: id,
+                encoding: encoded ? "base64" : "",
+                content: content
+            };
+            response.push(resourceContent);
+            if (response.length === ids.length)
+                this._dispatchCallback(message.requestId, port, response);
+        }
+
+        if (typeof message.ids === "number")
+            ids = [ message.ids ];
+        else if (message.ids instanceof Array)
+            ids = message.ids;
+        else
+            return this._status.E_BADARGTYPE("message.ids", "Array", typeof message.ids);
+
+        for (var i = 0; i < ids.length; ++i) {
+            var id = ids[i];
+            var resource = WebInspector.resources[id];
+            if (!resource)
+                response.push(this._status.E_NOTFOUND(id));
+            else {
+                var encode = !WebInspector.Resource.Type.isTextType(resource.type);
+                WebInspector.getEncodedResourceContent(id, encode, onContentAvailable.bind(this, id, encode));
+            }
+        }
+        if (response.length === ids.length)
+            this._dispatchCallback(message.requestId, port, response);
+    },
+
+    _onGetPageTimings: function()
+    {
+        return (new WebInspector.HARLog()).buildMainResourceTimings();
+    },
+
     _onAddAuditCategory: function(request)
     {
         var category = new WebInspector.ExtensionAuditCategory(request.id, request.displayName, request.ruleCount);
@@ -329,12 +374,13 @@ WebInspector.ExtensionServer.prototype = {
              if (typeof propValue === "number")
                  resourceTypes[propName] = WebInspector.Resource.Type.toString(propValue);
         }
-
+        var platformAPI = WebInspector.buildPlatformExtensionAPI ? WebInspector.buildPlatformExtensionAPI() : "";
         return "(function(){ " +
             "var private = {};" +
             "(" + WebInspector.commonExtensionSymbols.toString() + ")(private);" +
             "(" + WebInspector.injectedExtensionAPI.toString() + ").apply(this, arguments);" +
             "webInspector.resources.Types = " + JSON.stringify(resourceTypes) + ";" +
+            platformAPI +
             "})";
     },
 
@@ -400,3 +446,8 @@ WebInspector.addExtensions = function(extensions)
 }
 
 WebInspector.extensionServer = new WebInspector.ExtensionServer();
+
+WebInspector.getEncodedResourceContent = function(identifier, encode, callback)
+{
+    InspectorBackend.getResourceContent(identifier, encode, callback);
+}
diff --git a/WebCore/inspector/front-end/HAREntry.js b/WebCore/inspector/front-end/HAREntry.js
index 85e4f59..2b8f41b 100644
--- a/WebCore/inspector/front-end/HAREntry.js
+++ b/WebCore/inspector/front-end/HAREntry.js
@@ -56,7 +56,6 @@ WebInspector.HAREntry.prototype = {
             method: this._resource.requestMethod,
             url: this._resource.url,
             // httpVersion: "HTTP/1.1" -- Not available.
-            // cookies: [] -- Not available.
             headers: this._buildHeaders(this._resource.requestHeaders),
             headersSize: -1, // Not available.
             bodySize: -1 // Not available.
@@ -65,22 +64,26 @@ WebInspector.HAREntry.prototype = {
             res.queryString = this._buildParameters(this._resource.queryParameters);
         if (this._resource.requestFormData)
             res.postData = this._buildPostData();
+        if (this._resource.requestCookies)
+            res.cookies = this._buildCookies(this._resource.requestCookies);
         return res;
     },
 
     _buildResponse: function()
     {
-        return {
+        var res = {
             status: this._resource.statusCode,
             statusText: this._resource.statusText,
             // "httpVersion": "HTTP/1.1" -- Not available.
-            // "cookies": [],  -- Not available.
             headers: this._buildHeaders(this._resource.responseHeaders),
             content: this._buildContent(),
             redirectURL: this._resource.responseHeaderValue("Location") || "",
             headersSize: -1, // Not available.
             bodySize: this._resource.resourceSize
         };
+        if (this._resource.responseCookies)
+            res.cookies = this._buildCookies(this._resource.responseCookies);
+        return res;
     },
 
     _buildContent: function()
@@ -150,6 +153,25 @@ WebInspector.HAREntry.prototype = {
         return parameters.slice();
     },
 
+    _buildCookies: function(cookies)
+    {
+        return cookies.map(this._buildCookie.bind(this));
+    },
+
+    _buildCookie: function(cookie)
+    {
+        
+        return {
+            name: cookie.name,
+            value: cookie.value,
+            path: cookie.path,
+            domain: cookie.domain,
+            expires: cookie.expires(new Date(this._resource.startTime * 1000)),
+            httpOnly: cookie.httpOnly,
+            secure: cookie.secure
+        };
+    },
+
     _interval: function(start, end)
     {
         var timing = this._resource.timing;
@@ -181,7 +203,7 @@ WebInspector.HARLog.prototype = {
                 version: webKitVersion ? webKitVersion[1] : "n/a"
             },
             pages: this._buildPages(),
-            entries: Object.properties(WebInspector.resources).map(this._convertResource)
+            entries: Object.keys(WebInspector.resources).map(this._convertResource)
         }
     },
 
@@ -192,23 +214,31 @@ WebInspector.HARLog.prototype = {
                 startedDateTime: new Date(WebInspector.mainResource.startTime * 1000),
                 id: WebInspector.mainResource.documentURL,
                 title: "",
-                pageTimings: this._buildMainResourceTimings()
+                pageTimings: this.buildMainResourceTimings()
             }
         ];
     },
 
-    _buildMainResourceTimings: function()
+    buildMainResourceTimings: function()
     {
         var resourcesPanel = WebInspector.panels.resources;
         var startTime = WebInspector.mainResource.startTime;
         return {
-             onContentLoad: WebInspector.HAREntry._toMilliseconds(resourcesPanel.mainResourceDOMContentTime - startTime),
-             onLoad: WebInspector.HAREntry._toMilliseconds(resourcesPanel.mainResourceLoadTime - startTime),
+             onContentLoad: this._pageEventTime(resourcesPanel.mainResourceDOMContentTime),
+             onLoad: this._pageEventTime(resourcesPanel.mainResourceLoadTime),
         }
     },
 
     _convertResource: function(id)
     {
         return (new WebInspector.HAREntry(WebInspector.resources[id])).build();
+    },
+
+    _pageEventTime: function(time)
+    {
+        var startTime = WebInspector.mainResource.startTime;
+        if (time === -1 || startTime === -1)
+            return -1;
+        return WebInspector.HAREntry._toMilliseconds(time - startTime);
     }
 };
diff --git a/WebCore/inspector/front-end/InjectedScript.js b/WebCore/inspector/front-end/InjectedScript.js
index 5544ed5..24b270b 100644
--- a/WebCore/inspector/front-end/InjectedScript.js
+++ b/WebCore/inspector/front-end/InjectedScript.js
@@ -220,7 +220,7 @@ InjectedScript.prototype = {
                 if (!callFrame)
                     return props;
                 if (expression)
-                    expressionResult = this._evaluateOn(callFrame.evaluate, callFrame, expression);
+                    expressionResult = this._evaluateOn(callFrame.evaluate, callFrame, expression, true);
                 else {
                     // Evaluate into properties in scope of the selected call frame.
                     var scopeChain = callFrame.scopeChain;
@@ -230,7 +230,7 @@ InjectedScript.prototype = {
             } else {
                 if (!expression)
                     expression = "this";
-                expressionResult = this._evaluateOn(inspectedWindow.eval, inspectedWindow, expression);
+                expressionResult = this._evaluateOn(inspectedWindow.eval, inspectedWindow, expression, false);
             }
             if (typeof expressionResult === "object")
                 this._populatePropertyNames(expressionResult, props);
@@ -246,26 +246,29 @@ InjectedScript.prototype = {
 
     evaluate: function(expression, objectGroup)
     {
-        return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, expression, objectGroup);
+        return this._evaluateAndWrap(inspectedWindow.eval, inspectedWindow, expression, objectGroup, false);
     },
 
-    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup)
+    _evaluateAndWrap: function(evalFunction, object, expression, objectGroup, isEvalOnCallFrame)
     {
         try {
-            return this._wrapObject(this._evaluateOn(evalFunction, object, expression), objectGroup);
+            return this._wrapObject(this._evaluateOn(evalFunction, object, expression, isEvalOnCallFrame), objectGroup);
         } catch (e) {
             return InjectedScript.RemoteObject.fromException(e);
         }
     },
 
-    _evaluateOn: function(evalFunction, object, expression)
+    _evaluateOn: function(evalFunction, object, expression, isEvalOnCallFrame)
     {
         // Only install command line api object for the time of evaluation.
         // Surround the expression in with statements to inject our command line API so that
         // the window object properties still take more precedent than our API functions.
         inspectedWindow.console._commandLineAPI = this._commandLineAPI;
     
-        expression = "with (window.console._commandLineAPI) { with (window) {\n" + expression + "\n} }";
+        // We don't want local variables to be shadowed by global ones when evaluating on CallFrame.
+        if (!isEvalOnCallFrame)
+            expression = "with (window) {\n" + expression + "\n} ";
+        expression = "with (window.console._commandLineAPI) {\n" + expression + "\n}";
         var value = evalFunction.call(object, expression);
     
         delete inspectedWindow.console._commandLineAPI;
@@ -303,7 +306,7 @@ InjectedScript.prototype = {
         var callFrame = this._callFrameForId(callFrameId);
         if (!callFrame)
             return false;
-        return this._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup);
+        return this._evaluateAndWrap(callFrame.evaluate, callFrame, code, objectGroup, true);
     },
 
     _callFrameForId: function(id)
diff --git a/WebCore/inspector/front-end/NetworkPanel.js b/WebCore/inspector/front-end/NetworkPanel.js
index f07b3b0..8eed425 100644
--- a/WebCore/inspector/front-end/NetworkPanel.js
+++ b/WebCore/inspector/front-end/NetworkPanel.js
@@ -32,25 +32,41 @@ WebInspector.NetworkPanel = function()
 {
     WebInspector.Panel.call(this, "network");
 
+    this.createSidebar();
+    this.sidebarElement.className = "network-sidebar";
+
     this._resources = [];
     this._staleResources = [];
     this._resourceGridNodes = {};
     this._mainResourceLoadTime = -1;
     this._mainResourceDOMContentTime = -1;
+    this._hiddenCategories = {};
+
+    this._categories = WebInspector.resourceCategories;
+
+    this.containerElement = document.createElement("div");
+    this.containerElement.id = "network-container";
+    this.sidebarElement.appendChild(this.containerElement);
 
     this._viewsContainerElement = document.createElement("div");
     this._viewsContainerElement.id = "network-views";
+    this._viewsContainerElement.className = "hidden";
+
     this.element.appendChild(this._viewsContainerElement);
 
     this._createSortingFunctions();
-    this._createTimelineGrid();
     this._createTable();
+    this._createTimelineGrid();
     this._createStatusbarButtons();
+    this._createFilterStatusBarItems();
+    this._createSummaryBar();
 
     this._popoverHelper = new WebInspector.PopoverHelper(this.element, this._getPopoverAnchor.bind(this), this._showPopover.bind(this), true);
 
     this.calculator = new WebInspector.NetworkTransferTimeCalculator();
-    this.filter(this.filterAllElement, false);
+    this._filter(this._filterAllElement, false);
+
+    this._toggleGridMode();
 }
 
 WebInspector.NetworkPanel.prototype = {
@@ -61,7 +77,7 @@ WebInspector.NetworkPanel.prototype = {
 
     get statusBarItems()
     {
-        return [this._largerResourcesButton.element, this._clearButton.element];
+        return [this._largerResourcesButton.element, this._clearButton.element, this._filterBarElement];
     },
 
     isCategoryVisible: function(categoryName)
@@ -78,32 +94,87 @@ WebInspector.NetworkPanel.prototype = {
     {
         WebInspector.Panel.prototype.resize.call(this);
         this._dataGrid.updateWidths();
+        this._positionSummaryBar();
+    },
+
+    updateSidebarWidth: function()
+    {
+        if (!this._viewingResourceMode)
+            return;
+        WebInspector.Panel.prototype.updateSidebarWidth.apply(this, arguments);
+    },
+
+    updateMainViewWidth: function(width)
+    {
+        this._viewsContainerElement.style.left = width + "px";
+    },
+
+    handleShortcut: function(event)
+    {
+        if (this._viewingResourceMode && event.keyCode === WebInspector.KeyboardShortcut.Keys.Esc.code) {
+            this._toggleGridMode();
+            event.handled = true;
+        }
+    },
+
+    _positionSummaryBar: function()
+    {
+        // Position the total bar.
+        const rowHeight = 22;
+        const summaryBarHeight = 22;
+        var offsetHeight = this.element.offsetHeight;
+
+        var parentElement = this._summaryBarElement.parentElement;
+
+        if (this._summaryBarElement.parentElement !== this.element && offsetHeight > (this._dataGrid.children.length - 1) * rowHeight + summaryBarHeight) {
+            // Glue status to bottom.
+            if (this._summaryBarRowNode) {
+                this._dataGrid.removeChild(this._summaryBarRowNode);
+                delete this._summaryBarRowNode;
+            }
+            this._summaryBarElement.addStyleClass("network-summary-bar-bottom");
+            this.element.appendChild(this._summaryBarElement);
+            this._dataGrid.element.style.bottom = "20px";
+            return;
+        }
+
+        if (!this._summaryBarRowNode && offsetHeight - summaryBarHeight < this._dataGrid.children.length * rowHeight) {
+            // Glue status to table.
+            this._summaryBarRowNode = new WebInspector.NetworkTotalGridNode(this._summaryBarElement);
+            this._summaryBarElement.removeStyleClass("network-summary-bar-bottom");
+            this._dataGrid.appendChild(this._summaryBarRowNode);
+            this._dataGrid.element.style.bottom = 0;
+            this._sortItems();
+        }
+    },
+
+    _resetSummaryBar: function()
+    {
+        delete this._summaryBarRowNode;
+        this._summaryBarElement.parentElement.removeChild(this._summaryBarElement);
+        this._updateSummaryBar();
     },
 
     _createTimelineGrid: function()
     {
         this._timelineGrid = new WebInspector.TimelineGrid();
         this._timelineGrid.element.addStyleClass("network-timeline-grid");
-        this.element.appendChild(this._timelineGrid.element);
+        this._dataGrid.element.appendChild(this._timelineGrid.element);
     },
 
     _createTable: function()
     {
-        this.containerElement = document.createElement("div");
-        this.containerElement.id = "network-container";
-        this.element.appendChild(this.containerElement);
+        var columns = {name: {}, method: {}, status: {}, type: {}, size: {}, time: {}, timeline: {}};
+        columns.name.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Name"), WebInspector.UIString("Path"));
+        columns.name.sortable = true;
+        columns.name.width = "20%";
+        columns.name.disclosure = true;
 
-        var columns = {url: {}, method: {}, status: {}, type: {}, size: {}, time: {}, timeline: {}};
-        columns.url.title = WebInspector.UIString("URL");
-        columns.url.sortable = true;
-        columns.url.width = "20%";
-        columns.url.disclosure = true;
-        
         columns.method.title = WebInspector.UIString("Method");
         columns.method.sortable = true;
         columns.method.width = "7%";
 
-        columns.status.title = WebInspector.UIString("Status");
+        columns.status.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Status"), WebInspector.UIString("Text"));
         columns.status.sortable = true;
         columns.status.width = "8%";
 
@@ -111,41 +182,233 @@ WebInspector.NetworkPanel.prototype = {
         columns.type.sortable = true;
         columns.type.width = "7%";
 
-        columns.size.title = WebInspector.UIString("Size");
+        columns.size.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Size"), WebInspector.UIString("Transfer"));
         columns.size.sortable = true;
         columns.size.width = "10%";
         columns.size.aligned = "right";
 
-        columns.time.title = WebInspector.UIString("Time");
+        columns.time.titleDOMFragment = this._makeHeaderFragment(WebInspector.UIString("Time"), WebInspector.UIString("Duration"));
         columns.time.sortable = true;
         columns.time.width = "10%";
         columns.time.aligned = "right";
 
         columns.timeline.title = "";
-        columns.timeline.sortable = true;
+        columns.timeline.sortable = false;
         columns.timeline.width = "40%";
-        columns.timeline.sort = true;
+        columns.timeline.sort = "ascending";
 
         this._dataGrid = new WebInspector.DataGrid(columns);
-        this.element.appendChild(this._dataGrid.element);
+        this.containerElement.appendChild(this._dataGrid.element);
         this._dataGrid.addEventListener("sorting changed", this._sortItems, this);
         this._dataGrid.addEventListener("width changed", this._updateDividersIfNeeded, this);
+
+        this._patchTimelineHeader();
+    },
+
+    _makeHeaderFragment: function(title, subtitle)
+    {
+        var fragment = document.createDocumentFragment();
+        fragment.appendChild(document.createTextNode(title));
+        var subtitleDiv = document.createElement("div");
+        subtitleDiv.className = "network-header-subtitle";
+        subtitleDiv.textContent = subtitle;
+        fragment.appendChild(subtitleDiv);
+        return fragment;
+    },
+
+    _patchTimelineHeader: function()
+    {
+        var timelineSorting = document.createElement("select");
+
+        var option = document.createElement("option");
+        option.value = "startTime";
+        option.label = WebInspector.UIString("Timeline");
+        timelineSorting.appendChild(option);
+
+        option = document.createElement("option");
+        option.value = "startTime";
+        option.label = WebInspector.UIString("Start Time");
+        timelineSorting.appendChild(option);
+
+        option = document.createElement("option");
+        option.value = "responseTime";
+        option.label = WebInspector.UIString("Response Time");
+        timelineSorting.appendChild(option);
+
+        option = document.createElement("option");
+        option.value = "endTime";
+        option.label = WebInspector.UIString("End Time");
+        timelineSorting.appendChild(option);
+
+        option = document.createElement("option");
+        option.value = "duration";
+        option.label = WebInspector.UIString("Duration");
+        timelineSorting.appendChild(option);
+
+        option = document.createElement("option");
+        option.value = "latency";
+        option.label = WebInspector.UIString("Latency");
+        timelineSorting.appendChild(option);
+
+        var header = this._dataGrid.headerTableHeader("timeline");
+        header.firstChild.appendChild(timelineSorting);
+
+        timelineSorting.addEventListener("click", function(event) { event.stopPropagation() }, false);
+        timelineSorting.addEventListener("change", this._sortByTimeline.bind(this), false);
+        this._timelineSortSelector = timelineSorting;
     },
 
     _createSortingFunctions: function()
     {
         this._sortingFunctions = {};
-        this._sortingFunctions.url = WebInspector.NetworkDataGridNode.URLComparator;
-        this._sortingFunctions.method = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "method");
-        this._sortingFunctions.status = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "statusCode");
-        this._sortingFunctions.type = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "mimeType");
-        this._sortingFunctions.size = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "resourceSize");
-        this._sortingFunctions.time = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "duration");
-        this._sortingFunctions.timeline = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "startTime");
+        this._sortingFunctions.name = WebInspector.NetworkDataGridNode.NameComparator;
+        this._sortingFunctions.method = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "method", false);
+        this._sortingFunctions.status = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "statusCode", false);
+        this._sortingFunctions.type = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "mimeType", false);
+        this._sortingFunctions.size = WebInspector.NetworkDataGridNode.SizeComparator;
+        this._sortingFunctions.time = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "duration", false);
+        this._sortingFunctions.timeline = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "startTime", false);
+        this._sortingFunctions.startTime = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "startTime", false);
+        this._sortingFunctions.endTime = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "endTime", false);
+        this._sortingFunctions.responseTime = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "responseReceivedTime", false);
+        this._sortingFunctions.duration = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "duration", true);
+        this._sortingFunctions.latency = WebInspector.NetworkDataGridNode.ResourcePropertyComparator.bind(null, "latency", true);
+
+        var timeCalculator = new WebInspector.NetworkTransferTimeCalculator();
+        var durationCalculator = new WebInspector.NetworkTransferDurationCalculator();
+
+        this._calculators = {};
+        this._calculators.timeline = timeCalculator;
+        this._calculators.startTime = timeCalculator;
+        this._calculators.endTime = timeCalculator;
+        this._calculators.responseTime = timeCalculator;
+        this._calculators.duration = durationCalculator;
+        this._calculators.latency = durationCalculator;
     },
 
-    filter: function(target, selectMultiple)
+    _sortItems: function()
     {
+        var columnIdentifier = this._dataGrid.sortColumnIdentifier;
+        if (columnIdentifier === "timeline") {
+            this._sortByTimeline();
+            return;
+        }
+        var sortingFunction = this._sortingFunctions[columnIdentifier];
+        if (!sortingFunction)
+            return;
+
+        this._dataGrid.sortNodes(sortingFunction, this._dataGrid.sortOrder === "descending");
+        this._timelineSortSelector.selectedIndex = 0;
+    },
+
+    _sortByTimeline: function()
+    {
+        var selectedIndex = this._timelineSortSelector.selectedIndex;
+        if (!selectedIndex)
+            selectedIndex = 1; // Sort by start time by default.
+        var selectedOption = this._timelineSortSelector[selectedIndex];
+        var value = selectedOption.value;
+
+        var sortingFunction = this._sortingFunctions[value];
+        this._dataGrid.sortNodes(sortingFunction);
+        this.calculator = this._calculators[value];
+        if (this.calculator.startAtZero)
+            this._timelineGrid.hideEventDividers();
+        else
+            this._timelineGrid.showEventDividers();
+        this._dataGrid.markColumnAsSortedBy("timeline", "ascending");
+    },
+
+    _createFilterStatusBarItems: function()
+    {
+        var filterBarElement = document.createElement("div");
+        filterBarElement.className = "scope-bar status-bar-item";
+        filterBarElement.id = "network-filter";
+
+        function createFilterElement(category, label)
+        {
+            var categoryElement = document.createElement("li");
+            categoryElement.category = category;
+            categoryElement.className = category;
+            categoryElement.appendChild(document.createTextNode(label));
+            categoryElement.addEventListener("click", this._updateFilter.bind(this), false);
+            filterBarElement.appendChild(categoryElement);
+
+            return categoryElement;
+        }
+
+        this._filterAllElement = createFilterElement.call(this, "all", WebInspector.UIString("All"));
+
+        // Add a divider
+        var dividerElement = document.createElement("div");
+        dividerElement.addStyleClass("scope-bar-divider");
+        filterBarElement.appendChild(dividerElement);
+
+        for (var category in this._categories)
+            createFilterElement.call(this, category, this._categories[category].title);
+        this._filterBarElement = filterBarElement;
+    },
+
+    _createSummaryBar: function()
+    {
+        this._summaryBarElement = document.createElement("div");
+        this._summaryBarElement.className = "network-summary-bar";
+        this.containerElement.appendChild(this._summaryBarElement);
+    },
+
+    _updateSummaryBar: function()
+    {
+        this._positionSummaryBar(); // Grid is growing.
+        var numRequests = this._resources.length;
+
+        if (!numRequests) {
+            if (this._summaryBarElement._isDisplayingWarning)
+                return;
+            this._summaryBarElement._isDisplayingWarning = true;
+
+            var img = document.createElement("img");
+            img.src = "Images/warningIcon.png";
+            this._summaryBarElement.removeChildren();
+            this._summaryBarElement.appendChild(img);
+            this._summaryBarElement.appendChild(document.createTextNode(" "));
+            this._summaryBarElement.appendChild(document.createTextNode(
+                WebInspector.UIString("No requests captured. Reload the page to see detailed information on the network activity.")));
+            return;
+        }
+        delete this._summaryBarElement._isDisplayingWarning;
+
+        var transferSize = 0;
+        var baseTime = -1;
+        var maxTime = -1;
+        for (var i = 0; i < this._resources.length; ++i) {
+            var resource = this._resources[i];
+            transferSize += resource.cached ? 0 : resource.transferSize;
+            if (resource.isMainResource)
+                baseTime = resource.startTime;
+            if (resource.endTime > maxTime) 
+                maxTime = resource.endTime;
+        }
+        var text = String.sprintf(WebInspector.UIString("%d requests"), numRequests);
+        text += "  \u2758  " + String.sprintf(WebInspector.UIString("%s transferred"), Number.bytesToString(transferSize));
+        if (baseTime !== -1 && this._mainResourceLoadTime !== -1 && this._mainResourceDOMContentTime !== -1 && this._mainResourceDOMContentTime > baseTime) {
+            text += "  \u2758  " + String.sprintf(WebInspector.UIString("%s (onload: %s, DOMContentLoaded: %s)"),
+                        Number.secondsToString(maxTime - baseTime),
+                        Number.secondsToString(this._mainResourceLoadTime - baseTime),
+                        Number.secondsToString(this._mainResourceDOMContentTime - baseTime));
+        }
+        this._summaryBarElement.textContent = text;
+    },
+
+    _showCategory: function(category)
+    {
+        this._dataGrid.element.addStyleClass("filter-" + category);
+        delete this._hiddenCategories[category];
+    },
+
+    _hideCategory: function(category)
+    {
+        this._dataGrid.element.removeStyleClass("filter-" + category);
+        this._hiddenCategories[category] = true;
     },
 
     _updateFilter: function(e)
@@ -157,16 +420,65 @@ WebInspector.NetworkPanel.prototype = {
         if (!isMac && e.ctrlKey && !e.metaKey && !e.altKey && !e.shiftKey)
             selectMultiple = true;
 
-        this.filter(e.target, selectMultiple);
-
-        // When we are updating our filtering, scroll to the top so we don't end up
-        // in blank graph under all the resources.
-        this.containerElement.scrollTop = 0;
+        this._filter(e.target, selectMultiple);
 
         var searchField = document.getElementById("search");
         WebInspector.doPerformSearch(searchField.value, WebInspector.shortSearchWasForcedByKeyEvent, false, true);
     },
 
+    _filter: function(target, selectMultiple)
+    {
+        function unselectAll()
+        {
+            for (var i = 0; i < this._filterBarElement.childNodes.length; ++i) {
+                var child = this._filterBarElement.childNodes[i];
+                if (!child.category)
+                    continue;
+
+                child.removeStyleClass("selected");
+                this._hideCategory(child.category);
+            }
+        }
+
+        if (target.category === this._filterAllElement) {
+            if (target.hasStyleClass("selected")) {
+                // We can't unselect All, so we break early here
+                return;
+            }
+
+            // If All wasn't selected, and now is, unselect everything else.
+            unselectAll.call(this);
+        } else {
+            // Something other than All is being selected, so we want to unselect All.
+            if (this._filterAllElement.hasStyleClass("selected")) {
+                this._filterAllElement.removeStyleClass("selected");
+                this._hideCategory("all");
+            }
+        }
+
+        if (!selectMultiple) {
+            // If multiple selection is off, we want to unselect everything else
+            // and just select ourselves.
+            unselectAll.call(this);
+
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+            return;
+        }
+
+        if (target.hasStyleClass("selected")) {
+            // If selectMultiple is turned on, and we were selected, we just
+            // want to unselect ourselves.
+            target.removeStyleClass("selected");
+            this._hideCategory(target.category);
+        } else {
+            // If selectMultiple is turned on, and we weren't selected, we just
+            // want to select ourselves.
+            target.addStyleClass("selected");
+            this._showCategory(target.category);
+        }
+    },
+
     _scheduleRefresh: function()
     {
         if (this._needsRefresh)
@@ -178,18 +490,16 @@ WebInspector.NetworkPanel.prototype = {
             this._refreshTimeout = setTimeout(this.refresh.bind(this), 500);
     },
 
-    _sortItems: function()
-    {
-        var columnIdentifier = this._dataGrid.sortColumnIdentifier;
-        var sortingFunction = this._sortingFunctions[columnIdentifier];
-        if (!sortingFunction)
-            return;
-        this._dataGrid.sortNodes(sortingFunction, this._dataGrid.sortOrder === "descending");
-    },
-
     _updateDividersIfNeeded: function(force)
     {
-        this._timelineGrid.element.style.left = this._dataGrid.resizers[this._dataGrid.resizers.length - 1].style.left;
+        var timelineColumn = this._dataGrid.columns.timeline;
+        for (var i = 0; i < this._dataGrid.resizers.length; ++i) {
+            if (timelineColumn.ordinal === this._dataGrid.resizers[i].rightNeighboringColumnID) {
+                // Position timline grid location.
+                this._timelineGrid.element.style.left = this._dataGrid.resizers[i].style.left;
+                this._timelineGrid.element.style.right = "18px";
+            }
+        }
 
         var proceed = true;
         if (!this.visible) {
@@ -296,7 +606,7 @@ WebInspector.NetworkPanel.prototype = {
     _createStatusbarButtons: function()
     {
         this._clearButton = new WebInspector.StatusBarButton(WebInspector.UIString("Clear"), "clear-status-bar-item");
-        this._clearButton.addEventListener("click", this.reset.bind(this), false);
+        this._clearButton.addEventListener("click", this._reset.bind(this), false);
 
         this._largerResourcesButton = new WebInspector.StatusBarButton(WebInspector.UIString("Use small resource rows."), "network-larger-resources-status-bar-item");
         WebInspector.applicationSettings.addEventListener("loaded", this._settingsLoaded, this);
@@ -354,27 +664,18 @@ WebInspector.NetworkPanel.prototype = {
             view.visible = false;
         }
         this._dataGrid.updateWidths();
+        this._positionSummaryBar();
+    },
+
+    hide: function()
+    {
+        WebInspector.Panel.prototype.hide.call(this);
+        this._popoverHelper.hidePopup();
     },
 
     get searchableViews()
     {
         var views = [];
-
-        const visibleView = this.visibleView;
-        if (visibleView && visibleView.performSearch)
-            views.push(visibleView);
-
-        var resourcesLength = this._resources.length;
-        for (var i = 0; i < resourcesLength; ++i) {
-            var resource = this._resources[i];
-            if (!this._resourceGridNode(resource) || !this._resourceGridNode(resource).selectable)
-                continue;
-            var resourceView = this.resourceViewForResource(resource);
-            if (!resourceView.performSearch || resourceView === visibleView)
-                continue;
-            views.push(resourceView);
-        }
-
         return views;
     },
 
@@ -420,7 +721,7 @@ WebInspector.NetworkPanel.prototype = {
             var node = this._resourceGridNode(resource);
             if (!node) {
                 // Create the timeline tree element and graph.
-                node = new WebInspector.NetworkDataGridNode(resource);
+                node = new WebInspector.NetworkDataGridNode(this, resource);
                 this._resourceGridNodes[resource.identifier] = node;
                 this._dataGrid.appendChild(node);
             }
@@ -441,54 +742,35 @@ WebInspector.NetworkPanel.prototype = {
 
         this._staleResources = [];
         this._sortItems();
+        this._updateSummaryBar();
         this._dataGrid.updateWidths();
     },
 
-    reset: function()
+    _reset: function()
     {
         this._popoverHelper.hidePopup();
-        this.closeVisibleResource();
+        this._closeVisibleResource();
 
-        delete this.currentQuery;
-        this.searchCanceled();
-
-        if (this._resources) {
-            var resourcesLength = this._resources.length;
-            for (var i = 0; i < resourcesLength; ++i) {
-                var resource = this._resources[i];
-
-                resource.warnings = 0;
-                resource.errors = 0;
-
-                delete resource._resourcesView;
-            }
-        }
+        this._toggleGridMode();
 
         // Begin reset timeline
-        this.containerElement.scrollTop = 0;
-
         if (this._calculator)
             this._calculator.reset();
 
-        if (this._resources) {
-            var itemsLength = this._resources.length;
-            for (var i = 0; i < itemsLength; ++i) {
-                var item = this._resources[i];
-            }
-        }
-
         this._resources = [];
         this._staleResources = [];
         this._resourceGridNodes = {};
 
         this._dataGrid.removeChildren();
+        delete this._summaryBarRowNode;
         this._updateDividersIfNeeded(true);
         // End reset timeline.
-        
+
         this._mainResourceLoadTime = -1;
         this._mainResourceDOMContentTime = -1;
  
         this._viewsContainerElement.removeChildren();
+        this._resetSummaryBar();
     },
 
     addResource: function(resource)
@@ -501,20 +783,17 @@ WebInspector.NetworkPanel.prototype = {
     {
         this._staleResources.push(resource);
         this._scheduleRefresh();
-    },
 
-    recreateViewForResourceIfNeeded: function(resource)
-    {
         if (!resource || !resource._resourcesView)
             return;
 
+        if (this._resourceViewTypeMatchesResource(resource, resource._resourcesView))
+            return;
+
         var newView = this._createResourceView(resource);
         if (newView.__proto__ === resource._resourcesView.__proto__)
             return;
 
-        if (!this.currentQuery && this._resourceGridNode(resource))
-            this._resourceGridNode(resource).updateErrorsAndWarnings();
-
         var oldView = resource._resourcesView;
         var oldViewParentNode = oldView.visible ? oldView.element.parentNode : null;
 
@@ -533,27 +812,26 @@ WebInspector.NetworkPanel.prototype = {
 
     canShowSourceLine: function(url, line)
     {
-        return this._resourceTrackingEnabled && !!WebInspector.resourceForURL(url);
+        return false;
     },
 
     showSourceLine: function(url, line)
     {
-        this.showResource(WebInspector.resourceForURL(url), line);
     },
 
-    showResource: function(resource, line)
+    _showResource: function(resource, line)
     {
         if (!resource)
             return;
 
         this._popoverHelper.hidePopup();
 
-        this.containerElement.addStyleClass("viewing-resource");
+        this._toggleViewingResourceMode();
 
         if (this.visibleResource && this.visibleResource._resourcesView)
             this.visibleResource._resourcesView.hide();
 
-        var view = this.resourceViewForResource(resource);
+        var view = this._resourceViewForResource(resource);
         view.headersVisible = true;
         view.show(this._viewsContainerElement);
 
@@ -565,23 +843,13 @@ WebInspector.NetworkPanel.prototype = {
                 view.highlightLine(line);
         }
 
-        this.revealAndSelectItem(resource);
-
         this.visibleResource = resource;
-
         this.updateSidebarWidth();
     },
 
-    showView: function(view)
-    {
-        if (!view)
-            return;
-        this.showResource(view.resource);
-    },
-
-    closeVisibleResource: function()
+    _closeVisibleResource: function()
     {
-        this.containerElement.removeStyleClass("viewing-resource");
+        this.element.removeStyleClass("viewing-resource");
 
         if (this.visibleResource && this.visibleResource._resourcesView)
             this.visibleResource._resourcesView.hide();
@@ -593,7 +861,7 @@ WebInspector.NetworkPanel.prototype = {
         this.updateSidebarWidth();
     },
 
-    resourceViewForResource: function(resource)
+    _resourceViewForResource: function(resource)
     {
         if (!resource)
             return null;
@@ -602,23 +870,6 @@ WebInspector.NetworkPanel.prototype = {
         return resource._resourcesView;
     },
 
-    sourceFrameForResource: function(resource)
-    {
-        var view = this.resourceViewForResource(resource);
-        if (!view)
-            return null;
-
-        if (!view.setupSourceFrameIfNeeded)
-            return null;
-
-        // Setting up the source frame requires that we be attached.
-        if (!this.element.parentNode)
-            this.attach();
-
-        view.setupSourceFrameIfNeeded();
-        return view.sourceFrame;
-    },
-
     _toggleLargerResources: function()
     {
         WebInspector.applicationSettings.resourcesLargeRows = !WebInspector.applicationSettings.resourcesLargeRows;
@@ -631,9 +882,11 @@ WebInspector.NetworkPanel.prototype = {
         if (!enabled) {
             this._largerResourcesButton.title = WebInspector.UIString("Use large resource rows.");
             this._dataGrid.element.addStyleClass("small");
+            this._timelineGrid.element.addStyleClass("small");
         } else {
             this._largerResourcesButton.title = WebInspector.UIString("Use small resource rows.");
             this._dataGrid.element.removeStyleClass("small");
+            this._timelineGrid.element.removeStyleClass("small");
         }
     },
 
@@ -654,6 +907,24 @@ WebInspector.NetworkPanel.prototype = {
         }
     },
 
+    _resourceViewTypeMatchesResource: function(resource, resourceView)
+    {
+        switch (resource.category) {
+            case WebInspector.resourceCategories.documents:
+            case WebInspector.resourceCategories.stylesheets:
+            case WebInspector.resourceCategories.scripts:
+            case WebInspector.resourceCategories.xhr:
+                return resourceView instanceof WebInspector.SourceView;
+            case WebInspector.resourceCategories.images:
+                return resourceView instanceof WebInspector.ImageView;
+            case WebInspector.resourceCategories.fonts:
+                return resourceView instanceof WebInspector.FontView;
+            default:
+                return resourceView instanceof WebInspector.ResourceView;
+        }
+        return false;
+    },
+
     _getPopoverAnchor: function(element)
     {
         var anchor = element.enclosingNodeOrSelfWithClass("network-graph-bar") || element.enclosingNodeOrSelfWithClass("network-graph-label");
@@ -751,20 +1022,85 @@ WebInspector.NetworkPanel.prototype = {
         return popover;
     },
 
-    hide: function()
+    _toggleGridMode: function()
     {
-        WebInspector.Panel.prototype.hide.call(this);
-        this._popoverHelper.hidePopup();
+        if (this._viewingResourceMode) {
+            this._viewingResourceMode = false;
+            this.element.removeStyleClass("viewing-resource");
+            this._dataGrid.element.removeStyleClass("viewing-resource-mode");
+            this._viewsContainerElement.addStyleClass("hidden");
+            this.sidebarElement.style.right = 0;
+            this.sidebarElement.style.removeProperty("width");
+        }
+
+        if (this._briefGrid) {
+            this._dataGrid.element.removeStyleClass("full-grid-mode");
+            this._dataGrid.element.addStyleClass("brief-grid-mode");
+
+            this._dataGrid.hideColumn("method");
+            this._dataGrid.hideColumn("status");
+            this._dataGrid.hideColumn("type");
+            this._dataGrid.hideColumn("size");
+            this._dataGrid.hideColumn("time");
+
+            var widths = {};
+            widths.name = 20;
+            widths.timeline = 80;
+        } else {
+            this._dataGrid.element.addStyleClass("full-grid-mode");
+            this._dataGrid.element.removeStyleClass("brief-grid-mode");
+
+            this._dataGrid.showColumn("method");
+            this._dataGrid.showColumn("status");
+            this._dataGrid.showColumn("type");
+            this._dataGrid.showColumn("size");
+            this._dataGrid.showColumn("time");
+
+            var widths = {};
+            widths.name = 20;
+            widths.method = 7;
+            widths.status = 8;
+            widths.type = 7;
+            widths.size = 10;
+            widths.time = 10;
+            widths.timeline = 40;
+        }
+
+        this._dataGrid.showColumn("timeline");
+        this._dataGrid.applyColumnWidthsMap(widths);
+
+    },
+
+    _toggleViewingResourceMode: function()
+    {
+        if (this._viewingResourceMode)
+            return;
+        this._viewingResourceMode = true;
+        this._preservedColumnWidths = this._dataGrid.columnWidthsMap();
+
+        this.element.addStyleClass("viewing-resource");
+        this._dataGrid.element.addStyleClass("viewing-resource-mode");
+        this._dataGrid.element.removeStyleClass("full-grid-mode");
+        this._dataGrid.element.removeStyleClass("brief-grid-mode");
+
+        this._dataGrid.hideColumn("method");
+        this._dataGrid.hideColumn("status");
+        this._dataGrid.hideColumn("type");
+        this._dataGrid.hideColumn("size");
+        this._dataGrid.hideColumn("time");
+        this._dataGrid.hideColumn("timeline");
+
+        this._viewsContainerElement.removeStyleClass("hidden");
+        this.updateSidebarWidth(200);
+
+        var widths = {};
+        widths.name = 100;
+        this._dataGrid.applyColumnWidthsMap(widths);
     }
 }
 
 WebInspector.NetworkPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.getResourceContent = function(identifier, callback)
-{
-    InspectorBackend.getResourceContent(identifier, callback);
-}
-
 WebInspector.NetworkBaseCalculator = function()
 {
 }
@@ -1047,86 +1383,50 @@ WebInspector.NetworkTransferDurationCalculator.prototype = {
 
 WebInspector.NetworkTransferDurationCalculator.prototype.__proto__ = WebInspector.NetworkTimeCalculator.prototype;
 
-WebInspector.NetworkTransferSizeCalculator = function()
+WebInspector.NetworkDataGridNode = function(panel, resource)
 {
-    WebInspector.NetworkBaseCalculator.call(this);
+    WebInspector.DataGridNode.call(this, {});
+    this._panel = panel;
+    this._resource = resource;
 }
 
-WebInspector.NetworkTransferSizeCalculator.prototype = {
-    computeBarGraphLabels: function(resource)
-    {
-        var networkBytes = this._networkBytes(resource);
-        var resourceBytes = this._value(resource);
-        if (networkBytes && networkBytes !== resourceBytes) {
-            // Transferred size is not the same as reported resource length.
-            var networkBytesString = this.formatValue(networkBytes);
-            var left = networkBytesString;
-            var right = this.formatValue(resourceBytes);
-            var tooltip = right ? WebInspector.UIString("%s (%s transferred)", right, networkBytesString) : right;
-        } else {
-            var left = this.formatValue(resourceBytes);
-            var right = left;
-            var tooltip = left;
-        }
-        if (resource.cached)
-            tooltip = WebInspector.UIString("%s (from cache)", tooltip);
-        return {left: left, right: right, tooltip: tooltip};
-    },
-
-    computeBarGraphPercentages: function(item)
+WebInspector.NetworkDataGridNode.prototype = {
+    createCells: function()
     {
-        const resourceBytesAsPercent = (this._value(item) / this.boundarySpan) * 100;
-        const networkBytesAsPercent = this._networkBytes(item) ? (this._networkBytes(item) / this.boundarySpan) * 100 : resourceBytesAsPercent;
-        return {start: 0, middle: networkBytesAsPercent, end: resourceBytesAsPercent};
+        this._nameCell = this._createDivInTD("name");
+        this._methodCell = this._createDivInTD("method");
+        this._statusCell = this._createDivInTD("status");
+        this._typeCell = this._createDivInTD("type");
+        this._sizeCell = this._createDivInTD("size");
+        this._timeCell = this._createDivInTD("time");
+        this._createTimelineCell();
     },
 
-    _value: function(resource)
+    select: function()
     {
-        return resource.resourceSize;
+        WebInspector.DataGridNode.prototype.select.apply(this, arguments);
+        this._panel._showResource(this._resource);
     },
 
-    _networkBytes: function(resource)
+    get selectable()
     {
-        return resource.transferSize;
+        if (!this._panel._hiddenCategories.all)
+            return true;
+        if (this._panel._hiddenCategories[this._resource.category.name])
+            return false;
+        return true;
     },
 
-    formatValue: function(value)
-    {
-        return Number.bytesToString(value, WebInspector.UIString);
-    }
-}
-
-WebInspector.NetworkTransferSizeCalculator.prototype.__proto__ = WebInspector.NetworkBaseCalculator.prototype;
-
-WebInspector.NetworkDataGridNode = function(resource)
-{
-    WebInspector.DataGridNode.call(this, {});
-    this._resource = resource;
-}
-
-WebInspector.NetworkDataGridNode.prototype = {
-    createCells: function()
+    _createDivInTD: function(columnIdentifier)
     {
-        this._urlCell = this._createDivInTD("url-column");
-        this._methodCell = this._createDivInTD("optional-column");
-        this._statusCell = this._createDivInTD("optional-column");
-        this._typeCell = this._createDivInTD("optional-column");
-        this._sizeCell = this._createDivInTD("optional-column right");
-        this._timeCell = this._createDivInTD("optional-column right");
-        this._createTimelineCell();
-    },
-
-    _createDivInTD: function(className) {
         var td = document.createElement("td");
-        if (className)
-            td.className = className;
+        td.className = columnIdentifier + "-column";
         var div = document.createElement("div");
         td.appendChild(div);
         this._element.appendChild(td);
         return div;
     },
 
-
     _createTimelineCell: function()
     {
         this._graphElement = document.createElement("div");
@@ -1156,13 +1456,14 @@ WebInspector.NetworkDataGridNode.prototype = {
         this._barAreaElement.appendChild(this._labelRightElement);
 
         this._timelineCell = document.createElement("td");
+        this._timelineCell.className = "timeline-column";
         this._element.appendChild(this._timelineCell);
         this._timelineCell.appendChild(this._graphElement);
     },
 
     refreshResource: function()
     {
-        this._refreshURLCell();
+        this._refreshNameCell();
 
         this._methodCell.textContent = this._resource.requestMethod;
 
@@ -1188,9 +1489,9 @@ WebInspector.NetworkDataGridNode.prototype = {
         }
     },
 
-    _refreshURLCell: function()
+    _refreshNameCell: function()
     {
-        this._urlCell.removeChildren();
+        this._nameCell.removeChildren();
 
         if (this._resource.category === WebInspector.resourceCategories.images) {
             var previewImage = document.createElement("img");
@@ -1204,8 +1505,8 @@ WebInspector.NetworkDataGridNode.prototype = {
             var iconElement = document.createElement("img");
             iconElement.className = "icon";
         }
-        this._urlCell.appendChild(iconElement);
-        this._urlCell.appendChild(document.createTextNode(this._fileName()));
+        this._nameCell.appendChild(iconElement);
+        this._nameCell.appendChild(document.createTextNode(this._fileName()));
 
 
         var subtitle = this._resource.displayDomain;
@@ -1216,13 +1517,8 @@ WebInspector.NetworkDataGridNode.prototype = {
                 subtitle += this._resource.path.substring(0, lastPathComponentIndex);
         }
 
-        var subtitleElement = document.createElement("div");
-        subtitleElement.className = "network-grid-subtitle";
-        subtitleElement.textContent = subtitle;
-        this._urlCell.appendChild(subtitleElement);
-
-
-        this._urlCell.title = this._resource.url;
+        this._appendSubtitle(this._nameCell, subtitle);
+        this._nameCell.title = this._resource.url;
     },
 
     _fileName: function()
@@ -1238,16 +1534,6 @@ WebInspector.NetworkDataGridNode.prototype = {
         this._statusCell.removeChildren();
 
         if (this._resource.statusCode) {
-            var img = document.createElement("img");
-            if (this._resource.statusCode < 300)
-                img.src = "Images/successGreenDot.png";
-            else if (this._resource.statusCode < 400)
-                img.src = "Images/warningOrangeDot.png";
-            else
-                img.src = "Images/errorRedDot.png";
-
-            img.className = "resource-status-image";
-            this._statusCell.appendChild(img);
             this._statusCell.appendChild(document.createTextNode(this._resource.statusCode));
             this._statusCell.removeStyleClass("network-dim-cell");
             this._appendSubtitle(this._statusCell, this._resource.statusText);
@@ -1287,7 +1573,7 @@ WebInspector.NetworkDataGridNode.prototype = {
     _appendSubtitle: function(cellElement, subtitleText)
     {
         var subtitleElement = document.createElement("div");
-        subtitleElement.className = "network-grid-subtitle";
+        subtitleElement.className = "network-cell-subtitle";
         subtitleElement.textContent = subtitleText;
         cellElement.appendChild(subtitleElement);
     },
@@ -1324,6 +1610,8 @@ WebInspector.NetworkDataGridNode.prototype = {
 
     _refreshLabelPositions: function()
     {
+        if (!this._percentages)
+            return;
         this._labelLeftElement.style.removeProperty("left");
         this._labelLeftElement.style.removeProperty("right");
         this._labelLeftElement.removeStyleClass("before");
@@ -1389,7 +1677,7 @@ WebInspector.NetworkDataGridNode.prototype = {
     }
 }
 
-WebInspector.NetworkDataGridNode.URLComparator = function(a, b)
+WebInspector.NetworkDataGridNode.NameComparator = function(a, b)
 {
     var aFileName = a._resource.displayName + (a._resource.queryString ? a._resource.queryString : "");
     var bFileName = b._resource.displayName + (b._resource.queryString ? b._resource.queryString : "");
@@ -1400,15 +1688,47 @@ WebInspector.NetworkDataGridNode.URLComparator = function(a, b)
     return 0;
 }
 
-WebInspector.NetworkDataGridNode.ResourcePropertyComparator = function(propertyName, a, b)
+WebInspector.NetworkDataGridNode.SizeComparator = function(a, b)
+{
+    if (b._resource.cached && !a._resource.cached)
+        return 1;
+    if (a._resource.cached && !b._resource.cached)
+        return -1;
+
+    if (a._resource.resourceSize === b._resource.resourceSize)
+        return 0;
+
+    return a._resource.resourceSize - b._resource.resourceSize;
+}
+
+WebInspector.NetworkDataGridNode.ResourcePropertyComparator = function(propertyName, revert, a, b)
 {
     var aValue = a._resource[propertyName];
     var bValue = b._resource[propertyName];
     if (aValue > bValue)
-        return 1;
+        return revert ? -1 : 1;
     if (bValue > aValue)
-        return -1;
+        return revert ? 1 : -1;
     return 0;
 }
 
 WebInspector.NetworkDataGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
+
+WebInspector.NetworkTotalGridNode = function(element)
+{
+    this._summaryBarElement = element;
+    WebInspector.DataGridNode.call(this, {summaryRow: true});
+}
+
+WebInspector.NetworkTotalGridNode.prototype = {
+    createCells: function()
+    {
+        var td = document.createElement("td");
+        td.setAttribute("colspan", 7);
+        td.className = "network-summary";
+        td.appendChild(this._summaryBarElement);
+        this._element.appendChild(td);
+    }
+}
+
+WebInspector.NetworkTotalGridNode.prototype.__proto__ = WebInspector.DataGridNode.prototype;
diff --git a/WebCore/inspector/front-end/ProfilesPanel.js b/WebCore/inspector/front-end/ProfilesPanel.js
index 2bd76f9..ca02f9e 100644
--- a/WebCore/inspector/front-end/ProfilesPanel.js
+++ b/WebCore/inspector/front-end/ProfilesPanel.js
@@ -116,7 +116,7 @@ WebInspector.ProfilesPanel = function()
     this.clearResultsButton.addEventListener("click", this._clearProfiles.bind(this), false);
 
     this.profileViewStatusBarItemsContainer = document.createElement("div");
-    this.profileViewStatusBarItemsContainer.id = "profile-view-status-bar-items";
+    this.profileViewStatusBarItemsContainer.className = "status-bar-items";
 
     this.welcomeView = new WebInspector.WelcomeView("profiles", WebInspector.UIString("Welcome to the Profiles panel"));
     this.element.appendChild(this.welcomeView.element);
@@ -550,7 +550,7 @@ WebInspector.ProfilesPanel.prototype = {
     {
         this.welcomeView.element.style.left = width + "px";
         this.profileViews.style.left = width + "px";
-        this.profileViewStatusBarItemsContainer.style.left = width + "px";
+        this.profileViewStatusBarItemsContainer.style.left = Math.max(155, width) + "px";
         this.resize();
     }
 }
diff --git a/WebCore/inspector/front-end/PropertiesSection.js b/WebCore/inspector/front-end/PropertiesSection.js
index 5ced9ef..1ca52ce 100644
--- a/WebCore/inspector/front-end/PropertiesSection.js
+++ b/WebCore/inspector/front-end/PropertiesSection.js
@@ -32,7 +32,7 @@ WebInspector.PropertiesSection = function(title, subtitle)
     WebInspector.Section.call(this, title, subtitle);
 
     this.propertiesElement = document.createElement("ol");
-    this.propertiesElement.className = "properties source-code";
+    this.propertiesElement.className = "properties properties-tree source-code";
     this.propertiesElement.tabIndex = 0;
     this.propertiesTreeOutline = new TreeOutline(this.propertiesElement);
     this.propertiesTreeOutline.section = this;
diff --git a/WebCore/inspector/front-end/Resource.js b/WebCore/inspector/front-end/Resource.js
index ea9052d..fe2f7d2 100644
--- a/WebCore/inspector/front-end/Resource.js
+++ b/WebCore/inspector/front-end/Resource.js
@@ -29,7 +29,7 @@
 WebInspector.Resource = function(identifier, url)
 {
     this.identifier = identifier;
-    this._url = url;
+    this.url = url;
     this._startTime = -1;
     this._endTime = -1;
     this._requestMethod = "";
@@ -97,14 +97,19 @@ WebInspector.Resource.prototype = {
         if (this._url === x)
             return;
 
-        var oldURL = this._url;
         this._url = x;
         delete this._parsedQueryParameters;
-        // FIXME: We should make the WebInspector object listen for the "url changed" event.
-        // Then resourceURLChanged can be removed.
-        WebInspector.resourceURLChanged(this, oldURL);
 
-        this.dispatchEventToListeners("url changed");
+        var parsedURL = x.asParsedURL();
+        this.domain = parsedURL ? parsedURL.host : "";
+        this.path = parsedURL ? parsedURL.path : "";
+        this.lastPathComponent = "";
+        if (parsedURL && parsedURL.path) {
+            var lastSlashIndex = parsedURL.path.lastIndexOf("/");
+            if (lastSlashIndex !== -1)
+                this.lastPathComponent = parsedURL.path.substring(lastSlashIndex + 1);
+        }
+        this.lastPathComponentLowerCase = this.lastPathComponent.toLowerCase();
     },
 
     get documentURL()
@@ -114,46 +119,21 @@ WebInspector.Resource.prototype = {
 
     set documentURL(x)
     {
-        if (this._documentURL === x)
-            return;
         this._documentURL = x;
     },
 
-    get domain()
-    {
-        return this._domain;
-    },
-
-    set domain(x)
-    {
-        if (this._domain === x)
-            return;
-        this._domain = x;
-    },
-
-    get lastPathComponent()
-    {
-        return this._lastPathComponent;
-    },
-
-    set lastPathComponent(x)
-    {
-        if (this._lastPathComponent === x)
-            return;
-        this._lastPathComponent = x;
-        this._lastPathComponentLowerCase = x ? x.toLowerCase() : null;
-    },
-
     get displayName()
     {
-        var title = this.lastPathComponent;
-        if (!title)
-            title = this.displayDomain;
-        if (!title && this.url)
-            title = this.url.trimURL(WebInspector.mainResource ? WebInspector.mainResource.domain : "");
-        if (title === "/")
-            title = this.url;
-        return title;
+        if (this._displayName)
+            return this._displayName;
+        this._displayName = this.lastPathComponent;
+        if (!this._displayName)
+            this._displayName = this.displayDomain;
+        if (!this._displayName && this.url)
+            this._displayName = this.url.trimURL(WebInspector.mainResource ? WebInspector.mainResource.domain : "");
+        if (this._displayName === "/")
+            this._displayName = this.url;
+        return this._displayName;
     },
 
     get displayDomain()
@@ -171,29 +151,22 @@ WebInspector.Resource.prototype = {
 
     set startTime(x)
     {
-        if (this._startTime === x)
-            return;
-
         this._startTime = x;
-
-        if (WebInspector.panels.resources)
-            WebInspector.panels.resources.refreshResource(this);
     },
 
     get responseReceivedTime()
     {
+        if (this.timing && this.timing.requestTime) {
+            // Calculate responseReceivedTime from timing data for better accuracy.
+            // Timing's requestTime is a baseline in seconds, rest of the numbers there are ticks in millis.
+            return this.timing.requestTime + this.timing.receiveHeadersEnd / 1000.0;
+        }
         return this._responseReceivedTime || -1;
     },
 
     set responseReceivedTime(x)
     {
-        if (this._responseReceivedTime === x)
-            return;
-
         this._responseReceivedTime = x;
-
-        if (WebInspector.panels.resources)
-            WebInspector.panels.resources.refreshResource(this);
     },
 
     get endTime()
@@ -203,13 +176,13 @@ WebInspector.Resource.prototype = {
 
     set endTime(x)
     {
-        if (this._endTime === x)
-            return;
+        // In case of fast load (or in case of cached resources), endTime on network stack
+        // can be less then m_responseReceivedTime measured in WebCore. Normalize it here,
+        // prefer actualEndTime to m_responseReceivedTime.
+        if (x < this.responseReceivedTime)
+            this.responseReceivedTime = x;
 
         this._endTime = x;
-
-        if (WebInspector.panels.resources)
-            WebInspector.panels.resources.refreshResource(this);
     },
 
     get duration()
@@ -240,13 +213,7 @@ WebInspector.Resource.prototype = {
 
     set resourceSize(x)
     {
-        if (this._resourceSize === x)
-            return;
-
         this._resourceSize = x;
-
-        if (WebInspector.panels.resources)
-            WebInspector.panels.resources.refreshResource(this);
     },
 
     get transferSize()
@@ -262,8 +229,6 @@ WebInspector.Resource.prototype = {
 
     set expectedContentLength(x)
     {
-        if (this._expectedContentLength === x)
-            return;
         this._expectedContentLength = x;
     },
 
@@ -313,11 +278,6 @@ WebInspector.Resource.prototype = {
 
         if (this._category)
             this._category.addResource(this);
-
-        if (WebInspector.panels.resources) {
-            WebInspector.panels.resources.refreshResource(this);
-            WebInspector.panels.resources.recreateViewForResourceIfNeeded(this);
-        }
     },
 
     get cached()
@@ -328,7 +288,6 @@ WebInspector.Resource.prototype = {
     set cached(x)
     {
         this._cached = x;
-        this.dispatchEventToListeners("cached changed");
     },
 
     get mimeType()
@@ -338,9 +297,6 @@ WebInspector.Resource.prototype = {
 
     set mimeType(x)
     {
-        if (this._mimeType === x)
-            return;
-
         this._mimeType = x;
     },
 
@@ -387,18 +343,14 @@ WebInspector.Resource.prototype = {
 
     get requestHeaders()
     {
-        if (this._requestHeaders === undefined)
-            this._requestHeaders = {};
-        return this._requestHeaders;
+        return this._requestHeaders || {};
     },
 
     set requestHeaders(x)
     {
-        if (this._requestHeaders === x)
-            return;
-
         this._requestHeaders = x;
         delete this._sortedRequestHeaders;
+        delete this._requestCookies;
 
         this.dispatchEventToListeners("requestHeaders changed");
     },
@@ -421,6 +373,13 @@ WebInspector.Resource.prototype = {
         return this._headerValue(this.requestHeaders, headerName);
     },
 
+    get requestCookies()
+    {
+        if (!this._requestCookies)
+            this._requestCookies = WebInspector.CookieParser.parseCookie(this.requestHeaderValue("Cookie"));
+        return this._requestCookies;
+    },
+
     get requestFormData()
     {
         return this._requestFormData;
@@ -434,18 +393,14 @@ WebInspector.Resource.prototype = {
 
     get responseHeaders()
     {
-        if (this._responseHeaders === undefined)
-            this._responseHeaders = {};
-        return this._responseHeaders;
+        return this._responseHeaders || {};
     },
 
     set responseHeaders(x)
     {
-        if (this._responseHeaders === x)
-            return;
-
         this._responseHeaders = x;
         delete this._sortedResponseHeaders;
+        delete this._responseCookies;
 
         this.dispatchEventToListeners("responseHeaders changed");
     },
@@ -468,6 +423,13 @@ WebInspector.Resource.prototype = {
         return this._headerValue(this.responseHeaders, headerName);
     },
 
+    get responseCookies()
+    {
+        if (!this._responseCookies)
+            this._responseCookies = WebInspector.CookieParser.parseSetCookie(this.responseHeaderValue("Set-Cookie"));
+        return this._responseCookies;
+    },
+
     get queryParameters()
     {
         if (this._parsedQueryParameters)
@@ -627,6 +589,15 @@ WebInspector.Resource.prototype = {
 
         if (msg)
             WebInspector.console.addMessage(msg);
+    },
+
+    getContents: function(callback)
+    {
+        // FIXME: eventually, cached resources will have no identifiers.
+        if (this.frameID)
+            InspectorBackend.resourceContent(this.frameID, this.url, callback);
+        else
+            InspectorBackend.getResourceContent(this.identifier, false, callback);
     }
 }
 
diff --git a/WebCore/inspector/front-end/ResourceCategory.js b/WebCore/inspector/front-end/ResourceCategory.js
index 84f2cf9..7d95a1f 100644
--- a/WebCore/inspector/front-end/ResourceCategory.js
+++ b/WebCore/inspector/front-end/ResourceCategory.js
@@ -47,8 +47,8 @@ WebInspector.ResourceCategory.prototype = {
         var resourcesLength = this.resources.length;
         for (var i = 0; i < resourcesLength; ++i) {
             var b = this.resources[i];
-            if (a._lastPathComponentLowerCase && b._lastPathComponentLowerCase)
-                if (a._lastPathComponentLowerCase < b._lastPathComponentLowerCase)
+            if (a.lastPathComponentLowerCase && b.lastPathComponentLowerCase)
+                if (a.lastPathComponentLowerCase < b.lastPathComponentLowerCase)
                     break;
             else if (a.name && b.name)
                 if (a.name < b.name)
diff --git a/WebCore/inspector/front-end/ResourceManager.js b/WebCore/inspector/front-end/ResourceManager.js
new file mode 100644
index 0000000..7244cea
--- /dev/null
+++ b/WebCore/inspector/front-end/ResourceManager.js
@@ -0,0 +1,297 @@
+/*
+ * Copyright (C) 2009, 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+WebInspector.ResourceManager = function()
+{
+    this._registerNotifyHandlers(
+        "identifierForInitialRequest",
+        "willSendRequest",
+        "markResourceAsCached",
+        "didReceiveResponse",
+        "didReceiveContentLength",
+        "didFinishLoading",
+        "didFailLoading",
+        "didLoadResourceFromMemoryCache",
+        "setOverrideContent",
+        "didCommitLoad",
+        "frameDetachedFromParent",
+        "didCreateWebSocket",
+        "willSendWebSocketHandshakeRequest",
+        "didReceiveWebSocketHandshakeResponse",
+        "didCloseWebSocket");
+
+    this._resources = {};
+    this._resourcesByFrame = {};
+    this._lastCachedId = 0;
+}
+
+WebInspector.ResourceManager.prototype = {
+    _registerNotifyHandlers: function()
+    {
+        for (var i = 0; i < arguments.length; ++i)
+            WebInspector[arguments[i]] = this[arguments[i]].bind(this);
+    },
+
+    identifierForInitialRequest: function(identifier, url, frameID, isMainResource)
+    {
+        var resource = new WebInspector.Resource(identifier, url);
+        if (isMainResource)
+            resource.isMainResource = true;
+        this._resources[identifier] = resource;
+
+        if (frameID) {
+            resource.frameID = frameID;
+            var resourcesForFrame = this._resourcesByFrame[frameID];
+            if (!resourcesForFrame) {
+                resourcesForFrame = [];
+                this._resourcesByFrame[frameID] = resourcesForFrame;
+            }
+            resourcesForFrame.push(resource);
+        }
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.addResource(resource);
+    },
+
+    willSendRequest: function(identifier, time, request, redirectResponse)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        // Redirect may have empty URL and we'd like to not crash with invalid HashMap entry.
+        // See http/tests/misc/will-send-request-returns-null-on-redirect.html
+        if (!redirectResponse.isNull && request.url.length) {
+            resource.endTime = time;
+            this.didReceiveResponse(identifier, time, "Other", redirectResponse);
+            resource = this._appendRedirect(resource.identifier, request.url);
+        }
+
+        resource.requestMethod = request.httpMethod;
+        resource.requestHeaders = request.httpHeaderFields;
+        resource.requestFormData = request.requestFormData;
+        resource.startTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    _appendRedirect: function(identifier, redirectURL)
+    {
+        // We always store last redirect by the original id key. Rest of the redirects are referenced from within the last one.
+
+        var originalResource = this._resources[identifier];
+        var redirectIdentifier = originalResource.identifier + ":" + (originalResource.redirects ? originalResource.redirects.length : 0);
+        originalResource.identifier = redirectIdentifier;
+        this._resources[redirectIdentifier] = originalResource;
+
+        this.identifierForInitialRequest(identifier, redirectURL, originalResource.frameID);
+
+        var newResource = this._resources[identifier];
+        newResource.redirects = originalResource.redirects || [];
+        delete originalResource.redirects;
+        newResource.redirects.push(originalResource);
+        return newResource;
+    },
+
+    markResourceAsCached: function(identifier)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.cached = true;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didReceiveResponse: function(identifier, time, resourceType, response)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.type = WebInspector.Resource.Type[resourceType];
+        resource.mimeType = response.mimeType;
+        resource.expectedContentLength = response.expectedContentLength;
+        resource.textEncodingName = response.textEncodingName;
+        resource.suggestedFilename = response.suggestedFilename;
+        resource.statusCode = response.httpStatusCode;
+        resource.statusText = response.httpStatusText;
+
+        resource.responseHeaders = response.httpHeaderFields;
+        resource.connectionReused = response.connectionReused;
+        resource.connectionID = response.connectionID;
+        resource.responseReceivedTime = time;
+
+        if (response.wasCached)
+            resource.cached = true;
+        else
+            resource.timing = response.timing;
+
+        if (response.rawHeaders) {
+            resource.requestHeaders = response.rawHeaders.requestHeaders;
+            resource.responseHeaders = response.rawHeaders.responseHeaders;
+        }
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didReceiveContentLength: function(identifier, time, lengthReceived)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.resourceSize += lengthReceived;
+        resource.endTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didFinishLoading: function(identifier, finishTime)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.finished = true;
+        resource.endTime = finishTime;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didFailLoading: function(identifier, time, localizedDescription)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.failed = true;
+        resource.endTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didLoadResourceFromMemoryCache: function(time, frameID, cachedResource)
+    {
+        var identifier = "cached:" + this._lastCachedId++;
+        this.identifierForInitialRequest(identifier, cachedResource.url, frameID);
+
+        var resource = this._resources[identifier];
+        resource.cached = true;
+        resource.startTime = resource.responseReceivedTime = time;
+        resource.resourceSize = cachedResource.encodedSize();
+
+        this.didReceiveResponse(identifier, time, cachedResource.response);
+    },
+
+    setOverrideContent: function(identifier, sourceString, type)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.type = WebInspector.Resource.Type[type];
+        resource.overridenContent = sourceString;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.addResource(resource);
+    },
+
+    didCommitLoad: function(frameID)
+    {
+    },
+
+    frameDetachedFromParent: function(frameID)
+    {
+        var resourcesForFrame = this._resourcesByFrame[frameID];
+        for (var i = 0; resourcesForFrame && i < resourcesForFrame.length; ++i)
+            delete this._resources[resourcesForFrame[i].identifier];
+        delete this._resourcesByFrame[frameID];
+    },
+
+    didCreateWebSocket: function(identifier, requestURL)
+    {
+        this.identifierForInitialRequest(identifier, requestURL);
+        var resource = this._resources[identifier];
+        resource.type = WebInspector.Resource.Type.WebSocket;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.addResource(resource);
+    },
+
+    willSendWebSocketHandshakeRequest: function(identifier, time, request)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.requestMethod = "GET";
+        resource.requestHeaders = request.webSocketHeaderFields;
+        resource.webSocketRequestKey3 = request.webSocketRequestKey3;
+        resource.startTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didReceiveWebSocketHandshakeResponse: function(identifier, time, response)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+
+        resource.statusCode = response.statusCode;
+        resource.statusText = response.statusText;
+        resource.responseHeaders = response.webSocketHeaderFields;
+        resource.webSocketChallengeResponse = response.webSocketChallengeResponse;
+        resource.responseReceivedTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    },
+
+    didCloseWebSocket: function(identifier, time)
+    {
+        var resource = this._resources[identifier];
+        if (!resource)
+            return;
+        resource.endTime = time;
+
+        if (WebInspector.panels.network)
+            WebInspector.panels.network.refreshResource(resource);
+    }
+}
diff --git a/WebCore/inspector/front-end/ResourceView.js b/WebCore/inspector/front-end/ResourceView.js
index 1c2574f..862569f 100644
--- a/WebCore/inspector/front-end/ResourceView.js
+++ b/WebCore/inspector/front-end/ResourceView.js
@@ -99,7 +99,6 @@ WebInspector.ResourceView = function(resource)
 
     this.headersVisible = true;
 
-    resource.addEventListener("url changed", this._refreshURL, this);
     resource.addEventListener("requestHeaders changed", this._refreshRequestHeaders, this);
     resource.addEventListener("responseHeaders changed", this._refreshResponseHeaders, this);
     resource.addEventListener("finished", this._refreshHTTPInformation, this);
diff --git a/WebCore/inspector/front-end/ResourcesPanel.js b/WebCore/inspector/front-end/ResourcesPanel.js
index aa021ff..ae67bef 100644
--- a/WebCore/inspector/front-end/ResourcesPanel.js
+++ b/WebCore/inspector/front-end/ResourcesPanel.js
@@ -142,7 +142,7 @@ WebInspector.ResourcesPanel.prototype = {
 
         // Add a divider
         var dividerElement = document.createElement("div");
-        dividerElement.addStyleClass("divider");
+        dividerElement.addStyleClass("scope-bar-divider");
         this.filterBarElement.appendChild(dividerElement);
 
         for (var category in this.categories)
@@ -757,7 +757,6 @@ WebInspector.ResourcesPanel.prototype = {
     addResource: function(resource)
     {
         this._resources.push(resource);
-        this.refreshResource(resource);
     },
 
     removeResource: function(resource)
@@ -815,18 +814,19 @@ WebInspector.ResourcesPanel.prototype = {
 
     refreshResource: function(resource)
     {
+        this._recreateViewForResourceIfNeeded(resource);
         this.refreshItem(resource);
     },
 
-    recreateViewForResourceIfNeeded: function(resource)
+    _recreateViewForResourceIfNeeded: function(resource)
     {
         if (!resource || !resource._resourcesView)
             return;
 
-        var newView = this._createResourceView(resource);
-        if (newView.__proto__ === resource._resourcesView.__proto__)
+        if (this._resourceViewIsConsistentWithCategory(resource, resource._resourcesView))
             return;
 
+        var newView = this._createResourceView(resource);
         if (!this.currentQuery && resource._itemsTreeElement)
             resource._itemsTreeElement.updateErrorsAndWarnings();
 
@@ -1068,6 +1068,23 @@ WebInspector.ResourcesPanel.prototype = {
         this.calculator = this.summaryBar.calculator = selectedOption.calculator;
     },
 
+    _resourceViewIsConsistentWithCategory: function(resource, resourceView)
+    {
+        switch (resource.category) {
+            case WebInspector.resourceCategories.documents:
+            case WebInspector.resourceCategories.stylesheets:
+            case WebInspector.resourceCategories.scripts:
+            case WebInspector.resourceCategories.xhr:
+                return resourceView.__proto__ === WebInspector.SourceView.prototype;
+            case WebInspector.resourceCategories.images:
+                return resourceView.__proto__ === WebInspector.ImageView.prototype;
+            case WebInspector.resourceCategories.fonts:
+                return resourceView.__proto__ === WebInspector.FontView.prototype;
+            default:
+                return resourceView.__proto__ === WebInspector.ResourceView.prototype;
+        }
+    },
+
     _createResourceView: function(resource)
     {
         switch (resource.category) {
@@ -1250,17 +1267,27 @@ WebInspector.ResourcesPanel.prototype = {
 
     _contextMenu: function(event)
     {
-        // createBlobURL is enabled conditionally, do not expose resource export if it's not available.
-        if (typeof window.createBlobURL !== "function" || !Preferences.resourceExportEnabled)
-            return;
-
         var contextMenu = new WebInspector.ContextMenu();
         var resourceTreeItem = event.target.enclosingNodeOrSelfWithClass("resource-sidebar-tree-item");
-        if (resourceTreeItem && resourceTreeItem.treeElement) {
-            var resource = resourceTreeItem.treeElement.representedObject;
-            contextMenu.appendItem(WebInspector.UIString("Export to HAR"), this._exportResource.bind(this, resource));
+        var resource;
+        if (resourceTreeItem && resourceTreeItem.treeElement)
+            resource = resourceTreeItem.treeElement.representedObject;
+
+        var needSeparator = false;
+        // createObjectURL is enabled conditionally, do not expose resource export if it's not available.
+        if (typeof window.createObjectURL === "function" && Preferences.resourceExportEnabled) {
+            if (resource)
+                contextMenu.appendItem(WebInspector.UIString("Export to HAR"), this._exportResource.bind(this, resource));
+            contextMenu.appendItem(WebInspector.UIString("Export all to HAR"), this._exportAll.bind(this));
+            needSeparator = true;
         }
-        contextMenu.appendItem(WebInspector.UIString("Export all to HAR"), this._exportAll.bind(this));
+
+        if (resource && resource.category === WebInspector.resourceCategories.xhr) {
+            if (needSeparator)
+                contextMenu.appendSeparator();
+            contextMenu.appendItem(WebInspector.UIString("Set XHR Breakpoint"), WebInspector.breakpointManager.createXHRBreakpoint.bind(WebInspector.breakpointManager, resource.url));
+        }
+
         contextMenu.show(event);
     },
 
@@ -1281,11 +1308,6 @@ WebInspector.ResourcesPanel.prototype = {
 
 WebInspector.ResourcesPanel.prototype.__proto__ = WebInspector.Panel.prototype;
 
-WebInspector.getResourceContent = function(identifier, callback)
-{
-    InspectorBackend.getResourceContent(identifier, callback);
-}
-
 WebInspector.ResourceBaseCalculator = function()
 {
 }
@@ -1814,7 +1836,8 @@ WebInspector.ResourceGraph = function(resource)
     this._graphElement.className = "resources-graph-side";
     this._graphElement.addEventListener("mouseover", this.refreshLabelPositions.bind(this), false);
 
-    this._cachedChanged();
+    if (this.resource.cached)
+        this._graphElement.addStyleClass("resource-cached");
 
     this._barAreaElement = document.createElement("div");
     this._barAreaElement.className = "resources-graph-bar-area hidden";
@@ -1838,8 +1861,6 @@ WebInspector.ResourceGraph = function(resource)
     this._barAreaElement.appendChild(this._labelRightElement);
 
     this._graphElement.addStyleClass("resources-category-" + resource.category.name);
-
-    resource.addEventListener("cached changed", this._cachedChanged, this);
 }
 
 WebInspector.ResourceGraph.prototype = {
@@ -1963,11 +1984,8 @@ WebInspector.ResourceGraph.prototype = {
         this._labelLeftElement.title = tooltip;
         this._labelRightElement.title = tooltip;
         this._barRightElement.title = tooltip;
-    },
 
-    _cachedChanged: function()
-    {
-        if (this.resource.cached)
+        if (this.resource.cached && !this._graphElement.hasStyleClass("resource-cached"))
             this._graphElement.addStyleClass("resource-cached");
     }
 }
diff --git a/WebCore/inspector/front-end/ScriptsPanel.js b/WebCore/inspector/front-end/ScriptsPanel.js
index 8283528..0a653c9 100644
--- a/WebCore/inspector/front-end/ScriptsPanel.js
+++ b/WebCore/inspector/front-end/ScriptsPanel.js
@@ -134,10 +134,9 @@ WebInspector.ScriptsPanel = function()
     this.sidebarPanes.jsBreakpoints = WebInspector.createJSBreakpointsSidebarPane();
     if (Preferences.nativeInstrumentationEnabled) {
         this.sidebarPanes.domBreakpoints = WebInspector.createDOMBreakpointsSidebarPane();
-        this.sidebarPanes.domBreakpoints.expanded = true;
         this.sidebarPanes.xhrBreakpoints = WebInspector.createXHRBreakpointsSidebarPane();
-        this.sidebarPanes.xhrBreakpoints.expanded = true;
     }
+    this.sidebarPanes.eventListenerBreakpoints = new WebInspector.EventListenerBreakpointsSidebarPane();
 
     this.sidebarPanes.workers = new WebInspector.WorkersSidebarPane();
 
@@ -389,9 +388,6 @@ WebInspector.ScriptsPanel.prototype = {
         this.sidebarPanes.callstack.update(details.callFrames, this._sourceIDMap);
         this.sidebarPanes.callstack.selectedCallFrame = details.callFrames[0];
 
-        if ("eventType" in details)
-            this.sidebarPanes.callstack.updateStatus(details.eventType, details.eventData);
-
         WebInspector.currentPanel = this;
         window.focus();
     },
@@ -439,13 +435,7 @@ WebInspector.ScriptsPanel.prototype = {
         delete this.currentQuery;
         this.searchCanceled();
 
-        if (!this._debuggerEnabled) {
-            this._paused = false;
-            this._waitingToPause = false;
-            this._stepping = false;
-        }
-
-        this._clearInterface();
+        this.debuggerResumed();
 
         this._backForwardList = [];
         this._currentBackForwardIndex = -1;
@@ -473,6 +463,7 @@ WebInspector.ScriptsPanel.prototype = {
                 this.sidebarPanes.domBreakpoints.reset();
                 this.sidebarPanes.xhrBreakpoints.reset();
             }
+            this.sidebarPanes.eventListenerBreakpoints.reset();
             this.sidebarPanes.workers.reset();
         }
     },
diff --git a/WebCore/inspector/front-end/SourceFrame.js b/WebCore/inspector/front-end/SourceFrame.js
index aecd57b..4b391ac 100644
--- a/WebCore/inspector/front-end/SourceFrame.js
+++ b/WebCore/inspector/front-end/SourceFrame.js
@@ -169,6 +169,14 @@ WebInspector.SourceFrame.prototype = {
             this._lineToHighlight = line;
     },
 
+    clearLineHighlight: function()
+    {
+        if (this._textViewer)
+            this._textViewer.clearLineHighlight();
+        else
+            delete this._lineToHighlight;
+    },
+
     _createViewerIfNeeded: function()
     {
         if (!this._visible || !this._loaded || this._textViewer)
diff --git a/WebCore/inspector/front-end/SourceView.js b/WebCore/inspector/front-end/SourceView.js
index 3f762cc..8092505 100644
--- a/WebCore/inspector/front-end/SourceView.js
+++ b/WebCore/inspector/front-end/SourceView.js
@@ -59,6 +59,8 @@ WebInspector.SourceView.prototype = {
     hide: function()
     {
         this.sourceFrame.visible = false;
+        if (!this._frameNeedsSetup)
+            this.sourceFrame.clearLineHighlight();
         WebInspector.View.prototype.hide.call(this);
         if (this.localSourceFrame)
             this.localSourceFrame.visible = false;
@@ -81,7 +83,7 @@ WebInspector.SourceView.prototype = {
         this.attach();
 
         delete this._frameNeedsSetup;
-        WebInspector.getResourceContent(this.resource.identifier, this._contentLoaded.bind(this));
+        this.resource.getContents(this._contentLoaded.bind(this));
     },
 
     hasContentTab: function()
diff --git a/WebCore/inspector/front-end/StoragePanel.js b/WebCore/inspector/front-end/StoragePanel.js
index 2d17989..e033b57 100644
--- a/WebCore/inspector/front-end/StoragePanel.js
+++ b/WebCore/inspector/front-end/StoragePanel.js
@@ -59,7 +59,7 @@ WebInspector.StoragePanel = function(database)
     this.element.appendChild(this.storageViews);
 
     this.storageViewStatusBarItemsContainer = document.createElement("div");
-    this.storageViewStatusBarItemsContainer.id = "storage-view-status-bar-items";
+    this.storageViewStatusBarItemsContainer.className = "status-bar-items";
 
     this.reset();
 }
diff --git a/WebCore/inspector/front-end/StylesSidebarPane.js b/WebCore/inspector/front-end/StylesSidebarPane.js
index 6aff37d..36d854c 100644
--- a/WebCore/inspector/front-end/StylesSidebarPane.js
+++ b/WebCore/inspector/front-end/StylesSidebarPane.js
@@ -1695,17 +1695,13 @@ WebInspector.StylePropertyTreeElement.prototype = {
                 self.updateTitle();
         }
 
-        function successCallback(newStyle, changedProperties)
+        function successCallback(newStyle)
         {
-            elementsPanel.removeStyleChange(section.identifier, self.style, self.name);
-
             if (!styleTextLength) {
                 // Do remove ourselves from UI when the property removal is confirmed.
                 self.parent.removeChild(self);
             } else {
                 self.style = newStyle;
-                for (var i = 0; i < changedProperties.length; ++i)
-                    elementsPanel.addStyleChange(section.identifier, self.style, changedProperties[i]);
                 self._styleRule.style = self.style;
             }
 
diff --git a/WebCore/inspector/front-end/TabbedPane.js b/WebCore/inspector/front-end/TabbedPane.js
index 6acd163..dec3a0b 100644
--- a/WebCore/inspector/front-end/TabbedPane.js
+++ b/WebCore/inspector/front-end/TabbedPane.js
@@ -33,7 +33,7 @@ WebInspector.TabbedPane = function(element)
     this.element = element || document.createElement("div");
 
     this.tabsElement = document.createElement("div");
-    this.tabsElement.className = "scope-bar";
+    this.tabsElement.className = "tabbed-pane-header";
     this.element.appendChild(this.tabsElement);
 
     this._tabObjects = {};
diff --git a/WebCore/inspector/front-end/TextViewer.js b/WebCore/inspector/front-end/TextViewer.js
index 13b2836..9ad5e49 100644
--- a/WebCore/inspector/front-end/TextViewer.js
+++ b/WebCore/inspector/front-end/TextViewer.js
@@ -117,16 +117,22 @@ WebInspector.TextViewer.prototype = {
 
     highlightLine: function(lineNumber)
     {
-        if (typeof this._highlightedLine === "number") {
-            var chunk = this._makeLineAChunk(this._highlightedLine);
-            chunk.removeDecoration("webkit-highlighted-line");
-        }
+        this.clearLineHighlight();
         this._highlightedLine = lineNumber;
         this.revealLine(lineNumber);
         var chunk = this._makeLineAChunk(lineNumber);
         chunk.addDecoration("webkit-highlighted-line");
     },
 
+    clearLineHighlight: function()
+    {
+        if (typeof this._highlightedLine === "number") {
+            var chunk = this._makeLineAChunk(this._highlightedLine);
+            chunk.removeDecoration("webkit-highlighted-line");
+            delete this._highlightedLine;
+        }
+    },
+
     freeCachedElements: function()
     {
         this._cachedSpans = [];
diff --git a/WebCore/inspector/front-end/TimelineGrid.js b/WebCore/inspector/front-end/TimelineGrid.js
index ad7e769..adc8e47 100644
--- a/WebCore/inspector/front-end/TimelineGrid.js
+++ b/WebCore/inspector/front-end/TimelineGrid.js
@@ -55,6 +55,7 @@ WebInspector.TimelineGrid.prototype = {
         return this._itemsGraphsElement;
     },
 
+    
     updateDividers: function(force, calculator, paddingLeft)
     {
         var dividerCount = Math.round(this._dividersElement.offsetWidth / 64);
@@ -88,10 +89,21 @@ WebInspector.TimelineGrid.prototype = {
                 dividersLabelBarElementClientWidth = this._dividersLabelBarElement.clientWidth;
             }
 
-            if (i === dividerCount)
+            if (i === (paddingLeft ? 0 : 1)) {
+                divider.addStyleClass("first");
+                dividerLabelBar.addStyleClass("first");
+            } else {
+                divider.removeStyleClass("first");
+                dividerLabelBar.removeStyleClass("first");
+            }
+
+            if (i === dividerCount) {
                 divider.addStyleClass("last");
-            else
+                dividerLabelBar.addStyleClass("last");
+            } else {
                 divider.removeStyleClass("last");
+                dividerLabelBar.removeStyleClass("last");
+            }
 
             var left = paddingLeft + clientWidth * (i / dividerCount);
             var percentLeft = 100 * left / dividersLabelBarElementClientWidth;
diff --git a/WebCore/inspector/front-end/TimelineOverviewPane.js b/WebCore/inspector/front-end/TimelineOverviewPane.js
index 3e83f62..55e24c5 100644
--- a/WebCore/inspector/front-end/TimelineOverviewPane.js
+++ b/WebCore/inspector/front-end/TimelineOverviewPane.js
@@ -33,8 +33,7 @@ WebInspector.TimelineOverviewPane = function(categories)
     this._categories = categories;
 
     this.statusBarFilters = document.createElement("div");
-    this.statusBarFilters.id = "timeline-view-status-bar-items";
-    this.statusBarFilters.addStyleClass("status-bar-item");
+    this.statusBarFilters.className = "status-bar-items";
     for (var categoryName in this._categories) {
         var category = this._categories[categoryName];
         this.statusBarFilters.appendChild(this._createTimelineCategoryStatusBarCheckbox(category, this._onCheckboxClicked.bind(this, category)));
@@ -197,6 +196,7 @@ WebInspector.TimelineOverviewPane.prototype = {
     updateMainViewWidth: function(width, records)
     {
         this._overviewGrid.element.style.left = width + "px";
+        this.statusBarFilters.style.left = Math.max(155, width) + "px";
     },
 
     reset: function()
diff --git a/WebCore/inspector/front-end/WebKit.qrc b/WebCore/inspector/front-end/WebKit.qrc
index 11382cd..1e5a508 100644
--- a/WebCore/inspector/front-end/WebKit.qrc
+++ b/WebCore/inspector/front-end/WebKit.qrc
@@ -20,6 +20,7 @@
     <file>ConsoleView.js</file>
     <file>ContextMenu.js</file>
     <file>CookieItemsView.js</file>
+    <file>CookieParser.js</file>
     <file>CSSCompletions.js</file>
     <file>CSSStyleModel.js</file>
     <file>Database.js</file>
@@ -68,6 +69,7 @@
     <file>RemoteObject.js</file>
     <file>Resource.js</file>
     <file>ResourceCategory.js</file>
+    <file>ResourceManager.js</file>
     <file>ResourcesPanel.js</file>
     <file>ResourceView.js</file>
     <file>ScopeChainSidebarPane.js</file>
diff --git a/WebCore/inspector/front-end/inspector.css b/WebCore/inspector/front-end/inspector.css
index 848afdc..0662954 100644
--- a/WebCore/inspector/front-end/inspector.css
+++ b/WebCore/inspector/front-end/inspector.css
@@ -810,6 +810,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
 .resource-view {
     display: none;
     position: absolute;
+    background: white;
     top: 0;
     left: 0;
     right: 0;
@@ -820,7 +821,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     display: block;
 }
 
-.resource-view .scope-bar {
+.resource-view .tabbed-pane-header {
     display: none;
     position: absolute;
     height: 20px;
@@ -831,7 +832,7 @@ body.platform-linux .monospace, body.platform-linux .source-code {
     border-bottom: 1px solid rgb(163, 163, 163);
 }
 
-.resource-view.headers-visible .scope-bar {
+.resource-view.headers-visible .tabbed-pane-header {
     display: block;
 }
 
@@ -1373,10 +1374,10 @@ body.inactive .placard.selected {
 
 .section .properties, .event-bar .event-properties {
     display: none;
-    margin: 0;
-    padding: 2px 6px 3px;
-    list-style: none;
-    min-height: 18px;
+}
+
+.section.expanded .properties, .event-bar.expanded .event-properties {
+    display: block;
 }
 
 .section.no-affect .properties li {
@@ -1387,11 +1388,14 @@ body.inactive .placard.selected {
     opacity: 1.0;
 }
 
-.section.expanded .properties, .event-bar.expanded .event-properties {
-    display: block;
+.properties-tree {
+    margin: 0;
+    padding: 2px 6px 3px;
+    list-style: none;
+    min-height: 18px;
 }
 
-.section .properties li, .event-properties li {
+.properties-tree li {
     margin-left: 12px;
     white-space: nowrap;
     text-overflow: ellipsis;
@@ -1400,26 +1404,11 @@ body.inactive .placard.selected {
     cursor: auto;
 }
 
-.section .properties li.parent, .event-properties li.parent {
+.properties-tree li.parent {
     margin-left: 1px;
 }
 
-.section .properties ol, .event-properties ol, .stack-trace ol, ol.stack-trace {
-    display: none;
-    margin: 0;
-    -webkit-padding-start: 12px;
-    list-style: none;
-}
-
-ol.stack-trace {
-    -webkit-padding-start: 0px;
-}
-
-.section .properties ol.expanded, .event-properties ol.expanded, .stack-trace ol, ol.stack-trace {
-    display: block;
-}
-
-.section .properties li.parent::before, .event-properties li.parent::before {
+.properties-tree li.parent::before {
     content: url(Images/treeRightTriangleBlack.png);
     opacity: 0.75;
     float: left;
@@ -1431,16 +1420,47 @@ ol.stack-trace {
     cursor: default;
 }
 
-.section .properties li.parent.expanded::before, .event-properties li.parent.expanded::before {
+.properties-tree li.parent.expanded::before {
     content: url(Images/treeDownTriangleBlack.png);
     margin-top: 1px;
 }
 
-.section .properties li .info, .event-properties li .info {
+.properties-tree li .info {
     padding-top: 4px;
     padding-bottom: 3px;
 }
 
+.properties-tree ol, .stack-trace ol, ol.stack-trace {
+    display: none;
+    margin: 0;
+    -webkit-padding-start: 12px;
+    list-style: none;
+}
+
+.properties-tree ol.expanded, .stack-trace ol, ol.stack-trace {
+    display: block;
+}
+
+ol.stack-trace {
+    -webkit-padding-start: 0px;
+}
+
+.event-listener-breakpoints .event-category {
+    font-size: 12px;
+    font-weight: bold;
+    color: rgb(110, 110, 110);
+}
+
+.event-listener-breakpoints.properties-tree .children li {
+    margin-left: 17px;
+}
+
+.event-listener-breakpoints .checkbox-elem {
+    float: left;
+    margin-top: 1px;
+    margin-left: 0px;
+}
+
 .section .event-bars {
     display: none;
 }
@@ -2086,22 +2106,27 @@ body.inactive .sidebar {
     background-image: url(Images/glossyHeaderSelectedPressed.png);
 }
 
-.data-grid th.sort-ascending div::after {
+.data-grid th.sort-ascending > div::after {
     position: absolute;
     top: 0;
+    bottom: 0;
     right: 0;
+    height: 12px;
+    margin-bottom: auto;
+    margin-top: auto;
     width: 8px;
-    height: 8px;
     content: url(Images/treeUpTriangleBlack.png);
 }
 
-.data-grid th.sort-descending div::after {
+.data-grid th.sort-descending > div::after {
     position: absolute;
     top: 0;
+    bottom: 0;
     right: 0;
-    margin-top: 1px;
-    width: 8px;
     height: 8px;
+    margin-bottom: auto;
+    margin-top: auto;
+    width: 8px;
     content: url(Images/treeDownTriangleBlack.png);
 }
 
@@ -2560,6 +2585,33 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     margin-top: 1px;
 }
 
+.tabbed-pane-header {
+    height: 23px;
+    padding: 0 10px;
+    border-bottom: 1px solid rgb(163, 163, 163);
+}
+
+.tabbed-pane-header li {
+    display: inline-block;
+    margin-top: 2px;
+    font-size: 11px;
+    font-weight: bold;
+    color: rgb(46, 46, 46);
+    background: transparent;
+    text-shadow: rgba(255, 255, 255, 0.5) 0 1px 0;
+    vertical-align: middle;
+    padding: 1px 7px 2px;
+    height: 18px;
+    border: 1px solid transparent;
+    border-bottom: none;
+}
+
+.tabbed-pane-header li.selected {
+    background-color: white;
+    border: 1px solid rgb(163, 163, 163);
+    border-bottom: none;
+}
+
 .scope-bar {
     height: 23px;
     padding: 2px 10px 0;
@@ -2580,7 +2632,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
     vertical-align: middle;
 }
 
-.scope-bar .divider {
+.scope-bar-divider {
     margin: 1px 9px 0 8px;
     background-color: rgba(0, 0, 0, 0.4);
     height: 16px;
@@ -2718,7 +2770,7 @@ button.enable-toggle-status-bar-item.toggled-on .glyph {
 .resources-event-dividers {
     position: absolute;
     left: 0;
-    right: 0;
+    right: 5px;
     height: 100%;
     top: 0;
     z-index: 300;
@@ -3837,8 +3889,7 @@ body.inactive .sidebar-tree-item.selected .bubble.search-matches {
     bottom: 0;
 }
 
-#timeline-view-status-bar-items,
-#profile-view-status-bar-items {
+.status-bar-items {
     position: absolute;
     top: 0;
     bottom: 0;
@@ -3962,30 +4013,10 @@ button.enable-toggle-status-bar-item .glyph {
     -webkit-mask-image: url(Images/excludeButtonGlyph.png);
 }
 
-#storage-view-status-bar-items {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    left: 200px;
-    overflow: hidden;
-    border-left: 1px solid rgb(184, 184, 184);
-    margin-left: -1px;
-}
-
 .refresh-storage-status-bar-item .glyph {
     -webkit-mask-image: url(Images/reloadButtonGlyph.png);
 }
 
-#storage-view-status-bar-items {
-    position: absolute;
-    top: 0;
-    bottom: 0;
-    left: 200px;
-    overflow: hidden;
-    border-left: 1px solid rgb(184, 184, 184);
-    margin-left: -1px;
-}
-
 ol.breakpoint-list {
     -webkit-padding-start: 2px;
     list-style: none;
@@ -4020,6 +4051,10 @@ ol.breakpoint-list {
     margin: 2px 0 0px 20px;
 }
 
+.breakpoint-list .breakpoint-hit {
+    background-color: yellow;
+}
+
 .webkit-html-js-node, .webkit-html-css-node {
     white-space: pre;
 }
diff --git a/WebCore/inspector/front-end/inspector.html b/WebCore/inspector/front-end/inspector.html
index 949b18f..96d0cfe 100644
--- a/WebCore/inspector/front-end/inspector.html
+++ b/WebCore/inspector/front-end/inspector.html
@@ -61,6 +61,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="Panel.js"></script>
     <script type="text/javascript" src="TimelineGrid.js"></script>    
     <script type="text/javascript" src="Resource.js"></script>
+    <script type="text/javascript" src="ResourceManager.js"></script>
     <script type="text/javascript" src="ResourceCategory.js"></script>
     <script type="text/javascript" src="Database.js"></script>
     <script type="text/javascript" src="DOMStorage.js"></script>
@@ -143,6 +144,7 @@ THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
     <script type="text/javascript" src="GoToLineDialog.js"></script>
     <script type="text/javascript" src="ShortcutsHelp.js"></script>
     <script type="text/javascript" src="HAREntry.js"></script>
+    <script type="text/javascript" src="CookieParser.js"></script>
 </head>
 <body class="detached">
     <div id="toolbar">
diff --git a/WebCore/inspector/front-end/inspector.js b/WebCore/inspector/front-end/inspector.js
index 3edae8f..9bd88d6 100644
--- a/WebCore/inspector/front-end/inspector.js
+++ b/WebCore/inspector/front-end/inspector.js
@@ -56,15 +56,6 @@ var WebInspector = {
     missingLocalizedStrings: {},
     pendingDispatches: 0,
 
-    // RegExp groups:
-    // 1 - scheme
-    // 2 - hostname
-    // 3 - ?port
-    // 4 - ?path
-    // 5 - ?fragment
-    URLRegExp: /^(http[s]?|file):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
-    GenericURLRegExp: /^([^:]+):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i,
-
     get platform()
     {
         if (!("_platform" in this))
@@ -213,9 +204,9 @@ var WebInspector = {
         var pane = new WebInspector.BreakpointsSidebarPane(WebInspector.UIString("DOM Breakpoints"));
         function breakpointAdded(event)
         {
-            pane.addBreakpoint(new WebInspector.DOMBreakpointItem(event.data));
+            pane.addBreakpoint(new WebInspector.BreakpointItem(event.data));
         }
-        WebInspector.domBreakpointManager.addEventListener("dom-breakpoint-added", breakpointAdded);
+        WebInspector.breakpointManager.addEventListener("dom-breakpoint-added", breakpointAdded);
         return pane;
     },
 
@@ -224,7 +215,7 @@ var WebInspector = {
         var pane = new WebInspector.XHRBreakpointsSidebarPane();
         function breakpointAdded(event)
         {
-            pane.addBreakpoint(new WebInspector.XHRBreakpointItem(event.data));
+            pane.addBreakpoint(new WebInspector.BreakpointItem(event.data));
         }
         WebInspector.breakpointManager.addEventListener("xhr-breakpoint-added", breakpointAdded);
         return pane;
@@ -516,6 +507,8 @@ WebInspector.doLoadedDone = function()
     // this.changes = new WebInspector.ChangesView(this.drawer);
     // TODO: Remove class="hidden" from inspector.html on button#changes-status-bar-item
     this.drawer.visibleView = this.console;
+    // FIXME: uncomment when ready.
+    // this.resourceManager = new WebInspector.ResourceManager();
     this.domAgent = new WebInspector.DOMAgent();
 
     this.resourceCategories = {
@@ -530,7 +523,6 @@ WebInspector.doLoadedDone = function()
     };
 
     this.breakpointManager = new WebInspector.BreakpointManager();
-    this.domBreakpointManager = new WebInspector.DOMBreakpointManager();
     this.cssModel = new WebInspector.CSSStyleModel();
 
     this.panels = {};
@@ -604,6 +596,7 @@ WebInspector.doLoadedDone = function()
     InspectorBackend.getInspectorState(populateInspectorState);
 
     InspectorBackend.populateScriptObjects();
+    InspectorBackend.setConsoleMessagesEnabled(true);
 
     // As a DOMAgent method, this needs to happen after the frontend has loaded and the agent is available.
     InspectorBackend.getSupportedCSSProperties(WebInspector.CSSCompletions._load);
@@ -770,10 +763,10 @@ WebInspector.documentClick = function(event)
             return;
         }
 
-        const urlMatch = WebInspector.GenericURLRegExp.exec(anchor.href);
-        if (urlMatch && urlMatch[1] === "webkit-link-action") {
-            if (urlMatch[2] === "show-panel") {
-                const panel = urlMatch[4].substring(1);
+        var parsedURL = anchor.href.asParsedURL();
+        if (parsedURL && parsedURL.scheme === "webkit-link-action") {
+            if (parsedURL.host === "show-panel") {
+                var panel = parsedURL.path.substring(1);
                 if (WebInspector.panels[panel])
                     WebInspector.currentPanel = WebInspector.panels[panel];
             }
@@ -1229,14 +1222,9 @@ WebInspector.updateResource = function(payload)
         this.resourceURLMap[resource.url] = resource;
         this.panels.resources.addResource(resource);
         this.panels.audits.resourceStarted(resource);
-        if (this.panels.network)
-            this.panels.network.addResource(resource);
     }
 
     if (payload.didRequestChange) {
-        resource.domain = payload.host;
-        resource.path = payload.path;
-        resource.lastPathComponent = payload.lastPathComponent;
         resource.requestHeaders = payload.requestHeaders;
         resource.mainResource = payload.mainResource;
         resource.requestMethod = payload.requestMethod;
@@ -1248,11 +1236,10 @@ WebInspector.updateResource = function(payload)
         if (resource.mainResource)
             this.mainResource = resource;
 
-        var match = payload.documentURL.match(WebInspector.GenericURLRegExp);
-        if (match) {
-            var protocol = match[1].toLowerCase();
-            this._addCookieDomain(match[2]);
-            this._addAppCacheDomain(match[2]);
+        var parsedURL = payload.documentURL.asParsedURL();
+        if (parsedURL) {
+            this._addCookieDomain(parsedURL.host);
+            this._addAppCacheDomain(parsedURL.host);
         }
     }
 
@@ -1293,29 +1280,24 @@ WebInspector.updateResource = function(payload)
             resource.responseReceivedTime = payload.responseReceivedTime;
         if (payload.endTime)
             resource.endTime = payload.endTime;
-
-        if (payload.loadEventTime) {
-            // This loadEventTime is for the main resource, and we want to show it
-            // for all resources on this page. This means we want to set it as a member
-            // of the resources panel instead of the individual resource.
-            this.panels.resources.mainResourceLoadTime = payload.loadEventTime;
-            this.panels.audits.mainResourceLoadTime = payload.loadEventTime;
-            if (this.panels.network)
-                this.panels.network.mainResourceLoadTime = payload.loadEventTime;
-        }
-
-        if (payload.domContentEventTime) {
-            // This domContentEventTime is for the main resource, so it should go in
-            // the resources panel for the same reasons as above.
-            this.panels.resources.mainResourceDOMContentTime = payload.domContentEventTime;
-            this.panels.audits.mainResourceDOMContentTime = payload.domContentEventTime;
-            if (this.panels.network)
-                this.panels.network.mainResourceDOMContentTime = payload.domContentEventTime;
-        }
     }
+    this.panels.resources.refreshResource(resource);
+}
 
+WebInspector.domContentEventFired = function(time)
+{
+    this.panels.resources.mainResourceDOMContentTime = time;
+    this.panels.audits.mainResourceDOMContentTime = time;
     if (this.panels.network)
-        this.panels.network.refreshResource(resource);
+        this.panels.network.mainResourceDOMContentTime = time;
+}
+
+WebInspector.loadEventFired = function(time)
+{
+    this.panels.resources.mainResourceLoadTime = time;
+    this.panels.audits.mainResourceLoadTime = time;
+    if (this.panels.network)
+        this.panels.network.mainResourceLoadTime = time;
 }
 
 WebInspector.removeResource = function(identifier)
@@ -1447,16 +1429,20 @@ WebInspector.failedToParseScriptSource = function(sourceURL, source, startingLin
 WebInspector.pausedScript = function(details)
 {
     this.panels.scripts.debuggerPaused(details);
+    this.breakpointManager.debuggerPaused(details);
     InspectorFrontendHost.bringToFront();
 }
 
 WebInspector.resumedScript = function()
 {
+    this.breakpointManager.debuggerResumed();
     this.panels.scripts.debuggerResumed();
 }
 
 WebInspector.reset = function()
 {
+    this.breakpointManager.reset();
+
     for (var panelName in this.panels) {
         var panel = this.panels[panelName];
         if ("reset" in panel)
@@ -1464,7 +1450,6 @@ WebInspector.reset = function()
     }
 
     this.sessionSettings.reset();
-    this.breakpointManager.reset();
 
     for (var category in this.resourceCategories)
         this.resourceCategories[category].removeAllResources();
@@ -1498,12 +1483,6 @@ WebInspector.inspectedURLChanged = function(url)
     this.extensionServer.notifyInspectedURLChanged();
 }
 
-WebInspector.resourceURLChanged = function(resource, oldURL)
-{
-    delete this.resourceURLMap[oldURL];
-    this.resourceURLMap[resource.url] = resource;
-}
-
 WebInspector.didCommitLoad = function()
 {
     // Cleanup elements panel early on inspected page refresh.
@@ -1837,8 +1816,8 @@ WebInspector.resourceURLForRelatedNode = function(node, url)
 
     // documentURL not found or has bad value
     for (var resourceURL in WebInspector.resourceURLMap) {
-        var match = resourceURL.match(WebInspector.URLRegExp);
-        if (match && match[4] === url)
+        var parsedURL = resourceURL.asParsedURL();
+        if (parsedURL && parsedURL.path === url)
             return resourceURL;
     }
     return url;
@@ -1846,17 +1825,17 @@ WebInspector.resourceURLForRelatedNode = function(node, url)
 
 WebInspector.completeURL = function(baseURL, href)
 {
-    var match = baseURL.match(WebInspector.URLRegExp);
-    if (match) {
+    var parsedURL = baseURL.asParsedURL();
+    if (parsedURL) {
         var path = href;
         if (path.charAt(0) !== "/") {
-            var basePath = match[4] || "/";
+            var basePath = parsedURL.path;
             path = basePath.substring(0, basePath.lastIndexOf("/")) + "/" + path;
         } else if (path.length > 1 && path.charAt(1) === "/") {
             // href starts with "//" which is a full URL with the protocol dropped (use the baseURL protocol).
-            return match[1] + ":" + path;
+            return parsedURL.scheme + ":" + path;
         }
-        return match[1] + "://" + match[2] + (match[3] ? (":" + match[3]) : "") + path;
+        return parsedURL.scheme + "://" + parsedURL.host + (parsedURL.port ? (":" + parsedURL.port) : "") + path;
     }
     return null;
 }
diff --git a/WebCore/inspector/front-end/networkPanel.css b/WebCore/inspector/front-end/networkPanel.css
index cdea7fe..773fe99 100644
--- a/WebCore/inspector/front-end/networkPanel.css
+++ b/WebCore/inspector/front-end/networkPanel.css
@@ -1,383 +1,601 @@
-.network-larger-resources-status-bar-item .glyph {

-    -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);

-}

-

-.network.panel .data-grid {

-    border: none;

-    position: absolute;

-    top: 0;

-    left: 0;

-    right: 0;

-    bottom: 0;

-    font-size: 11px;

-}

-

-.network.panel .data-grid table.data {

-    -webkit-background-size: 1px 82px;

-    background-image: -webkit-gradient(linear, left top, left bottom, from(rgba(0, 0, 0, 0)), color-stop(0.5, rgba(0, 0, 0, 0)), color-stop(0.5, rgba(0, 0, 0, 0.05)), to(rgba(0, 0, 0, 0.05)));

-    font-size: 11px;

-}

-

-.network.panel .data-grid.small table.data {

-    -webkit-background-size: 1px 42px;

-}

-

-.network.panel .data-grid td {

-    line-height: 17px;

-    border-right: 1px solid rgb(210, 210, 210);

-    -webkit-user-select: none;

-}

-

-.network.panel .data-grid th {

-    border-bottom: 1px solid rgb(64%, 64%, 64%);

-    height: 22px;

-}

-

-.network.panel .data-grid th, .network.panel .data-grid th.sort-descending, .network.panel .data-grid th.sort-ascending {

-    background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));

-}

-

-.network.panel .data-grid .data-container {

-    top: 23px;

-}

-

-.network.panel .data-grid td.url-column {

-    font-weight: bold;

-}

-

-.network.panel .data-grid td.optional-column {

-    background-color: rgba(0, 0, 0, 0.07);

-}

-

-.network.panel .small .network-graph-side {

-    height: 14px;

-}

-

-.network.panel .data-grid th.sortable:active {

-    background-image: none;

-}

-

-.network-grid-subtitle {

-    font-weight: normal;

-    color: grey;

-}

-

-.network.panel .data-grid.small .network-grid-subtitle {

-    display: none;

-}

-

-/* Resource preview icons */

-

-.network.panel .data-grid .icon {

-    content: url(Images/resourcePlainIcon.png);

-}

-

-.network.panel .data-grid.small .icon {

-    content: url(Images/resourcePlainIconSmall.png);

-}

-

-.network.panel .network-category-scripts .icon {

-    content: url(Images/resourceJSIcon.png);

-}

-

-.network.panel .data-grid.small .network-category-scripts .icon {

-    content: url(Images/resourceDocumentIconSmall.png);

-}

-

-.network.panel .network-category-documents .icon {

-    content: url(Images/resourceDocumentIcon.png);

-}

-

-.network.panel .data-grid.small .network-category-documents .icon {

-    content: url(Images/resourceDocumentIconSmall.png);

-}

-

-.network.panel .network-category-stylesheets .icon {

-    content: url(Images/resourceCSSIcon.png);

-}

-

-.network.panel .data-grid.small .network-category-stylesheets .icon {

-    content: url(Images/resourceDocumentIconSmall.png);

-}

-

-.network.panel .network-category-images .icon {

-    position: relative;

-    background-image: url(Images/resourcePlainIcon.png);

-    background-repeat: no-repeat;

-    content: "";

-}

-

-.network.panel .network-category-images .icon {

-    position: relative;

-    background-image: url(Images/resourcePlainIcon.png);

-    background-repeat: no-repeat;

-    content: "";

-}

-

-.network.panel .data-grid.small .network-category-images .icon {

-    background-image: url(Images/resourcePlainIconSmall.png);

-    content: "";

-}

-

-.network.panel .data-grid .icon {

-    float: left;

-    width: 32px;

-    height: 32px;

-    margin-top: 1px;

-    margin-right: 3px;

-}

-

-.network.panel .data-grid.small .icon {

-    width: 16px;

-    height: 16px;

-}

-

-.network.panel .image-network-icon-preview {

-    position: absolute;

-    margin: auto;

-    top: 3px;

-    bottom: 4px;

-    left: 5px;

-    right: 5px;

-    max-width: 18px;

-    max-height: 21px;

-    min-width: 1px;

-    min-height: 1px;

-}

-

-.network.panel .data-grid.small .image-network-icon-preview {

-    top: 2px;

-    bottom: 1px;

-    left: 3px;

-    right: 3px;

-    max-width: 8px;

-    max-height: 11px;

-}

-

-/* Graph styles */

-

-.network-graph-side {

-    position: relative;

-    height: 36px;

-    padding: 0 5px;

-    white-space: nowrap;

-    margin-top: 1px;

-    border-top: 1px solid transparent;

-    overflow: hidden;

-}

-

-.network-graph-bar-area {

-    position: absolute;

-    top: 0;

-    bottom: 0;

-    right: 8px;

-    left: 9px;

-}

-

-.network-graph-label {

-    position: absolute;

-    top: 0;

-    bottom: 0;

-    margin: auto -7px;

-    height: 13px;

-    line-height: 13px;

-    font-size: 9px;

-    color: rgba(0, 0, 0, 0.75);

-    text-shadow: rgba(255, 255, 255, 0.25) 1px 0 0, rgba(255, 255, 255, 0.25) -1px 0 0, rgba(255, 255, 255, 0.333) 0 1px 0, rgba(255, 255, 255, 0.25) 0 -1px 0;

-    z-index: 150;

-    overflow: hidden;

-    text-align: center;

-    font-weight: bold;

-    opacity: 0;

-    -webkit-transition: opacity 250ms ease-in-out;

-}

-

-.network-graph-side:hover .network-graph-label {

-    opacity: 1;

-}

-

-.network-graph-label:empty {

-    display: none;

-}

-

-.network-graph-label.waiting {

-    margin-right: 5px;

-}

-

-.network-graph-label.waiting-right {

-    margin-left: 5px;

-}

-

-.network-graph-label.before {

-    color: rgba(0, 0, 0, 0.7);

-    text-shadow: none;

-    text-align: right;

-    margin-right: 2px;

-}

-

-.network-graph-label.before::after {

-    padding-left: 2px;

-    height: 6px;

-    content: url(Images/graphLabelCalloutLeft.png);

-}

-

-.network-graph-label.after {

-    color: rgba(0, 0, 0, 0.7);

-    text-shadow: none;

-    text-align: left;

-    margin-left: 2px;

-}

-

-.network-graph-label.after::before {

-    padding-right: 2px;

-    height: 6px;

-    content: url(Images/graphLabelCalloutRight.png);

-}

-

-.network-graph-bar {

-    position: absolute;

-    top: 0;

-    bottom: 0;

-    margin: auto -7px;

-    border-width: 6px 7px;

-    height: 13px;

-    min-width: 14px;

-    opacity: 0.65;

-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;

-}

-

-.network-graph-bar.waiting, .network-graph-bar.waiting-right {

-    opacity: 0.35;

-}

-

-/* Resource categories */

-

-

-.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;

-}

-

-.network-category-documents .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillBlue.png) 6 7 6 7;

-}

-

-.network-category-documents.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 6 7 6 7;

-}

-

-.network-category-stylesheets .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillGreen.png) 6 7 6 7;

-}

-

-.network-category-stylesheets.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 6 7 6 7;

-}

-

-.network-category-images .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillPurple.png) 6 7 6 7;

-}

-

-.network-category-images.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillPurple.png) 6 7 6 7;

-}

-

-.network-category-fonts .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillRed.png) 6 7 6 7;

-}

-

-.network-category-fonts.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillRed.png) 6 7 6 7;

-}

-

-.network-category-scripts .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillOrange.png) 6 7 6 7;

-}

-

-.network-category-scripts.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 6 7 6 7;

-}

-

-.network-category-xhr .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillYellow.png) 6 7 6 7;

-}

-

-.network-category-xhr.resource-cached .network-graph-bar {

-    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 6 7 6 7;

-}

-

-.network-category-websockets .network-graph-bar {

-    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;

-}

-

-.network-category-websockets.resource-cached .network-graph-bar {

-   -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;

-}

-

-

-/* Popover */

-

-.network-timing-row {

-    position: relative;

-    height: 12px;

-}

-

-.network-timing-bar {

-    position: absolute;

-    background-color: red;

-    border-left: 1px solid red;

-    opacity: 0.4;

-}

-

-.network-timing-bar-title {

-    position: absolute;

-}

-

-.network-dim-cell {

-    color: grey;

-}

-

-/* Dividers */

-

-.network-timeline-grid {

-    position: absolute;

-    top: 0;

-    bottom: 0;

-    left: 0;

-    right: 0;

-}

-

-.network-event-divider-padding {

-    position: absolute;

-    width: 8px;

-    top: 0;

-    bottom: 0;

-    pointer-events: auto;

-}

-

-.network-event-divider {

-    position: absolute;

-    width: 2px;

-    top: 0;

-    bottom: 0;

-    z-index: 300;

-}

-

-.network-red-divider {

-    background-color: rgba(255, 0, 0, 0.5);

-}

-

-.network-blue-divider {

-    background-color: rgba(0, 0, 255, 0.5);

-}

-

-.network.panel .resources-dividers-label-bar {

-    background-color: transparent;

-    border: none;

-    height: 23px;

-    pointer-events: none;

-}

-

-.network.panel .resources-divider-label {

-    top: 6px;

-    color: black;

-}

+.network-larger-resources-status-bar-item .glyph {
+    -webkit-mask-image: url(Images/largerResourcesButtonGlyph.png);
+}
+
+.network.panel .data-grid {
+    border: none;
+    position: absolute;
+    top: 0;
+    left: 0;
+    right: 0;
+    bottom: 0;
+    font-size: 11px;
+}
+
+.network.panel .data-grid table.data {
+    -webkit-background-size: 1px 82px;
+    background-image: -webkit-gradient(linear, left top, left bottom, from(rgba(0, 0, 0, 0)), color-stop(0.5, rgba(0, 0, 0, 0)), color-stop(0.5, rgba(0, 0, 0, 0.05)), to(rgba(0, 0, 0, 0.05)));
+    font-size: 11px;
+}
+
+.network.panel .data-grid.small table.data {
+    -webkit-background-size: 1px 42px;
+}
+
+.network.panel .data-grid td {
+    line-height: 17px;
+    border-right: 1px solid rgb(210, 210, 210);
+    -webkit-user-select: none;
+    vertical-align: middle;
+}
+
+.network.panel .data-grid th {
+    border-bottom: 1px solid rgb(64%, 64%, 64%);
+    height: 30px;
+    font-size: 11px;
+    font-weight: bold;
+}
+
+.network.panel .data-grid.small th {
+    height: 22px;
+}
+
+.network.panel .data-grid th, .network.panel .data-grid th.sort-descending, .network.panel .data-grid th.sort-ascending {
+    background: -webkit-gradient(linear, left top, left bottom, from(rgb(236, 236, 236)), to(rgb(217, 217, 217)));
+}
+
+.network.panel .data-grid .data-container {
+    top: 31px;
+}
+
+.network.panel .data-grid.small .data-container {
+    top: 23px;
+}
+
+.network.panel .data-grid select {
+    -webkit-appearance: none;
+    background-color: transparent;
+    border: none;
+    width: 100%;
+    font-size: 11px;
+    font-weight: bold;
+}
+
+.network.panel .data-grid tr.filler {
+    background-color: white;
+}
+
+.network.panel .data-grid td.name-column {
+    font-weight: bold;
+}
+
+.network.panel .data-grid td.method-column,
+.network.panel .data-grid td.status-column,
+.network.panel .data-grid td.type-column,
+.network.panel .data-grid td.size-column,
+.network.panel .data-grid td.time-column {
+    background-color: rgba(0, 0, 0, 0.07);
+}
+
+.network.panel .data-grid td.size-column,
+.network.panel .data-grid td.time-column {
+    text-align: right;
+}
+
+.network.panel .small .network-graph-side {
+    height: 14px;
+}
+
+.network.panel .data-grid th.sortable:active {
+    background-image: none;
+}
+
+.network-cell-subtitle {
+    font-weight: normal;
+    color: grey;
+}
+
+.network-header-subtitle {
+    color: grey;
+}
+
+.network.panel .data-grid.small .network-cell-subtitle,
+.network.panel .data-grid.small .network-header-subtitle
+{
+    display: none;
+}
+
+/* Resource preview icons */
+
+.network.panel .data-grid .icon {
+    content: url(Images/resourcePlainIcon.png);
+}
+
+.network.panel .data-grid.small .icon {
+    content: url(Images/resourcePlainIconSmall.png);
+}
+
+.network.panel .network-category-scripts .icon {
+    content: url(Images/resourceJSIcon.png);
+}
+
+.network.panel .data-grid.small .network-category-scripts .icon {
+    content: url(Images/resourceDocumentIconSmall.png);
+}
+
+.network.panel .network-category-documents .icon {
+    content: url(Images/resourceDocumentIcon.png);
+}
+
+.network.panel .data-grid.small .network-category-documents .icon {
+    content: url(Images/resourceDocumentIconSmall.png);
+}
+
+.network.panel .network-category-stylesheets .icon {
+    content: url(Images/resourceCSSIcon.png);
+}
+
+.network.panel .data-grid.small .network-category-stylesheets .icon {
+    content: url(Images/resourceDocumentIconSmall.png);
+}
+
+.network.panel .network-category-images .icon {
+    position: relative;
+    background-image: url(Images/resourcePlainIcon.png);
+    background-repeat: no-repeat;
+    content: "";
+}
+
+.network.panel .network-category-images .icon {
+    position: relative;
+    background-image: url(Images/resourcePlainIcon.png);
+    background-repeat: no-repeat;
+    content: "";
+}
+
+.network.panel .data-grid.small .network-category-images .icon {
+    background-image: url(Images/resourcePlainIconSmall.png);
+    content: "";
+}
+
+.network.panel .data-grid .icon {
+    float: left;
+    width: 32px;
+    height: 32px;
+    margin-top: 1px;
+    margin-right: 3px;
+}
+
+.network.panel .data-grid.small .icon {
+    width: 16px;
+    height: 16px;
+}
+
+.network.panel .image-network-icon-preview {
+    position: absolute;
+    margin: auto;
+    top: 3px;
+    bottom: 4px;
+    left: 5px;
+    right: 5px;
+    max-width: 18px;
+    max-height: 21px;
+    min-width: 1px;
+    min-height: 1px;
+}
+
+.network.panel .data-grid.small .image-network-icon-preview {
+    top: 2px;
+    bottom: 1px;
+    left: 3px;
+    right: 3px;
+    max-width: 8px;
+    max-height: 11px;
+}
+
+/* Graph styles */
+
+.network-graph-side {
+    position: relative;
+    height: 36px;
+    padding: 0 5px;
+    white-space: nowrap;
+    margin-top: 1px;
+    border-top: 1px solid transparent;
+    overflow: hidden;
+}
+
+.network-graph-bar-area {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    right: 8px;
+    left: 9px;
+}
+
+.network-graph-label {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    margin: auto -7px;
+    height: 13px;
+    line-height: 13px;
+    font-size: 9px;
+    color: rgba(0, 0, 0, 0.75);
+    text-shadow: rgba(255, 255, 255, 0.25) 1px 0 0, rgba(255, 255, 255, 0.25) -1px 0 0, rgba(255, 255, 255, 0.333) 0 1px 0, rgba(255, 255, 255, 0.25) 0 -1px 0;
+    z-index: 150;
+    overflow: hidden;
+    text-align: center;
+    font-weight: bold;
+    opacity: 0;
+    -webkit-transition: opacity 250ms ease-in-out;
+}
+
+.network-graph-side:hover .network-graph-label {
+    opacity: 1;
+}
+
+.network-graph-label:empty {
+    display: none;
+}
+
+.network-graph-label.waiting {
+    margin-right: 5px;
+}
+
+.network-graph-label.waiting-right {
+    margin-left: 5px;
+}
+
+.network-graph-label.before {
+    color: rgba(0, 0, 0, 0.7);
+    text-shadow: none;
+    text-align: right;
+    margin-right: 2px;
+}
+
+.network-graph-label.before::after {
+    padding-left: 2px;
+    height: 6px;
+    content: url(Images/graphLabelCalloutLeft.png);
+}
+
+.network-graph-label.after {
+    color: rgba(0, 0, 0, 0.7);
+    text-shadow: none;
+    text-align: left;
+    margin-left: 2px;
+}
+
+.network-graph-label.after::before {
+    padding-right: 2px;
+    height: 6px;
+    content: url(Images/graphLabelCalloutRight.png);
+}
+
+.network-graph-bar {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    margin: auto -7px;
+    border-width: 6px 7px;
+    height: 13px;
+    min-width: 14px;
+    opacity: 0.65;
+    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+}
+
+.network-graph-bar.waiting, .network-graph-bar.waiting-right {
+    opacity: 0.35;
+}
+
+/* Resource categories */
+
+
+.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+}
+
+.network-category-documents .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillBlue.png) 6 7 6 7;
+}
+
+.network-category-documents.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillBlue.png) 6 7 6 7;
+}
+
+.network-category-stylesheets .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillGreen.png) 6 7 6 7;
+}
+
+.network-category-stylesheets.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillGreen.png) 6 7 6 7;
+}
+
+.network-category-images .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillPurple.png) 6 7 6 7;
+}
+
+.network-category-images.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillPurple.png) 6 7 6 7;
+}
+
+.network-category-fonts .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillRed.png) 6 7 6 7;
+}
+
+.network-category-fonts.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillRed.png) 6 7 6 7;
+}
+
+.network-category-scripts .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillOrange.png) 6 7 6 7;
+}
+
+.network-category-scripts.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillOrange.png) 6 7 6 7;
+}
+
+.network-category-xhr .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillYellow.png) 6 7 6 7;
+}
+
+.network-category-xhr.resource-cached .network-graph-bar {
+    -webkit-border-image: url(Images/timelineHollowPillYellow.png) 6 7 6 7;
+}
+
+.network-category-websockets .network-graph-bar {
+    -webkit-border-image: url(Images/timelinePillGray.png) 6 7 6 7;
+}
+
+.network-category-websockets.resource-cached .network-graph-bar {
+   -webkit-border-image: url(Images/timelineHollowPillGray.png) 6 7 6 7;
+}
+
+
+/* Popover */
+
+.network-timing-row {
+    position: relative;
+    height: 12px;
+}
+
+.network-timing-bar {
+    position: absolute;
+    background-color: red;
+    border-left: 1px solid red;
+    opacity: 0.4;
+}
+
+.network-timing-bar-title {
+    position: absolute;
+}
+
+.network-dim-cell {
+    color: grey;
+}
+
+/* Dividers */
+
+.network-timeline-grid {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    pointer-events: none;
+}
+
+.network-event-divider-padding {
+    position: absolute;
+    width: 8px;
+    top: 0;
+    bottom: 0;
+    pointer-events: auto;
+}
+
+.network-event-divider {
+    position: absolute;
+    width: 2px;
+    top: 31px;
+    bottom: 0;
+    z-index: 300;
+}
+
+.network.panel .network-timeline-grid.small .network-event-divider {
+    top: 23px;
+}
+
+.network-red-divider {
+    background-color: rgba(255, 0, 0, 0.5);
+}
+
+.network-blue-divider {
+    background-color: rgba(0, 0, 255, 0.5);
+}
+
+.network.panel .resources-dividers-label-bar {
+    background-color: transparent;
+    border: none;
+    height: 30px;
+    pointer-events: none;
+}
+
+.network.panel .network-timeline-grid.small .resources-dividers-label-bar {
+    height: 23px;
+}
+
+.network.panel .resources-divider-label {
+    top: 0px;
+    margin-top: -4px;
+    color: black;
+}
+
+.network.panel .resources-dividers-label-bar .resources-divider {
+    top: 23px;
+}
+
+.network.panel .network-timeline-grid.small .resources-dividers-label-bar .resources-divider {
+    top: 15px;
+}
+
+.network.panel .resources-divider.first .resources-divider-label {
+    display: none;
+}
+
+.network.panel .resources-dividers-label-bar .resources-divider.first {
+    background-color: transparent;
+}
+
+/* Filters */
+#network-filter {
+    margin-top: 1px;
+}
+
+.data-grid table.data tr.revealed.network-category-documents, .data-grid table.data tr.revealed.network-category-stylesheets,
+.data-grid table.data tr.revealed.network-category-images, .data-grid table.data tr.revealed.network-category-scripts,
+.data-grid table.data tr.revealed.network-category-xhr, .data-grid table.data tr.revealed.network-category-fonts,
+.data-grid table.data tr.revealed.network-category-websockets, .data-grid table.data tr.revealed.network-category-other {
+    display: none;
+}
+
+.data-grid.filter-all table.data tr.revealed.network-category-documents, .data-grid.filter-documents table.data tr.revealed.network-category-documents,
+.data-grid.filter-all table.data tr.revealed.network-category-stylesheets, .data-grid.filter-stylesheets table.data tr.revealed.network-category-stylesheets,
+.data-grid.filter-all table.data tr.revealed.network-category-images, .data-grid.filter-images table.data tr.revealed.network-category-images,
+.data-grid.filter-all table.data tr.revealed.network-category-scripts, .data-grid.filter-scripts table.data tr.revealed.network-category-scripts,
+.data-grid.filter-all table.data tr.revealed.network-category-xhr, .data-grid.filter-xhr table.data tr.revealed.network-category-xhr,
+.data-grid.filter-all table.data tr.revealed.network-category-fonts, .data-grid.filter-fonts table.data tr.revealed.network-category-fonts,
+.data-grid.filter-all table.data tr.revealed.network-category-websockets, .data-grid.filter-websockets table.data tr.revealed.network-category-websockets,
+.data-grid.filter-all table.data tr.revealed.network-category-other, .data-grid.filter-other table.data tr.revealed.network-category-other {
+    display: table-row;
+}
+
+/* Summary */
+
+.network-summary-bar {
+    background-color: rgb(101, 111, 130);
+    color: white;
+    height: 20px;
+    font-size: 11px;
+    font-weight: bold;
+    padding-top: 1px;
+    padding-left: 10px;
+    z-index: 2000;
+    white-space: pre;
+}
+
+.network-summary-bar-bottom {
+    position: absolute;
+    bottom: 0;
+    left: 0;
+    right: 0;
+    padding-top: 3px;
+}
+
+.data-grid td .network-summary-bar {
+    white-space: pre;
+}
+
+.network.panel .data-grid td.network-summary {
+    padding: 0;
+}
+
+/* Viewer */
+
+.network.panel.viewing-resource .data-grid td,
+.network.panel.viewing-resource .data-grid th {
+    border-right: none;
+}
+
+.network.panel.viewing-resource .data-grid th.corner {
+    display: none;
+}
+
+#network-container {
+    position: absolute;
+    top: 0;
+    left: 0;
+    bottom: 0;
+    right: 0;
+    border-right: 0 none transparent;
+    overflow-y: auto;
+    overflow-x: hidden;
+}
+
+.network.panel.viewing-resource #network-container {
+    border-right: 1px solid rgb(163, 163, 163);
+}
+
+#network-views {
+    position: absolute;
+    background: rgb(203, 203, 203);
+    top: 0;
+    right: 0;
+    bottom: 0;
+    left: 0;
+}
+
+.network.panel .data-grid.full-grid-mode .viewer-column {
+    display: none;
+}
+
+.network.panel .data-grid.brief-grid-mode .viewer-column,
+.network.panel .data-grid.brief-grid-mode .method-column,
+.network.panel .data-grid.brief-grid-mode .status-column,
+.network.panel .data-grid.brief-grid-mode .type-column,
+.network.panel .data-grid.brief-grid-mode .size-column,
+.network.panel .data-grid.brief-grid-mode .time-column {
+    display: none;
+}
+
+.network.panel.viewing-resource .network-timeline-grid {
+    display: none;
+}
+
+.network.panel .data-grid.viewing-resource-mode .method-column,
+.network.panel .data-grid.viewing-resource-mode .status-column,
+.network.panel .data-grid.viewing-resource-mode .type-column,
+.network.panel .data-grid.viewing-resource-mode .size-column,
+.network.panel .data-grid.viewing-resource-mode .time-column,
+.network.panel .data-grid.viewing-resource-mode .timeline-column {
+    display: none;
+}
+
+.network.panel .network-sidebar {
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    right: 0;
+}
+
+.network.panel:not(.viewing-resource) .sidebar-resizer-vertical {
+    display: none;
+}
+
+.network.panel.viewing-resource .data-grid-resizer {
+    display: none;
+}
+
+.network.panel .scope-bar {
+    height: 23px;
+    padding-top: 5px;
+}
+
+.network.panel .resource-view.headers-visible .resource-view-content {
+    top: 23px;
+}
+
+.network.panel:not(.viewing-resource) .data-grid tr.selected {
+    background-color: transparent;
+    color: black;
+}
+
+.network.panel .resource-view .tabbed-pane-header {
+    height: 23px;
+    padding-top: 3px;
+}
+
+.network.panel.viewing-resource .data-grid .data-container {
+    padding-right: 0;
+}
diff --git a/WebCore/inspector/front-end/utilities.js b/WebCore/inspector/front-end/utilities.js
index 5e41da6..3aff6bb 100644
--- a/WebCore/inspector/front-end/utilities.js
+++ b/WebCore/inspector/front-end/utilities.js
@@ -26,19 +26,6 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-Object.properties = function(obj)
-{
-    var properties = [];
-    for (var prop in obj)
-        properties.push(prop);
-    return properties;
-}
-
-Object.sortedProperties = function(obj, sortFunc)
-{
-    return Object.properties(obj).sort(sortFunc);
-}
-
 Function.prototype.bind = function(thisObject)
 {
     var func = this;
@@ -393,6 +380,26 @@ String.prototype.hasSubstring = function(string, caseInsensitive)
     return this.match(new RegExp(string.escapeForRegExp(), "i"));
 }
 
+String.prototype.asParsedURL = function()
+{
+    // RegExp groups:
+    // 1 - scheme
+    // 2 - hostname
+    // 3 - ?port
+    // 4 - ?path
+    // 5 - ?fragment
+    var match = this.match(/^([^:]+):\/\/([^\/:]*)(?::([\d]+))?(?:(\/[^#]*)(?:#(.*))?)?$/i);
+    if (!match)
+        return null;
+    var result = {};
+    result.scheme = match[1].toLowerCase();
+    result.host = match[2];
+    result.port = match[3];
+    result.path = match[4] || "/";
+    result.fragment = match[5];
+    return result;
+}
+
 String.prototype.escapeCharacters = function(chars)
 {
     var foundChar = false;
@@ -990,6 +997,6 @@ function offerFileForDownload(contents)
     var builder = new BlobBuilder();
     builder.append(contents);
     var blob = builder.getBlob("application/octet-stream");
-    var url = window.createBlobURL(blob);
+    var url = window.createObjectURL(blob);
     window.open(url);
 }
diff --git a/WebCore/loader/Cache.cpp b/WebCore/loader/Cache.cpp
index 28c9f93..6ef65c0 100644
--- a/WebCore/loader/Cache.cpp
+++ b/WebCore/loader/Cache.cpp
@@ -34,6 +34,7 @@
 #include "FrameLoaderTypes.h"
 #include "FrameView.h"
 #include "Image.h"
+#include "Logging.h"
 #include "ResourceHandle.h"
 #include "SecurityOrigin.h"
 #include <stdio.h>
@@ -95,6 +96,8 @@ static CachedResource* createResource(CachedResource::Type type, const KURL& url
 
 CachedResource* Cache::requestResource(CachedResourceLoader* cachedResourceLoader, CachedResource::Type type, const KURL& url, const String& charset, bool requestIsPreload)
 {
+    LOG(ResourceLoading, "Cache::requestResource '%s', charset '%s', preload=%u", url.string().latin1().data(), charset.latin1().data(), requestIsPreload);
+
     // FIXME: Do we really need to special-case an empty URL?
     // Would it be better to just go on with the cache code and let it fail later?
     if (url.isEmpty())
@@ -103,16 +106,20 @@ CachedResource* Cache::requestResource(CachedResourceLoader* cachedResourceLoade
     // Look up the resource in our map.
     CachedResource* resource = resourceForURL(url.string());
 
-    if (resource && requestIsPreload && !resource->isPreloaded())
+    if (resource && requestIsPreload && !resource->isPreloaded()) {
+        LOG(ResourceLoading, "Cache::requestResource already has a preload request for this request, and it hasn't been preloaded yet");
         return 0;
+    }
 
     if (!cachedResourceLoader->doc()->securityOrigin()->canDisplay(url)) {
+        LOG(ResourceLoading, "...URL was not allowed by SecurityOrigin");
         if (!requestIsPreload)
             FrameLoader::reportLocalLoadFailed(cachedResourceLoader->doc()->frame(), url.string());
         return 0;
     }
     
     if (!resource) {
+        LOG(ResourceLoading, "CachedResource for '%s' wasn't found in cache. Creating it", url.string().latin1().data());
         // The resource does not exist. Create it.
         resource = createResource(type, url, charset);
         ASSERT(resource);
@@ -141,14 +148,18 @@ CachedResource* Cache::requestResource(CachedResourceLoader* cachedResourceLoade
         }
     }
 
-    if (resource->type() != type)
+    if (resource->type() != type) {
+        LOG(ResourceLoading, "Cache::requestResource cannot use cached resource for '%s' due to type mismatch", url.string().latin1().data());
         return 0;
+    }
 
     if (!disabled()) {
         // This will move the resource to the front of its LRU list and increase its access count.
         resourceAccessed(resource);
     }
 
+    LOG(ResourceLoading, "Cache::requestResource for '%s' returning resource %p\n", url.string().latin1().data(), resource);
+
     return resource;
 }
     
@@ -195,6 +206,7 @@ void Cache::revalidateResource(CachedResource* resource, CachedResourceLoader* c
     }
     const String& url = resource->url();
     CachedResource* newResource = createResource(resource->type(), KURL(ParsedURLString, url), resource->encoding());
+    LOG(ResourceLoading, "Resource %p created to revalidate %p", newResource, resource);
     newResource->setResourceToRevalidate(resource);
     evict(resource);
     m_resources.set(url, newResource);
@@ -231,6 +243,7 @@ void Cache::revalidationSucceeded(CachedResource* revalidatingResource, const Re
 
 void Cache::revalidationFailed(CachedResource* revalidatingResource)
 {
+    LOG(ResourceLoading, "Revalidation failed for %p", revalidatingResource);
     ASSERT(revalidatingResource->resourceToRevalidate());
     revalidatingResource->clearResourceToRevalidate();
 }
@@ -411,6 +424,9 @@ bool Cache::makeResourcePurgeable(CachedResource* resource)
     if (!resource->inCache())
         return false;
 
+    if (resource->isPurgeable())
+        return true;
+
     if (!resource->isSafeToMakePurgeable())
         return false;
 
@@ -424,6 +440,7 @@ bool Cache::makeResourcePurgeable(CachedResource* resource)
 
 void Cache::evict(CachedResource* resource)
 {
+    LOG(ResourceLoading, "Evicting resource %p for '%s' from cache", resource, resource->url().latin1().data());
     // The resource may have already been removed by someone other than our caller,
     // who needed a fresh copy for a reload. See <http://bugs.webkit.org/show_bug.cgi?id=12479#c6>.
     if (resource->inCache()) {
@@ -436,8 +453,9 @@ void Cache::evict(CachedResource* resource)
         removeFromLiveDecodedResourcesList(resource);
 
         // If the resource was purged, it means we had already decremented the size when we made the
-        // resource purgeable in makeResourcePurgeable().
-        if (!Cache::shouldMakeResourcePurgeableOnEviction() || !resource->wasPurged())
+        // resource purgeable in makeResourcePurgeable(). So adjust the size if we are evicting a
+        // resource that was not marked as purgeable.
+        if (!Cache::shouldMakeResourcePurgeableOnEviction() || !resource->isPurgeable())
             adjustSize(resource->hasClients(), -static_cast<int>(resource->size()));
     } else
         ASSERT(m_resources.get(resource->url()) != resource);
diff --git a/WebCore/loader/CachedResource.cpp b/WebCore/loader/CachedResource.cpp
index a6ff0ff..e519c29 100644
--- a/WebCore/loader/CachedResource.cpp
+++ b/WebCore/loader/CachedResource.cpp
@@ -33,6 +33,7 @@
 #include "Frame.h"
 #include "FrameLoaderClient.h"
 #include "KURL.h"
+#include "Logging.h"
 #include "PurgeableBuffer.h"
 #include "Request.h"
 #include "ResourceHandle.h"
@@ -350,6 +351,8 @@ void CachedResource::setResourceToRevalidate(CachedResource* resource)
     ASSERT(m_handlesToRevalidate.isEmpty());
     ASSERT(resource->type() == type());
 
+    LOG(ResourceLoading, "CachedResource %p setResourceToRevalidate %p", this, resource);
+
     // The following assert should be investigated whenever it occurs. Although it should never fire, it currently does in rare circumstances.
     // https://bugs.webkit.org/show_bug.cgi?id=28604.
     // So the code needs to be robust to this assert failing thus the "if (m_resourceToRevalidate->m_proxyResource == this)" in CachedResource::clearResourceToRevalidate.
@@ -378,6 +381,8 @@ void CachedResource::switchClientsToRevalidatedResource()
     ASSERT(m_resourceToRevalidate->inCache());
     ASSERT(!inCache());
 
+    LOG(ResourceLoading, "CachedResource %p switchClientsToRevalidatedResource %p", this, m_resourceToRevalidate);
+
     HashSet<CachedResourceHandleBase*>::iterator end = m_handlesToRevalidate.end();
     for (HashSet<CachedResourceHandleBase*>::iterator it = m_handlesToRevalidate.begin(); it != end; ++it) {
         CachedResourceHandleBase* handle = *it;
@@ -428,6 +433,25 @@ void CachedResource::updateResponseAfterRevalidation(const ResourceResponse& val
     }
 }
 
+void CachedResource::registerHandle(CachedResourceHandleBase* h)
+{
+    ++m_handleCount;
+    if (m_resourceToRevalidate)
+        m_handlesToRevalidate.add(h);
+}
+
+void CachedResource::unregisterHandle(CachedResourceHandleBase* h)
+{
+    ASSERT(m_handleCount > 0);
+    --m_handleCount;
+
+    if (m_resourceToRevalidate)
+         m_handlesToRevalidate.remove(h);
+
+    if (!m_handleCount)
+        deleteIfPossible();
+}
+
 bool CachedResource::canUseCacheValidator() const
 {
     if (m_loading || m_errorOccurred)
@@ -443,19 +467,33 @@ bool CachedResource::canUseCacheValidator() const
     
 bool CachedResource::mustRevalidate(CachePolicy cachePolicy) const
 {
-    if (m_errorOccurred)
+    if (m_errorOccurred) {
+        LOG(ResourceLoading, "CachedResource %p mustRevalidate because of m_errorOccurred\n", this);
         return true;
+    }
 
     if (m_loading)
         return false;
     
-    if (m_response.cacheControlContainsNoCache() || m_response.cacheControlContainsNoStore())
+    if (m_response.cacheControlContainsNoCache() || m_response.cacheControlContainsNoStore()) {
+        LOG(ResourceLoading, "CachedResource %p mustRevalidate because of m_response.cacheControlContainsNoCache() || m_response.cacheControlContainsNoStore()\n", this);
         return true;
+    }
 
-    if (cachePolicy == CachePolicyCache)
-        return m_response.cacheControlContainsMustRevalidate() && isExpired();
+    if (cachePolicy == CachePolicyCache) {
+        if (m_response.cacheControlContainsMustRevalidate() && isExpired()) {
+            LOG(ResourceLoading, "CachedResource %p mustRevalidate because of cachePolicy == CachePolicyCache and m_response.cacheControlContainsMustRevalidate() && isExpired()\n", this);
+            return true;
+        }
+        return false;
+    }
+
+    if (isExpired()) {
+        LOG(ResourceLoading, "CachedResource %p mustRevalidate because of isExpired()\n", this);
+        return true;
+    }
 
-    return isExpired();
+    return false;
 }
 
 bool CachedResource::isSafeToMakePurgeable() const
diff --git a/WebCore/loader/CachedResource.h b/WebCore/loader/CachedResource.h
index 958c8fd..078da57 100644
--- a/WebCore/loader/CachedResource.h
+++ b/WebCore/loader/CachedResource.h
@@ -67,9 +67,7 @@ public:
     };
 
     enum Status {
-        NotCached,    // this URL is not cached
         Unknown,      // let cache decide what to do with it
-        New,          // inserting new item
         Pending,      // only partially loaded
         Cached        // regular case
     };
@@ -188,8 +186,8 @@ public:
     void increasePreloadCount() { ++m_preloadCount; }
     void decreasePreloadCount() { ASSERT(m_preloadCount); --m_preloadCount; }
     
-    void registerHandle(CachedResourceHandleBase* h) { ++m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.add(h); }
-    void unregisterHandle(CachedResourceHandleBase* h) { ASSERT(m_handleCount > 0); --m_handleCount; if (m_resourceToRevalidate) m_handlesToRevalidate.remove(h); if (!m_handleCount) deleteIfPossible(); }
+    void registerHandle(CachedResourceHandleBase* h);
+    void unregisterHandle(CachedResourceHandleBase* h);
     
     bool canUseCacheValidator() const;
     bool mustRevalidate(CachePolicy) const;
@@ -256,7 +254,7 @@ private:
     bool m_loading : 1;
 
     unsigned m_type : 3; // Type
-    unsigned m_status : 3; // Status
+    unsigned m_status : 2; // Status
 
 #ifndef NDEBUG
     bool m_deleted;
diff --git a/WebCore/loader/CachedResourceLoader.cpp b/WebCore/loader/CachedResourceLoader.cpp
index e2edb3a..5925f67 100644
--- a/WebCore/loader/CachedResourceLoader.cpp
+++ b/WebCore/loader/CachedResourceLoader.cpp
@@ -44,7 +44,7 @@
 #include "PingLoader.h"
 #include "SecurityOrigin.h"
 #include "Settings.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #define PRELOAD_DEBUG 0
 
@@ -297,12 +297,8 @@ void CachedResourceLoader::printAccessDeniedMessage(const KURL& url) const
         return;
 
     String message = m_doc->url().isNull() ?
-        String::format("Unsafe attempt to load URL %s.",
-                       url.string().utf8().data()) :
-        String::format("Unsafe attempt to load URL %s from frame with URL %s. "
-                       "Domains, protocols and ports must match.\n",
-                       url.string().utf8().data(),
-                       m_doc->url().string().utf8().data());
+        makeString("Unsafe attempt to load URL ", url.string(), '.') :
+        makeString("Unsafe attempt to load URL ", url.string(), " from frame with URL ", m_doc->url().string(), ". Domains, protocols and ports must match.\n");
 
     // FIXME: provide a real line number and source URL.
     frame()->domWindow()->console()->addMessage(OtherMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String());
@@ -394,19 +390,9 @@ void CachedResourceLoader::setLoadInProgress(bool load)
 void CachedResourceLoader::checkCacheObjectStatus(CachedResource* resource)
 {
     // Return from the function for objects that we didn't load from the cache or if we don't have a frame.
-    if (!resource || !frame())
+    if (!resource || !frame() || resource->status() != CachedResource::Cached)
         return;
 
-    switch (resource->status()) {
-        case CachedResource::Cached:
-            break;
-        case CachedResource::NotCached:
-        case CachedResource::Unknown:
-        case CachedResource::New:
-        case CachedResource::Pending:
-            return;
-    }
-
     // FIXME: If the WebKit client changes or cancels the request, WebCore does not respect this and continues the load.
     frame()->loader()->loadedResourceFromMemoryCache(resource);
 }
diff --git a/WebCore/loader/DocumentLoader.cpp b/WebCore/loader/DocumentLoader.cpp
index 91316a5..2c113c3 100644
--- a/WebCore/loader/DocumentLoader.cpp
+++ b/WebCore/loader/DocumentLoader.cpp
@@ -224,6 +224,11 @@ void DocumentLoader::stopLoading(DatabasePolicy databasePolicy)
     // Always cancel multipart loaders
     cancelAll(m_multipartSubresourceLoaders);
 
+    // Appcache uses ResourceHandle directly, DocumentLoader doesn't count these loads.
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    m_applicationCacheHost->stopLoadingInFrame(m_frame);
+#endif
+
     if (!loading)
         return;
     
diff --git a/WebCore/loader/DocumentWriter.cpp b/WebCore/loader/DocumentWriter.cpp
index cd82d6e..5b03cd7 100644
--- a/WebCore/loader/DocumentWriter.cpp
+++ b/WebCore/loader/DocumentWriter.cpp
@@ -248,4 +248,9 @@ String DocumentWriter::deprecatedFrameEncoding() const
     return m_frame->loader()->url().isEmpty() ? m_encoding : encoding();
 }
 
+void DocumentWriter::setDocumentWasLoadedAsPartOfNavigation()
+{
+    m_frame->document()->parser()->setDocumentWasLoadedAsPartOfNavigation();
+}
+
 } // namespace WebCore
diff --git a/WebCore/loader/DocumentWriter.h b/WebCore/loader/DocumentWriter.h
index 531a632..5fb3dc1 100644
--- a/WebCore/loader/DocumentWriter.h
+++ b/WebCore/loader/DocumentWriter.h
@@ -71,6 +71,8 @@ public:
     TextResourceDecoder* createDecoderIfNeeded();
     void reportDataReceived();
 
+    void setDocumentWasLoadedAsPartOfNavigation();
+
 private:
     PassRefPtr<Document> createDocument(const KURL&);
 
diff --git a/WebCore/loader/FormSubmission.cpp b/WebCore/loader/FormSubmission.cpp
index 98a545e..f3f19d2 100644
--- a/WebCore/loader/FormSubmission.cpp
+++ b/WebCore/loader/FormSubmission.cpp
@@ -31,7 +31,6 @@
 #include "config.h"
 #include "FormSubmission.h"
 
-#include "CSSHelper.h"
 #include "DOMFormData.h"
 #include "Document.h"
 #include "Event.h"
@@ -45,6 +44,7 @@
 #include "HTMLFormElement.h"
 #include "HTMLInputElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "TextEncoding.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/RandomNumber.h>
@@ -85,7 +85,7 @@ static void appendMailtoPostFormDataToURL(KURL& url, const FormData& data, const
 void FormSubmission::Attributes::parseAction(const String& action)
 {
     // FIXME: Can we parse into a KURL?
-    m_action = deprecatedParseURL(action);
+    m_action = stripLeadingAndTrailingHTMLSpaces(action);
 }
 
 void FormSubmission::Attributes::parseEncodingType(const String& type)
diff --git a/WebCore/loader/FrameLoader.cpp b/WebCore/loader/FrameLoader.cpp
index 722f02f..03b6ab1 100644
--- a/WebCore/loader/FrameLoader.cpp
+++ b/WebCore/loader/FrameLoader.cpp
@@ -92,7 +92,6 @@
 #include "SchemeRegistry.h"
 #include "ScriptController.h"
 #include "ScriptSourceCode.h"
-#include "ScriptString.h"
 #include "SecurityOrigin.h"
 #include "SegmentedString.h"
 #include "SerializedScriptValue.h"
@@ -103,6 +102,7 @@
 #include <wtf/CurrentTime.h>
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #if ENABLE(SHARED_WORKERS)
 #include "SharedWorkerRepository.h"
@@ -261,7 +261,7 @@ void FrameLoader::setDefersLoading(bool defers)
         m_policyDocumentLoader->setDefersLoading(defers);
 
     if (!defers) {
-        m_frame->redirectScheduler()->startTimer();
+        m_frame->navigationScheduler()->startTimer();
         startCheckCompleteTimer();
     }
 }
@@ -271,27 +271,27 @@ bool FrameLoader::canHandleRequest(const ResourceRequest& request)
     return m_client->canHandleRequest(request);
 }
 
-void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool userGesture, bool refresh)
+void FrameLoader::changeLocation(const KURL& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool refresh)
 {
     RefPtr<Frame> protect(m_frame);
 
     ResourceRequest request(url, referrer, refresh ? ReloadIgnoringCacheData : UseProtocolCachePolicy);
     
-    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, userGesture, SendReferrer, ReplaceDocumentIfJavaScriptURL);
+    urlSelected(request, "_self", 0, lockHistory, lockBackForwardList, SendReferrer, ReplaceDocumentIfJavaScriptURL);
 }
 
-void FrameLoader::urlSelected(const KURL& url, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy referrerPolicy)
+void FrameLoader::urlSelected(const KURL& url, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, ReferrerPolicy referrerPolicy)
 {
-    urlSelected(ResourceRequest(url), passedTarget, triggeringEvent, lockHistory, lockBackForwardList, userGesture, referrerPolicy, DoNotReplaceDocumentIfJavaScriptURL);
+    urlSelected(ResourceRequest(url), passedTarget, triggeringEvent, lockHistory, lockBackForwardList, referrerPolicy, DoNotReplaceDocumentIfJavaScriptURL);
 }
 
 // The shouldReplaceDocumentIfJavaScriptURL parameter will go away when the FIXME to eliminate the
 // corresponding parameter from ScriptController::executeIfJavaScriptURL() is addressed.
-void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy referrerPolicy, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)
+void FrameLoader::urlSelected(const ResourceRequest& request, const String& passedTarget, PassRefPtr<Event> triggeringEvent, bool lockHistory, bool lockBackForwardList, ReferrerPolicy referrerPolicy, ShouldReplaceDocumentIfJavaScriptURL shouldReplaceDocumentIfJavaScriptURL)
 {
     ASSERT(!m_suppressOpenerInNewFrame);
 
-    if (m_frame->script()->executeIfJavaScriptURL(request.url(), userGesture, shouldReplaceDocumentIfJavaScriptURL))
+    if (m_frame->script()->executeIfJavaScriptURL(request.url(), shouldReplaceDocumentIfJavaScriptURL))
         return;
 
     String target = passedTarget;
@@ -331,7 +331,7 @@ void FrameLoader::submitForm(PassRefPtr<FormSubmission> submission)
 
     if (protocolIsJavaScript(submission->action())) {
         m_isExecutingJavaScriptFormAction = true;
-        m_frame->script()->executeIfJavaScriptURL(submission->action(), false, DoNotReplaceDocumentIfJavaScriptURL);
+        m_frame->script()->executeIfJavaScriptURL(submission->action(), DoNotReplaceDocumentIfJavaScriptURL);
         m_isExecutingJavaScriptFormAction = false;
         return;
     }
@@ -372,7 +372,7 @@ void FrameLoader::submitForm(PassRefPtr<FormSubmission> submission)
     submission->setReferrer(m_outgoingReferrer);
     submission->setOrigin(outgoingOrigin());
 
-    targetFrame->redirectScheduler()->scheduleFormSubmission(submission);
+    targetFrame->navigationScheduler()->scheduleFormSubmission(submission);
 }
 
 void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolicy databasePolicy)
@@ -448,7 +448,7 @@ void FrameLoader::stopLoading(UnloadEventPolicy unloadEventPolicy, DatabasePolic
     }
 
     // FIXME: This will cancel redirection timer, which really needs to be restarted when restoring the frame from b/f cache.
-    m_frame->redirectScheduler()->cancel();
+    m_frame->navigationScheduler()->cancel();
 }
 
 void FrameLoader::stop()
@@ -503,13 +503,13 @@ KURL FrameLoader::iconURL()
 
 bool FrameLoader::didOpenURL(const KURL& url)
 {
-    if (m_frame->redirectScheduler()->redirectScheduledDuringLoad()) {
+    if (m_frame->navigationScheduler()->redirectScheduledDuringLoad()) {
         // A redirect was scheduled before the document was created.
         // This can happen when one frame changes another frame's location.
         return false;
     }
 
-    m_frame->redirectScheduler()->cancel();
+    m_frame->navigationScheduler()->cancel();
     m_frame->editor()->clearLastEditCommand();
 
     m_isComplete = false;
@@ -548,7 +548,7 @@ void FrameLoader::didExplicitOpen()
     // from a subsequent window.document.open / window.document.write call. 
     // Canceling redirection here works for all cases because document.open 
     // implicitly precedes document.write.
-    m_frame->redirectScheduler()->cancel(); 
+    m_frame->navigationScheduler()->cancel(); 
     if (m_frame->document()->url() != blankURL())
         m_URL = m_frame->document()->url();
 }
@@ -556,7 +556,7 @@ void FrameLoader::didExplicitOpen()
 
 void FrameLoader::cancelAndClear()
 {
-    m_frame->redirectScheduler()->cancel();
+    m_frame->navigationScheduler()->cancel();
 
     if (!m_isComplete)
         closeURL();
@@ -605,7 +605,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
     if (clearScriptObjects)
         m_frame->script()->clearScriptObjects();
 
-    m_frame->redirectScheduler()->clear();
+    m_frame->navigationScheduler()->clear();
 
     m_checkTimer.stop();
     m_shouldCallCheckCompleted = false;
@@ -618,6 +618,7 @@ void FrameLoader::clear(bool clearWindowProperties, bool clearScriptObjects, boo
 void FrameLoader::receivedFirstData()
 {
     writer()->begin(m_workingURL, false);
+    writer()->setDocumentWasLoadedAsPartOfNavigation();
 
     dispatchDidCommitLoad();
     dispatchDidClearWindowObjectsInAllWorlds();
@@ -645,7 +646,7 @@ void FrameLoader::receivedFirstData()
     else
         url = m_frame->document()->completeURL(url).string();
 
-    m_frame->redirectScheduler()->scheduleRedirect(delay, url);
+    m_frame->navigationScheduler()->scheduleRedirect(delay, url);
 }
 
 void FrameLoader::setURL(const KURL& url)
@@ -664,6 +665,7 @@ void FrameLoader::didBeginDocument(bool dispatch)
     m_isComplete = false;
     m_didCallImplicitClose = false;
     m_isLoadingMainResource = true;
+    m_frame->document()->setReadyState(Document::Loading);
 
     if (m_pendingStateObject) {
         m_frame->document()->statePopped(m_pendingStateObject.get());
@@ -857,7 +859,7 @@ void FrameLoader::checkCompleted()
     RefPtr<Frame> protect(m_frame);
     checkCallImplicitClose(); // if we didn't do it before
 
-    m_frame->redirectScheduler()->startTimer();
+    m_frame->navigationScheduler()->startTimer();
 
     completed();
     if (m_frame->page())
@@ -1029,8 +1031,7 @@ void FrameLoader::checkIfDisplayInsecureContent(SecurityOrigin* context, const K
     if (!isMixedContent(context, url))
         return;
 
-    String message = String::format("The page at %s displayed insecure content from %s.\n",
-        m_URL.string().utf8().data(), url.string().utf8().data());
+    String message = makeString("The page at ", m_URL.string(), " displayed insecure content from ", url.string(), ".\n");
     m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
 
     m_client->didDisplayInsecureContent();
@@ -1041,8 +1042,7 @@ void FrameLoader::checkIfRunInsecureContent(SecurityOrigin* context, const KURL&
     if (!isMixedContent(context, url))
         return;
 
-    String message = String::format("The page at %s ran insecure content from %s.\n",
-        m_URL.string().utf8().data(), url.string().utf8().data());
+    String message = makeString("The page at ", m_URL.string(), " ran insecure content from ", url.string(), ".\n");
     m_frame->domWindow()->console()->addMessage(HTMLMessageSource, LogMessageType, WarningMessageLevel, message, 1, String());
 
     m_client->didRunInsecureContent(context);
@@ -1084,7 +1084,7 @@ void FrameLoader::provisionalLoadStarted()
 #endif
     if (m_stateMachine.firstLayoutDone())
         m_stateMachine.advanceTo(FrameLoaderStateMachine::CommittedFirstRealLoad);
-    m_frame->redirectScheduler()->cancel(true);
+    m_frame->navigationScheduler()->cancel(true);
     m_client->provisionalLoadStarted();
 }
 
@@ -1212,7 +1212,7 @@ void FrameLoader::completed()
     RefPtr<Frame> protect(m_frame);
 
     for (Frame* descendant = m_frame->tree()->traverseNext(m_frame); descendant; descendant = descendant->tree()->traverseNext(m_frame))
-        descendant->redirectScheduler()->startTimer();
+        descendant->navigationScheduler()->startTimer();
     
     if (Frame* parent = m_frame->tree()->parent())
         parent->loader()->checkCompleted();
@@ -1683,8 +1683,8 @@ bool FrameLoader::shouldAllowNavigation(Frame* targetFrame) const
     if (settings && !settings->privateBrowsingEnabled()) {
         Document* targetDocument = targetFrame->document();
         // FIXME: this error message should contain more specifics of why the navigation change is not allowed.
-        String message = String::format("Unsafe JavaScript attempt to initiate a navigation change for frame with URL %s from frame with URL %s.\n",
-            targetDocument->url().string().utf8().data(), activeDocument->url().string().utf8().data());
+        String message = makeString("Unsafe JavaScript attempt to initiate a navigation change for frame with URL ",
+                                    targetDocument->url().string(), " from frame with URL ", activeDocument->url().string(), ".\n");
 
         // FIXME: should we print to the console of the activeFrame as well?
         targetFrame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 1, String());
@@ -2098,7 +2098,7 @@ void FrameLoader::prepareForCachedPageRestore()
     ASSERT(m_frame->page());
     ASSERT(m_frame->page()->mainFrame() == m_frame);
 
-    m_frame->redirectScheduler()->cancel();
+    m_frame->navigationScheduler()->cancel();
 
     // We still have to close the previous part page.
     closeURL();
@@ -3258,12 +3258,8 @@ void FrameLoader::navigateToDifferentDocument(HistoryItem* item, FrameLoadType l
 // Loads content into this frame, as specified by history item
 void FrameLoader::loadItem(HistoryItem* item, FrameLoadType loadType)
 {
-    // We do same-document navigation in the following cases:
-    // - The HistoryItem corresponds to the same document (or documents in the case of frames).
-    // - The HistoryItem is not the same as the current item.
     HistoryItem* currentItem = history()->currentItem();
-    bool sameDocumentNavigation = currentItem && item != currentItem
-        && item->hasSameDocuments(currentItem);
+    bool sameDocumentNavigation = currentItem && item->shouldDoSameDocumentNavigationTo(currentItem);
 
 #if ENABLE(WML)
     // All WML decks should go through the real load mechanism, not the scroll-to-anchor code
diff --git a/WebCore/loader/FrameLoader.h b/WebCore/loader/FrameLoader.h
index 965e57f..63730bf 100644
--- a/WebCore/loader/FrameLoader.h
+++ b/WebCore/loader/FrameLoader.h
@@ -36,9 +36,9 @@
 #include "FrameLoaderStateMachine.h"
 #include "FrameLoaderTypes.h"
 #include "HistoryController.h"
+#include "NavigationScheduler.h"
 #include "PolicyCallback.h"
 #include "PolicyChecker.h"
-#include "RedirectScheduler.h"
 #include "ResourceLoadNotifier.h"
 #include "ResourceRequest.h"
 #include "SubframeLoader.h"
@@ -75,7 +75,6 @@ class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
 class ScriptSourceCode;
-class ScriptString;
 class ScriptValue;
 class SecurityOrigin;
 class SerializedScriptValue;
@@ -216,8 +215,8 @@ public:
 
     void setDefersLoading(bool);
 
-    void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false, bool refresh = false);
-    void urlSelected(const KURL&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy);
+    void changeLocation(const KURL&, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool refresh = false);
+    void urlSelected(const KURL&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, ReferrerPolicy);
 
     void submitForm(PassRefPtr<FormSubmission>);
 
@@ -395,7 +394,7 @@ private:
 
     void dispatchDidCommitLoad();
 
-    void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, bool userGesture, ReferrerPolicy, ShouldReplaceDocumentIfJavaScriptURL);
+    void urlSelected(const ResourceRequest&, const String& target, PassRefPtr<Event>, bool lockHistory, bool lockBackForwardList, ReferrerPolicy, ShouldReplaceDocumentIfJavaScriptURL);
 
     void loadWithDocumentLoader(DocumentLoader*, FrameLoadType, PassRefPtr<FormState>); // Calls continueLoadAfterNavigationPolicy
     void load(DocumentLoader*);                                                         // Calls loadWithDocumentLoader   
diff --git a/WebCore/loader/FrameLoaderClient.h b/WebCore/loader/FrameLoaderClient.h
index 803eb11..1855d5a 100644
--- a/WebCore/loader/FrameLoaderClient.h
+++ b/WebCore/loader/FrameLoaderClient.h
@@ -73,7 +73,6 @@ namespace WebCore {
     class ResourceLoader;
     class ResourceRequest;
     class ResourceResponse;
-    class ScriptString;
     class SecurityOrigin;
     class SharedBuffer;
     class SubstituteData;
diff --git a/WebCore/loader/ImageLoader.cpp b/WebCore/loader/ImageLoader.cpp
index f6bc8d0..94a21a4 100644
--- a/WebCore/loader/ImageLoader.cpp
+++ b/WebCore/loader/ImageLoader.cpp
@@ -22,7 +22,6 @@
 #include "config.h"
 #include "ImageLoader.h"
 
-#include "CSSHelper.h"
 #include "CachedImage.h"
 #include "CachedResourceLoader.h"
 #include "Document.h"
diff --git a/WebCore/loader/MainResourceLoader.cpp b/WebCore/loader/MainResourceLoader.cpp
index d976841..af30a11 100644
--- a/WebCore/loader/MainResourceLoader.cpp
+++ b/WebCore/loader/MainResourceLoader.cpp
@@ -123,10 +123,17 @@ void MainResourceLoader::callContinueAfterNavigationPolicy(void* argument, const
     static_cast<MainResourceLoader*>(argument)->continueAfterNavigationPolicy(request, shouldContinue);
 }
 
-void MainResourceLoader::continueAfterNavigationPolicy(const ResourceRequest&, bool shouldContinue)
+void MainResourceLoader::continueAfterNavigationPolicy(const ResourceRequest& request, bool shouldContinue)
 {
     if (!shouldContinue)
         stopLoadingForPolicyChange();
+    else if (m_substituteData.isValid()) {
+        // A redirect resulted in loading substitute data.
+        ASSERT(documentLoader()->timing()->redirectCount);
+        handle()->cancel();
+        handleDataLoadSoon(request);
+    }
+
     deref(); // balances ref in willSendRequest
 }
 
@@ -192,6 +199,15 @@ void MainResourceLoader::willSendRequest(ResourceRequest& newRequest, const Reso
     if (top != m_frame)
         frameLoader()->checkIfDisplayInsecureContent(top->document()->securityOrigin(), newRequest.url());
 
+#if ENABLE(OFFLINE_WEB_APPLICATIONS)
+    if (!redirectResponse.isNull()) {
+        // We checked application cache for initial URL, now we need to check it for redirected one.
+        ASSERT(documentLoader()->applicationCacheHost()->status() == ApplicationCacheHost::UNCACHED);
+        ASSERT(!m_substituteData.isValid());
+        documentLoader()->applicationCacheHost()->maybeLoadMainResource(newRequest, m_substituteData);
+    }
+#endif
+
     // FIXME: Ideally we'd stop the I/O until we hear back from the navigation policy delegate
     // listener. But there's no way to do that in practice. So instead we cancel later if the
     // listener tells us to. In practice that means the navigation policy needs to be decided
@@ -437,7 +453,7 @@ void MainResourceLoader::didFinishLoading(double finishTime)
 #endif
 
     ASSERT(!documentLoader()->timing()->responseEnd);
-    documentLoader()->timing()->responseEnd = m_timeOfLastDataReceived;
+    documentLoader()->timing()->responseEnd = finishTime ? finishTime : m_timeOfLastDataReceived;
     frameLoader()->finishedLoading();
     ResourceLoader::didFinishLoading(finishTime);
     
@@ -500,7 +516,7 @@ void MainResourceLoader::startDataLoadTimer()
 #endif
 }
 
-void MainResourceLoader::handleDataLoadSoon(ResourceRequest& r)
+void MainResourceLoader::handleDataLoadSoon(const ResourceRequest& r)
 {
     m_initialRequest = r;
     
diff --git a/WebCore/loader/MainResourceLoader.h b/WebCore/loader/MainResourceLoader.h
index 35eab2f..1620f7a 100644
--- a/WebCore/loader/MainResourceLoader.h
+++ b/WebCore/loader/MainResourceLoader.h
@@ -79,7 +79,7 @@ namespace WebCore {
         bool loadNow(ResourceRequest&);
 
         void handleEmptyLoad(const KURL&, bool forURLScheme);
-        void handleDataLoadSoon(ResourceRequest& r);
+        void handleDataLoadSoon(const ResourceRequest& r);
 
         void startDataLoadTimer();
         void handleDataLoad(ResourceRequest&);
diff --git a/WebCore/loader/RedirectScheduler.cpp b/WebCore/loader/NavigationScheduler.cpp
index ce41cde..98f21fe 100644
--- a/WebCore/loader/RedirectScheduler.cpp
+++ b/WebCore/loader/NavigationScheduler.cpp
@@ -30,7 +30,7 @@
  */
 
 #include "config.h"
-#include "RedirectScheduler.h"
+#include "NavigationScheduler.h"
 
 #include "BackForwardList.h"
 #include "DOMWindow.h"
@@ -53,13 +53,13 @@ namespace WebCore {
 
 class ScheduledNavigation : public Noncopyable {
 public:
-    ScheduledNavigation(double delay, bool lockHistory, bool lockBackForwardList, bool wasDuringLoad, bool isLocationChange, bool wasUserGesture)
+    ScheduledNavigation(double delay, bool lockHistory, bool lockBackForwardList, bool wasDuringLoad, bool isLocationChange)
         : m_delay(delay)
         , m_lockHistory(lockHistory)
         , m_lockBackForwardList(lockBackForwardList)
         , m_wasDuringLoad(wasDuringLoad)
         , m_isLocationChange(isLocationChange)
-        , m_wasUserGesture(wasUserGesture)
+        , m_wasUserGesture(ScriptController::processingUserGesture())
     {
     }
     virtual ~ScheduledNavigation() { }
@@ -67,7 +67,7 @@ public:
     virtual void fire(Frame*) = 0;
 
     virtual bool shouldStartTimer(Frame*) { return true; }
-    virtual void didStartTimer(Frame*, Timer<RedirectScheduler>*) { }
+    virtual void didStartTimer(Frame*, Timer<NavigationScheduler>*) { }
     virtual void didStopTimer(Frame*, bool /* newLoadInProgress */) { }
 
     double delay() const { return m_delay; }
@@ -88,8 +88,8 @@ private:
 
 class ScheduledURLNavigation : public ScheduledNavigation {
 public:
-    ScheduledURLNavigation(double delay, const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool duringLoad, bool isLocationChange)
-        : ScheduledNavigation(delay, lockHistory, lockBackForwardList, duringLoad, isLocationChange, wasUserGesture)
+    ScheduledURLNavigation(double delay, const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool duringLoad, bool isLocationChange)
+        : ScheduledNavigation(delay, lockHistory, lockBackForwardList, duringLoad, isLocationChange)
         , m_url(url)
         , m_referrer(referrer)
         , m_haveToldClient(false)
@@ -98,10 +98,11 @@ public:
 
     virtual void fire(Frame* frame)
     {
-        frame->loader()->changeLocation(KURL(ParsedURLString, m_url), m_referrer, lockHistory(), lockBackForwardList(), wasUserGesture(), false);
+        UserGestureIndicator gestureIndicator(wasUserGesture() ? DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
+        frame->loader()->changeLocation(KURL(ParsedURLString, m_url), m_referrer, lockHistory(), lockBackForwardList(), false);
     }
 
-    virtual void didStartTimer(Frame* frame, Timer<RedirectScheduler>* timer)
+    virtual void didStartTimer(Frame* frame, Timer<NavigationScheduler>* timer)
     {
         if (m_haveToldClient)
             return;
@@ -127,32 +128,41 @@ private:
 
 class ScheduledRedirect : public ScheduledURLNavigation {
 public:
-    ScheduledRedirect(double delay, const String& url, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
-        : ScheduledURLNavigation(delay, url, String(), lockHistory, lockBackForwardList, wasUserGesture, false, false) { }
+    ScheduledRedirect(double delay, const String& url, bool lockHistory, bool lockBackForwardList)
+        : ScheduledURLNavigation(delay, url, String(), lockHistory, lockBackForwardList, false, false)
+    {
+    }
 
     virtual bool shouldStartTimer(Frame* frame) { return frame->loader()->allAncestorsAreComplete(); }
 };
 
 class ScheduledLocationChange : public ScheduledURLNavigation {
 public:
-    ScheduledLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture, bool duringLoad)
-        : ScheduledURLNavigation(0.0, url, referrer, lockHistory, lockBackForwardList, wasUserGesture, duringLoad, true) { }
+    ScheduledLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool duringLoad)
+        : ScheduledURLNavigation(0.0, url, referrer, lockHistory, lockBackForwardList, duringLoad, true) { }
 };
 
 class ScheduledRefresh : public ScheduledURLNavigation {
 public:
-    ScheduledRefresh(const String& url, const String& referrer, bool wasUserGesture)
-        : ScheduledURLNavigation(0.0, url, referrer, true, true, wasUserGesture, false, true) { }
+    ScheduledRefresh(const String& url, const String& referrer)
+        : ScheduledURLNavigation(0.0, url, referrer, true, true, false, true)
+    {
+    }
 
     virtual void fire(Frame* frame)
     {
-        frame->loader()->changeLocation(KURL(ParsedURLString, url()), referrer(), lockHistory(), lockBackForwardList(), wasUserGesture(), true);
+        UserGestureIndicator gestureIndicator(wasUserGesture() ? DefinitelyProcessingUserGesture : DefinitelyNotProcessingUserGesture);
+        frame->loader()->changeLocation(KURL(ParsedURLString, url()), referrer(), lockHistory(), lockBackForwardList(), true);
     }
 };
 
 class ScheduledHistoryNavigation : public ScheduledNavigation {
 public:
-    explicit ScheduledHistoryNavigation(int historySteps, bool wasUserGesture) : ScheduledNavigation(0, false, false, false, true, wasUserGesture), m_historySteps(historySteps) { }
+    explicit ScheduledHistoryNavigation(int historySteps)
+        : ScheduledNavigation(0, false, false, false, true)
+        , m_historySteps(historySteps)
+    {
+    }
 
     virtual void fire(Frame* frame)
     {
@@ -162,7 +172,7 @@ public:
         if (!m_historySteps) {
             // Special case for go(0) from a frame -> reload only the frame
             // To follow Firefox and IE's behavior, history reload can only navigate the self frame.
-            loader->urlSelected(loader->url(), "_self", 0, lockHistory(), lockBackForwardList(), wasUserGesture(), SendReferrer);
+            loader->urlSelected(loader->url(), "_self", 0, lockHistory(), lockBackForwardList(), SendReferrer);
             return;
         }
         // go(i!=0) from a frame navigates into the history of the frame only,
@@ -176,8 +186,8 @@ private:
 
 class ScheduledFormSubmission : public ScheduledNavigation {
 public:
-    ScheduledFormSubmission(PassRefPtr<FormSubmission> submission, bool lockBackForwardList, bool duringLoad, bool wasUserGesture)
-        : ScheduledNavigation(0, submission->lockHistory(), lockBackForwardList, duringLoad, true, wasUserGesture)
+    ScheduledFormSubmission(PassRefPtr<FormSubmission> submission, bool lockBackForwardList, bool duringLoad)
+        : ScheduledNavigation(0, submission->lockHistory(), lockBackForwardList, duringLoad, true)
         , m_submission(submission)
         , m_haveToldClient(false)
     {
@@ -199,7 +209,7 @@ public:
         frame->loader()->loadFrameRequest(frameRequest, lockHistory(), lockBackForwardList(), m_submission->event(), m_submission->state(), SendReferrer);
     }
     
-    virtual void didStartTimer(Frame* frame, Timer<RedirectScheduler>* timer)
+    virtual void didStartTimer(Frame* frame, Timer<NavigationScheduler>* timer)
     {
         if (m_haveToldClient)
             return;
@@ -219,33 +229,33 @@ private:
     bool m_haveToldClient;
 };
 
-RedirectScheduler::RedirectScheduler(Frame* frame)
+NavigationScheduler::NavigationScheduler(Frame* frame)
     : m_frame(frame)
-    , m_timer(this, &RedirectScheduler::timerFired)
+    , m_timer(this, &NavigationScheduler::timerFired)
 {
 }
 
-RedirectScheduler::~RedirectScheduler()
+NavigationScheduler::~NavigationScheduler()
 {
 }
 
-bool RedirectScheduler::redirectScheduledDuringLoad()
+bool NavigationScheduler::redirectScheduledDuringLoad()
 {
     return m_redirect && m_redirect->wasDuringLoad();
 }
 
-bool RedirectScheduler::locationChangePending()
+bool NavigationScheduler::locationChangePending()
 {
     return m_redirect && m_redirect->isLocationChange();
 }
 
-void RedirectScheduler::clear()
+void NavigationScheduler::clear()
 {
     m_timer.stop();
     m_redirect.clear();
 }
 
-void RedirectScheduler::scheduleRedirect(double delay, const String& url)
+void NavigationScheduler::scheduleRedirect(double delay, const String& url)
 {
     if (!m_frame->page())
         return;
@@ -256,14 +266,14 @@ void RedirectScheduler::scheduleRedirect(double delay, const String& url)
 
     // We want a new back/forward list item if the refresh timeout is > 1 second.
     if (!m_redirect || delay <= m_redirect->delay())
-        schedule(adoptPtr(new ScheduledRedirect(delay, url, true, delay <= 1, false)));
+        schedule(adoptPtr(new ScheduledRedirect(delay, url, true, delay <= 1)));
 }
 
-bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame, bool wasUserGesture)
+bool NavigationScheduler::mustLockBackForwardList(Frame* targetFrame)
 {
     // Non-user navigation before the page has finished firing onload should not create a new back/forward item.
     // See https://webkit.org/b/42861 for the original motivation for this.    
-    if (!wasUserGesture && targetFrame->loader()->documentLoader() && !targetFrame->loader()->documentLoader()->wasOnloadHandled())
+    if (!ScriptController::processingUserGesture() && targetFrame->loader()->documentLoader() && !targetFrame->loader()->documentLoader()->wasOnloadHandled())
         return true;
     
     // Navigation of a subframe during loading of an ancestor frame does not create a new back/forward item.
@@ -277,14 +287,14 @@ bool RedirectScheduler::mustLockBackForwardList(Frame* targetFrame, bool wasUser
     return false;
 }
 
-void RedirectScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList, bool wasUserGesture)
+void NavigationScheduler::scheduleLocationChange(const String& url, const String& referrer, bool lockHistory, bool lockBackForwardList)
 {
     if (!m_frame->page())
         return;
     if (url.isEmpty())
         return;
 
-    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame, wasUserGesture);
+    lockBackForwardList = lockBackForwardList || mustLockBackForwardList(m_frame);
 
     FrameLoader* loader = m_frame->loader();
     
@@ -292,7 +302,7 @@ void RedirectScheduler::scheduleLocationChange(const String& url, const String&
     // fragment part, we don't need to schedule the location change.
     KURL parsedURL(ParsedURLString, url);
     if (parsedURL.hasFragmentIdentifier() && equalIgnoringFragmentIdentifier(loader->url(), parsedURL)) {
-        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList, wasUserGesture);
+        loader->changeLocation(loader->completeURL(url), referrer, lockHistory, lockBackForwardList);
         return;
     }
 
@@ -300,10 +310,10 @@ void RedirectScheduler::scheduleLocationChange(const String& url, const String&
     // This may happen when a frame changes the location of another frame.
     bool duringLoad = !loader->stateMachine()->committedFirstRealDocumentLoad();
 
-    schedule(adoptPtr(new ScheduledLocationChange(url, referrer, lockHistory, lockBackForwardList, wasUserGesture, duringLoad)));
+    schedule(adoptPtr(new ScheduledLocationChange(url, referrer, lockHistory, lockBackForwardList, duringLoad)));
 }
 
-void RedirectScheduler::scheduleFormSubmission(PassRefPtr<FormSubmission> submission)
+void NavigationScheduler::scheduleFormSubmission(PassRefPtr<FormSubmission> submission)
 {
     ASSERT(m_frame->page());
 
@@ -317,13 +327,14 @@ void RedirectScheduler::scheduleFormSubmission(PassRefPtr<FormSubmission> submis
     // If this is a child frame and the form submission was triggered by a script, lock the back/forward list
     // to match IE and Opera.
     // See https://bugs.webkit.org/show_bug.cgi?id=32383 for the original motivation for this.
-    bool isUserGesture = m_frame->loader()->isProcessingUserGesture();
-    bool lockBackForwardList = mustLockBackForwardList(m_frame, isUserGesture) || (submission->state()->formSubmissionTrigger() == SubmittedByJavaScript && m_frame->tree()->parent() && !isUserGesture);
+    bool lockBackForwardList = mustLockBackForwardList(m_frame)
+        || (submission->state()->formSubmissionTrigger() == SubmittedByJavaScript
+            && m_frame->tree()->parent() && !ScriptController::processingUserGesture());
 
-    schedule(adoptPtr(new ScheduledFormSubmission(submission, lockBackForwardList, duringLoad, isUserGesture)));
+    schedule(adoptPtr(new ScheduledFormSubmission(submission, lockBackForwardList, duringLoad)));
 }
 
-void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
+void NavigationScheduler::scheduleRefresh()
 {
     if (!m_frame->page())
         return;
@@ -331,10 +342,10 @@ void RedirectScheduler::scheduleRefresh(bool wasUserGesture)
     if (url.isEmpty())
         return;
 
-    schedule(adoptPtr(new ScheduledRefresh(url.string(), m_frame->loader()->outgoingReferrer(), wasUserGesture)));
+    schedule(adoptPtr(new ScheduledRefresh(url.string(), m_frame->loader()->outgoingReferrer())));
 }
 
-void RedirectScheduler::scheduleHistoryNavigation(int steps)
+void NavigationScheduler::scheduleHistoryNavigation(int steps)
 {
     if (!m_frame->page())
         return;
@@ -348,10 +359,10 @@ void RedirectScheduler::scheduleHistoryNavigation(int steps)
     }
 
     // In all other cases, schedule the history traversal to occur asynchronously.
-    schedule(adoptPtr(new ScheduledHistoryNavigation(steps, m_frame->loader()->isProcessingUserGesture())));
+    schedule(adoptPtr(new ScheduledHistoryNavigation(steps)));
 }
 
-void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
+void NavigationScheduler::timerFired(Timer<NavigationScheduler>*)
 {
     if (!m_frame->page())
         return;
@@ -362,7 +373,7 @@ void RedirectScheduler::timerFired(Timer<RedirectScheduler>*)
     redirect->fire(m_frame);
 }
 
-void RedirectScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
+void NavigationScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
 {
     ASSERT(m_frame->page());
 
@@ -384,7 +395,7 @@ void RedirectScheduler::schedule(PassOwnPtr<ScheduledNavigation> redirect)
     startTimer();
 }
 
-void RedirectScheduler::startTimer()
+void NavigationScheduler::startTimer()
 {
     if (!m_redirect)
         return;
@@ -399,7 +410,7 @@ void RedirectScheduler::startTimer()
     m_redirect->didStartTimer(m_frame, &m_timer);
 }
 
-void RedirectScheduler::cancel(bool newLoadInProgress)
+void NavigationScheduler::cancel(bool newLoadInProgress)
 {
     m_timer.stop();
 
diff --git a/WebCore/loader/RedirectScheduler.h b/WebCore/loader/NavigationScheduler.h
index 70b0202..3bf5010 100644
--- a/WebCore/loader/RedirectScheduler.h
+++ b/WebCore/loader/NavigationScheduler.h
@@ -47,18 +47,18 @@ class Frame;
 struct FrameLoadRequest;
 class ScheduledNavigation;
 
-class RedirectScheduler : public Noncopyable {
+class NavigationScheduler : public Noncopyable {
 public:
-    RedirectScheduler(Frame*);
-    ~RedirectScheduler();
+    NavigationScheduler(Frame*);
+    ~NavigationScheduler();
 
     bool redirectScheduledDuringLoad();
     bool locationChangePending();
 
     void scheduleRedirect(double delay, const String& url);
-    void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true, bool userGesture = false);
+    void scheduleLocationChange(const String& url, const String& referrer, bool lockHistory = true, bool lockBackForwardList = true);
     void scheduleFormSubmission(PassRefPtr<FormSubmission>);
-    void scheduleRefresh(bool userGesture = false);
+    void scheduleRefresh();
     void scheduleHistoryNavigation(int steps);
 
     void startTimer();
@@ -67,13 +67,13 @@ public:
     void clear();
 
 private:
-    void timerFired(Timer<RedirectScheduler>*);
+    void timerFired(Timer<NavigationScheduler>*);
     void schedule(PassOwnPtr<ScheduledNavigation>);
 
-    static bool mustLockBackForwardList(Frame* targetFrame, bool mustLockIfDuringLoad);
+    static bool mustLockBackForwardList(Frame* targetFrame);
 
     Frame* m_frame;
-    Timer<RedirectScheduler> m_timer;
+    Timer<NavigationScheduler> m_timer;
     OwnPtr<ScheduledNavigation> m_redirect;
 };
 
diff --git a/WebCore/loader/ProgressTracker.cpp b/WebCore/loader/ProgressTracker.cpp
index 7f61cd1..561e6bc 100644
--- a/WebCore/loader/ProgressTracker.cpp
+++ b/WebCore/loader/ProgressTracker.cpp
@@ -59,9 +59,10 @@ struct ProgressItem : Noncopyable {
     long long estimatedLength;
 };
 
+unsigned long ProgressTracker::s_uniqueIdentifier = 0;
+
 ProgressTracker::ProgressTracker()
-    : m_uniqueIdentifier(0)
-    , m_totalPageAndResourceBytesToLoad(0)
+    : m_totalPageAndResourceBytesToLoad(0)
     , m_totalBytesReceived(0)
     , m_lastNotifiedProgressValue(0)
     , m_lastNotifiedProgressTime(0)
@@ -255,7 +256,7 @@ void ProgressTracker::completeProgress(unsigned long identifier)
 
 unsigned long ProgressTracker::createUniqueIdentifier()
 {
-    return ++m_uniqueIdentifier;
+    return ++s_uniqueIdentifier;
 }
 
 
diff --git a/WebCore/loader/ProgressTracker.h b/WebCore/loader/ProgressTracker.h
index 744e101..5d5b6b2 100644
--- a/WebCore/loader/ProgressTracker.h
+++ b/WebCore/loader/ProgressTracker.h
@@ -41,7 +41,7 @@ public:
     ProgressTracker();
     ~ProgressTracker();
     
-    unsigned long createUniqueIdentifier();
+    static unsigned long createUniqueIdentifier();
 
     double estimatedProgress() const;
 
@@ -59,7 +59,7 @@ private:
     void reset();
     void finalProgressComplete();
     
-    unsigned long m_uniqueIdentifier;
+    static unsigned long s_uniqueIdentifier;
     
     long long m_totalPageAndResourceBytesToLoad;
     long long m_totalBytesReceived;
diff --git a/WebCore/loader/Request.h b/WebCore/loader/Request.h
index b6a9e90..25bf31a 100644
--- a/WebCore/loader/Request.h
+++ b/WebCore/loader/Request.h
@@ -36,7 +36,6 @@ namespace WebCore {
         Request(CachedResourceLoader*, CachedResource*, bool incremental, SecurityCheckPolicy, bool sendResourceLoadCallbacks);
         ~Request();
         
-        Vector<char>& buffer() { return m_buffer; }
         CachedResource* cachedResource() { return m_object; }
         CachedResourceLoader* cachedResourceLoader() { return m_cachedResourceLoader; }
 
@@ -50,7 +49,6 @@ namespace WebCore {
         bool sendResourceLoadCallbacks() const { return m_sendResourceLoadCallbacks; }
         
     private:
-        Vector<char> m_buffer;
         CachedResource* m_object;
         CachedResourceLoader* m_cachedResourceLoader;
         bool m_incremental;
diff --git a/WebCore/loader/ResourceLoadNotifier.cpp b/WebCore/loader/ResourceLoadNotifier.cpp
index c43a1da..b32b737 100644
--- a/WebCore/loader/ResourceLoadNotifier.cpp
+++ b/WebCore/loader/ResourceLoadNotifier.cpp
@@ -136,7 +136,7 @@ void ResourceLoadNotifier::dispatchDidReceiveResponse(DocumentLoader* loader, un
 
 #if ENABLE(INSPECTOR)
     if (Page* page = m_frame->page())
-        page->inspectorController()->didReceiveResponse(identifier, r);
+        page->inspectorController()->didReceiveResponse(identifier, loader, r);
 #endif
 }
 
diff --git a/WebCore/loader/ResourceLoadNotifier.h b/WebCore/loader/ResourceLoadNotifier.h
index 758e414..93fcccc 100644
--- a/WebCore/loader/ResourceLoadNotifier.h
+++ b/WebCore/loader/ResourceLoadNotifier.h
@@ -40,7 +40,6 @@ class Frame;
 class ResourceError;
 class ResourceLoader;
 class ResourceResponse;
-class ScriptString;
 class ResourceRequest;
 
 class ResourceLoadNotifier : public Noncopyable {
diff --git a/WebCore/loader/ResourceLoader.cpp b/WebCore/loader/ResourceLoader.cpp
index 3bc1119..eab5acd 100644
--- a/WebCore/loader/ResourceLoader.cpp
+++ b/WebCore/loader/ResourceLoader.cpp
@@ -36,8 +36,7 @@
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
-#include "InspectorController.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "Page.h"
 #include "ProgressTracker.h"
 #include "ResourceHandle.h"
@@ -412,44 +411,20 @@ void ResourceLoader::didSendData(ResourceHandle*, unsigned long long bytesSent,
 
 void ResourceLoader::didReceiveResponse(ResourceHandle*, const ResourceResponse& response)
 {
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent::instanceCount()) {
-        InspectorTimelineAgent* timelineAgent = (m_frame && m_frame->page()) ? m_frame->page()->inspectorTimelineAgent() : 0;
-        if (timelineAgent)
-            timelineAgent->willReceiveResourceResponse(identifier(), response);
-    }
-#endif
 #if ENABLE(OFFLINE_WEB_APPLICATIONS)
     if (documentLoader()->applicationCacheHost()->maybeLoadFallbackForResponse(this, response))
         return;
 #endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceResponse(m_frame.get(), identifier(), response);
     didReceiveResponse(response);
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent::instanceCount()) {
-        InspectorTimelineAgent* timelineAgent = (m_frame && m_frame->page()) ? m_frame->page()->inspectorTimelineAgent() : 0;
-        if (timelineAgent)
-            timelineAgent->didReceiveResourceResponse();
-    }
-#endif
+    InspectorInstrumentation::didReceiveResourceResponse(cookie);
 }
 
 void ResourceLoader::didReceiveData(ResourceHandle*, const char* data, int length, int lengthReceived)
 {
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent::instanceCount()) {
-        InspectorTimelineAgent* timelineAgent = (m_frame && m_frame->page()) ? m_frame->page()->inspectorTimelineAgent() : 0;
-        if (timelineAgent)
-            timelineAgent->willReceiveResourceData(identifier());
-    }
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willReceiveResourceData(m_frame.get(), identifier());
     didReceiveData(data, length, lengthReceived, false);
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent::instanceCount()) {
-        InspectorTimelineAgent* timelineAgent = (m_frame && m_frame->page()) ? m_frame->page()->inspectorTimelineAgent() : 0;
-        if (timelineAgent)
-            timelineAgent->didReceiveResourceData();
-    }
-#endif
+    InspectorInstrumentation::didReceiveResourceData(cookie);
 }
 
 void ResourceLoader::didFinishLoading(ResourceHandle*, double finishTime)
diff --git a/WebCore/loader/SubframeLoader.cpp b/WebCore/loader/SubframeLoader.cpp
index e247e5b..f73646b 100644
--- a/WebCore/loader/SubframeLoader.cpp
+++ b/WebCore/loader/SubframeLoader.cpp
@@ -42,6 +42,7 @@
 #include "MIMETypeRegistry.h"
 #include "Page.h"
 #include "PluginData.h"
+#include "PluginDocument.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderView.h"
 #include "Settings.h"
@@ -238,7 +239,7 @@ Frame* SubframeLoader::loadOrRedirectSubframe(HTMLFrameOwnerElement* ownerElemen
 {
     Frame* frame = ownerElement->contentFrame();
     if (frame)
-        frame->redirectScheduler()->scheduleLocationChange(url.string(), m_frame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList, m_frame->loader()->isProcessingUserGesture());
+        frame->navigationScheduler()->scheduleLocationChange(url.string(), m_frame->loader()->outgoingReferrer(), lockHistory, lockBackForwardList);
     else
         frame = loadSubframe(ownerElement, url, frameName, m_frame->loader()->outgoingReferrer());
     return frame;
@@ -354,7 +355,7 @@ bool SubframeLoader::loadPlugin(HTMLPlugInImageElement* pluginElement, const KUR
     frameLoader->checkIfRunInsecureContent(document()->securityOrigin(), url);
 
     IntSize contentSize(renderer->contentWidth(), renderer->contentHeight());
-    bool loadManually = document()->isPluginDocument() && !m_containsPlugins;
+    bool loadManually = document()->isPluginDocument() && !m_containsPlugins && toPluginDocument(document())->shouldLoadPluginManually();
     RefPtr<Widget> widget = frameLoader->client()->createPlugin(contentSize,
         pluginElement, url, paramNames, paramValues, mimeType, loadManually);
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.cpp b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
index d89f819..8d5d5c0 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.cpp
@@ -159,14 +159,17 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
     
     if (mainResourceCache) {
         if (manifestURL == mainResourceCache->group()->m_manifestURL) {
+            // The cache may have gotten obsoleted after we've loaded from it, but before we parsed the document and saw cache manifest.
+            if (mainResourceCache->group()->isObsolete())
+                return;
             mainResourceCache->group()->associateDocumentLoaderWithCache(documentLoader, mainResourceCache);
             mainResourceCache->group()->update(frame, ApplicationCacheUpdateWithBrowsingContext);
         } else {
             // The main resource was loaded from cache, so the cache must have an entry for it. Mark it as foreign.
-            KURL documentURL(documentLoader->url());
-            if (documentURL.hasFragmentIdentifier())
-                documentURL.removeFragmentIdentifier();
-            ApplicationCacheResource* resource = mainResourceCache->resourceForURL(documentURL);
+            KURL resourceURL(documentLoader->responseURL());
+            if (resourceURL.hasFragmentIdentifier())
+                resourceURL.removeFragmentIdentifier();
+            ApplicationCacheResource* resource = mainResourceCache->resourceForURL(resourceURL);
             bool inStorage = resource->storageID();
             resource->addType(ApplicationCacheResource::Foreign);
             if (inStorage)
@@ -175,7 +178,7 @@ void ApplicationCacheGroup::selectCache(Frame* frame, const KURL& passedManifest
             // Restart the current navigation from the top of the navigation algorithm, undoing any changes that were made
             // as part of the initial load.
             // The navigation will not result in the same resource being loaded, because "foreign" entries are never picked during navigation.
-            frame->redirectScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
+            frame->navigationScheduler()->scheduleLocationChange(documentLoader->url(), frame->loader()->referrer(), true);
         }
         
         return;
@@ -384,6 +387,14 @@ void ApplicationCacheGroup::cacheDestroyed(ApplicationCache* cache)
     }
 }
 
+void ApplicationCacheGroup::stopLoadingInFrame(Frame* frame)
+{
+    if (frame != m_frame)
+        return;
+
+    stopLoading();
+}
+
 #if ENABLE(INSPECTOR)
 static void inspectorUpdateApplicationCacheStatus(Frame* frame)
 {
@@ -512,7 +523,7 @@ void ApplicationCacheGroup::didReceiveResponse(ResourceHandle* handle, const Res
             if (InspectorApplicationCacheAgent* applicationCacheAgent = page->inspectorController()->applicationCacheAgent())
                 applicationCacheAgent->didReceiveManifestResponse(m_currentResourceIdentifier, response);
         } else
-            page->inspectorController()->didReceiveResponse(m_currentResourceIdentifier, response);
+            page->inspectorController()->didReceiveResponse(m_currentResourceIdentifier, m_frame->loader()->documentLoader(), response);
     }
 #endif
 
diff --git a/WebCore/loader/appcache/ApplicationCacheGroup.h b/WebCore/loader/appcache/ApplicationCacheGroup.h
index 99ab71a..29d0749 100644
--- a/WebCore/loader/appcache/ApplicationCacheGroup.h
+++ b/WebCore/loader/appcache/ApplicationCacheGroup.h
@@ -80,6 +80,8 @@ public:
 
     bool cacheIsBeingUpdated(const ApplicationCache* cache) const { return cache == m_cacheBeingUpdated; }
 
+    void stopLoadingInFrame(Frame*);
+
     ApplicationCache* newestCache() const { return m_newestCache.get(); }
     void setNewestCache(PassRefPtr<ApplicationCache>);
 
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.cpp b/WebCore/loader/appcache/ApplicationCacheHost.cpp
index eca6861..f613729 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheHost.cpp
@@ -55,6 +55,8 @@ ApplicationCacheHost::ApplicationCacheHost(DocumentLoader* documentLoader)
 
 ApplicationCacheHost::~ApplicationCacheHost()
 {
+    ASSERT(!m_applicationCache || !m_candidateApplicationCacheGroup || m_applicationCache->group() == m_candidateApplicationCacheGroup);
+
     if (m_applicationCache)
         m_applicationCache->group()->disassociateDocumentLoader(m_documentLoader);
     else if (m_candidateApplicationCacheGroup)
@@ -126,7 +128,10 @@ void ApplicationCacheHost::failedLoadingMainResource()
 {
     ApplicationCacheGroup* group = m_candidateApplicationCacheGroup;
     if (!group && m_applicationCache) {
-        ASSERT(!mainResourceApplicationCache()); // If the main resource were loaded from a cache, it wouldn't fail.
+        if (mainResourceApplicationCache()) {
+            // Even when the main resource is being loaded from an application cache, loading can fail if aborted.
+            return;
+        }
         group = m_applicationCache->group();
     }
     
@@ -239,6 +244,16 @@ void ApplicationCacheHost::notifyDOMApplicationCache(EventID id, int total, int
     dispatchDOMEvent(id, total, done);
 }
 
+void ApplicationCacheHost::stopLoadingInFrame(Frame* frame)
+{
+    ASSERT(!m_applicationCache || !m_candidateApplicationCacheGroup || m_applicationCache->group() == m_candidateApplicationCacheGroup);
+
+    if (m_candidateApplicationCacheGroup)
+        m_candidateApplicationCacheGroup->stopLoadingInFrame(frame);
+    else if (m_applicationCache)
+        m_applicationCache->group()->stopLoadingInFrame(frame);
+}
+
 void ApplicationCacheHost::stopDeferringEvents()
 {
     RefPtr<DocumentLoader> protect(documentLoader());
diff --git a/WebCore/loader/appcache/ApplicationCacheHost.h b/WebCore/loader/appcache/ApplicationCacheHost.h
index c224172..667205d 100644
--- a/WebCore/loader/appcache/ApplicationCacheHost.h
+++ b/WebCore/loader/appcache/ApplicationCacheHost.h
@@ -43,6 +43,7 @@
 namespace WebCore {
     class DOMApplicationCache;
     class DocumentLoader;
+    class Frame;
     class ResourceLoader;
     class ResourceError;
     class ResourceRequest;
@@ -144,6 +145,8 @@ namespace WebCore {
         void setDOMApplicationCache(DOMApplicationCache*);
         void notifyDOMApplicationCache(EventID, int progressTotal, int progressDone);
 
+        void stopLoadingInFrame(Frame*);
+
         void stopDeferringEvents(); // Also raises the events that have been queued up.
 
 #if ENABLE(INSPECTOR)
diff --git a/WebCore/loader/appcache/ApplicationCacheStorage.cpp b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
index 5a82d6e..7b20775 100644
--- a/WebCore/loader/appcache/ApplicationCacheStorage.cpp
+++ b/WebCore/loader/appcache/ApplicationCacheStorage.cpp
@@ -659,10 +659,12 @@ bool ApplicationCacheStorage::store(ApplicationCacheGroup* group, GroupStorageID
     if (!executeStatement(statement))
         return false;
 
+    unsigned groupStorageID = static_cast<unsigned>(m_database.lastInsertRowID());
+
     if (!ensureOriginRecord(group->origin()))
         return false;
 
-    group->setStorageID(static_cast<unsigned>(m_database.lastInsertRowID()));
+    group->setStorageID(groupStorageID);
     journal->add(group, 0);
     return true;
 }    
diff --git a/WebCore/loader/archive/cf/LegacyWebArchive.cpp b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
index ea0ce74..061f4d9 100644
--- a/WebCore/loader/archive/cf/LegacyWebArchive.cpp
+++ b/WebCore/loader/archive/cf/LegacyWebArchive.cpp
@@ -47,6 +47,7 @@
 #include "SelectionController.h"
 #include "SharedBuffer.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/RetainPtr.h>
 
@@ -573,8 +574,8 @@ PassRefPtr<LegacyWebArchive> LegacyWebArchive::createFromSelection(Frame* frame)
         
     // Wrap the frameset document in an iframe so it can be pasted into
     // another document (which will have a body or frameset of its own). 
-    String iframeMarkup = String::format("<iframe frameborder=\"no\" marginwidth=\"0\" marginheight=\"0\" width=\"98%%\" height=\"98%%\" src=\"%s\"></iframe>", 
-                                         frame->loader()->documentLoader()->response().url().string().utf8().data());
+    String iframeMarkup = makeString("<iframe frameborder=\"no\" marginwidth=\"0\" marginheight=\"0\" width=\"98%%\" height=\"98%%\" src=\"",
+                                     frame->loader()->documentLoader()->response().url().string(), "\"></iframe>");
     RefPtr<ArchiveResource> iframeResource = ArchiveResource::create(utf8Buffer(iframeMarkup), blankURL(), "text/html", "UTF-8", String());
 
     Vector<PassRefPtr<ArchiveResource> > subresources;
diff --git a/WebCore/loader/icon/IconFetcher.cpp b/WebCore/loader/icon/IconFetcher.cpp
deleted file mode 100644
index f6b80fa..0000000
--- a/WebCore/loader/icon/IconFetcher.cpp
+++ /dev/null
@@ -1,230 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#include "config.h"
-#include "IconFetcher.h"
-
-#include "Frame.h"
-#include "FrameLoaderClient.h"
-#include "HTMLHeadElement.h"
-#include "HTMLLinkElement.h"
-#include "HTMLNames.h"
-#include "ResourceHandle.h"
-#include "ResourceRequest.h"
-#include "SharedBuffer.h"
-
-namespace WebCore {
-
-using namespace HTMLNames;
-
-struct IconLinkEntry {
-public:
-    enum IconType {
-        Unknown,
-        ICNS,
-        ICO,
-    };
-    
-    IconLinkEntry(IconType type, const KURL& url) 
-        : m_type(type)
-        , m_url(url)
-    {
-    }
-    
-    IconType type() const { return m_type; }
-    const KURL& url() const { return m_url; }
-
-    SharedBuffer* buffer() 
-    {
-        if (!m_buffer)
-            m_buffer = SharedBuffer::create();
-        
-        return m_buffer.get();
-    }
-    
-private:
-    RefPtr<SharedBuffer> m_buffer;
-    IconType m_type;
-    KURL m_url;
-};
-    
-#if PLATFORM(MAC)
-static const IconLinkEntry::IconType NativeIconType = IconLinkEntry::ICNS;
-#elif PLATFORM(WIN)
-static const IconLinkEntry::IconType NativeIconType = IconLinkEntry::ICO;
-#else
-static const IconLinkEntry::IconType NativeIconType = IconLinkEntry::Unknown;
-#endif
-
-static void parseIconLink(HTMLLinkElement* link, Vector<IconLinkEntry>& entries)
-{
-    // FIXME: Parse the size attribute too.
-    
-    IconLinkEntry::IconType type = IconLinkEntry::Unknown;
-    const KURL& url = link->href();
-
-    // Try to determine the file type.
-    String path = url.path();
-    
-    size_t pos = path.reverseFind('.');
-    if (pos != notFound) {
-        String extension = path.substring(pos + 1);
-        if (equalIgnoringCase(extension, "icns"))
-            type = IconLinkEntry::ICNS;
-        else if (equalIgnoringCase(extension, "ico"))
-            type = IconLinkEntry::ICO;
-    }
-    
-    entries.append(IconLinkEntry(type, url));
-}
-    
-PassRefPtr<IconFetcher> IconFetcher::create(Frame* frame, IconFetcherClient* client)
-{
-    Document* document = frame->document();
-    
-    HTMLHeadElement* head = document->head();
-    if (!head)
-        return 0;
-    
-    Vector<IconLinkEntry> entries;
-    
-    for (Node* n = head; n; n = n->traverseNextNode()) {
-        if (!n->hasTagName(linkTag))    
-            continue;
-            
-        HTMLLinkElement* link = static_cast<HTMLLinkElement*>(n);
-        if (!link->isIcon())
-            continue;
-
-        parseIconLink(link, entries);
-    }
-    
-    if (entries.isEmpty())
-        return 0;
-    
-    // Check if any of the entries have the same type as the native icon type.
-
-    // FIXME: This should be way more sophisticated, and handle conversion
-    // of multisize formats for example.
-    for (unsigned i = 0; i < entries.size(); i++) {
-        const IconLinkEntry& entry = entries[i];
-        if (entry.type() == NativeIconType) {
-            RefPtr<IconFetcher> iconFetcher = adoptRef(new IconFetcher(frame, client));
-            
-            iconFetcher->m_entries.append(entry);
-            iconFetcher->loadEntry();
-            
-            return iconFetcher.release();
-        }
-    }
-
-    return 0;
-}    
-
-IconFetcher::IconFetcher(Frame* frame, IconFetcherClient* client)
-    : m_frame(frame)
-    , m_client(client)
-    , m_currentEntry(0)
-{
-}
-    
-IconFetcher::~IconFetcher()
-{
-    cancel();
-}
-
-void IconFetcher::cancel()
-{
-    if (m_handle)
-        m_handle->cancel();
-}
-
-PassRefPtr<SharedBuffer> IconFetcher::createIcon()
-{
-    ASSERT(!m_entries.isEmpty());
-    
-    // For now, just return the data of the first entry.
-    return m_entries.first().buffer();
-}
-
-void IconFetcher::loadEntry()
-{
-    ASSERT(m_currentEntry < m_entries.size());
-    ASSERT(!m_handle);
-    
-    m_handle = ResourceHandle::create(m_frame->loader()->networkingContext(), m_entries[m_currentEntry].url(), this, false, false);
-}
-    
-void IconFetcher::loadFailed()
-{
-    m_handle = 0;
-    
-    m_client->finishedFetchingIcon(0);
-}    
-    
-void IconFetcher::didReceiveResponse(ResourceHandle* handle, const ResourceResponse& response)
-{
-    ASSERT_UNUSED(handle, m_handle == handle);
-    
-    int statusCode = response.httpStatusCode() / 100;
-    if (statusCode == 4 || statusCode == 5) {
-        loadFailed();
-        return;
-    }    
-}
-    
-void IconFetcher::didReceiveData(ResourceHandle* handle, const char* data, int length, int)
-{
-    ASSERT_UNUSED(handle, m_handle == handle);
-    
-    m_entries[m_currentEntry].buffer()->append(data, length);
-}
-
-void IconFetcher::didFinishLoading(ResourceHandle* handle, double)
-{
-    ASSERT_UNUSED(handle, m_handle == handle);
-    
-    if (m_currentEntry == m_entries.size() - 1) {
-        // We finished loading, create the icon
-        RefPtr<SharedBuffer> iconData = createIcon();
-        
-        m_client->finishedFetchingIcon(iconData.release());
-        return;
-    }
-    
-    // Load the next entry
-    m_currentEntry++;
-
-    loadEntry();
-}
-    
-void IconFetcher::didFail(ResourceHandle* handle, const ResourceError&)
-{
-    ASSERT_UNUSED(handle, m_handle == handle);
-    
-    loadFailed();
-}
-
-} // namespace WebCore
diff --git a/WebCore/loader/icon/IconFetcher.h b/WebCore/loader/icon/IconFetcher.h
deleted file mode 100644
index 387e1c3..0000000
--- a/WebCore/loader/icon/IconFetcher.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#ifndef IconFetcher_h
-#define IconFetcher_h
-
-#include <wtf/RefCounted.h>
-#include <wtf/Forward.h>
-#include <wtf/Vector.h>
-
-#include "ResourceHandleClient.h"
-
-namespace WebCore {
-
-class Frame;
-struct IconLinkEntry;
-class ResourceHandle;
-class SharedBuffer;
-
-class IconFetcherClient {
-public:
-    virtual void finishedFetchingIcon(PassRefPtr<SharedBuffer> iconData) = 0;
-    
-    virtual ~IconFetcherClient() { }
-};
-
-class IconFetcher : public RefCounted<IconFetcher>, ResourceHandleClient {
-public:
-    static PassRefPtr<IconFetcher> create(Frame*, IconFetcherClient*);
-    ~IconFetcher();
-    
-    void cancel();
-    
-private:
-    IconFetcher(Frame*, IconFetcherClient*);
-    void loadEntry();
-    void loadFailed();
-    
-    PassRefPtr<SharedBuffer> createIcon();
-    
-    virtual void didReceiveResponse(ResourceHandle*, const ResourceResponse&);
-    virtual void didReceiveData(ResourceHandle*, const char*, int, int lengthReceived);
-    virtual void didFinishLoading(ResourceHandle*, double /*finishTime*/);
-    virtual void didFail(ResourceHandle*, const ResourceError&);
-
-    Frame* m_frame;
-    IconFetcherClient* m_client;
-
-    unsigned m_currentEntry;
-    RefPtr<ResourceHandle> m_handle;
-    Vector<IconLinkEntry> m_entries;
-};
-    
-} // namespace WebCore
-
-#endif // IconFetcher_h
diff --git a/WebCore/loader/loader.cpp b/WebCore/loader/loader.cpp
index 3f6fad2..aa3f246 100644
--- a/WebCore/loader/loader.cpp
+++ b/WebCore/loader/loader.cpp
@@ -28,10 +28,11 @@
 #include "CachedImage.h"
 #include "CachedResource.h"
 #include "CachedResourceLoader.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "HTMLDocument.h"
+#include "Logging.h"
 #include "Request.h"
 #include "ResourceHandle.h"
 #include "ResourceRequest.h"
@@ -43,7 +44,6 @@
 #include <wtf/Vector.h>
 
 #define REQUEST_MANAGEMENT_ENABLED 1
-#define REQUEST_DEBUG 0
 
 namespace WebCore {
 
@@ -123,6 +123,8 @@ Loader::Priority Loader::determinePriority(const CachedResource* resource) const
 
 void Loader::load(CachedResourceLoader* cachedResourceLoader, CachedResource* resource, bool incremental, SecurityCheckPolicy securityCheck, bool sendResourceLoadCallbacks)
 {
+    LOG(ResourceLoading, "Loader::load resource %p '%s'", resource, resource->url().latin1().data());
+
     ASSERT(cachedResourceLoader);
     Request* request = new Request(cachedResourceLoader, resource, incremental, securityCheck, sendResourceLoadCallbacks);
 
@@ -149,30 +151,27 @@ void Loader::load(CachedResourceLoader* cachedResourceLoader, CachedResource* re
         host->servePendingRequests(priority);
     } else {
         // Handle asynchronously so early low priority requests don't get scheduled before later high priority ones
-#if ENABLE(INSPECTOR)
-        if (InspectorTimelineAgent::instanceCount()) {
-            InspectorTimelineAgent* agent = cachedResourceLoader->doc()->inspectorTimelineAgent();
-            if (agent)
-                agent->didScheduleResourceRequest(resource->url());
-        }
-#endif // ENABLE(INSPECTOR)
+        InspectorInstrumentation::didScheduleResourceRequest(cachedResourceLoader->doc(), resource->url());
         scheduleServePendingRequests();
     }
 }
     
 void Loader::scheduleServePendingRequests()
 {
+    LOG(ResourceLoading, "Loader::scheduleServePendingRequests, m_requestTimer.isActive()=%u", m_requestTimer.isActive());
     if (!m_requestTimer.isActive())
         m_requestTimer.startOneShot(0);
 }
 
 void Loader::requestTimerFired(Timer<Loader>*) 
 {
+    LOG(ResourceLoading, "Loader::requestTimerFired\n");
     servePendingRequests();
 }
 
 void Loader::servePendingRequests(Priority minimumPriority)
 {
+    LOG(ResourceLoading, "Loader::servePendingRequests. m_isSuspendingPendingRequests=%d", m_isSuspendingPendingRequests);
     if (m_isSuspendingPendingRequests)
         return;
 
@@ -314,8 +313,11 @@ bool Loader::Host::hasRequests() const
 
 void Loader::Host::servePendingRequests(Loader::Priority minimumPriority)
 {
-    if (cache()->loader()->isSuspendingPendingRequests())
+    LOG(ResourceLoading, "Host::servePendingRequests '%s'", m_name.string().latin1().data());
+    if (cache()->loader()->isSuspendingPendingRequests()) {
+        LOG(ResourceLoading, "...isSuspendingPendingRequests");
         return;
+    }
 
     bool serveMore = true;
     for (int priority = High; priority >= minimumPriority && serveMore; --priority)
@@ -364,18 +366,26 @@ void Loader::Host::servePendingRequests(RequestQueue& requestsPending, bool& ser
             }
         }
 
+#if ENABLE(LINK_PREFETCH)
+        if (request->cachedResource()->type() == CachedResource::LinkPrefetch)
+            resourceRequest.setHTTPHeaderField("X-Purpose", "prefetch");
+#endif
+
         RefPtr<SubresourceLoader> loader = SubresourceLoader::create(cachedResourceLoader->doc()->frame(),
             this, resourceRequest, request->shouldDoSecurityCheck(), request->sendResourceLoadCallbacks());
         if (loader) {
             m_requestsLoading.add(loader.release(), request);
             request->cachedResource()->setRequestedFromNetworkingLayer();
-#if REQUEST_DEBUG
-            printf("HOST %s COUNT %d LOADING %s\n", resourceRequest.url().host().latin1().data(), m_requestsLoading.size(), request->cachedResource()->url().latin1().data());
-#endif
-        } else {            
-            cachedResourceLoader->decrementRequestCount(request->cachedResource());
+            LOG(ResourceLoading, "Host '%s' loading '%s'. Current count %d", m_name.string().latin1().data(), request->cachedResource()->url().latin1().data(), m_requestsLoading.size());
+        } else {
+            // FIXME: What if resources in other frames were waiting for this revalidation?
+            LOG(ResourceLoading, "Host '%s' cannot start loading '%s'", m_name.string().latin1().data(), request->cachedResource()->url().latin1().data());
+            CachedResource* resource = request->cachedResource();
+            cachedResourceLoader->decrementRequestCount(resource);
             cachedResourceLoader->setLoadInProgress(true);
-            request->cachedResource()->error();
+            if (resource->resourceToRevalidate())
+                cache()->revalidationFailed(resource);
+            resource->error();
             cachedResourceLoader->setLoadInProgress(false);
             delete request;
         }
@@ -402,6 +412,8 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     CachedResource* resource = request->cachedResource();
     ASSERT(!resource->resourceToRevalidate());
 
+    LOG(ResourceLoading, "Host '%s' received %s. Current count %d\n", m_name.string().latin1().data(), resource->url().latin1().data(), m_requestsLoading.size());
+
     // If we got a 4xx response, we're pretending to have received a network
     // error, so we can't send the successful data() and finish() callbacks.
     if (!resource->errorOccurred()) {
@@ -416,10 +428,6 @@ void Loader::Host::didFinishLoading(SubresourceLoader* loader)
     
     cachedResourceLoader->checkForPendingPreloads();
 
-#if REQUEST_DEBUG
-    KURL u(ParsedURLString, resource->url());
-    printf("HOST %s COUNT %d RECEIVED %s\n", u.host().latin1().data(), m_requestsLoading.size(), resource->url().latin1().data());
-#endif
     servePendingRequests();
 }
 
@@ -448,7 +456,9 @@ void Loader::Host::didFail(SubresourceLoader* loader, bool cancelled)
         cachedResourceLoader->decrementRequestCount(request->cachedResource());
 
     CachedResource* resource = request->cachedResource();
-    
+
+    LOG(ResourceLoading, "Host '%s' failed to load %s (cancelled=%d). Current count %d\n", m_name.string().latin1().data(), resource->url().latin1().data(), cancelled, m_requestsLoading.size());
+
     if (resource->resourceToRevalidate())
         cache()->revalidationFailed(resource);
 
diff --git a/WebCore/make-hash-tools.pl b/WebCore/make-hash-tools.pl
index 3ad5ee9..b070829 100644
--- a/WebCore/make-hash-tools.pl
+++ b/WebCore/make-hash-tools.pl
@@ -56,7 +56,7 @@ struct PubIDInfo {
 
 struct NamedColor {
     const char* name;
-    int RGBValue;
+    unsigned ARGBValue;
 };
 
 struct Property {
diff --git a/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html b/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html
new file mode 100644
index 0000000..9637195
--- /dev/null
+++ b/WebCore/manual-tests/autocorrection/autocorrection-cancelled-by-typing-1.html
@@ -0,0 +1,59 @@
+<html>
+<head>
+
+<style>
+.editing {
+    border: 2px solid red;
+    padding: 12px;
+    font-size: 24px;
+}
+</style>
+<script src=../../../LayoutTests/editing/editing.js language="JavaScript" type="text/JavaScript" ></script>
+
+<script>
+ if (window.layoutTestController)
+        layoutTestController.waitUntilDone();
+
+function keepTyping() {
+    typeCharacterCommand('i');
+    typeCharacterCommand('n');
+    typeCharacterCommand('g');
+    typeCharacterCommand(' ');
+    if (window.layoutTestController)
+            layoutTestController.notifyDone();
+}
+
+function editingTest() {
+    typeCharacterCommand('t');
+    typeCharacterCommand('h');
+    typeCharacterCommand('e');
+    typeCharacterCommand(' ');
+    typeCharacterCommand('c');
+    typeCharacterCommand('o');
+    typeCharacterCommand('l');
+    typeCharacterCommand('l');
+    typeCharacterCommand('a');
+    typeCharacterCommand('p');
+    typeCharacterCommand('s');
+    setTimeout("keepTyping()", 1000);
+}
+
+</script>
+
+<title>Autocorrection Cancellation By Typing Test</title>
+</head>
+<body>
+<div>This test verifies that autocorrection behaves correctly when continuing typing in a word on 
+which autocorrection panel is hown. You should see correction panel showing 'collapse' after 'collaps' is entered. And after a pause, phrase 'the collapsing' is shown without underline.</div>
+<p  style="color:green">Note, this test can fail due to user specific spell checking data. If the user has previously dismissed 'collapse' as the correct spelling of 'collaps' several times, the spell checker will not provide 'collapse' as a suggestion anymore. To fix this, remove all files in ~/Library/Spelling.</p>
+<div contenteditable id="root" class="editing">
+<span id="test"></span>
+</div>
+
+
+<script>
+runEditingTest();
+</script>
+
+</body>
+</html>
diff --git a/WebCore/manual-tests/screen-availLeft.html b/WebCore/manual-tests/screen-availLeft.html
new file mode 100644
index 0000000..e8d9f39
--- /dev/null
+++ b/WebCore/manual-tests/screen-availLeft.html
@@ -0,0 +1,27 @@
+<!DOCTYPE html>
+<html>
+<head>
+    <script type="text/javascript">
+        function log(s)
+        {
+            var output = document.getElementById('output');
+            output.innerHTML += s + "<br>";
+        }
+        
+        function doTest()
+        {
+            window.setInterval(function() {
+                
+                var screen = window.screen;
+                log('screen availLeft: ' + screen.availLeft + ' availTop: ' + screen.availTop);
+                
+            }, 1000);
+        }
+        window.addEventListener('load', doTest, false);
+    </script>
+</head>
+<body>
+    <p>On a two-monitor system, configure the menu bar to be on the right screen. Then drag this window between screens. When on the left screen, screen.availLeft should be negative.</p>
+    <div id="output"></div>
+</body>
+</html>
diff --git a/WebCore/mathml/RenderMathMLBlock.cpp b/WebCore/mathml/RenderMathMLBlock.cpp
index ef94893..c625b1d 100644
--- a/WebCore/mathml/RenderMathMLBlock.cpp
+++ b/WebCore/mathml/RenderMathMLBlock.cpp
@@ -89,7 +89,7 @@ void RenderMathMLBlock::paint(PaintInfo& info, int tx, int ty)
     
     info.context->setStrokeThickness(1.0f);
     info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeColor(Color(0, 0, 255), sRGBColorSpace);
+    info.context->setStrokeColor(Color(0, 0, 255), ColorSpaceSRGB);
     
     info.context->drawLine(IntPoint(tx, ty), IntPoint(tx + offsetWidth(), ty));
     info.context->drawLine(IntPoint(tx + offsetWidth(), ty), IntPoint(tx + offsetWidth(), ty + offsetHeight()));
@@ -98,13 +98,13 @@ void RenderMathMLBlock::paint(PaintInfo& info, int tx, int ty)
     
     int topStart = paddingTop();
     
-    info.context->setStrokeColor(Color(0, 255, 0), sRGBColorSpace);
+    info.context->setStrokeColor(Color(0, 255, 0), ColorSpaceSRGB);
     
     info.context->drawLine(IntPoint(tx, ty + topStart), IntPoint(tx + offsetWidth(), ty + topStart));
     
     int baseline = baselinePosition(true);
     
-    info.context->setStrokeColor(Color(255, 0, 0), sRGBColorSpace);
+    info.context->setStrokeColor(Color(255, 0, 0), ColorSpaceSRGB);
     
     info.context->drawLine(IntPoint(tx, ty + baseline), IntPoint(tx + offsetWidth(), ty + baseline));
     
diff --git a/WebCore/mathml/RenderMathMLFenced.cpp b/WebCore/mathml/RenderMathMLFenced.cpp
index 6c0bb0b..a304fa4 100644
--- a/WebCore/mathml/RenderMathMLFenced.cpp
+++ b/WebCore/mathml/RenderMathMLFenced.cpp
@@ -40,6 +40,8 @@ namespace WebCore {
 using namespace MathMLNames;
     
 enum Braces { OpeningBraceChar = 0x28, ClosingBraceChar = 0x29 };
+    
+static const float gOperatorPadding = 0.1f;
 
 RenderMathMLFenced::RenderMathMLFenced(Node* fenced) 
     : RenderMathMLRow(fenced)
@@ -67,7 +69,7 @@ void RenderMathMLFenced::updateFromElement()
             if (!isSpaceOrNewline(separators[i]))
                 characters.append(separators[i]);
         }
-        m_separators = !separators.length() ? 0 : StringImpl::create(characters.data() , characters.size());
+        m_separators = !characters.size() ? 0 : StringImpl::create(characters.data() , characters.size());
     } else {
         // The separator defaults to a single comma.
         m_separators = StringImpl::create(",");
@@ -82,8 +84,7 @@ RefPtr<RenderStyle> RenderMathMLFenced::makeOperatorStyle()
     RefPtr<RenderStyle> newStyle = RenderStyle::create();
     newStyle->inheritFrom(style());
     newStyle->setDisplay(INLINE_BLOCK);
-    newStyle->setHeight(Length(100.0, Percent));
-    newStyle->setVerticalAlign(MIDDLE);
+    newStyle->setPaddingRight(Length(static_cast<int>(gOperatorPadding * style()->fontSize()), Fixed));
     return newStyle;
 }
 
@@ -158,6 +159,8 @@ void RenderMathMLFenced::layout()
     setNeedsLayoutAndPrefWidthsRecalc();
     markContainingBlocksForLayout();
     RenderBlock::layout();
+    
+    setNeedsLayout(false);
 }
 }    
 
diff --git a/WebCore/mathml/RenderMathMLFraction.cpp b/WebCore/mathml/RenderMathMLFraction.cpp
index 914f6fe..92c8101 100644
--- a/WebCore/mathml/RenderMathMLFraction.cpp
+++ b/WebCore/mathml/RenderMathMLFraction.cpp
@@ -167,14 +167,14 @@ void RenderMathMLFraction::paint(PaintInfo& info, int tx, int ty)
     
     info.context->setStrokeThickness(static_cast<float>(m_lineThickness));
     info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), sRGBColorSpace);
+    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), ColorSpaceSRGB);
     
     info.context->drawLine(IntPoint(tx, ty), IntPoint(tx + offsetWidth(), ty));
     
     info.context->restore();
 }
 
-int RenderMathMLFraction::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderMathMLFraction::baselinePosition(bool firstLine, LineDirectionMode lineDirection, LinePositionMode linePositionMode) const
 {
     if (firstChild() && firstChild()->isRenderMathMLBlock()) {
         RenderMathMLBlock* numerator = toRenderMathMLBlock(firstChild());
@@ -184,7 +184,7 @@ int RenderMathMLFraction::baselinePosition(bool firstLine, bool isRootLineBox) c
         // a good guess.
         return numerator->offsetHeight() + style()->fontSize() / 3;
     }
-    return RenderBlock::baselinePosition(firstLine, isRootLineBox);
+    return RenderBlock::baselinePosition(firstLine, lineDirection, linePositionMode);
 }
 
 }
diff --git a/WebCore/mathml/RenderMathMLFraction.h b/WebCore/mathml/RenderMathMLFraction.h
index c8c1cb8..d0f3fe0 100644
--- a/WebCore/mathml/RenderMathMLFraction.h
+++ b/WebCore/mathml/RenderMathMLFraction.h
@@ -38,7 +38,7 @@ public:
     RenderMathMLFraction(Element* fraction);
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
     virtual void updateFromElement();
-    virtual int baselinePosition(bool , bool) const; 
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const; 
     virtual void paint(PaintInfo&, int tx, int ty);
 protected:
     virtual void layout();
diff --git a/WebCore/mathml/RenderMathMLOperator.cpp b/WebCore/mathml/RenderMathMLOperator.cpp
index a6778a9..1e3b429 100644
--- a/WebCore/mathml/RenderMathMLOperator.cpp
+++ b/WebCore/mathml/RenderMathMLOperator.cpp
@@ -174,7 +174,6 @@ void RenderMathMLOperator::updateFromElement()
     
     // We only stretch character if the stretch height is larger than a minimum size (e.g. 24px).
     bool shouldStretch = isStretchy && m_stretchHeight>gMinimumStretchHeight;
-    m_isCentered = true;
     
     // Either stretch is disabled or we don't have a stretchable character over the minimum height
     if (stretchDisabled || !shouldStretch) {
@@ -184,6 +183,7 @@ void RenderMathMLOperator::updateFromElement()
         RefPtr<RenderStyle> newStyle = RenderStyle::create();
         newStyle->inheritFrom(style());
         newStyle->setDisplay(INLINE_BLOCK);
+        newStyle->setVerticalAlign(BASELINE);
         
         // Check for a stretchable character that is under the minimum height and use the
         // font size to adjust the glyph size.
@@ -195,18 +195,6 @@ void RenderMathMLOperator::updateFromElement()
             desc.setComputedSize(m_stretchHeight);
             newStyle->setFontDescription(desc);
             newStyle->font().update(newStyle->font().fontSelector());
-            newStyle->setVerticalAlign(BASELINE);
-            m_isCentered = false;
-        } else {
-            int topPad = (m_stretchHeight - currentFontSize) / 2;
-
-            if (topPad / static_cast<float>(m_stretchHeight) > gMinimumRatioForStretch) {
-                newStyle->setVerticalAlign(TOP);
-                newStyle->setPaddingTop(Length(topPad, Fixed));
-            } else {
-                m_isCentered = false;
-                newStyle->setVerticalAlign(BASELINE);
-            }
         }
 
         container->setStyle(newStyle.release());
@@ -345,13 +333,11 @@ RenderBlock* RenderMathMLOperator::createGlyph(UChar glyph, int size, int charRe
     return container;
 }
 
-int RenderMathMLOperator::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderMathMLOperator::baselinePosition(bool firstLine, LineDirectionMode lineDirection, LinePositionMode linePositionMode) const
 {
     if (m_isStacked)
-        return m_stretchHeight * 2 / 3 - (m_stretchHeight - static_cast<int>(m_stretchHeight / gOperatorExpansion)) / 2;
-    if (m_isCentered && firstChild()) 
-        return firstChild()->baselinePosition(firstLine, isRootLineBox);
-    return RenderBlock::baselinePosition(firstLine, isRootLineBox);
+        return m_stretchHeight * 2 / 3 - (m_stretchHeight - static_cast<int>(m_stretchHeight / gOperatorExpansion)) / 2;    
+    return RenderBlock::baselinePosition(firstLine, lineDirection, linePositionMode);
 }
     
 }
diff --git a/WebCore/mathml/RenderMathMLOperator.h b/WebCore/mathml/RenderMathMLOperator.h
index 99c5246..7091b34 100644
--- a/WebCore/mathml/RenderMathMLOperator.h
+++ b/WebCore/mathml/RenderMathMLOperator.h
@@ -41,8 +41,8 @@ public:
     virtual void stretchToHeight(int pixelHeight);
     virtual void updateFromElement(); 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
-    virtual int baselinePosition(bool , bool) const;    
-    
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+        
 protected:
     virtual void layout();
     virtual RefPtr<RenderStyle> createStackableStyle(int size, int topRelative);
@@ -51,7 +51,6 @@ protected:
 private:
     int m_stretchHeight;
     bool m_isStacked;
-    bool m_isCentered;
     UChar m_operator;
 };
 
diff --git a/WebCore/mathml/RenderMathMLRoot.cpp b/WebCore/mathml/RenderMathMLRoot.cpp
index da303c9..ab15c80 100644
--- a/WebCore/mathml/RenderMathMLRoot.cpp
+++ b/WebCore/mathml/RenderMathMLRoot.cpp
@@ -151,7 +151,7 @@ void RenderMathMLRoot::paint(PaintInfo& info, int tx, int ty)
     
     info.context->setStrokeThickness(gRadicalLineThickness * style()->fontSize());
     info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), DeviceColorSpace);
+    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), ColorSpaceDeviceRGB);
     info.context->setLineJoin(MiterJoin);
     info.context->setMiterLimit(style()->fontSize());
     
@@ -190,9 +190,9 @@ void RenderMathMLRoot::paint(PaintInfo& info, int tx, int ty)
     info.context->setLineCap(SquareCap);
     
     Path line;
-    
-    line = line.createLine(bottomLeft, topLeft);
-    
+    line.moveTo(bottomLeft);
+    line.addLineTo(topLeft);
+
     info.context->beginPath();
     info.context->addPath(line);
     info.context->strokePath();
diff --git a/WebCore/mathml/RenderMathMLRow.cpp b/WebCore/mathml/RenderMathMLRow.cpp
index acbfb9d..632b794 100644
--- a/WebCore/mathml/RenderMathMLRow.cpp
+++ b/WebCore/mathml/RenderMathMLRow.cpp
@@ -145,15 +145,15 @@ void RenderMathMLRow::layout()
     RenderBlock::layout();
 }    
 
-int RenderMathMLRow::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderMathMLRow::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     if (firstChild() && firstChild()->isRenderMathMLBlock()) {
         RenderMathMLBlock* block = toRenderMathMLBlock(firstChild());
         if (block->isRenderMathMLOperator())
-            return block->baselinePosition(firstLine, isRootLineBox);
+            return block->y() + block->baselinePosition(firstLine, direction, linePositionMode);
     }
     
-    return RenderBlock::baselinePosition(firstLine, isRootLineBox);
+    return RenderBlock::baselinePosition(firstLine, direction, linePositionMode);
 }
     
 }
diff --git a/WebCore/mathml/RenderMathMLRow.h b/WebCore/mathml/RenderMathMLRow.h
index 83c6832..b363b1b 100644
--- a/WebCore/mathml/RenderMathMLRow.h
+++ b/WebCore/mathml/RenderMathMLRow.h
@@ -37,7 +37,7 @@ public:
     RenderMathMLRow(Node* container);
     virtual bool isRenderMathMLRow() const { return true; }
     virtual int nonOperatorHeight() const;
-    virtual int baselinePosition(bool , bool) const;    
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;    
 protected:
     virtual void layout();
 };
diff --git a/WebCore/mathml/RenderMathMLSquareRoot.cpp b/WebCore/mathml/RenderMathMLSquareRoot.cpp
index 86add7a..862d8a4 100644
--- a/WebCore/mathml/RenderMathMLSquareRoot.cpp
+++ b/WebCore/mathml/RenderMathMLSquareRoot.cpp
@@ -117,7 +117,7 @@ void RenderMathMLSquareRoot::paint(PaintInfo& info, int tx, int ty)
     
     info.context->setStrokeThickness(gRadicalLineThickness * style()->fontSize());
     info.context->setStrokeStyle(SolidStroke);
-    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), DeviceColorSpace);
+    info.context->setStrokeColor(style()->visitedDependentColor(CSSPropertyColor), ColorSpaceDeviceRGB);
     info.context->setLineJoin(MiterJoin);
     info.context->setMiterLimit(style()->fontSize());
     
@@ -156,8 +156,8 @@ void RenderMathMLSquareRoot::paint(PaintInfo& info, int tx, int ty)
     info.context->setLineCap(SquareCap);
     
     Path line;
-    
-    line = line.createLine(bottomLeft, topLeft);
+    line.moveTo(bottomLeft);
+    line.addLineTo(topLeft);
     
     info.context->beginPath();
     info.context->addPath(line);
diff --git a/WebCore/mathml/RenderMathMLSubSup.cpp b/WebCore/mathml/RenderMathMLSubSup.cpp
index 4cda36f..8add254 100644
--- a/WebCore/mathml/RenderMathMLSubSup.cpp
+++ b/WebCore/mathml/RenderMathMLSubSup.cpp
@@ -173,49 +173,47 @@ void RenderMathMLSubSup::layout()
     }    
 }
 
-int RenderMathMLSubSup::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderMathMLSubSup::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     RenderObject* base = firstChild();
     if (!base) 
         return offsetHeight();
     base = base->firstChild();
-    if (!base) 
-        return offsetHeight();
     
     int baseline = offsetHeight();
-    
+    if (!base || !base->isBoxModelObject()) 
+        return baseline;
+
+    RenderBoxModelObject* box = toRenderBoxModelObject(base);
+
     switch (m_kind) {
     case SubSup:
         if (m_scripts) {
-            int topAdjust = 0;
-            if (base->isBoxModelObject()) {
-                RenderBoxModelObject* box = toRenderBoxModelObject(base);
-                topAdjust = (m_scripts->offsetHeight() - box->offsetHeight()) / 2;
-            }
+            int topAdjust = (m_scripts->offsetHeight() - box->offsetHeight()) / 2;
+        
             // FIXME: The last bit of this calculation should be more exact.  Why is the 2-3px scaled for zoom necessary?
             // The baseline is top spacing of the base + the baseline of the base + adjusted space for zoom
             float zoomFactor = style()->effectiveZoom();
-            return topAdjust + base->baselinePosition(firstLine, isRootLineBox) + static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
+            return topAdjust + box->baselinePosition(firstLine, direction, linePositionMode) + static_cast<int>((zoomFactor > 1.25 ? 2 : 3) * zoomFactor);
         }
         break;
-    case Sup:
-        if (base) {
-            baseline = base->baselinePosition(firstLine, isRootLineBox) + 4;
-            // FIXME: The extra amount of the superscript ascending above the base's box
-            // isn't taken into account.  This should be calculated in a more reliable
-            // way.
-            RenderObject* sup = base->nextSibling();
-            if (sup && sup->isBoxModelObject()) {
-                RenderBoxModelObject* box = toRenderBoxModelObject(sup);
-                // we'll take half of the sup's box height into account in the baseline
-                baseline += static_cast<int>(box->offsetHeight() * 0.5);
-            }
-            baseline++;
+    case Sup: {
+        baseline = box->baselinePosition(firstLine, direction, linePositionMode) + 4;
+        // FIXME: The extra amount of the superscript ascending above the base's box
+        // isn't taken into account.  This should be calculated in a more reliable
+        // way.
+        RenderObject* sup = base->nextSibling();
+        if (sup && sup->isBoxModelObject()) {
+            RenderBoxModelObject* box = toRenderBoxModelObject(sup);
+            // we'll take half of the sup's box height into account in the baseline
+            baseline += static_cast<int>(box->offsetHeight() * 0.5);
         }
+        baseline++;
         break;
+    }
     case Sub:
-        if (base) 
-            baseline = base->baselinePosition(true) + 4;
+        baseline = box->baselinePosition(true, direction) + 4;
+        break;
     }
     
     return baseline;
diff --git a/WebCore/mathml/RenderMathMLSubSup.h b/WebCore/mathml/RenderMathMLSubSup.h
index 037ef89..3e62eb0 100644
--- a/WebCore/mathml/RenderMathMLSubSup.h
+++ b/WebCore/mathml/RenderMathMLSubSup.h
@@ -41,7 +41,7 @@ public:
     virtual bool hasBase() const { return true; }
     virtual int nonOperatorHeight() const;
     virtual void stretchToHeight(int pixelHeight);
-    virtual int baselinePosition(bool, bool) const;    
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
 protected:
     virtual void layout();
diff --git a/WebCore/mathml/RenderMathMLUnderOver.cpp b/WebCore/mathml/RenderMathMLUnderOver.cpp
index f015054..69f2c57 100644
--- a/WebCore/mathml/RenderMathMLUnderOver.cpp
+++ b/WebCore/mathml/RenderMathMLUnderOver.cpp
@@ -157,7 +157,10 @@ void RenderMathMLUnderOver::layout()
         if (over) {
             // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
             // FIXME: bases that ascend higher than the line box intrude into the over
-            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - over->firstChild()->baselinePosition(true)));
+            if (!over->firstChild()->isBoxModelObject())
+                break;
+            
+            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - toRenderBoxModelObject(over->firstChild())->baselinePosition(true, HorizontalLine)));
             
             // base row wrapper
             base = over->nextSibling();
@@ -182,9 +185,12 @@ void RenderMathMLUnderOver::layout()
             int baseHeight = getOffsetHeight(base);
             // actual base
             base = base->firstChild();
+            if (!base->isBoxModelObject())
+                break;
+            
             // FIXME: We need to look at the space between a single maximum height of
             //        the line boxes and the baseline and squeeze them together
-            int underSpacing = baseHeight - base->baselinePosition(true);
+            int underSpacing = baseHeight - toRenderBoxModelObject(base)->baselinePosition(true, HorizontalLine);
             
             // adjust the base's intrusion into the under
             RenderObject* under = lastChild();
@@ -203,7 +209,9 @@ void RenderMathMLUnderOver::layout()
         if (over) {
             // FIXME: descending glyphs intrude into base (e.g. lowercase y over base)
             // FIXME: bases that ascend higher than the line box intrude into the over
-            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - over->firstChild()->baselinePosition(true)));
+            if (!over->firstChild()->isBoxModelObject())
+                break;
+            int overSpacing = static_cast<int>(gOverSpacingAdjustment * (getOffsetHeight(over) - toRenderBoxModelObject(over->firstChild())->baselinePosition(true, HorizontalLine)));
             
             // base row wrapper
             base = over->nextSibling();
@@ -218,9 +226,12 @@ void RenderMathMLUnderOver::layout()
                 int baseHeight = getOffsetHeight(base);
                 // actual base
                 base = base->firstChild();
+                if (!base->isBoxModelObject())
+                    break;
+
                 // FIXME: We need to look at the space between a single maximum height of
                 //        the line boxes and the baseline and squeeze them together
-                int underSpacing = baseHeight - base->baselinePosition(true);
+                int underSpacing = baseHeight - toRenderBoxModelObject(base)->baselinePosition(true, HorizontalLine);
                 
                 RenderObject* under = lastChild();
                 if (under && under->firstChild()->isRenderInline() && underSpacing > 0)
@@ -234,11 +245,11 @@ void RenderMathMLUnderOver::layout()
     RenderBlock::layout();
 }
 
-int RenderMathMLUnderOver::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderMathMLUnderOver::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     RenderObject* current = firstChild();
     if (!current)
-        return RenderBlock::baselinePosition(firstLine, isRootLineBox);
+        return RenderBlock::baselinePosition(firstLine, direction, linePositionMode);
 
     int baseline = 0;
     switch (m_kind) {
@@ -249,17 +260,17 @@ int RenderMathMLUnderOver::baselinePosition(bool firstLine, bool isRootLineBox)
         if (current) {
             // actual base
             RenderObject* base = current->firstChild();
-            if (!base)
+            if (!base || !base->isBoxModelObject())
                 break;
-            baseline += base->baselinePosition(firstLine, isRootLineBox);
+            baseline += toRenderBoxModelObject(base)->baselinePosition(firstLine, HorizontalLine, linePositionMode);
             // added the negative top margin
             baseline += current->style()->marginTop().value();
         }
         break;
     case Under:
         RenderObject* base = current->firstChild();
-        if (base)
-            baseline += base->baselinePosition(true);
+        if (base && base->isBoxModelObject())
+            baseline += toRenderBoxModelObject(base)->baselinePosition(true, HorizontalLine);
     }
 
     // FIXME: Where is the extra 2-3px adjusted for zoom coming from?
diff --git a/WebCore/mathml/RenderMathMLUnderOver.h b/WebCore/mathml/RenderMathMLUnderOver.h
index 5917126..88edea8 100644
--- a/WebCore/mathml/RenderMathMLUnderOver.h
+++ b/WebCore/mathml/RenderMathMLUnderOver.h
@@ -40,7 +40,7 @@ public:
     virtual void layout();
     virtual bool hasBase() const { return true; }
     virtual int nonOperatorHeight() const;
-    virtual int baselinePosition(bool , bool) const;    
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;    
     virtual void stretchToHeight(int pixelHeight);
 private:
     enum UnderOverType { Under, Over, UnderOver };
diff --git a/WebCore/page/Chrome.cpp b/WebCore/page/Chrome.cpp
index 8feedce..944f32f 100644
--- a/WebCore/page/Chrome.cpp
+++ b/WebCore/page/Chrome.cpp
@@ -426,6 +426,11 @@ void Chrome::chooseIconForFiles(const Vector<String>& filenames, FileChooser* fi
     m_client->chooseIconForFiles(filenames, fileChooser);
 }
 
+void Chrome::dispatchViewportDataDidChange(const ViewportArguments& arguments) const
+{
+    m_client->dispatchViewportDataDidChange(arguments);
+}
+
 void Chrome::setCursor(const Cursor& cursor)
 {
     m_client->setCursor(cursor);
diff --git a/WebCore/page/Chrome.h b/WebCore/page/Chrome.h
index 5ee8897..1897b79 100644
--- a/WebCore/page/Chrome.h
+++ b/WebCore/page/Chrome.h
@@ -53,6 +53,7 @@ namespace WebCore {
 #endif
 
     struct FrameLoadRequest;
+    struct ViewportArguments;
     struct WindowFeatures;
     
     class Chrome : public HostWindow {
@@ -139,6 +140,8 @@ namespace WebCore {
         void runOpenPanel(Frame*, PassRefPtr<FileChooser>);
         void chooseIconForFiles(const Vector<String>&, FileChooser*);
 
+        void dispatchViewportDataDidChange(const ViewportArguments&) const;
+
 #if PLATFORM(MAC)
         void focusNSView(NSView*);
 #endif
diff --git a/WebCore/page/ChromeClient.h b/WebCore/page/ChromeClient.h
index bf6c157..29a54c9 100644
--- a/WebCore/page/ChromeClient.h
+++ b/WebCore/page/ChromeClient.h
@@ -146,6 +146,8 @@ namespace WebCore {
         virtual void setCursor(const Cursor&) = 0;
         // End methods used by HostWindow.
 
+        virtual void dispatchViewportDataDidChange(const ViewportArguments&) const { }
+
         virtual void contentsSizeChanged(Frame*, const IntSize&) const = 0;
         virtual void scrollRectIntoView(const IntRect&, const ScrollView*) const = 0; // Currently only Mac has a non empty implementation.
        
@@ -155,8 +157,6 @@ namespace WebCore {
 
         virtual void setToolTip(const String&, TextDirection) = 0;
 
-        virtual void didReceiveViewportArguments(Frame*, const ViewportArguments&) const { }
-
         virtual void print(Frame*) = 0;
 
 #if ENABLE(DATABASE)
@@ -233,8 +233,6 @@ namespace WebCore {
         virtual bool allowsAcceleratedCompositing() const { return true; }
 #endif
 
-        virtual SharedGraphicsContext3D* getSharedGraphicsContext3D() { return 0; }
-
         virtual bool supportsFullscreenForNode(const Node*) { return false; }
         virtual void enterFullscreenForNode(Node*) { }
         virtual void exitFullscreenForNode(Node*) { }
diff --git a/WebCore/page/Console.cpp b/WebCore/page/Console.cpp
index 9cc8d5d..2d4cc98 100644
--- a/WebCore/page/Console.cpp
+++ b/WebCore/page/Console.cpp
@@ -182,7 +182,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
 
     String message;
     if (getFirstArgumentAsString(callStack->state(), lastCaller, message))
-        page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL().prettyURL());
+        page->chrome()->client()->addMessageToConsole(JSMessageSource, type, level, message, lastCaller.lineNumber(), lastCaller.sourceURL());
 
 #if ENABLE(INSPECTOR)
     page->inspectorController()->addMessageToConsole(JSMessageSource, type, level, callStack, message);
@@ -191,7 +191,7 @@ void Console::addMessage(MessageType type, MessageLevel level, ScriptCallStack*
     if (!Console::shouldPrintExceptions())
         return;
 
-    printSourceURLAndLine(lastCaller.sourceURL().prettyURL(), 0);
+    printSourceURLAndLine(lastCaller.sourceURL(), 0);
     printMessageSourceAndLevelPrefix(JSMessageSource, level);
 
     for (unsigned i = 0; i < lastCaller.argumentCount(); ++i) {
@@ -269,7 +269,7 @@ void Console::count(ScriptCallStack* callStack)
     String title;
     getFirstArgumentAsString(callStack->state(), lastCaller, title);
 
-    page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+    page->inspectorController()->count(title, lastCaller.lineNumber(), lastCaller.sourceURL());
 #else
     UNUSED_PARAM(callStack);
 #endif
@@ -413,7 +413,7 @@ void Console::timeEnd(const String& title, ScriptCallStack* callStack)
     String message = title + String::format(": %.0fms", elapsed);
 
     const ScriptCallFrame& lastCaller = callStack->at(0);
-    page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL().string());
+    page->inspectorController()->addMessageToConsole(JSMessageSource, LogMessageType, LogMessageLevel, message, lastCaller.lineNumber(), lastCaller.sourceURL());
 #else
     UNUSED_PARAM(title);
     UNUSED_PARAM(callStack);
diff --git a/WebCore/page/DOMSelection.cpp b/WebCore/page/DOMSelection.cpp
index 6c25103..03172b5 100644
--- a/WebCore/page/DOMSelection.cpp
+++ b/WebCore/page/DOMSelection.cpp
@@ -370,7 +370,7 @@ PassRefPtr<Range> DOMSelection::getRangeAt(int index, ExceptionCode& ec)
     ASSERT(rangeCount() == 1);
 
     if (Node* shadowAncestor = selectionShadowAncestor(m_frame)) {
-        Node* container = shadowAncestor->parentNode();
+        ContainerNode* container = shadowAncestor->parentNode();
         int offset = shadowAncestor->nodeIndex();
         return Range::create(shadowAncestor->document(), container, offset, container, offset);
     }
@@ -460,7 +460,7 @@ bool DOMSelection::containsNode(const Node* n, bool allowPartial) const
     if (!n || m_frame->document() != n->document() || selection->isNone())
         return false;
 
-    Node* parentNode = n->parentNode();
+    ContainerNode* parentNode = n->parentNode();
     unsigned nodeIndex = n->nodeIndex();
     RefPtr<Range> selectedRange = selection->selection().toNormalizedRange();
 
diff --git a/WebCore/page/DOMTimer.cpp b/WebCore/page/DOMTimer.cpp
index 3ac6d15..57e6512 100644
--- a/WebCore/page/DOMTimer.cpp
+++ b/WebCore/page/DOMTimer.cpp
@@ -27,7 +27,7 @@
 #include "config.h"
 #include "DOMTimer.h"
 
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "ScheduledAction.h"
 #include "ScriptExecutionContext.h"
 #include <wtf/HashSet.h>
@@ -81,10 +81,7 @@ int DOMTimer::install(ScriptExecutionContext* context, PassOwnPtr<ScheduledActio
     // or if it is a one-time timer and it has fired (DOMTimer::fired).
     DOMTimer* timer = new DOMTimer(context, action, timeout, singleShot);
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
-        timelineAgent->didInstallTimer(timer->m_timeoutId, timeout, singleShot);
-#endif    
+    InspectorInstrumentation::didInstallTimer(context, timer->m_timeoutId, timeout, singleShot);
 
     return timer->m_timeoutId;
 }
@@ -97,10 +94,7 @@ void DOMTimer::removeById(ScriptExecutionContext* context, int timeoutId)
     if (timeoutId <= 0)
         return;
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
-        timelineAgent->didRemoveTimer(timeoutId);
-#endif
+    InspectorInstrumentation::didRemoveTimer(context, timeoutId);
 
     delete context->findTimeout(timeoutId);
 }
@@ -110,10 +104,7 @@ void DOMTimer::fired()
     ScriptExecutionContext* context = scriptExecutionContext();
     timerNestingLevel = m_nestingLevel;
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
-        timelineAgent->willFireTimer(m_timeoutId);
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willFireTimer(context, m_timeoutId);
 
     // Simple case for non-one-shot timers.
     if (isActive()) {
@@ -125,10 +116,9 @@ void DOMTimer::fired()
 
         // No access to member variables after this point, it can delete the timer.
         m_action->execute(context);
-#if ENABLE(INSPECTOR)
-        if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
-            timelineAgent->didFireTimer();
-#endif
+
+        InspectorInstrumentation::didFireTimer(cookie);
+
         return;
     }
 
@@ -140,10 +130,7 @@ void DOMTimer::fired()
 
     action->execute(context);
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(context))
-        timelineAgent->didFireTimer();
-#endif
+    InspectorInstrumentation::didFireTimer(cookie);
 
     timerNestingLevel = 0;
 }
diff --git a/WebCore/page/DOMTimer.h b/WebCore/page/DOMTimer.h
index c1d8d9e..4fc6aae 100644
--- a/WebCore/page/DOMTimer.h
+++ b/WebCore/page/DOMTimer.h
@@ -34,8 +34,6 @@
 
 namespace WebCore {
 
-    class InspectorTimelineAgent;
-
     class DOMTimer : public SuspendableTimer {
     public:
         virtual ~DOMTimer();
diff --git a/WebCore/page/DOMWindow.cpp b/WebCore/page/DOMWindow.cpp
index 200b82a..1c811cc 100644
--- a/WebCore/page/DOMWindow.cpp
+++ b/WebCore/page/DOMWindow.cpp
@@ -62,7 +62,7 @@
 #include "IDBFactory.h"
 #include "IDBFactoryBackendInterface.h"
 #include "InspectorController.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "KURL.h"
 #include "Location.h"
 #include "StyleMedia.h"
@@ -86,7 +86,7 @@
 #include <algorithm>
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #if ENABLE(FILE_SYSTEM)
 #include "AsyncFileSystem.h"
@@ -700,7 +700,7 @@ void DOMWindow::pageDestroyed()
 }
 
 #if ENABLE(INDEXED_DATABASE)
-IDBFactory* DOMWindow::indexedDB() const
+IDBFactory* DOMWindow::webkitIndexedDB() const
 {
     if (m_idbFactory)
         return m_idbFactory.get();
@@ -740,7 +740,7 @@ void DOMWindow::requestFileSystem(int type, long long size, PassRefPtr<FileSyste
         return;
     }
 
-    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document));
+    LocalFileSystem::localFileSystem().requestFileSystem(document, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, document), false);
 }
 
 COMPILE_ASSERT(static_cast<int>(DOMWindow::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
@@ -798,8 +798,8 @@ void DOMWindow::postMessageTimerFired(PostMessageTimer* t)
     if (timer->targetOrigin()) {
         // Check target origin now since the target document may have changed since the simer was scheduled.
         if (!timer->targetOrigin()->isSameSchemeHostPort(document()->securityOrigin())) {
-            String message = String::format("Unable to post message to %s. Recipient has origin %s.\n", 
-                timer->targetOrigin()->toString().utf8().data(), document()->securityOrigin()->toString().utf8().data());
+            String message = makeString("Unable to post message to ", timer->targetOrigin()->toString(),
+                                        ". Recipient has origin ", document()->securityOrigin()->toString(), ".\n");
             console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, message, 0, String());
             return;
         }
@@ -993,11 +993,8 @@ String DOMWindow::atob(const String& encodedString, ExceptionCode& ec)
         return String();
     }
 
-    Vector<char> in;
-    in.append(encodedString.characters(), encodedString.length());
     Vector<char> out;
-
-    if (!base64Decode(in, out)) {
+    if (!base64Decode(encodedString, out, FailOnInvalidCharacter)) {
         ec = INVALID_CHARACTER_ERR;
         return String();
     }
@@ -1541,15 +1538,6 @@ void DOMWindow::dispatchLoadEvent()
 #endif
 }
 
-#if ENABLE(INSPECTOR)
-InspectorTimelineAgent* DOMWindow::inspectorTimelineAgent() 
-{
-    if (frame() && frame()->page())
-        return frame()->page()->inspectorTimelineAgent();
-    return 0;
-}
-#endif
-
 bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget> prpTarget)
 {
     RefPtr<EventTarget> protect = this;
@@ -1559,23 +1547,11 @@ bool DOMWindow::dispatchEvent(PassRefPtr<Event> prpEvent, PassRefPtr<EventTarget
     event->setCurrentTarget(this);
     event->setEventPhase(Event::AT_TARGET);
 
-#if ENABLE(INSPECTOR)
-    Page* inspectedPage = InspectorTimelineAgent::instanceCount() && frame() ? frame()->page() : 0;
-    if (inspectedPage) {
-        if (InspectorTimelineAgent* timelineAgent = hasEventListeners(event->type()) ? inspectedPage->inspectorTimelineAgent() : 0)
-            timelineAgent->willDispatchEvent(*event);
-        else
-            inspectedPage = 0;
-    }
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willDispatchEventOnWindow(frame(), *event, this);
 
     bool result = fireEventListeners(event.get());
 
-#if ENABLE(INSPECTOR)
-    if (inspectedPage)
-        if (InspectorTimelineAgent* timelineAgent = inspectedPage->inspectorTimelineAgent())
-            timelineAgent->didDispatchEvent();
-#endif
+    InspectorInstrumentation::didDispatchEventOnWindow(cookie);
 
     return result;
 }
@@ -1616,12 +1592,12 @@ EventTargetData* DOMWindow::ensureEventTargetData()
 }
 
 #if ENABLE(BLOB)
-String DOMWindow::createBlobURL(Blob* blob)
+String DOMWindow::createObjectURL(Blob* blob)
 {
     return scriptExecutionContext()->createPublicBlobURL(blob).string();
 }
 
-void DOMWindow::revokeBlobURL(const String& blobURLString)
+void DOMWindow::revokeObjectURL(const String& blobURLString)
 {
     scriptExecutionContext()->revokePublicBlobURL(KURL(KURL(), blobURLString));
 }
diff --git a/WebCore/page/DOMWindow.h b/WebCore/page/DOMWindow.h
index 6fd3775..2156791 100644
--- a/WebCore/page/DOMWindow.h
+++ b/WebCore/page/DOMWindow.h
@@ -57,7 +57,6 @@ namespace WebCore {
     class Frame;
     class History;
     class IDBFactory;
-    class InspectorTimelineAgent;
     class Location;
     class StyleMedia;
     class Navigator;
@@ -235,7 +234,7 @@ namespace WebCore {
         void pageDestroyed();
 
 #if ENABLE(INDEXED_DATABASE)
-        IDBFactory* indexedDB() const;
+        IDBFactory* webkitIndexedDB() const;
 #endif
 
 #if ENABLE(FILE_SYSTEM)
@@ -393,8 +392,8 @@ namespace WebCore {
         DOMApplicationCache* optionalApplicationCache() const { return m_applicationCache.get(); }
 #endif
 #if ENABLE(BLOB)
-        String createBlobURL(Blob*);
-        void revokeBlobURL(const String&);
+        String createObjectURL(Blob*);
+        void revokeObjectURL(const String&);
 #endif
 
         using RefCounted<DOMWindow>::ref;
@@ -407,7 +406,6 @@ namespace WebCore {
         virtual void derefEventTarget() { deref(); }
         virtual EventTargetData* eventTargetData();
         virtual EventTargetData* ensureEventTargetData();
-        InspectorTimelineAgent* inspectorTimelineAgent();
 
         RefPtr<SecurityOrigin> m_securityOrigin;
         KURL m_url;
diff --git a/WebCore/page/DOMWindow.idl b/WebCore/page/DOMWindow.idl
index f7f9a85..cb504b9 100644
--- a/WebCore/page/DOMWindow.idl
+++ b/WebCore/page/DOMWindow.idl
@@ -38,7 +38,6 @@ module window {
         CustomNativeConverter,
         CustomPutFunction,
         EventTarget,
-        OmitConstructor,
         ExtendsDOMGlobalObject,
         GenerateNativeConverter,
         LegacyParent=JSDOMWindowBase
@@ -173,26 +172,26 @@ module window {
         readonly attribute [EnabledAtRuntime] NotificationCenter webkitNotifications;
 #endif
 #if defined(ENABLE_INDEXED_DATABASE) && ENABLE_INDEXED_DATABASE
-        readonly attribute [EnabledAtRuntime] IDBFactory indexedDB;
-
-        attribute [EnabledAtRuntime] IDBCursorConstructor IDBCursor;
-        attribute [EnabledAtRuntime] IDBDatabaseConstructor IDBDatabase;
-        attribute [EnabledAtRuntime] IDBDatabaseErrorConstructor IDBDatabaseError;
-        attribute [EnabledAtRuntime] IDBDatabaseExceptionConstructor IDBDatabaseException;
-        attribute [EnabledAtRuntime] IDBErrorEventConstructor IDBErrorEvent;
-        attribute [EnabledAtRuntime] IDBEventConstructor IDBEvent;
-        attribute [EnabledAtRuntime] IDBFactoryConstructor IDBFactory;
-        attribute [EnabledAtRuntime] IDBIndexConstructor IDBIndex;
-        attribute [EnabledAtRuntime] IDBKeyRangeConstructor IDBKeyRange;
-        attribute [EnabledAtRuntime] IDBObjectStoreConstructor IDBObjectStore;
-        attribute [EnabledAtRuntime] IDBRequestConstructor IDBRequest;
-        attribute [EnabledAtRuntime] IDBSuccessEventConstructor IDBSuccessEvent;
-        attribute [EnabledAtRuntime] IDBTransactionConstructor IDBTransaction;
+        readonly attribute [EnabledAtRuntime] IDBFactory webkitIndexedDB;
+
+        attribute [EnabledAtRuntime] IDBCursorConstructor webkitIDBCursor;
+        attribute [EnabledAtRuntime] IDBDatabaseConstructor webkitIDBDatabase;
+        attribute [EnabledAtRuntime] IDBDatabaseErrorConstructor webkitIDBDatabaseError;
+        attribute [EnabledAtRuntime] IDBDatabaseExceptionConstructor webkitIDBDatabaseException;
+        attribute [EnabledAtRuntime] IDBErrorEventConstructor webkitIDBErrorEvent;
+        attribute [EnabledAtRuntime] IDBEventConstructor webkitIDBEvent;
+        attribute [EnabledAtRuntime] IDBFactoryConstructor webkitIDBFactory;
+        attribute [EnabledAtRuntime] IDBIndexConstructor webkitIDBIndex;
+        attribute [EnabledAtRuntime] IDBKeyRangeConstructor webkitIDBKeyRange;
+        attribute [EnabledAtRuntime] IDBObjectStoreConstructor webkitIDBObjectStore;
+        attribute [EnabledAtRuntime] IDBRequestConstructor webkitIDBRequest;
+        attribute [EnabledAtRuntime] IDBSuccessEventConstructor webkitIDBSuccessEvent;
+        attribute [EnabledAtRuntime] IDBTransactionConstructor webkitIDBTransaction;
 #endif
 #if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
-        [EnabledAtRuntime] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
 
         attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
 #endif
@@ -488,14 +487,14 @@ module window {
 
         attribute DOMStringMapConstructor DOMStringMap;
 
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
-        attribute [JSCCustomGetter,Conditional=3D_CANVAS,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
+        attribute [JSCCustomGetter,Conditional=3D_CANVAS|BLOB,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
 
         attribute EventConstructor Event;
         attribute BeforeLoadEventConstructor BeforeLoadEvent;
@@ -765,8 +764,8 @@ module window {
         attribute [Conditional=BLOB] BlobBuilderConstructor BlobBuilder;
 
 #if defined(ENABLE_BLOB) && ENABLE_BLOB
-        [ConvertNullStringTo=Undefined] DOMString createBlobURL(in Blob blob);
-        void revokeBlobURL(in DOMString blobURL);
+        [ConvertNullStringTo=Undefined] DOMString createObjectURL(in Blob blob);
+        void revokeObjectURL(in DOMString blobURL);
 #endif
 
 #endif // defined(LANGUAGE_JAVASCRIPT)
diff --git a/WebCore/page/FocusController.cpp b/WebCore/page/FocusController.cpp
index 1ac50cb..622bf39 100644
--- a/WebCore/page/FocusController.cpp
+++ b/WebCore/page/FocusController.cpp
@@ -298,7 +298,7 @@ bool FocusController::advanceFocusDirectionally(FocusDirection direction, Keyboa
     if (!focusedNode) {
         // Just move to the first focusable node.
         FocusDirection tabDirection = (direction == FocusDirectionUp || direction == FocusDirectionLeft) ?
-                                       FocusDirectionForward : FocusDirectionBackward;
+                                       FocusDirectionBackward : FocusDirectionForward;
         // 'initialFocus' is set to true so the chrome is not focused.
         return advanceFocusInDocumentOrder(tabDirection, event, true);
     }
diff --git a/WebCore/page/Frame.cpp b/WebCore/page/Frame.cpp
index 9817e87..1b476a0 100755..100644
--- a/WebCore/page/Frame.cpp
+++ b/WebCore/page/Frame.cpp
@@ -153,7 +153,7 @@ inline Frame::Frame(Page* page, HTMLFrameOwnerElement* ownerElement, FrameLoader
     : m_page(page)
     , m_treeNode(this, parentFromOwnerElement(ownerElement))
     , m_loader(this, frameLoaderClient)
-    , m_redirectScheduler(this)
+    , m_navigationScheduler(this)
     , m_ownerElement(ownerElement)
     , m_script(this)
     , m_editor(this)
@@ -292,6 +292,9 @@ void Frame::setDocument(PassRefPtr<Document> newDoc)
 
     // Update the cached 'document' property, which is now stale.
     m_script.updateDocument();
+
+    if (m_page)
+        m_page->updateViewportArguments();
 }
 
 #if ENABLE(ORIENTATION_EVENTS)
@@ -344,35 +347,25 @@ static RegularExpression* createRegExpForLabels(const Vector<String>& labels)
 
 String Frame::searchForLabelsAboveCell(RegularExpression* regExp, HTMLTableCellElement* cell, size_t* resultDistanceFromStartOfCell)
 {
-    RenderObject* cellRenderer = cell->renderer();
-
-    if (cellRenderer && cellRenderer->isTableCell()) {
-        RenderTableCell* tableCellRenderer = toRenderTableCell(cellRenderer);
-        RenderTableCell* cellAboveRenderer = tableCellRenderer->table()->cellAbove(tableCellRenderer);
-
-        if (cellAboveRenderer) {
-            HTMLTableCellElement* aboveCell =
-                static_cast<HTMLTableCellElement*>(cellAboveRenderer->node());
-
-            if (aboveCell) {
-                // search within the above cell we found for a match
-                size_t lengthSearched = 0;    
-                for (Node* n = aboveCell->firstChild(); n; n = n->traverseNextNode(aboveCell)) {
-                    if (n->isTextNode() && n->renderer() && n->renderer()->style()->visibility() == VISIBLE) {
-                        // For each text chunk, run the regexp
-                        String nodeString = n->nodeValue();
-                        int pos = regExp->searchRev(nodeString);
-                        if (pos >= 0) {
-                            if (resultDistanceFromStartOfCell)
-                                *resultDistanceFromStartOfCell = lengthSearched;
-                            return nodeString.substring(pos, regExp->matchedLength());
-                        }
-                        lengthSearched += nodeString.length();
-                    }
+    HTMLTableCellElement* aboveCell = cell->cellAbove();
+    if (aboveCell) {
+        // search within the above cell we found for a match
+        size_t lengthSearched = 0;    
+        for (Node* n = aboveCell->firstChild(); n; n = n->traverseNextNode(aboveCell)) {
+            if (n->isTextNode() && n->renderer() && n->renderer()->style()->visibility() == VISIBLE) {
+                // For each text chunk, run the regexp
+                String nodeString = n->nodeValue();
+                int pos = regExp->searchRev(nodeString);
+                if (pos >= 0) {
+                    if (resultDistanceFromStartOfCell)
+                        *resultDistanceFromStartOfCell = lengthSearched;
+                    return nodeString.substring(pos, regExp->matchedLength());
                 }
+                lengthSearched += nodeString.length();
             }
         }
     }
+
     // Any reason in practice to search all cells in that are above cell?
     if (resultDistanceFromStartOfCell)
         *resultDistanceFromStartOfCell = notFound;
diff --git a/WebCore/page/Frame.h b/WebCore/page/Frame.h
index c09c330..b48f5c8 100644
--- a/WebCore/page/Frame.h
+++ b/WebCore/page/Frame.h
@@ -93,7 +93,7 @@ namespace WebCore {
         Editor* editor() const;
         EventHandler* eventHandler() const;
         FrameLoader* loader() const;
-        RedirectScheduler* redirectScheduler() const;
+        NavigationScheduler* navigationScheduler() const;
         SelectionController* selection() const;
         FrameTree* tree() const;
         AnimationController* animation() const;
@@ -194,7 +194,7 @@ namespace WebCore {
         Page* m_page;
         mutable FrameTree m_treeNode;
         mutable FrameLoader m_loader;
-        mutable RedirectScheduler m_redirectScheduler;
+        mutable NavigationScheduler m_navigationScheduler;
 
         mutable RefPtr<DOMWindow> m_domWindow;
         HashSet<DOMWindow*> m_liveFormerWindows;
@@ -252,9 +252,9 @@ namespace WebCore {
         return &m_loader;
     }
 
-    inline RedirectScheduler* Frame::redirectScheduler() const
+    inline NavigationScheduler* Frame::navigationScheduler() const
     {
-        return &m_redirectScheduler;
+        return &m_navigationScheduler;
     }
 
     inline FrameView* Frame::view() const
diff --git a/WebCore/page/FrameView.cpp b/WebCore/page/FrameView.cpp
index 9a4daa7..660cdfb 100644
--- a/WebCore/page/FrameView.cpp
+++ b/WebCore/page/FrameView.cpp
@@ -45,7 +45,7 @@
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
 #include "HTMLPlugInImageElement.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "OverflowEvent.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderLayer.h"
@@ -387,9 +387,9 @@ void FrameView::updateCanHaveScrollbars()
     ScrollbarMode vMode;
     scrollbarModes(hMode, vMode);
     if (hMode == ScrollbarAlwaysOff && vMode == ScrollbarAlwaysOff)
-        m_canHaveScrollbars = false;
+        setCanHaveScrollbars(false);
     else
-        m_canHaveScrollbars = true;
+        setCanHaveScrollbars(true);
 }
 
 PassRefPtr<Scrollbar> FrameView::createScrollbar(ScrollbarOrientation orientation)
@@ -486,6 +486,58 @@ void FrameView::applyOverflowToViewport(RenderObject* o, ScrollbarMode& hMode, S
     m_viewportRenderer = o;
 }
 
+void FrameView::calculateScrollbarModesForLayout(ScrollbarMode& hMode, ScrollbarMode& vMode)
+{
+    if (m_canHaveScrollbars) {
+        hMode = ScrollbarAuto;
+        vMode = ScrollbarAuto;
+    } else {
+        hMode = ScrollbarAlwaysOff;
+        vMode = ScrollbarAlwaysOff;
+    }
+    
+    if (!m_layoutRoot) {
+        Document* document = m_frame->document();
+        Node* documentElement = document->documentElement();
+        RenderObject* rootRenderer = documentElement ? documentElement->renderer() : 0;
+        Node* body = document->body();
+        if (body && body->renderer()) {
+            if (body->hasTagName(framesetTag) && m_frame->settings() && !m_frame->settings()->frameFlatteningEnabled()) {
+                body->renderer()->setChildNeedsLayout(true);
+                vMode = ScrollbarAlwaysOff;
+                hMode = ScrollbarAlwaysOff;
+            } else if (body->hasTagName(bodyTag)) {
+                if (!m_firstLayout && m_size.height() != layoutHeight() && body->renderer()->enclosingBox()->stretchesToViewport())
+                    body->renderer()->setChildNeedsLayout(true);
+                // It's sufficient to just check the X overflow,
+                // since it's illegal to have visible in only one direction.
+                RenderObject* o = rootRenderer->style()->overflowX() == OVISIBLE && document->documentElement()->hasTagName(htmlTag) ? body->renderer() : rootRenderer;
+                applyOverflowToViewport(o, hMode, vMode);
+            }
+        } else if (rootRenderer) {
+#if ENABLE(SVG)
+            if (documentElement->isSVGElement()) {
+                if (!m_firstLayout && (m_size.width() != layoutWidth() || m_size.height() != layoutHeight()))
+                    rootRenderer->setChildNeedsLayout(true);
+            } else
+                applyOverflowToViewport(rootRenderer, hMode, vMode);
+#else
+            applyOverflowToViewport(rootRenderer, hMode, vMode);
+#endif
+        }
+#ifdef INSTRUMENT_LAYOUT_SCHEDULING
+        if (m_firstLayout && !document->ownerElement())
+            printf("Elapsed time before first layout: %d\n", document->elapsedTime());
+#endif
+    }
+    
+    HTMLFrameOwnerElement* owner = m_frame->ownerElement();
+    if (owner && (owner->scrollingMode() == ScrollbarAlwaysOff)) {
+        hMode = ScrollbarAlwaysOff;
+        vMode = ScrollbarAlwaysOff;
+    }     
+}
+    
 #if USE(ACCELERATED_COMPOSITING)
 void FrameView::updateCompositingLayers()
 {
@@ -626,10 +678,7 @@ void FrameView::layout(bool allowSubtree)
     if (isPainting())
         return;
 
-#if ENABLE(INSPECTOR)    
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->willLayout();
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willLayout(m_frame.get());
 
     if (!allowSubtree && m_layoutRoot) {
         m_layoutRoot->markContainingBlocksForLayout(false);
@@ -683,6 +732,7 @@ void FrameView::layout(bool allowSubtree)
 
     ScrollbarMode hMode;
     ScrollbarMode vMode;
+<<<<<<< HEAD
     if (m_canHaveScrollbars) {
         hMode = ScrollbarAuto;
         vMode = ScrollbarAuto;
@@ -726,6 +776,10 @@ void FrameView::layout(bool allowSubtree)
             printf("Elapsed time before first layout: %d\n", document->elapsedTime());
 #endif
     }
+=======
+    
+    calculateScrollbarModesForLayout(hMode, vMode);
+>>>>>>> webkit.org at r70209
 
     m_doFullRepaint = !subtree && (m_firstLayout || toRenderView(root)->printing());
 
@@ -860,10 +914,7 @@ void FrameView::layout(bool allowSubtree)
         ASSERT(m_enqueueEvents);
     }
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->didLayout();
-#endif
+    InspectorInstrumentation::didLayout(cookie);
 
     m_nestedLayoutCount--;
 }
@@ -1970,10 +2021,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (!frame())
         return;
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->willPaint(rect);
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_frame.get(), rect);
 
     Document* document = frame()->document();
 
@@ -1993,7 +2041,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
         fillWithRed = true;
     
     if (fillWithRed)
-        p->fillRect(rect, Color(0xFF, 0, 0), DeviceColorSpace);
+        p->fillRect(rect, Color(0xFF, 0, 0), ColorSpaceDeviceRGB);
 #endif
 
     bool isTopLevelPainter = !sCurrentPaintTimeStamp;
@@ -2047,10 +2095,7 @@ void FrameView::paintContents(GraphicsContext* p, const IntRect& rect)
     if (isTopLevelPainter)
         sCurrentPaintTimeStamp = 0;
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent())
-        timelineAgent->didPaint();
-#endif
+    InspectorInstrumentation::didPaint(cookie);
 }
 
 void FrameView::setPaintBehavior(PaintBehavior behavior)
diff --git a/WebCore/page/FrameView.h b/WebCore/page/FrameView.h
index 22c05be..1518233 100644
--- a/WebCore/page/FrameView.h
+++ b/WebCore/page/FrameView.h
@@ -25,9 +25,9 @@
 #ifndef FrameView_h
 #define FrameView_h
 
-#include "Frame.h" // Only used by FrameView::inspectorTimelineAgent()
+#include "Frame.h"
 #include "IntSize.h"
-#include "Page.h" // Only used by FrameView::inspectorTimelineAgent()
+#include "Page.h"
 #include "RenderObject.h" // For PaintBehavior
 #include "ScrollView.h"
 #include <wtf/Forward.h>
@@ -38,7 +38,6 @@ namespace WebCore {
 class Color;
 class Event;
 class FrameViewPrivate;
-class InspectorTimelineAgent;
 class IntRect;
 class Node;
 class PlatformMouseEvent;
@@ -259,6 +258,7 @@ private:
     bool hasFixedObjects() const { return m_fixedObjectCount > 0; }
 
     void applyOverflowToViewport(RenderObject*, ScrollbarMode& hMode, ScrollbarMode& vMode);
+    void calculateScrollbarModesForLayout(ScrollbarMode& hMode, ScrollbarMode& vMode);
 
     void updateOverflowStatus(bool horizontalOverflow, bool verticalOverflow);
 
@@ -293,10 +293,6 @@ private:
     void scrollToAnchor();
     void scrollPositionChanged();
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* inspectorTimelineAgent() const;
-#endif
-    
     bool hasCustomScrollbars() const;
 
     virtual void updateScrollCorner();
@@ -386,13 +382,6 @@ private:
     static double s_deferredRepaintDelayIncrementDuringLoading;
 };
 
-#if ENABLE(INSPECTOR)
-inline InspectorTimelineAgent* FrameView::inspectorTimelineAgent() const
-{
-    return m_frame->page() ? m_frame->page()->inspectorTimelineAgent() : 0;
-}
-#endif
-
 } // namespace WebCore
 
 #endif // FrameView_h
diff --git a/WebCore/page/Geolocation.cpp b/WebCore/page/Geolocation.cpp
index 44e28fa..de01b66 100644
--- a/WebCore/page/Geolocation.cpp
+++ b/WebCore/page/Geolocation.cpp
@@ -718,7 +718,7 @@ void Geolocation::handlePendingPermissionNotifiers()
 
 namespace WebCore {
 
-void Geolocation::clearWatch(int watchId) {}
+void Geolocation::clearWatch(int) {}
 
 void Geolocation::disconnectFrame() {}
 
diff --git a/WebCore/page/GroupSettings.cpp b/WebCore/page/GroupSettings.cpp
index 58ab74d..0762861 100644
--- a/WebCore/page/GroupSettings.cpp
+++ b/WebCore/page/GroupSettings.cpp
@@ -30,6 +30,7 @@ namespace WebCore {
 
 GroupSettings::GroupSettings()
     : m_localStorageQuotaBytes(5 * 1024 * 1024) // Suggested by the HTML5 spec.
+    , m_indexedDBQuotaBytes(5 * 1024 * 1024)
 {
 }
 
@@ -43,4 +44,10 @@ void GroupSettings::setIndexedDBDatabasePath(const String& path)
     m_indexedDBDatabasePath = path;
 }
 
+void GroupSettings::setIndexedDBQuotaBytes(int64_t quota)
+{
+    m_indexedDBQuotaBytes = quota;
+}
+
+
 } // namespace WebCore
diff --git a/WebCore/page/GroupSettings.h b/WebCore/page/GroupSettings.h
index 62a5dd2..fb6f6b5 100644
--- a/WebCore/page/GroupSettings.h
+++ b/WebCore/page/GroupSettings.h
@@ -43,6 +43,9 @@ public:
     void setLocalStorageQuotaBytes(unsigned);
     unsigned localStorageQuotaBytes() const { return m_localStorageQuotaBytes; }
 
+    void setIndexedDBQuotaBytes(int64_t);
+    int64_t indexedDBQuotaBytes() const { return m_indexedDBQuotaBytes; }
+
     void setIndexedDBDatabasePath(const String&);
     const String& indexedDBDatabasePath() const { return m_indexedDBDatabasePath; }
 
@@ -51,6 +54,7 @@ private:
 
     unsigned m_localStorageQuotaBytes;
     String m_indexedDBDatabasePath;
+    int64_t m_indexedDBQuotaBytes;
 };
 
 } // namespace WebCore
diff --git a/WebCore/page/History.cpp b/WebCore/page/History.cpp
index 337f5b2..3d463b6 100644
--- a/WebCore/page/History.cpp
+++ b/WebCore/page/History.cpp
@@ -63,21 +63,21 @@ void History::back()
 {
     if (!m_frame)
         return;
-    m_frame->redirectScheduler()->scheduleHistoryNavigation(-1);
+    m_frame->navigationScheduler()->scheduleHistoryNavigation(-1);
 }
 
 void History::forward()
 {
     if (!m_frame)
         return;
-    m_frame->redirectScheduler()->scheduleHistoryNavigation(1);
+    m_frame->navigationScheduler()->scheduleHistoryNavigation(1);
 }
 
 void History::go(int distance)
 {
     if (!m_frame)
         return;
-    m_frame->redirectScheduler()->scheduleHistoryNavigation(distance);
+    m_frame->navigationScheduler()->scheduleHistoryNavigation(distance);
 }
 
 KURL History::urlForState(const String& urlString)
diff --git a/WebCore/page/Location.cpp b/WebCore/page/Location.cpp
index c02304c..78809e3 100644
--- a/WebCore/page/Location.cpp
+++ b/WebCore/page/Location.cpp
@@ -138,6 +138,16 @@ String Location::hash() const
     return fragmentIdentifier.isEmpty() ? "" : "#" + fragmentIdentifier;
 }
 
+String Location::getParameter(const String& name) const
+{
+    if (!m_frame)
+        return String();
+
+    ParsedURLParameters parameters;
+    url().copyParsedQueryTo(parameters);
+    return parameters.get(name);
+}
+
 String Location::toString() const
 {
     if (!m_frame)
diff --git a/WebCore/page/Location.h b/WebCore/page/Location.h
index a4bc407..c62f5aa 100644
--- a/WebCore/page/Location.h
+++ b/WebCore/page/Location.h
@@ -59,6 +59,8 @@ namespace WebCore {
 
         String toString() const;
 
+        String getParameter(const String&) const;
+
     private:
         Location(Frame*);
 
diff --git a/WebCore/page/Location.idl b/WebCore/page/Location.idl
index 1668e05..76340d9 100644
--- a/WebCore/page/Location.idl
+++ b/WebCore/page/Location.idl
@@ -62,6 +62,8 @@ module window {
                  readonly attribute DOMString origin;
 #endif
 
+        DOMString getParameter(in DOMString name);
+
 #if defined(LANGUAGE_JAVASCRIPT) && LANGUAGE_JAVASCRIPT
         [DontEnum, Custom, V8OnInstance, V8ReadOnly] DOMString toString();
 #endif
diff --git a/WebCore/page/Page.cpp b/WebCore/page/Page.cpp
index 379d3f3..5609e28 100644
--- a/WebCore/page/Page.cpp
+++ b/WebCore/page/Page.cpp
@@ -20,7 +20,6 @@
 #include "config.h"
 #include "Page.h"
 
-#include "DeviceMotionController.h"
 #include "BackForwardController.h"
 #include "BackForwardList.h"
 #include "Base64.h"
@@ -30,6 +29,7 @@
 #include "ContextMenuClient.h"
 #include "ContextMenuController.h"
 #include "DOMWindow.h"
+#include "DeviceMotionController.h"
 #include "DeviceOrientationController.h"
 #include "DragController.h"
 #include "EditorClient.h"
@@ -46,7 +46,6 @@
 #include "HTMLElement.h"
 #include "HistoryItem.h"
 #include "InspectorController.h"
-#include "InspectorTimelineAgent.h"
 #include "Logging.h"
 #include "MediaCanStartListener.h"
 #include "Navigator.h"
@@ -55,6 +54,7 @@
 #include "PluginData.h"
 #include "PluginHalter.h"
 #include "PluginView.h"
+#include "PluginViewBase.h"
 #include "ProgressTracker.h"
 #include "RenderTheme.h"
 #include "RenderWidget.h"
@@ -72,6 +72,10 @@
 #include <wtf/StdLibExtras.h>
 #include <wtf/text/StringHash.h>
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+#include "SharedGraphicsContext3D.h"
+#endif
+
 #if ENABLE(DOM_STORAGE)
 #include "StorageArea.h"
 #include "StorageNamespace.h"
@@ -434,6 +438,15 @@ void Page::scheduleForcedStyleRecalcForAllPages()
             frame->document()->scheduleForcedStyleRecalc();
 }
 
+void Page::updateViewportArguments()
+{
+    if (!mainFrame() || !mainFrame()->document() || mainFrame()->document()->viewportArguments() == m_viewportArguments)
+        return;
+
+    m_viewportArguments = mainFrame()->document()->viewportArguments();
+    chrome()->dispatchViewportDataDidChange(m_viewportArguments);
+}
+
 void Page::refreshPlugins(bool reload)
 {
     if (!allPages)
@@ -639,22 +652,17 @@ void Page::userStyleSheetLocationChanged()
     m_didLoadUserStyleSheet = false;
     m_userStyleSheet = String();
     m_userStyleSheetModificationTime = 0;
-    
+
     // Data URLs with base64-encoded UTF-8 style sheets are common. We can process them
     // synchronously and avoid using a loader. 
-    if (url.protocolIs("data") && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
+    if (url.protocolIsData() && url.string().startsWith("data:text/css;charset=utf-8;base64,")) {
         m_didLoadUserStyleSheet = true;
-        
-        const unsigned prefixLength = 35;
-        Vector<char> encodedData(url.string().length() - prefixLength);
-        for (unsigned i = prefixLength; i < url.string().length(); ++i)
-            encodedData[i - prefixLength] = static_cast<char>(url.string()[i]);
 
         Vector<char> styleSheetAsUTF8;
-        if (base64Decode(encodedData, styleSheetAsUTF8))
+        if (base64Decode(decodeURLEscapeSequences(url.string().substring(35)), styleSheetAsUTF8, IgnoreWhitespace))
             m_userStyleSheet = String::fromUTF8(styleSheetAsUTF8.data(), styleSheetAsUTF8.size());
     }
-    
+
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
         if (frame->document())
             frame->document()->updatePageUserSheet();
@@ -773,6 +781,18 @@ void Page::setDebugger(JSC::Debugger* debugger)
         frame->script()->attachDebugger(m_debugger);
 }
 
+SharedGraphicsContext3D* Page::sharedGraphicsContext3D()
+{
+#if ENABLE(ACCELERATED_2D_CANVAS)
+    if (!m_sharedGraphicsContext3D)
+        m_sharedGraphicsContext3D = SharedGraphicsContext3D::create(chrome());
+
+    return m_sharedGraphicsContext3D.get();
+#else
+    return 0;
+#endif
+}
+
 #if ENABLE(DOM_STORAGE)
 StorageNamespace* Page::sessionStorage(bool optionalCreate)
 {
@@ -838,13 +858,6 @@ bool Page::javaScriptURLsAreAllowed() const
     return m_javaScriptURLsAreAllowed;
 }
 
-#if ENABLE(INSPECTOR)
-InspectorTimelineAgent* Page::inspectorTimelineAgent() const
-{
-    return m_inspectorController->timelineAgent();
-}
-#endif
-
 #if ENABLE(INPUT_SPEECH)
 SpeechInput* Page::speechInput()
 {
@@ -861,8 +874,7 @@ void Page::privateBrowsingStateChanged()
 
     // Collect the PluginViews in to a vector to ensure that action the plug-in takes
     // from below privateBrowsingStateChanged does not affect their lifetime.
-
-    Vector<RefPtr<PluginView>, 32> pluginViews;
+    Vector<RefPtr<PluginViewBase>, 32> pluginViewBases;
     for (Frame* frame = mainFrame(); frame; frame = frame->tree()->traverseNext()) {
         FrameView* view = frame->view();
         if (!view)
@@ -874,14 +886,13 @@ void Page::privateBrowsingStateChanged()
         HashSet<RefPtr<Widget> >::const_iterator end = children->end();
         for (HashSet<RefPtr<Widget> >::const_iterator it = children->begin(); it != end; ++it) {
             Widget* widget = (*it).get();
-            if (!widget->isPluginView())
-                continue;
-            pluginViews.append(static_cast<PluginView*>(widget));
+            if (widget->isPluginViewBase())
+                pluginViewBases.append(static_cast<PluginViewBase*>(widget));
         }
     }
 
-    for (size_t i = 0; i < pluginViews.size(); i++)
-        pluginViews[i]->privateBrowsingStateChanged(privateBrowsingEnabled);
+    for (size_t i = 0; i < pluginViewBases.size(); ++i)
+        pluginViewBases[i]->privateBrowsingStateChanged(privateBrowsingEnabled);
 }
 
 void Page::pluginAllowedRunTimeChanged()
diff --git a/WebCore/page/Page.h b/WebCore/page/Page.h
index 8f01faa..6ff64cf 100644
--- a/WebCore/page/Page.h
+++ b/WebCore/page/Page.h
@@ -23,6 +23,7 @@
 
 #include "FrameLoaderTypes.h"
 #include "PlatformString.h"
+#include "ViewportArguments.h"
 #include <wtf/Forward.h>
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
@@ -60,7 +61,6 @@ namespace WebCore {
     class HistoryItem;
     class InspectorClient;
     class InspectorController;
-    class InspectorTimelineAgent;
     class MediaCanStartListener;
     class Node;
     class PageGroup;
@@ -72,6 +72,7 @@ namespace WebCore {
     class VisibleSelection;
     class SelectionController;
     class Settings;
+    class SharedGraphicsContext3D;
     class SpeechInput;
     class SpeechInputClient;
 
@@ -127,6 +128,9 @@ namespace WebCore {
 
         RenderTheme* theme() const { return m_theme.get(); };
 
+        ViewportArguments viewportArguments() const { return m_viewportArguments; }
+        void updateViewportArguments();
+
         static void refreshPlugins(bool reload);
         PluginData* pluginData() const;
 
@@ -259,6 +263,8 @@ namespace WebCore {
         static void allVisitedStateChanged(PageGroup*);
         static void visitedStateChanged(PageGroup*, LinkHash visitedHash);
 
+        SharedGraphicsContext3D* sharedGraphicsContext3D();
+
 #if ENABLE(DOM_STORAGE)
         StorageNamespace* sessionStorage(bool optionalCreate = true);
         void setSessionStorage(PassRefPtr<StorageNamespace>);
@@ -282,10 +288,6 @@ namespace WebCore {
         void setJavaScriptURLsAreAllowed(bool);
         bool javaScriptURLsAreAllowed() const;
 
-#if ENABLE(INSPECTOR)
-        InspectorTimelineAgent* inspectorTimelineAgent() const;
-#endif
-
         // Don't allow more than a certain number of frames in a page.
         // This seems like a reasonable upper bound, and otherwise mutually
         // recursive frameset pages can quickly bring the program to its knees
@@ -304,6 +306,11 @@ namespace WebCore {
 
         OwnPtr<Chrome> m_chrome;
         OwnPtr<SelectionController> m_dragCaretController;
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+        RefPtr<SharedGraphicsContext3D> m_sharedGraphicsContext3D;
+#endif
+        
 #if ENABLE(DRAG_SUPPORT)
         OwnPtr<DragController> m_dragController;
 #endif
@@ -383,6 +390,8 @@ namespace WebCore {
 #endif
 
         ViewMode m_viewMode;
+
+        ViewportArguments m_viewportArguments;
     };
 
 } // namespace WebCore
diff --git a/WebCore/page/PrintContext.cpp b/WebCore/page/PrintContext.cpp
index 8cc7dd6..7acca96 100644
--- a/WebCore/page/PrintContext.cpp
+++ b/WebCore/page/PrintContext.cpp
@@ -26,7 +26,7 @@
 #include "FrameView.h"
 #include "RenderLayer.h"
 #include "RenderView.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
@@ -210,18 +210,18 @@ String PrintContext::pageProperty(Frame* frame, const char* propertyName, int pa
     if (!strcmp(propertyName, "margin-left")) {
         if (style->marginLeft().isAuto())
             return String("auto");
-        return String::format("%d", style->marginLeft().rawValue());
+        return String::number(style->marginLeft().rawValue());
     }
     if (!strcmp(propertyName, "line-height"))
-        return String::format("%d", style->lineHeight().rawValue());
+        return String::number(style->lineHeight().rawValue());
     if (!strcmp(propertyName, "font-size"))
-        return String::format("%d", style->fontDescription().computedPixelSize());
+        return String::number(style->fontDescription().computedPixelSize());
     if (!strcmp(propertyName, "font-family"))
-        return String::format("%s", style->fontDescription().family().family().string().utf8().data());
+        return style->fontDescription().family().family().string();
     if (!strcmp(propertyName, "size"))
-        return String::format("%d %d", style->pageSize().width().rawValue(), style->pageSize().height().rawValue());
+        return makeString(String::number(style->pageSize().width().rawValue()), ' ', String::number(style->pageSize().height().rawValue()));
 
-    return String::format("pageProperty() unimplemented for: %s", propertyName);
+    return makeString("pageProperty() unimplemented for: ", propertyName);
 }
 
 bool PrintContext::isPageBoxVisible(Frame* frame, int pageNumber)
@@ -233,7 +233,10 @@ String PrintContext::pageSizeAndMarginsInPixels(Frame* frame, int pageNumber, in
 {
     IntSize pageSize(width, height);
     frame->document()->pageSizeAndMarginsInPixels(pageNumber, pageSize, marginTop, marginRight, marginBottom, marginLeft);
-    return String::format("(%d, %d) %d %d %d %d", pageSize.width(), pageSize.height(), marginTop, marginRight, marginBottom, marginLeft);
+
+    // We don't have a makeString() function that takes up to 12 arguments, if this is a hot function, we can provide one.
+    return makeString('(', String::number(pageSize.width()), ", ", String::number(pageSize.height()), ") ") +
+           makeString(String::number(marginTop), ' ', String::number(marginRight), ' ', String::number(marginBottom), ' ', String::number(marginLeft));
 }
 
 int PrintContext::numberOfPages(Frame* frame, const FloatSize& pageSizeInPixels)
@@ -268,7 +271,7 @@ void PrintContext::spoolAllPagesWithBoundaries(Frame* frame, GraphicsContext& gr
     int totalHeight = pageRects.size() * (pageSizeInPixels.height() + 1) - 1;
 
     // Fill the whole background by white.
-    graphicsContext.setFillColor(Color(255, 255, 255), DeviceColorSpace);
+    graphicsContext.setFillColor(Color(255, 255, 255), ColorSpaceDeviceRGB);
     graphicsContext.fillRect(FloatRect(0, 0, pageWidth, totalHeight));
 
     graphicsContext.save();
@@ -280,8 +283,8 @@ void PrintContext::spoolAllPagesWithBoundaries(Frame* frame, GraphicsContext& gr
         // Draw a line for a page boundary if this isn't the first page.
         if (pageIndex > 0) {
             graphicsContext.save();
-            graphicsContext.setStrokeColor(Color(0, 0, 255), DeviceColorSpace);
-            graphicsContext.setFillColor(Color(0, 0, 255), DeviceColorSpace);
+            graphicsContext.setStrokeColor(Color(0, 0, 255), ColorSpaceDeviceRGB);
+            graphicsContext.setFillColor(Color(0, 0, 255), ColorSpaceDeviceRGB);
             graphicsContext.drawLine(IntPoint(0, currentHeight),
                                      IntPoint(pageWidth, currentHeight));
             graphicsContext.restore();
diff --git a/WebCore/page/Screen.cpp b/WebCore/page/Screen.cpp
index d2bb60f..bddc030 100644
--- a/WebCore/page/Screen.cpp
+++ b/WebCore/page/Screen.cpp
@@ -81,18 +81,18 @@ unsigned Screen::pixelDepth() const
     return static_cast<unsigned>(screenDepth(m_frame->view()));
 }
 
-unsigned Screen::availLeft() const
+int Screen::availLeft() const
 {
     if (!m_frame)
         return 0;
-    return static_cast<unsigned>(screenAvailableRect(m_frame->view()).x());
+    return static_cast<int>(screenAvailableRect(m_frame->view()).x());
 }
 
-unsigned Screen::availTop() const
+int Screen::availTop() const
 {
     if (!m_frame)
         return 0;
-    return static_cast<unsigned>(screenAvailableRect(m_frame->view()).y());
+    return static_cast<int>(screenAvailableRect(m_frame->view()).y());
 }
 
 unsigned Screen::availHeight() const
diff --git a/WebCore/page/Screen.h b/WebCore/page/Screen.h
index 2c84abd..5716d46 100644
--- a/WebCore/page/Screen.h
+++ b/WebCore/page/Screen.h
@@ -48,8 +48,8 @@ namespace WebCore {
         unsigned width() const;
         unsigned colorDepth() const;
         unsigned pixelDepth() const;
-        unsigned availLeft() const;
-        unsigned availTop() const;
+        int availLeft() const;
+        int availTop() const;
         unsigned availHeight() const;
         unsigned availWidth() const;
 
diff --git a/WebCore/page/Screen.idl b/WebCore/page/Screen.idl
index cd181eb..50f87ee 100644
--- a/WebCore/page/Screen.idl
+++ b/WebCore/page/Screen.idl
@@ -34,8 +34,8 @@ module window {
         readonly attribute unsigned long width;
         readonly attribute unsigned long colorDepth;
         readonly attribute unsigned long pixelDepth;
-        readonly attribute unsigned long availLeft;
-        readonly attribute unsigned long availTop;
+        readonly attribute long availLeft;
+        readonly attribute long availTop;
         readonly attribute unsigned long availHeight;
         readonly attribute unsigned long availWidth;
     };
diff --git a/WebCore/page/SecurityOrigin.cpp b/WebCore/page/SecurityOrigin.cpp
index 6001983..f0e999f 100644
--- a/WebCore/page/SecurityOrigin.cpp
+++ b/WebCore/page/SecurityOrigin.cpp
@@ -267,7 +267,7 @@ bool SecurityOrigin::taintsCanvas(const KURL& url) const
     // we special case data URLs below. If we change to match HTML5 w.r.t.
     // data URL security, then we can remove this function in favor of
     // !canRequest.
-    if (url.protocolIs("data"))
+    if (url.protocolIsData())
         return false;
 
     return true;
diff --git a/WebCore/page/Timing.cpp b/WebCore/page/Timing.cpp
index f65322b..8a0de2a 100644
--- a/WebCore/page/Timing.cpp
+++ b/WebCore/page/Timing.cpp
@@ -100,7 +100,7 @@ unsigned long long Timing::unloadEventEnd() const
 
     return toIntegerMilliseconds(timing->unloadEventEnd);
 }
-    
+
 unsigned long long Timing::redirectStart() const
 {
     DocumentLoadTiming* timing = documentLoadTiming();
@@ -109,7 +109,7 @@ unsigned long long Timing::redirectStart() const
 
     return toIntegerMilliseconds(timing->redirectStart);
 }
-    
+
 unsigned long long Timing::redirectEnd() const
 {
     DocumentLoadTiming* timing = documentLoadTiming();
@@ -218,12 +218,7 @@ unsigned long long Timing::requestStart() const
 
 unsigned long long Timing::requestEnd() const
 {
-    ResourceLoadTiming* timing = resourceLoadTiming();
-    if (!timing)
-        return 0;
-
-    ASSERT(timing->sendEnd >= 0);
-    return resourceLoadTimeRelativeToAbsolute(timing->sendEnd);
+    return responseStart();
 }
 
 unsigned long long Timing::responseStart() const
diff --git a/WebCore/page/XSSAuditor.cpp b/WebCore/page/XSSAuditor.cpp
index 0e6cc65..1940d52 100644
--- a/WebCore/page/XSSAuditor.cpp
+++ b/WebCore/page/XSSAuditor.cpp
@@ -41,8 +41,7 @@
 #include "Settings.h"
 #include "TextResourceDecoder.h"
 #include <wtf/text/CString.h>
-
-using namespace WTF;
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -203,7 +202,7 @@ bool XSSAuditor::canLoadObject(const String& url) const
     task.allowRequestIfNoIllegalURICharacters = true;
 
     if (findInRequest(task)) {
-        String consoleMessage = String::format("Refused to load an object. URL found within request: \"%s\".\n", url.utf8().data());
+        String consoleMessage = makeString("Refused to load an object. URL found within request: \"", url, "\".\n");
         m_frame->domWindow()->console()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, consoleMessage, 1, String());
         return false;
     }
@@ -340,7 +339,7 @@ bool XSSAuditor::findInRequest(const FindTask& task) const
     case XSSProtectionBlockEnabled:
         if (blockFrame) {
             blockFrame->loader()->stopAllLoaders();
-            blockFrame->redirectScheduler()->scheduleLocationChange(blankURL(), String());
+            blockFrame->navigationScheduler()->scheduleLocationChange(blankURL(), String());
         }
         break;
     default:
@@ -392,7 +391,7 @@ bool XSSAuditor::findInRequest(Frame* frame, const FindTask& task) const
     } else
         canonicalizedString = task.string;
 
-    if (frame->document()->url().protocolIs("data"))
+    if (frame->document()->url().protocolIsData())
         return false;
 
     canonicalizedString = canonicalize(canonicalizedString);
diff --git a/WebCore/page/chromium/EventHandlerChromium.cpp b/WebCore/page/chromium/EventHandlerChromium.cpp
index 6bf907e..9b40fb3 100644
--- a/WebCore/page/chromium/EventHandlerChromium.cpp
+++ b/WebCore/page/chromium/EventHandlerChromium.cpp
@@ -128,8 +128,8 @@ bool EventHandler::eventActivatedView(const PlatformMouseEvent& event) const
 
 PassRefPtr<Clipboard> EventHandler::createDraggingClipboard() const
 {
-    RefPtr<ChromiumDataObject> dataObject = ChromiumDataObject::create();
-    return ClipboardChromium::create(Clipboard::DragAndDrop, dataObject.get(), ClipboardWritable, m_frame);
+    RefPtr<ChromiumDataObjectLegacy> dataObject = ChromiumDataObjectLegacy::create(Clipboard::DragAndDrop);
+    return ClipboardChromium::create(Clipboard::DragAndDrop, ChromiumDataObject::create(dataObject), ClipboardWritable, m_frame);
 }
 
 void EventHandler::focusDocumentView()
diff --git a/WebCore/page/mac/WebCoreViewFactory.h b/WebCore/page/mac/WebCoreViewFactory.h
index 9191abe..7af75cb 100644
--- a/WebCore/page/mac/WebCoreViewFactory.h
+++ b/WebCore/page/mac/WebCoreViewFactory.h
@@ -28,8 +28,6 @@
 
 @protocol WebCoreViewFactory
 
-- (NSString *)defaultLanguageCode;
-
 - (BOOL)objectIsTextMarker:(id)object;
 - (BOOL)objectIsTextMarkerRange:(id)object;
 
diff --git a/WebCore/platform/AsyncFileSystem.h b/WebCore/platform/AsyncFileSystem.h
index 1bf7580..3104ebc 100644
--- a/WebCore/platform/AsyncFileSystem.h
+++ b/WebCore/platform/AsyncFileSystem.h
@@ -59,6 +59,10 @@ public:
 
     static bool isAvailable();
 
+    // Subclass must implement this if it supports synchronous operations.
+    // This should return false if there are no pending operations.
+    virtual bool waitForOperationToComplete() { return false; }
+
     // Creates and returns a new platform-specific AsyncFileSystem instance if the platform has its own implementation.
     static PassOwnPtr<AsyncFileSystem> create(const String& rootPath);
 
@@ -76,10 +80,16 @@ public:
     virtual void copy(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
 
     // Deletes a file or directory at a given path.
+    // It is an error to try to remove a directory that is not empty.
     // AsyncFileSystemCallbacks::didSucceed() is called when the operation is completed successfully.
     // AsyncFileSystemCallbacks::didFail() is called otherwise.
     virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
 
+    // Recursively deletes a directory at a given path.
+    // AsyncFileSystemCallbacks::didSucceed() is called when the operation is completed successfully.
+    // AsyncFileSystemCallbacks::didFail() is called otherwise.
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>) = 0;
+
     // Retrieves the metadata information of the file or directory at a given path.
     // AsyncFileSystemCallbacks::didReadMetadata() is called when the operation is completed successfully.
     // AsyncFileSystemCallbacks::didFail() is called otherwise.
diff --git a/WebCore/platform/ColorData.gperf b/WebCore/platform/ColorData.gperf
index dd726cc..f83e793 100644
--- a/WebCore/platform/ColorData.gperf
+++ b/WebCore/platform/ColorData.gperf
@@ -10,152 +10,153 @@ struct NamedColor;
 %define hash-function-name colordata_hash_function
 %enum
 %%
-aliceblue, 0xf0f8ff
-antiquewhite, 0xfaebd7
-aqua, 0x00ffff
-aquamarine, 0x7fffd4
-azure, 0xf0ffff
-beige, 0xf5f5dc
-bisque, 0xffe4c4
-black, 0x000000
-blanchedalmond, 0xffebcd
-blue, 0x0000ff
-blueviolet, 0x8a2be2
-brown, 0xa52a2a
-burlywood, 0xdeb887
-cadetblue, 0x5f9ea0
-chartreuse, 0x7fff00
-chocolate, 0xd2691e
-coral, 0xff7f50
-cornflowerblue, 0x6495ed
-cornsilk, 0xfff8dc
-crimson, 0xdc143c
-cyan, 0x00ffff
-darkblue, 0x00008b
-darkcyan, 0x008b8b
-darkgoldenrod, 0xb8860b
-darkgray, 0xa9a9a9
-darkgrey, 0xa9a9a9
-darkgreen, 0x006400
-darkkhaki, 0xbdb76b
-darkmagenta, 0x8b008b
-darkolivegreen, 0x556b2f
-darkorange, 0xff8c00
-darkorchid, 0x9932cc
-darkred, 0x8b0000
-darksalmon, 0xe9967a
-darkseagreen, 0x8fbc8f
-darkslateblue, 0x483d8b
-darkslategray, 0x2f4f4f
-darkslategrey, 0x2f4f4f
-darkturquoise, 0x00ced1
-darkviolet, 0x9400d3
-deeppink, 0xff1493
-deepskyblue, 0x00bfff
-dimgray, 0x696969
-dimgrey, 0x696969
-dodgerblue, 0x1e90ff
-firebrick, 0xb22222
-floralwhite, 0xfffaf0
-forestgreen, 0x228b22
-fuchsia, 0xff00ff
-gainsboro, 0xdcdcdc
-ghostwhite, 0xf8f8ff
-gold, 0xffd700
-goldenrod, 0xdaa520
-gray, 0x808080
-grey, 0x808080
-green, 0x008000
-greenyellow, 0xadff2f
-honeydew, 0xf0fff0
-hotpink, 0xff69b4
-indianred, 0xcd5c5c
-indigo, 0x4b0082
-ivory, 0xfffff0
-khaki, 0xf0e68c
-lavender, 0xe6e6fa
-lavenderblush, 0xfff0f5
-lawngreen, 0x7cfc00
-lemonchiffon, 0xfffacd
-lightblue, 0xadd8e6
-lightcoral, 0xf08080
-lightcyan, 0xe0ffff
-lightgoldenrodyellow, 0xfafad2
-lightgray, 0xd3d3d3
-lightgrey, 0xd3d3d3
-lightgreen, 0x90ee90
-lightpink, 0xffb6c1
-lightsalmon, 0xffa07a
-lightseagreen, 0x20b2aa
-lightskyblue, 0x87cefa
-lightslateblue, 0x8470ff
-lightslategray, 0x778899
-lightslategrey, 0x778899
-lightsteelblue, 0xb0c4de
-lightyellow, 0xffffe0
-lime, 0x00ff00
-limegreen, 0x32cd32
-linen, 0xfaf0e6
-magenta, 0xff00ff
-maroon, 0x800000
-mediumaquamarine, 0x66cdaa
-mediumblue, 0x0000cd
-mediumorchid, 0xba55d3
-mediumpurple, 0x9370d8
-mediumseagreen, 0x3cb371
-mediumslateblue, 0x7b68ee
-mediumspringgreen, 0x00fa9a
-mediumturquoise, 0x48d1cc
-mediumvioletred, 0xc71585
-midnightblue, 0x191970
-mintcream, 0xf5fffa
-mistyrose, 0xffe4e1
-moccasin, 0xffe4b5
-navajowhite, 0xffdead
-navy, 0x000080
-oldlace, 0xfdf5e6
-olive, 0x808000
-olivedrab, 0x6b8e23
-orange, 0xffa500
-orangered, 0xff4500
-orchid, 0xda70d6
-palegoldenrod, 0xeee8aa
-palegreen, 0x98fb98
-paleturquoise, 0xafeeee
-palevioletred, 0xd87093
-papayawhip, 0xffefd5
-peachpuff, 0xffdab9
-peru, 0xcd853f
-pink, 0xffc0cb
-plum, 0xdda0dd
-powderblue, 0xb0e0e6
-purple, 0x800080
-red, 0xff0000
-rosybrown, 0xbc8f8f
-royalblue, 0x4169e1
-saddlebrown, 0x8b4513
-salmon, 0xfa8072
-sandybrown, 0xf4a460
-seagreen, 0x2e8b57
-seashell, 0xfff5ee
-sienna, 0xa0522d
-silver, 0xc0c0c0
-skyblue, 0x87ceeb
-slateblue, 0x6a5acd
-slategray, 0x708090
-slategrey, 0x708090
-snow, 0xfffafa
-springgreen, 0x00ff7f
-steelblue, 0x4682b4
-tan, 0xd2b48c
-teal, 0x008080
-thistle, 0xd8bfd8
-tomato, 0xff6347
-turquoise, 0x40e0d0
-violet, 0xee82ee
-violetred, 0xd02090
-wheat, 0xf5deb3
-white, 0xffffff
-whitesmoke, 0xf5f5f5
-yellow, 0xffff00
-yellowgreen, 0x9acd32
+aliceblue, 0xfff0f8ff
+antiquewhite, 0xfffaebd7
+aqua, 0xff00ffff
+aquamarine, 0xff7fffd4
+azure, 0xfff0ffff
+beige, 0xfff5f5dc
+bisque, 0xffffe4c4
+black, 0xff000000
+blanchedalmond, 0xffffebcd
+blue, 0xff0000ff
+blueviolet, 0xff8a2be2
+brown, 0xffa52a2a
+burlywood, 0xffdeb887
+cadetblue, 0xff5f9ea0
+chartreuse, 0xff7fff00
+chocolate, 0xffd2691e
+coral, 0xffff7f50
+cornflowerblue, 0xff6495ed
+cornsilk, 0xfffff8dc
+crimson, 0xffdc143c
+cyan, 0xff00ffff
+darkblue, 0xff00008b
+darkcyan, 0xff008b8b
+darkgoldenrod, 0xffb8860b
+darkgray, 0xffa9a9a9
+darkgrey, 0xffa9a9a9
+darkgreen, 0xff006400
+darkkhaki, 0xffbdb76b
+darkmagenta, 0xff8b008b
+darkolivegreen, 0xff556b2f
+darkorange, 0xffff8c00
+darkorchid, 0xff9932cc
+darkred, 0xff8b0000
+darksalmon, 0xffe9967a
+darkseagreen, 0xff8fbc8f
+darkslateblue, 0xff483d8b
+darkslategray, 0xff2f4f4f
+darkslategrey, 0xff2f4f4f
+darkturquoise, 0xff00ced1
+darkviolet, 0xff9400d3
+deeppink, 0xffff1493
+deepskyblue, 0xff00bfff
+dimgray, 0xff696969
+dimgrey, 0xff696969
+dodgerblue, 0xff1e90ff
+firebrick, 0xffb22222
+floralwhite, 0xfffffaf0
+forestgreen, 0xff228b22
+fuchsia, 0xffff00ff
+gainsboro, 0xffdcdcdc
+ghostwhite, 0xfff8f8ff
+gold, 0xffffd700
+goldenrod, 0xffdaa520
+gray, 0xff808080
+grey, 0xff808080
+green, 0xff008000
+greenyellow, 0xffadff2f
+honeydew, 0xfff0fff0
+hotpink, 0xffff69b4
+indianred, 0xffcd5c5c
+indigo, 0xff4b0082
+ivory, 0xfffffff0
+khaki, 0xfff0e68c
+lavender, 0xffe6e6fa
+lavenderblush, 0xfffff0f5
+lawngreen, 0xff7cfc00
+lemonchiffon, 0xfffffacd
+lightblue, 0xffadd8e6
+lightcoral, 0xfff08080
+lightcyan, 0xffe0ffff
+lightgoldenrodyellow, 0xfffafad2
+lightgray, 0xffd3d3d3
+lightgrey, 0xffd3d3d3
+lightgreen, 0xff90ee90
+lightpink, 0xffffb6c1
+lightsalmon, 0xffffa07a
+lightseagreen, 0xff20b2aa
+lightskyblue, 0xff87cefa
+lightslateblue, 0xff8470ff
+lightslategray, 0xff778899
+lightslategrey, 0xff778899
+lightsteelblue, 0xffb0c4de
+lightyellow, 0xffffffe0
+lime, 0xff00ff00
+limegreen, 0xff32cd32
+linen, 0xfffaf0e6
+magenta, 0xffff00ff
+maroon, 0xff800000
+mediumaquamarine, 0xff66cdaa
+mediumblue, 0xff0000cd
+mediumorchid, 0xffba55d3
+mediumpurple, 0xff9370d8
+mediumseagreen, 0xff3cb371
+mediumslateblue, 0xff7b68ee
+mediumspringgreen, 0xff00fa9a
+mediumturquoise, 0xff48d1cc
+mediumvioletred, 0xffc71585
+midnightblue, 0xff191970
+mintcream, 0xfff5fffa
+mistyrose, 0xffffe4e1
+moccasin, 0xffffe4b5
+navajowhite, 0xffffdead
+navy, 0xff000080
+oldlace, 0xfffdf5e6
+olive, 0xff808000
+olivedrab, 0xff6b8e23
+orange, 0xffffa500
+orangered, 0xffff4500
+orchid, 0xffda70d6
+palegoldenrod, 0xffeee8aa
+palegreen, 0xff98fb98
+paleturquoise, 0xffafeeee
+palevioletred, 0xffd87093
+papayawhip, 0xffffefd5
+peachpuff, 0xffffdab9
+peru, 0xffcd853f
+pink, 0xffffc0cb
+plum, 0xffdda0dd
+powderblue, 0xffb0e0e6
+purple, 0xff800080
+red, 0xffff0000
+rosybrown, 0xffbc8f8f
+royalblue, 0xff4169e1
+saddlebrown, 0xff8b4513
+salmon, 0xfffa8072
+sandybrown, 0xfff4a460
+seagreen, 0xff2e8b57
+seashell, 0xfffff5ee
+sienna, 0xffa0522d
+silver, 0xffc0c0c0
+skyblue, 0xff87ceeb
+slateblue, 0xff6a5acd
+slategray, 0xff708090
+slategrey, 0xff708090
+snow, 0xfffffafa
+springgreen, 0xff00ff7f
+steelblue, 0xff4682b4
+tan, 0xffd2b48c
+teal, 0xff008080
+thistle, 0xffd8bfd8
+tomato, 0xffff6347
+transparent, 0x00000000
+turquoise, 0xff40e0d0
+violet, 0xffee82ee
+violetred, 0xffd02090
+wheat, 0xfff5deb3
+white, 0xffffffff
+whitesmoke, 0xfff5f5f5
+yellow, 0xffffff00
+yellowgreen, 0xff9acd32
diff --git a/WebCore/platform/CrossThreadCopier.cpp b/WebCore/platform/CrossThreadCopier.cpp
index 683ba54..4280486 100644
--- a/WebCore/platform/CrossThreadCopier.cpp
+++ b/WebCore/platform/CrossThreadCopier.cpp
@@ -37,6 +37,7 @@
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
+#include "SerializedScriptValue.h"
 
 namespace WebCore {
 
diff --git a/WebCore/platform/KURL.cpp b/WebCore/platform/KURL.cpp
index 16b84b5..3ac5d86 100644
--- a/WebCore/platform/KURL.cpp
+++ b/WebCore/platform/KURL.cpp
@@ -616,6 +616,33 @@ bool KURL::hasFragmentIdentifier() const
     return m_fragmentEnd != m_queryEnd;
 }
 
+void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
+{
+    const UChar* pos = m_string.characters() + m_pathEnd + 1;
+    const UChar* end = m_string.characters() + m_queryEnd;
+    while (pos < end) {
+        const UChar* parameterStart = pos;
+        while (pos < end && *pos != '&')
+            ++pos;
+        const UChar* parameterEnd = pos;
+        if (pos < end) {
+            ASSERT(*pos == '&');
+            ++pos;
+        }
+        if (parameterStart == parameterEnd)
+            continue;
+        const UChar* nameStart = parameterStart;
+        const UChar* equalSign = parameterStart;
+        while (equalSign < parameterEnd && *equalSign != '=')
+            ++equalSign;
+        if (equalSign == nameStart)
+            continue;
+        String name(nameStart, equalSign - nameStart);
+        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
+        parameters.set(name, value);
+    }
+}
+
 String KURL::baseAsString() const
 {
     return m_string.left(m_pathAfterLastSlash);
diff --git a/WebCore/platform/KURL.h b/WebCore/platform/KURL.h
index e5e8ec4..cbf0d8b 100644
--- a/WebCore/platform/KURL.h
+++ b/WebCore/platform/KURL.h
@@ -27,6 +27,7 @@
 #define KURL_h
 
 #include "PlatformString.h"
+#include <wtf/HashMap.h>
 
 #if PLATFORM(CF)
 typedef const struct __CFURL* CFURLRef;
@@ -59,6 +60,8 @@ namespace WebCore {
 class TextEncoding;
 struct KURLHash;
 
+typedef HashMap<String, String> ParsedURLParameters;
+
 enum ParsedURLStringTag { ParsedURLString };
 
 class KURL {
@@ -133,6 +136,8 @@ public:
     String fragmentIdentifier() const;
     bool hasFragmentIdentifier() const;
 
+    void copyParsedQueryTo(ParsedURLParameters&) const;
+
     String baseAsString() const;
 
     String prettyURL() const;
@@ -141,6 +146,7 @@ public:
     // Returns true if the current URL's protocol is the same as the null-
     // terminated ASCII argument. The argument must be lower-case.
     bool protocolIs(const char*) const;
+    bool protocolIsData() const { return protocolIs("data"); }
     bool protocolInHTTPFamily() const;
     bool isLocalFile() const;
 
diff --git a/WebCore/platform/KURLGoogle.cpp b/WebCore/platform/KURLGoogle.cpp
index 3d23fcf..726bc57 100644
--- a/WebCore/platform/KURLGoogle.cpp
+++ b/WebCore/platform/KURLGoogle.cpp
@@ -549,6 +549,34 @@ bool KURL::hasFragmentIdentifier() const
     return m_url.m_parsed.ref.len >= 0;
 }
 
+void KURL::copyParsedQueryTo(ParsedURLParameters& parameters) const
+{
+    String query = m_url.componentString(m_url.m_parsed.query);
+    const UChar* pos = query.characters();
+    const UChar* end = query.characters() + query.length();
+    while (pos < end) {
+        const UChar* parameterStart = pos;
+        while (pos < end && *pos != '&')
+            ++pos;
+        const UChar* parameterEnd = pos;
+        if (pos < end) {
+            ASSERT(*pos == '&');
+            ++pos;
+        }
+        if (parameterStart == parameterEnd)
+            continue;
+        const UChar* nameStart = parameterStart;
+        const UChar* equalSign = parameterStart;
+        while (equalSign < parameterEnd && *equalSign != '=')
+            ++equalSign;
+        if (equalSign == nameStart)
+            continue;
+        String name(nameStart, equalSign - nameStart);
+        String value = equalSign == parameterEnd ? String() : String(equalSign + 1, parameterEnd - equalSign - 1);
+        parameters.set(name, value);
+    }
+}
+
 String KURL::baseAsString() const
 {
     // FIXME: There is probably a more efficient way to do this?
diff --git a/WebCore/platform/Language.cpp b/WebCore/platform/Language.cpp
new file mode 100644
index 0000000..6cf2597
--- /dev/null
+++ b/WebCore/platform/Language.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "Language.h"
+
+#include "PlatformString.h"
+#include <wtf/HashMap.h>
+
+namespace WebCore {
+
+typedef HashMap<void*, LanguageChangeObserverFunction> ObserverMap;
+static ObserverMap& observerMap()
+{
+    DEFINE_STATIC_LOCAL(ObserverMap, map, ());
+    return map;
+}
+
+void addLanguageChangeObserver(void* context, LanguageChangeObserverFunction customObserver)
+{
+    observerMap().set(context, customObserver);
+}
+
+void removeLanguageChangeObserver(void* context)
+{
+    ASSERT(observerMap().contains(context));
+    observerMap().remove(context);
+}
+
+void languageDidChange()
+{
+    ObserverMap::iterator end = observerMap().end();
+    for (ObserverMap::iterator iter = observerMap().begin(); iter != end; ++iter)
+        iter->second(iter->first);
+}
+
+static String& languageOverride()
+{
+    DEFINE_STATIC_LOCAL(String, override, ());
+    return override;
+}
+
+String defaultLanguage()
+{
+    const String& override = languageOverride();
+    if (!override.isNull())
+        return override;
+
+    return platformDefaultLanguage();
+}
+
+void overrideDefaultLanguage(const String& override)
+{
+    languageOverride() = override;
+}
+
+}
diff --git a/WebCore/platform/Language.h b/WebCore/platform/Language.h
index 4c92755..656caee 100644
--- a/WebCore/platform/Language.h
+++ b/WebCore/platform/Language.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,17 +10,17 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef Language_h
@@ -30,8 +30,16 @@
 
 namespace WebCore {
 
-    String defaultLanguage();
+String defaultLanguage();
+void overrideDefaultLanguage(const String&);
 
+// The observer function will be called when system language changes (unless it's overridden by overrideDefaultLanguage()).
+typedef void (*LanguageChangeObserverFunction)(void* context);
+void addLanguageChangeObserver(void* context, LanguageChangeObserverFunction);
+void removeLanguageChangeObserver(void* context);
+
+String platformDefaultLanguage();
+void languageDidChange();
 }
 
 #endif
diff --git a/WebCore/platform/Logging.cpp b/WebCore/platform/Logging.cpp
index 7fb15b1..8f64282 100644
--- a/WebCore/platform/Logging.cpp
+++ b/WebCore/platform/Logging.cpp
@@ -33,13 +33,11 @@ WTFLogChannel LogNotYetImplemented = { 0x00000001, "WebCoreLogLevel", WTFLogChan
 
 WTFLogChannel LogFrames =            { 0x00000010, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogLoading =           { 0x00000020, "WebCoreLogLevel", WTFLogChannelOff };
-
 WTFLogChannel LogPopupBlocking =     { 0x00000040, "WebCoreLogLevel", WTFLogChannelOff };
-
 WTFLogChannel LogEvents =            { 0x00000080, "WebCoreLogLevel", WTFLogChannelOff };
+
 WTFLogChannel LogEditing =           { 0x00000100, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogLiveConnect =       { 0x00000200, "WebCoreLogLevel", WTFLogChannelOff };
-
 WTFLogChannel LogIconDatabase =      { 0x00000400, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogSQLDatabase =       { 0x00000800, "WebCoreLogLevel", WTFLogChannelOff };
 
@@ -49,6 +47,7 @@ WTFLogChannel LogHistory =           { 0x00004000, "WebCoreLogLevel", WTFLogChan
 WTFLogChannel LogPageCache =         { 0x00008000, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel LogPlatformLeaks =     { 0x00010000, "WebCoreLogLevel", WTFLogChannelOff };
+WTFLogChannel LogResourceLoading =   { 0x00020000, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel LogNetwork =           { 0x00100000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogFTP =               { 0x00200000, "WebCoreLogLevel", WTFLogChannelOff };
@@ -56,10 +55,10 @@ WTFLogChannel LogThreading =         { 0x00400000, "WebCoreLogLevel", WTFLogChan
 WTFLogChannel LogStorageAPI =        { 0x00800000, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel LogMedia =             { 0x01000000, "WebCoreLogLevel", WTFLogChannelOff };
-
 WTFLogChannel LogPlugins =           { 0x02000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogArchives =          { 0x04000000, "WebCoreLogLevel", WTFLogChannelOff };
 WTFLogChannel LogProgress =          { 0x08000000, "WebCoreLogLevel", WTFLogChannelOff };
+
 WTFLogChannel LogFileAPI =           { 0x10000000, "WebCoreLogLevel", WTFLogChannelOff };
 
 WTFLogChannel* getChannelFromName(const String& channelName)
@@ -106,6 +105,9 @@ WTFLogChannel* getChannelFromName(const String& channelName)
     if (equalIgnoringCase(channelName, String("PlatformLeaks")))
         return &LogPlatformLeaks;
 
+    if (equalIgnoringCase(channelName, String("ResourceLoading")))
+        return &LogResourceLoading;
+
     if (equalIgnoringCase(channelName, String("Plugins")))
         return &LogPlugins;
 
diff --git a/WebCore/platform/Logging.h b/WebCore/platform/Logging.h
index df3c6fd..11ad1db 100644
--- a/WebCore/platform/Logging.h
+++ b/WebCore/platform/Logging.h
@@ -49,6 +49,7 @@ namespace WebCore {
     extern WTFLogChannel LogHistory;
     extern WTFLogChannel LogPageCache;
     extern WTFLogChannel LogPlatformLeaks;
+    extern WTFLogChannel LogResourceLoading;
     extern WTFLogChannel LogNetwork;
     extern WTFLogChannel LogFTP;
     extern WTFLogChannel LogThreading;
diff --git a/WebCore/platform/PlatformKeyboardEvent.h b/WebCore/platform/PlatformKeyboardEvent.h
index 6ec4879..7ce7017 100644
--- a/WebCore/platform/PlatformKeyboardEvent.h
+++ b/WebCore/platform/PlatformKeyboardEvent.h
@@ -186,6 +186,8 @@ namespace WebCore {
 #if PLATFORM(QT)
         PlatformKeyboardEvent(QKeyEvent*);
         QKeyEvent* qtEvent() const { return m_qtEvent; }
+        uint32_t nativeModifiers() const;
+        uint32_t nativeScanCode() const;
 #endif
 
 #if PLATFORM(WX)
diff --git a/WebCore/platform/ScrollView.cpp b/WebCore/platform/ScrollView.cpp
index 0e95e22..fac37d7 100644
--- a/WebCore/platform/ScrollView.cpp
+++ b/WebCore/platform/ScrollView.cpp
@@ -718,27 +718,27 @@ void ScrollView::wheelEvent(PlatformWheelEvent& e)
         return;
     }
 
-    // Determine how much we want to scroll.  If we can move at all, we will accept the event.
+    // Accept the event if we have a scrollbar in that direction and can still
+    // scroll any further.
+    float deltaX = m_horizontalScrollbar ? e.deltaX() : 0;
+    float deltaY = m_verticalScrollbar ? e.deltaY() : 0;
     IntSize maxScrollDelta = maximumScrollPosition() - scrollPosition();
-    if ((e.deltaX() < 0 && maxScrollDelta.width() > 0) ||
-        (e.deltaX() > 0 && scrollOffset().width() > 0) ||
-        (e.deltaY() < 0 && maxScrollDelta.height() > 0) ||
-        (e.deltaY() > 0 && scrollOffset().height() > 0)) {
+    if ((deltaX < 0 && maxScrollDelta.width() > 0)
+        || (deltaX > 0 && scrollOffset().width() > 0)
+        || (deltaY < 0 && maxScrollDelta.height() > 0)
+        || (deltaY > 0 && scrollOffset().height() > 0)) {
         e.accept();
-        float deltaX = e.deltaX();
-        float deltaY = e.deltaY();
         if (e.granularity() == ScrollByPageWheelEvent) {
-            ASSERT(deltaX == 0);
+            ASSERT(!e.deltaX());
             bool negative = deltaY < 0;
             deltaY = max(max(static_cast<float>(visibleHeight()) * Scrollbar::minFractionToStepWhenPaging(), static_cast<float>(visibleHeight() - Scrollbar::maxOverlapBetweenPages())), 1.0f);
             if (negative)
                 deltaY = -deltaY;
         }
 
-        // Should we fall back on scrollBy() if there is no scrollbar for a non-zero delta?
-        if (deltaY && m_verticalScrollbar)
+        if (deltaY)
             m_verticalScrollbar->scroll(ScrollUp, ScrollByPixel, deltaY);
-        if (deltaX && m_horizontalScrollbar)
+        if (deltaX)
             m_horizontalScrollbar->scroll(ScrollLeft, ScrollByPixel, deltaX);
     }
 }
@@ -837,7 +837,7 @@ void ScrollView::paintScrollbars(GraphicsContext* context, const IntRect& rect)
 void ScrollView::paintPanScrollIcon(GraphicsContext* context)
 {
     static Image* panScrollIcon = Image::loadPlatformResource("panIcon").releaseRef();
-    context->drawImage(panScrollIcon, DeviceColorSpace, m_panScrollIconPoint);
+    context->drawImage(panScrollIcon, ColorSpaceDeviceRGB, m_panScrollIconPoint);
 }
 
 void ScrollView::paint(GraphicsContext* context, const IntRect& rect)
diff --git a/WebCore/platform/ScrollbarTheme.h b/WebCore/platform/ScrollbarTheme.h
index c5c2094..0efaf7a 100644
--- a/WebCore/platform/ScrollbarTheme.h
+++ b/WebCore/platform/ScrollbarTheme.h
@@ -73,7 +73,7 @@ public:
 
     virtual void invalidatePart(Scrollbar*, ScrollbarPart) {}
 
-    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, DeviceColorSpace); }
+    virtual void paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect) { context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB); }
 
     virtual bool shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent&) { return false; }
     virtual bool shouldSnapBackToDragOrigin(Scrollbar*, const PlatformMouseEvent&) { return false; }
diff --git a/WebCore/platform/ScrollbarThemeComposite.cpp b/WebCore/platform/ScrollbarThemeComposite.cpp
index fdac14d..bf00ebb 100644
--- a/WebCore/platform/ScrollbarThemeComposite.cpp
+++ b/WebCore/platform/ScrollbarThemeComposite.cpp
@@ -298,7 +298,7 @@ void ScrollbarThemeComposite::paintScrollCorner(ScrollView* view, GraphicsContex
     Page* page = frameView->frame() ? frameView->frame()->page() : 0;
     if (page && page->settings()->shouldPaintCustomScrollbars() && page->chrome()->client()->paintCustomScrollCorner(context, cornerRect))
         return;
-    context->fillRect(cornerRect, Color::white, DeviceColorSpace);
+    context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB);
 }
 
 }
diff --git a/WebCore/platform/Widget.h b/WebCore/platform/Widget.h
index 089a1e9..85612ed 100644
--- a/WebCore/platform/Widget.h
+++ b/WebCore/platform/Widget.h
@@ -232,6 +232,10 @@ public:
     const String edjeThemeRecursive() const;
 #endif
 
+#if PLATFORM(CHROMIUM)
+    virtual bool isPluginContainer() const { return false; }
+#endif
+
     // Virtual methods to convert points to/from the containing ScrollView
     virtual IntRect convertToContainingView(const IntRect&) const;
     virtual IntRect convertFromContainingView(const IntRect&) const;
diff --git a/WebCore/platform/android/FileSystemAndroid.cpp b/WebCore/platform/android/FileSystemAndroid.cpp
index 3513958..5ab8929 100644
--- a/WebCore/platform/android/FileSystemAndroid.cpp
+++ b/WebCore/platform/android/FileSystemAndroid.cpp
@@ -28,8 +28,11 @@
 #include "config.h"
 #include "FileSystem.h"
 
+<<<<<<< HEAD
 #include "PlatformBridge.h"
 #include "StringBuilder.h"
+=======
+>>>>>>> webkit.org at r70209
 #include "cutils/log.h"
 #include <dirent.h>
 #include <dlfcn.h>
@@ -37,6 +40,7 @@
 #include <fnmatch.h>
 #include <sys/stat.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/platform/audio/AudioResampler.cpp b/WebCore/platform/audio/AudioResampler.cpp
new file mode 100644
index 0000000..7f8221e
--- /dev/null
+++ b/WebCore/platform/audio/AudioResampler.cpp
@@ -0,0 +1,128 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioResampler.h"
+
+#include "AudioBus.h"
+#include <algorithm>
+#include <math.h>
+
+using namespace std;
+ 
+namespace WebCore {
+
+const double AudioResampler::MaxRate = 8.0;
+
+AudioResampler::AudioResampler()
+    : m_rate(1.0)
+{
+    m_kernels.append(adoptPtr(new AudioResamplerKernel(this)));
+    m_sourceBus = adoptPtr(new AudioBus(1, 0, false));
+}
+
+AudioResampler::AudioResampler(unsigned numberOfChannels)
+    : m_rate(1.0)
+{
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_kernels.append(adoptPtr(new AudioResamplerKernel(this)));
+
+    m_sourceBus = adoptPtr(new AudioBus(numberOfChannels, 0, false));
+}
+
+void AudioResampler::configureChannels(unsigned numberOfChannels)
+{
+    unsigned currentSize = m_kernels.size();
+    if (numberOfChannels == currentSize)
+        return; // already setup
+
+    // First deal with adding or removing kernels.
+    if (numberOfChannels > currentSize) {
+        for (unsigned i = currentSize; i < numberOfChannels; ++i)
+            m_kernels.append(adoptPtr(new AudioResamplerKernel(this)));
+    } else
+        m_kernels.resize(numberOfChannels);
+
+    // Reconfigure our source bus to the new channel size.
+    m_sourceBus = adoptPtr(new AudioBus(numberOfChannels, 0, false));
+}
+
+void AudioResampler::process(AudioSourceProvider* provider, AudioBus* destinationBus, size_t framesToProcess)
+{
+    ASSERT(provider);
+    if (!provider)
+        return;
+        
+    unsigned numberOfChannels = m_kernels.size();
+
+    // Make sure our configuration matches the bus we're rendering to.
+    bool channelsMatch = (destinationBus && destinationBus->numberOfChannels() == numberOfChannels);
+    ASSERT(channelsMatch);
+    if (!channelsMatch)
+        return;
+
+    // Setup the source bus.
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        // Figure out how many frames we need to get from the provider, and a pointer to the buffer.
+        size_t framesNeeded;
+        float* fillPointer = m_kernels[i]->getSourcePointer(framesToProcess, &framesNeeded);
+        ASSERT(fillPointer);
+        if (!fillPointer)
+            return;
+            
+        m_sourceBus->setChannelMemory(i, fillPointer, framesNeeded);
+    }
+
+    // Ask the provider to supply the desired number of source frames.
+    provider->provideInput(m_sourceBus.get(), m_sourceBus->length());
+
+    // Now that we have the source data, resample each channel into the destination bus.
+    // FIXME: optimize for the common stereo case where it's faster to process both left/right channels in the same inner loop.
+    for (unsigned i = 0; i < numberOfChannels; ++i) {
+        float* destination = destinationBus->channel(i)->data();
+        m_kernels[i]->process(destination, framesToProcess);
+    }
+}
+
+void AudioResampler::setRate(double rate)
+{
+    if (isnan(rate) || isinf(rate) || rate <= 0.0)
+        return;
+    
+    m_rate = min(AudioResampler::MaxRate, rate);
+}
+
+void AudioResampler::reset()
+{
+    unsigned numberOfChannels = m_kernels.size();
+    for (unsigned i = 0; i < numberOfChannels; ++i)
+        m_kernels[i]->reset();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/platform/audio/AudioResampler.h b/WebCore/platform/audio/AudioResampler.h
new file mode 100644
index 0000000..ed352b8
--- /dev/null
+++ b/WebCore/platform/audio/AudioResampler.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioResampler_h
+#define AudioResampler_h
+
+#include "AudioBus.h"
+#include "AudioResamplerKernel.h"
+#include "AudioSourceProvider.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+// AudioResampler resamples the audio stream from an AudioSourceProvider.
+// The audio stream may be single or multi-channel.
+// The default constructor defaults to single-channel (mono).
+
+class AudioResampler {
+public:
+    AudioResampler();
+    AudioResampler(unsigned numberOfChannels);
+    ~AudioResampler() { }
+    
+    // Given an AudioSourceProvider, process() resamples the source stream into destinationBus.
+    void process(AudioSourceProvider*, AudioBus* destinationBus, size_t framesToProcess);
+
+    // Resets the processing state.
+    void reset();
+
+    void configureChannels(unsigned numberOfChannels);
+
+    // 0 < rate <= MaxRate
+    void setRate(double rate);
+    double rate() const { return m_rate; }
+
+    static const double MaxRate;
+
+private:
+    double m_rate;
+    Vector<OwnPtr<AudioResamplerKernel> > m_kernels;
+    OwnPtr<AudioBus> m_sourceBus;
+};
+
+} // namespace WebCore
+
+#endif // AudioResampler_h
diff --git a/WebCore/platform/audio/AudioUtilities.cpp b/WebCore/platform/audio/AudioUtilities.cpp
new file mode 100644
index 0000000..32f4335
--- /dev/null
+++ b/WebCore/platform/audio/AudioUtilities.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#include "AudioUtilities.h"
+
+#include <math.h>
+
+namespace WebCore {
+
+namespace AudioUtilities {
+
+double decibelsToLinear(double decibels)
+{
+    return pow(10.0, 0.05 * decibels);
+}
+
+double linearToDecibels(double linear)
+{
+    // It's not possible to calculate decibels for a zero linear value since it would be -Inf.
+    // -1000.0 dB represents a very tiny linear value in case we ever reach this case.
+    ASSERT(linear);
+    if (!linear)
+        return -1000.0;
+        
+    return 20.0 * log10(linear);
+}
+
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate)
+{
+    return 1.0 - pow(1.0 / M_E, 1.0 / (sampleRate * timeConstant));
+}
+    
+} // AudioUtilites
+
+} // WebCore
diff --git a/WebCore/platform/audio/AudioUtilities.h b/WebCore/platform/audio/AudioUtilities.h
new file mode 100644
index 0000000..7cf44ce
--- /dev/null
+++ b/WebCore/platform/audio/AudioUtilities.h
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioUtilities_h
+#define AudioUtilities_h
+
+namespace WebCore {
+
+namespace AudioUtilities {
+
+// Standard functions for converting to and from decibel values from linear.
+double linearToDecibels(double);
+double decibelsToLinear(double);
+
+// timeConstant is the time it takes a first-order linear time-invariant system
+// to reach the value 1 - 1/e (around 63.2%) given a step input response.
+// discreteTimeConstantForSampleRate() will return the discrete time-constant for the specific sampleRate.
+double discreteTimeConstantForSampleRate(double timeConstant, double sampleRate);
+    
+} // AudioUtilites
+
+} // WebCore
+
+#endif // AudioUtilities_h
diff --git a/WebCore/platform/audio/EqualPowerPanner.cpp b/WebCore/platform/audio/EqualPowerPanner.cpp
new file mode 100644
index 0000000..2e4e10f
--- /dev/null
+++ b/WebCore/platform/audio/EqualPowerPanner.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "EqualPowerPanner.h"
+
+#include "AudioBus.h"
+#include "AudioUtilities.h"
+#include <math.h>
+
+// Use a 50ms smoothing / de-zippering time-constant.
+const double SmoothingTimeConstant = 0.050;
+ 
+namespace WebCore {
+
+EqualPowerPanner::EqualPowerPanner(double sampleRate)
+    : Panner(PanningModelEqualPower)
+    , m_isFirstRender(true)
+    , m_gainL(0.0)
+    , m_gainR(0.0)
+{
+    m_smoothingConstant = AudioUtilities::discreteTimeConstantForSampleRate(SmoothingTimeConstant, sampleRate);
+}
+
+void EqualPowerPanner::pan(double azimuth, double /*elevation*/, AudioBus* inputBus, AudioBus* outputBus, size_t framesToProcess)
+{
+    // FIXME: implement stereo sources
+    bool isInputSafe = inputBus && inputBus->numberOfChannels() == 1 && framesToProcess <= inputBus->length();
+    ASSERT(isInputSafe);
+    if (!isInputSafe)
+        return;
+
+    bool isOutputSafe = outputBus && outputBus->numberOfChannels() == 2 && framesToProcess <= outputBus->length();
+    ASSERT(isOutputSafe);
+    if (!isOutputSafe)
+        return;
+
+    AudioChannel* channel = inputBus->channel(0);
+    float* sourceP = channel->data();                               
+    float* destinationL = outputBus->channelByType(AudioBus::ChannelLeft)->data();
+    float* destinationR = outputBus->channelByType(AudioBus::ChannelRight)->data();
+
+    if (!sourceP || !destinationL || !destinationR)
+        return;
+
+    // Pan smoothly from left to right with azimuth going from -30 -> +30 degrees.
+    double desiredPanPosition;
+    if (azimuth > 30.0)
+        desiredPanPosition = 1.0;
+    else if (azimuth < -30.0)
+        desiredPanPosition = 0.0;
+    else
+        desiredPanPosition = (azimuth + 30.0) / 60.0;
+
+    double desiredGainL = 0.5 * cos(M_PI * desiredPanPosition) + 0.5;
+    double desiredGainR = sqrt(1.0 - desiredGainL*desiredGainL);
+
+    // Don't de-zipper on first render call.
+    if (m_isFirstRender) {
+        m_isFirstRender = false;
+        m_gainL = desiredGainL;
+        m_gainR = desiredGainR;
+    }
+
+    // Cache in local variables.
+    double gainL = m_gainL;
+    double gainR = m_gainR;
+
+    // Get local copy of smoothing constant.
+    const double SmoothingConstant = m_smoothingConstant;
+
+    int n = framesToProcess;
+
+    while (n--) {
+        float input = *sourceP++;
+        gainL += (desiredGainL - gainL) * SmoothingConstant;
+        gainR += (desiredGainR - gainR) * SmoothingConstant;
+        *destinationL++ = static_cast<float>(input * gainL);
+        *destinationR++ = static_cast<float>(input * gainR);
+    }
+
+    m_gainL = gainL;
+    m_gainR = gainR;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/platform/audio/EqualPowerPanner.h b/WebCore/platform/audio/EqualPowerPanner.h
new file mode 100644
index 0000000..f20617e
--- /dev/null
+++ b/WebCore/platform/audio/EqualPowerPanner.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef EqualPowerPanner_h
+#define EqualPowerPanner_h
+
+#include "Panner.h"
+
+namespace WebCore {
+
+// Common type of stereo panner as found in normal audio mixing equipment.
+
+class EqualPowerPanner : public Panner {
+public:
+    EqualPowerPanner(double sampleRate);
+
+    virtual void pan(double azimuth, double elevation, AudioBus* inputBus, AudioBus* outputBuf, size_t framesToProcess);
+
+    virtual void reset() { m_isFirstRender = true; }
+
+private:
+    // For smoothing / de-zippering
+    bool m_isFirstRender;
+    double m_smoothingConstant;
+    
+    double m_gainL;
+    double m_gainR;
+};
+
+} // namespace WebCore
+
+#endif // EqualPowerPanner_h
diff --git a/WebCore/platform/audio/HRTFPanner.cpp b/WebCore/platform/audio/HRTFPanner.cpp
new file mode 100644
index 0000000..56f06f1
--- /dev/null
+++ b/WebCore/platform/audio/HRTFPanner.cpp
@@ -0,0 +1,229 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "HRTFPanner.h"
+
+#include "AudioBus.h"
+#include "FFTConvolver.h"
+#include "HRTFDatabase.h"
+#include "HRTFDatabaseLoader.h"
+#include <algorithm>
+#include <math.h>
+#include <wtf/RefPtr.h>
+
+using namespace std;
+ 
+namespace WebCore {
+
+// The value of 2 milliseconds is larger than the largest delay which exists in any HRTFKernel from the default HRTFDatabase (0.0136 seconds).
+// We ASSERT the delay values used in process() with this value.
+const double MaxDelayTimeSeconds = 0.002;
+
+HRTFPanner::HRTFPanner(double sampleRate)
+    : Panner(PanningModelHRTF)
+    , m_sampleRate(sampleRate)
+    , m_isFirstRender(true)
+    , m_azimuthIndex(0)
+    , m_convolverL(fftSizeForSampleRate(sampleRate))
+    , m_convolverR(fftSizeForSampleRate(sampleRate))
+    , m_delayLineL(MaxDelayTimeSeconds, sampleRate)
+    , m_delayLineR(MaxDelayTimeSeconds, sampleRate)
+{ 
+}
+
+HRTFPanner::~HRTFPanner()
+{
+}
+
+size_t HRTFPanner::fftSizeForSampleRate(double sampleRate)
+{
+    // The HRTF impulse responses (loaded as audio resources) are 512 sample-frames @44.1KHz.
+    // Currently, we truncate the impulse responses to half this size, but an FFT-size of twice impulse response size is needed (for convolution).
+    // So for sample rates around 44.1KHz an FFT size of 512 is good.  We double that size for higher sample rates.
+    ASSERT(sampleRate >= 44100 && sampleRate <= 96000.0);
+    return (sampleRate <= 48000.0) ? 512 : 1024;
+}
+
+void HRTFPanner::reset()
+{
+    m_isFirstRender = true;
+    m_convolverL.reset();
+    m_convolverR.reset();
+    m_delayLineL.reset();
+    m_delayLineR.reset();
+}
+
+static bool wrapDistance(int i, int j, int length)
+{
+    int directDistance = abs(i - j);
+    int indirectDistance = length - directDistance;
+
+    return indirectDistance < directDistance;
+}
+
+int HRTFPanner::calculateDesiredAzimuthIndexAndBlend(double azimuth, double& azimuthBlend)
+{
+    // Convert the azimuth angle from the range -180 -> +180 into the range 0 -> 360.
+    // The azimuth index may then be calculated from this positive value.
+    if (azimuth < 0)
+        azimuth += 360.0;
+    
+    HRTFDatabase* database = HRTFDatabaseLoader::defaultHRTFDatabase();    
+    ASSERT(database);
+    
+    int numberOfAzimuths = database->numberOfAzimuths();
+    const double angleBetweenAzimuths = 360.0 / numberOfAzimuths;
+
+    // Calculate the azimuth index and the blend (0 -> 1) for interpolation.
+    double desiredAzimuthIndexFloat = azimuth / angleBetweenAzimuths;
+    int desiredAzimuthIndex = static_cast<int>(desiredAzimuthIndexFloat);
+    azimuthBlend = desiredAzimuthIndexFloat - static_cast<double>(desiredAzimuthIndex);
+    
+    // We don't immediately start using this azimuth index, but instead approach this index from the last index we rendered at.
+    // This minimizes the clicks and graininess for moving sources which occur otherwise.
+    desiredAzimuthIndex = max(0, desiredAzimuthIndex);
+    desiredAzimuthIndex = min(numberOfAzimuths - 1, desiredAzimuthIndex);
+    return desiredAzimuthIndex;
+}
+
+void HRTFPanner::pan(double desiredAzimuth, double elevation, AudioBus* inputBus, AudioBus* outputBus, size_t framesToProcess)
+{
+    unsigned numInputChannels = inputBus ? inputBus->numberOfChannels() : 0;
+
+    bool isInputGood = inputBus &&  numInputChannels >= 1 && numInputChannels <= 2;
+    ASSERT(isInputGood);
+
+    bool isOutputGood = outputBus && outputBus->numberOfChannels() == 2 && framesToProcess <= outputBus->length();
+    ASSERT(isOutputGood);
+
+    if (!isInputGood || !isOutputGood) {
+        if (outputBus)
+            outputBus->zero();
+        return;
+    }
+
+    // This code only runs as long as the context is alive and after database has been loaded.
+    HRTFDatabase* database = HRTFDatabaseLoader::defaultHRTFDatabase();    
+    ASSERT(database);
+    if (!database) {
+        outputBus->zero();
+        return;
+    }
+
+    // IRCAM HRTF azimuths values from the loaded database is reversed from the panner's notion of azimuth.
+    double azimuth = -desiredAzimuth;
+
+    bool isAzimuthGood = azimuth >= -180.0 && azimuth <= 180.0;
+    ASSERT(isAzimuthGood);
+    if (!isAzimuthGood) {
+        outputBus->zero();
+        return;
+    }
+
+    // Normally, we'll just be dealing with mono sources.
+    // If we have a stereo input, implement stereo panning with left source processed by left HRTF, and right source by right HRTF.
+    AudioChannel* inputChannelL = inputBus->channelByType(AudioBus::ChannelLeft);
+    AudioChannel* inputChannelR = numInputChannels > 1 ? inputBus->channelByType(AudioBus::ChannelRight) : 0;
+
+    // Get source and destination pointers.
+    float* sourceL = inputChannelL->data();
+    float* sourceR = numInputChannels > 1 ? inputChannelR->data() : sourceL;
+    float* destinationL = outputBus->channelByType(AudioBus::ChannelLeft)->data();
+    float* destinationR = outputBus->channelByType(AudioBus::ChannelRight)->data();
+
+    double azimuthBlend;
+    int desiredAzimuthIndex = calculateDesiredAzimuthIndexAndBlend(azimuth, azimuthBlend);
+
+    // This algorithm currently requires that we process in power-of-two size chunks at least 128.
+    ASSERT(1UL << static_cast<int>(log2(framesToProcess)) == framesToProcess);
+    ASSERT(framesToProcess >= 128);
+    
+    const unsigned framesPerSegment = 128;
+    const unsigned numberOfSegments = framesToProcess / framesPerSegment;
+
+    for (unsigned segment = 0; segment < numberOfSegments; ++segment) {
+        if (m_isFirstRender) {
+            // Snap exactly to desired position (first time and after reset()).
+            m_azimuthIndex = desiredAzimuthIndex;
+            m_isFirstRender = false;
+        } else {
+            // Each segment renders with an azimuth index closer by one to the desired azimuth index.
+            // Because inter-aural time delay is mostly a factor of azimuth and the delay is where the clicks and graininess come from,
+            // we don't bother smoothing the elevations.
+            int numberOfAzimuths = database->numberOfAzimuths();
+            bool wrap = wrapDistance(m_azimuthIndex, desiredAzimuthIndex, numberOfAzimuths);
+            if (wrap) {
+                if (m_azimuthIndex < desiredAzimuthIndex)
+                    m_azimuthIndex = (m_azimuthIndex - 1 + numberOfAzimuths) % numberOfAzimuths;
+                else if (m_azimuthIndex > desiredAzimuthIndex)
+                    m_azimuthIndex = (m_azimuthIndex + 1) % numberOfAzimuths;
+            } else {
+                if (m_azimuthIndex < desiredAzimuthIndex)
+                    m_azimuthIndex = (m_azimuthIndex + 1) % numberOfAzimuths;
+                else if (m_azimuthIndex > desiredAzimuthIndex)
+                    m_azimuthIndex = (m_azimuthIndex - 1 + numberOfAzimuths) % numberOfAzimuths;
+            }
+        }
+        
+        // Get the HRTFKernels and interpolated delays.    
+        HRTFKernel* kernelL;
+        HRTFKernel* kernelR;
+        double frameDelayL;
+        double frameDelayR;
+        database->getKernelsFromAzimuthElevation(azimuthBlend, m_azimuthIndex, elevation, kernelL, kernelR, frameDelayL, frameDelayR);
+
+        ASSERT(kernelL && kernelR);
+        if (!kernelL || !kernelR) {
+            outputBus->zero();
+            return;
+        }
+        
+        ASSERT(frameDelayL / sampleRate() < MaxDelayTimeSeconds && frameDelayR / sampleRate() < MaxDelayTimeSeconds);
+            
+        // Calculate the source and destination pointers for the current segment.
+        unsigned offset = segment * framesPerSegment;
+        float* segmentSourceL = sourceL + offset;
+        float* segmentSourceR = sourceR + offset;
+        float* segmentDestinationL = destinationL + offset;
+        float* segmentDestinationR = destinationR + offset;
+
+        // First run through delay lines for inter-aural time difference.
+        m_delayLineL.setDelayFrames(frameDelayL);
+        m_delayLineR.setDelayFrames(frameDelayR);
+        m_delayLineL.process(segmentSourceL, segmentDestinationL, framesPerSegment);
+        m_delayLineR.process(segmentSourceR, segmentDestinationR, framesPerSegment);
+
+        // Now do the convolutions in-place.
+        m_convolverL.process(kernelL->fftFrame(), segmentDestinationL, segmentDestinationL, framesPerSegment);
+        m_convolverR.process(kernelR->fftFrame(), segmentDestinationR, segmentDestinationR, framesPerSegment);
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/platform/audio/HRTFPanner.h b/WebCore/platform/audio/HRTFPanner.h
new file mode 100644
index 0000000..6c13d48
--- /dev/null
+++ b/WebCore/platform/audio/HRTFPanner.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HRTFPanner_h
+#define HRTFPanner_h
+
+#include "DelayDSPKernel.h"
+#include "FFTConvolver.h"
+#include "Panner.h"
+
+namespace WebCore {
+
+class HRTFPanner : public Panner {
+public:
+    explicit HRTFPanner(double sampleRate);
+    virtual ~HRTFPanner();
+
+    // Panner
+    virtual void pan(double azimuth, double elevation, AudioBus* inputBus, AudioBus* outputBus, size_t framesToProcess);
+    virtual void reset();
+
+    size_t fftSize() { return fftSizeForSampleRate(m_sampleRate); }
+    static size_t fftSizeForSampleRate(double sampleRate);
+
+    double sampleRate() const { return m_sampleRate; }
+    
+private:
+    // Given an azimuth angle in the range -180 -> +180, returns the corresponding azimuth index for the database,
+    // and azimuthBlend which is an interpolation value from 0 -> 1.
+    int calculateDesiredAzimuthIndexAndBlend(double azimuth, double& azimuthBlend);
+
+    double m_sampleRate;
+    
+    // m_isFirstRender and m_azimuthIndex are used to avoid harshly changing from rendering at one azimuth angle to another angle very far away.
+    // Changing the azimuth gradually produces a smoother sound.
+    bool m_isFirstRender;
+    int m_azimuthIndex;
+
+    FFTConvolver m_convolverL;
+    FFTConvolver m_convolverR;
+    DelayDSPKernel m_delayLineL;
+    DelayDSPKernel m_delayLineR;
+};
+
+} // namespace WebCore
+
+#endif // HRTFPanner_h
diff --git a/WebCore/platform/brew/ClipboardBrew.cpp b/WebCore/platform/brew/ClipboardBrew.cpp
index 10025d6..c0504bc 100644
--- a/WebCore/platform/brew/ClipboardBrew.cpp
+++ b/WebCore/platform/brew/ClipboardBrew.cpp
@@ -42,7 +42,7 @@ PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy, DragData*, Frame*
 }
 
 ClipboardBrew::ClipboardBrew(ClipboardAccessPolicy policy, ClipboardType clipboardType)
-    : Clipboard(clipboardType, isForDragging)
+    : Clipboard(policy, clipboardType)
 {
 }
 
diff --git a/WebCore/platform/brew/FileSystemBrew.cpp b/WebCore/platform/brew/FileSystemBrew.cpp
index a723e63..e207b55 100644
--- a/WebCore/platform/brew/FileSystemBrew.cpp
+++ b/WebCore/platform/brew/FileSystemBrew.cpp
@@ -30,24 +30,23 @@
 #include "FileSystem.h"
 
 #include "NotImplemented.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 
 #include <AEEAppGen.h>
 #include <AEEFile.h>
 #include <AEEStdLib.h>
 
-#include <wtf/OwnPtr.h>
-#include <wtf/PassOwnPtr.h>
 #include <wtf/RandomNumber.h>
+#include <wtf/brew/RefPtrBrew.h>
 #include <wtf/brew/ShellBrew.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
 bool getFileSize(const String& path, long long& result)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
     FileInfo info;
 
     if (IFILEMGR_GetInfo(fileMgr.get(), path.utf8().data(), &info) == SUCCESS) {
@@ -67,21 +66,21 @@ bool getFileModificationTime(const String& path, time_t& result)
 
 bool fileExists(const String& path)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     return (IFILEMGR_Test(fileMgr.get(), path.utf8().data()) == SUCCESS);
 }
 
 bool deleteFile(const String& path)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     return (IFILEMGR_Remove(fileMgr.get(), path.utf8().data()) == SUCCESS);
 }
 
 bool deleteEmptyDirectory(const String& path)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     return (IFILEMGR_RmDir(fileMgr.get(), path.utf8().data()) == SUCCESS);
 }
@@ -110,7 +109,7 @@ CString fileSystemRepresentation(const String& path)
 
 static String canonicalPath(const String& path)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     // Get the buffer size required to resolve the path.
     int canonPathLen;
@@ -163,7 +162,7 @@ static bool makeAllDirectories(IFileMgr* fileManager, const String& path)
 
 bool makeAllDirectories(const String& path)
 {
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     return makeAllDirectories(fileMgr.get(), canonicalPath(path));
 }
@@ -193,7 +192,7 @@ CString openTemporaryFile(const char* prefix, PlatformFileHandle& handle)
     // use "fs:/~/tmp" as our temporary directory.
     String tempPath("fs:/~/tmp");
 
-    OwnPtr<IFileMgr> fileMgr = createInstance<IFileMgr>(AEECLSID_FILEMGR);
+    PlatformRefPtr<IFileMgr> fileMgr = createRefPtrInstance<IFileMgr>(AEECLSID_FILEMGR);
 
     // Create the temporary directory if it does not exist.
     IFILEMGR_MkDir(fileMgr.get(), tempPath.utf8().data());
diff --git a/WebCore/platform/brew/PlatformKeyboardEventBrew.cpp b/WebCore/platform/brew/PlatformKeyboardEventBrew.cpp
index 3384a4f..fc6a753 100644
--- a/WebCore/platform/brew/PlatformKeyboardEventBrew.cpp
+++ b/WebCore/platform/brew/PlatformKeyboardEventBrew.cpp
@@ -30,9 +30,14 @@
 #include "WindowsKeyboardCodes.h"
 
 #include <AEEEvent.h>
+#include <AEEIKeysMapping.h>
+#include <AEEKeysMapping.bid>
 #include <AEEStdDef.h>
 #include <AEEVCodes.h>
 
+#include <wtf/brew/RefPtrBrew.h>
+#include <wtf/brew/ShellBrew.h>
+
 namespace WebCore {
 
 static String keyIdentifierForBrewKeyCode(uint16 keyCode)
@@ -143,23 +148,93 @@ static int windowsKeyCodeForKeyEvent(uint16 code)
 
 static inline String singleCharacterString(UChar c)
 {
-    return String(&c, 1);
+    UChar text;
+
+    // Some key codes are not mapped to Unicode characters. Convert them to Unicode characters here.
+    switch (c) {
+    case AVK_0:
+        text = VK_0;
+        break;
+    case AVK_1:
+        text = VK_1;
+        break;
+    case AVK_2:
+        text = VK_2;
+        break;
+    case AVK_3:
+        text = VK_3;
+        break;
+    case AVK_4:
+        text = VK_4;
+        break;
+    case AVK_5:
+        text = VK_5;
+        break;
+    case AVK_6:
+        text = VK_6;
+        break;
+    case AVK_7:
+        text = VK_7;
+        break;
+    case AVK_8:
+        text = VK_8;
+        break;
+    case AVK_9:
+        text = VK_9;
+        break;
+    case AVK_STAR:
+        text = '*';
+        break;
+    case AVK_POUND:
+        text = '#';
+        break;
+    case AVK_FUNCTION1:
+        text = '=';
+        break;
+    case AVK_FUNCTION2:
+        text = '/';
+        break;
+    case AVK_FUNCTION3:
+        text = '_';
+        break;
+    case AVK_PUNC1:
+        text = ',';
+        break;
+    case AVK_PUNC2:
+        text = '.';
+        break;
+    case AVK_SPACE:
+        text = VK_SPACE;
+        break;
+    default:
+        text = c;
+        break;
+    }
+
+    return String(&text, 1);
 }
 
 PlatformKeyboardEvent::PlatformKeyboardEvent(AEEEvent event, uint16 code, uint32 modifiers, Type type)
     : m_type(type)
-    , m_text((type == Char) ? singleCharacterString(code) : String())
-    , m_unmodifiedText((type == Char) ? singleCharacterString(code) : String())
-    , m_keyIdentifier((type == Char) ? String() : keyIdentifierForBrewKeyCode(code))
-    , m_autoRepeat(modifiers & KB_AUTOREPEAT)
-    , m_windowsVirtualKeyCode((type == RawKeyDown || type == KeyUp) ? windowsKeyCodeForKeyEvent(code) : 0)
-    , m_nativeVirtualKeyCode(code)
     , m_isKeypad(false)
-    , m_shiftKey(modifiers & (KB_LSHIFT | KB_RSHIFT))
-    , m_ctrlKey(modifiers & (KB_LCTRL | KB_RCTRL))
-    , m_altKey(modifiers & (KB_LALT | KB_RALT))
     , m_metaKey(false)
+    , m_windowsVirtualKeyCode((type == RawKeyDown || type == KeyUp) ? windowsKeyCodeForKeyEvent(code) : 0)
 {
+    if ((m_type == Char) && modifiers) {
+        PlatformRefPtr<IKeysMapping> keysMapping = createRefPtrInstance<IKeysMapping>(AEECLSID_KeysMapping);
+        int result = IKeysMapping_GetMapping(keysMapping.get(), code, modifiers, reinterpret_cast<AECHAR*>(&code));
+        if (result == AEE_SUCCESS) // Reset the modifier when key code is successfully mapped.
+            modifiers = 0;
+    }
+
+    m_text = (type == Char) ? singleCharacterString(code) : String();
+    m_unmodifiedText = (type == Char) ? singleCharacterString(code) : String();
+    m_keyIdentifier = (type == Char) ? String() : keyIdentifierForBrewKeyCode(code);
+    m_nativeVirtualKeyCode = code;
+    m_autoRepeat = modifiers & KB_AUTOREPEAT;
+    m_shiftKey = modifiers & (KB_LSHIFT | KB_RSHIFT);
+    m_ctrlKey = modifiers & (KB_LCTRL | KB_RCTRL);
+    m_altKey = modifiers & (KB_LALT | KB_RALT);
 }
 
 void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool)
diff --git a/WebCore/platform/brew/ScreenBrew.cpp b/WebCore/platform/brew/ScreenBrew.cpp
index b141b34..53e53d0 100644
--- a/WebCore/platform/brew/ScreenBrew.cpp
+++ b/WebCore/platform/brew/ScreenBrew.cpp
@@ -36,6 +36,7 @@
 
 #include <AEEAppGen.h>
 #include <AEEStdLib.h>
+#include <wtf/brew/RefPtrBrew.h>
 
 namespace WebCore {
 
@@ -48,17 +49,14 @@ struct DisplayInfo {
 static void getDisplayInfo(DisplayInfo& info)
 {
     IDisplay* display = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIDisplay;
-    IBitmap* bitmap = IDisplay_GetDestination(display);
-    ASSERT(bitmap);
+    PlatformRefPtr<IBitmap> bitmap = adoptPlatformRef(IDisplay_GetDestination(display));
 
     AEEBitmapInfo bitmapInfo;
-    IBitmap_GetInfo(bitmap, &bitmapInfo, sizeof(AEEBitmapInfo));
+    IBitmap_GetInfo(bitmap.get(), &bitmapInfo, sizeof(AEEBitmapInfo));
 
     info.width  = bitmapInfo.cx;
     info.height = bitmapInfo.cy;
     info.depth  = bitmapInfo.nDepth;
-
-    IBitmap_Release(bitmap);
 }
 
 FloatRect screenRect(Widget*)
diff --git a/WebCore/platform/chromium/ChromiumBridge.h b/WebCore/platform/chromium/ChromiumBridge.h
index 121ec4b..74bad04 100644
--- a/WebCore/platform/chromium/ChromiumBridge.h
+++ b/WebCore/platform/chromium/ChromiumBridge.h
@@ -154,9 +154,10 @@ namespace WebCore {
         // Forms --------------------------------------------------------------
         static void notifyFormStateChanged(const Document*);
 
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
         // Geolocation --------------------------------------------------------
         static GeolocationServiceBridge* createGeolocationServiceBridge(GeolocationServiceChromium*);
-
+#endif
         // Databases ----------------------------------------------------------
         // Returns a handle to the DB file and ooptionally a handle to its containing directory
         static PlatformFileHandle databaseOpenFile(const String& vfsFleName, int desiredFlags);
@@ -254,6 +255,45 @@ namespace WebCore {
             GraphicsContext*, int part, int state, int classicState, const IntRect&);
         static void paintProgressBar(
             GraphicsContext*, const IntRect& barRect, const IntRect& valueRect, bool determinate, double animatedSeconds);
+#elif OS(LINUX)
+        // The UI part which is being accessed.
+        enum ThemePart {
+            PartScrollbarDownArrow,
+            PartScrollbarLeftArrow,
+            PartScrollbarRightArrow,
+            PartScrollbarUpArrow,
+            PartScrollbarHorizontalThumb,
+            PartScrollbarVerticalThumb,
+            PartScrollbarHoriztonalTrack,
+            PartScrollbarVerticalTrack,
+        };
+
+        // The current state of the associated Part.
+        enum ThemePaintState {
+            StateDisabled,
+            StateHover,
+            StateNormal,
+            StatePressed,
+        };
+
+        struct ScrollbarTrackExtraParams {
+            // The bounds of the entire track, as opposed to the part being painted.
+            int trackX;
+            int trackY;
+            int trackWidth;
+            int trackHeight;
+        };
+
+        union ThemePaintExtraParams {
+            ScrollbarTrackExtraParams scrollbarTrack;
+        };
+
+        // Gets the size of the given theme part. For variable sized items
+        // like vertical scrollbar thumbs, the width will be the required width of
+        // the track while the height will be the minimum height.
+        static IntSize getThemePartSize(ThemePart);
+        // Paint the given the given theme part.
+        static void paintThemePart(GraphicsContext*, ThemePart, ThemePaintState, const IntRect&, const ThemePaintExtraParams*);
 #endif
 
         // Trace Event --------------------------------------------------------
diff --git a/WebCore/platform/chromium/ChromiumDataObject.cpp b/WebCore/platform/chromium/ChromiumDataObject.cpp
index 8352669..78b794b 100644
--- a/WebCore/platform/chromium/ChromiumDataObject.cpp
+++ b/WebCore/platform/chromium/ChromiumDataObject.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2010, Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -33,54 +33,187 @@
 
 namespace WebCore {
 
-void ChromiumDataObject::clear()
+ChromiumDataObject::ChromiumDataObject(PassRefPtr<ChromiumDataObjectLegacy> data)
+    : RefCounted<ChromiumDataObject>()
+    , m_legacyData(data)
+{
+}
+
+ChromiumDataObject::ChromiumDataObject(PassRefPtr<ReadableDataObject> data)
+    : RefCounted<ChromiumDataObject>()
+    , m_readableData(data)
+{
+}
+
+ChromiumDataObject::ChromiumDataObject(PassRefPtr<WritableDataObject> data)
+    : RefCounted<ChromiumDataObject>()
+    , m_writableData(data)
+{
+}
+
+PassRefPtr<ChromiumDataObject> ChromiumDataObject::create(PassRefPtr<ChromiumDataObjectLegacy> data)
+{
+    return adoptRef(new ChromiumDataObject(data));
+}
+
+PassRefPtr<ChromiumDataObject> ChromiumDataObject::createReadable(Clipboard::ClipboardType clipboardType)
+{
+    return adoptRef(new ChromiumDataObject(ReadableDataObject::create(clipboardType)));
+}
+
+PassRefPtr<ChromiumDataObject> ChromiumDataObject::createWritable(Clipboard::ClipboardType clipboardType)
+{
+    return adoptRef(new ChromiumDataObject(WritableDataObject::create(clipboardType)));
+}
+
+void ChromiumDataObject::clearData(const String& type)
+{
+    if (m_legacyData)
+        m_legacyData->clearData(type);
+    else
+        m_writableData->clearData(type);
+}
+
+void ChromiumDataObject::clearAll()
 {
-    clearAllExceptFiles();
-    filenames.clear();
+    if (m_legacyData)
+        m_legacyData->clearAll();
+    else
+        m_writableData->clearAll();
 }
 
 void ChromiumDataObject::clearAllExceptFiles()
 {
-    url = KURL();
-    urlTitle = "";
-    uriList.clear();
-    downloadMetadata = "";
-    fileExtension = "";
-    plainText = "";
-    textHtml = "";
-    htmlBaseUrl = KURL();
-    fileContentFilename = "";
-    if (fileContent)
-        fileContent->clear();
+    if (m_legacyData)
+        m_legacyData->clearAllExceptFiles();
+    else
+        m_writableData->clearAllExceptFiles();
 }
 
 bool ChromiumDataObject::hasData() const
 {
-    return !url.isEmpty()
-        || !uriList.isEmpty()
-        || !downloadMetadata.isEmpty()
-        || !fileExtension.isEmpty()
-        || !filenames.isEmpty()
-        || !plainText.isEmpty()
-        || !textHtml.isEmpty()
-        || fileContent;
+    if (m_legacyData)
+        return m_legacyData->hasData();
+    return m_readableData->hasData();
+}
+
+HashSet<String> ChromiumDataObject::types() const
+{
+    if (m_legacyData)
+        return m_legacyData->types();
+    return m_readableData->types();
+}
+
+String ChromiumDataObject::getData(const String& type, bool& success)
+{
+    if (m_legacyData)
+        return m_legacyData->getData(type, success);
+    return m_readableData->getData(type, success);
+}
+
+bool ChromiumDataObject::setData(const String& type, const String& data)
+{
+    if (m_legacyData)
+        return m_legacyData->setData(type, data);
+    return m_writableData->setData(type, data);
+}
+
+String ChromiumDataObject::urlTitle() const
+{
+    if (m_legacyData)
+        return m_legacyData->urlTitle();
+    return m_readableData->urlTitle();
+}
+
+void ChromiumDataObject::setUrlTitle(const String& urlTitle)
+{
+    if (m_legacyData)
+        m_legacyData->setUrlTitle(urlTitle);
+    else
+        m_writableData->setUrlTitle(urlTitle);
+}
+
+KURL ChromiumDataObject::htmlBaseUrl() const
+{
+    if (m_legacyData)
+        return m_legacyData->htmlBaseUrl();
+    return m_readableData->htmlBaseUrl();
+}
+
+void ChromiumDataObject::setHtmlBaseUrl(const KURL& url)
+{
+    if (m_legacyData)
+        m_legacyData->setHtmlBaseUrl(url);
+    else
+        m_writableData->setHtmlBaseUrl(url);
+}
+
+bool ChromiumDataObject::containsFilenames() const
+{
+    if (m_legacyData)
+        return m_legacyData->containsFilenames();
+    return m_readableData->containsFilenames();
+}
+
+Vector<String> ChromiumDataObject::filenames() const
+{
+    if (m_legacyData)
+        return m_legacyData->filenames();
+    return m_readableData->filenames();
+}
+
+void ChromiumDataObject::setFilenames(const Vector<String>& filenames)
+{
+    if (m_legacyData)
+        m_legacyData->setFilenames(filenames);
+    else
+        ASSERT_NOT_REACHED();
+}
+
+String ChromiumDataObject::fileExtension() const
+{
+    if (m_legacyData)
+        return m_legacyData->fileExtension();
+    return m_writableData->fileExtension();
+}
+
+void ChromiumDataObject::setFileExtension(const String& fileExtension)
+{
+    if (m_legacyData)
+        m_legacyData->setFileExtension(fileExtension);
+    else
+        m_writableData->setFileExtension(fileExtension);
+}
+
+String ChromiumDataObject::fileContentFilename() const
+{
+    if (m_legacyData)
+        return m_legacyData->fileContentFilename();
+    return m_writableData->fileContentFilename();
+}
+
+void ChromiumDataObject::setFileContentFilename(const String& fileContentFilename)
+{
+    if (m_legacyData)
+          m_legacyData->setFileContentFilename(fileContentFilename);
+    else
+          m_writableData->setFileContentFilename(fileContentFilename);
+}
+
+PassRefPtr<SharedBuffer> ChromiumDataObject::fileContent() const
+{
+    if (m_legacyData)
+        return m_legacyData->fileContent();
+    return m_writableData->fileContent();
+}
+
+void ChromiumDataObject::setFileContent(PassRefPtr<SharedBuffer> fileContent)
+{
+    if (m_legacyData)
+        m_legacyData->setFileContent(fileContent);
+    else
+        m_writableData->setFileContent(fileContent);
+}
+
 }
 
-ChromiumDataObject::ChromiumDataObject(const ChromiumDataObject& other)
-    : RefCounted<ChromiumDataObject>()
-    , urlTitle(other.urlTitle)
-    , downloadMetadata(other.downloadMetadata)
-    , fileExtension(other.fileExtension)
-    , filenames(other.filenames)
-    , plainText(other.plainText)
-    , textHtml(other.textHtml)
-    , htmlBaseUrl(other.htmlBaseUrl)
-    , fileContentFilename(other.fileContentFilename)
-    , url(other.url)
-    , uriList(other.uriList)
-{
-    if (other.fileContent.get())
-        fileContent = other.fileContent->copy();
-}
-
-} // namespace WebCore
diff --git a/WebCore/platform/chromium/ChromiumDataObject.h b/WebCore/platform/chromium/ChromiumDataObject.h
index af0a3fa..4aac5c9 100644
--- a/WebCore/platform/chromium/ChromiumDataObject.h
+++ b/WebCore/platform/chromium/ChromiumDataObject.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * Copyright (c) 2010, Google Inc. All rights reserved.
  * 
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
@@ -31,85 +31,58 @@
 #ifndef ChromiumDataObject_h
 #define ChromiumDataObject_h
 
-#include "KURL.h"
-#include "PlatformString.h"
-#include "SharedBuffer.h"
+#include "ChromiumDataObjectLegacy.h"
+#include "ReadableDataObject.h"
+#include "WritableDataObject.h"
 #include <wtf/RefPtr.h>
-#include <wtf/Vector.h>
 
 namespace WebCore {
 
-    // A data object for holding data that would be in a clipboard or moved
-    // during a drag-n-drop operation.  This is the data that WebCore is aware
-    // of and is not specific to a platform.
-    class ChromiumDataObject : public RefCounted<ChromiumDataObject> {
-    public:
-        static PassRefPtr<ChromiumDataObject> create()
-        {
-            return adoptRef(new ChromiumDataObject);
-        }
-
-        PassRefPtr<ChromiumDataObject> copy() const
-        {
-            return adoptRef(new ChromiumDataObject(*this));
-        }
-
-        void clear();
-        void clearAllExceptFiles();
-        bool hasData() const;
-
-        void clearURL()
-        {
-            url = KURL();
-            uriList.clear();
-            urlTitle = "";
-        }
-
-        bool hasValidURL() const
-        {
-            return url.isValid();
-        }
-
-        KURL getURL() const
-        {
-            return url;
-        }
-
-        void setURL(const KURL& newURL)
-        {
-            url = newURL;
-            uriList.clear();
-            if (newURL.isEmpty())
-                return;
-            uriList.append(newURL.string());
-        }
-
-        String urlTitle;
-
-        String downloadMetadata;
-
-        String fileExtension;
-        Vector<String> filenames;
-
-        String plainText;
-
-        String textHtml;
-        KURL htmlBaseUrl;
-
-        String fileContentFilename;
-        RefPtr<SharedBuffer> fileContent;
-
-    private:
-        // URL and uri-list are linked, so they should not be accessed individually.
-        KURL url;
-        Vector<String> uriList;
-
-        ChromiumDataObject() {}
-        ChromiumDataObject(const ChromiumDataObject&);
-
-        friend class ClipboardChromium;
-    };
-
-} // namespace WebCore
+class ChromiumDataObject : public RefCounted<ChromiumDataObject> {
+public:
+    static PassRefPtr<ChromiumDataObject> create(PassRefPtr<ChromiumDataObjectLegacy> data);
+    static PassRefPtr<ChromiumDataObject> createReadable(Clipboard::ClipboardType);
+    static PassRefPtr<ChromiumDataObject> createWritable(Clipboard::ClipboardType);
+
+    void clearData(const String& type);
+    void clearAll();
+    void clearAllExceptFiles();
+
+    bool hasData() const;
+
+    HashSet<String> types() const;
+    String getData(const String& type, bool& success);
+    bool setData(const String& type, const String& data);
+
+    // Special handlers for URL/HTML metadata.
+    String urlTitle() const;
+    void setUrlTitle(const String& urlTitle);
+    KURL htmlBaseUrl() const;
+    void setHtmlBaseUrl(const KURL& url);
+
+    // Used to handle files being dragged in.
+    bool containsFilenames() const;
+    Vector<String> filenames() const;
+    void setFilenames(const Vector<String>& filenames);
+
+    // Used to handle files (images) being dragged out.
+    String fileExtension() const;
+    void setFileExtension(const String& fileExtension);
+    String fileContentFilename() const;
+    void setFileContentFilename(const String& fileContentFilename);
+    PassRefPtr<SharedBuffer> fileContent() const;
+    void setFileContent(PassRefPtr<SharedBuffer> fileContent);
+
+private:
+    ChromiumDataObject(PassRefPtr<ChromiumDataObjectLegacy>);
+    ChromiumDataObject(PassRefPtr<ReadableDataObject>);
+    ChromiumDataObject(PassRefPtr<WritableDataObject>);
+
+    RefPtr<ChromiumDataObjectLegacy> m_legacyData;
+    RefPtr<ReadableDataObject> m_readableData;
+    RefPtr<WritableDataObject> m_writableData;
+};
+
+}
 
 #endif
diff --git a/WebCore/platform/chromium/ChromiumDataObjectLegacy.cpp b/WebCore/platform/chromium/ChromiumDataObjectLegacy.cpp
new file mode 100644
index 0000000..a2952c0
--- /dev/null
+++ b/WebCore/platform/chromium/ChromiumDataObjectLegacy.cpp
@@ -0,0 +1,249 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ChromiumDataObjectLegacy.h"
+
+#include "ChromiumBridge.h"
+#include "ClipboardMimeTypes.h"
+#include "Pasteboard.h"
+
+namespace WebCore {
+
+// Per RFC 2483, the line separator for "text/..." MIME types is CR-LF.
+static char const* const textMIMETypeLineSeparator = "\r\n";
+
+void ChromiumDataObjectLegacy::clearData(const String& type)
+{
+    if (type == mimeTypeTextPlain) {
+        m_plainText = "";
+        return;
+    }
+
+    if (type == mimeTypeURL || type == mimeTypeTextURIList) {
+        m_uriList = "";
+        m_url = KURL();
+        m_urlTitle = "";
+        return;
+    }
+
+    if (type == mimeTypeTextHTML) {
+        m_textHtml = "";
+        m_htmlBaseUrl = KURL();
+        return;
+    }
+
+    if (type == mimeTypeDownloadURL) {
+        m_downloadMetadata = "";
+        return;
+    }
+}
+
+void ChromiumDataObjectLegacy::clearAll()
+{
+    clearAllExceptFiles();
+    m_filenames.clear();
+}
+
+void ChromiumDataObjectLegacy::clearAllExceptFiles()
+{
+    m_urlTitle = "";
+    m_url = KURL();
+    m_uriList = "";
+    m_downloadMetadata = "";
+    m_fileExtension = "";
+    m_plainText = "";
+    m_textHtml = "";
+    m_htmlBaseUrl = KURL();
+    m_fileContentFilename = "";
+    if (m_fileContent)
+        m_fileContent->clear();
+}
+
+bool ChromiumDataObjectLegacy::hasData() const
+{
+    return !m_url.isEmpty()
+        || !m_uriList.isEmpty()
+        || !m_downloadMetadata.isEmpty()
+        || !m_fileExtension.isEmpty()
+        || !m_filenames.isEmpty()
+        || !m_plainText.isEmpty()
+        || !m_textHtml.isEmpty()
+        || m_fileContent;
+}
+
+HashSet<String> ChromiumDataObjectLegacy::types() const
+{
+    // This is currently broken for pasteboard events, and always has been.
+    HashSet<String> results;
+
+    if (!m_plainText.isEmpty()) {
+        results.add(mimeTypeText);
+        results.add(mimeTypeTextPlain);
+    }
+
+    if (m_url.isValid())
+        results.add(mimeTypeURL);
+
+    if (!m_uriList.isEmpty())
+        results.add(mimeTypeTextURIList);
+
+    if (!m_textHtml.isEmpty())
+        results.add(mimeTypeTextHTML);
+
+    if (!m_filenames.isEmpty())
+        results.add("Files");
+
+    return results;
+}
+
+String ChromiumDataObjectLegacy::getData(const String& type, bool& success)
+{
+    if (type == mimeTypeTextPlain) {
+        if (m_clipboardType == Clipboard::CopyAndPaste) {
+            PasteboardPrivate::ClipboardBuffer buffer =
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer :
+                PasteboardPrivate::StandardBuffer;
+            String text = ChromiumBridge::clipboardReadPlainText(buffer);
+            success = !text.isEmpty();
+            return text;
+        }
+        success = !m_plainText.isEmpty();
+        return m_plainText;
+    }
+
+    if (type == mimeTypeURL) {
+        success = !m_url.isEmpty();
+        return m_url.string();
+    }
+
+    if (type == mimeTypeTextURIList) {
+        success = !m_uriList.isEmpty();
+        return m_uriList;
+    }
+
+    if (type == mimeTypeTextHTML) {
+        if (m_clipboardType == Clipboard::CopyAndPaste) {
+            PasteboardPrivate::ClipboardBuffer buffer =
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer :
+                PasteboardPrivate::StandardBuffer;
+            String htmlText;
+            KURL sourceURL;
+            ChromiumBridge::clipboardReadHTML(buffer, &htmlText, &sourceURL);
+            success = !htmlText.isEmpty();
+            return htmlText;
+        }
+        success = !m_textHtml.isEmpty();
+        return m_textHtml;
+    }
+
+    if (type == mimeTypeDownloadURL) {
+        success = !m_downloadMetadata.isEmpty();
+        return m_downloadMetadata;
+    }
+
+    success = false;
+    return String();
+}
+
+bool ChromiumDataObjectLegacy::setData(const String& type, const String& data)
+{
+    if (type == mimeTypeTextPlain) {
+        m_plainText = data;
+        return true;
+    }
+
+    if (type == mimeTypeURL || type == mimeTypeTextURIList) {
+        m_url = KURL();
+        Vector<String> uriList;
+        // Line separator is \r\n per RFC 2483 - however, for compatibility
+        // reasons we also allow just \n here.
+        data.split('\n', uriList);
+        // Process the input and copy the first valid URL into the url member.
+        // In case no URLs can be found, subsequent calls to getData("URL")
+        // will get an empty string. This is in line with the HTML5 spec (see
+        // "The DragEvent and DataTransfer interfaces").
+        for (size_t i = 0; i < uriList.size(); ++i) {
+            String& line = uriList[i];
+            line = line.stripWhiteSpace();
+            if (line.isEmpty())
+                continue;
+            if (line[0] == '#')
+                continue;
+            KURL url = KURL(ParsedURLString, line);
+            if (url.isValid()) {
+                m_url = url;
+                break;
+            }
+        }
+        m_uriList = data;
+        return true;
+    }
+
+    if (type == mimeTypeTextHTML) {
+        m_textHtml = data;
+        m_htmlBaseUrl = KURL();
+        return true;
+    }
+
+    if (type == mimeTypeDownloadURL) {
+        m_downloadMetadata = data;
+        return true;
+    }
+
+    return false;
+}
+
+ChromiumDataObjectLegacy::ChromiumDataObjectLegacy(Clipboard::ClipboardType clipboardType)
+    : m_clipboardType(clipboardType)
+{
+}
+
+ChromiumDataObjectLegacy::ChromiumDataObjectLegacy(const ChromiumDataObjectLegacy& other)
+    : RefCounted<ChromiumDataObjectLegacy>()
+    , m_clipboardType(other.m_clipboardType)
+    , m_urlTitle(other.m_urlTitle)
+    , m_downloadMetadata(other.m_downloadMetadata)
+    , m_fileExtension(other.m_fileExtension)
+    , m_filenames(other.m_filenames)
+    , m_plainText(other.m_plainText)
+    , m_textHtml(other.m_textHtml)
+    , m_htmlBaseUrl(other.m_htmlBaseUrl)
+    , m_fileContentFilename(other.m_fileContentFilename)
+    , m_url(other.m_url)
+    , m_uriList(other.m_uriList)
+{
+    if (other.m_fileContent.get())
+        m_fileContent = other.m_fileContent->copy();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/chromium/ChromiumDataObjectLegacy.h b/WebCore/platform/chromium/ChromiumDataObjectLegacy.h
new file mode 100644
index 0000000..55be7aa
--- /dev/null
+++ b/WebCore/platform/chromium/ChromiumDataObjectLegacy.h
@@ -0,0 +1,119 @@
+/*
+ * Copyright (c) 2008, 2009, Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ChromiumDataObjectLegacy_h
+#define ChromiumDataObjectLegacy_h
+
+#include "Clipboard.h"
+#include "KURL.h"
+#include "PlatformString.h"
+#include "SharedBuffer.h"
+#include <wtf/HashSet.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+#include <wtf/text/StringHash.h>
+
+namespace WebCore {
+
+// A data object for holding data that would be in a clipboard or moved
+// during a drag-n-drop operation.  This is the data that WebCore is aware
+// of and is not specific to a platform.
+class ChromiumDataObjectLegacy : public RefCounted<ChromiumDataObjectLegacy> {
+public:
+    static PassRefPtr<ChromiumDataObjectLegacy> create(Clipboard::ClipboardType clipboardType)
+    {
+        return adoptRef(new ChromiumDataObjectLegacy(clipboardType));
+    }
+
+    PassRefPtr<ChromiumDataObjectLegacy> copy() const
+    {
+        return adoptRef(new ChromiumDataObjectLegacy(*this));
+    }
+
+    void clearData(const String& type);
+    void clearAll();
+    void clearAllExceptFiles();
+
+    bool hasData() const;
+
+    HashSet<String> types() const;
+    String getData(const String& type, bool& success);
+    bool setData(const String& type, const String& data);
+
+    // Special handlers for URL/HTML metadata.
+    String urlTitle() const { return m_urlTitle; }
+    void setUrlTitle(const String& urlTitle) { m_urlTitle = urlTitle; }
+    KURL htmlBaseUrl() const { return m_htmlBaseUrl; }
+    void setHtmlBaseUrl(const KURL& url) { m_htmlBaseUrl = url; }
+
+    // Used to handle files being dragged in.
+    bool containsFilenames() const { return !m_filenames.isEmpty(); }
+    Vector<String> filenames() const { return m_filenames; }
+    void setFilenames(const Vector<String>& filenames) { m_filenames = filenames; }
+
+    // Used to handle files (images) being dragged out.
+    String fileExtension() const { return m_fileExtension; }
+    void setFileExtension(const String& fileExtension) { m_fileExtension = fileExtension; }
+    String fileContentFilename() const { return m_fileContentFilename; }
+    void setFileContentFilename(const String& fileContentFilename) { m_fileContentFilename = fileContentFilename; }
+    PassRefPtr<SharedBuffer> fileContent() const { return m_fileContent; }
+    void setFileContent(PassRefPtr<SharedBuffer> fileContent) { m_fileContent = fileContent; }
+
+private:
+    ChromiumDataObjectLegacy(Clipboard::ClipboardType);
+    ChromiumDataObjectLegacy(const ChromiumDataObjectLegacy&);
+
+    Clipboard::ClipboardType m_clipboardType;
+
+    String m_urlTitle;
+
+    String m_downloadMetadata;
+
+    String m_fileExtension;
+    Vector<String> m_filenames;
+
+    String m_plainText;
+
+    String m_textHtml;
+    KURL m_htmlBaseUrl;
+
+    String m_fileContentFilename;
+    RefPtr<SharedBuffer> m_fileContent;
+
+    // These two are linked. Setting m_url will set m_uriList to the same
+    // string value; setting m_uriList will cause its contents to be parsed
+    // according to RFC 2483 and the first URL found will be set in m_url.
+    KURL m_url;
+    String m_uriList;
+};
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/chromium/ClipboardChromium.cpp b/WebCore/platform/chromium/ClipboardChromium.cpp
index c2ec80c..46b4339 100644
--- a/WebCore/platform/chromium/ClipboardChromium.cpp
+++ b/WebCore/platform/chromium/ClipboardChromium.cpp
@@ -28,8 +28,8 @@
 #include "ClipboardChromium.h"
 
 #include "CachedImage.h"
-#include "ChromiumBridge.h"
 #include "ChromiumDataObject.h"
+#include "ClipboardMimeTypes.h"
 #include "ClipboardUtilitiesChromium.h"
 #include "Document.h"
 #include "DragData.h"
@@ -37,17 +37,18 @@
 #include "FileList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "Image.h"
 #include "MIMETypeRegistry.h"
 #include "NamedNodeMap.h"
-#include "Pasteboard.h"
-#include "PlatformString.h"
 #include "Range.h"
 #include "RenderImage.h"
 #include "ScriptExecutionContext.h"
-#include "StringBuilder.h"
 #include "markup.h"
 
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
 namespace WebCore {
 
 using namespace HTMLNames;
@@ -55,40 +56,12 @@ using namespace HTMLNames;
 // We provide the IE clipboard types (URL and Text), and the clipboard types specified in the WHATWG Web Applications 1.0 draft
 // see http://www.whatwg.org/specs/web-apps/current-work/ Section 6.3.5.3
 
-enum ClipboardDataType {
-    ClipboardDataTypeNone,
-
-    ClipboardDataTypeURL,
-    ClipboardDataTypeURIList,
-    ClipboardDataTypeDownloadURL,
-    ClipboardDataTypePlainText,
-    ClipboardDataTypeHTML,
-
-    ClipboardDataTypeOther,
-};
-
-// Per RFC 2483, the line separator for "text/..." MIME types is CR-LF.
-static char const* const textMIMETypeLineSeparator = "\r\n";
-
-static ClipboardDataType clipboardTypeFromMIMEType(const String& type)
+static String normalizeType(const String& type)
 {
     String cleanType = type.stripWhiteSpace().lower();
-    if (cleanType.isEmpty())
-        return ClipboardDataTypeNone;
-
-    // Includes two special cases for IE compatibility.
-    if (cleanType == "text" || cleanType == "text/plain" || cleanType.startsWith("text/plain;"))
-        return ClipboardDataTypePlainText;
-    if (cleanType == "url")
-        return ClipboardDataTypeURL;
-    if (cleanType == "text/uri-list")
-        return ClipboardDataTypeURIList;
-    if (cleanType == "downloadurl")
-        return ClipboardDataTypeDownloadURL;
-    if (cleanType == "text/html")
-        return ClipboardDataTypeHTML;
-
-    return ClipboardDataTypeOther;
+    if (cleanType == mimeTypeText || cleanType.startsWith(mimeTypeTextPlainEtc))
+        return mimeTypeTextPlain;
+    return cleanType;
 }
 
 PassRefPtr<Clipboard> Clipboard::create(ClipboardAccessPolicy policy, DragData* dragData, Frame* frame)
@@ -112,41 +85,22 @@ PassRefPtr<ClipboardChromium> ClipboardChromium::create(ClipboardType clipboardT
     return adoptRef(new ClipboardChromium(clipboardType, dataObject, policy, frame));
 }
 
+PassRefPtr<ClipboardChromium> ClipboardChromium::create(ClipboardType clipboardType,
+    ClipboardAccessPolicy policy, Frame* frame)
+{
+    RefPtr<ChromiumDataObject> dataObject =
+        policy == ClipboardWritable ?
+        ChromiumDataObject::createWritable(clipboardType) :
+        ChromiumDataObject::createReadable(clipboardType);
+    return adoptRef(new ClipboardChromium(clipboardType, dataObject, policy, frame));
+}
+
 void ClipboardChromium::clearData(const String& type)
 {
     if (policy() != ClipboardWritable || !m_dataObject)
         return;
 
-    ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
-    switch (dataType) {
-    case ClipboardDataTypeNone:
-        // If called with no arguments, everything except the file list must be cleared.
-        // (See HTML5 spec, "The DragEvent and DataTransfer interfaces")
-        m_dataObject->clearAllExceptFiles();
-        return;
-
-    case ClipboardDataTypeURL:
-    case ClipboardDataTypeURIList:
-        m_dataObject->clearURL();
-        return;
-
-    case ClipboardDataTypeDownloadURL:
-        m_dataObject->downloadMetadata = "";
-        return;
-        
-    case ClipboardDataTypePlainText:
-        m_dataObject->plainText = "";
-        return;
-
-    case ClipboardDataTypeHTML:
-        m_dataObject->textHtml = "";
-        m_dataObject->htmlBaseUrl = KURL();
-        return;
-
-    case ClipboardDataTypeOther:
-        // Not yet implemented, see https://bugs.webkit.org/show_bug.cgi?id=34410
-        return;
-    }
+    m_dataObject->clearData(normalizeType(type));
 
     ASSERT_NOT_REACHED();
 }
@@ -156,7 +110,7 @@ void ClipboardChromium::clearAllData()
     if (policy() != ClipboardWritable)
         return;
 
-    m_dataObject->clear();
+    m_dataObject->clearAll();
 }
 
 String ClipboardChromium::getData(const String& type, bool& success) const
@@ -165,80 +119,7 @@ String ClipboardChromium::getData(const String& type, bool& success) const
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
-    ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
-    switch (dataType) {
-    case ClipboardDataTypeNone:
-        return String();
-
-    // Hack for URLs. file URLs are used internally for drop's default action, but we don't want
-    // to expose them to the page, so we filter them out here.
-    case ClipboardDataTypeURIList:
-        {
-            String text;
-            for (size_t i = 0; i < m_dataObject->uriList.size(); ++i) {
-                const String& uri = m_dataObject->uriList[i];
-                if (protocolIs(uri, "file"))
-                    continue;
-                ASSERT(!uri.isEmpty());
-                if (!text.isEmpty())
-                    text.append(textMIMETypeLineSeparator);
-                // URIs have already been canonicalized, so copy everything verbatim.
-                text.append(uri);
-            }
-            success = !text.isEmpty();
-            return text;
-        }
-
-    case ClipboardDataTypeURL:
-        // In case of a previous setData('text/uri-list'), setData() has already
-        // prepared the 'url' member, so we can just retrieve it here.
-        if (!m_dataObject->url.isEmpty() && !m_dataObject->url.isLocalFile()) {
-            success = true;
-            return m_dataObject->url.string();
-        }
-        return String();
-
-    case ClipboardDataTypeDownloadURL:
-        success = !m_dataObject->downloadMetadata.isEmpty();
-        return m_dataObject->downloadMetadata;
-    
-    case ClipboardDataTypePlainText:
-        if (isForCopyAndPaste()) {
-            PasteboardPrivate::ClipboardBuffer buffer = 
-                Pasteboard::generalPasteboard()->isSelectionMode() ?
-                PasteboardPrivate::SelectionBuffer : 
-                PasteboardPrivate::StandardBuffer;
-            String text = ChromiumBridge::clipboardReadPlainText(buffer);
-            success = !text.isEmpty();
-            return text;
-        }
-        // Otherwise return whatever is stored in plainText.
-        success = !m_dataObject->plainText.isEmpty();
-        return m_dataObject->plainText;
-
-    case ClipboardDataTypeHTML:
-        if (isForCopyAndPaste()) {
-            PasteboardPrivate::ClipboardBuffer buffer = 
-                Pasteboard::generalPasteboard()->isSelectionMode() ?
-                PasteboardPrivate::SelectionBuffer : 
-                PasteboardPrivate::StandardBuffer;
-            String htmlText;
-            KURL sourceURL;
-            ChromiumBridge::clipboardReadHTML(buffer, &htmlText, &sourceURL);
-            success = !htmlText.isEmpty();
-            return htmlText;
-        }
-        // Otherwise return whatever is stored in textHtml.
-        success = !m_dataObject->textHtml.isEmpty();
-        return m_dataObject->textHtml;
-
-    case ClipboardDataTypeOther:
-        // not yet implemented, see https://bugs.webkit.org/show_bug.cgi?id=34410
-        return String();
-    }
-
-    ASSERT_NOT_REACHED();
-    return String();
+    return m_dataObject->getData(normalizeType(type), success);
 }
 
 bool ClipboardChromium::setData(const String& type, const String& data)
@@ -246,69 +127,7 @@ bool ClipboardChromium::setData(const String& type, const String& data)
     if (policy() != ClipboardWritable)
         return false;
 
-    ClipboardDataType dataType = clipboardTypeFromMIMEType(type);
-    switch (dataType) {
-    case ClipboardDataTypeNone:
-        return false;
-
-    case ClipboardDataTypeURL:
-        // For setData(), "URL" must be treated as "text/uri-list".
-        // (See HTML5 spec, "The DragEvent and DataTransfer interfaces")
-    case ClipboardDataTypeURIList:
-        m_dataObject->url = KURL();
-        // Line separator is \r\n per RFC 2483 - however, for compatibility reasons
-        // we also allow just \n here. 
-        data.split('\n', m_dataObject->uriList);
-        // Strip white space on all lines, including trailing \r from above split.
-        // If this leaves a line empty, remove it completely.
-        //
-        // Also, copy the first valid URL into the 'url' member as well.
-        // In case no entry is a valid URL (i.e., remarks only), then we leave 'url' empty.
-        // I.e., in that case subsequent calls to getData("URL") will get an empty string.
-        // This is in line with the HTML5 spec (see "The DragEvent and DataTransfer interfaces").
-        for (size_t i = 0; i < m_dataObject->uriList.size(); /**/) {
-            String& line = m_dataObject->uriList[i];
-            line = line.stripWhiteSpace();
-            if (line.isEmpty()) {
-                m_dataObject->uriList.remove(i);
-                continue;
-            }
-            ++i;
-            // Only copy the first valid URL.
-            if (m_dataObject->url.isValid())
-                continue;
-            // Skip remarks.
-            if (line[0] == '#')
-                continue;
-            KURL url = KURL(ParsedURLString, line);
-            if (url.isValid())
-                m_dataObject->url = url;
-        }
-        if (m_dataObject->uriList.isEmpty()) {
-            ASSERT(m_dataObject->url.isEmpty());
-            return data.isEmpty();
-        }
-        return true;
-
-    case ClipboardDataTypeDownloadURL:
-        m_dataObject->downloadMetadata = data;
-        return true;
-
-    case ClipboardDataTypePlainText:
-        m_dataObject->plainText = data;
-        return true;
-
-    case ClipboardDataTypeHTML:
-        m_dataObject->textHtml = data;
-        return true;
-
-    case ClipboardDataTypeOther:
-        // Not yet implemented, see https://bugs.webkit.org/show_bug.cgi?id=34410
-        return false;
-    }
-    
-    ASSERT_NOT_REACHED();
-    return false;
+    return m_dataObject->setData(normalizeType(type), data);
 }
 
 // extensions beyond IE's API
@@ -321,33 +140,7 @@ HashSet<String> ClipboardChromium::types() const
     if (!m_dataObject)
         return results;
 
-    if (!m_dataObject->filenames.isEmpty())
-        results.add("Files");
-
-    // Hack for URLs. file URLs are used internally for drop's default action, but we don't want
-    // to expose them to the page, so we filter them out here.
-    if (m_dataObject->url.isValid() && !m_dataObject->url.isLocalFile()) {
-        ASSERT(!m_dataObject->uriList.isEmpty());
-        results.add("URL");
-    }
-
-    if (!m_dataObject->uriList.isEmpty()) {
-        // Verify that the URI list contains at least one non-file URL.
-        for (Vector<String>::const_iterator it = m_dataObject->uriList.begin();
-             it != m_dataObject->uriList.end(); ++it) {
-            if (!protocolIs(*it, "file")) {
-                // Note that even if the URI list is not empty, it may not actually
-                // contain a valid URL, so we can't return "URL" here.
-                results.add("text/uri-list");
-                break;
-            }
-        }
-    }
-
-    if (!m_dataObject->plainText.isEmpty()) {
-        results.add("Text");
-        results.add("text/plain");
-    }
+    results = m_dataObject->types();
 
     return results;
 }
@@ -357,12 +150,13 @@ PassRefPtr<FileList> ClipboardChromium::files() const
     if (policy() != ClipboardReadable)
         return FileList::create();
 
-    if (!m_dataObject || m_dataObject->filenames.isEmpty())
+    if (!m_dataObject)
         return FileList::create();
 
+    const Vector<String>& filenames = m_dataObject->filenames();
     RefPtr<FileList> fileList = FileList::create();
-    for (size_t i = 0; i < m_dataObject->filenames.size(); ++i)
-        fileList->append(File::create(m_dataObject->filenames.at(i)));
+    for (size_t i = 0; i < filenames.size(); ++i)
+        fileList->append(File::create(filenames.at(i)));
 
     return fileList.release();
 }
@@ -412,7 +206,7 @@ static String imageToMarkup(const String& url, Element* element)
     StringBuilder markup;
     markup.append("<img src=\"");
     markup.append(url);
-    markup.append("\"");
+    markup.append('"');
     // Copy over attributes.  If we are dragging an image, we expect things like
     // the id to be copied as well.
     NamedNodeMap* attrs = element->attributes();
@@ -421,13 +215,13 @@ static String imageToMarkup(const String& url, Element* element)
         Attribute* attr = attrs->attributeItem(i);
         if (attr->localName() == "src")
             continue;
-        markup.append(" ");
+        markup.append(' ');
         markup.append(attr->localName());
         markup.append("=\"");
         String escapedAttr = attr->value();
         escapedAttr.replace("\"", "&quot;");
         markup.append(escapedAttr);
-        markup.append("\"");
+        markup.append('"');
     }
 
     markup.append("/>");
@@ -461,7 +255,7 @@ static void writeImageToDataObject(ChromiumDataObject* dataObject, Element* elem
     if (!imageBuffer || !imageBuffer->size())
         return;
 
-    dataObject->fileContent = imageBuffer;
+    dataObject->setFileContent(imageBuffer);
 
     // Determine the filename for the file contents of the image.  We try to
     // use the alt tag if one exists, otherwise we fall back on the suggested
@@ -469,13 +263,13 @@ static void writeImageToDataObject(ChromiumDataObject* dataObject, Element* elem
     // in the URL.
     String extension = MIMETypeRegistry::getPreferredExtensionForMIMEType(
         cachedImage->response().mimeType());
-    dataObject->fileExtension = extension.isEmpty() ? "" : "." + extension;
+    dataObject->setFileExtension(extension.isEmpty() ? "" : "." + extension);
     String title = element->getAttribute(altAttr);
     if (title.isEmpty())
         title = cachedImage->response().suggestedFilename();
 
     title = ClipboardChromium::validateFileName(title, dataObject);
-    dataObject->fileContentFilename = title + dataObject->fileExtension;
+    dataObject->setFileContentFilename(title + dataObject->fileExtension());
 }
 
 void ClipboardChromium::declareAndWriteDragImage(Element* element, const KURL& url, const String& title, Frame* frame)
@@ -483,8 +277,8 @@ void ClipboardChromium::declareAndWriteDragImage(Element* element, const KURL& u
     if (!m_dataObject)
         return;
 
-    m_dataObject->url = url;
-    m_dataObject->urlTitle = title;
+    m_dataObject->setData(mimeTypeURL, url);
+    m_dataObject->setUrlTitle(title);
 
     // Write the bytes in the image to the file format.
     writeImageToDataObject(m_dataObject.get(), element, url);
@@ -493,12 +287,12 @@ void ClipboardChromium::declareAndWriteDragImage(Element* element, const KURL& u
     if (imageURL.isEmpty())
         return;
 
-    String fullURL = frame->document()->completeURL(deprecatedParseURL(imageURL));
+    String fullURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(imageURL));
     if (fullURL.isEmpty())
         return;
 
     // Put img tag on the clipboard referencing the image
-    m_dataObject->textHtml = imageToMarkup(fullURL, element);
+    m_dataObject->setData(mimeTypeTextHTML, imageToMarkup(fullURL, element));
 }
 
 void ClipboardChromium::writeURL(const KURL& url, const String& title, Frame*)
@@ -506,17 +300,15 @@ void ClipboardChromium::writeURL(const KURL& url, const String& title, Frame*)
     if (!m_dataObject)
         return;
     ASSERT(!url.isEmpty());
-    m_dataObject->url = url;
-    m_dataObject->urlTitle = title;
-    m_dataObject->uriList.clear();
-    m_dataObject->uriList.append(url);
+    m_dataObject->setData(mimeTypeURL, url);
+    m_dataObject->setUrlTitle(title);
 
     // The URL can also be used as plain text.
-    m_dataObject->plainText = url.string();
+    m_dataObject->setData(mimeTypeTextPlain, url.string());
 
     // The URL can also be used as an HTML fragment.
-    m_dataObject->textHtml = urlToMarkup(url, title);
-    m_dataObject->htmlBaseUrl = url;
+    m_dataObject->setData(mimeTypeTextHTML, urlToMarkup(url, title));
+    m_dataObject->setHtmlBaseUrl(url);
 }
 
 void ClipboardChromium::writeRange(Range* selectedRange, Frame* frame)
@@ -525,15 +317,15 @@ void ClipboardChromium::writeRange(Range* selectedRange, Frame* frame)
     if (!m_dataObject)
          return;
 
-    m_dataObject->textHtml = createMarkup(selectedRange, 0, AnnotateForInterchange, false, AbsoluteURLs);
-    m_dataObject->htmlBaseUrl = frame->document()->url();
+    m_dataObject->setData(mimeTypeTextHTML, createMarkup(selectedRange, 0, AnnotateForInterchange, false, AbsoluteURLs));
+    m_dataObject->setHtmlBaseUrl(frame->document()->url());
 
     String str = frame->editor()->selectedText();
 #if OS(WINDOWS)
     replaceNewlinesWithWindowsStyleNewlines(str);
 #endif
     replaceNBSPWithSpace(str);
-    m_dataObject->plainText = str;
+    m_dataObject->setData(mimeTypeTextPlain, str);
 }
 
 void ClipboardChromium::writePlainText(const String& text)
@@ -546,7 +338,7 @@ void ClipboardChromium::writePlainText(const String& text)
     replaceNewlinesWithWindowsStyleNewlines(str);
 #endif
     replaceNBSPWithSpace(str);
-    m_dataObject->plainText = str;
+    m_dataObject->setData(mimeTypeTextPlain, str);
 }
 
 bool ClipboardChromium::hasData()
diff --git a/WebCore/platform/chromium/ClipboardChromium.h b/WebCore/platform/chromium/ClipboardChromium.h
index 14f59e9..1d69921 100644
--- a/WebCore/platform/chromium/ClipboardChromium.h
+++ b/WebCore/platform/chromium/ClipboardChromium.h
@@ -48,6 +48,9 @@ namespace WebCore {
         static PassRefPtr<ClipboardChromium> create(
             ClipboardType, PassRefPtr<ChromiumDataObject>, ClipboardAccessPolicy, Frame*);
 
+        static PassRefPtr<ClipboardChromium> create(
+            ClipboardType, ClipboardAccessPolicy, Frame*);
+
         // Returns the file name (not including the extension). This removes any
         // invalid file system characters as well as making sure the
         // path + extension is not bigger than allowed by the file system.
diff --git a/WebCore/platform/chromium/ClipboardChromiumWin.cpp b/WebCore/platform/chromium/ClipboardChromiumWin.cpp
index b4a2c21..d9bbeb5 100644
--- a/WebCore/platform/chromium/ClipboardChromiumWin.cpp
+++ b/WebCore/platform/chromium/ClipboardChromiumWin.cpp
@@ -44,11 +44,11 @@ String ClipboardChromium::validateFileName(const String& title, ChromiumDataObje
 {
     // Remove any invalid file system characters.
     String result = title.removeCharacters(&isInvalidFileCharacter);
-    if (result.length() + dataObject->fileExtension.length() + 1 >= MAX_PATH) {
-        if (dataObject->fileExtension.length() + 1 >= MAX_PATH)
-            dataObject->fileExtension = "";
-        if (result.length() + dataObject->fileExtension.length() + 1 >= MAX_PATH)
-            result = result.substring(0, MAX_PATH - dataObject->fileExtension.length() - 1);
+    if (result.length() + dataObject->fileExtension().length() + 1 >= MAX_PATH) {
+        if (dataObject->fileExtension().length() + 1 >= MAX_PATH)
+            dataObject->setFileExtension("");
+        if (result.length() + dataObject->fileExtension().length() + 1 >= MAX_PATH)
+            result = result.substring(0, MAX_PATH - dataObject->fileExtension().length() - 1);
     }
     return result;
 }
diff --git a/WebCore/platform/chromium/ClipboardMimeTypes.cpp b/WebCore/platform/chromium/ClipboardMimeTypes.cpp
index b95744f8..f689e0e 100644
--- a/WebCore/platform/chromium/ClipboardMimeTypes.cpp
+++ b/WebCore/platform/chromium/ClipboardMimeTypes.cpp
@@ -33,8 +33,12 @@
 
 namespace WebCore {
 
-const char textPlainType[] = "text/plain";
-const char textHtmlType[] = "text/html";
-const char textUriListType[] = "text/uri-list";
+const char mimeTypeText[] = "text";
+const char mimeTypeTextPlain[] = "text/plain";
+const char mimeTypeTextPlainEtc[] = "text/plain;";
+const char mimeTypeTextHTML[] = "text/html";
+const char mimeTypeURL[] = "url";
+const char mimeTypeTextURIList[] = "text/uri-list";
+const char mimeTypeDownloadURL[] = "downloadurl";
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/ClipboardMimeTypes.h b/WebCore/platform/chromium/ClipboardMimeTypes.h
index d7468f2..9bdccfe 100644
--- a/WebCore/platform/chromium/ClipboardMimeTypes.h
+++ b/WebCore/platform/chromium/ClipboardMimeTypes.h
@@ -33,9 +33,13 @@
 
 namespace WebCore {
 
-extern const char textPlainType[];
-extern const char textHtmlType[];
-extern const char textUriListType[];
+extern const char mimeTypeText[];
+extern const char mimeTypeTextPlain[];
+extern const char mimeTypeTextPlainEtc[];
+extern const char mimeTypeTextHTML[];
+extern const char mimeTypeURL[];
+extern const char mimeTypeTextURIList[];
+extern const char mimeTypeDownloadURL[];
 
 } // namespace WebCore
 
diff --git a/WebCore/platform/chromium/DragDataChromium.cpp b/WebCore/platform/chromium/DragDataChromium.cpp
index 674d34d..2b04523 100644
--- a/WebCore/platform/chromium/DragDataChromium.cpp
+++ b/WebCore/platform/chromium/DragDataChromium.cpp
@@ -32,6 +32,7 @@
 
 #include "ChromiumBridge.h"
 #include "ChromiumDataObject.h"
+#include "ClipboardMimeTypes.h"
 #include "DocumentFragment.h"
 #include "FileSystem.h"
 #include "KURL.h"
@@ -43,50 +44,50 @@ namespace WebCore {
 
 static bool containsHTML(const ChromiumDataObject* dropData)
 {
-    return dropData->textHtml.length() > 0;
+    return dropData->types().contains(mimeTypeTextHTML);
 }
 
 bool DragData::containsURL(FilenameConversionPolicy filenamePolicy) const
 {
-    return !asURL(filenamePolicy).isEmpty();
+    return m_platformDragData->types().contains(mimeTypeURL)
+        || (filenamePolicy == ConvertFilenames && m_platformDragData->containsFilenames());
 }
 
 String DragData::asURL(FilenameConversionPolicy filenamePolicy, String* title) const
 {
     String url;
-    if (m_platformDragData->hasValidURL())
-        url = m_platformDragData->getURL().string();
-    else if (filenamePolicy == ConvertFilenames && !m_platformDragData->filenames.isEmpty()) {
-        String fileName = m_platformDragData->filenames[0];
-        fileName = ChromiumBridge::getAbsolutePath(fileName);
-        url = ChromiumBridge::filePathToURL(fileName).string();
+    if (m_platformDragData->types().contains(mimeTypeURL)) {
+        bool ignoredSuccess;
+        url = m_platformDragData->getData(mimeTypeURL, ignoredSuccess);
+        if (title)
+            *title = m_platformDragData->urlTitle();
+    } else if (filenamePolicy == ConvertFilenames && containsFiles()) {
+        url = ChromiumBridge::filePathToURL(ChromiumBridge::getAbsolutePath(m_platformDragData->filenames()[0]));
     }
- 
-    // |title| can be NULL
-    if (title)
-        *title = m_platformDragData->urlTitle;
     return url;
 }
 
 bool DragData::containsFiles() const
 {
-    return !m_platformDragData->filenames.isEmpty();
+    return m_platformDragData->containsFilenames();
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
-    for (size_t i = 0; i < m_platformDragData->filenames.size(); ++i)
-        result.append(m_platformDragData->filenames[i]);
+    const Vector<String>& filenames = m_platformDragData->filenames();
+    for (size_t i = 0; i < filenames.size(); ++i)
+        result.append(filenames[i]);
 }
 
 bool DragData::containsPlainText() const
 {
-    return !m_platformDragData->plainText.isEmpty();
+    return m_platformDragData->types().contains(mimeTypeTextPlain);
 }
 
 String DragData::asPlainText() const
 {
-    return m_platformDragData->plainText;
+    bool ignoredSuccess;
+    return m_platformDragData->getData(mimeTypeTextPlain, ignoredSuccess);
 }
 
 bool DragData::containsColor() const
@@ -101,8 +102,8 @@ bool DragData::canSmartReplace() const
     // This is allowed whenever the drag data contains a 'range' (ie.,
     // ClipboardWin::writeRange is called).  For example, dragging a link
     // should not result in a space being added.
-    return !m_platformDragData->plainText.isEmpty()
-        && !m_platformDragData->hasValidURL();
+    return m_platformDragData->types().contains(mimeTypeTextPlain)
+        && !m_platformDragData->types().contains(mimeTypeURL);
 }
 
 bool DragData::containsCompatibleContent() const
@@ -134,9 +135,10 @@ PassRefPtr<DocumentFragment> DragData::asFragment(Document* doc) const
         //    return fragment;
     }
 
-    if (!m_platformDragData->textHtml.isEmpty()) {
+    if (m_platformDragData->types().contains(mimeTypeTextHTML)) {
+        bool ignoredSuccess;
         RefPtr<DocumentFragment> fragment = createFragmentFromMarkup(doc,
-            m_platformDragData->textHtml, m_platformDragData->htmlBaseUrl, FragmentScriptingNotAllowed);
+            m_platformDragData->getData(mimeTypeTextHTML, ignoredSuccess), m_platformDragData->htmlBaseUrl(), FragmentScriptingNotAllowed);
         return fragment.release();
     }
 
diff --git a/WebCore/platform/chromium/GeolocationServiceChromium.cpp b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
index b64f5eb..c5e73ae 100644
--- a/WebCore/platform/chromium/GeolocationServiceChromium.cpp
+++ b/WebCore/platform/chromium/GeolocationServiceChromium.cpp
@@ -33,6 +33,10 @@
 
 #include "ChromiumBridge.h"
 
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+#error "This file should not be compiled when ENABLE(CLIENT_BASED_GEOLOCATION)"
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
+
 namespace WebCore {
 
 GeolocationServiceBridge::~GeolocationServiceBridge()
diff --git a/WebCore/platform/chromium/Language.cpp b/WebCore/platform/chromium/LanguageChromium.cpp
index 2612af4..69fe372 100644
--- a/WebCore/platform/chromium/Language.cpp
+++ b/WebCore/platform/chromium/LanguageChromium.cpp
@@ -36,7 +36,7 @@
 
 namespace WebCore {
 
-String defaultLanguage()
+String platformDefaultLanguage()
 {
     static String computedDefaultLanguage;
     if (computedDefaultLanguage.isEmpty())
diff --git a/WebCore/platform/chromium/PasteboardChromium.cpp b/WebCore/platform/chromium/PasteboardChromium.cpp
index ba69b00..907a4b9 100644
--- a/WebCore/platform/chromium/PasteboardChromium.cpp
+++ b/WebCore/platform/chromium/PasteboardChromium.cpp
@@ -38,6 +38,7 @@
 #include "Element.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "Image.h"
 #include "KURL.h"
 #include "markup.h"
@@ -147,7 +148,7 @@ void Pasteboard::writeImage(Node* node, const KURL&, const String& title)
         Element* element = static_cast<Element*>(node);
         urlString = element->getAttribute(element->imageSourceAttributeName());
     }
-    KURL url = urlString.isEmpty() ? KURL() : node->document()->completeURL(deprecatedParseURL(urlString));
+    KURL url = urlString.isEmpty() ? KURL() : node->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
 
     ChromiumBridge::clipboardWriteImage(bitmap, url, title);
 }
diff --git a/WebCore/platform/chromium/PopupMenuChromium.cpp b/WebCore/platform/chromium/PopupMenuChromium.cpp
index 9c73a9c..3c807ba 100644
--- a/WebCore/platform/chromium/PopupMenuChromium.cpp
+++ b/WebCore/platform/chromium/PopupMenuChromium.cpp
@@ -513,7 +513,7 @@ void PopupContainer::paintBorder(GraphicsContext* gc, const IntRect& rect)
     Color borderColor(127, 157, 185);
 
     gc->setStrokeStyle(NoStroke);
-    gc->setFillColor(borderColor, DeviceColorSpace);
+    gc->setFillColor(borderColor, ColorSpaceDeviceRGB);
 
     int tx = x();
     int ty = y();
@@ -857,7 +857,7 @@ void PopupListBox::paint(GraphicsContext* gc, const IntRect& rect)
 
     // Special case for an empty popup.
     if (numItems() == 0)
-        gc->fillRect(r, Color::white, DeviceColorSpace);
+        gc->fillRect(r, Color::white, ColorSpaceDeviceRGB);
 
     gc->restore();
 
@@ -894,23 +894,23 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     // If we have a transparent background, make sure it has a color to blend
     // against.
     if (backColor.hasAlpha())
-        gc->fillRect(rowRect, Color::white, DeviceColorSpace);
+        gc->fillRect(rowRect, Color::white, ColorSpaceDeviceRGB);
 
-    gc->fillRect(rowRect, backColor, DeviceColorSpace);
+    gc->fillRect(rowRect, backColor, ColorSpaceDeviceRGB);
     
     if (m_popupClient->itemIsSeparator(rowIndex)) {
         IntRect separatorRect(
             rowRect.x() + separatorPadding,
             rowRect.y() + (rowRect.height() - separatorHeight) / 2,
             rowRect.width() - 2 * separatorPadding, separatorHeight);
-        gc->fillRect(separatorRect, textColor, DeviceColorSpace);
+        gc->fillRect(separatorRect, textColor, ColorSpaceDeviceRGB);
         return;
     }
     
     if (!style.isVisible())
         return;
 
-    gc->setFillColor(textColor, DeviceColorSpace);
+    gc->setFillColor(textColor, ColorSpaceDeviceRGB);
 
     Font itemFont = getRowFont(rowIndex);
     // FIXME: http://crbug.com/19872 We should get the padding of individual option
@@ -973,7 +973,7 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
         remainingWidth -= (imageRect.width() + kLabelToIconPadding);
         imageRect.setX(rowRect.width() - rightPadding - imageRect.width());
         imageRect.setY(rowRect.y() + (rowRect.height() - imageRect.height()) / 2);
-        gc->drawImage(image.get(), DeviceColorSpace, imageRect);
+        gc->drawImage(image.get(), ColorSpaceDeviceRGB, imageRect);
     }
 
     // Draw the the label if applicable.
@@ -985,7 +985,7 @@ void PopupListBox::paintRow(GraphicsContext* gc, const IntRect& rect, int rowInd
     else
         textX = remainingWidth - itemFont.width(labelTextRun);
 
-    gc->setFillColor(labelColor, DeviceColorSpace);
+    gc->setFillColor(labelColor, ColorSpaceDeviceRGB);
     gc->drawBidiText(itemFont, labelTextRun, IntPoint(textX, textY));
 }
 
diff --git a/WebCore/platform/chromium/ReadableDataObject.cpp b/WebCore/platform/chromium/ReadableDataObject.cpp
index 1a333bb..97c481b 100644
--- a/WebCore/platform/chromium/ReadableDataObject.cpp
+++ b/WebCore/platform/chromium/ReadableDataObject.cpp
@@ -33,21 +33,23 @@
 
 #include "ChromiumBridge.h"
 #include "ClipboardMimeTypes.h"
+#include "Pasteboard.h"
+#include "PasteboardPrivate.h"
 
 namespace WebCore {
 
-static PasteboardPrivate::ClipboardBuffer clipboardBuffer(bool isForDragging)
+static PasteboardPrivate::ClipboardBuffer clipboardBuffer(Clipboard::ClipboardType clipboardType)
 {
-    return isForDragging ? PasteboardPrivate::DragBuffer : PasteboardPrivate::StandardBuffer;
+    return clipboardType == Clipboard::DragAndDrop ? PasteboardPrivate::DragBuffer : PasteboardPrivate::StandardBuffer;
 }
 
-PassRefPtr<ReadableDataObject> ReadableDataObject::create(bool isForDragging)
+PassRefPtr<ReadableDataObject> ReadableDataObject::create(Clipboard::ClipboardType clipboardType)
 {
-    return adoptRef(new ReadableDataObject(isForDragging));
+    return adoptRef(new ReadableDataObject(clipboardType));
 }
 
-ReadableDataObject::ReadableDataObject(bool isForDragging)
-    : m_isForDragging(isForDragging)
+ReadableDataObject::ReadableDataObject(Clipboard::ClipboardType clipboardType)
+    : m_clipboardType(clipboardType)
     , m_containsFilenames(false)
     , m_isTypeCacheInitialized(false)
 {
@@ -69,34 +71,51 @@ String ReadableDataObject::getData(const String& type, bool& succeeded) const
 {
     String data;
     String ignoredMetadata;
+    // Since the Chromium-side bridge isn't complete yet, we special case this
+    // for copy-and-paste, since that code path no longer uses
+    // ChromiumDataObjectLegacy.
+    if (m_clipboardType == Clipboard::CopyAndPaste) {
+        if (type == mimeTypeTextPlain) {
+            PasteboardPrivate::ClipboardBuffer buffer =
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer :
+                PasteboardPrivate::StandardBuffer;
+            data = ChromiumBridge::clipboardReadPlainText(buffer);
+        } else if (type == mimeTypeTextHTML) {
+            PasteboardPrivate::ClipboardBuffer buffer =
+                Pasteboard::generalPasteboard()->isSelectionMode() ?
+                PasteboardPrivate::SelectionBuffer :
+                PasteboardPrivate::StandardBuffer;
+            KURL ignoredSourceURL;
+            ChromiumBridge::clipboardReadHTML(buffer, &data, &ignoredSourceURL);
+        }
+        succeeded = !data.isEmpty();
+        return data;
+    }
     succeeded = ChromiumBridge::clipboardReadData(
-        clipboardBuffer(m_isForDragging), type, data, ignoredMetadata);
+        clipboardBuffer(m_clipboardType), type, data, ignoredMetadata);
     return data;
 }
 
-String ReadableDataObject::getURL(String* title) const
+String ReadableDataObject::urlTitle() const
 {
-    String url;
-    String ignoredTitle;
-    if (!title)
-        title = &ignoredTitle;
+    String ignoredData;
+    String urlTitle;
     ChromiumBridge::clipboardReadData(
-        clipboardBuffer(m_isForDragging), textUriListType, url, *title);
-    return url;
+        clipboardBuffer(m_clipboardType), mimeTypeTextURIList, ignoredData, urlTitle);
+    return urlTitle;
 }
 
-String ReadableDataObject::getHTML(String* baseURL) const
+KURL ReadableDataObject::htmlBaseUrl() const
 {
-    String html;
-    String ignoredBaseURL;
-    if (!baseURL)
-        baseURL = &ignoredBaseURL;
+    String ignoredData;
+    String htmlBaseUrl;
     ChromiumBridge::clipboardReadData(
-        clipboardBuffer(m_isForDragging), textHtmlType, html, *baseURL);
-    return html;
+        clipboardBuffer(m_clipboardType), mimeTypeTextHTML, ignoredData, htmlBaseUrl);
+    return KURL(ParsedURLString, htmlBaseUrl);
 }
 
-bool ReadableDataObject::hasFilenames() const
+bool ReadableDataObject::containsFilenames() const
 {
     ensureTypeCacheInitialized();
     return m_containsFilenames;
@@ -104,7 +123,7 @@ bool ReadableDataObject::hasFilenames() const
 
 Vector<String> ReadableDataObject::filenames() const
 {
-    return ChromiumBridge::clipboardReadFilenames(clipboardBuffer(m_isForDragging));
+    return ChromiumBridge::clipboardReadFilenames(clipboardBuffer(m_clipboardType));
 }
 
 void ReadableDataObject::ensureTypeCacheInitialized() const
@@ -113,7 +132,7 @@ void ReadableDataObject::ensureTypeCacheInitialized() const
         return;
 
     m_types = ChromiumBridge::clipboardReadAvailableTypes(
-        clipboardBuffer(m_isForDragging), &m_containsFilenames);
+        clipboardBuffer(m_clipboardType), &m_containsFilenames);
     m_isTypeCacheInitialized = true;
 }
 
diff --git a/WebCore/platform/chromium/ReadableDataObject.h b/WebCore/platform/chromium/ReadableDataObject.h
index 60f6d45..027e0ed 100644
--- a/WebCore/platform/chromium/ReadableDataObject.h
+++ b/WebCore/platform/chromium/ReadableDataObject.h
@@ -31,6 +31,7 @@
 #ifndef ReadableDataObject_h
 #define ReadableDataObject_h
 
+#include "Clipboard.h"
 #include "PlatformString.h"
 #include <wtf/HashSet.h>
 #include <wtf/RefCounted.h>
@@ -43,26 +44,25 @@ namespace WebCore {
 // browser to the renderer.
 class ReadableDataObject : public RefCounted<ReadableDataObject> {
 public:
-    static PassRefPtr<ReadableDataObject> create(bool isForDragging);
+    static PassRefPtr<ReadableDataObject> create(Clipboard::ClipboardType);
 
-    virtual bool hasData() const;
-    virtual HashSet<String> types() const;
-    virtual String getData(const String& type, bool& succeeded) const;
+    bool hasData() const;
+    HashSet<String> types() const;
+    String getData(const String& type, bool& succeeded) const;
 
-    virtual String getURL(String* title) const;
-    virtual String getHTML(String* baseURL) const;
+    String urlTitle() const;
+    KURL htmlBaseUrl() const;
 
-    virtual bool hasFilenames() const;
-    virtual Vector<String> filenames() const;
+    bool containsFilenames() const;
+    Vector<String> filenames() const;
 
 private:
-    explicit ReadableDataObject(bool isForDragging);
+    explicit ReadableDataObject(Clipboard::ClipboardType);
 
     // This isn't always const... but most of the time it is.
     void ensureTypeCacheInitialized() const;
 
-
-    bool m_isForDragging;
+    Clipboard::ClipboardType m_clipboardType;
 
     // To avoid making a lot of IPC calls for each drag event, we cache some
     // values in the renderer.
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
index cf3ca6f..234d0ee 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromium.cpp
@@ -131,7 +131,7 @@ void ScrollbarThemeChromium::paintTickmarks(GraphicsContext* context, Scrollbar*
         const int yPos = rect.topLeft().y() + (rect.height() * percent);
 
         IntPoint tick(scrollbar->x(), yPos);
-        context->drawImage(dash.get(), DeviceColorSpace, tick);
+        context->drawImage(dash.get(), ColorSpaceDeviceRGB, tick);
     }
 
     context->restore();
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
index d8f2c79..46e6993 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumLinux.cpp
@@ -31,17 +31,12 @@
 #include "config.h"
 #include "ScrollbarThemeChromiumLinux.h"
 
-#include "PlatformContextSkia.h"
+#include "ChromiumBridge.h"
 #include "PlatformMouseEvent.h"
-#include "PlatformThemeChromiumGtk.h"
 #include "Scrollbar.h"
-#include "TransformationMatrix.h"
 
 namespace WebCore {
 
-static const int scrollbarThicknessValue = 15;
-static const int buttonLength = 14;
-
 ScrollbarTheme* ScrollbarTheme::nativeTheme()
 {
     static ScrollbarThemeChromiumLinux theme;
@@ -50,136 +45,79 @@ ScrollbarTheme* ScrollbarTheme::nativeTheme()
 
 int ScrollbarThemeChromiumLinux::scrollbarThickness(ScrollbarControlSize controlSize)
 {
-    return scrollbarThicknessValue;
-}
-
-static void drawVertLine(SkCanvas* canvas, int x, int y1, int y2, const SkPaint& paint)
-{
-    SkIRect skrect;
-    skrect.set(x, y1, x + 1, y2 + 1);
-    canvas->drawIRect(skrect, paint);
-}
-
-static void drawHorizLine(SkCanvas* canvas, int x1, int x2, int y, const SkPaint& paint)
-{
-    SkIRect skrect;
-    skrect.set(x1, y, x2 + 1, y + 1);
-    canvas->drawIRect(skrect, paint);
-}
-
-static void drawBox(SkCanvas* canvas, const IntRect& rect, const SkPaint& paint)
-{
-    const int right = rect.x() + rect.width() - 1;
-    const int bottom = rect.y() + rect.height() - 1;
-    drawHorizLine(canvas, rect.x(), right, rect.y(), paint);
-    drawVertLine(canvas, right, rect.y(), bottom, paint);
-    drawHorizLine(canvas, rect.x(), right, bottom, paint);
-    drawVertLine(canvas, rect.x(), rect.y(), bottom, paint);
+    // Horiz and Vert scrollbars are the same thickness.
+    IntSize scrollbarSize = ChromiumBridge::getThemePartSize(ChromiumBridge::PartScrollbarVerticalTrack);
+    return scrollbarSize.width();
 }
 
 void ScrollbarThemeChromiumLinux::paintTrackPiece(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart partType)
 {
-    SkCanvas* const canvas = gc->platformContext()->canvas();
-    SkPaint paint;
-    SkIRect skrect;
-
-    skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
-    SkScalar trackHSV[3];
-    SkColorToHSV(PlatformThemeChromiumGtk::trackColor(), trackHSV);
-    paint.setColor(PlatformThemeChromiumGtk::saturateAndBrighten(trackHSV, 0, 0));
-    canvas->drawIRect(skrect, paint);
-
-    SkScalar thumbHSV[3];
-    SkColorToHSV(PlatformThemeChromiumGtk::thumbInactiveColor(),
-                 thumbHSV);
-
-    paint.setColor(PlatformThemeChromiumGtk::outlineColor(trackHSV, thumbHSV));
-    drawBox(canvas, rect, paint);
+    ChromiumBridge::ThemePaintState state = scrollbar->hoveredPart() == partType ? ChromiumBridge::StateHover : ChromiumBridge::StateNormal;
+    IntRect alignRect = trackRect(scrollbar, false);
+    ChromiumBridge::ThemePaintExtraParams extraParams;
+    extraParams.scrollbarTrack.trackX = alignRect.x();
+    extraParams.scrollbarTrack.trackY = alignRect.y();
+    extraParams.scrollbarTrack.trackWidth = alignRect.width();
+    extraParams.scrollbarTrack.trackHeight = alignRect.height();
+    ChromiumBridge::paintThemePart(
+        gc,
+        scrollbar->orientation() == HorizontalScrollbar ? ChromiumBridge::PartScrollbarHoriztonalTrack : ChromiumBridge::PartScrollbarVerticalTrack,
+        state,
+        rect,
+        &extraParams);
 }
 
 void ScrollbarThemeChromiumLinux::paintButton(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect, ScrollbarPart part)
 {
-    PlatformThemeChromiumGtk::ArrowDirection direction;
+    ChromiumBridge::ThemePart paintPart;
+    ChromiumBridge::ThemePaintState state = ChromiumBridge::StateNormal;
+    bool checkMin = false;
+    bool checkMax = false;
     if (scrollbar->orientation() == HorizontalScrollbar) {
-        if (part == BackButtonStartPart)
-            direction = PlatformThemeChromiumGtk::West;
-        else
-            direction = PlatformThemeChromiumGtk::East;
+        if (part == BackButtonStartPart) {
+            paintPart = ChromiumBridge::PartScrollbarLeftArrow;
+            checkMin = true;
+        } else {
+            paintPart = ChromiumBridge::PartScrollbarRightArrow;
+            checkMax = true;
+        }
     } else {
-        if (part == BackButtonStartPart)
-            direction = PlatformThemeChromiumGtk::North;
-        else
-            direction = PlatformThemeChromiumGtk::South;
+        if (part == BackButtonStartPart) {
+            paintPart = ChromiumBridge::PartScrollbarUpArrow;
+            checkMin = true;
+        } else {
+            paintPart = ChromiumBridge::PartScrollbarDownArrow;
+            checkMax = true;
+        }
     }
-
-    ControlStates states = 0;
-    // Determine if the button can be pressed.
-    if (((direction == PlatformThemeChromiumGtk::West || direction == PlatformThemeChromiumGtk::North) && scrollbar->currentPos())
-        || ((direction == PlatformThemeChromiumGtk::East || direction == PlatformThemeChromiumGtk::South) && scrollbar->currentPos() != scrollbar->maximum()))
-        states |= EnabledState;
-
-    if (states & EnabledState) {
+    if ((checkMin && (scrollbar->currentPos() <= 0))
+        || (checkMax && scrollbar->currentPos() == scrollbar->maximum())) {
+        state = ChromiumBridge::StateDisabled;
+    } else {
         if (part == scrollbar->pressedPart())
-            states |= PressedState;
+            state = ChromiumBridge::StatePressed;
         else if (part == scrollbar->hoveredPart())
-            states |= HoverState;
+            state = ChromiumBridge::StateHover;
     }
-
-    PlatformThemeChromiumGtk::paintArrowButton(gc, rect, direction, states);
+    ChromiumBridge::paintThemePart(gc, paintPart, state, rect, 0);
 }
 
 void ScrollbarThemeChromiumLinux::paintThumb(GraphicsContext* gc, Scrollbar* scrollbar, const IntRect& rect)
 {
-    const bool hovered = scrollbar->hoveredPart() == ThumbPart;
-    const int midx = rect.x() + rect.width() / 2;
-    const int midy = rect.y() + rect.height() / 2;
-    const bool vertical = scrollbar->orientation() == VerticalScrollbar;
-    SkCanvas* const canvas = gc->platformContext()->canvas();
-
-    SkScalar thumb[3];
-    SkColorToHSV(hovered
-                 ? PlatformThemeChromiumGtk::thumbActiveColor()
-                 : PlatformThemeChromiumGtk::thumbInactiveColor(),
-                 thumb);
-
-    SkPaint paint;
-    paint.setColor(PlatformThemeChromiumGtk::saturateAndBrighten(thumb, 0, 0.02));
-
-    SkIRect skrect;
-    if (vertical)
-        skrect.set(rect.x(), rect.y(), midx + 1, rect.y() + rect.height());
-    else
-        skrect.set(rect.x(), rect.y(), rect.x() + rect.width(), midy + 1);
-
-    canvas->drawIRect(skrect, paint);
-
-    paint.setColor(PlatformThemeChromiumGtk::saturateAndBrighten(thumb, 0, -0.02));
+    ChromiumBridge::ThemePaintState state;
 
-    if (vertical)
-        skrect.set(midx + 1, rect.y(), rect.x() + rect.width(), rect.y() + rect.height());
+    if (scrollbar->pressedPart() == ThumbPart)
+        state = ChromiumBridge::StatePressed;
+    else if (scrollbar->hoveredPart() == ThumbPart)
+        state = ChromiumBridge::StateHover;
     else
-        skrect.set(rect.x(), midy + 1, rect.x() + rect.width(), rect.y() + rect.height());
-
-    canvas->drawIRect(skrect, paint);
-
-    SkScalar track[3];
-    SkColorToHSV(PlatformThemeChromiumGtk::trackColor(), track);
-    paint.setColor(PlatformThemeChromiumGtk::outlineColor(track, thumb));
-    drawBox(canvas, rect, paint);
-
-    if (rect.height() > 10 && rect.width() > 10) {
-        const int grippyHalfWidth = 2;
-        const int interGrippyOffset = 3;
-        if (vertical) {
-            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy - interGrippyOffset, paint);
-            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy,                     paint);
-            drawHorizLine(canvas, midx - grippyHalfWidth, midx + grippyHalfWidth, midy + interGrippyOffset, paint);
-        } else {
-            drawVertLine(canvas, midx - interGrippyOffset, midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
-            drawVertLine(canvas, midx,                     midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
-            drawVertLine(canvas, midx + interGrippyOffset, midy - grippyHalfWidth, midy + grippyHalfWidth, paint);
-        }
-    }
+        state = ChromiumBridge::StateNormal;
+    ChromiumBridge::paintThemePart(
+        gc,
+        scrollbar->orientation() == HorizontalScrollbar ? ChromiumBridge::PartScrollbarHorizontalThumb : ChromiumBridge::PartScrollbarVerticalThumb,
+        state,
+        rect,
+        0);
 }
 
 bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(Scrollbar*, const PlatformMouseEvent& evt)
@@ -189,17 +127,25 @@ bool ScrollbarThemeChromiumLinux::shouldCenterOnThumb(Scrollbar*, const Platform
 
 IntSize ScrollbarThemeChromiumLinux::buttonSize(Scrollbar* scrollbar)
 {
-    if (scrollbar->orientation() == VerticalScrollbar)
-        return IntSize(scrollbarThicknessValue, buttonLength);
+    if (scrollbar->orientation() == VerticalScrollbar) {
+        IntSize size = ChromiumBridge::getThemePartSize(ChromiumBridge::PartScrollbarUpArrow);
+        return IntSize(size.width(), scrollbar->height() < 2 * size.height() ? scrollbar->height() / 2 : size.height());
+    }
 
     // HorizontalScrollbar
-    return IntSize(buttonLength, scrollbarThicknessValue);
+    IntSize size = ChromiumBridge::getThemePartSize(ChromiumBridge::PartScrollbarLeftArrow);
+    return IntSize(scrollbar->width() < 2 * size.width() ? scrollbar->width() / 2 : size.width(), size.height());
 }
 
 int ScrollbarThemeChromiumLinux::minimumThumbLength(Scrollbar* scrollbar)
 {
-    // This matches Firefox on Linux.
-    return 2 * scrollbarThickness(scrollbar->controlSize());
+    if (scrollbar->orientation() == VerticalScrollbar) {
+        IntSize size = ChromiumBridge::getThemePartSize(ChromiumBridge::PartScrollbarVerticalThumb);
+        return size.height();
+    }
+
+    IntSize size = ChromiumBridge::getThemePartSize(ChromiumBridge::PartScrollbarHorizontalThumb);
+    return size.width();
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
index bafc96e..b47e998 100644
--- a/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
+++ b/WebCore/platform/chromium/ScrollbarThemeChromiumMac.mm
@@ -417,8 +417,8 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     if (scrollbar->orientation() == VerticalScrollbar && tickmarks.size()) {
         drawingContext->save();
         drawingContext->setShouldAntialias(false);
-        drawingContext->setStrokeColor(Color(0xCC, 0xAA, 0x00, 0xFF), DeviceColorSpace);
-        drawingContext->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), DeviceColorSpace);
+        drawingContext->setStrokeColor(Color(0xCC, 0xAA, 0x00, 0xFF), ColorSpaceDeviceRGB);
+        drawingContext->setFillColor(Color(0xFF, 0xDD, 0x00, 0xFF), ColorSpaceDeviceRGB);
 
         IntRect thumbArea = trackRect(scrollbar, false);
         if (!canDrawDirectly) {
@@ -453,7 +453,7 @@ bool ScrollbarThemeChromiumMac::paint(Scrollbar* scrollbar, GraphicsContext* con
     }
 
     if (!canDrawDirectly)
-        context->drawImageBuffer(imageBuffer.get(), DeviceColorSpace, scrollbar->frameRect().location());
+        context->drawImageBuffer(imageBuffer.get(), ColorSpaceDeviceRGB, scrollbar->frameRect().location());
 
     return true;
 }
diff --git a/WebCore/platform/chromium/ThemeChromiumMac.mm b/WebCore/platform/chromium/ThemeChromiumMac.mm
index 68fd7b7..5e457f3 100644
--- a/WebCore/platform/chromium/ThemeChromiumMac.mm
+++ b/WebCore/platform/chromium/ThemeChromiumMac.mm
@@ -376,6 +376,7 @@ static void paintCheckbox(ControlStates states, GraphicsContext* context, const
 
     // Determine the width and height needed for the control and prepare the cell for painting.
     NSButtonCell *checkboxCell = checkbox(states, zoomedRect, zoomFactor);
+    LocalCurrentGraphicsContext localContext(context);
 
     context->save();
 
@@ -456,6 +457,7 @@ static void paintRadio(ControlStates states, GraphicsContext* context, const Int
 {
     // Determine the width and height needed for the control and prepare the cell for painting.
     NSButtonCell *radioCell = radio(states, zoomedRect, zoomFactor);
+    LocalCurrentGraphicsContext localContext(context);
 
     context->save();
 
diff --git a/WebCore/platform/chromium/WritableDataObject.cpp b/WebCore/platform/chromium/WritableDataObject.cpp
index 6e7c283..7cbf42c 100644
--- a/WebCore/platform/chromium/WritableDataObject.cpp
+++ b/WebCore/platform/chromium/WritableDataObject.cpp
@@ -36,22 +36,22 @@
 
 namespace WebCore {
 
-PassRefPtr<WritableDataObject> WritableDataObject::create(bool isForDragging)
+PassRefPtr<WritableDataObject> WritableDataObject::create(Clipboard::ClipboardType clipboardType)
 {
-    return adoptRef(new WritableDataObject(isForDragging));
+    return adoptRef(new WritableDataObject(clipboardType));
 }
 
-WritableDataObject::WritableDataObject(bool isForDragging)
-    : m_isForDragging(isForDragging)
+WritableDataObject::WritableDataObject(Clipboard::ClipboardType clipboardType)
+    : m_clipboardType(clipboardType)
 {
 }
 
 void WritableDataObject::clearData(const String& type)
 {
     m_dataMap.remove(type);
-    if (type == textUriListType)
+    if (type == mimeTypeTextURIList)
         m_urlTitle = "";
-    else if (type == textHtmlType)
+    else if (type == mimeTypeTextHTML)
         m_htmlBaseURL = KURL();
 }
 
@@ -76,77 +76,19 @@ void WritableDataObject::clearAll()
 
 bool WritableDataObject::setData(const String& type, const String& data)
 {
-    if (!m_isForDragging) {
+    if (m_clipboardType == Clipboard::CopyAndPaste) {
+        // FIXME: This is currently unimplemented on the Chromium-side. This is
+        // "okay" for now since the original implementation didn't support it
+        // anyway. Going forward, this is something we'll need to fix though.
         ChromiumBridge::clipboardWriteData(type, data, "");
         return true;
     }
     m_dataMap.set(type, data);
-    if (type == textUriListType)
+    if (type == mimeTypeTextURIList)
         m_urlTitle = "";
-    else if (type == textHtmlType)
+    else if (type == mimeTypeTextHTML)
         m_htmlBaseURL = KURL();
     return true;
 }
 
-void WritableDataObject::setURL(const String& url, const String& title)
-{
-    setData(textUriListType, url);
-    m_urlTitle = title;
-}
-
-void WritableDataObject::setHTML(const String& html, const KURL& baseURL)
-{
-    setData(textHtmlType, html);
-    m_htmlBaseURL = baseURL;
-}
-
-// Accessors used when transferring drag data from the renderer to the
-// browser.
-HashMap<String, String> WritableDataObject::dataMap() const
-{
-    return m_dataMap;
-}
-
-String WritableDataObject::urlTitle() const
-{
-    return m_urlTitle;
-}
-
-KURL WritableDataObject::htmlBaseURL() const
-{
-    return m_htmlBaseURL;
-}
-
-// Used for transferring file data from the renderer to the browser.
-String WritableDataObject::fileExtension() const
-{
-    return m_fileExtension;
-}
-
-String WritableDataObject::fileContentFilename() const
-{
-    return m_fileContentFilename;
-}
-
-PassRefPtr<SharedBuffer> WritableDataObject::fileContent() const
-{
-    return m_fileContent;
-}
-
-void WritableDataObject::setFileExtension(const String& fileExtension)
-{
-    m_fileExtension = fileExtension;
-}
-
-void WritableDataObject::setFileContentFilename(const String& fileContentFilename)
-{
-    m_fileContentFilename = fileContentFilename;
-}
-
-void WritableDataObject::setFileContent(PassRefPtr<SharedBuffer> fileContent)
-{
-    m_fileContent = fileContent;
-}
-
-
 } // namespace WebCore
diff --git a/WebCore/platform/chromium/WritableDataObject.h b/WebCore/platform/chromium/WritableDataObject.h
index 71e2e26..c475d15 100644
--- a/WebCore/platform/chromium/WritableDataObject.h
+++ b/WebCore/platform/chromium/WritableDataObject.h
@@ -31,6 +31,7 @@
 #ifndef WritableDataObject_h
 #define WritableDataObject_h
 
+#include "Clipboard.h"
 #include "KURL.h"
 #include "PlatformString.h"
 #include "SharedBuffer.h"
@@ -47,32 +48,32 @@ namespace WebCore {
 // atomically.
 class WritableDataObject : public RefCounted<WritableDataObject> {
 public:
-    static PassRefPtr<WritableDataObject> create(bool isForDragging);
+    static PassRefPtr<WritableDataObject> create(Clipboard::ClipboardType);
 
-    virtual void clearData(const String& type);
-    virtual void clearAllExceptFiles();
-    virtual void clearAll();
-    virtual bool setData(const String& type, const String& data);
+    void clearData(const String& type);
+    void clearAllExceptFiles();
+    void clearAll();
+    bool setData(const String& type, const String& data);
 
-    virtual void setURL(const String& url, const String& title);
-    virtual void setHTML(const String& html, const KURL& baseURL);
+    void setUrlTitle(const String& title) { m_urlTitle = title; }
+    void setHtmlBaseUrl(const KURL& baseURL) { m_htmlBaseURL = baseURL; }
 
     // Used for transferring drag data from the renderer to the browser.
-    virtual HashMap<String, String> dataMap() const;
-    virtual String urlTitle() const;
-    virtual KURL htmlBaseURL() const;
+    HashMap<String, String> dataMap() const { return m_dataMap; }
+    String urlTitle() const { return m_urlTitle; }
+    KURL htmlBaseURL() const { return m_htmlBaseURL; }
 
-    virtual String fileExtension() const;
-    virtual String fileContentFilename() const;
-    virtual PassRefPtr<SharedBuffer> fileContent() const;
-    virtual void setFileExtension(const String&);
-    virtual void setFileContentFilename(const String&);
-    virtual void setFileContent(PassRefPtr<SharedBuffer>);
+    String fileExtension() const { return m_fileExtension; }
+    String fileContentFilename() const { return m_fileContentFilename; }
+    PassRefPtr<SharedBuffer> fileContent() const { return m_fileContent; }
+    void setFileExtension(const String& fileExtension) { m_fileExtension = fileExtension; }
+    void setFileContentFilename(const String& fileContentFilename) { m_fileContentFilename = fileContentFilename; }
+    void setFileContent(PassRefPtr<SharedBuffer> fileContent) { m_fileContent = fileContent; }
 
 private:
-    explicit WritableDataObject(bool isForDragging);
+    explicit WritableDataObject(Clipboard::ClipboardType);
 
-    bool m_isForDragging;
+    Clipboard::ClipboardType m_clipboardType;
 
     HashMap<String, String> m_dataMap;
     String m_urlTitle;
diff --git a/WebCore/platform/cocoa/KeyEventCocoa.mm b/WebCore/platform/cocoa/KeyEventCocoa.mm
index cf83d93..a2b5c9c 100644
--- a/WebCore/platform/cocoa/KeyEventCocoa.mm
+++ b/WebCore/platform/cocoa/KeyEventCocoa.mm
@@ -471,6 +471,33 @@ int windowsKeyCodeForKeyCode(uint16_t keyCode)
 int windowsKeyCodeForCharCode(unichar charCode)
 {
     switch (charCode) {
+#if PLATFORM(IOS)
+        case 8: case 0x7F: return VK_BACK;
+        case 9: return VK_TAB;
+        case 0xD: case 3: return VK_RETURN;
+        case 0x1B: return VK_ESCAPE;
+        case ' ': return VK_SPACE;
+        case NSHomeFunctionKey: return VK_HOME;
+        case NSEndFunctionKey: return VK_END;
+        case NSPageUpFunctionKey: return VK_PRIOR;
+        case NSPageDownFunctionKey: return VK_NEXT;
+        case NSUpArrowFunctionKey: return VK_UP;
+        case NSDownArrowFunctionKey: return VK_DOWN;
+        case NSLeftArrowFunctionKey: return VK_LEFT;
+        case NSRightArrowFunctionKey: return VK_RIGHT;
+        case NSDeleteFunctionKey: return VK_DELETE;
+
+        case '0': case ')': return VK_0;
+        case '1': case '!': return VK_1;
+        case '2': case '@': return VK_2;
+        case '3': case '#': return VK_3;
+        case '4': case '$': return VK_4;
+        case '5': case '%': return VK_5;
+        case '6': case '^': return VK_6;
+        case '7': case '&': return VK_7;
+        case '8': case '*': return VK_8;
+        case '9': case '(': return VK_9;
+#endif
         case 'a': case 'A': return VK_A; 
         case 'b': case 'B': return VK_B; 
         case 'c': case 'C': return VK_C; 
@@ -505,6 +532,30 @@ int windowsKeyCodeForCharCode(unichar charCode)
         case NSExecuteFunctionKey: return VK_EXECUTE;
         case NSPrintScreenFunctionKey: return VK_SNAPSHOT;
         case NSInsertFunctionKey: return VK_INSERT;
+#if PLATFORM(IOS)
+        case NSHelpFunctionKey: return VK_INSERT;
+
+        case NSF1FunctionKey: return VK_F1;
+        case NSF2FunctionKey: return VK_F2;
+        case NSF3FunctionKey: return VK_F3;
+        case NSF4FunctionKey: return VK_F4;
+        case NSF5FunctionKey: return VK_F5;
+        case NSF6FunctionKey: return VK_F6;
+        case NSF7FunctionKey: return VK_F7;
+        case NSF8FunctionKey: return VK_F8;
+        case NSF9FunctionKey: return VK_F9;
+        case NSF10FunctionKey: return VK_F10;
+        case NSF11FunctionKey: return VK_F11;
+        case NSF12FunctionKey: return VK_F12;
+        case NSF13FunctionKey: return VK_F13;
+        case NSF14FunctionKey: return VK_F14;
+        case NSF15FunctionKey: return VK_F15;
+        case NSF16FunctionKey: return VK_F16;
+        case NSF17FunctionKey: return VK_F17;
+        case NSF18FunctionKey: return VK_F18;
+        case NSF19FunctionKey: return VK_F19;
+        case NSF20FunctionKey: return VK_F20;
+#endif
         case NSF21FunctionKey: return VK_F21;
         case NSF22FunctionKey: return VK_F22;
         case NSF23FunctionKey: return VK_F23;
diff --git a/WebCore/platform/efl/Language.cpp b/WebCore/platform/efl/LanguageEfl.cpp
index 1da7925..4b765a6 100644
--- a/WebCore/platform/efl/Language.cpp
+++ b/WebCore/platform/efl/LanguageEfl.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-String defaultLanguage()
+String platformDefaultLanguage()
 {
     notImplemented();
     return String();
diff --git a/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp b/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
index fd84b15..2888b22 100644
--- a/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
+++ b/WebCore/platform/efl/PlatformKeyboardEventEfl.cpp
@@ -39,7 +39,7 @@
 #include <Evas.h>
 #include <stdio.h>
 #include <wtf/HashMap.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/text/StringHash.h>
 
 namespace WebCore {
@@ -53,7 +53,7 @@ static WindowsKeyMap gWindowsKeyMap;
 static void createKeyMap()
 {
     for (unsigned int i = 1; i < 25; i++) {
-        String key = String::format("F%d", i);
+        String key = makeString('F', String::number(i));
         gKeyMap.set(key, key);
     }
     gKeyMap.set("Alt_L", "Alt");
@@ -131,15 +131,15 @@ static void createWindowsKeyMap()
     gWindowsKeyMap.set("quotedbl",     VK_OEM_7);
 
     // Alphabet
-    String alphabet = "abcdefghijklmnopqrstuvwxyz";
+    const char* alphabet = "abcdefghijklmnopqrstuvwxyz";
     for (unsigned int i = 0; i < 26; i++) {
-        String key = String::format("%c", alphabet[i]);
+        String key(alphabet + i, 1);
         gWindowsKeyMap.set(key, VK_A + i);
     }
 
     // Digits
     for (unsigned int i = 0; i < 10; i++) {
-        String key = String::format("%d", i);
+        String key = String::number(i);
         gWindowsKeyMap.set(key, VK_0 + i);
     }
 
@@ -161,7 +161,7 @@ static void createWindowsKeyMap()
 
     // F_XX
     for (unsigned int i = 1; i < 25; i++) {
-        String key = String::format("F%d", i);
+        String key = makeString('F', String::number(i));
         gWindowsKeyMap.set(key, VK_F1 + i);
     }
 }
diff --git a/WebCore/platform/efl/RenderThemeEfl.cpp b/WebCore/platform/efl/RenderThemeEfl.cpp
index 53997be..6076747 100644
--- a/WebCore/platform/efl/RenderThemeEfl.cpp
+++ b/WebCore/platform/efl/RenderThemeEfl.cpp
@@ -35,6 +35,7 @@
 #include "Page.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
+#include "RenderProgress.h"
 #include "RenderSlider.h"
 #include <wtf/text/CString.h>
 
@@ -296,6 +297,25 @@ bool RenderThemeEfl::paintThemePart(RenderObject* o, FormType type, const PaintI
         msg->val[0] = static_cast<float>(value) / static_cast<float>(max);
         msg->val[1] = 0.1;
         edje_object_message_send(ce->o, EDJE_MESSAGE_FLOAT_SET, 0, msg);
+#if ENABLE(PROGRESS_TAG)
+    } else if (type == ProgressBar) {
+        RenderProgress* renderProgress = toRenderProgress(o);
+        Edje_Message_Float_Set* msg;
+        int max;
+        double value;
+
+        msg = static_cast<Edje_Message_Float_Set*>(alloca(sizeof(Edje_Message_Float_Set) + sizeof(float)));
+        max = rect.width();
+        value = renderProgress->position();
+
+        msg->count = 2;
+        if (o->style()->direction() == RTL)
+            msg->val[0] = (1.0 - value) * max;
+        else
+            msg->val[0] = 0;
+        msg->val[1] = value;
+        edje_object_message_send(ce->o, EDJE_MESSAGE_FLOAT_SET, 0, msg);
+#endif
     }
 
     edje_object_calc_force(ce->o);
@@ -562,6 +582,9 @@ const char* RenderThemeEfl::edjeGroupFromFormType(FormType type) const
         W("entry"),
         W("checkbox"),
         W("combo"),
+#if ENABLE(PROGRESS_TAG)
+        W("progressbar"),
+#endif
         W("search/field"),
         W("search/decoration"),
         W("search/results_button"),
@@ -1008,4 +1031,16 @@ void RenderThemeEfl::systemFont(int propId, FontDescription& fontDescription) co
     fontDescription.setItalic(false);
 }
 
+#if ENABLE(PROGRESS_TAG)
+void RenderThemeEfl::adjustProgressBarStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
+{
+    style->setBoxShadow(0);
+}
+
+bool RenderThemeEfl::paintProgressBar(RenderObject* o, const PaintInfo& i, const IntRect& rect)
+{
+    return paintThemePart(o, ProgressBar, i, rect);
+}
+#endif
+
 }
diff --git a/WebCore/platform/efl/RenderThemeEfl.h b/WebCore/platform/efl/RenderThemeEfl.h
index 478dfc5..087e2aa 100644
--- a/WebCore/platform/efl/RenderThemeEfl.h
+++ b/WebCore/platform/efl/RenderThemeEfl.h
@@ -45,6 +45,9 @@ enum FormType { // KEEP IN SYNC WITH edjeGroupFromFormType()
     TextField,
     CheckBox,
     ComboBox,
+#if ENABLE(PROGRESS_TAG)
+    ProgressBar,
+#endif
     SearchField,
     SearchFieldDecoration,
     SearchFieldResultsButton,
@@ -145,6 +148,11 @@ public:
 
     static void setDefaultFontSize(int size);
 
+#if ENABLE(PROGRESS_TAG)
+    virtual void adjustProgressBarStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintProgressBar(RenderObject*, const PaintInfo&, const IntRect&);
+#endif
+
 protected:
     static float defaultFontSize;
 
diff --git a/WebCore/platform/efl/SharedBufferEfl.cpp b/WebCore/platform/efl/SharedBufferEfl.cpp
index 1025e33..23769ab 100644
--- a/WebCore/platform/efl/SharedBufferEfl.cpp
+++ b/WebCore/platform/efl/SharedBufferEfl.cpp
@@ -56,7 +56,7 @@ PassRefPtr<SharedBuffer> SharedBuffer::createWithContentsOfFile(const String& fi
 
     result = SharedBuffer::create();
     result->m_buffer.resize(fileStat.st_size);
-    if (result->m_buffer.size() != fileStat.st_size) {
+    if (result->m_buffer.size() != static_cast<unsigned>(fileStat.st_size)) {
         fclose(file);
         return 0;
     }
diff --git a/WebCore/platform/efl/SharedTimerEfl.cpp b/WebCore/platform/efl/SharedTimerEfl.cpp
index 437de64..990d0c8 100644
--- a/WebCore/platform/efl/SharedTimerEfl.cpp
+++ b/WebCore/platform/efl/SharedTimerEfl.cpp
@@ -30,43 +30,97 @@
 #include "SharedTimer.h"
 
 #include <Ecore.h>
+#include <pthread.h>
 #include <stdio.h>
 #include <wtf/Assertions.h>
 #include <wtf/CurrentTime.h>
+#include <wtf/MainThread.h>
 
 namespace WebCore {
 
-static Ecore_Timer *g_sharedTimer = 0;
+static pthread_mutex_t timerMutex = PTHREAD_MUTEX_INITIALIZER;
+static Ecore_Timer *_sharedTimer = 0;
+static Ecore_Pipe *_pipe = 0;
 
-static void (*g_timerFunction)();
+static void (*_timerFunction)();
+
+struct timerOp {
+    double time;
+    unsigned char op; // 0 - add a timer; 1 - del a timer;
+};
 
 void setSharedTimerFiredFunction(void (*func)())
 {
-    g_timerFunction = func;
+    _timerFunction = func;
 }
 
 static Eina_Bool timerEvent(void*)
 {
-    if (g_timerFunction)
-        g_timerFunction();
+    if (_timerFunction)
+        _timerFunction();
+
+    _sharedTimer = 0;
 
     return ECORE_CALLBACK_CANCEL;
 }
 
-void stopSharedTimer()
+void processTimers(struct timerOp *tOp)
 {
-    if (g_sharedTimer) {
-        ecore_timer_del(g_sharedTimer);
-        g_sharedTimer = 0;
+    if (_sharedTimer) {
+        ecore_timer_del(_sharedTimer);
+        _sharedTimer = 0;
     }
+
+    if (tOp->op == 1)
+        return;
+
+    double interval = tOp->time - currentTime();
+
+    if (interval <= ecore_animator_frametime_get()) {
+        if (_timerFunction)
+            _timerFunction();
+        return;
+    }
+
+    _sharedTimer = ecore_timer_add(interval, timerEvent, 0);
 }
 
-void setSharedTimerFireTime(double fireTime)
+void pipeHandlerCb(void *data, void *buffer, unsigned int nbyte)
+{
+    ASSERT(nbyte == sizeof(struct timerOp));
+
+    struct timerOp *tOp = (struct timerOp *)buffer;
+    processTimers(tOp);
+}
+
+void stopSharedTimer()
 {
-    double interval = fireTime - currentTime();
+    struct timerOp tOp;
+    pthread_mutex_lock(&timerMutex);
+    if (!_pipe)
+        _pipe = ecore_pipe_add(pipeHandlerCb, 0);
+    pthread_mutex_unlock(&timerMutex);
 
-    stopSharedTimer();
-    g_sharedTimer = ecore_timer_add(interval, timerEvent, 0);
+    tOp.op = 1;
+    ecore_pipe_write(_pipe, &tOp, sizeof(tOp));
+}
+
+void addNewTimer(double fireTime)
+{
+    struct timerOp tOp;
+    pthread_mutex_lock(&timerMutex);
+    if (!_pipe)
+        _pipe = ecore_pipe_add(pipeHandlerCb, 0);
+    pthread_mutex_unlock(&timerMutex);
+
+    tOp.time = fireTime;
+    tOp.op = 0;
+    ecore_pipe_write(_pipe, &tOp, sizeof(tOp));
+}
+
+void setSharedTimerFireTime(double fireTime)
+{
+    addNewTimer(fireTime);
 }
 
 }
diff --git a/WebCore/platform/efl/WidgetEfl.cpp b/WebCore/platform/efl/WidgetEfl.cpp
index d82e99e..640e6e3 100644
--- a/WebCore/platform/efl/WidgetEfl.cpp
+++ b/WebCore/platform/efl/WidgetEfl.cpp
@@ -206,7 +206,7 @@ void Widget::setFocus(bool focused)
 
 void Widget::applyFallbackCursor()
 {
-#if HAVE_ECORE_X
+#ifdef HAVE_ECORE_X
     if (m_data->m_isUsingEcoreX && !m_data->m_cursorGroup.isNull()) {
         int shape = cursorStringMap.cursor(m_data->m_cursorGroup.utf8().data());
 
diff --git a/WebCore/platform/graphics/ANGLEWebKitBridge.cpp b/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
index 9a14820..64f19c4 100644
--- a/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
+++ b/WebCore/platform/graphics/ANGLEWebKitBridge.cpp
@@ -44,8 +44,6 @@ ANGLEWebKitBridge::~ANGLEWebKitBridge()
         ShDestruct(m_fragmentCompiler);
         ShDestruct(m_vertexCompiler);
     }
-    
-    ShFinalize();
 }
 
 bool ANGLEWebKitBridge::validateShaderSource(const char* shaderSource, ANGLEShaderType shaderType, String& translatedShaderSource, String& shaderValidationLog)
diff --git a/WebCore/platform/graphics/Color.cpp b/WebCore/platform/graphics/Color.cpp
index f28d51c..fa7346e 100644
--- a/WebCore/platform/graphics/Color.cpp
+++ b/WebCore/platform/graphics/Color.cpp
@@ -175,8 +175,7 @@ Color::Color(const char* name)
         m_valid = parseHexColor(&name[1], m_color);
     else {
         const NamedColor* foundColor = findColor(name, strlen(name));
-        m_color = foundColor ? foundColor->RGBValue : 0;
-        m_color |= 0xFF000000;
+        m_color = foundColor ? foundColor->ARGBValue : 0;
         m_valid = foundColor;
     }
 }
@@ -219,8 +218,7 @@ static inline const NamedColor* findNamedColor(const String& name)
 void Color::setNamedColor(const String& name)
 {
     const NamedColor* foundColor = findNamedColor(name);
-    m_color = foundColor ? foundColor->RGBValue : 0;
-    m_color |= 0xFF000000;
+    m_color = foundColor ? foundColor->ARGBValue : 0;
     m_valid = foundColor;
 }
 
diff --git a/WebCore/platform/graphics/Color.h b/WebCore/platform/graphics/Color.h
index 22a8a8f..276e69f 100644
--- a/WebCore/platform/graphics/Color.h
+++ b/WebCore/platform/graphics/Color.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003-6 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,6 +31,7 @@
 #include <wtf/unicode/Unicode.h>
 
 #if PLATFORM(CG)
+#include "ColorSpace.h"
 typedef struct CGColor* CGColorRef;
 #endif
 
@@ -180,7 +181,7 @@ Color colorFromPremultipliedARGB(unsigned);
 unsigned premultipliedARGBFromColor(const Color&);
 
 #if PLATFORM(CG)
-CGColorRef createCGColor(const Color&);
+CGColorRef cachedCGColor(const Color&, ColorSpace);
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/ColorSpace.h b/WebCore/platform/graphics/ColorSpace.h
index 1bad58c..7622c47 100644
--- a/WebCore/platform/graphics/ColorSpace.h
+++ b/WebCore/platform/graphics/ColorSpace.h
@@ -28,7 +28,11 @@
 
 namespace WebCore {
 
-    enum ColorSpace { DeviceColorSpace, sRGBColorSpace };
+enum ColorSpace {
+    ColorSpaceDeviceRGB,
+    ColorSpaceSRGB,
+    ColorSpaceLinearRGB
+};
     
 } // namespace WebCore
 
diff --git a/WebCore/platform/graphics/ContextShadow.cpp b/WebCore/platform/graphics/ContextShadow.cpp
index 1007962..87a1c5c 100644
--- a/WebCore/platform/graphics/ContextShadow.cpp
+++ b/WebCore/platform/graphics/ContextShadow.cpp
@@ -39,18 +39,20 @@ namespace WebCore {
 
 ContextShadow::ContextShadow()
     : m_type(NoShadow)
-    , m_blurRadius(0)
+    , m_blurDistance(0)
+    , m_layerContext(0)
 {
 }
 
 ContextShadow::ContextShadow(const Color& color, float radius, const FloatSize& offset)
     : m_color(color)
-    , m_blurRadius(round(radius))
+    , m_blurDistance(round(radius))
     , m_offset(offset)
+    , m_layerContext(0)
 {
     // See comments in http://webkit.org/b/40793, it seems sensible
     // to follow Skia's limit of 128 pixels of blur radius
-    m_blurRadius = min(m_blurRadius, 128);
+    m_blurDistance = min(m_blurDistance, 128);
 
     // The type of shadow is decided by the blur radius, shadow offset, and shadow color.
     if (!m_color.isValid() || !color.alpha()) {
@@ -71,7 +73,7 @@ void ContextShadow::clear()
 {
     m_type = NoShadow;
     m_color = Color();
-    m_blurRadius = 0;
+    m_blurDistance = 0;
     m_offset = FloatSize();
 }
 
@@ -85,8 +87,9 @@ static const int BlurSumShift = 15;
 void ContextShadow::blurLayerImage(unsigned char* imageData, const IntSize& size, int rowStride)
 {
     int channels[4] = { 3, 0, 1, 3 };
-    int dmax = m_blurRadius >> 1;
-    int dmin = dmax - 1 + (m_blurRadius & 1);
+    int d = max(2, static_cast<int>(floorf((2 / 3.f) * m_blurDistance)));
+    int dmax = d >> 1;
+    int dmin = dmax - 1 + (d & 1);
     if (dmin < 0)
         dmin = 0;
 
@@ -153,8 +156,8 @@ void ContextShadow::calculateLayerBoundingRect(const FloatRect& layerArea, const
     destinationRect.move(m_offset);
     m_layerRect = enclosingIntRect(destinationRect);
 
-    // We expand the area by the blur radius * 2 to give extra space for the blur transition.
-    m_layerRect.inflate((m_type == BlurShadow) ? ceil(m_blurRadius * 2) : 0);
+    // We expand the area by the blur radius to give extra space for the blur transition.
+    m_layerRect.inflate(m_type == BlurShadow ? m_blurDistance : 0);
 
     if (!clipRect.contains(m_layerRect)) {
         // No need to have the buffer larger than the clip.
@@ -167,7 +170,7 @@ void ContextShadow::calculateLayerBoundingRect(const FloatRect& layerArea, const
         // We adjust again because the pixels at the borders are still
         // potentially affected by the pixels outside the buffer.
         if (m_type == BlurShadow)
-            m_layerRect.inflate((m_type == BlurShadow) ? ceil(m_blurRadius * 2) : 0);
+            m_layerRect.inflate(m_type == BlurShadow ? m_blurDistance : 0);
     }
 }
 
diff --git a/WebCore/platform/graphics/ContextShadow.h b/WebCore/platform/graphics/ContextShadow.h
index ede9336..0160f8a 100644
--- a/WebCore/platform/graphics/ContextShadow.h
+++ b/WebCore/platform/graphics/ContextShadow.h
@@ -31,6 +31,7 @@
 
 #include "Color.h"
 #include "FloatRect.h"
+#include "GraphicsContext.h"
 #include "IntRect.h"
 #include "RefCounted.h"
 
@@ -65,7 +66,7 @@ public:
     } m_type;
 
     Color m_color;
-    int m_blurRadius;
+    int m_blurDistance;
     FloatSize m_offset;
 
     ContextShadow();
@@ -98,6 +99,9 @@ public:
     PlatformContext beginShadowLayer(PlatformContext, const FloatRect& layerArea);
     void endShadowLayer(PlatformContext);
     static void purgeScratchBuffer();
+#if PLATFORM(CAIRO)
+    void drawRectShadow(GraphicsContext* context, const IntRect& rect, const IntSize& topLeftRadius = IntSize(), const IntSize& topRightRadius = IntSize(), const IntSize& bottomLeftRadius = IntSize(), const IntSize& bottomRightRadius = IntSize());
+#endif
 
 #if PLATFORM(QT)
     QPointF offset() { return QPointF(m_offset.width(), m_offset.height()); }
@@ -111,6 +115,9 @@ private:
 
     void blurLayerImage(unsigned char*, const IntSize& imageSize, int stride);
     void calculateLayerBoundingRect(const FloatRect& layerArea, const IntRect& clipRect);
+#if PLATFORM(CAIRO)
+    void drawRectShadowWithoutTiling(PlatformContext context, const IntRect& shadowRect, const IntSize& topLeftRadius, const IntSize& topRightRadius, const IntSize& bottomLeftRadius, const IntSize& bottomRightRadius, float alpha);
+#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/FloatRect.h b/WebCore/platform/graphics/FloatRect.h
index e387927..10ad838 100644
--- a/WebCore/platform/graphics/FloatRect.h
+++ b/WebCore/platform/graphics/FloatRect.h
@@ -59,6 +59,10 @@ class BRect;
 struct SkRect;
 #endif
 
+#if PLATFORM(CAIRO)
+typedef struct _cairo_rectangle cairo_rectangle_t;
+#endif
+
 namespace WebCore {
 
 #if PLATFORM(OPENVG)
@@ -172,6 +176,11 @@ public:
     operator VGRect() const;
 #endif
 
+#if PLATFORM(CAIRO)
+    FloatRect(const cairo_rectangle_t&);
+    operator cairo_rectangle_t() const;
+#endif
+
 private:
     FloatPoint m_location;
     FloatSize m_size;
diff --git a/WebCore/platform/graphics/GraphicsContext.cpp b/WebCore/platform/graphics/GraphicsContext.cpp
index 3dfdb20..ec15d26 100644
--- a/WebCore/platform/graphics/GraphicsContext.cpp
+++ b/WebCore/platform/graphics/GraphicsContext.cpp
@@ -219,7 +219,7 @@ void GraphicsContext::setStrokePattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setStrokeColor(Color::black, DeviceColorSpace);
+        setStrokeColor(Color::black, ColorSpaceDeviceRGB);
         return;
     }
     m_common->state.strokeGradient.clear();
@@ -231,7 +231,7 @@ void GraphicsContext::setFillPattern(PassRefPtr<Pattern> pattern)
 {
     ASSERT(pattern);
     if (!pattern) {
-        setFillColor(Color::black, DeviceColorSpace);
+        setFillColor(Color::black, ColorSpaceDeviceRGB);
         return;
     }
     m_common->state.fillGradient.clear();
@@ -243,7 +243,7 @@ void GraphicsContext::setStrokeGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setStrokeColor(Color::black, DeviceColorSpace);
+        setStrokeColor(Color::black, ColorSpaceDeviceRGB);
         return;
     }
     m_common->state.strokeGradient = gradient;
@@ -255,7 +255,7 @@ void GraphicsContext::setFillGradient(PassRefPtr<Gradient> gradient)
 {
     ASSERT(gradient);
     if (!gradient) {
-        setFillColor(Color::black, DeviceColorSpace);
+        setFillColor(Color::black, ColorSpaceDeviceRGB);
         return;
     }
     m_common->state.fillGradient = gradient;
@@ -500,7 +500,9 @@ void GraphicsContext::addRoundedRectClip(const IntRect& rect, const IntSize& top
     if (paintingDisabled())
         return;
 
-    clip(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
+    Path path;
+    path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+    clip(path);
 }
 
 void GraphicsContext::clipOutRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight,
@@ -509,7 +511,9 @@ void GraphicsContext::clipOutRoundedRect(const IntRect& rect, const IntSize& top
     if (paintingDisabled())
         return;
 
-    clipOut(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
+    Path path;
+    path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+    clipOut(path);
 }
 
 void GraphicsContext::clipToImageBuffer(ImageBuffer* buffer, const FloatRect& rect)
diff --git a/WebCore/platform/graphics/GraphicsContext.h b/WebCore/platform/graphics/GraphicsContext.h
index fd3bf2c..b1fa48a 100644
--- a/WebCore/platform/graphics/GraphicsContext.h
+++ b/WebCore/platform/graphics/GraphicsContext.h
@@ -41,6 +41,9 @@
 typedef struct CGContext PlatformGraphicsContext;
 #elif PLATFORM(CAIRO)
 #include "PlatformRefPtrCairo.h"
+namespace WebCore {
+class ContextShadow;
+}
 typedef struct _cairo PlatformGraphicsContext;
 #elif PLATFORM(OPENVG)
 namespace WebCore {
@@ -333,11 +336,6 @@ namespace WebCore {
         void setAlpha(float);
 #if PLATFORM(CAIRO)
         float getAlpha();
-        void applyPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float radius);
-        PlatformRefPtr<cairo_surface_t> createShadowMask(PassOwnPtr<ImageBuffer>, const FloatRect&, float radius);
-
-        static void calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& radius, const FloatRect& sourceRect, const FloatSize& shadowOffset, float shadowBlur);
-        void drawTiledShadow(const IntRect& rect, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius, ColorSpace colorSpace);
 #endif
 
         void setCompositeOperation(CompositeOperator);
@@ -438,6 +436,9 @@ namespace WebCore {
         void pushTransparencyLayerInternal(const QRect &rect, qreal opacity, QPixmap& alphaMask);
         QPen pen();
         static QPainter::CompositionMode toQtCompositionMode(CompositeOperator op);
+#endif
+
+#if PLATFORM(QT) || PLATFORM(CAIRO)
         ContextShadow* contextShadow();
 #endif
 
diff --git a/WebCore/platform/graphics/GraphicsContext3D.cpp b/WebCore/platform/graphics/GraphicsContext3D.cpp
index 86e9569..d2e9057 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.cpp
+++ b/WebCore/platform/graphics/GraphicsContext3D.cpp
@@ -31,11 +31,27 @@
 #include "GraphicsContext3D.h"
 
 #include "ArrayBufferView.h"
+#include "DrawingBuffer.h"
 #include "Image.h"
 #include "ImageData.h"
 
 namespace WebCore {
 
+static uint8_t convertColor16LittleTo8(uint16_t value)
+{
+    return value >> 8;
+}
+
+static uint8_t convertColor16BigTo8(uint16_t value)
+{
+    return static_cast<uint8_t>(value & 0x00FF);
+}
+
+PassRefPtr<DrawingBuffer> GraphicsContext3D::createDrawingBuffer(const IntSize& size)
+{
+    return DrawingBuffer::create(this, size);
+}
+
 bool GraphicsContext3D::computeFormatAndTypeParameters(unsigned int format,
                                                        unsigned int type,
                                                        unsigned long* componentsPerPixel,
@@ -247,6 +263,22 @@ void unpackRGBA8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[3];
 }
 
+void unpackRGBA16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[0]);
+    destination[1] = convertColor16LittleTo8(source[1]);
+    destination[2] = convertColor16LittleTo8(source[2]);
+    destination[3] = convertColor16LittleTo8(source[3]);
+}
+
+void unpackRGBA16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[0]);
+    destination[1] = convertColor16BigTo8(source[1]);
+    destination[2] = convertColor16BigTo8(source[2]);
+    destination[3] = convertColor16BigTo8(source[3]);
+}
+
 void unpackRGB8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[0];
@@ -255,6 +287,22 @@ void unpackRGB8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = 0xFF;
 }
 
+void unpackRGB16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[0]);
+    destination[1] = convertColor16LittleTo8(source[1]);
+    destination[2] = convertColor16LittleTo8(source[2]);
+    destination[3] = 0xFF;
+}
+
+void unpackRGB16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[0]);
+    destination[1] = convertColor16BigTo8(source[1]);
+    destination[2] = convertColor16BigTo8(source[2]);
+    destination[3] = 0xFF;
+}
+
 void unpackARGB8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[1];
@@ -263,6 +311,22 @@ void unpackARGB8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[0];
 }
 
+void unpackARGB16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[1]);
+    destination[1] = convertColor16LittleTo8(source[2]);
+    destination[2] = convertColor16LittleTo8(source[3]);
+    destination[3] = convertColor16LittleTo8(source[0]);
+}
+
+void unpackARGB16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[1]);
+    destination[1] = convertColor16BigTo8(source[2]);
+    destination[2] = convertColor16BigTo8(source[3]);
+    destination[3] = convertColor16BigTo8(source[0]);
+}
+
 void unpackBGRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[2];
@@ -271,6 +335,22 @@ void unpackBGRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[3];
 }
 
+void unpackBGRA16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[2]);
+    destination[1] = convertColor16LittleTo8(source[1]);
+    destination[2] = convertColor16LittleTo8(source[0]);
+    destination[3] = convertColor16LittleTo8(source[3]);
+}
+
+void unpackBGRA16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[2]);
+    destination[1] = convertColor16BigTo8(source[1]);
+    destination[2] = convertColor16BigTo8(source[0]);
+    destination[3] = convertColor16BigTo8(source[3]);
+}
+
 void unpackRGBA5551ToRGBA8(const uint16_t* source, uint8_t* destination)
 {
     uint16_t packedValue = source[0];
@@ -316,6 +396,22 @@ void unpackR8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = 0xFF;
 }
 
+void unpackR16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[0]);
+    destination[1] = convertColor16LittleTo8(source[0]);
+    destination[2] = convertColor16LittleTo8(source[0]);
+    destination[3] = 0xFF;
+}
+
+void unpackR16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[0]);
+    destination[1] = convertColor16BigTo8(source[0]);
+    destination[2] = convertColor16BigTo8(source[0]);
+    destination[3] = 0xFF;
+}
+
 void unpackRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[0];
@@ -324,6 +420,22 @@ void unpackRA8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[1];
 }
 
+void unpackRA16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[0]);
+    destination[1] = convertColor16LittleTo8(source[0]);
+    destination[2] = convertColor16LittleTo8(source[0]);
+    destination[3] = convertColor16LittleTo8(source[1]);
+}
+
+void unpackRA16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[0]);
+    destination[1] = convertColor16BigTo8(source[0]);
+    destination[2] = convertColor16BigTo8(source[0]);
+    destination[3] = convertColor16BigTo8(source[1]);
+}
+
 void unpackAR8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = source[1];
@@ -332,6 +444,22 @@ void unpackAR8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[0];
 }
 
+void unpackAR16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16LittleTo8(source[1]);
+    destination[1] = convertColor16LittleTo8(source[1]);
+    destination[2] = convertColor16LittleTo8(source[1]);
+    destination[3] = convertColor16LittleTo8(source[0]);
+}
+
+void unpackAR16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = convertColor16BigTo8(source[1]);
+    destination[1] = convertColor16BigTo8(source[1]);
+    destination[2] = convertColor16BigTo8(source[1]);
+    destination[3] = convertColor16BigTo8(source[0]);
+}
+
 void unpackA8ToRGBA8(const uint8_t* source, uint8_t* destination)
 {
     destination[0] = 0x0;
@@ -340,6 +468,22 @@ void unpackA8ToRGBA8(const uint8_t* source, uint8_t* destination)
     destination[3] = source[0];
 }
 
+void unpackA16LittleToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = 0x0;
+    destination[1] = 0x0;
+    destination[2] = 0x0;
+    destination[3] = convertColor16LittleTo8(source[0]);
+}
+
+void unpackA16BigToRGBA8(const uint16_t* source, uint8_t* destination)
+{
+    destination[0] = 0x0;
+    destination[1] = 0x0;
+    destination[2] = 0x0;
+    destination[3] = convertColor16BigTo8(source[0]);
+}
+
 //----------------------------------------------------------------------
 // Pixel packing routines.
 //
@@ -602,6 +746,7 @@ static void computeIncrementParameters(unsigned int width,
 {
     unsigned int elementSizeInBytes = sizeof(SourceType);
     ASSERT(elementSizeInBytes <= bytesPerPixel);
+    ASSERT(!(bytesPerPixel % elementSizeInBytes));
     unsigned int validRowBytes = width * bytesPerPixel;
     unsigned int totalRowBytes = validRowBytes;
     if (unpackAlignment) {
@@ -644,24 +789,72 @@ static void doPacking(const void* sourceData,
         }
         break;
     }
+    case GraphicsContext3D::kSourceFormatRGBA16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGBA16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRGBA16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGBA16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatRGB8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 3, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackRGB8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatRGB16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 6, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGB16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRGB16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 6, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRGB16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatARGB8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackARGB8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatARGB16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackARGB16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatARGB16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackARGB16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatBGRA8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackBGRA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatBGRA16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackBGRA16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatBGRA16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 8, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackBGRA16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatRGBA5551: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
@@ -686,24 +879,72 @@ static void doPacking(const void* sourceData,
         doUnpackingAndPacking<uint8_t, DestType, unpackR8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatR16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackR16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatR16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackR16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatRA8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackRA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatRA16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRA16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatRA16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackRA16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatAR8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackAR8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatAR16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackAR16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatAR16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 4, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackAR16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     case GraphicsContext3D::kSourceFormatA8: {
         unsigned int sourceElementsPerPixel, sourceElementsPerRow;
         computeIncrementParameters<uint8_t>(width, 1, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
         doUnpackingAndPacking<uint8_t, DestType, unpackA8ToRGBA8, packingFunc>(static_cast<const uint8_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
         break;
     }
+    case GraphicsContext3D::kSourceFormatA16Little: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackA16LittleToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
+    case GraphicsContext3D::kSourceFormatA16Big: {
+        unsigned int sourceElementsPerPixel, sourceElementsPerRow;
+        computeIncrementParameters<uint16_t>(width, 2, sourceUnpackAlignment, &sourceElementsPerPixel, &sourceElementsPerRow);
+        doUnpackingAndPacking<uint16_t, DestType, unpackA16BigToRGBA8, packingFunc>(static_cast<const uint16_t*>(sourceData), width, height, sourceElementsPerPixel, sourceElementsPerRow, destinationData, destinationElementsPerPixel);
+        break;
+    }
     }
 }
 
diff --git a/WebCore/platform/graphics/GraphicsContext3D.h b/WebCore/platform/graphics/GraphicsContext3D.h
index a12b1c4..d74c97c 100644
--- a/WebCore/platform/graphics/GraphicsContext3D.h
+++ b/WebCore/platform/graphics/GraphicsContext3D.h
@@ -26,16 +26,12 @@
 #ifndef GraphicsContext3D_h
 #define GraphicsContext3D_h
 
-#if PLATFORM(MAC)
-#include "ANGLEWebKitBridge.h"
-#endif
 #include "GraphicsLayer.h"
 #include "PlatformString.h"
 
 #include <wtf/HashMap.h>
 #include <wtf/ListHashSet.h>
 #include <wtf/Noncopyable.h>
-#include <wtf/PassOwnPtr.h>
 
 // FIXME: Find a better way to avoid the name confliction for NO_ERROR.
 #if ((PLATFORM(CHROMIUM) && OS(WINDOWS)) || PLATFORM(WIN) || (PLATFORM(QT) && OS(WINDOWS)))
@@ -43,6 +39,7 @@
 #endif
 
 #if PLATFORM(MAC)
+#include "ANGLEWebKitBridge.h"
 #include <OpenGL/OpenGL.h>
 #include <wtf/RetainPtr.h>
 
@@ -78,6 +75,7 @@ const Platform3DObject NullPlatform3DObject = 0;
 
 namespace WebCore {
 class CanvasRenderingContext;
+class DrawingBuffer;
 class HostWindow;
 class Image;
 class ImageData;
@@ -94,7 +92,7 @@ struct ActiveInfo {
 class GraphicsContext3DInternal;
 #endif
 
-class GraphicsContext3D : public Noncopyable {
+class GraphicsContext3D : public RefCounted<GraphicsContext3D> {
 public:
     enum WebGLEnumType {
         DEPTH_BUFFER_BIT = 0x00000100,
@@ -409,7 +407,13 @@ public:
 
         // GL_CHROMIUM_map_sub (enums inherited from GL_ARB_vertex_buffer_object)
         READ_ONLY = 0x88B8,
-        WRITE_ONLY = 0x88B9
+        WRITE_ONLY = 0x88B9,
+
+        // GL_ARB_robustness enums
+        GUILTY_CONTEXT_RESET_ARB = 0x8253,
+        INNOCENT_CONTEXT_RESET_ARB = 0x8254,
+        UNKNOWN_CONTEXT_RESET_ARB = 0x8255
+
     };
 
     // Context creation attributes.
@@ -435,8 +439,8 @@ public:
         RenderDirectlyToHostWindow
     };
 
-    static PassOwnPtr<GraphicsContext3D> create(Attributes attrs, HostWindow* hostWindow, RenderStyle renderStyle = RenderOffscreen);
-    virtual ~GraphicsContext3D();
+    static PassRefPtr<GraphicsContext3D> create(Attributes, HostWindow*, RenderStyle = RenderOffscreen);
+    ~GraphicsContext3D();
 
 #if PLATFORM(MAC)
     PlatformGraphicsContext3D platformGraphicsContext3D() const { return m_contextObj; }
@@ -463,6 +467,8 @@ public:
 #endif
     void makeContextCurrent();
 
+    PassRefPtr<DrawingBuffer> createDrawingBuffer(const IntSize& = IntSize());
+    
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
     // With multisampling on, blit from multisampleFBO to regular FBO.
     void prepareTexture();
@@ -535,16 +541,32 @@ public:
     // by non-member functions.
     enum SourceDataFormat {
         kSourceFormatRGBA8,
+        kSourceFormatRGBA16Little,
+        kSourceFormatRGBA16Big,
         kSourceFormatRGB8,
+        kSourceFormatRGB16Little,
+        kSourceFormatRGB16Big,
         kSourceFormatBGRA8,
+        kSourceFormatBGRA16Little,
+        kSourceFormatBGRA16Big,
         kSourceFormatARGB8,
+        kSourceFormatARGB16Little,
+        kSourceFormatARGB16Big,
         kSourceFormatRGBA5551,
         kSourceFormatRGBA4444,
         kSourceFormatRGB565,
         kSourceFormatR8,
+        kSourceFormatR16Little,
+        kSourceFormatR16Big,
         kSourceFormatRA8,
+        kSourceFormatRA16Little,
+        kSourceFormatRA16Big,
         kSourceFormatAR8,
-        kSourceFormatA8
+        kSourceFormatAR16Little,
+        kSourceFormatAR16Big,
+        kSourceFormatA8,
+        kSourceFormatA16Little,
+        kSourceFormatA16Big
     };
 
     //----------------------------------------------------------------------
@@ -777,6 +799,9 @@ public:
     bool supportsCopyTextureToParentTextureCHROMIUM();
     void copyTextureToParentTextureCHROMIUM(unsigned texture, unsigned parentTexture);
 
+    // GL_ARB_robustness
+    int getGraphicsResetStatusARB();
+
   private:
     GraphicsContext3D(Attributes attrs, HostWindow* hostWindow, bool renderDirectlyToHostWindow);
 
diff --git a/WebCore/platform/graphics/GraphicsContextPrivate.h b/WebCore/platform/graphics/GraphicsContextPrivate.h
index 903c7e3..985cad9 100644
--- a/WebCore/platform/graphics/GraphicsContextPrivate.h
+++ b/WebCore/platform/graphics/GraphicsContextPrivate.h
@@ -39,10 +39,10 @@ namespace WebCore {
             , strokeStyle(SolidStroke)
             , strokeThickness(0)
             , strokeColor(Color::black)
-            , strokeColorSpace(DeviceColorSpace)
+            , strokeColorSpace(ColorSpaceDeviceRGB)
             , fillRule(RULE_NONZERO)
             , fillColor(Color::black)
-            , fillColorSpace(DeviceColorSpace)
+            , fillColorSpace(ColorSpaceDeviceRGB)
             , shouldAntialias(true)
             , paintingDisabled(false)
             , shadowBlur(0)
diff --git a/WebCore/platform/graphics/GraphicsLayer.cpp b/WebCore/platform/graphics/GraphicsLayer.cpp
index 412f06d..08b79ab 100644
--- a/WebCore/platform/graphics/GraphicsLayer.cpp
+++ b/WebCore/platform/graphics/GraphicsLayer.cpp
@@ -33,6 +33,7 @@
 #include "RotateTransformOperation.h"
 #include "TextStream.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #ifndef NDEBUG
 #include <stdio.h>
@@ -249,7 +250,7 @@ void GraphicsLayer::paintGraphicsLayerContents(GraphicsContext& context, const I
 String GraphicsLayer::animationNameForTransition(AnimatedPropertyID property)
 {
     // | is not a valid identifier character in CSS, so this can never conflict with a keyframe identifier.
-    return String::format("-|transition%c-", property);
+    return makeString("-|transition", static_cast<char>(property), '-');
 }
 
 void GraphicsLayer::suspendAnimations(double)
diff --git a/WebCore/platform/graphics/ImageBuffer.cpp b/WebCore/platform/graphics/ImageBuffer.cpp
index 71b8189..4a76be4 100644
--- a/WebCore/platform/graphics/ImageBuffer.cpp
+++ b/WebCore/platform/graphics/ImageBuffer.cpp
@@ -32,17 +32,17 @@
 
 namespace WebCore {
 
-void ImageBuffer::transformColorSpace(ImageColorSpace srcColorSpace, ImageColorSpace dstColorSpace)
+void ImageBuffer::transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstColorSpace)
 {
     if (srcColorSpace == dstColorSpace)
         return;
 
     // only sRGB <-> linearRGB are supported at the moment
-    if ((srcColorSpace != LinearRGB && srcColorSpace != DeviceRGB) || 
-        (dstColorSpace != LinearRGB && dstColorSpace != DeviceRGB))
+    if ((srcColorSpace != ColorSpaceLinearRGB && srcColorSpace != ColorSpaceDeviceRGB) 
+        || (dstColorSpace != ColorSpaceLinearRGB && dstColorSpace != ColorSpaceDeviceRGB))
         return;
 
-    if (dstColorSpace == LinearRGB) {
+    if (dstColorSpace == ColorSpaceLinearRGB) {
         if (m_linearRgbLUT.isEmpty()) {
             for (unsigned i = 0; i < 256; i++) {
                 float color = i  / 255.0f;
@@ -53,7 +53,7 @@ void ImageBuffer::transformColorSpace(ImageColorSpace srcColorSpace, ImageColorS
             }
         }
         platformTransformColorSpace(m_linearRgbLUT);
-    } else if (dstColorSpace == DeviceRGB) {
+    } else if (dstColorSpace == ColorSpaceDeviceRGB) {
         if (m_deviceRgbLUT.isEmpty()) {
             for (unsigned i = 0; i < 256; i++) {
                 float color = i / 255.0f;
diff --git a/WebCore/platform/graphics/ImageBuffer.h b/WebCore/platform/graphics/ImageBuffer.h
index 3c0508e..822a0ff 100644
--- a/WebCore/platform/graphics/ImageBuffer.h
+++ b/WebCore/platform/graphics/ImageBuffer.h
@@ -29,6 +29,7 @@
 #define ImageBuffer_h
 
 #include "AffineTransform.h"
+#include "ColorSpace.h"
 #include "FloatRect.h"
 #include "Image.h"
 #include "IntSize.h"
@@ -44,13 +45,6 @@ namespace WebCore {
     class ImageData;
     class IntPoint;
     class IntRect;
-    
-    enum ImageColorSpace {
-        Unknown,
-        DeviceRGB, // like sRGB
-        GrayScale,
-        LinearRGB
-    };
 
     enum Multiply {
         Premultiplied,
@@ -60,7 +54,7 @@ namespace WebCore {
     class ImageBuffer : public Noncopyable {
     public:
         // Will return a null pointer on allocation failure.
-        static PassOwnPtr<ImageBuffer> create(const IntSize& size, ImageColorSpace colorSpace = DeviceRGB)
+        static PassOwnPtr<ImageBuffer> create(const IntSize& size, ColorSpace colorSpace = ColorSpaceDeviceRGB)
         {
             bool success = false;
             OwnPtr<ImageBuffer> buf(new ImageBuffer(size, colorSpace, success));
@@ -89,7 +83,7 @@ namespace WebCore {
         String toDataURL(const String& mimeType, const double* quality = 0) const;
 #if !PLATFORM(CG)
         AffineTransform baseTransform() const { return AffineTransform(); }
-        void transformColorSpace(ImageColorSpace srcColorSpace, ImageColorSpace dstColorSpace);
+        void transformColorSpace(ColorSpace srcColorSpace, ColorSpace dstColorSpace);
         void platformTransformColorSpace(const Vector<int>&);
 #else
         AffineTransform baseTransform() const { return AffineTransform(1, 0, 0, -1, 0, m_size.height()); }
@@ -119,7 +113,7 @@ namespace WebCore {
 
         // This constructor will place its success into the given out-variable
         // so that create() knows when it should return failure.
-        ImageBuffer(const IntSize&, ImageColorSpace colorSpace, bool& success);
+        ImageBuffer(const IntSize&, ColorSpace colorSpace, bool& success);
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/IntRect.h b/WebCore/platform/graphics/IntRect.h
index c5990ef..c8d7c71 100644
--- a/WebCore/platform/graphics/IntRect.h
+++ b/WebCore/platform/graphics/IntRect.h
@@ -56,6 +56,8 @@ typedef cairo_rectangle_int_t GdkRectangle;
 #endif
 #elif PLATFORM(HAIKU)
 class BRect;
+#elif PLATFORM(EFL)
+typedef struct _Eina_Rectangle Eina_Rectangle;
 #endif
 
 #if PLATFORM(WX)
@@ -158,6 +160,9 @@ public:
 #elif PLATFORM(HAIKU)
     explicit IntRect(const BRect&);
     operator BRect() const;
+#elif PLATFORM(EFL)
+    explicit IntRect(const Eina_Rectangle&);
+    operator Eina_Rectangle() const;
 #endif
 
 #if PLATFORM(CG)
diff --git a/WebCore/platform/graphics/Path.cpp b/WebCore/platform/graphics/Path.cpp
index 4e2de53..55760b1 100644
--- a/WebCore/platform/graphics/Path.cpp
+++ b/WebCore/platform/graphics/Path.cpp
@@ -35,8 +35,9 @@
 #include <math.h>
 #include <wtf/MathExtras.h>
 
-static const float QUARTER = 0.552f; // approximation of control point positions on a bezier
-                              // to simulate a quarter of a circle.
+// Approximation of control point positions on a bezier to simulate a quarter of a circle.
+static const float gCircleControlPoint = 0.448f;
+
 namespace WebCore {
 
 #if !PLATFORM(OPENVG) && !PLATFORM(QT)
@@ -47,7 +48,7 @@ static void pathLengthApplierFunction(void* info, const PathElement* element)
         return;
     traversalState.m_previous = traversalState.m_current;
     FloatPoint* points = element->points;
-    float segmentLength = 0.0f;
+    float segmentLength = 0;
     switch (element->type) {
         case PathElementMoveToPoint:
             segmentLength = traversalState.moveTo(points[0]);
@@ -75,10 +76,8 @@ static void pathLengthApplierFunction(void* info, const PathElement* element)
         if (traversalState.m_action == PathTraversalState::TraversalPointAtLength) {
             float offset = traversalState.m_desiredLength - traversalState.m_totalLength;
             traversalState.m_current.move(offset * cosf(slope), offset * sinf(slope));
-        } else {
-            static const float rad2deg = 180.0f / piFloat;
-            traversalState.m_normalAngle = slope * rad2deg;
-        }
+        } else
+            traversalState.m_normalAngle = rad2deg(slope);
 
         traversalState.m_success = true;
     }
@@ -110,167 +109,83 @@ float Path::normalAngleAtLength(float length, bool& ok)
 }
 #endif
 
-Path Path::createRoundedRectangle(const FloatRect& rectangle, const FloatSize& roundingRadii)
+void Path::addRoundedRect(const FloatRect& rect, const FloatSize& roundingRadii)
 {
-    Path path;
-    float x = rectangle.x();
-    float y = rectangle.y();
-    float width = rectangle.width();
-    float height = rectangle.height();
-    float rx = roundingRadii.width();
-    float ry = roundingRadii.height();
-    if (width <= 0.0f || height <= 0.0f)
-        return path;
+    if (rect.isEmpty())
+        return;
+
+    FloatSize radius(roundingRadii);
+    FloatSize halfSize(rect.width() / 2, rect.height() / 2);
 
-    float dx = rx, dy = ry;
     // If rx is greater than half of the width of the rectangle
     // then set rx to half of the width (required in SVG spec)
-    if (dx > width * 0.5f)
-        dx = width * 0.5f;
+    if (radius.width() > halfSize.width())
+        radius.setWidth(halfSize.width());
 
     // If ry is greater than half of the height of the rectangle
     // then set ry to half of the height (required in SVG spec)
-    if (dy > height * 0.5f)
-        dy = height * 0.5f;
+    if (radius.height() > halfSize.height())
+        radius.setHeight(halfSize.height());
 
-    path.moveTo(FloatPoint(x + dx, y));
+    moveTo(FloatPoint(rect.x() + radius.width(), rect.y()));
 
-    if (dx < width * 0.5f)
-        path.addLineTo(FloatPoint(x + width - rx, y));
+    if (radius.width() < halfSize.width())
+        addLineTo(FloatPoint(rect.x() + rect.width() - roundingRadii.width(), rect.y()));
 
-    path.addBezierCurveTo(FloatPoint(x + width - dx * (1 - QUARTER), y), FloatPoint(x + width, y + dy * (1 - QUARTER)), FloatPoint(x + width, y + dy));
+    addBezierCurveTo(FloatPoint(rect.x() + rect.width() - radius.width() * gCircleControlPoint, rect.y()), FloatPoint(rect.x() + rect.width(), rect.y() + radius.height() * gCircleControlPoint), FloatPoint(rect.x() + rect.width(), rect.y() + radius.height()));
 
-    if (dy < height * 0.5)
-        path.addLineTo(FloatPoint(x + width, y + height - dy));
+    if (radius.height() < halfSize.height())
+        addLineTo(FloatPoint(rect.x() + rect.width(), rect.y() + rect.height() - radius.height()));
 
-    path.addBezierCurveTo(FloatPoint(x + width, y + height - dy * (1 - QUARTER)), FloatPoint(x + width - dx * (1 - QUARTER), y + height), FloatPoint(x + width - dx, y + height));
+    addBezierCurveTo(FloatPoint(rect.x() + rect.width(), rect.y() + rect.height() - radius.height() * gCircleControlPoint), FloatPoint(rect.x() + rect.width() - radius.width() * gCircleControlPoint, rect.y() + rect.height()), FloatPoint(rect.x() + rect.width() - radius.width(), rect.y() + rect.height()));
 
-    if (dx < width * 0.5)
-        path.addLineTo(FloatPoint(x + dx, y + height));
+    if (radius.width() < halfSize.width())
+        addLineTo(FloatPoint(rect.x() + radius.width(), rect.y() + rect.height()));
 
-    path.addBezierCurveTo(FloatPoint(x + dx * (1 - QUARTER), y + height), FloatPoint(x, y + height - dy * (1 - QUARTER)), FloatPoint(x, y + height - dy));
+    addBezierCurveTo(FloatPoint(rect.x() + radius.width() * gCircleControlPoint, rect.y() + rect.height()), FloatPoint(rect.x(), rect.y() + rect.height() - radius.height() * gCircleControlPoint), FloatPoint(rect.x(), rect.y() + rect.height() - radius.height()));
 
-    if (dy < height * 0.5)
-        path.addLineTo(FloatPoint(x, y + dy));
+    if (radius.height() < halfSize.height())
+        addLineTo(FloatPoint(rect.x(), rect.y() + radius.height()));
 
-    path.addBezierCurveTo(FloatPoint(x, y + dy * (1 - QUARTER)), FloatPoint(x + dx * (1 - QUARTER), y), FloatPoint(x + dx, y));
+    addBezierCurveTo(FloatPoint(rect.x(), rect.y() + radius.height() * gCircleControlPoint), FloatPoint(rect.x() + radius.width() * gCircleControlPoint, rect.y()), FloatPoint(rect.x() + radius.width(), rect.y()));
 
-    path.closeSubpath();
-
-    return path;
+    closeSubpath();
 }
 
-Path Path::createRoundedRectangle(const FloatRect& rectangle, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius)
+void Path::addRoundedRect(const FloatRect& rect, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius)
 {
-    Path path;
-
-    float width = rectangle.width();
-    float height = rectangle.height();
-    if (width <= 0.0 || height <= 0.0)
-        return path;
+    if (rect.isEmpty())
+        return;
 
-    if (width < topLeftRadius.width() + topRightRadius.width()
-            || width < bottomLeftRadius.width() + bottomRightRadius.width()
-            || height < topLeftRadius.height() + bottomLeftRadius.height()
-            || height < topRightRadius.height() + bottomRightRadius.height())
+    if (rect.width() < topLeftRadius.width() + topRightRadius.width()
+            || rect.width() < bottomLeftRadius.width() + bottomRightRadius.width()
+            || rect.height() < topLeftRadius.height() + bottomLeftRadius.height()
+            || rect.height() < topRightRadius.height() + bottomRightRadius.height()) {
         // If all the radii cannot be accommodated, return a rect.
-        return createRectangle(rectangle);
-
-    float x = rectangle.x();
-    float y = rectangle.y();
-
-    path.moveTo(FloatPoint(x + topLeftRadius.width(), y));
-
-    path.addLineTo(FloatPoint(x + width - topRightRadius.width(), y));
-
-    path.addBezierCurveTo(FloatPoint(x + width - topRightRadius.width() * (1 - QUARTER), y), FloatPoint(x + width, y + topRightRadius.height() * (1 - QUARTER)), FloatPoint(x + width, y + topRightRadius.height()));
-
-    path.addLineTo(FloatPoint(x + width, y + height - bottomRightRadius.height()));
-
-    path.addBezierCurveTo(FloatPoint(x + width, y + height - bottomRightRadius.height() * (1 - QUARTER)), FloatPoint(x + width - bottomRightRadius.width() * (1 - QUARTER), y + height), FloatPoint(x + width - bottomRightRadius.width(), y + height));
-
-    path.addLineTo(FloatPoint(x + bottomLeftRadius.width(), y + height));
-
-    path.addBezierCurveTo(FloatPoint(x + bottomLeftRadius.width() * (1 - QUARTER), y + height), FloatPoint(x, y + height - bottomLeftRadius.height() * (1 - QUARTER)), FloatPoint(x, y + height - bottomLeftRadius.height()));
-
-    path.addLineTo(FloatPoint(x, y + topLeftRadius.height()));
-
-    path.addBezierCurveTo(FloatPoint(x, y + topLeftRadius.height() * (1 - QUARTER)), FloatPoint(x + topLeftRadius.width() * (1 - QUARTER), y), FloatPoint(x + topLeftRadius.width(), y));
-
-    path.closeSubpath();
-
-    return path;
-}
-
-Path Path::createRectangle(const FloatRect& rectangle)
-{
-    Path path;
-    float x = rectangle.x();
-    float y = rectangle.y();
-    float width = rectangle.width();
-    float height = rectangle.height();
-    if (width <= 0.0f || height <= 0.0f)
-        return path;
-    
-    path.moveTo(FloatPoint(x, y));
-    path.addLineTo(FloatPoint(x + width, y));
-    path.addLineTo(FloatPoint(x + width, y + height));
-    path.addLineTo(FloatPoint(x, y + height));
-    path.closeSubpath();
-
-    return path;
-}
-
-Path Path::createEllipse(const FloatPoint& center, float rx, float ry)
-{
-    float cx = center.x();
-    float cy = center.y();
-    Path path;
-    if (rx <= 0.0f || ry <= 0.0f)
-        return path;
-
-    float x = cx;
-    float y = cy;
-
-    unsigned step = 0, num = 100;
-    bool running = true;
-    while (running)
-    {
-        if (step == num)
-        {
-            running = false;
-            break;
-        }
-
-        float angle = static_cast<float>(step) / static_cast<float>(num) * 2.0f * piFloat;
-        x = cx + cosf(angle) * rx;
-        y = cy + sinf(angle) * ry;
-
-        step++;
-        if (step == 1)
-            path.moveTo(FloatPoint(x, y));
-        else
-            path.addLineTo(FloatPoint(x, y));
+        addRect(rect);
+        return;
     }
 
-    path.closeSubpath();
-
-    return path;
-}
-
-Path Path::createCircle(const FloatPoint& center, float r)
-{
-    return createEllipse(center, r, r);
-}
-
-Path Path::createLine(const FloatPoint& start, const FloatPoint& end)
-{
-    Path path;
-
-    path.moveTo(start);
-    path.addLineTo(end);
-
-    return path;
+    moveTo(FloatPoint(rect.x() + topLeftRadius.width(), rect.y()));
+
+    addLineTo(FloatPoint(rect.x() + rect.width() - topRightRadius.width(), rect.y()));
+    addBezierCurveTo(FloatPoint(rect.x() + rect.width() - topRightRadius.width() * gCircleControlPoint, rect.y()),
+                     FloatPoint(rect.x() + rect.width(), rect.y() + topRightRadius.height() * gCircleControlPoint),
+                     FloatPoint(rect.x() + rect.width(), rect.y() + topRightRadius.height()));
+    addLineTo(FloatPoint(rect.x() + rect.width(), rect.y() + rect.height() - bottomRightRadius.height()));
+    addBezierCurveTo(FloatPoint(rect.x() + rect.width(), rect.y() + rect.height() - bottomRightRadius.height() * gCircleControlPoint),
+                     FloatPoint(rect.x() + rect.width() - bottomRightRadius.width() * gCircleControlPoint, rect.y() + rect.height()),
+                     FloatPoint(rect.x() + rect.width() - bottomRightRadius.width(), rect.y() + rect.height()));
+    addLineTo(FloatPoint(rect.x() + bottomLeftRadius.width(), rect.y() + rect.height()));
+    addBezierCurveTo(FloatPoint(rect.x() + bottomLeftRadius.width() * gCircleControlPoint, rect.y() + rect.height()),
+                     FloatPoint(rect.x(), rect.y() + rect.height() - bottomLeftRadius.height() * gCircleControlPoint),
+                     FloatPoint(rect.x(), rect.y() + rect.height() - bottomLeftRadius.height()));
+    addLineTo(FloatPoint(rect.x(), rect.y() + topLeftRadius.height()));
+    addBezierCurveTo(FloatPoint(rect.x(), rect.y() + topLeftRadius.height() * gCircleControlPoint),
+                     FloatPoint(rect.x() + topLeftRadius.width() * gCircleControlPoint, rect.y()),
+                     FloatPoint(rect.x() + topLeftRadius.width(), rect.y()));
+
+    closeSubpath();
 }
 
 }
diff --git a/WebCore/platform/graphics/Path.h b/WebCore/platform/graphics/Path.h
index 43ba889..86ba831 100644
--- a/WebCore/platform/graphics/Path.h
+++ b/WebCore/platform/graphics/Path.h
@@ -137,20 +137,13 @@ namespace WebCore {
         void addArc(const FloatPoint&, float radius, float startAngle, float endAngle, bool anticlockwise);
         void addRect(const FloatRect&);
         void addEllipse(const FloatRect&);
+        void addRoundedRect(const FloatRect&, const FloatSize& roundingRadii);
+        void addRoundedRect(const FloatRect&, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius);
 
         void translate(const FloatSize&);
 
-        String debugString() const;
-
         PlatformPathPtr platformPath() const { return m_path; }
 
-        static Path createRoundedRectangle(const FloatRect&, const FloatSize& roundingRadii);
-        static Path createRoundedRectangle(const FloatRect&, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius);
-        static Path createRectangle(const FloatRect&);
-        static Path createEllipse(const FloatPoint& center, float rx, float ry);
-        static Path createCircle(const FloatPoint& center, float r);
-        static Path createLine(const FloatPoint&, const FloatPoint&);
-
         void apply(void* info, PathApplierFunction) const;
         void transform(const AffineTransform&);
 
diff --git a/WebCore/platform/graphics/brew/ImageBrew.cpp b/WebCore/platform/graphics/brew/ImageBrew.cpp
index f5c855d..b574b0a 100644
--- a/WebCore/platform/graphics/brew/ImageBrew.cpp
+++ b/WebCore/platform/graphics/brew/ImageBrew.cpp
@@ -36,13 +36,13 @@
 #include "SharedBuffer.h"
 
 #include <wtf/text/CString.h>
-#include <wtf/text/WTFString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
 PassRefPtr<Image> Image::loadPlatformResource(const char *name)
 {
-    String resourcePath = homeDirectoryPath() + String::format("res/%s.png", name);
+    String resourcePath = makeString(homeDirectoryPath(), "res/", name, ".png");
 
     RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(resourcePath.utf8().data());
     if (!buffer)
diff --git a/WebCore/platform/graphics/cairo/CairoUtilities.cpp b/WebCore/platform/graphics/cairo/CairoUtilities.cpp
index 8c2049f..7af5577 100644
--- a/WebCore/platform/graphics/cairo/CairoUtilities.cpp
+++ b/WebCore/platform/graphics/cairo/CairoUtilities.cpp
@@ -26,8 +26,15 @@
 #include "config.h"
 #include "CairoUtilities.h"
 
+#include "AffineTransform.h"
+#include "CairoPath.h"
 #include "Color.h"
-#include <cairo.h>
+#include "FloatPoint.h"
+#include "FloatRect.h"
+#include "IntRect.h"
+#include "OwnPtrCairo.h"
+#include "Path.h"
+#include "PlatformRefPtrCairo.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -56,4 +63,96 @@ void setSourceRGBAFromColor(cairo_t* context, const Color& color)
     cairo_set_source_rgba(context, red, green, blue, alpha);
 }
 
+void appendPathToCairoContext(cairo_t* to, cairo_t* from)
+{
+    OwnPtr<cairo_path_t> cairoPath(cairo_copy_path(from));
+    cairo_append_path(to, cairoPath.get());
+}
+
+void setPathOnCairoContext(cairo_t* to, cairo_t* from)
+{
+    cairo_new_path(to);
+    appendPathToCairoContext(to, from);
+}
+
+void appendWebCorePathToCairoContext(cairo_t* context, const Path& path)
+{
+    appendPathToCairoContext(context, path.platformPath()->context());
+}
+
+cairo_operator_t toCairoOperator(CompositeOperator op)
+{
+    switch (op) {
+    case CompositeClear:
+        return CAIRO_OPERATOR_CLEAR;
+    case CompositeCopy:
+        return CAIRO_OPERATOR_SOURCE;
+    case CompositeSourceOver:
+        return CAIRO_OPERATOR_OVER;
+    case CompositeSourceIn:
+        return CAIRO_OPERATOR_IN;
+    case CompositeSourceOut:
+        return CAIRO_OPERATOR_OUT;
+    case CompositeSourceAtop:
+        return CAIRO_OPERATOR_ATOP;
+    case CompositeDestinationOver:
+        return CAIRO_OPERATOR_DEST_OVER;
+    case CompositeDestinationIn:
+        return CAIRO_OPERATOR_DEST_IN;
+    case CompositeDestinationOut:
+        return CAIRO_OPERATOR_DEST_OUT;
+    case CompositeDestinationAtop:
+        return CAIRO_OPERATOR_DEST_ATOP;
+    case CompositeXOR:
+        return CAIRO_OPERATOR_XOR;
+    case CompositePlusDarker:
+        return CAIRO_OPERATOR_SATURATE;
+    case CompositeHighlight:
+        // There is no Cairo equivalent for CompositeHighlight.
+        return CAIRO_OPERATOR_OVER;
+    case CompositePlusLighter:
+        return CAIRO_OPERATOR_ADD;
+    default:
+        return CAIRO_OPERATOR_SOURCE;
+    }
+}
+
+void drawPatternToCairoContext(cairo_t* cr, cairo_surface_t* image, const IntSize& imageSize, const FloatRect& tileRect,
+                               const AffineTransform& patternTransform, const FloatPoint& phase, cairo_operator_t op, const FloatRect& destRect)
+{
+    // Avoid NaN
+    if (!isfinite(phase.x()) || !isfinite(phase.y()))
+       return;
+
+    cairo_save(cr);
+
+    PlatformRefPtr<cairo_surface_t> clippedImageSurface = 0;
+    if (tileRect.size() != imageSize) {
+        IntRect imageRect = enclosingIntRect(tileRect);
+        clippedImageSurface = adoptPlatformRef(cairo_image_surface_create(CAIRO_FORMAT_ARGB32, imageRect.width(), imageRect.height()));
+        PlatformRefPtr<cairo_t> clippedImageContext(cairo_create(clippedImageSurface.get()));
+        cairo_set_source_surface(clippedImageContext.get(), image, -tileRect.x(), -tileRect.y());
+        cairo_paint(clippedImageContext.get());
+        image = clippedImageSurface.get();
+    }
+
+    cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
+    cairo_pattern_set_extend(pattern, CAIRO_EXTEND_REPEAT);
+
+    cairo_matrix_t patternMatrix = cairo_matrix_t(patternTransform);
+    cairo_matrix_t phaseMatrix = {1, 0, 0, 1, phase.x() + tileRect.x() * patternTransform.a(), phase.y() + tileRect.y() * patternTransform.d()};
+    cairo_matrix_t combined;
+    cairo_matrix_multiply(&combined, &patternMatrix, &phaseMatrix);
+    cairo_matrix_invert(&combined);
+    cairo_pattern_set_matrix(pattern, &combined);
+
+    cairo_set_operator(cr, op);
+    cairo_set_source(cr, pattern);
+    cairo_pattern_destroy(pattern);
+    cairo_rectangle(cr, destRect.x(), destRect.y(), destRect.width(), destRect.height());
+    cairo_fill(cr);
+
+    cairo_restore(cr);
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/cairo/CairoUtilities.h b/WebCore/platform/graphics/cairo/CairoUtilities.h
index 0675b90..d8fff8d 100644
--- a/WebCore/platform/graphics/cairo/CairoUtilities.h
+++ b/WebCore/platform/graphics/cairo/CairoUtilities.h
@@ -26,13 +26,25 @@
 #ifndef CairoUtilities_h
 #define CairoUtilities_h
 
-typedef struct _cairo cairo_t;
+#include <GraphicsTypes.h>
+#include <cairo.h>
 
 namespace WebCore {
+class AffineTransform;
 class Color;
+class FloatRect;
+class FloatPoint;
+class IntSize;
+class Path;
 
 void copyContextProperties(cairo_t* srcCr, cairo_t* dstCr);
 void setSourceRGBAFromColor(cairo_t*, const Color&);
+void appendPathToCairoContext(cairo_t* to, cairo_t* from);
+void setPathOnCairoContext(cairo_t* to, cairo_t* from);
+void appendWebCorePathToCairoContext(cairo_t* context, const Path& path);
+cairo_operator_t toCairoOperator(CompositeOperator op);
+void drawPatternToCairoContext(cairo_t* cr, cairo_surface_t* image, const IntSize& imageSize, const FloatRect& tileRect,
+                               const AffineTransform& patternTransform, const FloatPoint& phase, cairo_operator_t op, const FloatRect& destRect);
 
 } // namespace WebCore
 
diff --git a/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp b/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
index 4b94cb3..8299b6a 100644
--- a/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ContextShadowCairo.cpp
@@ -29,10 +29,15 @@
 #include "config.h"
 #include "ContextShadow.h"
 
+#include "AffineTransform.h"
 #include "CairoUtilities.h"
+#include "OwnPtrCairo.h"
+#include "Path.h"
 #include "Timer.h"
 #include <cairo.h>
 
+using WTF::max;
+
 namespace WebCore {
 
 static cairo_surface_t* scratchBuffer = 0;
@@ -105,10 +110,13 @@ void ContextShadow::endShadowLayer(cairo_t* cr)
     cairo_destroy(m_layerContext);
     m_layerContext = 0;
 
-    if (m_type == BlurShadow)
+    if (m_type == BlurShadow) {
+        cairo_surface_flush(m_layerImage);
         blurLayerImage(cairo_image_surface_get_data(m_layerImage),
                        IntSize(cairo_image_surface_get_width(m_layerImage), cairo_image_surface_get_height(m_layerImage)),
                        cairo_image_surface_get_stride(m_layerImage));
+        cairo_surface_mark_dirty(m_layerImage);
+    }
 
     cairo_save(cr);
     setSourceRGBAFromColor(cr, m_color);
@@ -119,4 +127,223 @@ void ContextShadow::endShadowLayer(cairo_t* cr)
     scheduleScratchBufferPurge();
 }
 
+void ContextShadow::drawRectShadowWithoutTiling(PlatformContext context, const IntRect& shadowRect, const IntSize& topLeftRadius, const IntSize& topRightRadius, const IntSize& bottomLeftRadius, const IntSize& bottomRightRadius, float alpha)
+{
+    beginShadowLayer(context, shadowRect);
+
+    if (!m_layerContext)
+        return;
+
+    Path path;
+    path.addRoundedRect(shadowRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+
+    appendWebCorePathToCairoContext(m_layerContext, path);
+    cairo_set_source_rgba(m_layerContext, 0, 0, 0, alpha);
+    cairo_fill(m_layerContext);
+
+    endShadowLayer(context);
+}
+
+static inline FloatPoint getPhase(const FloatRect& dest, const FloatRect& tile)
+{
+    FloatPoint phase = dest.location();
+    phase.move(-tile.x(), -tile.y());
+
+    return phase;
+}
+
+/*
+  This function uses tiling to improve the performance of the shadow
+  drawing of rounded rectangles. The code basically does the following
+  steps:
+
+     1. Calculate the size of the shadow template, a rectangle that
+     contains all the necessary tiles to draw the complete shadow.
+
+     2. If that size is smaller than the real rectangle render the new
+     template rectangle and its shadow in a new surface, in other case
+     render the shadow of the real rectangle in the destination
+     surface.
+
+     3. Calculate the sizes and positions of the tiles and their
+     destinations and use drawPattern to render the final shadow. The
+     code divides the rendering in 8 tiles:
+
+        1 | 2 | 3
+       -----------
+        4 |   | 5
+       -----------
+        6 | 7 | 8
+
+     The corners are directly copied from the template rectangle to the
+     real one and the side tiles are 1 pixel width, we use them as
+
+     tiles to cover the destination side. The corner tiles are bigger
+     than just the side of the rounded corner, we need to increase it
+     because the modifications caused by the corner over the blur
+     effect. We fill the central part with solid color to complete the
+     shadow.
+ */
+void ContextShadow::drawRectShadow(GraphicsContext* context, const IntRect& rect, const IntSize& topLeftRadius, const IntSize& topRightRadius, const IntSize& bottomLeftRadius, const IntSize& bottomRightRadius)
+{
+
+    // drawShadowedRect still does not work with rotations.
+    // https://bugs.webkit.org/show_bug.cgi?id=45042
+    float radiusTwice = m_blurDistance * 2;
+    cairo_t* cr = context->platformContext();
+    if ((!context->getCTM().isIdentityOrTranslationOrFlipped()) || (radiusTwice > rect.width())
+        || (radiusTwice > rect.height()) || (m_type != BlurShadow)) {
+        drawRectShadowWithoutTiling(cr, rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius, context->getAlpha());
+        return;
+    }
+
+    // Calculate size of the template shadow buffer.
+    IntSize shadowBufferSize = IntSize(rect.width() + radiusTwice, rect.height() + radiusTwice);
+
+    // Determine dimensions of shadow rect.
+    FloatRect shadowRect = FloatRect(rect.location(), shadowBufferSize);
+    shadowRect.move(- m_blurDistance, - m_blurDistance);
+
+    // Size of the tiling side.
+    int sideTileWidth = 1;
+
+    // Find the extra space needed from the curve of the corners.
+    int extraWidthFromCornerRadii = radiusTwice + max(topLeftRadius.width(), bottomLeftRadius.width()) +
+        radiusTwice + max(topRightRadius.width(), bottomRightRadius.width());
+    int extraHeightFromCornerRadii = radiusTwice + max(topLeftRadius.height(), topRightRadius.height()) +
+        radiusTwice + max(bottomLeftRadius.height(), bottomRightRadius.height());
+
+    // The length of a side of the buffer is the enough space for four blur radii,
+    // the radii of the corners, and then 1 pixel to draw the side tiles.
+    IntSize shadowTemplateSize = IntSize(sideTileWidth + extraWidthFromCornerRadii,
+                                         sideTileWidth + extraHeightFromCornerRadii);
+
+    // Reduce the size of what we have to draw with the clip area.
+    double x1, x2, y1, y2;
+    cairo_clip_extents(cr, &x1, &y1, &x2, &y2);
+    calculateLayerBoundingRect(shadowRect, IntRect(x1, y1, x2 - x1, y2 - y1));
+
+    if ((shadowTemplateSize.width() * shadowTemplateSize.height() > m_layerRect.width() * m_layerRect.height())) {
+        drawRectShadowWithoutTiling(cr, rect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius, context->getAlpha());
+        return;
+    }
+
+    shadowRect.move(m_offset.width(), m_offset.height());
+
+    m_layerImage = getScratchBuffer(shadowTemplateSize);
+
+    // Draw shadow into a new ImageBuffer.
+    m_layerContext = cairo_create(m_layerImage);
+
+    // Clear the surface first.
+    cairo_set_operator(m_layerContext, CAIRO_OPERATOR_CLEAR);
+    cairo_paint(m_layerContext);
+    cairo_set_operator(m_layerContext, CAIRO_OPERATOR_OVER);
+
+    // Draw the rectangle.
+    IntRect templateRect = IntRect(m_blurDistance, m_blurDistance, shadowTemplateSize.width() - radiusTwice, shadowTemplateSize.height() - radiusTwice);
+    Path path;
+    path.addRoundedRect(templateRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+    appendWebCorePathToCairoContext(m_layerContext, path);
+
+    cairo_set_source_rgba(m_layerContext, 0, 0, 0, context->getAlpha());
+    cairo_fill(m_layerContext);
+
+    // Blur the image.
+    cairo_surface_flush(m_layerImage);
+    blurLayerImage(cairo_image_surface_get_data(m_layerImage), shadowTemplateSize, cairo_image_surface_get_stride(m_layerImage));
+    cairo_surface_mark_dirty(m_layerImage);
+
+    // Mask the image with the shadow color.
+    cairo_set_operator(m_layerContext, CAIRO_OPERATOR_IN);
+    setSourceRGBAFromColor(m_layerContext, m_color);
+    cairo_paint(m_layerContext);
+
+    cairo_destroy(m_layerContext);
+    m_layerContext = 0;
+
+    // Fill the internal part of the shadow.
+    shadowRect.inflate(-radiusTwice);
+    if (!shadowRect.isEmpty()) {
+        cairo_save(cr);
+        path.clear();
+        path.addRoundedRect(shadowRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius);
+        appendWebCorePathToCairoContext(cr, path);
+        setSourceRGBAFromColor(cr, m_color);
+        cairo_fill(cr);
+        cairo_restore(cr);
+    }
+    shadowRect.inflate(radiusTwice);
+
+    // Draw top side.
+    FloatRect tileRect = FloatRect(radiusTwice + topLeftRadius.width(), 0, sideTileWidth, radiusTwice);
+    FloatRect destRect = tileRect;
+    destRect.move(shadowRect.x(), shadowRect.y());
+    destRect.setWidth(shadowRect.width() - topLeftRadius.width() - topRightRadius.width() - m_blurDistance * 4);
+    FloatPoint phase = getPhase(destRect, tileRect);
+    AffineTransform patternTransform;
+    patternTransform.makeIdentity();
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the bottom side.
+    tileRect = FloatRect(radiusTwice + bottomLeftRadius.width(), shadowTemplateSize.height() - radiusTwice, sideTileWidth, radiusTwice);
+    destRect = tileRect;
+    destRect.move(shadowRect.x(), shadowRect.y() + radiusTwice + rect.height() - shadowTemplateSize.height());
+    destRect.setWidth(shadowRect.width() - bottomLeftRadius.width() - bottomRightRadius.width() - m_blurDistance * 4);
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the right side.
+    tileRect = FloatRect(shadowTemplateSize.width() - radiusTwice, radiusTwice + topRightRadius.height(), radiusTwice, sideTileWidth);
+    destRect = tileRect;
+    destRect.move(shadowRect.x() + radiusTwice + rect.width() - shadowTemplateSize.width(), shadowRect.y());
+    destRect.setHeight(shadowRect.height() - topRightRadius.height() - bottomRightRadius.height() - m_blurDistance * 4);
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the left side.
+    tileRect = FloatRect(0, radiusTwice + topLeftRadius.height(), radiusTwice, sideTileWidth);
+    destRect = tileRect;
+    destRect.move(shadowRect.x(), shadowRect.y());
+    destRect.setHeight(shadowRect.height() - topLeftRadius.height() - bottomLeftRadius.height() - m_blurDistance * 4);
+    phase = FloatPoint(destRect.x() - tileRect.x(), destRect.y() - tileRect.y());
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the top left corner.
+    tileRect = FloatRect(0, 0, radiusTwice + topLeftRadius.width(), radiusTwice + topLeftRadius.height());
+    destRect = tileRect;
+    destRect.move(shadowRect.x(), shadowRect.y());
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the top right corner.
+    tileRect = FloatRect(shadowTemplateSize.width() - radiusTwice - topRightRadius.width(), 0, radiusTwice + topRightRadius.width(),
+                         radiusTwice + topRightRadius.height());
+    destRect = tileRect;
+    destRect.move(shadowRect.x() + rect.width() - shadowTemplateSize.width() + radiusTwice, shadowRect.y());
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the bottom right corner.
+    tileRect = FloatRect(shadowTemplateSize.width() - radiusTwice - bottomRightRadius.width(),
+                         shadowTemplateSize.height() - radiusTwice - bottomRightRadius.height(),
+                         radiusTwice + bottomRightRadius.width(), radiusTwice + bottomRightRadius.height());
+    destRect = tileRect;
+    destRect.move(shadowRect.x() + rect.width() - shadowTemplateSize.width() + radiusTwice,
+                  shadowRect.y() + rect.height() - shadowTemplateSize.height() + radiusTwice);
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Draw the bottom left corner.
+    tileRect = FloatRect(0, shadowTemplateSize.height() - radiusTwice - bottomLeftRadius.height(),
+                         radiusTwice + bottomLeftRadius.width(), radiusTwice + bottomLeftRadius.height());
+    destRect = tileRect;
+    destRect.move(shadowRect.x(), shadowRect.y() + rect.height() - shadowTemplateSize.height() + radiusTwice);
+    phase = getPhase(destRect, tileRect);
+    drawPatternToCairoContext(cr, m_layerImage, shadowTemplateSize, tileRect, patternTransform, phase, CAIRO_OPERATOR_OVER, destRect);
+
+    // Schedule a purge of the scratch buffer.
+    scheduleScratchBufferPurge();
+}
+
 }
diff --git a/WebCore/platform/graphics/cairo/FloatRectCairo.cpp b/WebCore/platform/graphics/cairo/FloatRectCairo.cpp
new file mode 100644
index 0000000..9f86f74
--- /dev/null
+++ b/WebCore/platform/graphics/cairo/FloatRectCairo.cpp
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2010 Igalia S.L.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "FloatRect.h"
+
+#include <cairo.h>
+
+namespace WebCore {
+
+FloatRect::FloatRect(const cairo_rectangle_t& r)
+    : m_location(r.x, r.y)
+    , m_size(r.width, r.height)
+{
+}
+
+FloatRect::operator cairo_rectangle_t() const
+{
+    cairo_rectangle_t r = { x(), y(), width(), height() };
+    return r;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/cairo/FontCacheFreeType.cpp b/WebCore/platform/graphics/cairo/FontCacheFreeType.cpp
index febad12..5dca010 100644
--- a/WebCore/platform/graphics/cairo/FontCacheFreeType.cpp
+++ b/WebCore/platform/graphics/cairo/FontCacheFreeType.cpp
@@ -87,12 +87,12 @@ void FontCache::getTraitsInFamily(const AtomicString& familyName, Vector<unsigne
 {
 }
 
-static CString getFamilyNameStringFromFontDescriptionAndFamily(const FontDescription& fontDescription, const AtomicString& family)
+static String getFamilyNameStringFromFontDescriptionAndFamily(const FontDescription& fontDescription, const AtomicString& family)
 {
     // If we're creating a fallback font (e.g. "-webkit-monospace"), convert the name into
     // the fallback name (like "monospace") that fontconfig understands.
     if (family.length() && !family.startsWith("-webkit-"))
-        return family.string().utf8();
+        return family.string();
 
     switch (fontDescription.genericFamily()) {
     case FontDescription::StandardFamily:
@@ -112,23 +112,14 @@ static CString getFamilyNameStringFromFontDescriptionAndFamily(const FontDescrip
     }
 }
 
-
-static bool isFallbackFontAllowed(const CString& familyName)
-{
-    return !strcasecmp(familyName.data(), "sans")
-           || !strcasecmp(familyName.data(), "sans-serif")
-           || !strcasecmp(familyName.data(), "serif")
-           || !strcasecmp(familyName.data(), "monospace");
-}
-
 FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontDescription, const AtomicString& family)
 {
     // The CSS font matching algorithm (http://www.w3.org/TR/css3-fonts/#font-matching-algorithm)
     // says that we must find an exact match for font family, slant (italic or oblique can be used)
     // and font weight (we only match bold/non-bold here).
     PlatformRefPtr<FcPattern> pattern = adoptPlatformRef(FcPatternCreate());
-    CString familyNameString = getFamilyNameStringFromFontDescriptionAndFamily(fontDescription, family);
-    if (!FcPatternAddString(pattern.get(), FC_FAMILY, reinterpret_cast<const FcChar8*>(familyNameString.data())))
+    String familyNameString(getFamilyNameStringFromFontDescriptionAndFamily(fontDescription, family));
+    if (!FcPatternAddString(pattern.get(), FC_FAMILY, reinterpret_cast<const FcChar8*>(familyNameString.utf8().data())))
         return 0;
 
     bool italic = fontDescription.italic();
@@ -140,53 +131,39 @@ FontPlatformData* FontCache::createFontPlatformData(const FontDescription& fontD
     if (!FcPatternAddDouble(pattern.get(), FC_PIXEL_SIZE, fontDescription.computedPixelSize()))
         return 0;
 
-    // The following comment and strategy are originally from Skia (src/ports/SkFontHost_fontconfig.cpp):
-    // Font matching:
-    // CSS often specifies a fallback list of families:
-    //    font-family: a, b, c, serif;
-    // However, fontconfig will always do its best to find *a* font when asked
-    // for something so we need a way to tell if the match which it has found is
-    // "good enough" for us. Otherwise, we can return null which gets piped up
-    // and lets WebKit know to try the next CSS family name. However, fontconfig
-    // configs allow substitutions (mapping "Arial -> Helvetica" etc) and we
-    // wish to support that.
-    //
-    // Thus, if a specific family is requested we set @family_requested. Then we
-    // record two strings: the family name after config processing and the
-    // family name after resolving. If the two are equal, it's a good match.
-    //
-    // So consider the case where a user has mapped Arial to Helvetica in their
-    // config.
-    //    requested family: "Arial"
-    //    post_config_family: "Helvetica"
-    //    post_match_family: "Helvetica"
-    //      -> good match
-    //
-    // and for a missing font:
-    //    requested family: "Monaco"
-    //    post_config_family: "Monaco"
-    //    post_match_family: "Times New Roman"
-    //      -> BAD match
-    //
+    // The strategy is originally from Skia (src/ports/SkFontHost_fontconfig.cpp):
+
+    // Allow Fontconfig to do pre-match substitution. Unless we are accessing a "fallback"
+    // family like "sans," this is the only time we allow Fontconfig to substitute one
+    // family name for another (i.e. if the fonts are aliased to each other).
     FcConfigSubstitute(0, pattern.get(), FcMatchPattern);
     FcDefaultSubstitute(pattern.get());
 
-    FcChar8* familyNameAfterConfiguration;
-    FcPatternGetString(pattern.get(), FC_FAMILY, 0, &familyNameAfterConfiguration);
+    FcChar8* fontConfigFamilyNameAfterConfiguration;
+    FcPatternGetString(pattern.get(), FC_FAMILY, 0, &fontConfigFamilyNameAfterConfiguration);
+    String familyNameAfterConfiguration = String::fromUTF8(reinterpret_cast<char*>(fontConfigFamilyNameAfterConfiguration));
 
     FcResult fontConfigResult;
     PlatformRefPtr<FcPattern> resultPattern = adoptPlatformRef(FcFontMatch(0, pattern.get(), &fontConfigResult));
     if (!resultPattern) // No match.
         return 0;
 
-    // Properly handle the situation where Fontconfig gives us a font that has a different family than we requested.
-    FcChar8* familyNameAfterMatching;
-    FcPatternGetString(resultPattern.get(), FC_FAMILY, 0, &familyNameAfterMatching);
-    if (strcasecmp(reinterpret_cast<char*>(familyNameAfterConfiguration),
-            reinterpret_cast<char*>(familyNameAfterMatching)) && !isFallbackFontAllowed(familyNameString))
-        return 0;
-
-    return new FontPlatformData(resultPattern.get(), fontDescription);
+    FcChar8* fontConfigFamilyNameAfterMatching;
+    FcPatternGetString(resultPattern.get(), FC_FAMILY, 0, &fontConfigFamilyNameAfterMatching);
+    String familyNameAfterMatching = String::fromUTF8(reinterpret_cast<char*>(fontConfigFamilyNameAfterMatching));
+    if (equalIgnoringCase(familyNameAfterConfiguration, familyNameAfterMatching))
+        return new FontPlatformData(resultPattern.get(), fontDescription);
+
+    // If Fontconfig gave use a different font family than the one we requested, we should ignore it
+    // and allow WebCore to give us the next font on the CSS fallback list. The only exception is if
+    // this family name is a commonly used generic family.
+    if (equalIgnoringCase(familyNameString, "sans") || equalIgnoringCase(familyNameString, "sans-serif")
+        || equalIgnoringCase(familyNameString, "serif") || equalIgnoringCase(familyNameString, "monospace")
+        || equalIgnoringCase(familyNameString, "fantasy") || equalIgnoringCase(familyNameString, "cursive"))
+        return new FontPlatformData(resultPattern.get(), fontDescription);
+
+    // Fontconfig did not return a good match.
+    return 0;
 }
 
 }
diff --git a/WebCore/platform/graphics/cairo/FontCairo.cpp b/WebCore/platform/graphics/cairo/FontCairo.cpp
index cd5d362..3d55c70 100644
--- a/WebCore/platform/graphics/cairo/FontCairo.cpp
+++ b/WebCore/platform/graphics/cairo/FontCairo.cpp
@@ -31,6 +31,8 @@
 #include "Font.h"
 
 #include "AffineTransform.h"
+#include "CairoUtilities.h"
+#include "ContextShadow.h"
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContext.h"
@@ -38,18 +40,63 @@
 #include "Pattern.h"
 #include "SimpleFontData.h"
 
-#define SYNTHETIC_OBLIQUE_ANGLE 14
-
 namespace WebCore {
 
-void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer,
-                      int from, int numGlyphs, const FloatPoint& point) const
+static void prepareContextForGlyphDrawing(cairo_t* context, const SimpleFontData* font, const FloatPoint& point)
 {
-    cairo_t* cr = context->platformContext();
-    cairo_save(cr);
+    static const float syntheticObliqueSkew = -tanf(14 * acosf(0) / 90);
+    cairo_set_scaled_font(context, font->platformData().scaledFont());
+    if (font->platformData().syntheticOblique()) {
+        cairo_matrix_t mat = {1, 0, syntheticObliqueSkew, 1, point.x(), point.y()};
+        cairo_transform(context, &mat);
+    } else
+        cairo_translate(context, point.x(), point.y());
+}
 
-    cairo_set_scaled_font(cr, font->platformData().scaledFont());
+static void drawGlyphsToContext(cairo_t* context, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
+{
+    cairo_show_glyphs(context, glyphs, numGlyphs);
+    if (font->syntheticBoldOffset()) {
+        // We could use cairo_save/cairo_restore here, but two translations are likely faster.
+        cairo_translate(context, font->syntheticBoldOffset(), 0);
+        cairo_show_glyphs(context, glyphs, numGlyphs);
+        cairo_translate(context, -font->syntheticBoldOffset(), 0);
+    }
+}
+
+static void drawGlyphsShadow(GraphicsContext* graphicsContext, cairo_t* context, const FloatPoint& point, const SimpleFontData* font, GlyphBufferGlyph* glyphs, int numGlyphs)
+{
+    ContextShadow* shadow = graphicsContext->contextShadow();
+    ASSERT(shadow);
+
+    if (!(graphicsContext->textDrawingMode() & cTextFill) || shadow->m_type == ContextShadow::NoShadow)
+        return;
+
+    if (shadow->m_type == ContextShadow::SolidShadow) {
+        // Optimize non-blurry shadows, by just drawing text without the ContextShadow.
+        cairo_save(context);
+        cairo_translate(context, shadow->m_offset.width(), shadow->m_offset.height());
+        setSourceRGBAFromColor(context, shadow->m_color);
+        prepareContextForGlyphDrawing(context, font, point);
+        cairo_show_glyphs(context, glyphs, numGlyphs);
+        cairo_restore(context);
+        return;
+    }
+
+    cairo_text_extents_t extents;
+    cairo_scaled_font_glyph_extents(font->platformData().scaledFont(), glyphs, numGlyphs, &extents);
+    FloatRect fontExtentsRect(point.x(), point.y() - extents.height, extents.width, extents.height);
+    cairo_t* shadowContext = shadow->beginShadowLayer(context, fontExtentsRect);
+    if (shadowContext) {
+        prepareContextForGlyphDrawing(shadowContext, font, point);
+        drawGlyphsToContext(shadowContext, font, glyphs, numGlyphs);
+        shadow->endShadowLayer(context);
+    }
+}
 
+void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, const GlyphBuffer& glyphBuffer,
+                      int from, int numGlyphs, const FloatPoint& point) const
+{
     GlyphBufferGlyph* glyphs = (GlyphBufferGlyph*)glyphBuffer.glyphs(from);
 
     float offset = 0.0f;
@@ -59,75 +106,11 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
         offset += glyphBuffer.advanceAt(from + i);
     }
 
-    Color fillColor = context->fillColor();
-
-    // Synthetic Oblique
-    if(font->platformData().syntheticOblique()) {
-        cairo_matrix_t mat = {1, 0, -tanf(SYNTHETIC_OBLIQUE_ANGLE * acosf(0) / 90), 1, point.x(), point.y()};
-        cairo_transform(cr, &mat);
-    } else {
-        cairo_translate(cr, point.x(), point.y());
-    }
-
-    // Text shadow, inspired by FontMac
-    FloatSize shadowOffset;
-    float shadowBlur = 0;
-    Color shadowColor;
-    bool hasShadow = context->textDrawingMode() & cTextFill
-                     && context->getShadow(shadowOffset, shadowBlur, shadowColor);
-
-    // TODO: Blur support
-    if (hasShadow) {
-        // Disable graphics context shadows (not yet implemented) and paint them manually
-        context->clearShadow();
-        Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        cairo_save(cr);
-
-        float red, green, blue, alpha;
-        shadowFillColor.getRGBA(red, green, blue, alpha);
-        cairo_set_source_rgba(cr, red, green, blue, alpha);
-
-#if ENABLE(FILTERS)
-        cairo_text_extents_t extents;
-        cairo_scaled_font_glyph_extents(font->platformData().scaledFont(), glyphs, numGlyphs, &extents);
-
-        FloatRect rect(FloatPoint(), FloatSize(extents.width, extents.height));
-        IntSize shadowBufferSize;
-        FloatRect shadowRect;
-        float radius = 0;
-        context->calculateShadowBufferDimensions(shadowBufferSize, shadowRect, radius, rect, shadowOffset, shadowBlur);
-
-        // Draw shadow into a new ImageBuffer
-        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
-        GraphicsContext* shadowContext = shadowBuffer->context();
-        cairo_t* shadowCr = shadowContext->platformContext();
-
-        cairo_translate(shadowCr, radius, extents.height + radius);
-
-        cairo_set_scaled_font(shadowCr, font->platformData().scaledFont());
-        cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
-        if (font->syntheticBoldOffset()) {
-            cairo_save(shadowCr);
-            cairo_translate(shadowCr, font->syntheticBoldOffset(), 0);
-            cairo_show_glyphs(shadowCr, glyphs, numGlyphs);
-            cairo_restore(shadowCr);
-        }
-        cairo_translate(cr, 0.0, -extents.height);
-        context->applyPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, radius);
-#else
-        cairo_translate(cr, shadowOffset.width(), shadowOffset.height());
-        cairo_show_glyphs(cr, glyphs, numGlyphs);
-        if (font->syntheticBoldOffset()) {
-            cairo_save(cr);
-            cairo_translate(cr, font->syntheticBoldOffset(), 0);
-            cairo_show_glyphs(cr, glyphs, numGlyphs);
-            cairo_restore(cr);
-        }
-#endif
-
-        cairo_restore(cr);
-    }
+    cairo_t* cr = context->platformContext();
+    drawGlyphsShadow(context, cr, point, font, glyphs, numGlyphs);
 
+    cairo_save(cr);
+    prepareContextForGlyphDrawing(cr, font, point);
     if (context->textDrawingMode() & cTextFill) {
         if (context->fillGradient()) {
             cairo_set_source(cr, context->fillGradient()->platformGradient());
@@ -148,16 +131,10 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
             cairo_pattern_destroy(pattern);
         } else {
             float red, green, blue, alpha;
-            fillColor.getRGBA(red, green, blue, alpha);
+            context->fillColor().getRGBA(red, green, blue, alpha);
             cairo_set_source_rgba(cr, red, green, blue, alpha * context->getAlpha());
         }
-        cairo_show_glyphs(cr, glyphs, numGlyphs);
-        if (font->syntheticBoldOffset()) {
-            cairo_save(cr);
-            cairo_translate(cr, font->syntheticBoldOffset(), 0);
-            cairo_show_glyphs(cr, glyphs, numGlyphs);
-            cairo_restore(cr);
-        }
+        drawGlyphsToContext(cr, font, glyphs, numGlyphs);
     }
 
     // Prevent running into a long computation within cairo. If the stroke width is
@@ -183,20 +160,15 @@ void Font::drawGlyphs(GraphicsContext* context, const SimpleFontData* font, cons
             }
             cairo_pattern_destroy(pattern);
         } else {
-            Color strokeColor = context->strokeColor();
             float red, green, blue, alpha;
-            strokeColor.getRGBA(red, green, blue, alpha);
+            context->strokeColor().getRGBA(red, green, blue, alpha);
             cairo_set_source_rgba(cr, red, green, blue, alpha * context->getAlpha());
-        } 
+        }
         cairo_glyph_path(cr, glyphs, numGlyphs);
         cairo_set_line_width(cr, context->strokeThickness());
         cairo_stroke(cr);
     }
 
-    // Re-enable the platform shadow we disabled earlier
-    if (hasShadow)
-        context->setShadow(shadowOffset, shadowBlur, shadowColor, DeviceColorSpace);
-
     cairo_restore(cr);
 }
 
diff --git a/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp b/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp
index 0617e6c..ba307fa 100644
--- a/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp
+++ b/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.cpp
@@ -75,40 +75,65 @@ void setCairoFontOptionsFromFontConfigPattern(cairo_font_options_t* options, FcP
     FcBool booleanResult;
     int integerResult;
 
-    // We will determine if subpixel anti-aliasing is enabled via the FC_RGBA setting.
-    if (FcPatternGetBool(pattern, FC_ANTIALIAS, 0, &booleanResult) == FcResultMatch && booleanResult)
-        cairo_font_options_set_antialias(options, CAIRO_ANTIALIAS_GRAY);
-
     if (FcPatternGetInteger(pattern, FC_RGBA, 0, &integerResult) == FcResultMatch) {
+        cairo_font_options_set_subpixel_order(options, convertFontConfigSubpixelOrder(integerResult));
+
+        // Based on the logic in cairo-ft-font.c in the cairo source, a font with
+        // a subpixel order implies that is uses subpixel antialiasing.
         if (integerResult != FC_RGBA_NONE)
             cairo_font_options_set_antialias(options, CAIRO_ANTIALIAS_SUBPIXEL);
-        cairo_font_options_set_subpixel_order(options, convertFontConfigSubpixelOrder(integerResult));
+    }
+
+    if (FcPatternGetBool(pattern, FC_ANTIALIAS, 0, &booleanResult) == FcResultMatch) {
+        // Only override the anti-aliasing setting if was previously turned off. Otherwise
+        // we'll override the preference which decides between gray anti-aliasing and
+        // subpixel anti-aliasing.
+        if (!booleanResult)
+            cairo_font_options_set_antialias(options, CAIRO_ANTIALIAS_NONE);
+        else if (cairo_font_options_get_antialias(options) == CAIRO_ANTIALIAS_NONE)
+            cairo_font_options_set_antialias(options, CAIRO_ANTIALIAS_GRAY);
     }
 
     if (FcPatternGetInteger(pattern, FC_HINT_STYLE, 0, &integerResult) == FcResultMatch)
         cairo_font_options_set_hint_style(options, convertFontConfigHintStyle(integerResult));
-
     if (FcPatternGetBool(pattern, FC_HINTING, 0, &booleanResult) == FcResultMatch && !booleanResult)
         cairo_font_options_set_hint_style(options, CAIRO_HINT_STYLE_NONE);
 }
 
+static const cairo_font_options_t* getDefaultFontOptions()
+{
+    static const cairo_font_options_t* options = cairo_font_options_create();
+#if PLATFORM(GTK) || ENABLE(GLIB_SUPPORT)
+    if (GdkScreen* screen = gdk_screen_get_default()) {
+        const cairo_font_options_t* screenOptions = gdk_screen_get_font_options(screen);
+        if (screenOptions)
+            options = screenOptions;
+    }
+#endif
+    return options;
+}
+
 FontPlatformData::FontPlatformData(FcPattern* pattern, const FontDescription& fontDescription)
     : m_pattern(pattern)
     , m_fallbacks(0)
     , m_size(fontDescription.computedPixelSize())
     , m_syntheticBold(false)
     , m_syntheticOblique(false)
+    , m_fixedWidth(false)
 {
-    cairo_font_options_t* options = cairo_font_options_create();
-    setCairoFontOptionsFromFontConfigPattern(options, pattern);
+    PlatformRefPtr<cairo_font_face_t> fontFace = adoptPlatformRef(cairo_ft_font_face_create_for_pattern(m_pattern.get()));
+    initializeWithFontFace(fontFace.get());
 
-    cairo_matrix_t fontMatrix;
-    cairo_matrix_init_scale(&fontMatrix, m_size, m_size);
-    cairo_matrix_t ctm;
-    cairo_matrix_init_identity(&ctm);
+    int spacing;
+    if (FcPatternGetInteger(pattern, FC_SPACING, 0, &spacing) == FcResultMatch && spacing == FC_MONO)
+        m_fixedWidth = true;
 
-    PlatformRefPtr<cairo_font_face_t> fontFace = adoptPlatformRef(cairo_ft_font_face_create_for_pattern(m_pattern.get()));
-    m_scaledFont = adoptPlatformRef(cairo_scaled_font_create(fontFace.get(), &fontMatrix, &ctm, options));
+    if (fontDescription.weight() >= FontWeightBold) {
+        // The FC_EMBOLDEN property instructs us to fake the boldness of the font.
+        FcBool fontConfigEmbolden;
+        if (FcPatternGetBool(pattern, FC_EMBOLDEN, 0, &fontConfigEmbolden) == FcResultMatch)
+            m_syntheticBold = fontConfigEmbolden;
+    }
 }
 
 FontPlatformData::FontPlatformData(float size, bool bold, bool italic)
@@ -116,7 +141,9 @@ FontPlatformData::FontPlatformData(float size, bool bold, bool italic)
     , m_size(size)
     , m_syntheticBold(bold)
     , m_syntheticOblique(italic)
+    , m_fixedWidth(false)
 {
+    // We cannot create a scaled font here.
 }
 
 FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool italic)
@@ -125,24 +152,13 @@ FontPlatformData::FontPlatformData(cairo_font_face_t* fontFace, float size, bool
     , m_syntheticBold(bold)
     , m_syntheticOblique(italic)
 {
-    cairo_matrix_t fontMatrix;
-    cairo_matrix_init_scale(&fontMatrix, size, size);
-    cairo_matrix_t ctm;
-    cairo_matrix_init_identity(&ctm);
-    static const cairo_font_options_t* defaultOptions = cairo_font_options_create();
-    const cairo_font_options_t* options = NULL;
-
-#if !PLATFORM(EFL) || ENABLE(GLIB_SUPPORT)
-    if (GdkScreen* screen = gdk_screen_get_default())
-        options = gdk_screen_get_font_options(screen);
-#endif
-
-    // gdk_screen_get_font_options() returns NULL if no default options are
-    // set, so we always have to check.
-    if (!options)
-        options = defaultOptions;
+    initializeWithFontFace(fontFace);
 
-    m_scaledFont = adoptPlatformRef(cairo_scaled_font_create(fontFace, &fontMatrix, &ctm, options));
+    FT_Face fontConfigFace = cairo_ft_scaled_font_lock_face(m_scaledFont.get());
+    if (fontConfigFace) {
+        m_fixedWidth = fontConfigFace->face_flags & FT_FACE_FLAG_FIXED_WIDTH;
+        cairo_ft_scaled_font_unlock_face(m_scaledFont.get());
+    }
 }
 
 FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
@@ -154,6 +170,7 @@ FontPlatformData& FontPlatformData::operator=(const FontPlatformData& other)
     m_size = other.m_size;
     m_syntheticBold = other.m_syntheticBold;
     m_syntheticOblique = other.m_syntheticOblique;
+    m_fixedWidth = other.m_fixedWidth;
     m_scaledFont = other.m_scaledFont;
     m_pattern = other.m_pattern;
 
@@ -172,6 +189,16 @@ FontPlatformData::FontPlatformData(const FontPlatformData& other)
     *this = other;
 }
 
+FontPlatformData::FontPlatformData(const FontPlatformData& other, float size)
+{
+    *this = other;
+
+    // We need to reinitialize the instance, because the difference in size 
+    // necessitates a new scaled font instance.
+    m_size = size;
+    initializeWithFontFace(cairo_scaled_font_get_font_face(m_scaledFont.get()));
+}
+
 FontPlatformData::~FontPlatformData()
 {
     if (m_fallbacks) {
@@ -182,14 +209,7 @@ FontPlatformData::~FontPlatformData()
 
 bool FontPlatformData::isFixedPitch()
 {
-    // TODO: Support isFixedPitch() for custom fonts.
-    if (!m_pattern)
-        return false;
-
-    int spacing;
-    if (FcPatternGetInteger(m_pattern.get(), FC_SPACING, 0, &spacing) == FcResultMatch)
-        return spacing == FC_MONO;
-    return false;
+    return m_fixedWidth;
 }
 
 bool FontPlatformData::operator==(const FontPlatformData& other) const
@@ -208,4 +228,37 @@ String FontPlatformData::description() const
 }
 #endif
 
+void FontPlatformData::initializeWithFontFace(cairo_font_face_t* fontFace)
+{
+    cairo_font_options_t* options = cairo_font_options_copy(getDefaultFontOptions());
+
+    cairo_matrix_t ctm;
+    cairo_matrix_init_identity(&ctm);
+
+    cairo_matrix_t fontMatrix;
+    if (!m_pattern)
+        cairo_matrix_init_scale(&fontMatrix, m_size, m_size);
+    else {
+        setCairoFontOptionsFromFontConfigPattern(options, m_pattern.get());
+
+        // FontConfig may return a list of transformation matrices with the pattern, for instance,
+        // for fonts that are oblique. We use that to initialize the cairo font matrix.
+        FcMatrix fontConfigMatrix, *tempFontConfigMatrix;
+        FcMatrixInit(&fontConfigMatrix);
+
+        // These matrices may be stacked in the pattern, so it's our job to get them all and multiply them.
+        for (int i = 0; FcPatternGetMatrix(m_pattern.get(), FC_MATRIX, i, &tempFontConfigMatrix) == FcResultMatch; i++)
+            FcMatrixMultiply(&fontConfigMatrix, &fontConfigMatrix, tempFontConfigMatrix);
+        cairo_matrix_init(&fontMatrix, fontConfigMatrix.xx, -fontConfigMatrix.yx,
+                          -fontConfigMatrix.xy, fontConfigMatrix.yy, 0, 0);
+
+        // The matrix from FontConfig does not include the scale.
+        cairo_matrix_scale(&fontMatrix, m_size, m_size);
+    }
+
+    m_scaledFont = adoptPlatformRef(cairo_scaled_font_create(fontFace, &fontMatrix, &ctm, options));
+    cairo_font_options_destroy(options);
+}
+
+
 }
diff --git a/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.h b/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.h
index f3488ef..7d3ff99 100644
--- a/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.h
+++ b/WebCore/platform/graphics/cairo/FontPlatformDataFreeType.h
@@ -57,6 +57,7 @@ public:
     FontPlatformData(cairo_font_face_t* fontFace, float size, bool bold, bool italic);
     FontPlatformData(float size, bool bold, bool italic);
     FontPlatformData(const FontPlatformData&);
+    FontPlatformData(const FontPlatformData&, float size);
 
     ~FontPlatformData();
 
@@ -89,7 +90,11 @@ public:
     float m_size;
     bool m_syntheticBold;
     bool m_syntheticOblique;
+    bool m_fixedWidth;
     PlatformRefPtr<cairo_scaled_font_t> m_scaledFont;
+
+private:
+    void initializeWithFontFace(cairo_font_face_t*);
 };
 
 }
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
index 05096a9..0847da1 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
+++ b/WebCore/platform/graphics/cairo/GraphicsContextCairo.cpp
@@ -36,20 +36,18 @@
 #include "AffineTransform.h"
 #include "CairoPath.h"
 #include "CairoUtilities.h"
-#include "FEGaussianBlur.h"
+#include "ContextShadow.h"
 #include "FloatRect.h"
 #include "Font.h"
+#include "GraphicsContextPlatformPrivateCairo.h"
+#include "GraphicsContextPrivate.h"
 #include "OwnPtrCairo.h"
-#include "ImageBuffer.h"
-#include "ImageBufferFilter.h"
 #include "IntRect.h"
 #include "NotImplemented.h"
 #include "Path.h"
 #include "Pattern.h"
 #include "PlatformRefPtrCairo.h"
 #include "SimpleFontData.h"
-#include "SourceGraphic.h"
-
 #include <cairo.h>
 #include <math.h>
 #include <stdio.h>
@@ -61,8 +59,6 @@
 #elif PLATFORM(WIN)
 #include <cairo-win32.h>
 #endif
-#include "GraphicsContextPlatformPrivateCairo.h"
-#include "GraphicsContextPrivate.h"
 
 using namespace std;
 
@@ -132,26 +128,6 @@ static inline void fillRectSourceOver(cairo_t* cr, const FloatRect& rect, const
     cairo_fill(cr);
 }
 
-static void appendPathToCairoContext(cairo_t* to, cairo_t* from)
-{
-    OwnPtr<cairo_path_t> cairoPath(cairo_copy_path(from));
-    cairo_append_path(to, cairoPath.get());
-}
-
-// We apply the pending path built via addPath to the Cairo context
-// lazily. This prevents interaction between the path and other routines
-// such as fillRect.
-static void setPathOnCairoContext(cairo_t* to, cairo_t* from)
-{
-    cairo_new_path(to);
-    appendPathToCairoContext(to, from);
-}
-
-static void appendWebCorePathToCairoContext(cairo_t* context, const Path& path)
-{
-    appendPathToCairoContext(context, path.platformPath()->context());
-}
-
 static void addConvexPolygonToContext(cairo_t* context, size_t numPoints, const FloatPoint* points)
 {
     cairo_move_to(context, points[0].x(), points[0].y());
@@ -160,83 +136,59 @@ static void addConvexPolygonToContext(cairo_t* context, size_t numPoints, const
     cairo_close_path(context);
 }
 
-void GraphicsContext::calculateShadowBufferDimensions(IntSize& shadowBufferSize, FloatRect& shadowRect, float& radius, const FloatRect& sourceRect, const FloatSize& shadowOffset, float shadowBlur)
-{
-#if ENABLE(FILTERS)
-    // limit radius to 128
-    radius = min(128.f, max(shadowBlur, 0.f));
-
-    shadowBufferSize = IntSize(sourceRect.width() + radius * 2, sourceRect.height() + radius * 2);
+enum PathDrawingStyle { 
+    Fill = 1,
+    Stroke = 2,
+    FillAndStroke = Fill + Stroke
+};
 
-    // determine dimensions of shadow rect
-    shadowRect = FloatRect(sourceRect.location(), shadowBufferSize);
-    shadowRect.move(shadowOffset.width() - radius, shadowOffset.height() - radius);
-#endif
-}
-
-static inline void drawPathShadow(GraphicsContext* context, GraphicsContextPrivate* gcp, bool fillShadow, bool strokeShadow)
+static inline void drawPathShadow(GraphicsContext* context, GraphicsContextPrivate* contextPrivate, PathDrawingStyle drawingStyle)
 {
-#if ENABLE(FILTERS)
-    FloatSize shadowOffset;
-    float shadowBlur;
-    Color shadowColor;
-    if (!context->getShadow(shadowOffset, shadowBlur, shadowColor))
+    ContextShadow* shadow = context->contextShadow();
+    ASSERT(shadow);
+    if (shadow->m_type == ContextShadow::NoShadow)
         return;
-    
-    // Calculate filter values to create appropriate shadow.
-    cairo_t* cr = context->platformContext();
-    double x0, x1, y0, y1;
-    if (strokeShadow)
-        cairo_stroke_extents(cr, &x0, &y0, &x1, &y1);
-    else
-        cairo_fill_extents(cr, &x0, &y0, &x1, &y1);
-    FloatRect rect(x0, y0, x1 - x0, y1 - y0);
-
-    IntSize shadowBufferSize;
-    FloatRect shadowRect;
-    float radius = 0;
-    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, radius, rect, shadowOffset, shadowBlur);
-
-    cairo_clip_extents(cr, &x0, &y0, &x1, &y1);
-    FloatRect clipRect(x0, y0, x1 - x0, y1 - y0);
-
-    FloatPoint rectLocation = shadowRect.location();
-
-    // Reduce the shadow rect using the clip area.
-    if (!clipRect.contains(shadowRect)) {
-        shadowRect.intersect(clipRect);
-        if (shadowRect.isEmpty())
-            return;
-        shadowRect.inflate(radius);
-        shadowBufferSize = IntSize(shadowRect.width(), shadowRect.height());
-    }
 
-    shadowOffset = rectLocation - shadowRect.location();
+    // Calculate the extents of the rendered solid paths.
+    cairo_t* cairoContext = context->platformContext();
+    cairo_path_t* path = cairo_copy_path(cairoContext);
+
+    FloatRect solidFigureExtents;
+    double x0 = 0;
+    double x1 = 0;
+    double y0 = 0;
+    double y1 = 0;
+    if (drawingStyle & Stroke) {
+        cairo_stroke_extents(cairoContext, &x0, &y0, &x1, &y1);
+        solidFigureExtents = FloatRect(x0, y0, x1 - x0, y1 - y0);
+    }
+    if (drawingStyle & Fill) {
+        cairo_fill_extents(cairoContext, &x0, &y0, &x1, &y1);
+        FloatRect fillExtents(x0, y0, x1 - x0, y1 - y0);
+        solidFigureExtents.unite(fillExtents);
+    }
 
-    // Create suitably-sized ImageBuffer to hold the shadow.
-    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
+    cairo_t* shadowContext = shadow->beginShadowLayer(cairoContext, solidFigureExtents);
+    if (!shadowContext)
+        return;
 
-    // Draw shadow into a new ImageBuffer.
-    cairo_t* shadowContext = shadowBuffer->context()->platformContext();
-    copyContextProperties(cr, shadowContext);
-    cairo_translate(shadowContext, -rect.x() + radius + shadowOffset.width(), -rect.y() + radius + shadowOffset.height());
-    cairo_new_path(shadowContext);
-    OwnPtr<cairo_path_t> path(cairo_copy_path(cr));
-    cairo_append_path(shadowContext, path.get());
+    // It's important to copy the context properties to the new shadow
+    // context to preserve things such as the fill rule and stroke width.
+    copyContextProperties(cairoContext, shadowContext);
+    cairo_append_path(shadowContext, path);
 
-    if (fillShadow)
-        setPlatformFill(context, shadowContext, gcp);
-    if (strokeShadow)
-        setPlatformStroke(context, shadowContext, gcp);
+    if (drawingStyle & Fill)
+        setPlatformFill(context, shadowContext, contextPrivate);
+    if (drawingStyle & Stroke)
+        setPlatformStroke(context, shadowContext, contextPrivate);
 
-    context->applyPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, radius);
-#endif
+    shadow->endShadowLayer(cairoContext);
 }
 
 static void fillCurrentCairoPath(GraphicsContext* context, GraphicsContextPrivate* gcp, cairo_t* cairoContext)
 {
     cairo_set_fill_rule(cairoContext, context->fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
-    drawPathShadow(context, gcp, true, false);
+    drawPathShadow(context, gcp, Fill);
 
     setPlatformFill(context, cairoContext, gcp);
     cairo_new_path(cairoContext);
@@ -244,7 +196,7 @@ static void fillCurrentCairoPath(GraphicsContext* context, GraphicsContextPrivat
 
 static void strokeCurrentCairoPath(GraphicsContext* context, GraphicsContextPrivate* gcp, cairo_t* cairoContext)
 {
-    drawPathShadow(context, gcp, false, true);
+    drawPathShadow(context, gcp, Stroke);
     setPlatformStroke(context, cairoContext, gcp);
     cairo_new_path(cairoContext);
 }
@@ -281,12 +233,20 @@ void GraphicsContext::savePlatformState()
 {
     cairo_save(m_data->cr);
     m_data->save();
+    m_data->shadowStack.append(m_data->shadow);
 }
 
 void GraphicsContext::restorePlatformState()
 {
     cairo_restore(m_data->cr);
     m_data->restore();
+
+    if (m_data->shadowStack.isEmpty())
+        m_data->shadow = ContextShadow();
+    else {
+        m_data->shadow = m_data->shadowStack.last();
+        m_data->shadowStack.removeLast();
+    }
 }
 
 // Draws a filled rectangle with a stroked border.
@@ -602,7 +562,7 @@ void GraphicsContext::drawPath()
     setPathOnCairoContext(cr, m_data->m_pendingPath.context());
 
     cairo_set_fill_rule(cr, fillRule() == RULE_EVENODD ? CAIRO_FILL_RULE_EVEN_ODD : CAIRO_FILL_RULE_WINDING);
-    drawPathShadow(this, m_common, true, true);
+    drawPathShadow(this, m_common, FillAndStroke);
 
     setPlatformFill(this, cr, m_common);
     setPlatformStroke(this, cr, m_common);
@@ -621,49 +581,14 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     cairo_restore(cr);
 }
 
-static void drawBorderlessRectShadow(GraphicsContext* context, const FloatRect& rect, const Color& rectColor)
-{
-#if ENABLE(FILTERS)
-    FloatSize shadowOffset;
-    float shadowBlur;
-    Color shadowColor;
-    if (!context->getShadow(shadowOffset, shadowBlur, shadowColor))
-        return;
-
-    AffineTransform transform = context->getCTM();
-    // drawTiledShadow still does not work with rotations.
-    if ((transform.isIdentityOrTranslationOrFlipped())) {
-        cairo_t* cr = context->platformContext();
-        cairo_save(cr);
-        appendWebCorePathToCairoContext(cr, Path::createRectangle(rect));
-        FloatSize corner;
-        IntRect shadowRect(rect);
-        context->drawTiledShadow(shadowRect, corner, corner, corner, corner, DeviceColorSpace);
-        cairo_restore(cr);
-
-        return;
-    }
-
-    IntSize shadowBufferSize;
-    FloatRect shadowRect;
-    float radius = 0;
-    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, radius, rect, shadowOffset, shadowBlur);
-
-    // Draw shadow into a new ImageBuffer
-    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
-    GraphicsContext* shadowContext = shadowBuffer->context();
-    shadowContext->fillRect(FloatRect(FloatPoint(radius, radius), rect.size()), rectColor, DeviceColorSpace);
-
-    context->applyPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, radius);
-#endif
-}
-
-void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace colorSpace)
+void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorSpace)
 {
     if (paintingDisabled())
         return;
 
-    drawBorderlessRectShadow(this, rect, color);
+    if (m_data->hasShadow())
+        m_data->shadow.drawRectShadow(this, enclosingIntRect(rect));
+
     if (color.alpha())
         fillRectSourceOver(m_data->cr, rect, color);
 }
@@ -737,8 +662,13 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
     setPlatformStrokeStyle(DottedStroke);
 #else
     int radius = (width - 1) / 2;
-    for (unsigned i = 0; i < rectCount; i++)
-        appendWebCorePathToCairoContext(cr, Path::createRoundedRectangle(rects[i], FloatSize(radius, radius)));
+    Path path;
+    for (unsigned i = 0; i < rectCount; ++i) {
+        if (i > 0)
+            path.clear();
+        path.addRoundedRect(rects[i], FloatSize(radius, radius));
+        appendWebCorePathToCairoContext(cr, path);
+    }
 
     // Force the alpha to 50%.  This matches what the Mac does with outline rings.
     Color ringColor(color.red(), color.green(), color.blue(), 127);
@@ -928,57 +858,26 @@ void GraphicsContext::addInnerRoundedRectClip(const IntRect& rect, int thickness
     cairo_set_fill_rule(cr, savedFillRule);
 }
 
-void GraphicsContext::setPlatformShadow(FloatSize const& size, float, Color const&, ColorSpace)
+void GraphicsContext::setPlatformShadow(FloatSize const& size, float blur, Color const& color, ColorSpace)
 {
-    // Cairo doesn't support shadows natively, they are drawn manually in the draw*
-    // functions
-
+    // Cairo doesn't support shadows natively, they are drawn manually in the draw* functions
     if (m_common->state.shadowsIgnoreTransforms) {
         // Meaning that this graphics context is associated with a CanvasRenderingContext
         // We flip the height since CG and HTML5 Canvas have opposite Y axis
         m_common->state.shadowOffset = FloatSize(size.width(), -size.height());
-    }
+        m_data->shadow = ContextShadow(color, blur, FloatSize(size.width(), -size.height()));
+    } else
+        m_data->shadow = ContextShadow(color, blur, FloatSize(size.width(), size.height()));
 }
 
-void GraphicsContext::applyPlatformShadow(PassOwnPtr<ImageBuffer> buffer, const Color& shadowColor, const FloatRect& shadowRect, float radius)
+ContextShadow* GraphicsContext::contextShadow()
 {
-#if ENABLE(FILTERS)
-    setColor(m_data->cr, shadowColor);
-    PlatformRefPtr<cairo_surface_t> shadowMask(createShadowMask(buffer, shadowRect, radius));
-    cairo_mask_surface(m_data->cr, shadowMask.get(), shadowRect.x(), shadowRect.y());
-#endif
-}
-
-PlatformRefPtr<cairo_surface_t> GraphicsContext::createShadowMask(PassOwnPtr<ImageBuffer> buffer, const FloatRect& shadowRect, float radius)
-{
-#if ENABLE(FILTERS)
-    if (!radius)
-        return buffer->m_data.m_surface;
-
-    FloatPoint blurRadius = FloatPoint(radius, radius);
-    float stdDeviation = FEGaussianBlur::calculateStdDeviation(radius);
-    if (!stdDeviation)
-        return buffer->m_data.m_surface;
-
-    // create filter
-    RefPtr<Filter> filter = ImageBufferFilter::create();
-    filter->setSourceImage(buffer);
-    RefPtr<FilterEffect> source = SourceGraphic::create();
-    source->setRepaintRectInLocalCoordinates(FloatRect(FloatPoint(), shadowRect.size()));
-    source->setIsAlphaImage(true);
-    RefPtr<FilterEffect> blur = FEGaussianBlur::create(stdDeviation, stdDeviation);
-    FilterEffectVector& inputEffects = blur->inputEffects();
-    inputEffects.append(source.get());
-    blur->setRepaintRectInLocalCoordinates(FloatRect(FloatPoint(), shadowRect.size()));
-    blur->apply(filter.get());
-    return blur->resultImage()->m_data.m_surface;
-#endif
+    return &m_data->shadow;
 }
 
-
 void GraphicsContext::clearPlatformShadow()
 {
-    notImplemented();
+    m_data->shadow.clear();
 }
 
 void GraphicsContext::beginTransparencyLayer(float opacity)
@@ -1095,43 +994,6 @@ float GraphicsContext::getAlpha()
     return m_common->state.globalAlpha;
 }
 
-static inline cairo_operator_t toCairoOperator(CompositeOperator op)
-{
-    switch (op) {
-    case CompositeClear:
-        return CAIRO_OPERATOR_CLEAR;
-    case CompositeCopy:
-        return CAIRO_OPERATOR_SOURCE;
-    case CompositeSourceOver:
-        return CAIRO_OPERATOR_OVER;
-    case CompositeSourceIn:
-        return CAIRO_OPERATOR_IN;
-    case CompositeSourceOut:
-        return CAIRO_OPERATOR_OUT;
-    case CompositeSourceAtop:
-        return CAIRO_OPERATOR_ATOP;
-    case CompositeDestinationOver:
-        return CAIRO_OPERATOR_DEST_OVER;
-    case CompositeDestinationIn:
-        return CAIRO_OPERATOR_DEST_IN;
-    case CompositeDestinationOut:
-        return CAIRO_OPERATOR_DEST_OUT;
-    case CompositeDestinationAtop:
-        return CAIRO_OPERATOR_DEST_ATOP;
-    case CompositeXOR:
-        return CAIRO_OPERATOR_XOR;
-    case CompositePlusDarker:
-        return CAIRO_OPERATOR_SATURATE;
-    case CompositeHighlight:
-        // There is no Cairo equivalent for CompositeHighlight.
-        return CAIRO_OPERATOR_OVER;
-    case CompositePlusLighter:
-        return CAIRO_OPERATOR_ADD;
-    default:
-        return CAIRO_OPERATOR_SOURCE;
-    }
-}
-
 void GraphicsContext::setCompositeOperation(CompositeOperator op)
 {
     if (paintingDisabled())
@@ -1248,206 +1110,20 @@ static inline FloatPoint getPhase(const FloatRect& dest, const FloatRect& tile)
     return phase;
 }
 
-/*
-  This function uses tiling to improve the performance of the shadow
-  drawing of rounded rectangles. The code basically does the following
-  steps:
-
-     1. Calculate the minimum rectangle size required to create the
-     tiles
-
-     2. If that size is smaller than the real rectangle render the new
-     small rectangle and its shadow in a new surface, in other case
-     render the shadow of the real rectangle in the destination
-     surface.
-
-     3. Calculate the sizes and positions of the tiles and their
-     destinations and use drawPattern to render the final shadow. The
-     code divides the rendering in 8 tiles:
-
-        1 | 2 | 3
-       -----------
-        4 |   | 5
-       -----------
-        6 | 7 | 8
-
-     The corners are directly copied from the small rectangle to the
-     real one and the side tiles are 1 pixel width, we use them as
-
-     tiles to cover the destination side. The corner tiles are bigger
-     than just the side of the rounded corner, we need to increase it
-     because the modifications caused by the corner over the blur
-     effect. We fill the central part with solid color to complete the
-     shadow.
- */
-void GraphicsContext::drawTiledShadow(const IntRect& rect, const FloatSize& topLeftRadius, const FloatSize& topRightRadius, const FloatSize& bottomLeftRadius, const FloatSize& bottomRightRadius, ColorSpace colorSpace)
-{
-#if ENABLE(FILTERS)
-    FloatSize shadowSize;
-    float shadowBlur;
-    Color shadowColor;
-    if (!getShadow(shadowSize, shadowBlur, shadowColor))
-        return;
-
-    // Calculate filter values to create appropriate shadow.
-    cairo_t* cr = m_data->cr;
-
-    IntSize shadowBufferSize;
-    FloatRect shadowRect;
-    float blurRadius = 0;
-    GraphicsContext::calculateShadowBufferDimensions(shadowBufferSize, shadowRect, blurRadius, rect, shadowSize, shadowBlur);
-
-    // Size of the tiling side.
-    int sideTileWidth = 1;
-    float radiusTwice = blurRadius * 2;
-
-    // Find the extra space needed from the curve of the corners.
-    int extraWidthFromCornerRadii = radiusTwice + max(topLeftRadius.width(), bottomLeftRadius.width()) +
-                                    radiusTwice + max(topRightRadius.width(), bottomRightRadius.width());
-    int extraHeightFromCornerRadii = radiusTwice + max(topLeftRadius.height(), topRightRadius.height()) +
-                                     radiusTwice + max(bottomLeftRadius.height(), bottomRightRadius.height());
-
-    // The length of a side of the buffer is the enough space for four blur radii,
-    // the radii of the corners, and then 1 pixel to draw the side tiles.
-    IntSize smallBufferSize = IntSize(sideTileWidth + extraWidthFromCornerRadii,
-                                      sideTileWidth + extraHeightFromCornerRadii);
-
-    if ((smallBufferSize.width() > shadowBufferSize.width()) || (smallBufferSize.height() > shadowBufferSize.height()) || (blurRadius <= 0)) {
-        // Create suitably-sized ImageBuffer to hold the shadow.
-        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
-        if (!shadowBuffer)
-            return;
-
-        // Draw shadow into a new ImageBuffer.
-        cairo_t* shadowContext = shadowBuffer->context()->platformContext();
-        copyContextProperties(cr, shadowContext);
-        cairo_translate(shadowContext, -rect.x() + blurRadius, -rect.y() + blurRadius);
-        cairo_new_path(shadowContext);
-        OwnPtr<cairo_path_t> path(cairo_copy_path(cr));
-        cairo_append_path(shadowContext, path.get());
-
-        setPlatformFill(this, shadowContext, m_common);
-
-        applyPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, blurRadius);
-
-        return;
-    }
-
-    OwnPtr<ImageBuffer> smallBuffer = ImageBuffer::create(smallBufferSize);
-    if (!smallBuffer)
-        return;
-
-    IntRect smallRect = IntRect(blurRadius, blurRadius, smallBufferSize.width() - radiusTwice, smallBufferSize.height() - radiusTwice);
-
-    // Draw shadow into a new ImageBuffer.
-    cairo_t* smallBufferContext = smallBuffer->context()->platformContext();
-    copyContextProperties(cr, smallBufferContext);
-    appendWebCorePathToCairoContext(smallBuffer->context()->platformContext(), Path::createRoundedRectangle(smallRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-    setPlatformFill(this, smallBufferContext, m_common);
-
-    OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(smallBufferSize);
-    if (!shadowBuffer)
-        return;
-
-    smallRect.setSize(smallBufferSize);
-
-    PlatformRefPtr<cairo_surface_t> shadowMask(createShadowMask(smallBuffer.release(), smallRect, blurRadius));
-
-    cairo_t* shadowContext = shadowBuffer->context()->platformContext();
-    setColor(shadowContext, shadowColor);
-    cairo_mask_surface(shadowContext, shadowMask.get(), 0, 0);
-
-    // Fill the internal part of the shadow.
-    shadowRect.inflate(-radiusTwice);
-    if (!shadowRect.isEmpty()) {
-        cairo_save(cr);
-        appendWebCorePathToCairoContext(cr, Path::createRoundedRectangle(shadowRect, topLeftRadius, topRightRadius, bottomLeftRadius, bottomRightRadius));
-        setColor(cr, shadowColor);
-        cairo_fill(cr);
-        cairo_restore(cr);
-    }
-    shadowRect.inflate(radiusTwice);
-
-    // Draw top side.
-    FloatRect tileRect = FloatRect(radiusTwice + topLeftRadius.width(), 0, sideTileWidth, radiusTwice);
-    FloatRect destRect = tileRect;
-    destRect.move(shadowRect.x(), shadowRect.y());
-    destRect.setWidth(shadowRect.width() - topLeftRadius.width() - topRightRadius.width() - blurRadius * 4);
-    FloatPoint phase = getPhase(destRect, tileRect);
-    AffineTransform patternTransform;
-    patternTransform.makeIdentity();
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the bottom side.
-    tileRect = FloatRect(radiusTwice + bottomLeftRadius.width(), smallBufferSize.height() - radiusTwice, sideTileWidth, radiusTwice);
-    destRect = tileRect;
-    destRect.move(shadowRect.x(), shadowRect.y() + radiusTwice + rect.height() - smallBufferSize.height());
-    destRect.setWidth(shadowRect.width() - bottomLeftRadius.width() - bottomRightRadius.width() - blurRadius * 4);
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the right side.
-    tileRect = FloatRect(smallBufferSize.width() - radiusTwice, radiusTwice + topRightRadius.height(), radiusTwice, sideTileWidth);
-    destRect = tileRect;
-    destRect.move(shadowRect.x() + radiusTwice + rect.width() - smallBufferSize.width(), shadowRect.y());
-    destRect.setHeight(shadowRect.height() - topRightRadius.height() - bottomRightRadius.height() - blurRadius * 4);
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the left side.
-    tileRect = FloatRect(0, radiusTwice + topLeftRadius.height(), radiusTwice, sideTileWidth);
-    destRect = tileRect;
-    destRect.move(shadowRect.x(), shadowRect.y());
-    destRect.setHeight(shadowRect.height() - topLeftRadius.height() - bottomLeftRadius.height() - blurRadius * 4);
-    phase = FloatPoint(destRect.x() - tileRect.x(), destRect.y() - tileRect.y());
-    shadowBuffer->drawPattern(this, tileRect, patternTransform,
-                              phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the top left corner.
-    tileRect = FloatRect(0, 0, radiusTwice + topLeftRadius.width(), radiusTwice + topLeftRadius.height());
-    destRect = tileRect;
-    destRect.move(shadowRect.x(), shadowRect.y());
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the top right corner.
-    tileRect = FloatRect(smallBufferSize.width() - radiusTwice - topRightRadius.width(), 0, radiusTwice + topRightRadius.width(), radiusTwice + topRightRadius.height());
-    destRect = tileRect;
-    destRect.move(shadowRect.x() + rect.width() - smallBufferSize.width() + radiusTwice, shadowRect.y());
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the bottom right corner.
-    tileRect = FloatRect(smallBufferSize.width() - radiusTwice - bottomRightRadius.width(), smallBufferSize.height() - radiusTwice - bottomRightRadius.height(), radiusTwice + bottomRightRadius.width(), radiusTwice + bottomRightRadius.height());
-    destRect = tileRect;
-    destRect.move(shadowRect.x() + rect.width() - smallBufferSize.width() + radiusTwice, shadowRect.y() + rect.height() - smallBufferSize.height() + radiusTwice);
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-
-    // Draw the bottom left corner.
-    tileRect = FloatRect(0, smallBufferSize.height() - radiusTwice - bottomLeftRadius.height(), radiusTwice + bottomLeftRadius.width(), radiusTwice + bottomLeftRadius.height());
-    destRect = tileRect;
-    destRect.move(shadowRect.x(), shadowRect.y() + rect.height() - smallBufferSize.height() + radiusTwice);
-    phase = getPhase(destRect, tileRect);
-    shadowBuffer->drawPattern(this, tileRect, patternTransform, phase, colorSpace, CompositeSourceOver, destRect);
-#endif
-}
-
 void GraphicsContext::fillRoundedRect(const IntRect& r, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
 {
     if (paintingDisabled())
         return;
 
+    if (m_data->hasShadow())
+        m_data->shadow.drawRectShadow(this, r, topLeft, topRight, bottomLeft, bottomRight);
+
     cairo_t* cr = m_data->cr;
     cairo_save(cr);
-    appendWebCorePathToCairoContext(cr, Path::createRoundedRectangle(r, topLeft, topRight, bottomLeft, bottomRight));
+    Path path;
+    path.addRoundedRect(r, topLeft, topRight, bottomLeft, bottomRight);
+    appendWebCorePathToCairoContext(cr, path);
     setColor(cr, color);
-    AffineTransform transform = this->getCTM();
-    // drawTiledShadow still does not work with rotations.
-    if (transform.isIdentityOrTranslationOrFlipped())
-        drawTiledShadow(r, topLeft, topRight, bottomLeft, bottomRight, colorSpace);
-    else
-        drawPathShadow(this, m_common, true, false);
     cairo_fill(cr);
     cairo_restore(cr);
 }
diff --git a/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h b/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
index 81987ef..527cb72 100644
--- a/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
+++ b/WebCore/platform/graphics/cairo/GraphicsContextPlatformPrivateCairo.h
@@ -28,6 +28,7 @@
 #include "GraphicsContext.h"
 
 #include "CairoPath.h"
+#include "ContextShadow.h"
 #include <cairo.h>
 #include <math.h>
 #include <stdio.h>
@@ -98,6 +99,10 @@ public:
     Vector<float> layers;
     CairoPath m_pendingPath;
 
+    ContextShadow shadow;
+    Vector<ContextShadow> shadowStack;
+    bool hasShadow() const { return shadow.m_type != ContextShadow::NoShadow; }
+
 #if PLATFORM(GTK)
     GdkEventExpose* expose;
 #elif PLATFORM(WIN)
diff --git a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
index 976dcb4..d452c3a 100644
--- a/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageBufferCairo.cpp
@@ -69,7 +69,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
 {
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
diff --git a/WebCore/platform/graphics/cairo/ImageCairo.cpp b/WebCore/platform/graphics/cairo/ImageCairo.cpp
index 904e819..8f7a194 100644
--- a/WebCore/platform/graphics/cairo/ImageCairo.cpp
+++ b/WebCore/platform/graphics/cairo/ImageCairo.cpp
@@ -31,7 +31,9 @@
 #if PLATFORM(CAIRO)
 
 #include "AffineTransform.h"
+#include "CairoUtilities.h"
 #include "Color.h"
+#include "ContextShadow.h"
 #include "FloatRect.h"
 #include "PlatformRefPtrCairo.h"
 #include "GraphicsContext.h"
@@ -133,29 +135,18 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
     cairo_matrix_t matrix = { scaleX, 0, 0, scaleY, srcRect.x(), srcRect.y() };
     cairo_pattern_set_matrix(pattern, &matrix);
 
-    // Draw the shadow
-#if ENABLE(FILTERS)
-    FloatSize shadowOffset;
-    float shadowBlur;
-    Color shadowColor;
-    if (context->getShadow(shadowOffset, shadowBlur, shadowColor)) {
-        IntSize shadowBufferSize;
-        FloatRect shadowRect;
-        float radius = 0;
-        context->calculateShadowBufferDimensions(shadowBufferSize, shadowRect, radius, dstRect, shadowOffset, shadowBlur);
-        shadowColor = colorWithOverrideAlpha(shadowColor.rgb(), (shadowColor.alpha() *  context->getAlpha()) / 255.f);
-
-        //draw shadow into a new ImageBuffer
-        OwnPtr<ImageBuffer> shadowBuffer = ImageBuffer::create(shadowBufferSize);
-        cairo_t* shadowContext = shadowBuffer->context()->platformContext();
-        cairo_set_source(shadowContext, pattern);
-        cairo_translate(shadowContext, -dstRect.x(), -dstRect.y());
-        cairo_rectangle(shadowContext, 0, 0, dstRect.width(), dstRect.height());
-        cairo_fill(shadowContext);
-
-        context->applyPlatformShadow(shadowBuffer.release(), shadowColor, shadowRect, radius);
+    ContextShadow* shadow = context->contextShadow();
+    ASSERT(shadow);
+    if (shadow->m_type != ContextShadow::NoShadow) {
+        cairo_t* shadowContext = shadow->beginShadowLayer(cr, dstRect);
+        if (shadowContext) {
+            cairo_translate(shadowContext, dstRect.x(), dstRect.y());
+            cairo_set_source(shadowContext, pattern);
+            cairo_rectangle(shadowContext, 0, 0, dstRect.width(), dstRect.height());
+            cairo_fill(shadowContext);
+            shadow->endShadowLayer(cr);
+        }
     }
-#endif
 
     // Draw the image.
     cairo_translate(cr, dstRect.x(), dstRect.y());
@@ -172,46 +163,15 @@ void BitmapImage::draw(GraphicsContext* context, const FloatRect& dst, const Flo
 }
 
 void Image::drawPattern(GraphicsContext* context, const FloatRect& tileRect, const AffineTransform& patternTransform,
-                        const FloatPoint& phase, ColorSpace, CompositeOperator op, const FloatRect& destRect)
+                        const FloatPoint& phase, ColorSpace colorSpace, CompositeOperator op, const FloatRect& destRect)
 {
     cairo_surface_t* image = nativeImageForCurrentFrame();
     if (!image) // If it's too early we won't have an image yet.
         return;
 
-    // Avoid NaN
-    if (!isfinite(phase.x()) || !isfinite(phase.y()))
-       return;
-
     cairo_t* cr = context->platformContext();
-    context->save();
-
-    PlatformRefPtr<cairo_surface_t> clippedImageSurface = 0;
-    if (tileRect.size() != size()) {
-        IntRect imageSize = enclosingIntRect(tileRect);
-        clippedImageSurface = adoptPlatformRef(cairo_image_surface_create(CAIRO_FORMAT_ARGB32, imageSize.width(), imageSize.height()));
-        PlatformRefPtr<cairo_t> clippedImageContext(cairo_create(clippedImageSurface.get()));
-        cairo_set_source_surface(clippedImageContext.get(), image, -tileRect.x(), -tileRect.y());
-        cairo_paint(clippedImageContext.get());
-        image = clippedImageSurface.get();
-    }
-
-    cairo_pattern_t* pattern = cairo_pattern_create_for_surface(image);
-    cairo_pattern_set_extend(pattern, CAIRO_EXTEND_REPEAT);
 
-    cairo_matrix_t pattern_matrix = cairo_matrix_t(patternTransform);
-    cairo_matrix_t phase_matrix = {1, 0, 0, 1, phase.x() + tileRect.x() * patternTransform.a(), phase.y() + tileRect.y() * patternTransform.d()};
-    cairo_matrix_t combined;
-    cairo_matrix_multiply(&combined, &pattern_matrix, &phase_matrix);
-    cairo_matrix_invert(&combined);
-    cairo_pattern_set_matrix(pattern, &combined);
-
-    context->setCompositeOperation(op);
-    cairo_set_source(cr, pattern);
-    cairo_pattern_destroy(pattern);
-    cairo_rectangle(cr, destRect.x(), destRect.y(), destRect.width(), destRect.height());
-    cairo_fill(cr);
-
-    context->restore();
+    drawPatternToCairoContext(cr, image, size(), tileRect, patternTransform, phase, toCairoOperator(op), destRect);
 
     if (imageObserver())
         imageObserver()->didDraw(this);
diff --git a/WebCore/platform/graphics/cairo/PathCairo.cpp b/WebCore/platform/graphics/cairo/PathCairo.cpp
index 776bceb..d5045be 100644
--- a/WebCore/platform/graphics/cairo/PathCairo.cpp
+++ b/WebCore/platform/graphics/cairo/PathCairo.cpp
@@ -337,40 +337,4 @@ void Path::transform(const AffineTransform& trans)
     cairo_transform(cr, &c_matrix);
 }
 
-String Path::debugString() const
-{
-    if (isEmpty())
-        return String();
-
-    String pathString;
-    OwnPtr<cairo_path_t> path(cairo_copy_path(platformPath()->context()));
-    cairo_path_data_t* data;
-
-    for (int i = 0; i < path->num_data; i += path->data[i].header.length) {
-        data = &path->data[i];
-        switch (data->header.type) {
-        case CAIRO_PATH_MOVE_TO:
-            if (i < (path->num_data - path->data[i].header.length))
-                pathString += String::format("M%.2f,%.2f ",
-                                      data[1].point.x, data[1].point.y);
-            break;
-        case CAIRO_PATH_LINE_TO:
-            pathString += String::format("L%.2f,%.2f ",
-                                      data[1].point.x, data[1].point.y);
-            break;
-        case CAIRO_PATH_CURVE_TO:
-            pathString += String::format("C%.2f,%.2f,%.2f,%.2f,%.2f,%.2f ",
-                                      data[1].point.x, data[1].point.y,
-                                      data[2].point.x, data[2].point.y,
-                                      data[3].point.x, data[3].point.y);
-            break;
-        case CAIRO_PATH_CLOSE_PATH:
-            pathString += "Z ";
-            break;
-        }
-    }
-
-    return pathString.simplifyWhiteSpace();
-}
-
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/cg/ColorCG.cpp b/WebCore/platform/graphics/cg/ColorCG.cpp
index 6f05c38..c9b05da 100644
--- a/WebCore/platform/graphics/cg/ColorCG.cpp
+++ b/WebCore/platform/graphics/cg/ColorCG.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007 Apple Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -28,6 +28,7 @@
 
 #if PLATFORM(CG)
 
+#include "GraphicsContextCG.h"
 #include <wtf/Assertions.h>
 #include <wtf/RetainPtr.h>
 #include <ApplicationServices/ApplicationServices.h>
@@ -69,37 +70,79 @@ Color::Color(CGColorRef color)
     m_valid = true;
 }
 
-#if OS(WINDOWS)
+static inline CGColorSpaceRef cachedCGColorSpace(ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case ColorSpaceDeviceRGB:
+        return deviceRGBColorSpaceRef();
+    case ColorSpaceSRGB:
+        return sRGBColorSpaceRef();
+    case ColorSpaceLinearRGB:
+        return linearRGBColorSpaceRef();
+    }
+    ASSERT_NOT_REACHED();
+    return deviceRGBColorSpaceRef();
+}
 
-CGColorRef createCGColor(const Color& c)
+static CGColorRef leakCGColor(const Color& color, ColorSpace colorSpace)
 {
-    CGColorRef color = NULL;
-#ifdef OBSOLETE_COLORSYNC_API
-    CMProfileRef prof = NULL;
-    CMGetSystemProfile(&prof);
-    RetainPtr<CGColorSpaceRef> rgbSpace(AdoptCF, CGColorSpaceCreateWithPlatformColorSpace(prof));
-#else
-    ColorSyncProfileRef prof = ColorSyncProfileCreateWithDisplayID(0);
-    RetainPtr<CGColorSpaceRef> rgbSpace(AdoptCF, CGColorSpaceCreateWithPlatformColorSpace(const_cast<void*>(reinterpret_cast<const void*>(prof))));
-#endif
-
-    if (rgbSpace) {
-        CGFloat components[4] = { static_cast<CGFloat>(c.red()) / 255, static_cast<CGFloat>(c.green()) / 255,
-                                  static_cast<CGFloat>(c.blue()) / 255, static_cast<CGFloat>(c.alpha()) / 255 };
-        color = CGColorCreate(rgbSpace.get(), components);
+    CGFloat components[4];
+    color.getRGBA(components[0], components[1], components[2], components[3]);
+    return CGColorCreate(cachedCGColorSpace(colorSpace), components);
+}
+
+template<ColorSpace colorSpace> static CGColorRef cachedCGColor(const Color& color)
+{
+    switch (color.rgb()) {
+    case Color::transparent: {
+        static CGColorRef transparentCGColor = leakCGColor(color, colorSpace);
+        return transparentCGColor;
+    }
+    case Color::black: {
+        static CGColorRef blackCGColor = leakCGColor(color, colorSpace);
+        return blackCGColor;
+    }
+    case Color::white: {
+        static CGColorRef whiteCGColor = leakCGColor(color, colorSpace);
+        return whiteCGColor;
+    }
     }
 
-#ifdef OBSOLETE_COLORSYNC_API
-    CMCloseProfile(prof);
-#else
-    if (prof)
-        CFRelease(prof);
-#endif
+    ASSERT(color.rgb());
 
-    return color;
+    const size_t cacheSize = 32;
+    static RGBA32 cachedRGBAValues[cacheSize];
+    static RetainPtr<CGColorRef>* cachedCGColors = new RetainPtr<CGColorRef>[cacheSize];
+
+    for (size_t i = 0; i < cacheSize; ++i) {
+        if (cachedRGBAValues[i] == color.rgb())
+            return cachedCGColors[i].get();
+    }
+
+    CGColorRef newCGColor = leakCGColor(color, colorSpace);
+
+    static size_t cursor;
+    cachedRGBAValues[cursor] = color.rgb();
+    cachedCGColors[cursor].adoptCF(newCGColor);
+    if (++cursor == cacheSize)
+        cursor = 0;
+
+    return newCGColor;
 }
 
-#endif // OS(WINDOWS)
+CGColorRef cachedCGColor(const Color& color, ColorSpace colorSpace)
+{
+    switch (colorSpace) {
+    case ColorSpaceDeviceRGB:
+        return cachedCGColor<ColorSpaceDeviceRGB>(color);
+    case ColorSpaceSRGB:
+        return cachedCGColor<ColorSpaceSRGB>(color);
+    case ColorSpaceLinearRGB:
+        return cachedCGColor<ColorSpaceLinearRGB>(color);
+    }
+    ASSERT_NOT_REACHED();
+    return cachedCGColor(color, ColorSpaceDeviceRGB);
+}
 
 }
 
diff --git a/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp b/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
index 2a81fd2..fe4fc7f 100644
--- a/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContext3DCG.cpp
@@ -64,9 +64,35 @@ bool GraphicsContext3D::getImageData(Image* image,
         return false;
     size_t width = CGImageGetWidth(cgImage);
     size_t height = CGImageGetHeight(cgImage);
-    if (!width || !height || CGImageGetBitsPerComponent(cgImage) != 8)
+    if (!width || !height)
         return false;
-    size_t componentsPerPixel = CGImageGetBitsPerPixel(cgImage) / 8;
+    size_t bitsPerComponent = CGImageGetBitsPerComponent(cgImage);
+    size_t bitsPerPixel = CGImageGetBitsPerPixel(cgImage);
+    if (bitsPerComponent != 8 && bitsPerComponent != 16)
+        return false;
+    if (bitsPerPixel % bitsPerComponent)
+        return false;
+    size_t componentsPerPixel = bitsPerPixel / bitsPerComponent;
+    bool srcByteOrder16Big = false;
+    if (bitsPerComponent == 16) {
+        CGBitmapInfo bitInfo = CGImageGetBitmapInfo(cgImage);
+        switch (bitInfo & kCGBitmapByteOrderMask) {
+        case kCGBitmapByteOrder16Big:
+            srcByteOrder16Big = true;
+            break;
+        case kCGBitmapByteOrder16Little:
+            srcByteOrder16Big = false;
+            break;
+        case kCGBitmapByteOrderDefault:
+            // This is a bug in earlier version of cg where the default endian
+            // is little whereas the decoded 16-bit png image data is actually
+            // Big. Later version (10.6.4) no longer returns ByteOrderDefault.
+            srcByteOrder16Big = true;
+            break;
+        default:
+            return false;
+        }
+    }
     SourceDataFormat srcDataFormat = kSourceFormatRGBA8;
     AlphaOp neededAlphaOp = kAlphaDoNothing;
     switch (CGImageGetAlphaInfo(cgImage)) {
@@ -79,10 +105,16 @@ bool GraphicsContext3D::getImageData(Image* image,
             neededAlphaOp = kAlphaDoUnmultiply;
         switch (componentsPerPixel) {
         case 2:
-            srcDataFormat = kSourceFormatAR8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatAR8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatAR16Big : kSourceFormatAR16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatARGB8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatARGB8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatARGB16Big : kSourceFormatARGB16Little;
             break;
         default:
             return false;
@@ -94,13 +126,22 @@ bool GraphicsContext3D::getImageData(Image* image,
             neededAlphaOp = kAlphaDoPremultiply;
         switch (componentsPerPixel) {
         case 1:
-            srcDataFormat = kSourceFormatA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatA16Big : kSourceFormatA16Little;
             break;
         case 2:
-            srcDataFormat = kSourceFormatAR8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatAR8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatAR16Big : kSourceFormatAR16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatARGB8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatARGB8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatARGB16Big : kSourceFormatARGB16Little;
             break;
         default:
             return false;
@@ -110,10 +151,16 @@ bool GraphicsContext3D::getImageData(Image* image,
         // This path is only accessible for MacOS earlier than 10.6.4.
         switch (componentsPerPixel) {
         case 2:
-            srcDataFormat = kSourceFormatAR8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatAR8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatAR16Big : kSourceFormatAR16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatARGB8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatARGB8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatARGB16Big : kSourceFormatARGB16Little;
             break;
         default:
             return false;
@@ -127,10 +174,16 @@ bool GraphicsContext3D::getImageData(Image* image,
             neededAlphaOp = kAlphaDoUnmultiply;
         switch (componentsPerPixel) {
         case 2:
-            srcDataFormat = kSourceFormatRA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRA16Big : kSourceFormatRA16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatRGBA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRGBA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRGBA16Big : kSourceFormatRGBA16Little;
             break;
         default:
             return false;
@@ -141,13 +194,22 @@ bool GraphicsContext3D::getImageData(Image* image,
             neededAlphaOp = kAlphaDoPremultiply;
         switch (componentsPerPixel) {
         case 1:
-            srcDataFormat = kSourceFormatA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatA16Big :  kSourceFormatA16Little;
             break;
         case 2:
-            srcDataFormat = kSourceFormatRA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRA16Big :  kSourceFormatRA16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatRGBA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRGBA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRGBA16Big : kSourceFormatRGBA16Little;
             break;
         default:
             return false;
@@ -156,10 +218,16 @@ bool GraphicsContext3D::getImageData(Image* image,
     case kCGImageAlphaNoneSkipLast:
         switch (componentsPerPixel) {
         case 2:
-            srcDataFormat = kSourceFormatRA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRA16Big : kSourceFormatRA16Little;
             break;
         case 4:
-            srcDataFormat = kSourceFormatRGBA8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRGBA8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRGBA16Big :  kSourceFormatRGBA16Little;
             break;
         default:
             return false;
@@ -168,10 +236,16 @@ bool GraphicsContext3D::getImageData(Image* image,
     case kCGImageAlphaNone:
         switch (componentsPerPixel) {
         case 1:
-            srcDataFormat = kSourceFormatR8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatR8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatR16Big : kSourceFormatR16Little;
             break;
         case 3:
-            srcDataFormat = kSourceFormatRGB8;
+            if (bitsPerComponent == 8)
+                srcDataFormat = kSourceFormatRGB8;
+            else
+                srcDataFormat = srcByteOrder16Big ? kSourceFormatRGB16Big : kSourceFormatRGB16Little;
             break;
         default:
             return false;
@@ -188,7 +262,7 @@ bool GraphicsContext3D::getImageData(Image* image,
     outputVector.resize(width * height * 4);
     unsigned int srcUnpackAlignment = 0;
     size_t bytesPerRow = CGImageGetBytesPerRow(cgImage);
-    unsigned int padding = bytesPerRow - componentsPerPixel * width;
+    unsigned int padding = bytesPerRow - bitsPerPixel / 8 * width;
     if (padding) {
         srcUnpackAlignment = padding + 1;
         while (bytesPerRow % srcUnpackAlignment)
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
index e5079dc..9e0a2f5 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.cpp
@@ -26,7 +26,7 @@
 
 #define _USE_MATH_DEFINES 1
 #include "config.h"
-#include "GraphicsContext.h"
+#include "GraphicsContextCG.h"
 
 #include "AffineTransform.h"
 #include "FloatConversion.h"
@@ -69,60 +69,14 @@ using namespace std;
 
 namespace WebCore {
 
-static CGColorRef createCGColorWithColorSpace(const Color& color, ColorSpace colorSpace)
-{
-    CGFloat components[4];
-    color.getRGBA(components[0], components[1], components[2], components[3]);
-
-    CGColorRef cgColor = 0;
-    if (colorSpace == sRGBColorSpace)
-        cgColor = CGColorCreate(sRGBColorSpaceRef(), components);
-    else
-        cgColor = CGColorCreate(deviceRGBColorSpaceRef(), components);
-
-    return cgColor;
-}
-
 static void setCGFillColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
-    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
-    CGContextSetFillColorWithColor(context, cgColor);
-    CFRelease(cgColor);
+    CGContextSetFillColorWithColor(context, cachedCGColor(color, colorSpace));
 }
 
 static void setCGStrokeColor(CGContextRef context, const Color& color, ColorSpace colorSpace)
 {
-    CGColorRef cgColor = createCGColorWithColorSpace(color, colorSpace);
-    CGContextSetStrokeColorWithColor(context, cgColor);
-    CFRelease(cgColor);
-}
-
-static void setCGFillColorSpace(CGContextRef context, ColorSpace colorSpace)
-{
-    switch (colorSpace) {
-    case DeviceColorSpace:
-        break;
-    case sRGBColorSpace:
-        CGContextSetFillColorSpace(context, sRGBColorSpaceRef());
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        break;
-    }
-}
-
-static void setCGStrokeColorSpace(CGContextRef context, ColorSpace colorSpace)
-{
-    switch (colorSpace) {
-    case DeviceColorSpace:
-        break;
-    case sRGBColorSpace:
-        CGContextSetStrokeColorSpace(context, sRGBColorSpaceRef());
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-        break;
-    }
+    CGContextSetStrokeColorWithColor(context, cachedCGColor(color, colorSpace));
 }
 
 CGColorSpaceRef deviceRGBColorSpaceRef()
@@ -142,6 +96,17 @@ CGColorSpaceRef sRGBColorSpaceRef()
 #endif
 }
 
+CGColorSpaceRef linearRGBColorSpaceRef()
+{
+    // FIXME: Windows should be able to use kCGColorSpaceGenericRGBLinear, this is tracked by http://webkit.org/b/31363.
+#if PLATFORM(WIN) || defined(BUILDING_ON_TIGER)
+    return deviceRGBColorSpaceRef();
+#else
+    static CGColorSpaceRef linearRGBSpace = CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear);
+    return linearRGBSpace;
+#endif
+}
+
 GraphicsContext::GraphicsContext(CGContextRef cgContext)
     : m_common(createGraphicsContextPrivate())
     , m_data(new GraphicsContextPlatformPrivate(cgContext))
@@ -586,9 +551,6 @@ void GraphicsContext::fillPath()
 
     CGContextRef context = platformContext();
 
-    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
-    setCGFillColorSpace(context, m_common->state.fillColorSpace);
-
     if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         if (fillRule() == RULE_EVENODD)
@@ -613,9 +575,6 @@ void GraphicsContext::strokePath()
 
     CGContextRef context = platformContext();
 
-    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
-    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
-
     if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         CGContextReplacePathWithStrokedPath(context);
@@ -638,9 +597,6 @@ void GraphicsContext::fillRect(const FloatRect& rect)
 
     CGContextRef context = platformContext();
 
-    // FIXME: Is this helpful and correct in the fillPattern and fillGradient cases?
-    setCGFillColorSpace(context, m_common->state.fillColorSpace);
-
     if (m_common->state.fillGradient) {
         CGContextSaveGState(context);
         CGContextClipToRect(context, rect);
@@ -659,17 +615,18 @@ void GraphicsContext::fillRect(const FloatRect& rect, const Color& color, ColorS
 {
     if (paintingDisabled())
         return;
+
     CGContextRef context = platformContext();
     Color oldFillColor = fillColor();
     ColorSpace oldColorSpace = fillColorSpace();
 
     if (oldFillColor != color || oldColorSpace != colorSpace)
-      setCGFillColor(context, color, colorSpace);
+        setCGFillColor(context, color, colorSpace);
 
     CGContextFillRect(context, rect);
 
     if (oldFillColor != color || oldColorSpace != colorSpace)
-      setCGFillColor(context, oldFillColor, oldColorSpace);
+        setCGFillColor(context, oldFillColor, oldColorSpace);
 }
 
 void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLeft, const IntSize& topRight, const IntSize& bottomLeft, const IntSize& bottomRight, const Color& color, ColorSpace colorSpace)
@@ -684,7 +641,9 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     if (oldFillColor != color || oldColorSpace != colorSpace)
         setCGFillColor(context, color, colorSpace);
 
-    addPath(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
+    Path path;
+    path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+    addPath(path);
     fillPath();
 
     if (oldFillColor != color || oldColorSpace != colorSpace)
@@ -821,13 +780,8 @@ void GraphicsContext::setPlatformShadow(const FloatSize& offset, float blur, con
     // and we should therefore just use the default shadow color.
     if (!color.isValid())
         CGContextSetShadow(context, CGSizeMake(xOffset, yOffset), blurRadius);
-    else {
-        RetainPtr<CGColorRef> colorCG(AdoptCF, createCGColorWithColorSpace(color, colorSpace));
-        CGContextSetShadowWithColor(context,
-                                    CGSizeMake(xOffset, yOffset),
-                                    blurRadius,
-                                    colorCG.get());
-    }
+    else
+        CGContextSetShadowWithColor(context, CGSizeMake(xOffset, yOffset), blurRadius, cachedCGColor(color, colorSpace));
 }
 
 void GraphicsContext::clearPlatformShadow()
@@ -865,9 +819,6 @@ void GraphicsContext::strokeRect(const FloatRect& r, float lineWidth)
 
     CGContextRef context = platformContext();
 
-    // FIXME: Is this helpful and correct in the strokePattern and strokeGradient cases?
-    setCGStrokeColorSpace(context, m_common->state.strokeColorSpace);
-
     if (m_common->state.strokeGradient) {
         CGContextSaveGState(context);
         setStrokeThickness(lineWidth);
diff --git a/WebCore/platform/graphics/cg/GraphicsContextCG.h b/WebCore/platform/graphics/cg/GraphicsContextCG.h
new file mode 100644
index 0000000..5de95ef
--- /dev/null
+++ b/WebCore/platform/graphics/cg/GraphicsContextCG.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2006, 2007, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef GraphicsContextCG_h
+#define GraphicsContextCG_h
+
+#include "GraphicsContext.h"
+
+typedef struct CGColorSpace *CGColorSpaceRef;
+
+namespace WebCore {
+
+CGColorSpaceRef deviceRGBColorSpaceRef();
+CGColorSpaceRef sRGBColorSpaceRef();
+CGColorSpaceRef linearRGBColorSpaceRef();
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
index aac4f45..1d0a99f 100644
--- a/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
+++ b/WebCore/platform/graphics/cg/GraphicsContextPlatformPrivateCG.h
@@ -28,12 +28,6 @@
 
 namespace WebCore {
 
-// FIXME: This would be in GraphicsContextCG.h if that existed.
-CGColorSpaceRef deviceRGBColorSpaceRef();
-
-// FIXME: This would be in GraphicsContextCG.h if that existed.
-CGColorSpaceRef sRGBColorSpaceRef();
-
 class GraphicsContextPlatformPrivate {
 public:
     GraphicsContextPlatformPrivate(CGContextRef cgContext)
diff --git a/WebCore/platform/graphics/cg/ImageBufferCG.cpp b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
index ecbcf60..640692a 100644
--- a/WebCore/platform/graphics/cg/ImageBufferCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageBufferCG.cpp
@@ -31,12 +31,12 @@
 #include "Base64.h"
 #include "BitmapImage.h"
 #include "GraphicsContext.h"
+#include "GraphicsContextCG.h"
 #include "ImageData.h"
 #include "MIMETypeRegistry.h"
-#include "PlatformString.h"
 #include <ApplicationServices/ApplicationServices.h>
 #include <wtf/Assertions.h>
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/RetainPtr.h>
 #include <wtf/Threading.h>
@@ -56,7 +56,7 @@ ImageBufferData::ImageBufferData(const IntSize&)
 {
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace imageColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -65,12 +65,11 @@ ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, b
         return;
 
     unsigned bytesPerRow = size.width();
-    if (imageColorSpace != GrayScale) {
-        // Protect against overflow
-        if (bytesPerRow > 0x3FFFFFFF)
-            return;
-        bytesPerRow *= 4;
-    }
+
+    // Protect against overflow
+    if (bytesPerRow > 0x3FFFFFFF)
+        return;
+    bytesPerRow *= 4;
     m_data.m_bytesPerRow = bytesPerRow;
 
     size_t dataSize = size.height() * bytesPerRow;
@@ -80,27 +79,20 @@ ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, b
     ASSERT((reinterpret_cast<size_t>(m_data.m_data) & 2) == 0);
 
     switch(imageColorSpace) {
-        case DeviceRGB:
-            m_data.m_colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
-            break;
-        case GrayScale:
-            m_data.m_colorSpace.adoptCF(CGColorSpaceCreateDeviceGray());
-            break;
-#if ((PLATFORM(MAC) || PLATFORM(CHROMIUM)) && !defined(BUILDING_ON_TIGER))
-        case LinearRGB:
-            m_data.m_colorSpace.adoptCF(CGColorSpaceCreateWithName(kCGColorSpaceGenericRGBLinear));
-            break;
-            
-#endif
-        default:
-            m_data.m_colorSpace.adoptCF(CGColorSpaceCreateDeviceRGB());
-            break;
+    case ColorSpaceDeviceRGB:
+        m_data.m_colorSpace = deviceRGBColorSpaceRef();
+        break;
+    case ColorSpaceSRGB:
+        m_data.m_colorSpace = sRGBColorSpaceRef();
+        break;
+    case ColorSpaceLinearRGB:
+        m_data.m_colorSpace = linearRGBColorSpaceRef();
+        break;
     }
 
-    m_data.m_grayScale = imageColorSpace == GrayScale;
-    m_data.m_bitmapInfo = m_data.m_grayScale ? kCGImageAlphaNone : kCGImageAlphaPremultipliedLast;
+    m_data.m_bitmapInfo = kCGImageAlphaPremultipliedLast;
     RetainPtr<CGContextRef> cgContext(AdoptCF, CGBitmapContextCreate(m_data.m_data, size.width(), size.height(), 8, bytesPerRow,
-                                                                     m_data.m_colorSpace.get(), m_data.m_bitmapInfo));
+                                                                     m_data.m_colorSpace, m_data.m_bitmapInfo));
     if (!cgContext)
         return;
 
@@ -135,8 +127,8 @@ PassRefPtr<Image> ImageBuffer::copyImage() const
 
 static CGImageRef cgImage(const IntSize& size, const ImageBufferData& data)
 {
-    return CGImageCreate(size.width(), size.height(), 8, data.m_grayScale ? 8 : 32, data.m_bytesPerRow,
-                         data.m_colorSpace.get(), data.m_bitmapInfo, data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
+    return CGImageCreate(size.width(), size.height(), 8, 32, data.m_bytesPerRow,
+                         data.m_colorSpace, data.m_bitmapInfo, data.m_dataProvider.get(), 0, true, kCGRenderingIntentDefault);
 }
 
 void ImageBuffer::draw(GraphicsContext* destContext, ColorSpace styleColorSpace, const FloatRect& destRect, const FloatRect& srcRect,
@@ -145,7 +137,7 @@ void ImageBuffer::draw(GraphicsContext* destContext, ColorSpace styleColorSpace,
     if (destContext == context()) {
         // We're drawing into our own buffer.  In order for this to work, we need to copy the source buffer first.
         RefPtr<Image> copy = copyImage();
-        destContext->drawImage(copy.get(), DeviceColorSpace, destRect, srcRect, op, useLowQualityScale);
+        destContext->drawImage(copy.get(), ColorSpaceDeviceRGB, destRect, srcRect, op, useLowQualityScale);
     } else {
         RefPtr<Image> imageForRendering = BitmapImage::create(cgImage(m_size, m_data));
         destContext->drawImage(imageForRendering.get(), styleColorSpace, destRect, srcRect, op, useLowQualityScale);
@@ -371,7 +363,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     base64Encode(reinterpret_cast<const char*>(CFDataGetBytePtr(data.get())), CFDataGetLength(data.get()), out);
     out.append('\0');
 
-    return String::format("data:%s;base64,%s", mimeType.utf8().data(), out.data());
+    return makeString("data:", mimeType, ";base64,", out.data());
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/cg/ImageBufferData.h b/WebCore/platform/graphics/cg/ImageBufferData.h
index 2f9d854..456c934 100644
--- a/WebCore/platform/graphics/cg/ImageBufferData.h
+++ b/WebCore/platform/graphics/cg/ImageBufferData.h
@@ -46,9 +46,8 @@ public:
     
     RetainPtr<CGDataProviderRef> m_dataProvider;
     CGBitmapInfo m_bitmapInfo;
-    bool m_grayScale;
     unsigned m_bytesPerRow;
-    RetainPtr<CGColorSpaceRef> m_colorSpace;
+    CGColorSpaceRef m_colorSpace;
 };
 
 }  // namespace WebCore
diff --git a/WebCore/platform/graphics/cg/ImageCG.cpp b/WebCore/platform/graphics/cg/ImageCG.cpp
index 70a80a0..c7ed0c8 100644
--- a/WebCore/platform/graphics/cg/ImageCG.cpp
+++ b/WebCore/platform/graphics/cg/ImageCG.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2004, 2005, 2006 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -31,12 +31,12 @@
 #include "AffineTransform.h"
 #include "FloatConversion.h"
 #include "FloatRect.h"
-#include "GraphicsContext.h"
-#include "GraphicsContextPlatformPrivateCG.h"
+#include "GraphicsContextCG.h"
 #include "ImageObserver.h"
 #include "PDFDocumentImage.h"
 #include "PlatformString.h"
 #include <ApplicationServices/ApplicationServices.h>
+#include <wtf/RetainPtr.h>
 
 #if PLATFORM(MAC) || PLATFORM(CHROMIUM)
 #include "WebCoreSystemInterface.h"
@@ -138,11 +138,12 @@ static RetainPtr<CGImageRef> imageWithColorSpace(CGImageRef originalImage, Color
         return originalImage;
 
     switch (colorSpace) {
-    case DeviceColorSpace:
+    case ColorSpaceDeviceRGB:
         return originalImage;
-    case sRGBColorSpace:
-        return RetainPtr<CGImageRef>(AdoptCF, CGImageCreateCopyWithColorSpace(originalImage, 
-            sRGBColorSpaceRef()));
+    case ColorSpaceSRGB:
+        return RetainPtr<CGImageRef>(AdoptCF, CGImageCreateCopyWithColorSpace(originalImage, sRGBColorSpaceRef()));
+    case ColorSpaceLinearRGB:
+        return RetainPtr<CGImageRef>(AdoptCF, CGImageCreateCopyWithColorSpace(originalImage, linearRGBColorSpaceRef()));
     }
 
     ASSERT_NOT_REACHED();
@@ -186,7 +187,7 @@ void BitmapImage::draw(GraphicsContext* ctxt, const FloatRect& destRect, const F
         // containing only the portion we want to display. We need to do this because high-quality
         // interpolation smoothes sharp edges, causing pixels from outside the source rect to bleed
         // into the destination rect. See <rdar://problem/6112909>.
-        shouldUseSubimage = (interpolationQuality == kCGInterpolationHigh || interpolationQuality == kCGInterpolationDefault) && srcRect.size() != destRect.size();
+        shouldUseSubimage = (interpolationQuality == kCGInterpolationHigh || interpolationQuality == kCGInterpolationDefault) && (srcRect.size() != destRect.size() || !ctxt->getCTM().isIdentityOrTranslationOrFlipped());
         float xScale = srcRect.width() / destRect.width();
         float yScale = srcRect.height() / destRect.height();
         if (shouldUseSubimage) {
diff --git a/WebCore/platform/graphics/cg/PathCG.cpp b/WebCore/platform/graphics/cg/PathCG.cpp
index 90d4b8a..b47ed02 100644
--- a/WebCore/platform/graphics/cg/PathCG.cpp
+++ b/WebCore/platform/graphics/cg/PathCG.cpp
@@ -254,61 +254,9 @@ FloatPoint Path::currentPoint() const
     return CGPathGetCurrentPoint(m_path);
 }
 
-static void CGPathToCFStringApplierFunction(void* info, const CGPathElement *element)
-{
-    CFMutableStringRef string = static_cast<CFMutableStringRef>(info);
-
-    CGPoint* points = element->points;
-    switch (element->type) {
-    case kCGPathElementMoveToPoint:
-        CFStringAppendFormat(string, 0, CFSTR("M%.2f,%.2f "), points[0].x, points[0].y);
-        break;
-    case kCGPathElementAddLineToPoint:
-        CFStringAppendFormat(string, 0, CFSTR("L%.2f,%.2f "), points[0].x, points[0].y);
-        break;
-    case kCGPathElementAddQuadCurveToPoint:
-        CFStringAppendFormat(string, 0, CFSTR("Q%.2f,%.2f,%.2f,%.2f "),
-                points[0].x, points[0].y, points[1].x, points[1].y);
-        break;
-    case kCGPathElementAddCurveToPoint:
-        CFStringAppendFormat(string, 0, CFSTR("C%.2f,%.2f,%.2f,%.2f,%.2f,%.2f "),
-                points[0].x, points[0].y, points[1].x, points[1].y,
-                points[2].x, points[2].y);
-        break;
-    case kCGPathElementCloseSubpath:
-        CFStringAppendFormat(string, 0, CFSTR("Z "));
-        break;
-    }
-}
-
-static CFStringRef CFStringFromCGPath(CGPathRef path)
-{
-    if (!path)
-        return 0;
-
-    CFMutableStringRef string = CFStringCreateMutable(NULL, 0);
-    CGPathApply(path, string, CGPathToCFStringApplierFunction);
-    CFStringTrimWhitespace(string);
-
-
-    return string;
-}
-
-
 #pragma mark -
 #pragma mark Path Management
 
-String Path::debugString() const
-{
-    String result;
-    if (!isEmpty()) {
-        CFStringRef pathString = CFStringFromCGPath(m_path);
-        result = String(pathString);
-        CFRelease(pathString);
-    }
-    return result;
-}
-
 struct PathApplierInfo {
     void* info;
     PathApplierFunction function;
diff --git a/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp b/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
index 8dda4d6..eba5349 100644
--- a/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/ContentLayerChromium.cpp
@@ -43,8 +43,6 @@
 #include "PlatformContextSkia.h"
 #include "skia/ext/platform_canvas.h"
 #elif PLATFORM(CG)
-#include "LocalCurrentGraphicsContext.h"
-
 #include <CoreGraphics/CGBitmapContext.h>
 #endif
 
@@ -121,6 +119,7 @@ PassRefPtr<ContentLayerChromium> ContentLayerChromium::create(GraphicsLayerChrom
 ContentLayerChromium::ContentLayerChromium(GraphicsLayerChromium* owner)
     : LayerChromium(owner)
     , m_contentsTexture(0)
+    , m_skipsDraw(false)
 {
 }
 
@@ -129,16 +128,6 @@ ContentLayerChromium::~ContentLayerChromium()
     cleanupResources();
 }
 
-void ContentLayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
-{
-    // If we're changing layer renderers then we need to free up any resources
-    // allocated by the old renderer.
-    if (layerRenderer() && layerRenderer() != renderer)
-        cleanupResources();
-
-    LayerChromium::setLayerRenderer(renderer);
-}
-
 void ContentLayerChromium::cleanupResources()
 {
     if (layerRenderer()) {
@@ -149,6 +138,42 @@ void ContentLayerChromium::cleanupResources()
     }
 }
 
+bool ContentLayerChromium::requiresClippedUpdateRect() const
+{
+    // To avoid allocating excessively large textures, switch into "large layer mode" if
+    // one of the layer's dimensions is larger than 2000 pixels or the current size
+    // of the visible rect. This is a temporary measure until layer tiling is implemented.
+    static const int maxLayerSize = 2000;
+    return (m_bounds.width() > max(maxLayerSize, layerRenderer()->rootLayerContentRect().width())
+            || m_bounds.height() > max(maxLayerSize, layerRenderer()->rootLayerContentRect().height())
+            || !layerRenderer()->checkTextureSize(m_bounds));
+}
+
+void ContentLayerChromium::calculateClippedUpdateRect(IntRect& dirtyRect, IntRect& drawRect) const
+{
+    // For the given layer size and content rect, calculate:
+    // 1) The minimal texture space rectangle to be uploaded, returned in dirtyRect.
+    // 2) The content rect-relative rectangle to draw this texture in, returned in drawRect.
+
+    const IntRect clipRect = layerRenderer()->currentScissorRect();
+    const TransformationMatrix& transform = drawTransform();
+    // The layer's draw transform points to the center of the layer, relative to
+    // the content rect.  layerPos is the distance from the top left of the
+    // layer to the top left of the content rect.
+    const IntPoint layerPos(m_bounds.width() / 2 - transform.m41(),
+                            m_bounds.height() / 2 - transform.m42());
+    // Transform the contentRect into the space of the layer.
+    IntRect contentRectInLayerSpace(layerPos, clipRect.size());
+
+    // Clip the entire layer against the visible region in the content rect
+    // and use that as the drawable texture, instead of the entire layer.
+    dirtyRect = IntRect(IntPoint(0, 0), m_bounds);
+    dirtyRect.intersect(contentRectInLayerSpace);
+
+    // The draw position is relative to the content rect.
+    drawRect = IntRect(toPoint(dirtyRect.location() - layerPos), dirtyRect.size());
+}
+
 void ContentLayerChromium::updateContents()
 {
     RenderLayerBacking* backing = static_cast<RenderLayerBacking*>(m_owner->client());
@@ -159,29 +184,47 @@ void ContentLayerChromium::updateContents()
 
     ASSERT(layerRenderer());
 
-    // FIXME: Remove this test when tiled layers are implemented.
-    m_skipsDraw = false;
-    if (!layerRenderer()->checkTextureSize(m_bounds)) {
-        m_skipsDraw = true;
-        return;
-    }
-
     void* pixels = 0;
-    IntRect dirtyRect(m_dirtyRect);
+    IntRect dirtyRect;
+    IntRect updateRect;
     IntSize requiredTextureSize;
     IntSize bitmapSize;
 
-    requiredTextureSize = m_bounds;
-    IntRect boundsRect(IntPoint(0, 0), m_bounds);
-
-    // If the texture needs to be reallocated then we must redraw the entire
-    // contents of the layer.
-    if (requiredTextureSize != m_allocatedTextureSize)
-        dirtyRect = boundsRect;
-    else {
-        // Clip the dirtyRect to the size of the layer to avoid drawing outside
-        // the bounds of the backing texture.
-        dirtyRect.intersect(boundsRect);
+    // FIXME: Remove this test when tiled layers are implemented.
+    if (requiresClippedUpdateRect()) {
+        // A layer with 3D transforms could require an arbitrarily large number
+        // of texels to be repainted, so ignore these layers until tiling is
+        // implemented.
+        if (!drawTransform().isIdentityOrTranslation()) {
+            m_skipsDraw = true;
+            return;
+        }
+
+        calculateClippedUpdateRect(dirtyRect, m_largeLayerDrawRect);
+        if (!layerRenderer()->checkTextureSize(m_largeLayerDrawRect.size())) {
+            m_skipsDraw = true;
+            return;
+        }
+        if (m_largeLayerDirtyRect == dirtyRect)
+            return;
+
+        m_largeLayerDirtyRect = dirtyRect;
+        requiredTextureSize = dirtyRect.size();
+        updateRect = IntRect(IntPoint(0, 0), dirtyRect.size());
+    } else {
+        dirtyRect = IntRect(m_dirtyRect);
+        IntRect boundsRect(IntPoint(0, 0), m_bounds);
+        requiredTextureSize = m_bounds;
+        // If the texture needs to be reallocated then we must redraw the entire
+        // contents of the layer.
+        if (requiredTextureSize != m_allocatedTextureSize)
+            dirtyRect = boundsRect;
+        else {
+            // Clip the dirtyRect to the size of the layer to avoid drawing
+            // outside the bounds of the backing texture.
+            dirtyRect.intersect(boundsRect);
+        }
+        updateRect = dirtyRect;
     }
 
 #if PLATFORM(SKIA)
@@ -228,7 +271,6 @@ void ContentLayerChromium::updateContents()
     CGContextScaleCTM(contextCG.get(), 1, -1);
 
     GraphicsContext graphicsContext(contextCG.get());
-    LocalCurrentGraphicsContext scopedNSGraphicsContext(&graphicsContext);
 
     // Translate the graphics context into the coordinate system of the dirty rect.
     graphicsContext.translate(-dirtyRect.x(), -dirtyRect.y());
@@ -246,7 +288,7 @@ void ContentLayerChromium::updateContents()
         textureId = layerRenderer()->createLayerTexture();
 
     if (pixels)
-        updateTextureRect(pixels, bitmapSize, requiredTextureSize,  dirtyRect, textureId);
+        updateTextureRect(pixels, bitmapSize, requiredTextureSize, updateRect, textureId);
 }
 
 void ContentLayerChromium::updateTextureRect(void* pixels, const IntSize& bitmapSize, const IntSize& requiredTextureSize, const IntRect& updateRect, unsigned textureId)
@@ -272,7 +314,8 @@ void ContentLayerChromium::updateTextureRect(void* pixels, const IntSize& bitmap
     }
 
     m_dirtyRect.setSize(FloatSize());
-    m_contentsDirty = false;
+    // Large layers always stay dirty, because they need to update when the content rect changes.
+    m_contentsDirty = requiresClippedUpdateRect();
 }
 
 void ContentLayerChromium::draw()
@@ -288,9 +331,21 @@ void ContentLayerChromium::draw()
     GLC(context, context->bindTexture(GraphicsContext3D::TEXTURE_2D, m_contentsTexture));
     layerRenderer()->useShader(sv->contentShaderProgram());
     GLC(context, context->uniform1i(sv->shaderSamplerLocation(), 0));
-    drawTexturedQuad(context, layerRenderer()->projectionMatrix(), drawTransform(),
-                     bounds().width(), bounds().height(), drawOpacity(),
-                     sv->shaderMatrixLocation(), sv->shaderAlphaLocation());
+
+    if (requiresClippedUpdateRect()) {
+        float m43 = drawTransform().m43();
+        TransformationMatrix transform;
+        transform.translate3d(m_largeLayerDrawRect.center().x(), m_largeLayerDrawRect.center().y(), m43);
+        drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
+                         transform, m_largeLayerDrawRect.width(),
+                         m_largeLayerDrawRect.height(), drawOpacity(),
+                         sv->shaderMatrixLocation(), sv->shaderAlphaLocation());
+    } else {
+        drawTexturedQuad(context, layerRenderer()->projectionMatrix(),
+                         drawTransform(), m_bounds.width(), m_bounds.height(),
+                         drawOpacity(), sv->shaderMatrixLocation(),
+                         sv->shaderAlphaLocation());
+    }
 }
 
 }
diff --git a/WebCore/platform/graphics/chromium/ContentLayerChromium.h b/WebCore/platform/graphics/chromium/ContentLayerChromium.h
index 412ba06..32c2c49 100644
--- a/WebCore/platform/graphics/chromium/ContentLayerChromium.h
+++ b/WebCore/platform/graphics/chromium/ContentLayerChromium.h
@@ -49,7 +49,6 @@ public:
     virtual void updateContents();
     virtual void draw();
     virtual bool drawsContent() { return m_owner && m_owner->drawsContent(); }
-    virtual void setLayerRenderer(LayerRendererChromium*);
 
     // Stores values that are shared between instances of this class that are
     // associated with the same LayerRendererChromium (and hence the same GL
@@ -80,12 +79,17 @@ protected:
     void updateTextureRect(void* pixels, const IntSize& bitmapSize, const IntSize& requiredTextureSize,
                            const IntRect& updateRect, unsigned textureId);
 
-    void cleanupResources();
+    virtual void cleanupResources();
+    bool requiresClippedUpdateRect() const;
 
     unsigned m_contentsTexture;
     IntSize m_allocatedTextureSize;
     bool m_skipsDraw;
 
+private:
+    void calculateClippedUpdateRect(IntRect& dirtyRect, IntRect& drawRect) const;
+    IntRect m_largeLayerDrawRect;
+    IntRect m_largeLayerDirtyRect;
 };
 
 }
diff --git a/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp b/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
index 9ce0efe..b54a427 100644
--- a/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
+++ b/WebCore/platform/graphics/chromium/DrawingBufferChromium.cpp
@@ -48,7 +48,7 @@ struct DrawingBufferInternal {
 #endif
 };
 
-static unsigned generateColorTexture(SharedGraphicsContext3D* context, const IntSize& size)
+static unsigned generateColorTexture(GraphicsContext3D* context, const IntSize& size)
 {
     unsigned offscreenColorTexture = context->createTexture();
     if (!offscreenColorTexture)
@@ -66,13 +66,13 @@ static unsigned generateColorTexture(SharedGraphicsContext3D* context, const Int
 }
 
 
-DrawingBuffer::DrawingBuffer(SharedGraphicsContext3D* context, const IntSize& size, unsigned framebuffer)
+DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size)
     : m_context(context)
     , m_size(size)
-    , m_framebuffer(framebuffer)
+    , m_fbo(context->createFramebuffer())
     , m_internal(new DrawingBufferInternal)
 {
-    context->bindFramebuffer(framebuffer);
+    context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
     m_internal->offscreenColorTexture = generateColorTexture(context, size);
 }
 
@@ -82,14 +82,22 @@ DrawingBuffer::~DrawingBuffer()
     if (m_internal->platformLayer)
         m_internal->platformLayer->setDrawingBuffer(0);
 #endif
-    m_context->bindFramebuffer(m_framebuffer);
+
+    if (!m_context)
+        return;
+        
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
     m_context->deleteTexture(m_internal->offscreenColorTexture);
-    m_context->deleteFramebuffer(m_framebuffer);
+
+    clear();
 }
 
 #if USE(ACCELERATED_COMPOSITING)
 void DrawingBuffer::publishToPlatformLayer()
 {
+    if (!m_context)
+        return;
+        
     if (m_callback)
         m_callback->willPublish();
     unsigned parentTexture = m_internal->platformLayer->textureId();
@@ -106,6 +114,9 @@ void DrawingBuffer::publishToPlatformLayer()
 
 void DrawingBuffer::reset(const IntSize& newSize)
 {
+    if (!m_context)
+        return;
+        
     if (m_size == newSize)
         return;
     m_size = newSize;
diff --git a/WebCore/platform/graphics/chromium/FontLinux.cpp b/WebCore/platform/graphics/chromium/FontLinux.cpp
index a242523..f38273c 100644
--- a/WebCore/platform/graphics/chromium/FontLinux.cpp
+++ b/WebCore/platform/graphics/chromium/FontLinux.cpp
@@ -161,62 +161,23 @@ static int truncateFixedPointToInteger(HB_Fixed value)
 // can call |reset| to start over again.
 class TextRunWalker {
 public:
-    TextRunWalker(const TextRun& run, unsigned startingX, const Font* font)
-        : m_font(font)
-        , m_startingX(startingX)
-        , m_offsetX(m_startingX)
-        , m_run(getTextRun(run))
-        , m_iterateBackwards(m_run.rtl())
-        , m_wordSpacingAdjustment(0)
-        , m_padding(0)
-        , m_padError(0)
-    {
-        // Do not use |run| inside this constructor. Use |m_run| instead.
-
-        memset(&m_item, 0, sizeof(m_item));
-        // We cannot know, ahead of time, how many glyphs a given script run
-        // will produce. We take a guess that script runs will not produce more
-        // than twice as many glyphs as there are code points plus a bit of
-        // padding and fallback if we find that we are wrong.
-        createGlyphArrays((m_run.length() + 2) * 2);
-
-        m_item.log_clusters = new unsigned short[m_run.length()];
-
-        m_item.face = 0;
-        m_item.font = allocHarfbuzzFont();
-
-        m_item.item.bidiLevel = m_run.rtl();
-
-        int length = m_run.length();
-        m_item.stringLength = length;
-
-        if (!m_item.item.bidiLevel)
-            m_item.string = m_run.characters();
-        else {
-            // Assume mirrored character is in the same Unicode multilingual plane as the original one.
-            UChar* string = new UChar[length];
-            mirrorCharacters(string, m_run.characters(), length);
-            m_item.string = string;
-        }
-
-        reset();
-    }
+    TextRunWalker(const TextRun&, unsigned, const Font*);
+    ~TextRunWalker();
 
-    ~TextRunWalker()
-    {
-        fastFree(m_item.font);
-        deleteGlyphArrays();
-        delete[] m_item.log_clusters;
-        if (m_item.item.bidiLevel)
-            delete[] m_item.string;
-    }
+    bool isWordBreak(unsigned, bool);
+    // setPadding sets a number of pixels to be distributed across the TextRun.
+    // WebKit uses this to justify text.
+    void setPadding(int);
+    void reset();
+    void setBackwardsIteration(bool);
+    // Advance to the next script run, returning false when the end of the
+    // TextRun has been reached.
+    bool nextScriptRun();
+    float widthOfFullRun();
 
     // setWordSpacingAdjustment sets a delta (in pixels) which is applied at
     // each word break in the TextRun.
-    void setWordSpacingAdjustment(int wordSpacingAdjustment)
-    {
-        m_wordSpacingAdjustment = wordSpacingAdjustment;
-    }
+    void setWordSpacingAdjustment(int wordSpacingAdjustment) { m_wordSpacingAdjustment = wordSpacingAdjustment; }
 
     // setLetterSpacingAdjustment sets an additional number of pixels that is
     // added to the advance after each output cluster. This matches the behaviour
@@ -224,393 +185,431 @@ public:
     //
     // (NOTE: currently does nothing because I don't know how to get the
     // cluster information from Harfbuzz.)
-    void setLetterSpacingAdjustment(int letterSpacingAdjustment)
-    {
-        m_letterSpacing = letterSpacingAdjustment;
-    }
-
-    bool isWordBreak(unsigned i, bool isRTL)
-    {
-        if (!isRTL)
-            return i && isCodepointSpace(m_item.string[i]) && !isCodepointSpace(m_item.string[i - 1]);
-        return i != m_item.stringLength - 1 && isCodepointSpace(m_item.string[i]) && !isCodepointSpace(m_item.string[i + 1]);
-    }
-
-    // setPadding sets a number of pixels to be distributed across the TextRun.
-    // WebKit uses this to justify text.
-    void setPadding(int padding)
-    {
-        m_padding = padding;
-        if (!m_padding)
-            return;
-
-        // If we have padding to distribute, then we try to give an equal
-        // amount to each space. The last space gets the smaller amount, if
-        // any.
-        unsigned numWordBreaks = 0;
-        bool isRTL = m_iterateBackwards;
-
-        for (unsigned i = 0; i < m_item.stringLength; i++) {
-            if (isWordBreak(i, isRTL))
-                numWordBreaks++;
-        }
-
-        if (numWordBreaks)
-            m_padPerWordBreak = m_padding / numWordBreaks;
-        else
-            m_padPerWordBreak = 0;
-    }
-
-    void reset()
-    {
-        if (m_iterateBackwards)
-            m_indexOfNextScriptRun = m_run.length() - 1;
-        else
-            m_indexOfNextScriptRun = 0;
-        m_offsetX = m_startingX;
-    }
+    void setLetterSpacingAdjustment(int letterSpacingAdjustment) { m_letterSpacing = letterSpacingAdjustment; }
 
     // Set the x offset for the next script run. This affects the values in
     // |xPositions|
-    void setXOffsetToZero()
-    {
-        m_offsetX = 0;
-    }
-
-    bool rtl() const
-    {
-        return m_run.rtl();
-    }
-
-    void setBackwardsIteration(bool isBackwards)
-    {
-        m_iterateBackwards = isBackwards;
-        reset();
-    }
-
-    // Advance to the next script run, returning false when the end of the
-    // TextRun has been reached.
-    bool nextScriptRun()
-    {
-        if (m_iterateBackwards) {
-            // In right-to-left mode we need to render the shaped glyph backwards and
-            // also render the script runs themselves backwards. So given a TextRun:
-            //    AAAAAAACTTTTTTT   (A = Arabic, C = Common, T = Thai)
-            // we render:
-            //    TTTTTTCAAAAAAA
-            // (and the glyphs in each A, C and T section are backwards too)
-            if (!hb_utf16_script_run_prev(&m_numCodePoints, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
-                return false;
-        } else {
-            if (!hb_utf16_script_run_next(&m_numCodePoints, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
-                return false;
-
-            // It is actually wrong to consider script runs at all in this code.
-            // Other WebKit code (e.g. Mac) segments complex text just by finding
-            // the longest span of text covered by a single font.
-            // But we currently need to call hb_utf16_script_run_next anyway to fill
-            // in the harfbuzz data structures to e.g. pick the correct script's shaper.
-            // So we allow that to run first, then do a second pass over the range it
-            // found and take the largest subregion that stays within a single font.
-            const FontData* glyphData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false, false).fontData;
-            unsigned endOfRun;
-            for (endOfRun = 1; endOfRun < m_item.item.length; ++endOfRun) {
-                const FontData* nextGlyphData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos + endOfRun], false, false).fontData;
-                if (nextGlyphData != glyphData)
-                    break;
-            }
-            m_item.item.length = endOfRun;
-            m_indexOfNextScriptRun = m_item.item.pos + endOfRun;
-        }
-
-        setupFontForScriptRun();
-        shapeGlyphs();
-        setGlyphXPositions(rtl());
-
-        return true;
-    }
-
-    const uint16_t* glyphs() const
-    {
-        return m_glyphs16;
-    }
+    void setXOffsetToZero() { m_offsetX = 0; }
+    bool rtl() const { return m_run.rtl(); }
+    const uint16_t* glyphs() const { return m_glyphs16; }
 
     // Return the length of the array returned by |glyphs|
-    const unsigned length() const
-    {
-        return m_item.num_glyphs;
-    }
+    const unsigned length() const { return m_item.num_glyphs; }
 
     // Return the x offset for each of the glyphs. Note that this is translated
     // by the current x offset and that the x offset is updated for each script
     // run.
-    const SkScalar* xPositions() const
-    {
-        return m_xPositions;
-    }
+    const SkScalar* xPositions() const { return m_xPositions; }
 
     // Get the advances (widths) for each glyph.
-    const HB_Fixed* advances() const
-    {
-        return m_item.advances;
-    }
+    const HB_Fixed* advances() const { return m_item.advances; }
 
     // Return the width (in px) of the current script run.
-    const unsigned width() const
-    {
-        return m_pixelWidth;
-    }
+    const unsigned width() const { return m_pixelWidth; }
 
     // Return the cluster log for the current script run. For example:
     //   script run: f i a n c é  (fi gets ligatured)
     //   log clutrs: 0 0 1 2 3 4
     // So, for each input code point, the log tells you which output glyph was
     // generated for it.
-    const unsigned short* logClusters() const
-    {
-        return m_item.log_clusters;
-    }
+    const unsigned short* logClusters() const { return m_item.log_clusters; }
 
     // return the number of code points in the current script run
-    const unsigned numCodePoints() const
-    {
-        return m_numCodePoints;
-    }
+    const unsigned numCodePoints() const { return m_numCodePoints; }
 
-    const FontPlatformData* fontPlatformDataForScriptRun()
-    {
-        return reinterpret_cast<FontPlatformData*>(m_item.font->userData);
-    }
+    const FontPlatformData* fontPlatformDataForScriptRun() { return reinterpret_cast<FontPlatformData*>(m_item.font->userData); }
 
-    float widthOfFullRun()
-    {
-        float widthSum = 0;
-        while (nextScriptRun())
-            widthSum += width();
+private:
+    const TextRun& getTextRun(const TextRun&);
+    const TextRun& getNormalizedTextRun(const TextRun&);
+    void setupFontForScriptRun();
+    HB_FontRec* allocHarfbuzzFont();
+    void deleteGlyphArrays();
+    void createGlyphArrays(int);
+    void resetGlyphArrays();
+    void shapeGlyphs();
+    void setGlyphXPositions(bool);
+    void mirrorCharacters(UChar*, const UChar*, int) const;
+
+    // This matches the logic in RenderBlock::findNextLineBreak
+    static bool isCodepointSpace(HB_UChar16 c) { return c == ' ' || c == '\t'; }
 
-        return widthSum;
-    }
+    const Font* const m_font;
+    HB_ShaperItem m_item;
+    uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
+    SkScalar* m_xPositions; // A vector of x positions for each glyph.
+    ssize_t m_indexOfNextScriptRun; // Indexes the script run in |m_run|.
+    const unsigned m_startingX; // Offset in pixels of the first script run.
+    unsigned m_offsetX; // Offset in pixels to the start of the next script run.
+    unsigned m_pixelWidth; // Width (in px) of the current script run.
+    unsigned m_numCodePoints; // Code points in current script run.
+    unsigned m_glyphsArrayCapacity; // Current size of all the Harfbuzz arrays.
 
-private:
-    const TextRun& getTextRun(const TextRun& originalRun)
-    {
-        // Normalize the text run in two ways:
-        // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
-        // (U+0300..) are used in the run. This conversion is necessary since most OpenType
-        // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
-        // their GSUB tables.
-        //
-        // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
-        // the API returns FALSE (= not normalized) for complex runs that don't require NFC
-        // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
-        // Harfbuzz will do the same thing for us using the GSUB table.
-        // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
-        // for characters like '\n' otherwise.
-        for (int i = 0; i < originalRun.length(); ++i) {
-            UChar ch = originalRun[i];
-            UBlockCode block = ::ublock_getCode(ch);
-            if (block == UBLOCK_COMBINING_DIACRITICAL_MARKS || (Font::treatAsSpace(ch) && ch != ' ')) {
-                return getNormalizedTextRun(originalRun);
-            }
-        }
-        return originalRun;
-    }
+    OwnPtr<TextRun> m_normalizedRun;
+    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
+    const TextRun& m_run;
+    bool m_iterateBackwards;
+    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
+    float m_padding; // pixels to be distributed over the line at word breaks.
+    float m_padPerWordBreak; // pixels to be added to each word break.
+    float m_padError; // |m_padPerWordBreak| might have a fractional component.
+                      // Since we only add a whole number of padding pixels at
+                      // each word break we accumulate error. This is the
+                      // number of pixels that we are behind so far.
+    unsigned m_letterSpacing; // pixels to be added after each glyph.
+};
 
-    const TextRun& getNormalizedTextRun(const TextRun& originalRun)
-    {
-        icu::UnicodeString normalizedString;
-        UErrorCode error = U_ZERO_ERROR;
-        icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(), originalRun.length()), UNORM_NFC, 0 /* no options */, normalizedString, error);
-        if (U_FAILURE(error))
-            return originalRun;
-
-        m_normalizedBuffer.set(new UChar[normalizedString.length() + 1]);
-        normalizedString.extract(m_normalizedBuffer.get(), normalizedString.length() + 1, error);
-        ASSERT(U_SUCCESS(error));
-
-        for (int i = 0; i < normalizedString.length(); ++i) {
-            if (Font::treatAsSpace(m_normalizedBuffer[i]))
-                m_normalizedBuffer[i] = ' ';
-        }
 
-        m_normalizedRun.set(new TextRun(originalRun));
-        m_normalizedRun->setText(m_normalizedBuffer.get(), normalizedString.length());
-        return *m_normalizedRun;
-    }
+TextRunWalker::TextRunWalker(const TextRun& run, unsigned startingX, const Font* font)
+    : m_font(font)
+    , m_startingX(startingX)
+    , m_offsetX(m_startingX)
+    , m_run(getTextRun(run))
+    , m_iterateBackwards(m_run.rtl())
+    , m_wordSpacingAdjustment(0)
+    , m_padding(0)
+    , m_padError(0)
+{
+    // Do not use |run| inside this constructor. Use |m_run| instead.
 
-    void setupFontForScriptRun()
-    {
-        const FontData* fontData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false, false).fontData;
-        const FontPlatformData& platformData = fontData->fontDataForCharacter(' ')->platformData();
-        m_item.face = platformData.harfbuzzFace();
-        void* opaquePlatformData = const_cast<FontPlatformData*>(&platformData);
-        m_item.font->userData = opaquePlatformData;
-    }
+    memset(&m_item, 0, sizeof(m_item));
+    // We cannot know, ahead of time, how many glyphs a given script run
+    // will produce. We take a guess that script runs will not produce more
+    // than twice as many glyphs as there are code points plus a bit of
+    // padding and fallback if we find that we are wrong.
+    createGlyphArrays((m_run.length() + 2) * 2);
 
-    HB_FontRec* allocHarfbuzzFont()
-    {
-        HB_FontRec* font = reinterpret_cast<HB_FontRec*>(fastMalloc(sizeof(HB_FontRec)));
-        memset(font, 0, sizeof(HB_FontRec));
-        font->klass = &harfbuzzSkiaClass;
-        font->userData = 0;
-        // The values which harfbuzzSkiaClass returns are already scaled to
-        // pixel units, so we just set all these to one to disable further
-        // scaling.
-        font->x_ppem = 1;
-        font->y_ppem = 1;
-        font->x_scale = 1;
-        font->y_scale = 1;
-
-        return font;
-    }
+    m_item.log_clusters = new unsigned short[m_run.length()];
+
+    m_item.face = 0;
+    m_item.font = allocHarfbuzzFont();
+
+    m_item.item.bidiLevel = m_run.rtl();
 
-    void deleteGlyphArrays()
-    {
-        delete[] m_item.glyphs;
-        delete[] m_item.attributes;
-        delete[] m_item.advances;
-        delete[] m_item.offsets;
-        delete[] m_glyphs16;
-        delete[] m_xPositions;
+    int length = m_run.length();
+    m_item.stringLength = length;
+
+    if (!m_item.item.bidiLevel)
+        m_item.string = m_run.characters();
+    else {
+        // Assume mirrored character is in the same Unicode multilingual plane as the original one.
+        UChar* string = new UChar[length];
+        mirrorCharacters(string, m_run.characters(), length);
+        m_item.string = string;
     }
 
-    void createGlyphArrays(int size)
-    {
-        m_item.glyphs = new HB_Glyph[size];
-        memset(m_item.glyphs, 0, size * sizeof(HB_Glyph));
-        m_item.attributes = new HB_GlyphAttributes[size];
-        memset(m_item.attributes, 0, size * sizeof(HB_GlyphAttributes));
-        m_item.advances = new HB_Fixed[size];
-        memset(m_item.advances, 0, size * sizeof(HB_Fixed));
-        m_item.offsets = new HB_FixedPoint[size];
-        memset(m_item.offsets, 0, size * sizeof(HB_FixedPoint));
-
-        m_glyphs16 = new uint16_t[size];
-        m_xPositions = new SkScalar[size];
-
-        m_item.num_glyphs = size;
+    reset();
+}
+
+TextRunWalker::~TextRunWalker()
+{
+    fastFree(m_item.font);
+    deleteGlyphArrays();
+    delete[] m_item.log_clusters;
+    if (m_item.item.bidiLevel)
+        delete[] m_item.string;
+}
+
+bool TextRunWalker::isWordBreak(unsigned index, bool isRTL)
+{
+    if (!isRTL)
+        return index && isCodepointSpace(m_item.string[index]) && !isCodepointSpace(m_item.string[index - 1]);
+    return index != m_item.stringLength - 1 && isCodepointSpace(m_item.string[index]) && !isCodepointSpace(m_item.string[index + 1]);
+}
+
+// setPadding sets a number of pixels to be distributed across the TextRun.
+// WebKit uses this to justify text.
+void TextRunWalker::setPadding(int padding)
+{
+    m_padding = padding;
+    if (!m_padding)
+        return;
+
+    // If we have padding to distribute, then we try to give an equal
+    // amount to each space. The last space gets the smaller amount, if
+    // any.
+    unsigned numWordBreaks = 0;
+    bool isRTL = m_iterateBackwards;
+
+    for (unsigned i = 0; i < m_item.stringLength; i++) {
+        if (isWordBreak(i, isRTL))
+            numWordBreaks++;
     }
 
-    void shapeGlyphs()
-    {
-        for (;;) {
-            if (HB_ShapeItem(&m_item))
-                break;
+    if (numWordBreaks)
+        m_padPerWordBreak = m_padding / numWordBreaks;
+    else
+        m_padPerWordBreak = 0;
+}
+
+void TextRunWalker::reset()
+{
+    if (m_iterateBackwards)
+        m_indexOfNextScriptRun = m_run.length() - 1;
+    else
+        m_indexOfNextScriptRun = 0;
+    m_offsetX = m_startingX;
+}
 
-            // We overflowed our arrays. Resize and retry.
-            // HB_ShapeItem fills in m_item.num_glyphs with the needed size.
-            deleteGlyphArrays();
-            // The |+ 1| here is a workaround for a bug in Harfbuzz: the Khmer
-            // shaper (at least) can fail because of insufficient glyph buffers
-            // and request 0 additional glyphs: throwing us into an infinite
-            // loop.
-            createGlyphArrays(m_item.num_glyphs + 1);
+void TextRunWalker::setBackwardsIteration(bool isBackwards)
+{
+    m_iterateBackwards = isBackwards;
+    reset();
+}
+
+// Advance to the next script run, returning false when the end of the
+// TextRun has been reached.
+bool TextRunWalker::nextScriptRun()
+{
+    if (m_iterateBackwards) {
+        // In right-to-left mode we need to render the shaped glyph backwards and
+        // also render the script runs themselves backwards. So given a TextRun:
+        //    AAAAAAACTTTTTTT   (A = Arabic, C = Common, T = Thai)
+        // we render:
+        //    TTTTTTCAAAAAAA
+        // (and the glyphs in each A, C and T section are backwards too)
+        if (!hb_utf16_script_run_prev(&m_numCodePoints, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
+            return false;
+    } else {
+        if (!hb_utf16_script_run_next(&m_numCodePoints, &m_item.item, m_run.characters(), m_run.length(), &m_indexOfNextScriptRun))
+            return false;
+
+        // It is actually wrong to consider script runs at all in this code.
+        // Other WebKit code (e.g. Mac) segments complex text just by finding
+        // the longest span of text covered by a single font.
+        // But we currently need to call hb_utf16_script_run_next anyway to fill
+        // in the harfbuzz data structures to e.g. pick the correct script's shaper.
+        // So we allow that to run first, then do a second pass over the range it
+        // found and take the largest subregion that stays within a single font.
+        const FontData* glyphData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false, false).fontData;
+        unsigned endOfRun;
+        for (endOfRun = 1; endOfRun < m_item.item.length; ++endOfRun) {
+            const FontData* nextGlyphData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos + endOfRun], false, false).fontData;
+            if (nextGlyphData != glyphData)
+                break;
         }
+        m_item.item.length = endOfRun;
+        m_indexOfNextScriptRun = m_item.item.pos + endOfRun;
     }
 
-    void setGlyphXPositions(bool isRTL)
-    {
-        double position = 0;
-        // logClustersIndex indexes logClusters for the first (or last when
-        // RTL) codepoint of the current glyph.  Each time we advance a glyph,
-        // we skip over all the codepoints that contributed to the current
-        // glyph.
-        unsigned logClustersIndex = isRTL ? m_item.num_glyphs - 1 : 0;
-
-        for (unsigned iter = 0; iter < m_item.num_glyphs; ++iter) {
-            // Glyphs are stored in logical order, but for layout purposes we
-            // always go left to right.
-            int i = isRTL ? m_item.num_glyphs - iter - 1 : iter;
-
-            m_glyphs16[i] = m_item.glyphs[i];
-            double offsetX = truncateFixedPointToInteger(m_item.offsets[i].x);
-            m_xPositions[i] = m_offsetX + position + offsetX;
-
-            double advance = truncateFixedPointToInteger(m_item.advances[i]);
-            // The first half of the conjuction works around the case where
-            // output glyphs aren't associated with any codepoints by the
-            // clusters log.
-            if (logClustersIndex < m_item.item.length
-                && isWordBreak(m_item.item.pos + logClustersIndex, isRTL)) {
-                advance += m_wordSpacingAdjustment;
-
-                if (m_padding > 0) {
-                    unsigned toPad = roundf(m_padPerWordBreak + m_padError);
-                    m_padError += m_padPerWordBreak - toPad;
-
-                    if (m_padding < toPad)
-                        toPad = m_padding;
-                    m_padding -= toPad;
-                    advance += toPad;
-                }
-            }
+    setupFontForScriptRun();
+    shapeGlyphs();
+    setGlyphXPositions(rtl());
 
-            // We would like to add m_letterSpacing after each cluster, but I
-            // don't know where the cluster information is. This is typically
-            // fine for Roman languages, but breaks more complex languages
-            // terribly.
-            // advance += m_letterSpacing;
-
-            if (isRTL) {
-                while (logClustersIndex > 0 && logClusters()[logClustersIndex] == i)
-                    logClustersIndex--;
-            } else {
-                while (logClustersIndex < m_item.item.length && logClusters()[logClustersIndex] == i)
-                    logClustersIndex++;
-            }
+    return true;
+}
 
-            position += advance;
-        }
+float TextRunWalker::widthOfFullRun()
+{
+    float widthSum = 0;
+    while (nextScriptRun())
+        widthSum += width();
 
-        m_pixelWidth = position;
-        m_offsetX += m_pixelWidth;
+    return widthSum;
+}
+
+const TextRun& TextRunWalker::getTextRun(const TextRun& originalRun)
+{
+    // Normalize the text run in two ways:
+    // 1) Convert the |originalRun| to NFC normalized form if combining diacritical marks
+    // (U+0300..) are used in the run. This conversion is necessary since most OpenType
+    // fonts (e.g., Arial) don't have substitution rules for the diacritical marks in
+    // their GSUB tables.
+    //
+    // Note that we don't use the icu::Normalizer::isNormalized(UNORM_NFC) API here since
+    // the API returns FALSE (= not normalized) for complex runs that don't require NFC
+    // normalization (e.g., Arabic text). Unless the run contains the diacritical marks,
+    // Harfbuzz will do the same thing for us using the GSUB table.
+    // 2) Convert spacing characters into plain spaces, as some fonts will provide glyphs
+    // for characters like '\n' otherwise.
+    for (int i = 0; i < originalRun.length(); ++i) {
+        UChar ch = originalRun[i];
+        UBlockCode block = ::ublock_getCode(ch);
+        if (block == UBLOCK_COMBINING_DIACRITICAL_MARKS || (Font::treatAsSpace(ch) && ch != ' '))
+            return getNormalizedTextRun(originalRun);
+    }
+    return originalRun;
+}
+
+const TextRun& TextRunWalker::getNormalizedTextRun(const TextRun& originalRun)
+{
+    icu::UnicodeString normalizedString;
+    UErrorCode error = U_ZERO_ERROR;
+    icu::Normalizer::normalize(icu::UnicodeString(originalRun.characters(), originalRun.length()), UNORM_NFC, 0 /* no options */, normalizedString, error);
+    if (U_FAILURE(error))
+        return originalRun;
+
+    m_normalizedBuffer.set(new UChar[normalizedString.length() + 1]);
+    normalizedString.extract(m_normalizedBuffer.get(), normalizedString.length() + 1, error);
+    ASSERT(U_SUCCESS(error));
+
+    for (int i = 0; i < normalizedString.length(); ++i) {
+        if (Font::treatAsSpace(m_normalizedBuffer[i]))
+            m_normalizedBuffer[i] = ' ';
     }
 
-    static bool isCodepointSpace(HB_UChar16 c)
-    {
-        // This matches the logic in RenderBlock::findNextLineBreak
-        return c == ' ' || c == '\t';
+    m_normalizedRun.set(new TextRun(originalRun));
+    m_normalizedRun->setText(m_normalizedBuffer.get(), normalizedString.length());
+    return *m_normalizedRun;
+}
+
+void TextRunWalker::setupFontForScriptRun()
+{
+    const FontData* fontData = m_font->glyphDataForCharacter(m_item.string[m_item.item.pos], false, false).fontData;
+    const FontPlatformData& platformData = fontData->fontDataForCharacter(' ')->platformData();
+    m_item.face = platformData.harfbuzzFace();
+    void* opaquePlatformData = const_cast<FontPlatformData*>(&platformData);
+    m_item.font->userData = opaquePlatformData;
+}
+
+HB_FontRec* TextRunWalker::allocHarfbuzzFont()
+{
+    HB_FontRec* font = reinterpret_cast<HB_FontRec*>(fastMalloc(sizeof(HB_FontRec)));
+    memset(font, 0, sizeof(HB_FontRec));
+    font->klass = &harfbuzzSkiaClass;
+    font->userData = 0;
+    // The values which harfbuzzSkiaClass returns are already scaled to
+    // pixel units, so we just set all these to one to disable further
+    // scaling.
+    font->x_ppem = 1;
+    font->y_ppem = 1;
+    font->x_scale = 1;
+    font->y_scale = 1;
+
+    return font;
+}
+
+void TextRunWalker::deleteGlyphArrays()
+{
+    delete[] m_item.glyphs;
+    delete[] m_item.attributes;
+    delete[] m_item.advances;
+    delete[] m_item.offsets;
+    delete[] m_glyphs16;
+    delete[] m_xPositions;
+}
+
+void TextRunWalker::createGlyphArrays(int size)
+{
+    m_item.glyphs = new HB_Glyph[size];
+    m_item.attributes = new HB_GlyphAttributes[size];
+    m_item.advances = new HB_Fixed[size];
+    m_item.offsets = new HB_FixedPoint[size];
+
+    m_glyphs16 = new uint16_t[size];
+    m_xPositions = new SkScalar[size];
+
+    m_item.num_glyphs = size;
+    m_glyphsArrayCapacity = size; // Save the GlyphArrays size.
+    resetGlyphArrays();
+}
+
+void TextRunWalker::resetGlyphArrays()
+{
+    int size = m_item.num_glyphs;
+    // All the types here don't have pointers. It is safe to reset to
+    // zero unless Harfbuzz breaks the compatibility in the future.
+    memset(m_item.glyphs, 0, size * sizeof(HB_Glyph));
+    memset(m_item.attributes, 0, size * sizeof(HB_GlyphAttributes));
+    memset(m_item.advances, 0, size * sizeof(HB_Fixed));
+    memset(m_item.offsets, 0, size * sizeof(HB_FixedPoint));
+    memset(m_glyphs16, 0, size * sizeof(uint16_t));
+    memset(m_xPositions, 0, size * sizeof(SkScalar));
+}
+
+void TextRunWalker::shapeGlyphs()
+{
+    // HB_ShapeItem() resets m_item.num_glyphs. If the previous call to
+    // HB_ShapeItem() used less space than was available, the capacity of
+    // the array may be larger than the current value of m_item.num_glyphs. 
+    // So, we need to reset the num_glyphs to the capacity of the array.
+    m_item.num_glyphs = m_glyphsArrayCapacity;
+    resetGlyphArrays();
+    while (!HB_ShapeItem(&m_item)) {
+        // We overflowed our arrays. Resize and retry.
+        // HB_ShapeItem fills in m_item.num_glyphs with the needed size.
+        deleteGlyphArrays();
+        // The |+ 1| here is a workaround for a bug in Harfbuzz: the Khmer
+        // shaper (at least) can fail because of insufficient glyph buffers
+        // and request 0 additional glyphs: throwing us into an infinite
+        // loop.
+        createGlyphArrays(m_item.num_glyphs + 1);
     }
+}
+
+void TextRunWalker::setGlyphXPositions(bool isRTL)
+{
+    double position = 0;
+    // logClustersIndex indexes logClusters for the first (or last when
+    // RTL) codepoint of the current glyph.  Each time we advance a glyph,
+    // we skip over all the codepoints that contributed to the current
+    // glyph.
+    unsigned logClustersIndex = isRTL ? m_item.num_glyphs - 1 : 0;
+
+    for (unsigned iter = 0; iter < m_item.num_glyphs; ++iter) {
+        // Glyphs are stored in logical order, but for layout purposes we
+        // always go left to right.
+        int i = isRTL ? m_item.num_glyphs - iter - 1 : iter;
+
+        m_glyphs16[i] = m_item.glyphs[i];
+        double offsetX = truncateFixedPointToInteger(m_item.offsets[i].x);
+        m_xPositions[i] = m_offsetX + position + offsetX;
+
+        double advance = truncateFixedPointToInteger(m_item.advances[i]);
+        // The first half of the conjuction works around the case where
+        // output glyphs aren't associated with any codepoints by the
+        // clusters log.
+        if (logClustersIndex < m_item.item.length
+            && isWordBreak(m_item.item.pos + logClustersIndex, isRTL)) {
+            advance += m_wordSpacingAdjustment;
+
+            if (m_padding > 0) {
+                unsigned toPad = roundf(m_padPerWordBreak + m_padError);
+                m_padError += m_padPerWordBreak - toPad;
+
+                if (m_padding < toPad)
+                    toPad = m_padding;
+                m_padding -= toPad;
+                advance += toPad;
+            }
+        }
 
-    void mirrorCharacters(UChar* destination, const UChar* source, int length) const
-    {
-        int position = 0;
-        bool error = false;
-        // Iterate characters in source and mirror character if needed.
-        while (position < length) {
-            UChar32 character;
-            int nextPosition = position;
-            U16_NEXT(source, nextPosition, length, character);
-            character = u_charMirror(character);
-            U16_APPEND(destination, position, length, character, error);
-            ASSERT(!error);
-            position = nextPosition;
+        // We would like to add m_letterSpacing after each cluster, but I
+        // don't know where the cluster information is. This is typically
+        // fine for Roman languages, but breaks more complex languages
+        // terribly.
+        // advance += m_letterSpacing;
+
+        if (isRTL) {
+            while (logClustersIndex > 0 && logClusters()[logClustersIndex] == i)
+                logClustersIndex--;
+        } else {
+            while (logClustersIndex < m_item.item.length && logClusters()[logClustersIndex] == i)
+                logClustersIndex++;
         }
+
+        position += advance;
     }
 
-    const Font* const m_font;
-    HB_ShaperItem m_item;
-    uint16_t* m_glyphs16; // A vector of 16-bit glyph ids.
-    SkScalar* m_xPositions; // A vector of x positions for each glyph.
-    ssize_t m_indexOfNextScriptRun; // Indexes the script run in |m_run|.
-    const unsigned m_startingX; // Offset in pixels of the first script run.
-    unsigned m_offsetX; // Offset in pixels to the start of the next script run.
-    unsigned m_pixelWidth; // Width (in px) of the current script run.
-    unsigned m_numCodePoints; // Code points in current script run.
+    m_pixelWidth = position;
+    m_offsetX += m_pixelWidth;
+}
 
-    OwnPtr<TextRun> m_normalizedRun;
-    OwnArrayPtr<UChar> m_normalizedBuffer; // A buffer for normalized run.
-    const TextRun& m_run;
-    bool m_iterateBackwards;
-    int m_wordSpacingAdjustment; // delta adjustment (pixels) for each word break.
-    float m_padding; // pixels to be distributed over the line at word breaks.
-    float m_padPerWordBreak; // pixels to be added to each word break.
-    float m_padError; // |m_padPerWordBreak| might have a fractional component.
-                      // Since we only add a whole number of padding pixels at
-                      // each word break we accumulate error. This is the
-                      // number of pixels that we are behind so far.
-    unsigned m_letterSpacing; // pixels to be added after each glyph.
-};
+void TextRunWalker::mirrorCharacters(UChar* destination, const UChar* source, int length) const
+{
+    int position = 0;
+    bool error = false;
+    // Iterate characters in source and mirror character if needed.
+    while (position < length) {
+        UChar32 character;
+        int nextPosition = position;
+        U16_NEXT(source, nextPosition, length, character);
+        character = u_charMirror(character);
+        U16_APPEND(destination, position, length, character, error);
+        ASSERT(!error);
+        position = nextPosition;
+    }
+}
 
 static void setupForTextPainting(SkPaint* paint, SkColor color)
 {
diff --git a/WebCore/platform/graphics/chromium/GLES2Canvas.cpp b/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
index 46aecf4..697cf5e 100644
--- a/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
+++ b/WebCore/platform/graphics/chromium/GLES2Canvas.cpp
@@ -97,7 +97,7 @@ void GLES2Canvas::clearRect(const FloatRect& rect)
     } else {
         save();
         setCompositeOperation(CompositeClear);
-        fillRect(rect, Color(RGBA32(0)), DeviceColorSpace);
+        fillRect(rect, Color(RGBA32(0)), ColorSpaceDeviceRGB);
         restore();
     }
 }
@@ -120,7 +120,7 @@ void GLES2Canvas::fillRect(const FloatRect& rect, const Color& color, ColorSpace
 
 void GLES2Canvas::fillRect(const FloatRect& rect)
 {
-    fillRect(rect, m_state->m_fillColor, DeviceColorSpace);
+    fillRect(rect, m_state->m_fillColor, ColorSpaceDeviceRGB);
 }
 
 void GLES2Canvas::setFillColor(const Color& color, ColorSpace colorSpace)
diff --git a/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp b/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
index c97be82..afcc98c 100644
--- a/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/ImageLayerChromium.cpp
@@ -75,6 +75,14 @@ void ImageLayerChromium::updateContents()
 {
     ASSERT(layerRenderer());
 
+    // FIXME: Remove this test when tiled layers are implemented.
+    if (requiresClippedUpdateRect()) {
+        // Use the base version of updateContents which draws a subset of the
+        // image to a bitmap, as the pixel contents can't be uploaded directly.
+        ContentLayerChromium::updateContents();
+        return;
+    }
+
     void* pixels = 0;
     IntSize requiredTextureSize;
     IntSize bitmapSize;
@@ -136,12 +144,6 @@ void ImageLayerChromium::updateContents()
 #else
 #error "Need to implement for your platform."
 #endif
-    // FIXME: Remove this test when tiled layers are implemented.
-    m_skipsDraw = false;
-    if (!layerRenderer()->checkTextureSize(requiredTextureSize)) {
-        m_skipsDraw = true;
-        return;
-    }
 
     unsigned textureId = m_contentsTexture;
     if (!textureId)
diff --git a/WebCore/platform/graphics/chromium/LayerChromium.cpp b/WebCore/platform/graphics/chromium/LayerChromium.cpp
index 5dba58d..79f18f0 100644
--- a/WebCore/platform/graphics/chromium/LayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/LayerChromium.cpp
@@ -174,6 +174,11 @@ LayerChromium::~LayerChromium()
 
 void LayerChromium::setLayerRenderer(LayerRendererChromium* renderer)
 {
+    // If we're changing layer renderers then we need to free up any resources
+    // allocated by the old renderer.
+    if (layerRenderer() && layerRenderer() != renderer)
+        cleanupResources();
+
     m_layerRenderer = renderer;
 }
 
@@ -446,15 +451,12 @@ void LayerChromium::drawDebugBorder()
     GLC(context, context->drawElements(GraphicsContext3D::LINE_LOOP, 4, GraphicsContext3D::UNSIGNED_SHORT, 6 * sizeof(unsigned short)));
 }
 
-const FloatRect LayerChromium::getDrawRect() const
+const IntRect LayerChromium::getDrawRect() const
 {
     // Form the matrix used by the shader to map the corners of the layer's
     // bounds into the view space.
-    TransformationMatrix renderMatrix = drawTransform();
-    renderMatrix.scale3d(bounds().width(), bounds().height(), 1);
-
-    FloatRect layerRect(-0.5, -0.5, 1, 1);
-    FloatRect mappedRect = renderMatrix.mapRect(layerRect);
+    FloatRect layerRect(-0.5 * bounds().width(), -0.5 * bounds().height(), bounds().width(), bounds().height());
+    IntRect mappedRect = enclosingIntRect(drawTransform().mapRect(layerRect));
     return mappedRect;
 }
 
diff --git a/WebCore/platform/graphics/chromium/LayerChromium.h b/WebCore/platform/graphics/chromium/LayerChromium.h
index 0a66318..3956e28 100644
--- a/WebCore/platform/graphics/chromium/LayerChromium.h
+++ b/WebCore/platform/graphics/chromium/LayerChromium.h
@@ -156,7 +156,7 @@ public:
     bool contentsDirty() { return m_contentsDirty; }
 
     // Returns the rect containtaining this layer in the current view's coordinate system.
-    const FloatRect getDrawRect() const;
+    const IntRect getDrawRect() const;
 
     // These methods typically need to be overwritten by derived classes.
     virtual bool drawsContent() { return false; }
@@ -202,6 +202,11 @@ protected:
     GraphicsLayerChromium* m_owner;
     LayerChromium(GraphicsLayerChromium* owner);
 
+    // This is called to clean up resources being held in the same context as
+    // layerRendererContext(). Subclasses should override this method if they
+    // hold context-dependent resources such as textures.
+    virtual void cleanupResources() { }
+
     LayerRendererChromium* layerRenderer() const { return m_layerRenderer.get(); }
     GraphicsContext3D* layerRendererContext() const;
 
diff --git a/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp b/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
index c4031e5..e93e296 100644
--- a/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
+++ b/WebCore/platform/graphics/chromium/LayerRendererChromium.cpp
@@ -73,7 +73,7 @@ static inline bool compareLayerZ(const LayerChromium* a, const LayerChromium* b)
     return transformA.m43() < transformB.m43();
 }
 
-PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassOwnPtr<GraphicsContext3D> context)
+PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassRefPtr<GraphicsContext3D> context)
 {
     if (!context)
         return 0;
@@ -85,7 +85,7 @@ PassRefPtr<LayerRendererChromium> LayerRendererChromium::create(PassOwnPtr<Graph
     return layerRenderer.release();
 }
 
-LayerRendererChromium::LayerRendererChromium(PassOwnPtr<GraphicsContext3D> context)
+LayerRendererChromium::LayerRendererChromium(PassRefPtr<GraphicsContext3D> context)
     : m_rootLayerTextureId(0)
     , m_rootLayerTextureWidth(0)
     , m_rootLayerTextureHeight(0)
@@ -127,7 +127,6 @@ void LayerRendererChromium::setRootLayerCanvasSize(const IntSize& size)
     // the old ones.
     m_rootLayerCanvas = new skia::PlatformCanvas(size.width(), size.height(), false);
     m_rootLayerSkiaContext = new PlatformContextSkia(m_rootLayerCanvas.get());
-    m_rootLayerSkiaContext->setDrawingToImageBuffer(true);
     m_rootLayerGraphicsContext = new GraphicsContext(reinterpret_cast<PlatformGraphicsContext*>(m_rootLayerSkiaContext.get()));
 #elif PLATFORM(CG)
     // Release the previous CGBitmapContext before reallocating the backing store as a precaution.
@@ -204,6 +203,8 @@ void LayerRendererChromium::prepareToDrawLayers(const IntRect& visibleRect, cons
     GLC(m_context, m_context->disable(GraphicsContext3D::CULL_FACE));
     GLC(m_context, m_context->depthFunc(GraphicsContext3D::LEQUAL));
     GLC(m_context, m_context->clearStencil(0));
+    // Blending disabled by default. Root layer alpha channel on Windows is incorrect when Skia uses ClearType. 
+    GLC(m_context, m_context->disable(GraphicsContext3D::BLEND)); 
 
     if (m_scrollPosition == IntPoint(-1, -1)) {
         m_scrollPosition = scrollPosition;
@@ -284,11 +285,15 @@ void LayerRendererChromium::drawLayers(const IntRect& visibleRect, const IntRect
     const ContentLayerChromium::SharedValues* contentLayerValues = contentLayerSharedValues();
     useShader(contentLayerValues->contentShaderProgram());
     GLC(m_context, m_context->uniform1i(contentLayerValues->shaderSamplerLocation(), 0));
+    // Mask out writes to alpha channel: ClearType via Skia results in invalid
+    // zero alpha values on text glyphs. The root layer is always opaque.
+    GLC(m_context, m_context->colorMask(true, true, true, false));
     TransformationMatrix layerMatrix;
     layerMatrix.translate3d(visibleRect.width() * 0.5f, visibleRect.height() * 0.5f, 0);
     LayerChromium::drawTexturedQuad(m_context.get(), m_projectionMatrix, layerMatrix,
                                     visibleRect.width(), visibleRect.height(), 1,
                                     contentLayerValues->shaderMatrixLocation(), contentLayerValues->shaderAlphaLocation());
+    GLC(m_context, m_context->colorMask(true, true, true, true));
 
     // If culling is enabled then we will cull the backface.
     GLC(m_context, m_context->cullFace(GraphicsContext3D::BACK));
@@ -302,8 +307,9 @@ void LayerRendererChromium::drawLayers(const IntRect& visibleRect, const IntRect
     GLC(m_context, m_context->enable(GraphicsContext3D::BLEND));
     GLC(m_context, m_context->blendFunc(GraphicsContext3D::ONE, GraphicsContext3D::ONE_MINUS_SRC_ALPHA));
 
-    // Set the rootVisibleRect --- used by subsequent drawLayers calls
+    // Set the root visible/content rects --- used by subsequent drawLayers calls.
     m_rootVisibleRect = visibleRect;
+    m_rootContentRect = contentRect;
 
     // Traverse the layer tree and update the layer transforms.
     float opacity = 1;
@@ -315,7 +321,7 @@ void LayerRendererChromium::drawLayers(const IntRect& visibleRect, const IntRect
 
     // Enable scissoring to avoid rendering composited layers over the scrollbars.
     GLC(m_context, m_context->enable(GraphicsContext3D::SCISSOR_TEST));
-    FloatRect scissorRect(contentRect);
+    IntRect scissorRect(contentRect);
 
     // The scissorRect should not include the scroll offset.
     scissorRect.move(-m_scrollPosition.x(), -m_scrollPosition.y());
@@ -328,9 +334,10 @@ void LayerRendererChromium::drawLayers(const IntRect& visibleRect, const IntRect
 
     // Traverse the layer tree one more time to draw the layers.
     for (size_t i = 0; i < sublayers.size(); i++)
-        drawLayersRecursive(sublayers[i].get(), scissorRect);
+        drawLayersRecursive(sublayers[i].get());
 
     GLC(m_context, m_context->disable(GraphicsContext3D::SCISSOR_TEST));
+    GLC(m_context, m_context->disable(GraphicsContext3D::BLEND));
 }
 
 void LayerRendererChromium::finish()
@@ -494,14 +501,14 @@ void LayerRendererChromium::drawLayerIntoStencilBuffer(LayerChromium* layer, boo
 }
 
 // Recursively walk the layer tree and draw the layers.
-void LayerRendererChromium::drawLayersRecursive(LayerChromium* layer, const FloatRect& scissorRect)
+void LayerRendererChromium::drawLayersRecursive(LayerChromium* layer)
 {
     static bool depthTestEnabledForSubtree = false;
     static int currentStencilValue = 0;
 
     // Check if the layer falls within the visible bounds of the page.
-    FloatRect layerRect = layer->getDrawRect();
-    bool isLayerVisible = scissorRect.intersects(layerRect);
+    IntRect layerRect = layer->getDrawRect();
+    bool isLayerVisible = m_currentScissorRect.intersects(layerRect);
 
     // Enable depth testing for this layer and all its descendants if preserves3D is set.
     bool mustClearDepth = false;
@@ -520,15 +527,16 @@ void LayerRendererChromium::drawLayersRecursive(LayerChromium* layer, const Floa
 
     // FIXME: We should check here if the layer has descendants that draw content
     // before we setup for clipping.
-    FloatRect currentScissorRect = scissorRect;
+    IntRect previousScissorRect = m_currentScissorRect;
     bool mustResetScissorRect = false;
     bool didStencilDraw = false;
     if (layer->masksToBounds()) {
         // If the layer isn't rotated then we can use scissoring otherwise we need
         // to clip using the stencil buffer.
         if (layer->drawTransform().isIdentityOrTranslation()) {
+            IntRect currentScissorRect = previousScissorRect;
             currentScissorRect.intersect(layerRect);
-            if (currentScissorRect != scissorRect) {
+            if (currentScissorRect != previousScissorRect) {
                 scissorToRect(currentScissorRect);
                 mustResetScissorRect = true;
             }
@@ -573,11 +581,11 @@ void LayerRendererChromium::drawLayersRecursive(LayerChromium* layer, const Floa
         std::stable_sort(sublayerList.begin(), sublayerList.end(), compareLayerZ);
 
         for (i = 0; i < sublayerList.size(); i++)
-            drawLayersRecursive(sublayerList[i], currentScissorRect);
+            drawLayersRecursive(sublayerList[i]);
     } else {
         const Vector<RefPtr<LayerChromium> >& sublayers = layer->getSublayers();
         for (size_t i = 0; i < sublayers.size(); i++)
-            drawLayersRecursive(sublayers[i].get(), currentScissorRect);
+            drawLayersRecursive(sublayers[i].get());
     }
 
     if (didStencilDraw) {
@@ -593,7 +601,7 @@ void LayerRendererChromium::drawLayersRecursive(LayerChromium* layer, const Floa
     }
 
     if (mustResetScissorRect) {
-        scissorToRect(scissorRect);
+        scissorToRect(previousScissorRect);
     }
 
     if (mustClearDepth) {
@@ -629,11 +637,12 @@ void LayerRendererChromium::drawLayer(LayerChromium* layer)
 
 // Sets the scissor region to the given rectangle. The coordinate system for the
 // scissorRect has its origin at the top left corner of the current visible rect.
-void LayerRendererChromium::scissorToRect(const FloatRect& scissorRect)
+void LayerRendererChromium::scissorToRect(const IntRect& scissorRect)
 {
     // Compute the lower left corner of the scissor rect.
-    float bottom = std::max((float)m_rootVisibleRect.height() - scissorRect.bottom(), 0.f);
+    int bottom = std::max(m_rootVisibleRect.height() - scissorRect.bottom(), 0);
     GLC(m_context, m_context->scissor(scissorRect.x(), bottom, scissorRect.width(), scissorRect.height()));
+    m_currentScissorRect = scissorRect;
 }
 
 bool LayerRendererChromium::makeContextCurrent()
diff --git a/WebCore/platform/graphics/chromium/LayerRendererChromium.h b/WebCore/platform/graphics/chromium/LayerRendererChromium.h
index b714584..6a06105 100644
--- a/WebCore/platform/graphics/chromium/LayerRendererChromium.h
+++ b/WebCore/platform/graphics/chromium/LayerRendererChromium.h
@@ -59,9 +59,8 @@ class GraphicsContext3D;
 // Class that handles drawing of composited render layers using GL.
 class LayerRendererChromium : public RefCounted<LayerRendererChromium> {
 public:
-    static PassRefPtr<LayerRendererChromium> create(PassOwnPtr<GraphicsContext3D> graphicsContext3D);
+    static PassRefPtr<LayerRendererChromium> create(PassRefPtr<GraphicsContext3D> graphicsContext3D);
 
-    LayerRendererChromium(PassOwnPtr<GraphicsContext3D> graphicsContext3D);
     ~LayerRendererChromium();
 
     GraphicsContext3D* context();
@@ -93,6 +92,8 @@ public:
     unsigned createLayerTexture();
     void deleteLayerTexture(unsigned);
 
+    IntRect currentScissorRect() const { return m_currentScissorRect; }
+
     static void debugGLCall(GraphicsContext3D*, const char* command, const char* file, int line);
 
     const TransformationMatrix& projectionMatrix() const { return m_projectionMatrix; }
@@ -109,12 +110,15 @@ public:
     void resizeOnscreenContent(const IntSize&);
 
     IntSize rootLayerTextureSize() const { return IntSize(m_rootLayerTextureWidth, m_rootLayerTextureHeight); }
+    IntRect rootLayerContentRect() const { return m_rootContentRect; }
     void getFramebufferPixels(void *pixels, const IntRect& rect);
 
 private:
+    explicit LayerRendererChromium(PassRefPtr<GraphicsContext3D> graphicsContext3D);
+
     void updateLayersRecursive(LayerChromium* layer, const TransformationMatrix& parentMatrix, float opacity);
 
-    void drawLayersRecursive(LayerChromium*, const FloatRect& scissorRect);
+    void drawLayersRecursive(LayerChromium*);
 
     void drawLayer(LayerChromium*);
 
@@ -122,7 +126,7 @@ private:
 
     void drawLayerIntoStencilBuffer(LayerChromium*, bool decrement);
 
-    void scissorToRect(const FloatRect&);
+    void scissorToRect(const IntRect&);
 
     bool makeContextCurrent();
 
@@ -160,6 +164,8 @@ private:
     IntSize m_rootLayerCanvasSize;
 
     IntRect m_rootVisibleRect;
+    IntRect m_rootContentRect;
+    IntRect m_currentScissorRect;
 
     int m_maxTextureSize;
 
@@ -174,7 +180,7 @@ private:
     OwnPtr<CanvasLayerChromium::SharedValues> m_canvasLayerSharedValues;
     OwnPtr<VideoLayerChromium::SharedValues> m_videoLayerSharedValues;
 
-    OwnPtr<GraphicsContext3D> m_context;
+    RefPtr<GraphicsContext3D> m_context;
 };
 
 // Setting DEBUG_GL_CALLS to 1 will call glGetError() after almost every GL
diff --git a/WebCore/platform/graphics/chromium/TransparencyWin.cpp b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
index 47cc894..4dc2157 100644
--- a/WebCore/platform/graphics/chromium/TransparencyWin.cpp
+++ b/WebCore/platform/graphics/chromium/TransparencyWin.cpp
@@ -275,7 +275,7 @@ void TransparencyWin::setupLayerForWhiteLayer()
     if (!m_validLayer)
         return;
 
-    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white, DeviceColorSpace);
+    m_drawContext->fillRect(IntRect(IntPoint(0, 0), m_layerSize), Color::white, ColorSpaceDeviceRGB);
     // Layer rect represents the part of the original layer.
 }
 
diff --git a/WebCore/platform/graphics/chromium/VideoFrameChromium.h b/WebCore/platform/graphics/chromium/VideoFrameChromium.h
index 34e922b..e176b0c 100644
--- a/WebCore/platform/graphics/chromium/VideoFrameChromium.h
+++ b/WebCore/platform/graphics/chromium/VideoFrameChromium.h
@@ -63,10 +63,7 @@ public:
 
     enum SurfaceType {
         TypeSystemMemory,
-        TypeOMXBufferHead,
-        TypeEGLImage,
-        TypeMFBuffer,
-        TypeDirect3DSurface
+        TypeTexture,
     };
 
     virtual SurfaceType surfaceType() const = 0;
@@ -76,6 +73,7 @@ public:
     virtual unsigned planes() const = 0;
     virtual int stride(unsigned plane) const = 0;
     virtual const void* data(unsigned plane) const = 0;
+    virtual unsigned texture(unsigned plane) const = 0;
     virtual const IntSize requiredTextureSize(unsigned plane) const = 0;
 };
 
diff --git a/WebCore/platform/graphics/chromium/VideoFrameProvider.h b/WebCore/platform/graphics/chromium/VideoFrameProvider.h
index f0bad08..c596f87 100644
--- a/WebCore/platform/graphics/chromium/VideoFrameProvider.h
+++ b/WebCore/platform/graphics/chromium/VideoFrameProvider.h
@@ -37,6 +37,8 @@ namespace WebCore {
 
 class VideoFrameProvider {
 public:
+    virtual ~VideoFrameProvider() { }
+
     // This function returns a pointer to a VideoFrameChromium, which is
     // the WebCore wrapper for a video frame in Chromium. getCurrentFrame()
     // places a lock on the frame in Chromium. Calls to this method should
diff --git a/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp b/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
index 26641a9..46c73a1 100644
--- a/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
+++ b/WebCore/platform/graphics/chromium/VideoLayerChromium.cpp
@@ -175,16 +175,22 @@ VideoLayerChromium::VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameP
     , m_skipsDraw(true)
     , m_frameFormat(VideoFrameChromium::Invalid)
     , m_provider(provider)
+    , m_currentFrame(0)
 {
-    for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
-        m_textures[plane] = 0;
-        m_textureSizes[plane] = IntSize();
-        m_frameSizes[plane] = IntSize();
-    }
+    resetFrameParameters();
 }
 
 VideoLayerChromium::~VideoLayerChromium()
 {
+    cleanupResources();
+}
+
+void VideoLayerChromium::cleanupResources()
+{
+    releaseCurrentFrame();
+    if (!layerRenderer())
+        return;
+
     GraphicsContext3D* context = layerRendererContext();
     for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
         if (m_textures[plane])
@@ -218,6 +224,14 @@ void VideoLayerChromium::updateContents()
         return;
     }
 
+    if (frame->surfaceType() == VideoFrameChromium::TypeTexture) {
+        releaseCurrentFrame();
+        saveCurrentFrame(frame);
+        m_dirtyRect.setSize(FloatSize());
+        m_contentsDirty = false;
+        return;
+    }
+
     // Allocate textures for planes if they are not allocated already, or
     // reallocate textures that are the wrong size for the frame.
     GraphicsContext3D* context = layerRendererContext();
@@ -236,6 +250,7 @@ void VideoLayerChromium::updateContents()
 
     m_dirtyRect.setSize(FloatSize());
     m_contentsDirty = false;
+
     m_provider->putCurrentFrame(frame);
 }
 
@@ -319,6 +334,17 @@ void VideoLayerChromium::draw()
         notImplemented();
         break;
     }
+    releaseCurrentFrame();
+}
+
+void VideoLayerChromium::releaseCurrentFrame()
+{
+    if (!m_currentFrame)
+        return;
+
+    m_provider->putCurrentFrame(m_currentFrame);
+    m_currentFrame = 0;
+    resetFrameParameters();
 }
 
 void VideoLayerChromium::drawYUV(const SharedValues* sv)
@@ -370,6 +396,26 @@ void VideoLayerChromium::drawRGBA(const SharedValues* sv)
                      sv->rgbaShaderMatrixLocation(), sv->rgbaAlphaLocation());
 }
 
+void VideoLayerChromium::resetFrameParameters()
+{
+    for (unsigned plane = 0; plane < VideoFrameChromium::maxPlanes; plane++) {
+        m_textures[plane] = 0;
+        m_textureSizes[plane] = IntSize();
+        m_frameSizes[plane] = IntSize();
+    }
+}
+
+void VideoLayerChromium::saveCurrentFrame(VideoFrameChromium* frame)
+{
+    ASSERT(!m_currentFrame);
+    m_currentFrame = frame;
+    for (unsigned plane = 0; plane < frame->planes(); plane++) {
+        m_textures[plane] = frame->texture(plane);
+        m_textureSizes[plane] = frame->requiredTextureSize(plane);
+        m_frameSizes[plane] = m_textureSizes[plane];
+    }
+}
+
 } // namespace WebCore
 
 #endif // USE(ACCELERATED_COMPOSITING)
diff --git a/WebCore/platform/graphics/chromium/VideoLayerChromium.h b/WebCore/platform/graphics/chromium/VideoLayerChromium.h
index 620d1a7..05b6578 100644
--- a/WebCore/platform/graphics/chromium/VideoLayerChromium.h
+++ b/WebCore/platform/graphics/chromium/VideoLayerChromium.h
@@ -49,6 +49,10 @@ public:
     virtual bool drawsContent() { return true; }
     virtual void draw();
 
+    // This function is called by VideoFrameProvider. When this method is called
+    // putCurrentFrame() must be called to return the frame currently held.
+    void releaseCurrentFrame();
+
     class SharedValues {
     public:
         explicit SharedValues(GraphicsContext3D*);
@@ -66,7 +70,7 @@ public:
         int rgbaAlphaLocation() const { return m_rgbaAlphaLocation; }
         int rgbaTextureLocation() const { return m_rgbaTextureLocation; }
         int ccMatrixLocation() const { return m_ccMatrixLocation; }
-        bool initialized() const { return m_initialized; };
+        bool initialized() const { return m_initialized; }
     private:
         GraphicsContext3D* m_context;
         unsigned m_yuvShaderProgram;
@@ -85,8 +89,12 @@ public:
         bool m_initialized;
     };
 
+protected:
+    virtual void cleanupResources();
+
 private:
     VideoLayerChromium(GraphicsLayerChromium* owner, VideoFrameProvider*);
+
     static unsigned determineTextureFormat(VideoFrameChromium*);
     bool allocateTexturesIfNeeded(GraphicsContext3D*, VideoFrameChromium*, unsigned textureFormat);
     void updateYUVContents(GraphicsContext3D*, const VideoFrameChromium*);
@@ -95,12 +103,16 @@ private:
     void updateTexture(GraphicsContext3D*, unsigned textureId, const IntSize& dimensions, unsigned textureFormat, const void* data);
     void drawYUV(const SharedValues*);
     void drawRGBA(const SharedValues*);
+    void resetFrameParameters();
+    void saveCurrentFrame(VideoFrameChromium*);
 
     static const float yuv2RGB[9];
 
     bool m_skipsDraw;
     VideoFrameChromium::Format m_frameFormat;
-    OwnPtr<VideoFrameProvider> m_provider;
+    VideoFrameProvider* m_provider;
+    VideoFrameChromium* m_currentFrame;
+
     unsigned m_textures[3];
     IntSize m_textureSizes[3];
     IntSize m_frameSizes[3];
diff --git a/WebCore/platform/graphics/efl/ImageEfl.cpp b/WebCore/platform/graphics/efl/ImageEfl.cpp
index 112770f..a86ba4e 100644
--- a/WebCore/platform/graphics/efl/ImageEfl.cpp
+++ b/WebCore/platform/graphics/efl/ImageEfl.cpp
@@ -32,6 +32,7 @@
 #include "BitmapImage.h"
 #include "SharedBuffer.h"
 
+#include <wtf/text/StringConcatenate.h>
 #include <cairo.h>
 
 namespace WebCore {
@@ -51,7 +52,7 @@ static PassRefPtr<SharedBuffer> loadResourceSharedBufferFallback()
 
 static PassRefPtr<SharedBuffer> loadResourceSharedBuffer(const char* name)
 {
-    RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(String::format(DATA_DIR "/webkit-1.0/images/%s.png", name));
+    RefPtr<SharedBuffer> buffer = SharedBuffer::createWithContentsOfFile(makeString(DATA_DIR "/webkit-1.0/images/", name, ".png"));    
     if (buffer)
         return buffer.release();
     return loadResourceSharedBufferFallback();
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.cpp b/WebCore/platform/graphics/efl/IntRectEfl.cpp
index 12407f8..0c92f63 100644
--- a/WebCore/platform/graphics/filters/ImageBufferFilter.cpp
+++ b/WebCore/platform/graphics/efl/IntRectEfl.cpp
@@ -1,6 +1,6 @@
 /*
- * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
- * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2010 Samsung Electronics
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -19,25 +19,22 @@
  */
 
 #include "config.h"
+#include "IntRect.h"
 
-#if ENABLE(FILTERS)
-#include "ImageBufferFilter.h"
-
-#include "FloatSize.h"
+#include <Eina.h>
 
 namespace WebCore {
 
-ImageBufferFilter::ImageBufferFilter()
-    : Filter()
+IntRect::IntRect(const Eina_Rectangle& r)
+    : m_location(IntPoint(r.x, r.y))
+    , m_size(r.w, r.h)
 {
-    setFilterResolution(FloatSize(1.f, 1.f));
 }
 
-PassRefPtr<ImageBufferFilter> ImageBufferFilter::create()
+IntRect::operator Eina_Rectangle() const
 {
-    return adoptRef(new ImageBufferFilter());
+    Eina_Rectangle r = {x(), y(), width(), height()};
+    return r;
 }
 
-} // namespace WebCore
-
-#endif // ENABLE(FILTERS)
+}
diff --git a/WebCore/platform/graphics/filters/FEBlend.cpp b/WebCore/platform/graphics/filters/FEBlend.cpp
index 4185f61..1a40027 100644
--- a/WebCore/platform/graphics/filters/FEBlend.cpp
+++ b/WebCore/platform/graphics/filters/FEBlend.cpp
@@ -98,13 +98,13 @@ void FEBlend::apply(Filter* filter)
     if (m_mode == FEBLEND_MODE_UNKNOWN)
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
-    IntRect effectADrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect effectADrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<CanvasPixelArray> srcPixelArrayA(in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-    IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->repaintRectInLocalCoordinates());
+    IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->absolutePaintRect());
     RefPtr<CanvasPixelArray> srcPixelArrayB(in2->resultImage()->getPremultipliedImageData(effectBDrawingRect)->data());
 
     IntRect imageRect(IntPoint(), resultImage()->size());
diff --git a/WebCore/platform/graphics/filters/FEColorMatrix.cpp b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
index 86c37c2..b41d5ad 100644
--- a/WebCore/platform/graphics/filters/FEColorMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEColorMatrix.cpp
@@ -160,11 +160,11 @@ void FEColorMatrix::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
-    filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()));
+    filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
 
     IntRect imageRect(IntPoint(), resultImage()->size());
     PassRefPtr<ImageData> imageData(resultImage()->getUnmultipliedImageData(imageRect));
diff --git a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
index 6fe38e4..08d0b1f 100644
--- a/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
+++ b/WebCore/platform/graphics/filters/FEComponentTransfer.cpp
@@ -154,7 +154,7 @@ void FEComponentTransfer::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     unsigned char rValues[256], gValues[256], bValues[256], aValues[256];
@@ -167,7 +167,7 @@ void FEComponentTransfer::apply(Filter* filter)
     for (unsigned channel = 0; channel < 4; channel++)
         (*callEffect[transferFunction[channel].type])(tables[channel], transferFunction[channel]);
 
-    IntRect drawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect drawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<ImageData> imageData(in->resultImage()->getUnmultipliedImageData(drawingRect));
     CanvasPixelArray* srcPixelArray(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEComposite.cpp b/WebCore/platform/graphics/filters/FEComposite.cpp
index 94e2524..2326966 100644
--- a/WebCore/platform/graphics/filters/FEComposite.cpp
+++ b/WebCore/platform/graphics/filters/FEComposite.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -112,6 +113,27 @@ inline void arithmetic(const RefPtr<CanvasPixelArray>& srcPixelArrayA, CanvasPix
         }
     }
 }
+    
+void FEComposite::determineAbsolutePaintRect(Filter* filter)
+{
+    switch (m_type) {
+    case FECOMPOSITE_OPERATOR_IN:
+    case FECOMPOSITE_OPERATOR_ATOP:
+        // For In and Atop the first effect just influences the result of
+        // the second effect. So just use the absolute paint rect of the second effect here.
+        setAbsolutePaintRect(inputEffect(1)->absolutePaintRect());
+        return;
+    case FECOMPOSITE_OPERATOR_ARITHMETIC:
+        // Arithmetic may influnce the compele filter primitive region. So we can't
+        // optimize the paint region here.
+        setAbsolutePaintRect(maxEffectRect());
+        return;
+    default:
+        // Take the union of both input effects.
+        FilterEffect::determineAbsolutePaintRect(filter);
+        return;
+    }
+}
 
 void FEComposite::apply(Filter* filter)
 {
@@ -122,39 +144,39 @@ void FEComposite::apply(Filter* filter)
     if (!in->resultImage() || !in2->resultImage())
         return;
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     FloatRect srcRect = FloatRect(0, 0, -1, -1);
     switch (m_type) {
     case FECOMPOSITE_OPERATOR_OVER:
-        filterContext->drawImageBuffer(in2->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in2->repaintRectInLocalCoordinates()));
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()));
+        filterContext->drawImageBuffer(in2->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in2->absolutePaintRect()));
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
         break;
     case FECOMPOSITE_OPERATOR_IN:
         filterContext->save();
-        filterContext->clipToImageBuffer(in2->resultImage(), drawingRegionOfInputImage(in2->repaintRectInLocalCoordinates()));
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()));
+        filterContext->clipToImageBuffer(in2->resultImage(), drawingRegionOfInputImage(in2->absolutePaintRect()));
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
         filterContext->restore();
         break;
     case FECOMPOSITE_OPERATOR_OUT:
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()));
-        filterContext->drawImageBuffer(in2->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in2->repaintRectInLocalCoordinates()), srcRect, CompositeDestinationOut);
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
+        filterContext->drawImageBuffer(in2->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in2->absolutePaintRect()), srcRect, CompositeDestinationOut);
         break;
     case FECOMPOSITE_OPERATOR_ATOP:
-        filterContext->drawImageBuffer(in2->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in2->repaintRectInLocalCoordinates()));
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()), srcRect, CompositeSourceAtop);
+        filterContext->drawImageBuffer(in2->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in2->absolutePaintRect()));
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()), srcRect, CompositeSourceAtop);
         break;
     case FECOMPOSITE_OPERATOR_XOR:
-        filterContext->drawImageBuffer(in2->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in2->repaintRectInLocalCoordinates()));
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()), srcRect, CompositeXOR);
+        filterContext->drawImageBuffer(in2->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in2->absolutePaintRect()));
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()), srcRect, CompositeXOR);
         break;
     case FECOMPOSITE_OPERATOR_ARITHMETIC: {
-        IntRect effectADrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+        IntRect effectADrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
         RefPtr<CanvasPixelArray> srcPixelArrayA(in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-        IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->repaintRectInLocalCoordinates());
+        IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->absolutePaintRect());
         RefPtr<ImageData> imageData(in2->resultImage()->getPremultipliedImageData(effectBDrawingRect));
         CanvasPixelArray* srcPixelArrayB(imageData->data());
 
diff --git a/WebCore/platform/graphics/filters/FEComposite.h b/WebCore/platform/graphics/filters/FEComposite.h
index 82a3b06..ecdb037 100644
--- a/WebCore/platform/graphics/filters/FEComposite.h
+++ b/WebCore/platform/graphics/filters/FEComposite.h
@@ -61,6 +61,8 @@ public:
 
     virtual void apply(Filter*);
     virtual void dump();
+    
+    virtual void determineAbsolutePaintRect(Filter*);
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp b/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp
index dd66c6a..d487a47 100644
--- a/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp
+++ b/WebCore/platform/graphics/filters/FEConvolveMatrix.cpp
@@ -377,11 +377,11 @@ void FEConvolveMatrix::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     IntRect imageRect(IntPoint(), resultImage()->size());
-    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->filterPrimitiveSubregion());
+    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
 
     RefPtr<CanvasPixelArray> srcPixelArray;
     if (m_preserveAlpha)
diff --git a/WebCore/platform/graphics/filters/FEConvolveMatrix.h b/WebCore/platform/graphics/filters/FEConvolveMatrix.h
index 2fe634f..8d3439e 100644
--- a/WebCore/platform/graphics/filters/FEConvolveMatrix.h
+++ b/WebCore/platform/graphics/filters/FEConvolveMatrix.h
@@ -75,6 +75,8 @@ public:
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
diff --git a/WebCore/platform/graphics/filters/FEDisplacementMap.cpp b/WebCore/platform/graphics/filters/FEDisplacementMap.cpp
index 6b5dbaa..0c53241 100644
--- a/WebCore/platform/graphics/filters/FEDisplacementMap.cpp
+++ b/WebCore/platform/graphics/filters/FEDisplacementMap.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -88,13 +89,13 @@ void FEDisplacementMap::apply(Filter* filter)
     if (m_xChannelSelector == CHANNEL_UNKNOWN || m_yChannelSelector == CHANNEL_UNKNOWN)
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
-    IntRect effectADrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect effectADrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<CanvasPixelArray> srcPixelArrayA(in->resultImage()->getPremultipliedImageData(effectADrawingRect)->data());
 
-    IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->repaintRectInLocalCoordinates());
+    IntRect effectBDrawingRect = requestedRegionOfInputImageData(in2->absolutePaintRect());
     RefPtr<CanvasPixelArray> srcPixelArrayB(in2->resultImage()->getUnmultipliedImageData(effectBDrawingRect)->data());
 
     IntRect imageRect(IntPoint(), resultImage()->size());
@@ -102,10 +103,10 @@ void FEDisplacementMap::apply(Filter* filter)
 
     ASSERT(srcPixelArrayA->length() == srcPixelArrayB->length());
 
-    float scaleX = m_scale / 255.f * filter->filterResolution().width();
-    float scaleY = m_scale / 255.f * filter->filterResolution().height();
-    float scaleAdjustmentX = (0.5f - 0.5f * m_scale) * filter->filterResolution().width();
-    float scaleAdjustmentY = (0.5f - 0.5f * m_scale) * filter->filterResolution().height();
+    float scaleX = filter->applyHorizontalScale(m_scale / 255);
+    float scaleY = filter->applyVerticalScale(m_scale / 255);
+    float scaleAdjustmentX = filter->applyHorizontalScale(0.5f - 0.5f * m_scale);
+    float scaleAdjustmentY = filter->applyVerticalScale(0.5f - 0.5f * m_scale);
     int stride = imageRect.width() * 4;
     for (int y = 0; y < imageRect.height(); ++y) {
         int line = y * stride;
diff --git a/WebCore/platform/graphics/filters/FEDisplacementMap.h b/WebCore/platform/graphics/filters/FEDisplacementMap.h
index dc87b90..c5b97a7 100644
--- a/WebCore/platform/graphics/filters/FEDisplacementMap.h
+++ b/WebCore/platform/graphics/filters/FEDisplacementMap.h
@@ -53,6 +53,8 @@ public:
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
diff --git a/WebCore/platform/graphics/filters/FEFlood.cpp b/WebCore/platform/graphics/filters/FEFlood.cpp
index 7804d89..b51a422 100644
--- a/WebCore/platform/graphics/filters/FEFlood.cpp
+++ b/WebCore/platform/graphics/filters/FEFlood.cpp
@@ -62,14 +62,14 @@ void FEFlood::setFloodOpacity(float floodOpacity)
     m_floodOpacity = floodOpacity;
 }
 
-void FEFlood::apply(Filter*)
+void FEFlood::apply(Filter* filter)
 {
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     Color color = colorWithOverrideAlpha(floodColor().rgb(), floodOpacity());
-    filterContext->fillRect(FloatRect(FloatPoint(), repaintRectInLocalCoordinates().size()), color, DeviceColorSpace);
+    filterContext->fillRect(FloatRect(FloatPoint(), absolutePaintRect().size()), color, ColorSpaceDeviceRGB);
 }
 
 void FEFlood::dump()
diff --git a/WebCore/platform/graphics/filters/FEFlood.h b/WebCore/platform/graphics/filters/FEFlood.h
index b615531..e6a9574 100644
--- a/WebCore/platform/graphics/filters/FEFlood.h
+++ b/WebCore/platform/graphics/filters/FEFlood.h
@@ -42,6 +42,8 @@ public:
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
diff --git a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
index fd9a3d8..1f36ba7 100644
--- a/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.cpp
@@ -4,6 +4,7 @@
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
  * Copyright (C) 2010 Igalia, S.L.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -34,7 +35,8 @@
 
 using std::max;
 
-static const float gGaussianKernelFactor = (3 * sqrtf(2 * piFloat) / 4.f);
+static const float gGaussianKernelFactor = 3 / 4.f * sqrtf(2 * piFloat);
+static const unsigned gMaxKernelSize = 1000;
 
 namespace WebCore {
 
@@ -97,7 +99,7 @@ static void boxBlur(CanvasPixelArray*& srcPixelArray, CanvasPixelArray*& dstPixe
     }
 }
 
-void FEGaussianBlur::kernelPosition(int boxBlur, unsigned& std, int& dLeft, int& dRight)
+inline void kernelPosition(int boxBlur, unsigned& std, int& dLeft, int& dRight)
 {
     // check http://www.w3.org/TR/SVG/filters.html#feGaussianBlurElement for details
     switch (boxBlur) {
@@ -125,6 +127,41 @@ void FEGaussianBlur::kernelPosition(int boxBlur, unsigned& std, int& dLeft, int&
     }
 }
 
+inline void calculateKernelSize(Filter* filter, unsigned& kernelSizeX, unsigned& kernelSizeY, float stdX, float stdY)
+{
+    stdX = filter->applyHorizontalScale(stdX);
+    stdY = filter->applyVerticalScale(stdY);
+    
+    kernelSizeX = 0;
+    if (stdX)
+        kernelSizeX = max<unsigned>(2, static_cast<unsigned>(floorf(stdX * gGaussianKernelFactor + 0.5f)));
+    kernelSizeY = 0;
+    if (stdY)
+        kernelSizeY = max<unsigned>(2, static_cast<unsigned>(floorf(stdY * gGaussianKernelFactor + 0.5f)));
+    
+    // Limit the kernel size to 1000. A bigger radius won't make a big difference for the result image but
+    // inflates the absolute paint rect to much. This is compatible with Firefox' behavior.
+    if (kernelSizeX > gMaxKernelSize)
+        kernelSizeX = gMaxKernelSize;
+    if (kernelSizeY > gMaxKernelSize)
+        kernelSizeY = gMaxKernelSize;
+}
+
+void FEGaussianBlur::determineAbsolutePaintRect(Filter* filter)
+{
+    FloatRect absolutePaintRect = inputEffect(0)->absolutePaintRect();
+    absolutePaintRect.intersect(maxEffectRect());
+
+    unsigned kernelSizeX = 0;
+    unsigned kernelSizeY = 0;
+    calculateKernelSize(filter, kernelSizeX, kernelSizeY, m_stdX, m_stdY);
+
+    // We take the half kernel size and multiply it with three, because we run box blur three times.
+    absolutePaintRect.inflateX(3 * kernelSizeX * 0.5f);
+    absolutePaintRect.inflateY(3 * kernelSizeY * 0.5f);
+    setAbsolutePaintRect(enclosingIntRect(absolutePaintRect));
+}
+
 void FEGaussianBlur::apply(Filter* filter)
 {
     FilterEffect* in = inputEffect(0);
@@ -132,12 +169,12 @@ void FEGaussianBlur::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     setIsAlphaImage(in->isAlphaImage());
 
-    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<ImageData> srcImageData(in->resultImage()->getPremultipliedImageData(effectDrawingRect));
     IntRect imageRect(IntPoint(), resultImage()->size());
 
@@ -147,12 +184,8 @@ void FEGaussianBlur::apply(Filter* filter)
     }
 
     unsigned kernelSizeX = 0;
-    if (m_stdX)
-        kernelSizeX = max(2U, static_cast<unsigned>(floor(m_stdX * filter->filterResolution().width() * gGaussianKernelFactor + 0.5f)));
-
     unsigned kernelSizeY = 0;
-    if (m_stdY)
-        kernelSizeY = max(2U, static_cast<unsigned>(floor(m_stdY * filter->filterResolution().height() * gGaussianKernelFactor + 0.5f)));
+    calculateKernelSize(filter, kernelSizeX, kernelSizeY, m_stdX, m_stdY);
 
     CanvasPixelArray* srcPixelArray(srcImageData->data());
     RefPtr<ImageData> tmpImageData = ImageData::create(imageRect.width(), imageRect.height());
diff --git a/WebCore/platform/graphics/filters/FEGaussianBlur.h b/WebCore/platform/graphics/filters/FEGaussianBlur.h
index 745bcc8..50fc610 100644
--- a/WebCore/platform/graphics/filters/FEGaussianBlur.h
+++ b/WebCore/platform/graphics/filters/FEGaussianBlur.h
@@ -42,12 +42,13 @@ public:
 
     virtual void apply(Filter*);
     virtual void dump();
+    
+    virtual void determineAbsolutePaintRect(Filter*);
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
     FEGaussianBlur(float, float);
-    static void kernelPosition(int boxBlur, unsigned& std, int& dLeft, int& dRight);
 
     float m_stdX;
     float m_stdY;
diff --git a/WebCore/platform/graphics/filters/FELighting.cpp b/WebCore/platform/graphics/filters/FELighting.cpp
index f49b67d..e1df580 100644
--- a/WebCore/platform/graphics/filters/FELighting.cpp
+++ b/WebCore/platform/graphics/filters/FELighting.cpp
@@ -247,12 +247,12 @@ void FELighting::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     setIsAlphaImage(false);
 
-    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<ImageData> srcImageData(in->resultImage()->getUnmultipliedImageData(effectDrawingRect));
     CanvasPixelArray* srcPixelArray(srcImageData->data());
 
@@ -261,8 +261,9 @@ void FELighting::apply(Filter* filter)
     // output for various kernelUnitLengths, and I am not sure they are reliable.
     // Anyway, feConvolveMatrix should also use the implementation
 
-    if (drawLighting(srcPixelArray, effectDrawingRect.width(), effectDrawingRect.height()))
-        resultImage()->putUnmultipliedImageData(srcImageData.get(), IntRect(IntPoint(), resultImage()->size()), IntPoint());
+    IntSize absolutePaintSize = absolutePaintRect().size();
+    if (drawLighting(srcPixelArray, absolutePaintSize.width(), absolutePaintSize.height()))
+        resultImage()->putUnmultipliedImageData(srcImageData.get(), IntRect(IntPoint(), absolutePaintSize), IntPoint());
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/filters/FELighting.h b/WebCore/platform/graphics/filters/FELighting.h
index 28c00c4..bd56cee 100644
--- a/WebCore/platform/graphics/filters/FELighting.h
+++ b/WebCore/platform/graphics/filters/FELighting.h
@@ -44,6 +44,8 @@ class FELighting : public FilterEffect {
 public:
     virtual void apply(Filter*);
 
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
+
 protected:
     enum LightingType {
         DiffuseLighting,
diff --git a/WebCore/platform/graphics/filters/FEMerge.cpp b/WebCore/platform/graphics/filters/FEMerge.cpp
index 19c832a..b136af3 100644
--- a/WebCore/platform/graphics/filters/FEMerge.cpp
+++ b/WebCore/platform/graphics/filters/FEMerge.cpp
@@ -50,13 +50,13 @@ void FEMerge::apply(Filter* filter)
             return;
     }
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     for (unsigned i = 0; i < size; ++i) {
         FilterEffect* in = inputEffect(i);
-        filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, drawingRegionOfInputImage(in->repaintRectInLocalCoordinates()));
+        filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegionOfInputImage(in->absolutePaintRect()));
     }
 }
 
diff --git a/WebCore/platform/graphics/filters/FEMorphology.cpp b/WebCore/platform/graphics/filters/FEMorphology.cpp
index 7329e1e..ac26441 100644
--- a/WebCore/platform/graphics/filters/FEMorphology.cpp
+++ b/WebCore/platform/graphics/filters/FEMorphology.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -74,6 +75,15 @@ float FEMorphology::radiusY() const
     return m_radiusY;
 }
 
+void FEMorphology::determineAbsolutePaintRect(Filter* filter)
+{
+    FloatRect paintRect = inputEffect(0)->absolutePaintRect();
+    paintRect.inflateX(filter->applyHorizontalScale(m_radiusX));
+    paintRect.inflateY(filter->applyVerticalScale(m_radiusY));
+    paintRect.intersect(maxEffectRect());
+    setAbsolutePaintRect(enclosingIntRect(paintRect));
+}
+
 void FEMorphology::setRadiusY(float radiusY)
 {
     m_radiusY = radiusY;
@@ -86,18 +96,18 @@ void FEMorphology::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     setIsAlphaImage(in->isAlphaImage());
-
-    int radiusX = static_cast<int>(m_radiusX * filter->filterResolution().width());
-    int radiusY = static_cast<int>(m_radiusY * filter->filterResolution().height());
-    if (radiusX <= 0 || radiusY <= 0)
+    if (m_radiusX <= 0 || m_radiusY <= 0)
         return;
 
+    int radiusX = static_cast<int>(floorf(filter->applyHorizontalScale(m_radiusX)));
+    int radiusY = static_cast<int>(floorf(filter->applyVerticalScale(m_radiusY)));
+
     IntRect imageRect(IntPoint(), resultImage()->size());
-    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->repaintRectInLocalCoordinates());
+    IntRect effectDrawingRect = requestedRegionOfInputImageData(in->absolutePaintRect());
     RefPtr<CanvasPixelArray> srcPixelArray(in->resultImage()->getPremultipliedImageData(effectDrawingRect)->data());
     RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
 
diff --git a/WebCore/platform/graphics/filters/FEMorphology.h b/WebCore/platform/graphics/filters/FEMorphology.h
index c8ce058..913671d 100644
--- a/WebCore/platform/graphics/filters/FEMorphology.h
+++ b/WebCore/platform/graphics/filters/FEMorphology.h
@@ -49,6 +49,8 @@ public:
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*);
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
 private:
diff --git a/WebCore/platform/graphics/filters/FEOffset.cpp b/WebCore/platform/graphics/filters/FEOffset.cpp
index ea84cf0..6ca56aa 100644
--- a/WebCore/platform/graphics/filters/FEOffset.cpp
+++ b/WebCore/platform/graphics/filters/FEOffset.cpp
@@ -3,6 +3,7 @@
  * Copyright (C) 2004, 2005 Rob Buis <buis@kde.org>
  * Copyright (C) 2005 Eric Seidel <eric@webkit.org>
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -62,6 +63,14 @@ void FEOffset::setDy(float dy)
     m_dy = dy;
 }
 
+void FEOffset::determineAbsolutePaintRect(Filter* filter)
+{
+    FloatRect paintRect = inputEffect(0)->absolutePaintRect();
+    paintRect.move(filter->applyHorizontalScale(m_dx), filter->applyVerticalScale(m_dy));
+    paintRect.intersect(maxEffectRect());
+    setAbsolutePaintRect(enclosingIntRect(paintRect));
+}
+
 void FEOffset::apply(Filter* filter)
 {
     FilterEffect* in = inputEffect(0);
@@ -69,28 +78,15 @@ void FEOffset::apply(Filter* filter)
     if (!in->resultImage())
         return;
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     setIsAlphaImage(in->isAlphaImage());
 
-    FloatRect sourceImageRect = filter->sourceImageRect();
-    sourceImageRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
-
-    if (filter->effectBoundingBoxMode()) {
-        m_dx *= sourceImageRect.width();
-        m_dy *= sourceImageRect.height();
-    }
-    m_dx *= filter->filterResolution().width();
-    m_dy *= filter->filterResolution().height();
-
-    FloatRect dstRect = FloatRect(m_dx + in->repaintRectInLocalCoordinates().x() - repaintRectInLocalCoordinates().x(),
-                                  m_dy + in->repaintRectInLocalCoordinates().y() - repaintRectInLocalCoordinates().y(),
-                                  in->repaintRectInLocalCoordinates().width(),
-                                  in->repaintRectInLocalCoordinates().height());
-
-    filterContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, dstRect);
+    FloatRect drawingRegion = drawingRegionOfInputImage(in->absolutePaintRect());
+    drawingRegion.move(filter->applyHorizontalScale(m_dx), filter->applyVerticalScale(m_dy));
+    filterContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, drawingRegion);
 }
 
 void FEOffset::dump()
diff --git a/WebCore/platform/graphics/filters/FEOffset.h b/WebCore/platform/graphics/filters/FEOffset.h
index 052ba74..36575c5 100644
--- a/WebCore/platform/graphics/filters/FEOffset.h
+++ b/WebCore/platform/graphics/filters/FEOffset.h
@@ -40,6 +40,8 @@ public:
 
     virtual void apply(Filter*);
     virtual void dump();
+    
+    virtual void determineAbsolutePaintRect(Filter*);
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/WebCore/platform/graphics/filters/FETile.cpp b/WebCore/platform/graphics/filters/FETile.cpp
index 41abd34..a695d3b 100644
--- a/WebCore/platform/graphics/filters/FETile.cpp
+++ b/WebCore/platform/graphics/filters/FETile.cpp
@@ -27,6 +27,7 @@
 #include "Filter.h"
 #include "GraphicsContext.h"
 #include "Pattern.h"
+#include "SVGImageBufferTools.h"
 
 namespace WebCore {
 
@@ -44,45 +45,51 @@ FloatRect FETile::determineFilterPrimitiveSubregion(Filter* filter)
 {
     inputEffect(0)->determineFilterPrimitiveSubregion(filter);
 
-    filter->determineFilterPrimitiveSubregion(this, filter->filterRegion());
+    filter->determineFilterPrimitiveSubregion(this, filter->filterRegionInUserSpace());
     return filterPrimitiveSubregion();
 }
 
 void FETile::apply(Filter* filter)
 {
+// FIXME: See bug 47315. This is a hack to work around a compile failure, but is incorrect behavior otherwise.
+#if ENABLE(SVG)
     FilterEffect* in = inputEffect(0);
     in->apply(filter);
     if (!in->resultImage())
         return;
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     setIsAlphaImage(in->isAlphaImage());
 
-    IntRect tileRect = enclosingIntRect(in->repaintRectInLocalCoordinates());
-
     // Source input needs more attention. It has the size of the filterRegion but gives the
     // size of the cutted sourceImage back. This is part of the specification and optimization.
-    if (in->isSourceInput()) {
-        FloatRect filterRegion = filter->filterRegion();
-        filterRegion.scale(filter->filterResolution().width(), filter->filterResolution().height());
-        tileRect = enclosingIntRect(filterRegion);
+    FloatRect tileRect = in->maxEffectRect();
+    FloatPoint inMaxEffectLocation = tileRect.location();
+    FloatPoint maxEffectLocation = maxEffectRect().location();
+    if (in->filterEffectType() == FilterEffectTypeSourceInput) {
+        tileRect = filter->filterRegion();
+        tileRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
     }
 
-    OwnPtr<ImageBuffer> tileImage = ImageBuffer::create(tileRect.size());
+    OwnPtr<ImageBuffer> tileImage;
+    if (!SVGImageBufferTools::createImageBuffer(tileRect, tileRect, tileImage, ColorSpaceDeviceRGB))
+        return;
+
     GraphicsContext* tileImageContext = tileImage->context();
-    tileImageContext->drawImageBuffer(in->resultImage(), DeviceColorSpace, IntPoint());
-    RefPtr<Pattern> pattern = Pattern::create(tileImage->copyImage(), true, true);
+    tileImageContext->translate(-inMaxEffectLocation.x(), -inMaxEffectLocation.y());
+    tileImageContext->drawImageBuffer(in->resultImage(), ColorSpaceDeviceRGB, in->absolutePaintRect().location());
 
-    AffineTransform matrix;
-    matrix.translate(in->repaintRectInLocalCoordinates().x() - repaintRectInLocalCoordinates().x(),
-                     in->repaintRectInLocalCoordinates().y() - repaintRectInLocalCoordinates().y());
-    pattern.get()->setPatternSpaceTransform(matrix);
+    RefPtr<Pattern> pattern = Pattern::create(tileImage->copyImage(), true, true);
 
+    AffineTransform patternTransform;
+    patternTransform.translate(inMaxEffectLocation.x() - maxEffectLocation.x(), inMaxEffectLocation.y() - maxEffectLocation.y());
+    pattern->setPatternSpaceTransform(patternTransform);
     filterContext->setFillPattern(pattern);
-    filterContext->fillRect(FloatRect(FloatPoint(), repaintRectInLocalCoordinates().size()));
+    filterContext->fillRect(FloatRect(FloatPoint(), absolutePaintRect().size()));
+#endif
 }
 
 void FETile::dump()
@@ -103,4 +110,3 @@ TextStream& FETile::externalRepresentation(TextStream& ts, int indent) const
 } // namespace WebCore
 
 #endif // ENABLE(FILTERS)
-
diff --git a/WebCore/platform/graphics/filters/FETile.h b/WebCore/platform/graphics/filters/FETile.h
index 20efbcd..8562c90 100644
--- a/WebCore/platform/graphics/filters/FETile.h
+++ b/WebCore/platform/graphics/filters/FETile.h
@@ -35,6 +35,8 @@ public:
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
     virtual FloatRect determineFilterPrimitiveSubregion(Filter*);
diff --git a/WebCore/platform/graphics/filters/FETurbulence.cpp b/WebCore/platform/graphics/filters/FETurbulence.cpp
index bb24362..b1494a5 100644
--- a/WebCore/platform/graphics/filters/FETurbulence.cpp
+++ b/WebCore/platform/graphics/filters/FETurbulence.cpp
@@ -321,7 +321,7 @@ unsigned char FETurbulence::calculateTurbulenceValueForPoint(PaintingData& paint
 
 void FETurbulence::apply(Filter* filter)
 {
-    if (!effectContext())
+    if (!effectContext(filter))
         return;
 
     IntRect imageRect(IntPoint(), resultImage()->size());
@@ -329,10 +329,10 @@ void FETurbulence::apply(Filter* filter)
         return;
 
     RefPtr<ImageData> imageData = ImageData::create(imageRect.width(), imageRect.height());
-    PaintingData paintingData(m_seed, imageRect.size());
+    PaintingData paintingData(m_seed, roundedIntSize(filterPrimitiveSubregion().size()));
     initPaint(paintingData);
 
-    FloatRect filterRegion = filter->filterRegion();
+    FloatRect filterRegion = absolutePaintRect();
     FloatPoint point;
     point.setY(filterRegion.y());
     int indexOfPixelChannel = 0;
@@ -342,7 +342,7 @@ void FETurbulence::apply(Filter* filter)
         for (int x = 0; x < imageRect.width(); ++x) {
             point.setX(point.x() + 1);
             for (paintingData.channel = 0; paintingData.channel < 4; ++paintingData.channel, ++indexOfPixelChannel)
-                imageData->data()->set(indexOfPixelChannel, calculateTurbulenceValueForPoint(paintingData, point));
+                imageData->data()->set(indexOfPixelChannel, calculateTurbulenceValueForPoint(paintingData, filter->mapAbsolutePointToLocalPoint(point)));
         }
     }
     resultImage()->putUnmultipliedImageData(imageData.get(), imageRect, IntPoint());
diff --git a/WebCore/platform/graphics/filters/FETurbulence.h b/WebCore/platform/graphics/filters/FETurbulence.h
index 1a5a28a..c15d7d1 100644
--- a/WebCore/platform/graphics/filters/FETurbulence.h
+++ b/WebCore/platform/graphics/filters/FETurbulence.h
@@ -60,6 +60,8 @@ public:
 
     virtual void apply(Filter*);
     virtual void dump();
+    
+    virtual void determineAbsolutePaintRect(Filter*) { setAbsolutePaintRect(maxEffectRect()); }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/WebCore/platform/graphics/filters/Filter.h b/WebCore/platform/graphics/filters/Filter.h
index bce4be3..121e389 100644
--- a/WebCore/platform/graphics/filters/Filter.h
+++ b/WebCore/platform/graphics/filters/Filter.h
@@ -44,11 +44,18 @@ namespace WebCore {
         FloatSize filterResolution() const { return m_filterResolution; }
         void setFilterResolution(const FloatSize& filterResolution) { m_filterResolution = filterResolution; }
 
+        virtual float applyHorizontalScale(float value) const { return value * m_filterResolution.width(); }
+        virtual float applyVerticalScale(float value) const { return value * m_filterResolution.height(); }
+        
         virtual FloatRect sourceImageRect() const = 0;
         virtual FloatRect filterRegion() const = 0;
+        
+        virtual FloatPoint mapAbsolutePointToLocalPoint(const FloatPoint&) const { return FloatPoint(); }
 
         // SVG specific
         virtual void determineFilterPrimitiveSubregion(FilterEffect*, const FloatRect&) { }
+        
+        virtual FloatRect filterRegionInUserSpace() const { return FloatRect(); }
 
         virtual FloatSize maxImageSize() const = 0;
         virtual bool effectBoundingBoxMode() const = 0;
diff --git a/WebCore/platform/graphics/filters/FilterEffect.cpp b/WebCore/platform/graphics/filters/FilterEffect.cpp
index 461b22a..121b921 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.cpp
+++ b/WebCore/platform/graphics/filters/FilterEffect.cpp
@@ -46,7 +46,7 @@ FloatRect FilterEffect::determineFilterPrimitiveSubregion(Filter* filter)
 
     // FETurbulence, FEImage and FEFlood don't have input effects, take the filter region as unite rect.
     if (!size)
-        uniteRect = filter->filterRegion();
+        uniteRect = filter->filterRegionInUserSpace();
     else {
         for (unsigned i = 0; i < size; ++i)
             uniteRect.unite(m_inputEffects.at(i)->determineFilterPrimitiveSubregion(filter));
@@ -56,18 +56,29 @@ FloatRect FilterEffect::determineFilterPrimitiveSubregion(Filter* filter)
     return m_filterPrimitiveSubregion;
 }
 
-IntRect FilterEffect::requestedRegionOfInputImageData(const FloatRect& effectRect) const
+void FilterEffect::determineAbsolutePaintRect(Filter*)
+{
+    m_absolutePaintRect = IntRect();
+    unsigned size = m_inputEffects.size();
+    for (unsigned i = 0; i < size; ++i)
+        m_absolutePaintRect.unite(m_inputEffects.at(i)->absolutePaintRect());
+    
+    // SVG specification wants us to clip to primitive subregion.
+    m_absolutePaintRect.intersect(m_maxEffectRect);
+}
+
+IntRect FilterEffect::requestedRegionOfInputImageData(const IntRect& effectRect) const
 {
     ASSERT(m_effectBuffer);
-    FloatPoint location = m_repaintRectInLocalCoordinates.location();
+    IntPoint location = m_absolutePaintRect.location();
     location.move(-effectRect.x(), -effectRect.y());
-    return IntRect(roundedIntPoint(location), m_effectBuffer->size());
+    return IntRect(location, m_effectBuffer->size());
 }
 
-FloatRect FilterEffect::drawingRegionOfInputImage(const FloatRect& srcRect) const
+IntRect FilterEffect::drawingRegionOfInputImage(const IntRect& srcRect) const
 {
-    return FloatRect(FloatPoint(srcRect.x() - m_repaintRectInLocalCoordinates.x(),
-                                srcRect.y() - m_repaintRectInLocalCoordinates.y()), srcRect.size());
+    return IntRect(IntPoint(srcRect.x() - m_absolutePaintRect.x(),
+                            srcRect.y() - m_absolutePaintRect.y()), srcRect.size());
 }
 
 FilterEffect* FilterEffect::inputEffect(unsigned number) const
@@ -76,10 +87,12 @@ FilterEffect* FilterEffect::inputEffect(unsigned number) const
     return m_inputEffects.at(number).get();
 }
 
-GraphicsContext* FilterEffect::effectContext()
+GraphicsContext* FilterEffect::effectContext(Filter* filter)
 {
-    IntRect bufferRect = enclosingIntRect(m_repaintRectInLocalCoordinates);
-    m_effectBuffer = ImageBuffer::create(bufferRect.size(), LinearRGB);
+    determineAbsolutePaintRect(filter);
+    if (m_absolutePaintRect.isEmpty())
+        return 0;
+    m_effectBuffer = ImageBuffer::create(m_absolutePaintRect.size(), ColorSpaceLinearRGB);
     if (!m_effectBuffer)
         return 0;
     return m_effectBuffer->context();
diff --git a/WebCore/platform/graphics/filters/FilterEffect.h b/WebCore/platform/graphics/filters/FilterEffect.h
index ebe1880..a614b59 100644
--- a/WebCore/platform/graphics/filters/FilterEffect.h
+++ b/WebCore/platform/graphics/filters/FilterEffect.h
@@ -39,6 +39,13 @@ namespace WebCore {
 
 typedef Vector<RefPtr<FilterEffect> > FilterEffectVector;
 
+enum FilterEffectType {
+    FilterEffectTypeUnknown,
+    FilterEffectTypeImage,
+    FilterEffectTypeTile,
+    FilterEffectTypeSourceInput
+};
+
 class FilterEffect : public RefCounted<FilterEffect> {
 public:
     virtual ~FilterEffect();
@@ -49,26 +56,31 @@ public:
 
     // Creates the ImageBuffer for the current filter primitive result in the size of the
     // repaintRect. Gives back the GraphicsContext of the own ImageBuffer.
-    GraphicsContext* effectContext();
+    GraphicsContext* effectContext(Filter*);
 
     FilterEffectVector& inputEffects() { return m_inputEffects; }
     FilterEffect* inputEffect(unsigned) const;
     unsigned numberOfEffectInputs() const { return m_inputEffects.size(); }
 
-    FloatRect drawingRegionOfInputImage(const FloatRect&) const;
-    IntRect requestedRegionOfInputImageData(const FloatRect&) const;
+    IntRect drawingRegionOfInputImage(const IntRect&) const;
+    IntRect requestedRegionOfInputImageData(const IntRect&) const;
 
     // Solid black image with different alpha values.
     bool isAlphaImage() const { return m_alphaImage; }
     void setIsAlphaImage(bool alphaImage) { m_alphaImage = alphaImage; }
 
-    FloatRect repaintRectInLocalCoordinates() const { return m_repaintRectInLocalCoordinates; }
-    void setRepaintRectInLocalCoordinates(const FloatRect& repaintRectInLocalCoordinates) { m_repaintRectInLocalCoordinates = repaintRectInLocalCoordinates; }
+    IntRect absolutePaintRect() const { return m_absolutePaintRect; }
+    void setAbsolutePaintRect(const IntRect& absolutePaintRect) { m_absolutePaintRect = absolutePaintRect; }
+
+    IntRect maxEffectRect() const { return m_maxEffectRect; }
+    void setMaxEffectRect(const IntRect& maxEffectRect) { m_maxEffectRect = maxEffectRect; } 
 
     virtual void apply(Filter*) = 0;
     virtual void dump() = 0;
 
-    virtual bool isSourceInput() const { return false; }
+    virtual void determineAbsolutePaintRect(Filter*);
+
+    virtual FilterEffectType filterEffectType() const { return FilterEffectTypeUnknown; }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention = 0) const;
 
@@ -87,7 +99,7 @@ public:
     bool hasHeight() const { return m_hasHeight; }
     void setHasHeight(bool value) { m_hasHeight = value; }
 
-    // FIXME: Pseudo primitives like SourceGraphic and SourceAlpha as well as FETile still need special handling.
+    // FIXME: FETile still needs special handling.
     virtual FloatRect determineFilterPrimitiveSubregion(Filter*);
 
     FloatRect filterPrimitiveSubregion() const { return m_filterPrimitiveSubregion; }
@@ -105,8 +117,11 @@ private:
 
     bool m_alphaImage;
 
-    // FIXME: Should be the paint region of the filter primitive, instead of the scaled subregion on use of filterRes.
-    FloatRect m_repaintRectInLocalCoordinates;
+    IntRect m_absolutePaintRect;
+    
+    // The maximum size of a filter primitive. In SVG this is the primitive subregion in absolute coordinate space.
+    // The absolute paint rect should never be bigger than m_maxEffectRect.
+    IntRect m_maxEffectRect;
 
 private:
     // The following member variables are SVG specific and will move to RenderSVGResourceFilterPrimitive.
diff --git a/WebCore/platform/graphics/filters/ImageBufferFilter.h b/WebCore/platform/graphics/filters/ImageBufferFilter.h
deleted file mode 100644
index cd4bc2f..0000000
--- a/WebCore/platform/graphics/filters/ImageBufferFilter.h
+++ /dev/null
@@ -1,57 +0,0 @@
-/*
- * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
- * Copyright (C) 2009 Brent Fulgham <bfulgham@webkit.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#ifndef ImageBufferFilter_h
-#define ImageBufferFilter_h
-
-#if ENABLE(FILTERS)
-#include "Filter.h"
-#include "FilterEffect.h"
-#include "FloatRect.h"
-#include "FloatSize.h"
-
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-#include <wtf/RefPtr.h>
-
-namespace WebCore {
-
-class ImageBufferFilter : public Filter {
-public:
-    static PassRefPtr<ImageBufferFilter> create();
-
-    virtual FloatRect filterRegion() const { return FloatRect(); }
-    virtual FloatRect sourceImageRect() const { return FloatRect(); }
-
-    // SVG specific
-    virtual bool effectBoundingBoxMode() const { return false; }
-
-    virtual FloatSize maxImageSize() const { return FloatSize(); }
-    virtual void calculateEffectSubRegion(FilterEffect*) { }
-
-private:
-    ImageBufferFilter();
-};
-
-} // namespace WebCore
-
-#endif // ENABLE(FILTERS)
-
-#endif // ImageBufferFilter_h
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.cpp b/WebCore/platform/graphics/filters/SourceAlpha.cpp
index beaf2e7..7dc56d9 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.cpp
+++ b/WebCore/platform/graphics/filters/SourceAlpha.cpp
@@ -42,31 +42,25 @@ const AtomicString& SourceAlpha::effectName()
     return s_effectName;
 }
 
-FloatRect SourceAlpha::determineFilterPrimitiveSubregion(Filter* filter)
+void SourceAlpha::determineAbsolutePaintRect(Filter* filter)
 {
-    FloatRect clippedSourceRect = filter->sourceImageRect();
-    if (filter->sourceImageRect().x() < filter->filterRegion().x())
-        clippedSourceRect.setX(filter->filterRegion().x());
-    if (filter->sourceImageRect().y() < filter->filterRegion().y())
-        clippedSourceRect.setY(filter->filterRegion().y());
-    setFilterPrimitiveSubregion(clippedSourceRect);
-    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
-    setRepaintRectInLocalCoordinates(clippedSourceRect);
-    return filter->filterRegion();
+    FloatRect paintRect = filter->sourceImageRect();
+    paintRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setAbsolutePaintRect(enclosingIntRect(paintRect));
 }
 
 void SourceAlpha::apply(Filter* filter)
 {
-    GraphicsContext* filterContext = effectContext();
-    if (!filterContext)
+    GraphicsContext* filterContext = effectContext(filter);
+    if (!filterContext || !filter->sourceImage())
         return;
 
     setIsAlphaImage(true);
 
-    FloatRect imageRect(FloatPoint(), filter->sourceImage()->size());
+    FloatRect imageRect(FloatPoint(), absolutePaintRect().size());
     filterContext->save();
     filterContext->clipToImageBuffer(filter->sourceImage(), imageRect);
-    filterContext->fillRect(imageRect, Color::black, DeviceColorSpace);
+    filterContext->fillRect(imageRect, Color::black, ColorSpaceDeviceRGB);
     filterContext->restore();
 }
 
diff --git a/WebCore/platform/graphics/filters/SourceAlpha.h b/WebCore/platform/graphics/filters/SourceAlpha.h
index f0fa319..83704e5 100644
--- a/WebCore/platform/graphics/filters/SourceAlpha.h
+++ b/WebCore/platform/graphics/filters/SourceAlpha.h
@@ -34,12 +34,12 @@ public:
 
     static const AtomicString& effectName();
 
-    virtual FloatRect determineFilterPrimitiveSubregion(Filter*);
-
     virtual void apply(Filter*);
     virtual void dump();
 
-    virtual bool isSourceInput() const { return true; }
+    virtual void determineAbsolutePaintRect(Filter*);
+
+    virtual FilterEffectType filterEffectType() const { return FilterEffectTypeSourceInput; }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/WebCore/platform/graphics/filters/SourceGraphic.cpp b/WebCore/platform/graphics/filters/SourceGraphic.cpp
index c014e68..fbb711a 100644
--- a/WebCore/platform/graphics/filters/SourceGraphic.cpp
+++ b/WebCore/platform/graphics/filters/SourceGraphic.cpp
@@ -41,26 +41,20 @@ const AtomicString& SourceGraphic::effectName()
     return s_effectName;
 }
 
-FloatRect SourceGraphic::determineFilterPrimitiveSubregion(Filter* filter)
+void SourceGraphic::determineAbsolutePaintRect(Filter* filter)
 {
-    FloatRect clippedSourceRect = filter->sourceImageRect();
-    if (filter->sourceImageRect().x() < filter->filterRegion().x())
-        clippedSourceRect.setX(filter->filterRegion().x());
-    if (filter->sourceImageRect().y() < filter->filterRegion().y())
-        clippedSourceRect.setY(filter->filterRegion().y());
-    setFilterPrimitiveSubregion(clippedSourceRect);
-    clippedSourceRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
-    setRepaintRectInLocalCoordinates(clippedSourceRect);
-    return filter->filterRegion();
+    FloatRect paintRect = filter->sourceImageRect();
+    paintRect.scale(filter->filterResolution().width(), filter->filterResolution().height());
+    setAbsolutePaintRect(enclosingIntRect(paintRect));
 }
 
 void SourceGraphic::apply(Filter* filter)
 {
-    GraphicsContext* filterContext = effectContext();
-    if (!filterContext)
+    GraphicsContext* filterContext = effectContext(filter);
+    if (!filterContext || !filter->sourceImage())
         return;
 
-    filterContext->drawImageBuffer(filter->sourceImage(), DeviceColorSpace, IntPoint());
+    filterContext->drawImageBuffer(filter->sourceImage(), ColorSpaceDeviceRGB, IntPoint());
 }
 
 void SourceGraphic::dump()
diff --git a/WebCore/platform/graphics/filters/SourceGraphic.h b/WebCore/platform/graphics/filters/SourceGraphic.h
index 2378798..a13337d 100644
--- a/WebCore/platform/graphics/filters/SourceGraphic.h
+++ b/WebCore/platform/graphics/filters/SourceGraphic.h
@@ -35,12 +35,12 @@ public:
 
     static const AtomicString& effectName();
 
-    virtual FloatRect determineFilterPrimitiveSubregion(Filter*);
-
     virtual void apply(Filter*);
     virtual void dump();
 
-    virtual bool isSourceInput() const { return true; }
+    virtual void determineAbsolutePaintRect(Filter*);
+
+    virtual FilterEffectType filterEffectType() const { return FilterEffectTypeSourceInput; }
 
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
 
diff --git a/WebCore/platform/graphics/gpu/DrawingBuffer.cpp b/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
index dc80954..2dc0517 100644
--- a/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
+++ b/WebCore/platform/graphics/gpu/DrawingBuffer.cpp
@@ -30,31 +30,40 @@
 
 #include "config.h"
 
-#include "DrawingBuffer.h"
+#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(3D_CANVAS)
 
-#include "GraphicsContext3D.h"
-#include "SharedGraphicsContext3D.h"
+#include "DrawingBuffer.h"
 
 namespace WebCore {
 
-PassOwnPtr<DrawingBuffer> DrawingBuffer::create(SharedGraphicsContext3D* context, const IntSize& size)
+PassRefPtr<DrawingBuffer> DrawingBuffer::create(GraphicsContext3D* context, const IntSize& size)
 {
-    unsigned framebuffer = context->createFramebuffer();
-    ASSERT(framebuffer);
-    if (!framebuffer)
-        return 0;
-    return adoptPtr(new DrawingBuffer(context, size, framebuffer));
+    RefPtr<DrawingBuffer> drawingBuffer = adoptRef(new DrawingBuffer(context, size));
+    return (drawingBuffer->m_context) ? drawingBuffer.release() : 0;
 }
 
-void DrawingBuffer::bind()
+void DrawingBuffer::clear()
 {
-    m_context->bindFramebuffer(m_framebuffer);
-    m_context->setViewport(m_size);
+    if (!m_context)
+        return;
+
+    m_context->makeContextCurrent();
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_context->deleteFramebuffer(m_fbo);
+    m_fbo = 0;
+
+    m_context.clear();
 }
 
-void DrawingBuffer::setWillPublishCallback(PassOwnPtr<WillPublishCallback> callback)
+void DrawingBuffer::bind()
 {
-    m_callback = callback;
+    if (!m_context)
+        return;
+        
+    m_context->bindFramebuffer(GraphicsContext3D::FRAMEBUFFER, m_fbo);
+    m_context->viewport(0, 0, m_size.width(), m_size.height());
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/DrawingBuffer.h b/WebCore/platform/graphics/gpu/DrawingBuffer.h
index 23e6f4a..75c7f99 100644
--- a/WebCore/platform/graphics/gpu/DrawingBuffer.h
+++ b/WebCore/platform/graphics/gpu/DrawingBuffer.h
@@ -31,30 +31,39 @@
 #ifndef DrawingBuffer_h
 #define DrawingBuffer_h
 
+#include "GraphicsContext3D.h"
 #include "GraphicsLayer.h"
 #include "IntSize.h"
 
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
+#if PLATFORM(MAC)
+#include <wtf/RetainPtr.h>
+#endif
 
 namespace WebCore {
 
-class SharedGraphicsContext3D;
-
+#if PLATFORM(CHROMIUM)
 struct DrawingBufferInternal;
+#endif
 
 // Manages a rendering target (framebuffer + attachment) for a canvas.  Can publish its rendering
 // results to a PlatformLayer for compositing.
-class DrawingBuffer : public Noncopyable {
+class DrawingBuffer : public RefCounted<DrawingBuffer> {
 public:
-    static PassOwnPtr<DrawingBuffer> create(SharedGraphicsContext3D*, const IntSize&);
+    friend class GraphicsContext3D;
+    
     ~DrawingBuffer();
 
     void reset(const IntSize&);
     void bind();
     IntSize size() const { return m_size; }
 
+    // Clear all resources from this object, as well as context. Called when context is destroyed
+    // to prevent invalid accesses to the resources.
+    void clear();
+    
 #if USE(ACCELERATED_COMPOSITING)
     PlatformLayer* platformLayer();
     void publishToPlatformLayer();
@@ -62,21 +71,36 @@ public:
 
     unsigned getRenderingResultsAsTexture();
 
+#if PLATFORM(CHROMIUM)
     class WillPublishCallback : public Noncopyable {
     public:
+        virtual ~WillPublishCallback() { }
+        
         virtual void willPublish() = 0;
     };
 
-    void setWillPublishCallback(PassOwnPtr<WillPublishCallback>);
+    void setWillPublishCallback(PassOwnPtr<WillPublishCallback> callback) { m_callback = callback; }
+#endif
+
+    PassRefPtr<GraphicsContext3D> graphicsContext3D() const { return m_context; }
+
 private:
-    DrawingBuffer(SharedGraphicsContext3D*, const IntSize&, unsigned framebuffer);
+    static PassRefPtr<DrawingBuffer> create(GraphicsContext3D*, const IntSize&);
+    
+    DrawingBuffer(GraphicsContext3D*, const IntSize&);
 
-    SharedGraphicsContext3D* m_context;
+    RefPtr<GraphicsContext3D> m_context;
     IntSize m_size;
-    unsigned m_framebuffer;
+    Platform3DObject m_fbo;
 
+#if PLATFORM(CHROMIUM)
     OwnPtr<WillPublishCallback> m_callback;
     OwnPtr<DrawingBufferInternal> m_internal;
+#endif
+
+#if PLATFORM(MAC)
+    RetainPtr<WebGLLayer> m_platformLayer;
+#endif
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/gpu/LoopBlinnClassifier.cpp b/WebCore/platform/graphics/gpu/LoopBlinnClassifier.cpp
index e43dc37..672b4d7 100644
--- a/WebCore/platform/graphics/gpu/LoopBlinnClassifier.cpp
+++ b/WebCore/platform/graphics/gpu/LoopBlinnClassifier.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "LoopBlinnClassifier.h"
 
 #include "LoopBlinnMathUtils.h"
@@ -120,3 +122,5 @@ LoopBlinnClassifier::Result LoopBlinnClassifier::classify(const FloatPoint& c0,
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp b/WebCore/platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp
index 3b73ff6..1517a67 100644
--- a/WebCore/platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp
+++ b/WebCore/platform/graphics/gpu/LoopBlinnLocalTriangulator.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "LoopBlinnLocalTriangulator.h"
 
 #include "LoopBlinnMathUtils.h"
@@ -273,3 +275,5 @@ bool LoopBlinnLocalTriangulator::isSharedEdge(Vertex* v0, Vertex* v1)
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp b/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
index 61ebc9b..5b155a5 100644
--- a/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
+++ b/WebCore/platform/graphics/gpu/LoopBlinnMathUtils.cpp
@@ -25,12 +25,13 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "LoopBlinnMathUtils.h"
 
 #include "FloatPoint.h"
-#include "MathExtras.h"
 #include <algorithm>
-#include <string.h> // for memcpy
+#include <wtf/MathExtras.h>
 
 namespace WebCore {
 namespace LoopBlinnMathUtils {
@@ -563,3 +564,5 @@ int numXRayCrossingsForCubic(const XRay& xRay, const FloatPoint cubic[4], bool&
 
 } // namespace LoopBlinnMathUtils
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/LoopBlinnTextureCoords.cpp b/WebCore/platform/graphics/gpu/LoopBlinnTextureCoords.cpp
index ac82637..d272fe1 100644
--- a/WebCore/platform/graphics/gpu/LoopBlinnTextureCoords.cpp
+++ b/WebCore/platform/graphics/gpu/LoopBlinnTextureCoords.cpp
@@ -25,6 +25,8 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "LoopBlinnTextureCoords.h"
 
 #include <math.h>
@@ -169,3 +171,5 @@ LoopBlinnTextureCoords::Result LoopBlinnTextureCoords::compute(const LoopBlinnCl
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/PODInterval.h b/WebCore/platform/graphics/gpu/PODInterval.h
index 9df69ba..5c1dcc2 100644
--- a/WebCore/platform/graphics/gpu/PODInterval.h
+++ b/WebCore/platform/graphics/gpu/PODInterval.h
@@ -27,7 +27,7 @@
 #define PODInterval_h
 
 #ifndef NDEBUG
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 #endif
 
 namespace WebCore {
@@ -57,14 +57,24 @@ namespace WebCore {
 // constructor and assignment operator.
 //
 // In debug mode, printing of intervals and the data they contain is
-// enabled. This requires the following functions to be available:
+// enabled. This requires the following template specializations to be
+// available:
 //
-//   String valueToString(const T&);
-//   String valueToString(const UserData&);
+//   template<> struct WebCore::ValueToString<T> {
+//       static String string(const T& t);
+//   };
+//   template<> struct WebCore::ValueToString<UserData> {
+//       static String string(const UserData& t);
+//   };
 //
 // Note that this class requires a copy constructor and assignment
 // operator in order to be stored in the red-black tree.
 
+#ifndef NDEBUG
+template<class T>
+struct ValueToString;
+#endif
+
 template<class T, class UserData = void*>
 class PODInterval {
 public:
@@ -131,13 +141,13 @@ public:
     {
         StringBuilder builder;
         builder.append("[PODInterval (");
-        builder.append(valueToString(low()));
+        builder.append(ValueToString<T>::string(low()));
         builder.append(", ");
-        builder.append(valueToString(high()));
+        builder.append(ValueToString<T>::string(high()));
         builder.append("), data=");
-        builder.append(valueToString(data()));
+        builder.append(ValueToString<UserData>::string(data()));
         builder.append(", maxHigh=");
-        builder.append(valueToString(maxHigh()));
+        builder.append(ValueToString<T>::string(maxHigh()));
         builder.append("]");
         return builder.toString();
     }
diff --git a/WebCore/platform/graphics/gpu/PODIntervalTree.h b/WebCore/platform/graphics/gpu/PODIntervalTree.h
index c0a86aa..320ce60 100644
--- a/WebCore/platform/graphics/gpu/PODIntervalTree.h
+++ b/WebCore/platform/graphics/gpu/PODIntervalTree.h
@@ -35,6 +35,11 @@
 
 namespace WebCore {
 
+#ifndef NDEBUG
+template<class T>
+struct ValueToString;
+#endif
+
 // An interval tree, which is a form of augmented red-black tree. It
 // supports efficient (O(lg n)) insertion, removal and querying of
 // intervals in the tree.
@@ -191,7 +196,7 @@ private:
             localMaxValue = node->data().high();
         if (!(localMaxValue == node->data().maxHigh())) {
 #ifndef NDEBUG
-            String localMaxValueString = valueToString(localMaxValue);
+            String localMaxValueString = ValueToString<T>::string(localMaxValue);
             LOG_ERROR("PODIntervalTree verification failed at node 0x%p: localMaxValue=%s and data=%s",
                       node, localMaxValueString.utf8().data(), node->data().toString().utf8().data());
 #endif
@@ -206,10 +211,12 @@ private:
 #ifndef NDEBUG
 // Support for printing PODIntervals at the PODRedBlackTree level.
 template<class T, class UserData>
-String valueToString(const PODInterval<T, UserData>& interval)
-{
-    return interval.toString();
-}
+struct ValueToString<PODInterval<T, UserData> > {
+    static String string(const PODInterval<T, UserData>& interval)
+    {
+        return interval.toString();
+    }
+};
 #endif
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/gpu/PODRedBlackTree.h b/WebCore/platform/graphics/gpu/PODRedBlackTree.h
index 9b02037..6d5954c 100644
--- a/WebCore/platform/graphics/gpu/PODRedBlackTree.h
+++ b/WebCore/platform/graphics/gpu/PODRedBlackTree.h
@@ -42,9 +42,11 @@
 // the "<" and "==" operators.
 //
 // In debug mode, printing of the data contained in the tree is
-// enabled. This requires the following function to be available:
+// enabled. This requires the template specialization to be available:
 //
-//   String valueToString(const T&);
+//   template<> struct WebCore::ValueToString<T> {
+//       static String string(const T& t);
+//   };
 //
 // Note that when complex types are stored in this red/black tree, it
 // is possible that single invocations of the "<" and "==" operators
@@ -76,13 +78,18 @@
 #include <wtf/RefPtr.h>
 #ifndef NDEBUG
 #include "Logging.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 #endif
 
 namespace WebCore {
 
+#ifndef NDEBUG
+template<class T>
+struct ValueToString;
+#endif
+
 template<class T>
 class PODRedBlackTree {
 public:
@@ -723,7 +730,7 @@ private:
         builder.append("-");
         if (node) {
             builder.append(" ");
-            builder.append(valueToString(node->data()));
+            builder.append(ValueToString<T>::string(node->data()));
             builder.append((node->color() == Black) ? " (black)" : " (red)");
         }
         LOG_ERROR("%s", builder.toString().ascii().data());
diff --git a/WebCore/platform/graphics/gpu/Shader.cpp b/WebCore/platform/graphics/gpu/Shader.cpp
index 59c50a7..8983adc 100644
--- a/WebCore/platform/graphics/gpu/Shader.cpp
+++ b/WebCore/platform/graphics/gpu/Shader.cpp
@@ -29,6 +29,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "Shader.h"
 
 #include "AffineTransform.h"
@@ -109,3 +112,5 @@ Shader::~Shader()
 }
 
 }
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp b/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
index 7629735..87a0b69 100644
--- a/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
+++ b/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.cpp
@@ -30,6 +30,8 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "SharedGraphicsContext3D.h"
 
 #include "AffineTransform.h"
@@ -47,16 +49,26 @@
 namespace WebCore {
 
 // static
-PassRefPtr<SharedGraphicsContext3D> SharedGraphicsContext3D::create(PassOwnPtr<GraphicsContext3D> context)
-{
-    return adoptRef(new SharedGraphicsContext3D(context));
-}
-
-SharedGraphicsContext3D::SharedGraphicsContext3D(PassOwnPtr<GraphicsContext3D> context)
+PassRefPtr<SharedGraphicsContext3D> SharedGraphicsContext3D::create(HostWindow* hostWindow)
+{
+    GraphicsContext3D::Attributes attr;
+    RefPtr<GraphicsContext3D> context = GraphicsContext3D::create(attr, hostWindow);
+    if (!context)
+        return 0;
+    OwnPtr<SolidFillShader> solidFillShader = SolidFillShader::create(context.get());
+    if (!solidFillShader)
+        return 0;
+    OwnPtr<TexShader> texShader = TexShader::create(context.get());
+    if (!texShader)
+        return 0;
+    return adoptRef(new SharedGraphicsContext3D(context.release(), solidFillShader.release(), texShader.release()));
+}
+
+SharedGraphicsContext3D::SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D> context, PassOwnPtr<SolidFillShader> solidFillShader, PassOwnPtr<TexShader> texShader)
     : m_context(context)
     , m_quadVertices(0)
-    , m_solidFillShader(SolidFillShader::create(m_context.get()))
-    , m_texShader(TexShader::create(m_context.get()))
+    , m_solidFillShader(solidFillShader)
+    , m_texShader(texShader)
 {
     allContexts()->add(this);
 }
@@ -215,8 +227,8 @@ void SharedGraphicsContext3D::removeTexturesFor(NativeImagePtr ptr)
 // static
 HashSet<SharedGraphicsContext3D*>* SharedGraphicsContext3D::allContexts()
 {
-    static OwnPtr<HashSet<SharedGraphicsContext3D*> > set(new HashSet<SharedGraphicsContext3D*>);
-    return set.get();
+    DEFINE_STATIC_LOCAL(HashSet<SharedGraphicsContext3D*>, allContextsSet, ());
+    return &allContextsSet;
 }
 
 
@@ -334,3 +346,5 @@ bool SharedGraphicsContext3D::paintsIntoCanvasBuffer() const
 }
 
 } // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h b/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
index 3ba3c52..05008c2 100644
--- a/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
+++ b/WebCore/platform/graphics/gpu/SharedGraphicsContext3D.h
@@ -47,6 +47,7 @@ class AffineTransform;
 class Color;
 class GraphicsContext3D;
 class FloatRect;
+class HostWindow;
 class IntSize;
 class SolidFillShader;
 class TexShader;
@@ -55,7 +56,7 @@ typedef HashMap<NativeImagePtr, RefPtr<Texture> > TextureHashMap;
 
 class SharedGraphicsContext3D : public RefCounted<SharedGraphicsContext3D> {
 public:
-    static PassRefPtr<SharedGraphicsContext3D> create(PassOwnPtr<GraphicsContext3D>);
+    static PassRefPtr<SharedGraphicsContext3D> create(HostWindow*);
     ~SharedGraphicsContext3D();
 
     // Functions that delegate directly to GraphicsContext3D, with caching
@@ -117,14 +118,16 @@ public:
     // the texture.
     PassRefPtr<Texture> createTexture(Texture::Format, int width, int height);
 
+    GraphicsContext3D* graphicsContext3D() const { return m_context.get(); }
+
 private:
-    explicit SharedGraphicsContext3D(PassOwnPtr<GraphicsContext3D> context);
+    SharedGraphicsContext3D(PassRefPtr<GraphicsContext3D>, PassOwnPtr<SolidFillShader>, PassOwnPtr<TexShader>);
 
     // Used to implement removeTexturesFor(), see the comment above.
     static HashSet<SharedGraphicsContext3D*>* allContexts();
     void removeTextureFor(NativeImagePtr);
 
-    OwnPtr<GraphicsContext3D> m_context;
+    RefPtr<GraphicsContext3D> m_context;
 
     unsigned m_quadVertices;
 
diff --git a/WebCore/platform/graphics/gpu/SolidFillShader.cpp b/WebCore/platform/graphics/gpu/SolidFillShader.cpp
index ff1b1fa..86079be 100644
--- a/WebCore/platform/graphics/gpu/SolidFillShader.cpp
+++ b/WebCore/platform/graphics/gpu/SolidFillShader.cpp
@@ -29,6 +29,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "SolidFillShader.h"
 
 #include "Color.h"
@@ -86,3 +89,5 @@ void SolidFillShader::use(const AffineTransform& transform, const Color& color)
 }
 
 }
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/TexShader.cpp b/WebCore/platform/graphics/gpu/TexShader.cpp
index 01f4306..d7ffa17 100644
--- a/WebCore/platform/graphics/gpu/TexShader.cpp
+++ b/WebCore/platform/graphics/gpu/TexShader.cpp
@@ -29,6 +29,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "TexShader.h"
 
 #include "GraphicsContext3D.h"
@@ -93,3 +96,5 @@ void TexShader::use(const AffineTransform& transform, const AffineTransform& tex
 }
 
 }
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/Texture.cpp b/WebCore/platform/graphics/gpu/Texture.cpp
index 6023fe9..74807dc 100644
--- a/WebCore/platform/graphics/gpu/Texture.cpp
+++ b/WebCore/platform/graphics/gpu/Texture.cpp
@@ -30,6 +30,8 @@
 
 #include "config.h"
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "Texture.h"
 
 #include "FloatRect.h"
@@ -206,3 +208,5 @@ void Texture::bindTile(int tile)
 }
 
 }
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/Texture.h b/WebCore/platform/graphics/gpu/Texture.h
index eda475e..92b6d0a 100644
--- a/WebCore/platform/graphics/gpu/Texture.h
+++ b/WebCore/platform/graphics/gpu/Texture.h
@@ -31,11 +31,11 @@
 #ifndef Texture_h
 #define Texture_h
 
-#include "RefCounted.h"
-#include "RefPtr.h"
 #include "TilingData.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassOwnPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/RefPtr.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
diff --git a/WebCore/platform/graphics/gpu/TilingData.cpp b/WebCore/platform/graphics/gpu/TilingData.cpp
index 4da242b..a98add7 100644
--- a/WebCore/platform/graphics/gpu/TilingData.cpp
+++ b/WebCore/platform/graphics/gpu/TilingData.cpp
@@ -29,6 +29,9 @@
  */
 
 #include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS)
+
 #include "TilingData.h"
 
 #include "FloatRect.h"
@@ -220,3 +223,5 @@ void TilingData::intersectDrawQuad(const FloatRect& srcRect, const FloatRect& ds
 }
 
 }
+
+#endif
diff --git a/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm b/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
new file mode 100644
index 0000000..7a8c501
--- /dev/null
+++ b/WebCore/platform/graphics/gpu/mac/DrawingBufferMac.mm
@@ -0,0 +1,84 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+
+#if ENABLE(ACCELERATED_2D_CANVAS) || ENABLE(3D_CANVAS)
+
+#include "DrawingBuffer.h"
+
+#include "WebGLLayer.h"
+
+#import "BlockExceptions.h"
+
+namespace WebCore {
+
+DrawingBuffer::DrawingBuffer(GraphicsContext3D* context, const IntSize& size)
+    : m_context(context)
+    , m_size(size)
+    , m_fbo(context->createFramebuffer())
+{
+    ASSERT(m_fbo);
+    if (!m_fbo) {
+        clear();
+        return;
+    }
+        
+    // Create the WebGLLayer
+    BEGIN_BLOCK_OBJC_EXCEPTIONS
+        m_platformLayer.adoptNS([[WebGLLayer alloc] initWithGraphicsContext3D:m_context.get()]);
+#ifndef NDEBUG
+        [m_platformLayer.get() setName:@"DrawingBuffer Layer"];
+#endif    
+    END_BLOCK_OBJC_EXCEPTIONS
+}
+
+DrawingBuffer::~DrawingBuffer()
+{
+    clear();
+}
+
+void DrawingBuffer::reset(const IntSize& newSize)
+{
+    if (!m_context)
+        return;
+        
+    if (m_size == newSize)
+        return;
+    m_size = newSize;
+
+    m_context->texImage2D(GraphicsContext3D::TEXTURE_2D, 0, GraphicsContext3D::RGBA, m_size.width(), m_size.height(), 0, GraphicsContext3D::RGBA, GraphicsContext3D::UNSIGNED_BYTE, 0);
+}
+
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* DrawingBuffer::platformLayer()
+{
+    return m_platformLayer.get();
+}
+#endif
+
+}
+
+#endif
diff --git a/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp b/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
index 539d92a..1cb561e 100644
--- a/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
+++ b/WebCore/platform/graphics/gstreamer/GStreamerGWorld.cpp
@@ -194,12 +194,14 @@ void GStreamerGWorld::setWindowOverlay(GstMessage* message)
     if (g_object_class_find_property(G_OBJECT_GET_CLASS(sink), "force-aspect-ratio"))
         g_object_set(sink, "force-aspect-ratio", TRUE, NULL);
 
-    if (m_videoWindow)
+    if (m_videoWindow) {
+        m_videoWindow->prepareForOverlay(message);
 #if GST_CHECK_VERSION(0, 10, 31) || GST_VERSION_NANO
         gst_x_overlay_set_window_handle(GST_X_OVERLAY(sink), m_videoWindow->videoWindowId());
 #else
         gst_x_overlay_set_xwindow_id(GST_X_OVERLAY(sink), m_videoWindow->videoWindowId());
 #endif
+    }
 }
 
 }
diff --git a/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp b/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
index da9255b..7012c9f 100644
--- a/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
+++ b/WebCore/platform/graphics/gstreamer/MediaPlayerPrivateGStreamer.cpp
@@ -1212,7 +1212,7 @@ void MediaPlayerPrivateGStreamer::paint(GraphicsContext* context, const IntRect&
     if (!gstImage)
         return;
 
-    context->drawImage(reinterpret_cast<Image*>(gstImage->image().get()), sRGBColorSpace,
+    context->drawImage(reinterpret_cast<Image*>(gstImage->image().get()), ColorSpaceSRGB,
                        rect, CompositeCopy, false);
 }
 
diff --git a/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h b/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
index f3df207..f2a3ff2 100644
--- a/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
+++ b/WebCore/platform/graphics/gstreamer/PlatformVideoWindow.h
@@ -25,6 +25,8 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
+typedef struct _GstMessage GstMessage;
+
 namespace WebCore {
 
 class PlatformVideoWindow : public RefCounted<PlatformVideoWindow> {
@@ -34,6 +36,8 @@ class PlatformVideoWindow : public RefCounted<PlatformVideoWindow> {
         PlatformVideoWindow();
         ~PlatformVideoWindow();
 
+
+        void prepareForOverlay(GstMessage*);
         PlatformWidget window() const { return m_window; }
         unsigned long videoWindowId() const { return m_videoWindowId; }
 
diff --git a/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp b/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
index c55b9cc..0097716 100644
--- a/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
+++ b/WebCore/platform/graphics/gstreamer/PlatformVideoWindowEfl.cpp
@@ -35,4 +35,8 @@ PlatformVideoWindow::~PlatformVideoWindow()
     notImplemented();
 }
 
+void PlatformVideoWindow::prepareForOverlay(GstMessage*)
+{
+}
+
 #endif // USE(GSTREAMER)
diff --git a/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp b/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
index 77343ae..c2f76cd 100644
--- a/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
+++ b/WebCore/platform/graphics/gstreamer/PlatformVideoWindowGtk.cpp
@@ -61,4 +61,9 @@ PlatformVideoWindow::~PlatformVideoWindow()
 
     m_videoWindowId = 0;
 }
+
+void PlatformVideoWindow::prepareForOverlay(GstMessage*)
+{
+}
 #endif // USE(GSTREAMER)
+
diff --git a/WebCore/platform/graphics/gtk/FontGtk.cpp b/WebCore/platform/graphics/gtk/FontGtk.cpp
index 27f48fc..328ec4a 100644
--- a/WebCore/platform/graphics/gtk/FontGtk.cpp
+++ b/WebCore/platform/graphics/gtk/FontGtk.cpp
@@ -181,31 +181,15 @@ bool Font::canReturnFallbackFontsForComplexText()
     return false;
 }
 
-#ifndef GTK_API_VERSION_2
-static void cairo_region_shrink(cairo_region_t* region, int dx, int dy)
+void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
 {
-    int nRects = cairo_region_num_rectangles(region);
-    // Clear region.
-    cairo_region_subtract(region, region);
-
-    for (int i = 0; i < nRects; i++) {
-        cairo_rectangle_int_t rect;
-        cairo_region_get_rectangle(region, i, &rect);
-
-        if (rect.width <= 2 * dx || rect.height <= 2 * dy)
-            continue;
-
-        rect.x += dx;
-        rect.y += dy;
-        rect.width -= 2 * dx;
-        rect.height -= 2 * dy;
-        cairo_region_union_rectangle(region, &rect);
+#if defined(USE_FREETYPE)
+    if (!primaryFont()->platformData().m_pattern) {
+        drawSimpleText(context, run, point, from, to);
+        return;
     }
-}
 #endif
 
-void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const FloatPoint& point, int from, int to) const
-{
     cairo_t* cr = context->platformContext();
     cairo_save(cr);
     cairo_translate(cr, point.x(), point.y());
@@ -224,17 +208,13 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 #else
     cairo_region_t* partialRegion = 0;
 #endif
+
     if (to - from != run.length()) {
         // Clip the region of the run to be rendered
         char* start = g_utf8_offset_to_pointer(utf8, from);
         char* end = g_utf8_offset_to_pointer(start, to - from);
         int ranges[] = {start - utf8, end - utf8};
         partialRegion = gdk_pango_layout_line_get_clip_region(layoutLine, 0, 0, ranges, 1);
-#ifdef GTK_API_VERSION_2
-        gdk_region_shrink(partialRegion, 0, -pixelSize());
-#else
-        cairo_region_shrink(partialRegion, 0, -pixelSize());
-#endif
     }
 
     Color fillColor = context->fillColor();
@@ -290,7 +270,7 @@ void Font::drawComplexText(GraphicsContext* context, const TextRun& run, const F
 
     // Re-enable the platform shadow we disabled earlier
     if (hasShadow)
-        context->setShadow(shadowOffset, shadowBlur, shadowColor, DeviceColorSpace);
+        context->setShadow(shadowOffset, shadowBlur, shadowColor, ColorSpaceDeviceRGB);
 
     // Pango sometimes leaves behind paths we don't want
     cairo_new_path(cr);
@@ -323,8 +303,13 @@ static PangoLayout* getDefaultPangoLayout(const TextRun& run)
     return layout;
 }
 
-float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* /* fallbackFonts */, GlyphOverflow*) const
+float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* overflow) const
 {
+#if defined(USE_FREETYPE)
+    if (!primaryFont()->platformData().m_pattern)
+        return floatWidthForSimpleText(run, 0, fallbackFonts, overflow);
+#endif
+
     if (run.length() == 0)
         return 0.0f;
 
@@ -345,6 +330,10 @@ float Font::floatWidthForComplexText(const TextRun& run, HashSet<const SimpleFon
 
 int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool includePartialGlyphs) const
 {
+#if defined(USE_FREETYPE)
+    if (!primaryFont()->platformData().m_pattern)
+        return offsetForPositionForSimpleText(run, xFloat, includePartialGlyphs);
+#endif
     // FIXME: This truncation is not a problem for HTML, but only affects SVG, which passes floating-point numbers
     // to Font::offsetForPosition(). Bug http://webkit.org/b/40673 tracks fixing this problem.
     int x = static_cast<int>(xFloat);
@@ -369,6 +358,11 @@ int Font::offsetForPositionForComplexText(const TextRun& run, float xFloat, bool
 
 FloatRect Font::selectionRectForComplexText(const TextRun& run, const FloatPoint& point, int h, int from, int to) const
 {
+#if defined(USE_FREETYPE)
+    if (!primaryFont()->platformData().m_pattern)
+        return selectionRectForSimpleText(run, point, h, from, to);
+#endif
+
     PangoLayout* layout = getDefaultPangoLayout(run);
     setPangoAttributes(this, run, layout);
 
diff --git a/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp b/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
index edb26f0..486a317 100644
--- a/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
+++ b/WebCore/platform/graphics/gtk/ImageBufferGtk.cpp
@@ -28,6 +28,7 @@
 #include <cairo.h>
 #include <gtk/gtk.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -67,7 +68,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     base64Encode(reinterpret_cast<const char*>(buffer.get()), bufferSize, out);
     out.append('\0');
 
-    return String::format("data:%s;base64,%s", mimeType.utf8().data(), out.data());
+    return makeString("data:", mimeType, ";base64,", out.data());
 }
 
 }
diff --git a/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
index c5de485..d1b06f3 100644
--- a/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/ImageBufferHaiku.cpp
@@ -33,6 +33,7 @@
 #include "MIMETypeRegistry.h"
 #include "StillImageHaiku.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <BitmapStream.h>
 #include <String.h>
 #include <TranslatorRoster.h>
@@ -367,8 +368,7 @@ String ImageBuffer::toDataURL(const String& mimeType, const double*) const
     base64Encode(reinterpret_cast<const char*>(translatedStream.Buffer()),
                  translatedStream.BufferLength(), encodedBuffer);
 
-    return String::format("data:%s;base64,%s", mimeType.utf8().data(),
-                          encodedBuffer.data());
+    return makeString("data:", mimeType, ";base64,", encodedBuffer.data());
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/haiku/PathHaiku.cpp b/WebCore/platform/graphics/haiku/PathHaiku.cpp
index c5b8c98..5377e10 100644
--- a/WebCore/platform/graphics/haiku/PathHaiku.cpp
+++ b/WebCore/platform/graphics/haiku/PathHaiku.cpp
@@ -144,12 +144,6 @@ bool Path::isEmpty() const
     return !m_path->Frame().IsValid();
 }
 
-String Path::debugString() const
-{
-    notImplemented();
-    return String();
-}
-
 void Path::apply(void* info, PathApplierFunction function) const
 {
     notImplemented();
diff --git a/WebCore/platform/graphics/mac/ColorMac.mm b/WebCore/platform/graphics/mac/ColorMac.mm
index c8ea9b1..07d6353 100644
--- a/WebCore/platform/graphics/mac/ColorMac.mm
+++ b/WebCore/platform/graphics/mac/ColorMac.mm
@@ -88,14 +88,15 @@ NSColor *nsColor(const Color& color)
             static unsigned cachedRGBAValues[cacheSize];
             static RetainPtr<NSColor>* cachedColors = new RetainPtr<NSColor>[cacheSize];
 
-            for (int i = 0; i != cacheSize; ++i)
+            for (int i = 0; i != cacheSize; ++i) {
                 if (cachedRGBAValues[i] == c)
                     return cachedColors[i].get();
+            }
 
             NSColor *result = [NSColor colorWithDeviceRed:static_cast<CGFloat>(color.red()) / 255
                                                     green:static_cast<CGFloat>(color.green()) / 255
                                                      blue:static_cast<CGFloat>(color.blue()) / 255
-                                                    alpha:static_cast<CGFloat>(color.alpha()) /255];
+                                                    alpha:static_cast<CGFloat>(color.alpha()) / 255];
 
             static int cursor;
             cachedRGBAValues[cursor] = c;
@@ -107,24 +108,5 @@ NSColor *nsColor(const Color& color)
     }
 }
 
-static CGColorRef CGColorFromNSColor(NSColor *color)
-{
-    // This needs to always use device colorspace so it can de-calibrate the color for
-    // CGColor to possibly recalibrate it.
-    CGFloat components[4];
-    NSColor *deviceColor = [color colorUsingColorSpaceName:NSDeviceRGBColorSpace];
-    [deviceColor getRed:&components[0] green:&components[1] blue:&components[2] alpha:&components[3]];
-    static CGColorSpaceRef deviceRGBColorSpace = CGColorSpaceCreateDeviceRGB();
-    CGColorRef cgColor = CGColorCreate(deviceRGBColorSpace, components);
-    return cgColor;
-}
-
-CGColorRef createCGColor(const Color& c)
-{
-    // We could directly create a CGColor here, but that would
-    // skip any RGB caching the nsColor method does. A direct 
-    // creation could be investigated for a possible performance win.
-    return CGColorFromNSColor(nsColor(c));
-}
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm b/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
index a4919d8..e079b44 100644
--- a/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContext3DMac.mm
@@ -77,12 +77,12 @@ static void setPixelFormat(Vector<CGLPixelFormatAttribute>& attribs, int colorBi
     attribs.append(static_cast<CGLPixelFormatAttribute>(0));
 }
 
-PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
 {
     // This implementation doesn't currently support rendering directly to the HostWindow.
     if (renderStyle == RenderDirectlyToHostWindow)
         return 0;
-    OwnPtr<GraphicsContext3D> context(new GraphicsContext3D(attrs, hostWindow, false));
+    RefPtr<GraphicsContext3D> context = adoptRef(new GraphicsContext3D(attrs, hostWindow, false));
     return context->m_contextObj ? context.release() : 0;
 }
 
diff --git a/WebCore/platform/graphics/mac/GraphicsContextMac.mm b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
index f3301d8..aa754f2 100644
--- a/WebCore/platform/graphics/mac/GraphicsContextMac.mm
+++ b/WebCore/platform/graphics/mac/GraphicsContextMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -30,6 +30,7 @@
 #import <AppKit/AppKit.h>
 #import <wtf/StdLibExtras.h>
 
+#import "LocalCurrentGraphicsContext.h"
 #import "WebCoreSystemInterface.h"
 
 @class NSColor;
@@ -43,14 +44,14 @@ namespace WebCore {
 // calls in this file are all exception-safe, so we don't block
 // exceptions for those.
 
-static void drawFocusRingToContext(CGContextRef context, RetainPtr<CGPathRef> focusRingPath, RetainPtr<CGColorRef> colorRef, int radius)
+static void drawFocusRingToContext(CGContextRef context, CGPathRef focusRingPath, CGColorRef color, int radius)
 {
 #ifdef BUILDING_ON_TIGER
     CGContextBeginTransparencyLayer(context, 0);
 #endif
     CGContextBeginPath(context);
-    CGContextAddPath(context, focusRingPath.get());
-    wkDrawFocusRing(context, colorRef.get(), radius);
+    CGContextAddPath(context, focusRingPath);
+    wkDrawFocusRing(context, color, radius);
 #ifdef BUILDING_ON_TIGER
     CGContextEndTransparencyLayer(context);
 #endif
@@ -63,16 +64,14 @@ void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int of
     
     int radius = (width - 1) / 2;
     offset += radius;
-    RetainPtr<CGColorRef> colorRef;
-    if (color.isValid())
-        colorRef.adoptCF(createCGColor(color));
-    
+    CGColorRef colorRef = color.isValid() ? cachedCGColor(color, ColorSpaceDeviceRGB) : 0;
+
     RetainPtr<CGMutablePathRef> focusRingPath(AdoptCF, CGPathCreateMutable());
     unsigned pathCount = paths.size();
     for (unsigned i = 0; i < pathCount; i++)
         CGPathAddPath(focusRingPath.get(), 0, paths[i].platformPath());
     
-    drawFocusRingToContext(platformContext(), focusRingPath, colorRef, radius);
+    drawFocusRingToContext(platformContext(), focusRingPath.get(), colorRef, radius);
 }    
     
 void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int offset, const Color& color)
@@ -82,16 +81,14 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
 
     int radius = (width - 1) / 2;
     offset += radius;
-    RetainPtr<CGColorRef> colorRef;
-    if (color.isValid())
-        colorRef.adoptCF(createCGColor(color));
+    CGColorRef colorRef = color.isValid() ? cachedCGColor(color, ColorSpaceDeviceRGB) : 0;
 
     RetainPtr<CGMutablePathRef> focusRingPath(AdoptCF, CGPathCreateMutable());
     unsigned rectCount = rects.size();
     for (unsigned i = 0; i < rectCount; i++)
         CGPathAddRect(focusRingPath.get(), 0, CGRectInset(rects[i], -offset, -offset));
 
-    drawFocusRingToContext(platformContext(), focusRingPath, colorRef, radius);
+    drawFocusRingToContext(platformContext(), focusRingPath.get(), colorRef, radius);
 }
 
 #ifdef BUILDING_ON_TIGER // Post-Tiger's setCompositeOperation() is defined in GraphicsContextCG.cpp.
@@ -182,6 +179,7 @@ void GraphicsContext::drawLineForTextChecking(const IntPoint& point, int width,
     // for transforms.
 
     // Draw underline.
+    LocalCurrentGraphicsContext localContext(this);
     NSGraphicsContext *currentContext = [NSGraphicsContext currentContext];
     CGContextRef context = (CGContextRef)[currentContext graphicsPort];
     CGContextSaveGState(context);
diff --git a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
index d4cd851..c4128ef 100644
--- a/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
+++ b/WebCore/platform/graphics/mac/GraphicsLayerCA.mm
@@ -38,7 +38,6 @@
 #import <QuartzCore/QuartzCore.h>
 #import "RotateTransformOperation.h"
 #import "ScaleTransformOperation.h"
-#import "StringBuilder.h"
 #import "SystemTime.h"
 #import "TranslateTransformOperation.h"
 #import "WebLayer.h"
@@ -48,6 +47,7 @@
 #import <wtf/CurrentTime.h>
 #import <wtf/UnusedParam.h>
 #import <wtf/RetainPtr.h>
+#import <wtf/text/StringConcatenate.h>
 
 using namespace std;
 
@@ -248,7 +248,7 @@ static String propertyIdToString(AnimatedPropertyID property)
 
 static String animationIdentifier(const String& animationName, AnimatedPropertyID property, int index)
 {
-    return animationName + String::format("_%d_%d", property, index);
+    return makeString(animationName, '_', String::number(property), '_', String::number(index));
 }
 
 static CAMediaTimingFunction* getCAMediaTimingFunction(const TimingFunction* timingFunction)
@@ -265,9 +265,7 @@ static CAMediaTimingFunction* getCAMediaTimingFunction(const TimingFunction* tim
 
 static void setLayerBorderColor(PlatformLayer* layer, const Color& color)
 {
-    CGColorRef borderColor = createCGColor(color);
-    [layer setBorderColor:borderColor];
-    CGColorRelease(borderColor);
+    [layer setBorderColor:cachedCGColor(color, ColorSpaceDeviceRGB)];
 }
 
 static void clearBorderColor(PlatformLayer* layer)
@@ -277,9 +275,7 @@ static void clearBorderColor(PlatformLayer* layer)
 
 static void setLayerBackgroundColor(PlatformLayer* layer, const Color& color)
 {
-    CGColorRef bgColor = createCGColor(color);
-    [layer setBackgroundColor:bgColor];
-    CGColorRelease(bgColor);
+    [layer setBackgroundColor:cachedCGColor(color, ColorSpaceDeviceRGB)];
 }
 
 static void clearLayerBackgroundColor(PlatformLayer* layer)
diff --git a/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp b/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
index 53d9b86..daf3b12 100644
--- a/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
+++ b/WebCore/platform/graphics/opengl/GraphicsContext3DOpenGL.cpp
@@ -1161,11 +1161,11 @@ String GraphicsContext3D::getProgramInfoLog(Platform3DObject program)
     makeContextCurrent();
     GLint length;
     ::glGetProgramiv((GLuint) program, GL_INFO_LOG_LENGTH, &length);
-    
+    if (!length)
+        return "";
+
     GLsizei size;
     GLchar* info = (GLchar*) fastMalloc(length);
-    if (!info)
-        return "";
 
     ::glGetProgramInfoLog((GLuint) program, length, &size, info);
     String s(info);
@@ -1227,8 +1227,6 @@ String GraphicsContext3D::getShaderInfoLog(Platform3DObject shader)
     ASSERT(shader);
 
     makeContextCurrent();
-    GLint length;
-    ::glGetShaderiv((GLuint) shader, GL_INFO_LOG_LENGTH, &length);
 
     HashMap<Platform3DObject, ShaderSourceEntry>::iterator result = m_shaderSourceMap.find(shader);
 
@@ -1240,21 +1238,19 @@ String GraphicsContext3D::getShaderInfoLog(Platform3DObject shader)
      if (entry.isValid) {
          GLint length;
          ::glGetShaderiv((GLuint) shader, GL_INFO_LOG_LENGTH, &length);
+         if (!length)
+             return "";
 
          GLsizei size;
          GLchar* info = (GLchar*) fastMalloc(length);
-         if (!info)
-             return "";
 
          ::glGetShaderInfoLog((GLuint) shader, length, &size, info);
 
          String s(info);
          fastFree(info);
          return s;
-     }
-     else {
+     } else
          return entry.log;
-     }
 }
 
 String GraphicsContext3D::getShaderSource(Platform3DObject shader)
@@ -1449,6 +1445,11 @@ void GraphicsContext3D::synthesizeGLError(unsigned long error)
     m_syntheticErrors.add(error);
 }
 
+int GraphicsContext3D::getGraphicsResetStatusARB()
+{
+    return NO_ERROR;
+}
+
 }
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/openvg/PathOpenVG.cpp b/WebCore/platform/graphics/openvg/PathOpenVG.cpp
index e74ea57..39a4b06 100644
--- a/WebCore/platform/graphics/openvg/PathOpenVG.cpp
+++ b/WebCore/platform/graphics/openvg/PathOpenVG.cpp
@@ -436,18 +436,6 @@ bool Path::hasCurrentPoint() const
     return vgGetParameteri(m_path->vgPath(), VG_PATH_NUM_SEGMENTS) > 0;
 }
 
-String Path::debugString() const
-{
-    String debugString = "";
-
-    // OpenVG provides no means to retrieve path segment information.
-    // This is a bit unfortunate, we might need to store the segments in
-    // memory if we want to implement this function properly.
-    notImplemented();
-
-    return debugString;
-}
-
 void Path::apply(void* info, PathApplierFunction function) const
 {
     // OpenVG provides no means to retrieve path segment information.
diff --git a/WebCore/platform/graphics/qt/FontQt.cpp b/WebCore/platform/graphics/qt/FontQt.cpp
index e7566eb..b049181 100644
--- a/WebCore/platform/graphics/qt/FontQt.cpp
+++ b/WebCore/platform/graphics/qt/FontQt.cpp
@@ -137,7 +137,7 @@ static void drawTextCommon(GraphicsContext* ctx, const TextRun& run, const Float
                     dy1 = -ctxShadow->offset().y();
                 // expand the clip rect to include the text shadow as well
                 clip.adjust(dx1, dx2, dy1, dy2);
-                clip.adjust(-ctxShadow->m_blurRadius, -ctxShadow->m_blurRadius, ctxShadow->m_blurRadius, ctxShadow->m_blurRadius);
+                clip.adjust(-ctxShadow->m_blurDistance, -ctxShadow->m_blurDistance, ctxShadow->m_blurDistance, ctxShadow->m_blurDistance);
             }
             p->save();
             p->setClipRect(clip.toRect(), Qt::IntersectClip);
diff --git a/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp b/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
index 0756aa7..cda8606 100644
--- a/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContext3DQt.cpp
@@ -286,6 +286,11 @@ bool GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses() const
     return false;
 }
 
+int GraphicsContext3D::getGraphicsResetStatusARB()
+{
+    return NO_ERROR;
+}
+
  
 GraphicsContext3DInternal::GraphicsContext3DInternal(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow)
     : m_attrs(attrs)
diff --git a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
index 7e4af40..8b34f51 100644
--- a/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsContextQt.cpp
@@ -204,6 +204,13 @@ public:
         return shadow.m_type != ContextShadow::NoShadow;
     }
 
+    inline void clearCurrentPath()
+    {
+        if (!currentPath.elementCount())
+            return;
+        currentPath = QPainterPath();
+    }
+
     QRectF clipBoundingRect() const
     {
 #if QT_VERSION >= QT_VERSION_CHECK(4, 8, 0)
@@ -248,8 +255,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor(), DeviceColorSpace);
-        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
+        setPlatformFillColor(fillColor(), ColorSpaceDeviceRGB);
+        setPlatformStrokeColor(strokeColor(), ColorSpaceDeviceRGB);
 
         // Make sure we start with the correct join mode.
         setLineJoin(MiterJoin);
@@ -533,7 +540,7 @@ void GraphicsContext::fillPath()
     } else
         p->fillPath(path, p->brush());
 
-    m_data->currentPath = QPainterPath();
+    m_data->clearCurrentPath();
 }
 
 void GraphicsContext::strokePath()
@@ -566,7 +573,7 @@ void GraphicsContext::strokePath()
         p->strokePath(path, pen);
     } else
         p->strokePath(path, pen);
-    m_data->currentPath = QPainterPath();
+    m_data->clearCurrentPath();
 }
 
 static inline void drawRepeatPattern(QPainter* p, QPixmap* image, const FloatRect& rect, const bool repeatX, const bool repeatY)
@@ -722,7 +729,8 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
     if (paintingDisabled() || !color.isValid())
         return;
 
-    Path path = Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight);
+    Path path;
+    path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
     QPainter* p = m_data->p();
     if (m_data->hasShadow()) {
         p->translate(m_data->shadow.offset());
@@ -734,7 +742,7 @@ void GraphicsContext::fillRoundedRect(const IntRect& rect, const IntSize& topLef
 
 void GraphicsContext::beginPath()
 {
-    m_data->currentPath = QPainterPath();
+    m_data->clearCurrentPath();
 }
 
 void GraphicsContext::addPath(const Path& path)
@@ -777,7 +785,7 @@ void GraphicsContext::clipPath(WindRule clipRule)
     QPainter* p = m_data->p();
     QPainterPath newPath = m_data->currentPath;
     newPath.setFillRule(clipRule == RULE_EVENODD ? Qt::OddEvenFill : Qt::WindingFill);
-    p->setClipPath(newPath);
+    p->setClipPath(newPath, Qt::IntersectClip);
 }
 
 void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int offset, const Color& color)
@@ -835,8 +843,28 @@ void GraphicsContext::drawLineForText(const IntPoint& origin, int width, bool)
     if (paintingDisabled())
         return;
 
+    IntPoint startPoint = origin;
     IntPoint endPoint = origin + IntSize(width, 0);
-    drawLine(origin, endPoint);
+
+    // If paintengine type is X11 to avoid artifacts
+    // like bug https://bugs.webkit.org/show_bug.cgi?id=42248
+#if defined(Q_WS_X11)
+    QPainter* p = m_data->p();
+    if (p->paintEngine()->type() == QPaintEngine::X11) {
+        // If stroke thickness is odd we need decrease Y coordinate by 1 pixel,
+        // because inside method adjustLineToPixelBoundaries(...), which
+        // called from drawLine(...), Y coordinate will be increased by 0.5f
+        // and then inside Qt painting engine will be rounded to next greater
+        // integer value.
+        float strokeWidth = strokeThickness();
+        if (static_cast<int>(strokeWidth) % 2) {
+            startPoint.setY(startPoint.y() - 1);
+            endPoint.setY(endPoint.y() - 1);
+        }
+    }
+#endif // defined(Q_WS_X11)
+
+    drawLine(startPoint, endPoint);
 }
 
 void GraphicsContext::drawLineForTextChecking(const IntPoint&, int, TextCheckingLineStyle)
diff --git a/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp b/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
index 079d8ba..e0941f5 100644
--- a/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
+++ b/WebCore/platform/graphics/qt/GraphicsLayerQt.cpp
@@ -37,6 +37,7 @@
 #include <QtGui/qgraphicseffect.h>
 #include <QtGui/qgraphicsitem.h>
 #include <QtGui/qgraphicsscene.h>
+#include <QtGui/qgraphicswidget.h>
 #include <QtGui/qpainter.h>
 #include <QtGui/qpixmap.h>
 #include <QtGui/qpixmapcache.h>
@@ -320,7 +321,7 @@ GraphicsLayerQtImpl::~GraphicsLayerQtImpl()
     // our items automatically.
     const QList<QGraphicsItem*> children = childItems();
     QList<QGraphicsItem*>::const_iterator cit;
-    for (cit = children.begin(); cit != children.end(); ++cit) {
+    for (cit = children.constBegin(); cit != children.constEnd(); ++cit) {
         if (QGraphicsItem* item = *cit) {
             if (scene())
                 scene()->removeItem(item);
@@ -523,7 +524,7 @@ void GraphicsLayerQtImpl::updateTransform()
 
     const QList<QGraphicsItem*> children = childItems();
     QList<QGraphicsItem*>::const_iterator it;
-    for (it = children.begin(); it != children.end(); ++it)
+    for (it = children.constBegin(); it != children.constEnd(); ++it)
         if (GraphicsLayerQtImpl* layer= toGraphicsLayerQtImpl(*it))
             layer->updateTransform();
 }
@@ -610,13 +611,13 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
     if (!m_layer || m_changeMask == NoChanges)
         goto afterLayerChanges;
 
-    if (m_currentContent.contentType == HTMLContentType && (m_changeMask & ParentChange)) {
+    if (m_changeMask & ParentChange) {
         // The WebCore compositor manages item ownership. We have to make sure graphicsview doesn't
         // try to snatch that ownership.
         if (!m_layer->parent() && !parentItem())
             setParentItem(0);
         else if (m_layer && m_layer->parent() && m_layer->parent()->nativeLayer() != parentItem())
-            setParentItem(m_layer->parent()->nativeLayer());
+            setParentItem(m_layer->parent()->platformLayer());
     }
 
     if (m_changeMask & ChildrenChange) {
@@ -634,13 +635,13 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
         const QSet<QGraphicsItem*> childrenToRemove = currentChildren - newChildren;
 
         QSet<QGraphicsItem*>::const_iterator it;
-        for (it = childrenToAdd.begin(); it != childrenToAdd.end(); ++it) {
+        for (it = childrenToAdd.constBegin(); it != childrenToAdd.constEnd(); ++it) {
              if (QGraphicsItem* w = *it)
                 w->setParentItem(this);
         }
 
         QSet<QGraphicsItem*>::const_iterator rit;
-        for (rit = childrenToRemove.begin(); rit != childrenToRemove.end(); ++rit) {
+        for (rit = childrenToRemove.constBegin(); rit != childrenToRemove.constEnd(); ++rit) {
              if (GraphicsLayerQtImpl* w = toGraphicsLayerQtImpl(*rit))
                 w->setParentItem(0);
         }
@@ -680,7 +681,7 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
         if (scene())
             scene()->update();
 
-    if (m_changeMask & (ChildrenTransformChange | Preserves3DChange | TransformChange | AnchorPointChange | SizeChange | BackfaceVisibilityChange | PositionChange)) {
+    if (m_changeMask & (ChildrenTransformChange | Preserves3DChange | TransformChange | AnchorPointChange | SizeChange | BackfaceVisibilityChange | PositionChange | ParentChange)) {
         // Due to the differences between the way WebCore handles transforms and the way Qt handles transforms,
         // all these elements affect the transforms of all the descendants.
         forceUpdateTransform = true;
@@ -737,6 +738,11 @@ void GraphicsLayerQtImpl::flushChanges(bool recursive, bool forceUpdateTransform
         const QRect rect(m_layer->contentsRect());
         if (m_state.contentsRect != rect) {
             m_state.contentsRect = rect;
+            if (m_pendingContent.mediaLayer) {
+                QGraphicsWidget* widget = qobject_cast<QGraphicsWidget*>(m_pendingContent.mediaLayer.data());
+                if (widget)
+                    widget->setGeometry(rect);
+            }
             update();
         }
     }
@@ -804,7 +810,7 @@ afterLayerChanges:
         children.append(m_state.maskLayer->platformLayer());
 
     QList<QGraphicsItem*>::const_iterator it;
-    for (it = children.begin(); it != children.end(); ++it) {
+    for (it = children.constBegin(); it != children.constEnd(); ++it) {
         if (QGraphicsItem* item = *it) {
             if (GraphicsLayerQtImpl* layer = toGraphicsLayerQtImpl(item))
                 layer->flushChanges(true, forceUpdateTransform);
@@ -850,6 +856,20 @@ void GraphicsLayerQt::setNeedsDisplayInRect(const FloatRect& rect)
     m_impl->notifyChange(GraphicsLayerQtImpl::DisplayChange);
 }
 
+void GraphicsLayerQt::setContentsNeedsDisplay()
+{
+    switch (m_impl->m_pendingContent.contentType) {
+    case GraphicsLayerQtImpl::MediaContentType:
+        if (!m_impl->m_pendingContent.mediaLayer)
+            return;
+        m_impl->m_pendingContent.mediaLayer.data()->update();
+        break;
+    default:
+        setNeedsDisplay();
+        break;
+    }
+}
+
 /* \reimp (GraphicsLayer.h)
 */
 void GraphicsLayerQt::setName(const String& name)
diff --git a/WebCore/platform/graphics/qt/GraphicsLayerQt.h b/WebCore/platform/graphics/qt/GraphicsLayerQt.h
index 75ca498..ed535eb 100644
--- a/WebCore/platform/graphics/qt/GraphicsLayerQt.h
+++ b/WebCore/platform/graphics/qt/GraphicsLayerQt.h
@@ -75,6 +75,7 @@ public:
     virtual void resumeAnimations();
 #endif // QT_NO_ANIMATION
     virtual void setContentsToImage(Image*);
+    virtual void setContentsNeedsDisplay();
     virtual void setContentsToMedia(PlatformLayer*);
     virtual void setContentsBackgroundColor(const Color&);
 #if ENABLE(3D_CANVAS)
diff --git a/WebCore/platform/graphics/qt/ImageBufferQt.cpp b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
index ee01222..0cdc894 100644
--- a/WebCore/platform/graphics/qt/ImageBufferQt.cpp
+++ b/WebCore/platform/graphics/qt/ImageBufferQt.cpp
@@ -35,6 +35,7 @@
 #include "StillImageQt.h"
 #include "TransparencyLayer.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #include <QBuffer>
 #include <QColor>
@@ -68,7 +69,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     pen.setColor(Qt::black);
     pen.setWidth(1);
     pen.setCapStyle(Qt::FlatCap);
-    pen.setJoinStyle(Qt::MiterJoin);
+    pen.setJoinStyle(Qt::SvgMiterJoin);
     pen.setMiterLimit(10);
     painter->setPen(pen);
     QBrush brush = painter->brush();
@@ -79,7 +80,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
     m_image = StillImage::createForRendering(&m_pixmap);
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -117,7 +118,7 @@ void ImageBuffer::draw(GraphicsContext* destContext, ColorSpace styleColorSpace,
     if (destContext == context()) {
         // We're drawing into our own buffer.  In order for this to work, we need to copy the source buffer first.
         RefPtr<Image> copy = copyImage();
-        destContext->drawImage(copy.get(), DeviceColorSpace, destRect, srcRect, op, useLowQualityScale);
+        destContext->drawImage(copy.get(), ColorSpaceDeviceRGB, destRect, srcRect, op, useLowQualityScale);
     } else
         destContext->drawImage(m_data.m_image.get(), styleColorSpace, destRect, srcRect, op, useLowQualityScale);
 }
@@ -139,7 +140,7 @@ void ImageBuffer::clip(GraphicsContext* context, const FloatRect& floatRect) con
     if (!nativeImage)
         return;
 
-    IntRect rect(floatRect);
+    IntRect rect = enclosingIntRect(floatRect);
     QPixmap alphaMask = *nativeImage;
     if (alphaMask.width() != rect.width() || alphaMask.height() != rect.height())
         alphaMask = alphaMask.scaled(rect.width(), rect.height());
@@ -216,7 +217,7 @@ PassRefPtr<ImageData> getImageData(const IntRect& rect, const ImageBufferData& i
     const uchar* bits = image.bits();
 #endif
 
-    quint32* destRows = reinterpret_cast_ptr<quint32*>(&data[desty * rect.width() + destx]);
+    quint32* destRows = reinterpret_cast_ptr<quint32*>(&data[desty * rect.width() * 4 + destx * 4]);
 
     if (multiplied == Unmultiplied) {
         for (int y = 0; y < numRows; ++y) {
@@ -401,7 +402,8 @@ String ImageBuffer::toDataURL(const String& mimeType, const double* quality) con
     }
 
     buffer.close();
-    return String::format("data:%s;base64,%s", mimeType.utf8().data(), data.toBase64().data());
+
+    return makeString("data:", mimeType, ";base64,", data.toBase64().data());
 }
 
 }
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp b/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
index 1a31d1e..962c931 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.cpp
@@ -27,6 +27,7 @@
 #include "HTMLVideoElement.h"
 #include "NetworkingContext.h"
 #include "NotImplemented.h"
+#include "RenderVideo.h"
 #include "TimeRanges.h"
 #include "Widget.h"
 #include "qwebframe.h"
@@ -42,6 +43,7 @@
 #include <QPainter>
 #include <QPoint>
 #include <QRect>
+#include <QStyleOptionGraphicsItem>
 #include <QTime>
 #include <QTimer>
 #include <QUrl>
@@ -49,6 +51,10 @@
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
 
+#if USE(ACCELERATED_COMPOSITING)
+#include "texmap/TextureMapperPlatformLayer.h"
+#endif
+
 using namespace WTF;
 
 namespace WebCore {
@@ -93,6 +99,8 @@ MediaPlayerPrivateQt::MediaPlayerPrivateQt(MediaPlayer* player)
     , m_videoScene(new QGraphicsScene)
     , m_networkState(MediaPlayer::Empty)
     , m_readyState(MediaPlayer::HaveNothing)
+    , m_currentSize(0, 0)
+    , m_naturalSize(RenderVideo::defaultSize())
     , m_isVisible(false)
     , m_isSeeking(false)
     , m_composited(false)
@@ -125,8 +133,7 @@ MediaPlayerPrivateQt::MediaPlayerPrivateQt(MediaPlayer* player)
            this, SLOT(nativeSizeChanged(QSizeF)));
 
     // Grab the player control
-    QMediaService* service = m_mediaPlayer->service();
-    if (service) {
+    if (QMediaService* service = m_mediaPlayer->service()) {
         m_mediaPlayerControl = qobject_cast<QMediaPlayerControl *>(
                 service->requestControl(QMediaPlayerControl_iid));
     }
@@ -134,6 +141,10 @@ MediaPlayerPrivateQt::MediaPlayerPrivateQt(MediaPlayer* player)
 
 MediaPlayerPrivateQt::~MediaPlayerPrivateQt()
 {
+    m_mediaPlayer->disconnect(this);
+    m_mediaPlayer->stop();
+    m_mediaPlayer->setMedia(QMediaContent());
+
     delete m_mediaPlayer;
     delete m_videoScene;
 }
@@ -330,8 +341,7 @@ float MediaPlayerPrivateQt::duration() const
 
 float MediaPlayerPrivateQt::currentTime() const
 {
-    float currentTime = m_mediaPlayer->position() / 1000.0f;
-    return currentTime;
+    return m_mediaPlayer->position() / 1000.0f;
 }
 
 PassRefPtr<TimeRanges> MediaPlayerPrivateQt::buffered() const
@@ -437,8 +447,15 @@ void MediaPlayerPrivateQt::stateChanged(QMediaPlayer::State state)
     }
 }
 
-void MediaPlayerPrivateQt::nativeSizeChanged(const QSizeF&)
+void MediaPlayerPrivateQt::nativeSizeChanged(const QSizeF& size)
 {
+    LOG(Media, "MediaPlayerPrivateQt::naturalSizeChanged(%dx%d)",
+            size.toSize().width(), size.toSize().height());
+
+    if (!size.isValid())
+        return;
+
+    m_naturalSize = size.toSize();
     m_webCorePlayer->sizeChanged();
 }
 
@@ -466,7 +483,7 @@ void MediaPlayerPrivateQt::seekTimeout()
 
 void MediaPlayerPrivateQt::positionChanged(qint64)
 {
-    // Only propogate this event if we are seeking
+    // Only propagate this event if we are seeking
     if (m_isSeeking && m_queuedSeek == -1) {
         m_webCorePlayer->timeChanged();
         m_isSeeking = false;
@@ -546,6 +563,9 @@ void MediaPlayerPrivateQt::updateStates()
 
 void MediaPlayerPrivateQt::setSize(const IntSize& size)
 {
+    LOG(Media, "MediaPlayerPrivateQt::setSize(%dx%d)",
+            size.width(), size.height());
+
     if (size == m_currentSize)
         return;
 
@@ -555,10 +575,15 @@ void MediaPlayerPrivateQt::setSize(const IntSize& size)
 
 IntSize MediaPlayerPrivateQt::naturalSize() const
 {
-    if (!hasVideo() || m_readyState < MediaPlayer::HaveMetadata)
+    if (!hasVideo() ||  m_readyState < MediaPlayer::HaveMetadata) {
+        LOG(Media, "MediaPlayerPrivateQt::naturalSize() -> 0x0 (!hasVideo || !haveMetaData)");
         return IntSize();
+    }
 
-    return IntSize(m_videoItem->nativeSize().toSize());
+    LOG(Media, "MediaPlayerPrivateQt::naturalSize() -> %dx%d (m_naturalSize)",
+            m_naturalSize.width(), m_naturalSize.height());
+
+    return m_naturalSize;
 }
 
 void MediaPlayerPrivateQt::paint(GraphicsContext* context, const IntRect& rect)
@@ -573,10 +598,7 @@ void MediaPlayerPrivateQt::paint(GraphicsContext* context, const IntRect& rect)
     if (!m_isVisible)
         return;
 
-    // Grab the painter and widget
     QPainter* painter = context->platformContext();
-
-    // Render the video
     m_videoScene->render(painter, QRectF(QRect(rect)), m_videoItem->sceneBoundingRect());
 }
 
@@ -585,7 +607,41 @@ void MediaPlayerPrivateQt::repaint()
     m_webCorePlayer->repaint();
 }
 
-#if USE(ACCELERATED_COMPOSITING)
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+
+class TextureMapperVideoLayerQt : public virtual TextureMapperVideoLayer {
+public:
+    TextureMapperVideoLayerQt(QGraphicsVideoItem* videoItem)
+        : m_videoItem(videoItem)
+    {
+    }
+
+    virtual void setPlatformLayerClient(TextureMapperLayerClient* client)
+    {
+        m_client = client;
+    }
+
+    virtual void paint(GraphicsContext* context)
+    {
+        if (!m_videoItem)
+            return;
+
+        QStyleOptionGraphicsItem opt;
+        opt.exposedRect = m_videoItem.data()->sceneBoundingRect();
+        opt.rect = opt.exposedRect.toRect();
+        m_videoItem.data()->paint(context->platformContext(), &opt);
+    }
+
+    virtual IntSize size() const
+    {
+        return m_videoItem ? IntSize(m_videoItem.data()->size().width(), m_videoItem.data()->size().height()) : IntSize();
+    }
+
+    QWeakPointer<QGraphicsVideoItem> m_videoItem;
+    TextureMapperLayerClient* m_client;
+};
+
+
 void MediaPlayerPrivateQt::acceleratedRenderingStateChanged()
 {
     MediaPlayerClient* client = m_webCorePlayer->mediaPlayerClient();
@@ -595,14 +651,12 @@ void MediaPlayerPrivateQt::acceleratedRenderingStateChanged()
 
     m_composited = composited;
     if (composited)
-        m_videoScene->removeItem(m_videoItem);
-    else
-        m_videoScene->addItem(m_videoItem);
+        m_platformLayer = new TextureMapperVideoLayerQt(m_videoItem);
 }
 
 PlatformLayer* MediaPlayerPrivateQt::platformLayer() const
 {
-    return m_composited ? m_videoItem : 0;
+    return m_composited ? m_platformLayer.get() : 0;
 }
 #endif
 
diff --git a/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h b/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
index 179bf2a..93c9d1c 100644
--- a/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
+++ b/WebCore/platform/graphics/qt/MediaPlayerPrivateQt.h
@@ -33,6 +33,8 @@ QT_END_NAMESPACE
 
 namespace WebCore {
 
+class TextureMapperVideoLayer;
+
 class MediaPlayerPrivateQt : public QObject, public MediaPlayerPrivateInterface {
 
     Q_OBJECT
@@ -91,12 +93,18 @@ public:
     bool supportsFullscreen() const { return false; }
 
 #if USE(ACCELERATED_COMPOSITING)
+#if USE(TEXTURE_MAPPER)
     // whether accelerated rendering is supported by the media engine for the current media.
     virtual bool supportsAcceleratedRendering() const { return true; }
     // called when the rendering system flips the into or out of accelerated rendering mode.
     virtual void acceleratedRenderingStateChanged();
     // returns an object that can be directly composited via GraphicsLayerQt (essentially a QGraphicsItem*)
     virtual PlatformLayer* platformLayer() const;
+#else
+    virtual bool supportsAcceleratedRendering() const { return false; }
+    virtual void acceleratedRenderingStateChanged() { }
+    virtual PlatformLayer* platformLayer() const { return 0; }
+#endif
 #endif
 
     virtual PlatformMedia platformMedia() const;
@@ -125,11 +133,15 @@ private:
     QMediaPlayerControl* m_mediaPlayerControl;
     QGraphicsVideoItem* m_videoItem;
     QGraphicsScene* m_videoScene;
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    OwnPtr<TextureMapperVideoLayer> m_platformLayer;
+#endif
 
     mutable MediaPlayer::NetworkState m_networkState;
     mutable MediaPlayer::ReadyState m_readyState;
 
     IntSize m_currentSize;
+    IntSize m_naturalSize;
     bool m_isVisible;
     bool m_isSeeking;
     bool m_composited;
diff --git a/WebCore/platform/graphics/qt/PathQt.cpp b/WebCore/platform/graphics/qt/PathQt.cpp
index b8b9d5e..508ba6a 100644
--- a/WebCore/platform/graphics/qt/PathQt.cpp
+++ b/WebCore/platform/graphics/qt/PathQt.cpp
@@ -335,6 +335,8 @@ void Path::addEllipse(const FloatRect& r)
 
 void Path::clear()
 {
+    if (!m_path.elementCount())
+        return;
     m_path = QPainterPath();
 }
 
@@ -355,41 +357,6 @@ FloatPoint Path::currentPoint() const
     return m_path.currentPosition();
 }
 
-String Path::debugString() const
-{
-    QString ret;
-    for (int i = 0; i < m_path.elementCount(); ++i) {
-        const QPainterPath::Element &cur = m_path.elementAt(i);
-
-        switch (cur.type) {
-            case QPainterPath::MoveToElement:
-                ret += QString(QLatin1String("M%1,%2 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2);
-                break;
-            case QPainterPath::LineToElement:
-                ret += QString(QLatin1String("L%1,%2 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2);
-                break;
-            case QPainterPath::CurveToElement:
-            {
-                const QPainterPath::Element &c1 = m_path.elementAt(i + 1);
-                const QPainterPath::Element &c2 = m_path.elementAt(i + 2);
-
-                Q_ASSERT(c1.type == QPainterPath::CurveToDataElement);
-                Q_ASSERT(c2.type == QPainterPath::CurveToDataElement);
-
-                ret += QString(QLatin1String("C%1,%2,%3,%4,%5,%6 ")).arg(cur.x, 0, 'f', 2).arg(cur.y, 0, 'f', 2).arg(c1.x, 0, 'f', 2)
-                                                                    .arg(c1.y, 0, 'f', 2).arg(c2.x, 0, 'f', 2).arg(c2.y, 0, 'f', 2);
-                i += 2;
-                break;
-            }
-            case QPainterPath::CurveToDataElement:
-                Q_ASSERT(false);
-                break;
-        }
-    }
-
-    return ret.trimmed();
-}
-
 void Path::apply(void* info, PathApplierFunction function) const
 {
     PathElement pelement;
diff --git a/WebCore/platform/graphics/qt/TextureMapperQt.cpp b/WebCore/platform/graphics/qt/TextureMapperQt.cpp
new file mode 100644
index 0000000..9236dae
--- /dev/null
+++ b/WebCore/platform/graphics/qt/TextureMapperQt.cpp
@@ -0,0 +1,225 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "texmap/TextureMapper.h"
+
+#include <QtCore/qdebug.h>
+#include <QtGui/qpaintengine.h>
+#include <QtGui/qpixmap.h>
+
+#ifdef QT_OPENGL_LIB
+# include "opengl/TextureMapperGL.h"
+#endif
+
+namespace WebCore {
+
+class BitmapTextureQt : public BitmapTexture {
+    friend class TextureMapperQt;
+public:
+    BitmapTextureQt() {}
+    virtual void destroy();
+    virtual IntSize size() const { return IntSize(m_pixmap.width(), m_pixmap.height()); }
+    virtual void reset(const IntSize&, bool opaque);
+    virtual PlatformGraphicsContext* beginPaint(const IntRect& dirtyRect);
+    virtual void endPaint();
+    virtual void setContentsToImage(Image*);
+    virtual bool save(const String& path);
+    virtual bool isValid() const { return !m_pixmap.isNull(); }
+    virtual bool allowOfflineTextureUpload() const { return true; }
+    IntRect sourceRect() const { return IntRect(0, 0, contentSize().width(), contentSize().height()); }
+private:
+    QPainter m_painter;
+    QPixmap m_pixmap;
+};
+
+class TextureMapperQt : public TextureMapper {
+public:
+    virtual void drawTexture(const BitmapTexture& texture, const IntRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* maskTexture);
+    virtual void bindSurface(BitmapTexture* surface);
+    virtual void setClip(const IntRect&);
+    virtual bool allowSurfaceForRoot() const { return false; }
+    TextureMapperQt(GraphicsContext* context);
+    virtual const char* type() const { return "TextureMapperQt"; }
+    virtual PassRefPtr<BitmapTexture> createTexture();
+
+    static void initialize(QPainter* painter)
+    {
+        painter->setRenderHints(QPainter::Antialiasing | QPainter::SmoothPixmapTransform, false);
+    }
+
+private:
+    QPainter* m_painter;
+    RefPtr<BitmapTextureQt> m_currentSurface;
+};
+
+void BitmapTextureQt::destroy()
+{
+    if (m_pixmap.paintingActive())
+        qFatal("Destroying an active pixmap");
+    m_pixmap = QPixmap();
+}
+
+void BitmapTextureQt::reset(const IntSize& size, bool isOpaque)
+{
+    BitmapTexture::reset(size, isOpaque);
+
+    if (size.width() > m_pixmap.size().width() || size.height() > m_pixmap.size().height() || m_pixmap.isNull())
+        m_pixmap = QPixmap(size.width(), size.height());
+    if (!isOpaque)
+        m_pixmap.fill(Qt::transparent);
+}
+
+PlatformGraphicsContext* BitmapTextureQt::beginPaint(const IntRect& dirtyRect)
+{
+    m_painter.begin(&m_pixmap);
+    TextureMapperQt::initialize(&m_painter);
+    m_painter.setCompositionMode(QPainter::CompositionMode_Clear);
+    m_painter.fillRect(QRect(dirtyRect), Qt::transparent);
+    m_painter.setCompositionMode(QPainter::CompositionMode_SourceOver);
+    return &m_painter;
+}
+
+void BitmapTextureQt::endPaint()
+{
+    m_painter.end();
+}
+
+bool BitmapTextureQt::save(const String& path)
+{
+    return m_pixmap.save(path, "PNG");
+}
+
+void BitmapTextureQt::setContentsToImage(Image* image)
+{
+    if (!image)
+        return;
+    const QPixmap* pixmap = image->nativeImageForCurrentFrame();
+    if (!pixmap)
+        return;
+    BitmapTexture::reset(pixmap->size(), !pixmap->hasAlphaChannel());
+    m_pixmap = *pixmap;
+}
+
+void TextureMapperQt::setClip(const IntRect& rect)
+{
+     QPainter* painter = m_currentSurface ? &m_currentSurface->m_painter : m_painter;
+     painter->setClipRect(rect);
+}
+
+TextureMapperQt::TextureMapperQt(GraphicsContext* context)
+    : TextureMapper(context)
+    , m_painter(context->platformContext())
+    , m_currentSurface(0)
+{
+    TextureMapperQt::initialize(m_painter);
+}
+
+void TextureMapperQt::bindSurface(BitmapTexture* surface)
+{
+    if (m_currentSurface == surface)
+        return;
+    if (m_currentSurface)
+        m_currentSurface->m_painter.end();
+    if (!surface) {
+        m_currentSurface = 0;
+        return;
+    }
+    BitmapTextureQt* surfaceQt = static_cast<BitmapTextureQt*>(surface);
+    if (!surfaceQt->m_painter.isActive())
+        surfaceQt->m_painter.begin(&surfaceQt->m_pixmap);
+    m_currentSurface = surfaceQt;
+}
+
+
+void TextureMapperQt::drawTexture(const BitmapTexture& texture, const IntRect& targetRect, const TransformationMatrix& matrix, float opacity, const BitmapTexture* maskTexture)
+{
+    const BitmapTextureQt& textureQt = static_cast<const BitmapTextureQt&>(texture);
+    QPainter* painter = m_painter;
+    QPixmap pixmap = textureQt.m_pixmap;
+    if (m_currentSurface)
+        painter = &m_currentSurface->m_painter;
+
+    if (maskTexture && maskTexture->isValid()) {
+        const BitmapTextureQt* mask = static_cast<const BitmapTextureQt*>(maskTexture);
+        QPixmap intermediatePixmap(pixmap.size());
+        intermediatePixmap.fill(Qt::transparent);
+        QPainter maskPainter(&intermediatePixmap);
+        maskPainter.setCompositionMode(QPainter::CompositionMode_Source);
+        maskPainter.drawPixmap(0, 0, pixmap);
+        maskPainter.setCompositionMode(QPainter::CompositionMode_DestinationIn);
+        maskPainter.drawPixmap(QRect(0, 0, pixmap.width(), pixmap.height()), mask->m_pixmap, mask->sourceRect());
+        maskPainter.end();
+        pixmap = intermediatePixmap;
+    }
+
+    const qreal prevOpacity = painter->opacity();
+    const QTransform prevTransform = painter->transform();
+    painter->setOpacity(opacity);
+    painter->setTransform(matrix, true);
+    painter->drawPixmap(targetRect, pixmap, textureQt.sourceRect());
+    painter->setTransform(prevTransform);
+    painter->setOpacity(prevOpacity);
+}
+
+PassRefPtr<TextureMapper> TextureMapper::create(GraphicsContext* context)
+{
+#ifdef QT_OPENGL_LIB
+    if (context->platformContext()->paintEngine()->type() == QPaintEngine::OpenGL2)
+        return adoptRef(new TextureMapperGL(context));
+#endif
+    return adoptRef(new TextureMapperQt(context));
+}
+
+
+PassRefPtr<BitmapTexture> TextureMapperQt::createTexture()
+{
+    return adoptRef(new BitmapTextureQt());
+}
+
+#ifdef QT_OPENGL_LIB
+class RGBA32PremultimpliedBufferQt : public RGBA32PremultimpliedBuffer {
+public:
+    virtual PlatformGraphicsContext* beginPaint(const IntRect& rect, bool opaque)
+    {
+        // m_image is only using during paint, it's safe to override it.
+        m_image = QImage(rect.size().width(), rect.size().height(), QImage::Format_ARGB32_Premultiplied);
+        if (!opaque)
+            m_image.fill(0);
+        m_painter.begin(&m_image);
+        TextureMapperQt::initialize(&m_painter);
+        m_painter.translate(-rect.x(), -rect.y());
+        return &m_painter;
+    }
+
+    virtual void endPaint() { m_painter.end(); }
+    virtual const void* data() const { return m_image.constBits(); }
+
+private:
+    QPainter m_painter;
+    QImage m_image;
+};
+
+PassRefPtr<RGBA32PremultimpliedBuffer> RGBA32PremultimpliedBuffer::create()
+{
+    return adoptRef(new RGBA32PremultimpliedBufferQt());
+}
+
+#endif
+};
diff --git a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
index 2be7dc5..143d667 100644
--- a/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageBufferSkia.cpp
@@ -45,6 +45,8 @@
 #include "SkColorPriv.h"
 #include "SkiaUtils.h"
 
+#include <wtf/text/StringConcatenate.h>
+
 using namespace std;
 
 namespace WebCore {
@@ -58,7 +60,7 @@ ImageBufferData::ImageBufferData(const IntSize& size)
 {
 }
 
-ImageBuffer::ImageBuffer(const IntSize& size, ImageColorSpace imageColorSpace, bool& success)
+ImageBuffer::ImageBuffer(const IntSize& size, ColorSpace, bool& success)
     : m_data(size)
     , m_size(size)
 {
@@ -290,6 +292,7 @@ void putImageData(ImageData*& source, const IntRect& sourceRect, const IntPoint&
 
 void ImageBuffer::putUnmultipliedImageData(ImageData* source, const IntRect& sourceRect, const IntPoint& destPoint)
 {
+    context()->platformContext()->prepareForSoftwareDraw();
     putImageData<Unmultiplied>(source, sourceRect, destPoint, *context()->platformContext()->bitmap(), m_size);
 }
 
@@ -311,7 +314,7 @@ String ImageBuffer::toDataURL(const String&, const double*) const
     base64EncodedData.append('\0');
 
     // And the resulting string.
-    return String::format("data:image/png;base64,%s", base64EncodedData.data());
+    return makeString("data:image/png;base64,", base64EncodedData.data());
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/skia/ImageSkia.cpp b/WebCore/platform/graphics/skia/ImageSkia.cpp
index e123256..23e7be6 100644
--- a/WebCore/platform/graphics/skia/ImageSkia.cpp
+++ b/WebCore/platform/graphics/skia/ImageSkia.cpp
@@ -143,9 +143,7 @@ static ResamplingMode computeResamplingMode(PlatformContextSkia* platformContext
 
     // Everything else gets resampled.
     // If the platform context permits high quality interpolation, use it.
-    // High quality interpolation only enabled for scaling and translation.
-    if (platformContext->interpolationQuality() == InterpolationHigh
-        && !(platformContext->canvas()->getTotalMatrix().getType() & (SkMatrix::kAffine_Mask | SkMatrix::kPerspective_Mask)))
+    if (platformContext->interpolationQuality() == InterpolationHigh)
         return RESAMPLE_AWESOME;
     
     return RESAMPLE_LINEAR;
@@ -175,12 +173,8 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
         && srcIRect.height() == bitmap.height();
 
     // We will always draw in integer sizes, so round the destination rect.
-    // First we need to apply canvas transformation matrix to get desired size of
-    // resampled image.
-    SkRect destRectTransformed;
-    canvas.getTotalMatrix().mapRect(&destRectTransformed, destRect);
     SkIRect destRectRounded;
-    destRectTransformed.round(&destRectRounded);
+    destRect.round(&destRectRounded);
     SkIRect resizedImageRect =  // Represents the size of the resized image.
         { 0, 0, destRectRounded.width(), destRectRounded.height() };
 
@@ -194,10 +188,7 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     // Compute the visible portion of our rect.
     SkRect destBitmapSubsetSk;
     ClipRectToCanvas(canvas, destRect, &destBitmapSubsetSk);
-    // Determine size of resampled image based on clipped destination rect.
-    SkRect destBitmapSubsetSkTransformed;
-    canvas.getTotalMatrix().mapRect(&destBitmapSubsetSkTransformed, destBitmapSubsetSk);
-    destBitmapSubsetSkTransformed.offset(-destBitmapSubsetSkTransformed.fLeft, -destBitmapSubsetSkTransformed.fTop);
+    destBitmapSubsetSk.offset(-destRect.fLeft, -destRect.fTop);
 
     // The matrix inverting, etc. could have introduced rounding error which
     // causes the bounds to be outside of the resized bitmap. We round outward
@@ -205,7 +196,7 @@ static void drawResampledBitmap(SkCanvas& canvas, SkPaint& paint, const NativeIm
     // need, and then clamp to the bitmap bounds so we don't get any invalid
     // data.
     SkIRect destBitmapSubsetSkI;
-    destBitmapSubsetSkTransformed.roundOut(&destBitmapSubsetSkI);
+    destBitmapSubsetSk.roundOut(&destBitmapSubsetSkI);
     if (!destBitmapSubsetSkI.intersect(resizedImageRect))
         return;  // Resized image does not intersect.
 
diff --git a/WebCore/platform/graphics/skia/PathSkia.cpp b/WebCore/platform/graphics/skia/PathSkia.cpp
index 12241f8..89323c4 100644
--- a/WebCore/platform/graphics/skia/PathSkia.cpp
+++ b/WebCore/platform/graphics/skia/PathSkia.cpp
@@ -227,62 +227,6 @@ void Path::transform(const AffineTransform& xform)
     m_path->transform(xform);
 }
 
-String Path::debugString() const
-{
-    String result;
-
-    SkPath::Iter iter(*m_path, false);
-    SkPoint pts[4];
-
-    int numPoints = m_path->getPoints(0, 0);
-    SkPath::Verb verb;
-
-    do {
-        verb = iter.next(pts);
-        switch (verb) {
-        case SkPath::kMove_Verb:
-            result += String::format("M%.2f,%.2f ", pts[0].fX, pts[0].fY);
-            numPoints -= 1;
-            break;
-        case SkPath::kLine_Verb:
-          if (!iter.isCloseLine()) {
-                result += String::format("L%.2f,%.2f ", pts[1].fX, pts[1].fY); 
-                numPoints -= 1;
-            }
-            break;
-        case SkPath::kQuad_Verb:
-            result += String::format("Q%.2f,%.2f,%.2f,%.2f ",
-                pts[1].fX, pts[1].fY,
-                pts[2].fX, pts[2].fY);
-            numPoints -= 2;
-            break;
-        case SkPath::kCubic_Verb:
-            result += String::format("C%.2f,%.2f,%.2f,%.2f,%.2f,%.2f ",
-                pts[1].fX, pts[1].fY,
-                pts[2].fX, pts[2].fY,
-                pts[3].fX, pts[3].fY);
-            numPoints -= 3;
-            break;
-        case SkPath::kClose_Verb:
-            result += "Z ";
-            break;
-        case SkPath::kDone_Verb:
-            break;
-        }
-    } while (verb != SkPath::kDone_Verb);
-
-    // If you have a path that ends with an M, Skia will not iterate the
-    // trailing M. That's nice of it, but Apple's paths output the trailing M
-    // and we want out layout dumps to look like theirs
-    if (numPoints) {
-        ASSERT(numPoints==1);
-        m_path->getLastPt(pts);
-        result += String::format("M%.2f,%.2f ", pts[0].fX, pts[0].fY);
-    }
-
-    return result.stripWhiteSpace();
-}
-
 // Computes the bounding box for the stroke and style currently selected into
 // the given bounding box. This also takes into account the stroke width.
 static FloatRect boundingBoxForCurrentStroke(const GraphicsContext* context)
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
index b469312..3f9e4c1 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.cpp
@@ -34,12 +34,10 @@
 
 #include "AffineTransform.h"
 #include "DrawingBuffer.h"
-#include "GLES2Canvas.h"
 #include "GraphicsContext.h"
 #include "GraphicsContext3D.h"
 #include "ImageBuffer.h"
 #include "NativeImageSkia.h"
-#include "SharedGraphicsContext3D.h"
 #include "SkiaUtils.h"
 #include "Texture.h"
 #include "TilingData.h"
@@ -56,6 +54,11 @@
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/Vector.h>
 
+#if ENABLE(ACCELERATED_2D_CANVAS)
+#include "GLES2Canvas.h"
+#include "SharedGraphicsContext3D.h"
+#endif
+
 namespace WebCore {
 
 extern bool isPathSkiaSafe(const SkMatrix& transform, const SkPath& path);
@@ -207,7 +210,9 @@ PlatformContextSkia::PlatformContextSkia(skia::PlatformCanvas* canvas)
     : m_canvas(canvas)
     , m_drawingToImageBuffer(false)
     , m_useGPU(false)
+#if ENABLE(ACCELERATED_2D_CANVAS)
     , m_gpuCanvas(0)
+#endif
     , m_backingStoreState(None)
 {
     m_stateStack.append(State());
@@ -216,8 +221,10 @@ PlatformContextSkia::PlatformContextSkia(skia::PlatformCanvas* canvas)
 
 PlatformContextSkia::~PlatformContextSkia()
 {
+#if ENABLE(ACCELERATED_2D_CANVAS)
     if (m_gpuCanvas)
         m_gpuCanvas->drawingBuffer()->setWillPublishCallback(0);
+#endif
 }
 
 void PlatformContextSkia::setCanvas(skia::PlatformCanvas* canvas)
@@ -705,6 +712,7 @@ private:
 
 void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* context, DrawingBuffer* drawingBuffer, const WebCore::IntSize& size)
 {
+#if ENABLE(ACCELERATED_2D_CANVAS)
     if (context && drawingBuffer) {
         m_useGPU = true;
         m_gpuCanvas = new GLES2Canvas(context, drawingBuffer, size);
@@ -716,6 +724,7 @@ void PlatformContextSkia::setSharedGraphicsContext3D(SharedGraphicsContext3D* co
         m_gpuCanvas.clear();
         m_useGPU = false;
     }
+#endif
 }
 
 void PlatformContextSkia::prepareForSoftwareDraw() const
@@ -808,6 +817,7 @@ void PlatformContextSkia::markDirtyRect(const IntRect& rect)
 
 void PlatformContextSkia::uploadSoftwareToHardware(CompositeOperator op) const
 {
+#if ENABLE(ACCELERATED_2D_CANVAS)
     const SkBitmap& bitmap = m_canvas->getDevice()->accessBitmap(false);
     SkAutoLockPixels lock(bitmap);
     SharedGraphicsContext3D* context = m_gpuCanvas->context();
@@ -816,7 +826,7 @@ void PlatformContextSkia::uploadSoftwareToHardware(CompositeOperator op) const
 
     m_uploadTexture->updateSubRect(bitmap.getPixels(), m_softwareDirtyRect);
     AffineTransform identity;
-    gpuCanvas()->drawTexturedRect(m_uploadTexture.get(), m_softwareDirtyRect, m_softwareDirtyRect, identity, 1.0, DeviceColorSpace, op);
+    gpuCanvas()->drawTexturedRect(m_uploadTexture.get(), m_softwareDirtyRect, m_softwareDirtyRect, identity, 1.0, ColorSpaceDeviceRGB, op);
     // Clear out the region of the software canvas we just uploaded.
     m_canvas->save();
     m_canvas->resetMatrix();
@@ -825,10 +835,12 @@ void PlatformContextSkia::uploadSoftwareToHardware(CompositeOperator op) const
     m_canvas->drawARGB(0, 0, 0, 0, SkXfermode::kClear_Mode);
     m_canvas->restore();
     m_softwareDirtyRect.setWidth(0); // Clear dirty rect.
+#endif
 }
 
 void PlatformContextSkia::readbackHardwareToSoftware() const
 {
+#if ENABLE(ACCELERATED_2D_CANVAS)
     const SkBitmap& bitmap = m_canvas->getDevice()->accessBitmap(true);
     SkAutoLockPixels lock(bitmap);
     int width = bitmap.width(), height = bitmap.height();
@@ -850,6 +862,7 @@ void PlatformContextSkia::readbackHardwareToSoftware() const
         }
     }
     m_softwareDirtyRect.unite(IntRect(0, 0, width, height)); // Mark everything as dirty.
+#endif
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/skia/PlatformContextSkia.h b/WebCore/platform/graphics/skia/PlatformContextSkia.h
index eb03224..84e5d78 100644
--- a/WebCore/platform/graphics/skia/PlatformContextSkia.h
+++ b/WebCore/platform/graphics/skia/PlatformContextSkia.h
@@ -183,8 +183,11 @@ public:
     bool canvasClipApplied() const;
     bool useGPU() { return m_useGPU; }
     void setSharedGraphicsContext3D(SharedGraphicsContext3D*, DrawingBuffer*, const IntSize&);
+#if ENABLE(ACCELERATED_2D_CANVAS)
     GLES2Canvas* gpuCanvas() const { return m_gpuCanvas.get(); }
-
+#else
+    GLES2Canvas* gpuCanvas() const { return 0; }
+#endif
     // Call these before making a call that manipulates the underlying
     // skia::PlatformCanvas or WebCore::GLES2Canvas
     void prepareForSoftwareDraw() const;
@@ -224,9 +227,11 @@ private:
     FloatSize m_imageResamplingHintDstSize;
     bool m_drawingToImageBuffer;
     bool m_useGPU;
+#if ENABLE(ACCELERATED_2D_CANVAS)
     OwnPtr<GLES2Canvas> m_gpuCanvas;
-    mutable enum { None, Software, Mixed, Hardware } m_backingStoreState;
     mutable RefPtr<Texture> m_uploadTexture;
+#endif
+    mutable enum { None, Software, Mixed, Hardware } m_backingStoreState;
     mutable IntRect m_softwareDirtyRect;
 };
 
diff --git a/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp b/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
new file mode 100644
index 0000000..cf90cb1
--- /dev/null
+++ b/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.cpp
@@ -0,0 +1,1444 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "GraphicsLayerTextureMapper.h"
+
+#include "CurrentTime.h"
+#include "FloatRect.h"
+#include "GraphicsContext.h"
+#include "HashMap.h"
+#include "Image.h"
+#include "RefCounted.h"
+#include "TextureMapper.h"
+#include "TextureMapperPlatformLayer.h"
+#include "Timer.h"
+#include "TransformOperations.h"
+#include "TranslateTransformOperation.h"
+#include "UnitBezier.h"
+
+#define DEBUG_TEXMAP_FPS 0
+
+namespace WebCore {
+
+struct TexmapPaintOptions {
+    BitmapTexture* surface;
+    TextureMapper* textureMapper;
+    GraphicsContext* context;
+    TextureMapperNode* rootLayer;
+    float opacity;
+    IntRect scissorRect;
+    IntRect visibleRect;
+    bool isSurface;
+};
+class TextureMapperCache {
+public:
+    void mark(BitmapTexture* texture);
+
+    class Entry {
+    public:
+        RefPtr<BitmapTexture> texture;
+        Entry() : previousCost(0) { }
+        inline int calculateCost() const
+        {
+            if (!texture || !texture->isValid())
+                return 0;
+            const IntSize textureSize = texture->size();
+            // an image's cost in bytes is width * height * bytes per pixel (4).
+            return textureSize.width() * textureSize.height() * 4;
+        }
+        Entry(BitmapTexture* newTexture)
+            : texture(newTexture)
+        {
+        }
+        bool operator==(const Entry& other) const { return texture == other.texture; }
+        int previousCost;
+    };
+
+    TextureMapperCache() : m_totalCost(0) {}
+
+    void purge();
+    Vector<Entry> m_data;
+    int m_totalCost;
+#ifndef TEXMAP_TEXTURE_CACHE_KBS
+#define TEXMAP_TEXTURE_CACHE_KBS 24 * 1024
+#endif
+    static const int MaxCost = TEXMAP_TEXTURE_CACHE_KBS * 1024;
+    static const int PurgeAmount = MaxCost / 4;
+};
+
+
+void TextureMapperCache::purge()
+{
+    // If this is in the GL implementation, we need an active GL context, because we might call glDeleteTextures.
+    const int size = m_data.size();
+
+    if (m_totalCost <= TextureMapperCache::MaxCost)
+        return;
+
+    // Ensure that we have the right count. It might be inaccurate if content changed size.
+    // We only do this when we're actually ready to purge.
+    m_totalCost = 0;
+    for (int i = 0; i < size; ++i)
+        m_totalCost += m_data[i].calculateCost();
+
+    for (int i = size-1; i >= 0 && m_totalCost > TextureMapperCache::MaxCost - TextureMapperCache::PurgeAmount; --i) {
+        Entry& entry = m_data[i];
+        if (entry.texture->isLocked() || !entry.texture->isValid())
+            continue;
+        m_totalCost -= entry.previousCost;
+        entry.texture->destroy();
+        m_data.remove(i);
+    }
+}
+
+void TextureMapperCache::mark(BitmapTexture* texture)
+{
+    if (!texture || !texture->isValid())
+        return;
+
+    Entry entry(texture);
+    size_t index = m_data.find(entry);
+    if (!index)
+        return;
+
+    if (index < m_data.size()) 
+        m_data.remove(index);
+    const int cost = entry.calculateCost();
+    m_totalCost -= entry.previousCost;
+    m_totalCost += (entry.previousCost = cost);
+    m_data.prepend(entry);
+}
+
+TextureMapperCache gTextureMapperCache;
+
+class TextureMapperCacheLock {
+public:
+    TextureMapperCacheLock(BitmapTexture* texture) : m_texture(texture)
+    {
+        if (m_texture)
+            m_texture->lock();
+    }
+    ~TextureMapperCacheLock()
+    {
+        if (m_texture)
+            m_texture->unlock();
+    }
+
+private:
+    RefPtr<BitmapTexture> m_texture;
+};
+
+class TextureMapperNode : public TextureMapperContentLayer {
+
+public:
+    // This set of flags help us defer which properties of the layer have been
+    // modified by the compositor, so we can know what to look for in the next flush.
+    enum ChangeMask {
+        NoChanges =                 0,
+
+        ParentChange =              (1L << 0),
+        ChildrenChange =            (1L << 1),
+        MaskLayerChange =           (1L << 2),
+        PositionChange =            (1L << 3),
+
+        AnchorPointChange =         (1L << 4),
+        SizeChange  =               (1L << 5),
+        TransformChange =           (1L << 6),
+        ContentChange =             (1L << 7),
+
+        ContentsOrientationChange = (1L << 9),
+        OpacityChange =             (1L << 10),
+        ContentsRectChange =        (1L << 11),
+
+        Preserves3DChange =         (1L << 12),
+        MasksToBoundsChange =       (1L << 13),
+        DrawsContentChange =        (1L << 14),
+        ContentsOpaqueChange =      (1L << 15),
+
+        BackfaceVisibilityChange =  (1L << 16),
+        ChildrenTransformChange =   (1L << 17),
+        DisplayChange =             (1L << 18),
+        BackgroundColorChange =     (1L << 19),
+
+        ReplicaLayerChange =        (1L << 20)
+    };
+
+    // The compositor lets us special-case images and colors, so we try to do so.
+    enum StaticContentType { HTMLContentType, DirectImageContentType, ColorContentType, MediaContentType, Canvas3DContentType};
+
+    TextureMapperNode* rootLayer();
+
+    TextureMapperNode(GraphicsLayerTextureMapper* newLayer);
+    virtual ~TextureMapperNode();
+
+    void clearDirectImage();
+    void computeTransformations();
+    IntSize nearestSurfaceSize() const;
+    void computeReplicaTransform();
+    void computeLayerType();
+    void computeLocalTransform();
+    void flattenTo2DSpaceIfNecessary();
+    void initializeTextureMapper(TextureMapper*);
+    void invalidateTransform();
+    void notifyChange(ChangeMask);
+    void syncCompositingState(bool recurse);
+    void performPostSyncOperations();
+    void setNeedsDisplay();
+    void setNeedsDisplayInRect(IntRect);
+    virtual void cleanupTextureMapper();
+
+    void paintRecursive(TexmapPaintOptions options);
+    void paintSelf(const TexmapPaintOptions& options);
+    void uploadTextureFromContent(TextureMapper* textureMapper, const IntRect& visibleRect);
+
+    int countDescendantsWithContent() const;
+    bool hasSurfaceDescendants() const;
+
+    IntSize size() const { return m_size; }
+
+    virtual void setPlatformLayerClient(TextureMapperLayerClient*);
+    virtual void paint(GraphicsContext*, const IntSize&, const IntRect& targetRect, const IntRect& exposedRect, const TransformationMatrix& transform, float opacity);
+
+    static TextureMapperNode* toTextureMapperNode(GraphicsLayer*);
+public:
+    GraphicsLayerTextureMapper* m_layer;
+    const char* m_lastTextureMapperType;
+    RefPtr<TextureMapper> m_lastTextureMapper;
+    struct TransformData {
+        TransformationMatrix base, target, replica, forDescendants, perspective, local;
+        IntRect targetBoundingRect;
+        float centerZ;
+        bool dirty, localDirty, perspectiveDirty;
+        IntRect boundingRectFromRoot;
+        TransformData() : dirty(true), localDirty(true), perspectiveDirty(true) { }
+    };
+
+    TransformData m_transforms;
+
+    enum LayerType {
+        DefaultLayer,
+        RootLayer,
+        ScissorLayer,
+        ClipLayer,
+        TransparencyLayer
+    };
+
+    LayerType m_layerType;
+
+    struct ContentData {
+        IntRect needsDisplayRect;
+        bool needsDisplay;
+        Color backgroundColor;
+
+        StaticContentType contentType;
+        RefPtr<Image> image;
+        TextureMapperVideoLayer* media;
+
+        ContentData()
+            : needsDisplay(false)
+            , contentType(HTMLContentType)
+            , image(0)
+            , media(0)
+        {
+        }
+
+    };
+
+    inline IntRect targetRect() const
+    {
+        return m_currentContent.contentType == HTMLContentType ? entireRect() : m_state.contentsRect;
+    }
+
+    inline IntRect entireRect() const
+    {
+        return IntRect(0, 0, m_size.width(), m_size.height());
+    }
+
+    inline IntRect replicaRect() const
+    {
+        return m_layerType == TransparencyLayer ? IntRect(0, 0, m_nearestSurfaceSize.width(), m_nearestSurfaceSize.height()) : entireRect();
+    }
+
+    RefPtr<BitmapTexture> m_texture;
+    RefPtr<BitmapTexture> m_surface, m_replicaSurface;
+
+    ContentData m_pendingContent;
+    ContentData m_currentContent;
+
+    Vector<TextureMapperNode*> m_children;
+    TextureMapperNode* m_parent;
+    TextureMapperNode* m_effectTarget;
+    int m_changeMask;
+    IntSize m_size, m_nearestSurfaceSize;
+    String m_name;
+    TextureMapperLayerClient* m_platformClient;
+
+    struct State {
+        FloatPoint pos;
+        FloatPoint3D anchorPoint;
+        FloatSize size;
+        TransformationMatrix transform;
+        TransformationMatrix childrenTransform;
+        Color backgroundColor;
+        Color currentColor;
+        GraphicsLayer::CompositingCoordinatesOrientation geoOrientation;
+        GraphicsLayer::CompositingCoordinatesOrientation contentsOrientation;
+        float opacity;
+        IntRect contentsRect;
+        int descendantsWithContent;
+        TextureMapperNode* maskLayer;
+        TextureMapperNode* replicaLayer;
+        bool preserves3D;
+        bool masksToBounds;
+        bool drawsContent;
+        bool contentsOpaque;
+        bool backfaceVisibility;
+        bool visible;
+        bool dirty;
+        bool tiled;
+        bool hasSurfaceDescendants;
+
+        State()
+            : opacity(1.f)
+            , descendantsWithContent(0)
+            , maskLayer(0)
+            , replicaLayer(0)
+            , preserves3D(false)
+            , masksToBounds(false)
+            , drawsContent(false)
+            , contentsOpaque(false)
+            , backfaceVisibility(false)
+            , visible(true)
+            , dirty(true)
+            , tiled(false)
+            , hasSurfaceDescendants(false)
+        {
+        }
+    };
+    State m_state;
+};
+
+void TextureMapperNode::setNeedsDisplayInRect(IntRect rect)
+{
+    if (m_platformClient) {
+        if (m_state.hasSurfaceDescendants) {
+            m_platformClient->setNeedsDisplay();
+            return;
+        }
+        rect.intersect(IntRect(0, 0, m_size.width(), m_size.height()));
+        if (rect.isEmpty())
+            return;
+        m_platformClient->setNeedsDisplayInRect(rect);
+        return;
+    }
+
+    if (!m_parent)
+        return;
+
+    m_parent->setNeedsDisplayInRect(rect);
+}
+
+void TextureMapperNode::setNeedsDisplay()
+{
+    if (m_effectTarget)
+        m_effectTarget->setNeedsDisplay();
+    if (m_transforms.targetBoundingRect.isEmpty())
+        return;
+    if (m_state.drawsContent || m_currentContent.contentType != HTMLContentType)
+        setNeedsDisplayInRect(m_transforms.targetBoundingRect);
+}
+
+
+void TextureMapperNode::setPlatformLayerClient(TextureMapperLayerClient* client)
+{
+    m_platformClient = client;
+}
+
+static int compareGraphicsLayersZValue(const void* a, const void* b)
+{
+    typedef const TextureMapperNode* NodePtr;
+    const NodePtr* nodeA = static_cast<const NodePtr*>(a);
+    const NodePtr* nodeB = static_cast<const NodePtr*>(b);
+    return int(((*nodeA)->m_transforms.centerZ - (*nodeB)->m_transforms.centerZ) * 1000);
+}
+inline static void sortByZOrder(Vector<TextureMapperNode* >& array, int first, int last)
+{
+    qsort(array.data(), array.size(), sizeof(TextureMapperNode*), compareGraphicsLayersZValue);
+}
+
+bool TextureMapperNode::hasSurfaceDescendants() const
+{
+    if (m_layerType == ClipLayer || m_layerType == TransparencyLayer || m_state.replicaLayer)
+        return true;
+    const int size = m_children.size();
+    for (int i = 0; i < size; ++i) {
+        if (TextureMapperNode* child = m_children[i]) {
+            if (child->hasSurfaceDescendants())
+                return true;
+        }
+    }
+    return false;
+
+}
+
+void TextureMapperNode::paint(GraphicsContext* context, const IntSize& size, const IntRect& targetRect, const IntRect& exposedRect, const TransformationMatrix& transform, float opacity)
+{
+    ASSERT(m_layerType == RootLayer);
+    if (m_size.isEmpty())
+        return;
+
+#if 0
+    WTF::StopWatch stopWatch;
+    ("[TextureMapper] RootPaint!!\n");
+#endif
+
+    RefPtr<TextureMapper> textureMapper = TextureMapper::create(context);
+
+    if (textureMapper->type() != m_lastTextureMapperType)
+        gTextureMapperCache.m_data.clear();
+
+    m_lastTextureMapper = textureMapper;
+    TexmapPaintOptions opt;
+    opt.opacity = 1;
+    opt.rootLayer = this;
+    opt.scissorRect = targetRect;
+    opt.visibleRect = exposedRect;
+    opt.textureMapper = textureMapper.get();
+    opt.context = textureMapper->graphicsContext();
+    opt.surface = 0;
+    paintRecursive(opt);
+
+    if (textureMapper->allowSurfaceForRoot() || m_state.hasSurfaceDescendants) {
+        textureMapper->bindSurface(0);
+        textureMapper->paintToTarget(*m_surface.get(), size, transform, opacity * m_state.opacity, targetRect);
+    }
+    gTextureMapperCache.purge();
+}
+
+int TextureMapperNode::countDescendantsWithContent() const
+{
+    if (!m_state.visible || m_state.opacity < 0.001)
+        return 0;
+    int descendantsWithContent = (m_state.drawsContent || m_currentContent.contentType != HTMLContentType) ? 1 : 0;
+
+    const int size = m_children.size();
+    for (int i = 0; i < size; ++i) {
+        if (TextureMapperNode* child = m_children[i])
+            descendantsWithContent += child->countDescendantsWithContent();
+    }
+
+    return descendantsWithContent;
+}
+
+inline TextureMapperNode* TextureMapperNode::toTextureMapperNode(GraphicsLayer* layer)
+{
+    return layer ? static_cast<GraphicsLayerTextureMapper*>(layer)->m_node.get() : 0;
+}
+
+void TextureMapperNode::computeLayerType()
+{
+    // calculate layer type. A layer can be one of the following:
+    //  RootLayer: the top level. Draws to a framebuffer, and the target texture draws into the viewport.
+    //            only one layer is the root layer.
+    //  ScissorLayer: draws to the current framebuffer, and applies an extra scissor before drawing its children.
+    //                A scissor layer is a layer with children that masks to bounds, is not a transparency layer, and has a rectangular clip.
+    //  ClipLayer: creates a new framebuffer, the size of the layer, and then paints it to the enclosing BitmapTexture with the layer's transform/opacity.
+    //              A clip layer is a layer that masks to bounds, doesn't preserve 3D, has children, and has a transparency/mask or a non-rectangular transform.
+    //  TransparencyLayer: creates a new framebuffer idetical in size to the current framebuffer. Then draws the fb's texture to the current framebuffer with identity transform.
+    //                     Used for layers with children and transparency/mask that preserve 3D or don't mask to bounds.
+    //  DefaultLayer: draws itself and its children directly to the current framebuffer.
+    //                any layer that doesn't conform to the other rules is a DefaultLayer.
+
+    const bool selfHasContent = m_state.drawsContent || (m_currentContent.contentType != HTMLContentType);
+    const bool hasDescendantsWithContent = m_state.descendantsWithContent - (selfHasContent ? 1 : 0);
+    const bool hasTransparency = m_state.opacity < 0.99 || m_state.maskLayer;
+    const bool hasReplica = m_state.replicaLayer;
+    m_layerType = DefaultLayer;
+
+    // Layer has no parent, it must be a root layer.
+    if (!m_parent && !m_effectTarget) {
+        m_layerType = RootLayer;
+        return;
+    }
+
+    // A layer with no contents is always a default layer.
+    if (!m_state.descendantsWithContent)
+        return;
+
+    // A layer with content-descendants and a mask is always a clip layer.
+    if (hasDescendantsWithContent && m_state.maskLayer) {
+        m_layerType = ClipLayer;
+        return;
+    }
+
+    // A masks-to bounds layer can be a clip or a scissor layer. It's a scissor layer only if it has a trivial clip (identity or translation), or if it has transparency.
+    // That's because a ClipLayer would create an intermediate drawing surface (FB) - we want to limit it to when it's actually necessary, i.e. transparency or non-trivial clip.
+    if (m_state.masksToBounds && hasDescendantsWithContent) {
+        if (hasTransparency || !m_state.transform.isIdentityOrTranslation() || m_parent->m_state.preserves3D)
+            m_layerType = ClipLayer;
+        else
+            m_layerType = ScissorLayer;
+        return;
+    }
+
+    // We use a transparency layer when we have two of the following 3: replica, transparency, descendants with contents.
+    if ((hasReplica && hasDescendantsWithContent) || (hasReplica && hasTransparency) || (hasTransparency && m_state.descendantsWithContent > 1))
+        m_layerType = TransparencyLayer;
+}
+void TextureMapperNode::initializeTextureMapper(TextureMapper* textureMapper)
+{
+    if (textureMapper->type() == m_lastTextureMapperType)
+        return;
+    m_surface = textureMapper->createTexture();
+    m_replicaSurface = textureMapper->createTexture();
+    m_texture = textureMapper->createTexture();
+    gTextureMapperCache.mark(m_texture.get());
+    m_lastTextureMapperType = textureMapper->type();
+}
+
+TextureMapperNode::TextureMapperNode(GraphicsLayerTextureMapper* newLayer)
+    : m_layer(newLayer)
+    , m_lastTextureMapperType(0)
+    , m_lastTextureMapper(0)
+    , m_layerType(DefaultLayer)
+    , m_surface(0)
+    , m_parent(0)
+    , m_effectTarget(0)
+    , m_changeMask(NoChanges)
+    , m_platformClient(0)
+{
+
+}
+
+TextureMapperNode* TextureMapperNode::rootLayer()
+{
+    if (m_effectTarget)
+        return m_effectTarget->rootLayer();
+    if (m_parent)
+        return m_parent->rootLayer();
+    return this;
+}
+
+void TextureMapperNode::invalidateTransform()
+{
+    m_transforms.dirty = true;
+    if (m_layerType != ClipLayer)
+        m_state.dirty = true;
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->invalidateTransform();
+    const int size = m_children.size();
+    for (int i = 0; i < size; ++i) {
+        if (TextureMapperNode* layer = m_children[i])
+            layer->invalidateTransform();
+    }
+}
+
+void TextureMapperNode::computeLocalTransform()
+{
+    if (!m_transforms.localDirty)
+        return;
+    const float originX = m_state.anchorPoint.x() * m_size.width();
+    const float originY = m_state.anchorPoint.y() * m_size.height();
+    m_transforms.local =
+        TransformationMatrix()
+        .translate3d(originX + m_state.pos.x(), originY + m_state.pos.y(), m_state.anchorPoint.z())
+        .multLeft(m_state.transform)
+        .translate3d(-originX, -originY, -m_state.anchorPoint.z());
+    m_transforms.localDirty = false;
+}
+
+void TextureMapperNode::flattenTo2DSpaceIfNecessary()
+{
+    if (m_state.preserves3D)
+        return;
+    m_transforms.forDescendants.setM13(0);
+    m_transforms.forDescendants.setM23(0);
+    m_transforms.forDescendants.setM31(0);
+    m_transforms.forDescendants.setM32(0);
+    m_transforms.forDescendants.setM33(1);
+    m_transforms.forDescendants.setM34(0);
+    m_transforms.forDescendants.setM43(0);
+}
+
+IntSize TextureMapperNode::nearestSurfaceSize() const
+{
+    if (m_layerType == ClipLayer || m_layerType == RootLayer)
+        return m_surface && !m_surface->size().isEmpty() ? m_surface->size() : m_size;
+    return m_parent->nearestSurfaceSize();
+}
+
+void TextureMapperNode::computeReplicaTransform()
+{
+    if (!m_state.replicaLayer)
+        return;
+
+    m_nearestSurfaceSize = nearestSurfaceSize();
+
+    if (m_layerType != TransparencyLayer) {
+        m_transforms.replica = TransformationMatrix(m_transforms.target).multLeft(m_state.replicaLayer->m_transforms.local);
+        return;
+    }
+
+    const float originX = m_transforms.target.m41();
+    const float originY = m_transforms.target.m42();
+    m_transforms.replica =
+            TransformationMatrix()
+                .translate(originX, originY)
+                .multLeft(m_state.replicaLayer->m_transforms.local)
+                .translate(-originX, -originY);
+}
+
+void TextureMapperNode::computeTransformations()
+{
+    if (!m_transforms.dirty)
+        return;
+
+    m_transforms.dirty = false;
+    if ((m_size.isEmpty() && m_state.masksToBounds))
+        return;
+
+    TextureMapperNode* parent = m_parent;
+    computeLocalTransform();
+
+    m_transforms.target = TransformationMatrix(parent ? parent->m_transforms.forDescendants : TransformationMatrix()).multLeft(m_transforms.local);
+    m_transforms.forDescendants = (m_layerType == ClipLayer ? TransformationMatrix() : m_transforms.target);
+
+    if (m_effectTarget)
+        return;
+
+    m_transforms.targetBoundingRect = IntRect(m_transforms.target.mapRect(entireRect()));
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->computeTransformations();
+
+    flattenTo2DSpaceIfNecessary();
+
+    if (!m_state.backfaceVisibility && m_transforms.target.inverse().m33() < 0) {
+        m_state.visible = false;
+        return;
+    }
+    m_state.visible = true;
+
+    if (parent && parent->m_state.preserves3D)
+        m_transforms.centerZ = m_transforms.target.mapPoint(FloatPoint3D(m_size.width() / 2, m_size.height() / 2, 0)).z();
+
+    if (!m_children.size())
+        return;
+
+    if (m_state.childrenTransform.isIdentity())
+        return;
+
+    const FloatPoint centerPoint = FloatPoint(m_size.width() / 2, m_size.height() / 2);
+    if (m_transforms.perspectiveDirty)
+        m_transforms.perspective = TransformationMatrix()
+            .translate(centerPoint.x(), centerPoint.y())
+            .multLeft(m_state.childrenTransform)
+            .translate(-centerPoint.x(), -centerPoint.y());
+    m_transforms.perspectiveDirty = false;
+    m_transforms.forDescendants.multLeft(m_transforms.perspective);
+}
+
+void TextureMapperNode::uploadTextureFromContent(TextureMapper* textureMapper, const IntRect& visibleRect)
+{
+    if (m_size.isEmpty() || !m_layer) {
+        m_texture->destroy();
+        return;
+    }
+
+    if (m_currentContent.contentType == DirectImageContentType) {
+        if (m_currentContent.image)
+            m_texture->setContentsToImage(m_currentContent.image.get());
+        return;
+    }
+
+    if (m_currentContent.contentType == MediaContentType) {
+        if (!m_currentContent.media)
+            return;
+        m_texture->reset(m_size, true);
+        PlatformGraphicsContext* platformContext = m_texture->beginPaintMedia();
+        GraphicsContext context(platformContext);
+        m_currentContent.media->paint(&context);
+        m_texture->endPaint();
+        return;
+    }
+
+    const bool needsReset = (m_texture->contentSize() != m_size) || !m_texture->isValid();
+    if ((m_currentContent.contentType != HTMLContentType)
+        || (!m_currentContent.needsDisplay && m_currentContent.needsDisplayRect.isEmpty() && !needsReset))
+        return;
+
+    WTF::StopWatch stopWatch;
+    IntRect dirtyRect = IntRect(0, 0, m_size.width(), m_size.height());
+    if (!needsReset && !m_currentContent.needsDisplay)
+        dirtyRect.intersect(m_currentContent.needsDisplayRect);
+    if (needsReset)
+        m_texture->reset(m_size, m_state.contentsOpaque);
+    m_pendingContent.needsDisplayRect = IntRect();
+
+    {
+        GraphicsContext context(m_texture->beginPaint(dirtyRect));
+        if (textureMapper && textureMapper->graphicsContext()) {
+            GraphicsContext* originalContext = textureMapper->graphicsContext();
+            context.setImageInterpolationQuality(originalContext->imageInterpolationQuality());
+            context.setTextDrawingMode(originalContext->textDrawingMode());
+        }
+        m_layer->paintGraphicsLayerContents(context, dirtyRect);
+    }
+    m_texture->endPaint();
+    {
+#if 0
+        LOG("[TextureMapper] Re-render(%d) layer(%p) %d::%d::%d (%dx%d) [%dms]\n", ++renderCount, this,
+               needsReset, m_currentContent.needsDisplay, !m_currentContent.needsDisplayRect.isEmpty(),
+               dirtyRect.width(), dirtyRect.height(), int(stopWatch.elapsed() * 1000));
+        static int renderCount = 0;
+        m_texture->save(String().format("/tmp/layer_%d.png", renderCount));
+#endif
+    }
+    m_currentContent.needsDisplay = false;
+
+}
+
+void TextureMapperNode::paintSelf(const TexmapPaintOptions& options)
+{
+    if (!m_layer || m_size.isEmpty() || (!m_state.drawsContent && m_currentContent.contentType == HTMLContentType))
+        return;
+
+    RefPtr<BitmapTexture> maskTexture = m_state.maskLayer ? m_state.maskLayer->m_texture : 0;
+    RefPtr<BitmapTexture> replicaMaskTexture = 0;
+    if (m_state.replicaLayer && m_state.replicaLayer->m_state.maskLayer)
+        replicaMaskTexture = m_state.replicaLayer->m_state.maskLayer->m_texture;
+
+    const float opacity = options.isSurface ? 1 : options.opacity;
+
+    uploadTextureFromContent(options.textureMapper, options.visibleRect);
+    if (m_state.replicaLayer && !options.isSurface)
+        options.textureMapper->drawTexture(*m_texture.get(), replicaRect(), m_transforms.replica,
+                         opacity * m_state.replicaLayer->m_state.opacity,
+                         replicaMaskTexture ? replicaMaskTexture.get() : maskTexture.get());
+
+    const IntRect rect = m_layerType == ClipLayer ? entireRect() : targetRect();
+    const TransformationMatrix transform = m_layerType == ClipLayer ? TransformationMatrix() : m_transforms.target;
+    options.textureMapper->drawTexture(*m_texture.get(), rect, transform, opacity, options.isSurface ? 0 : maskTexture.get());
+}
+
+void TextureMapperNode::paintRecursive(TexmapPaintOptions options)
+{
+    WTF::StopWatch stopWatch;
+
+    bool isDirty = m_state.dirty;
+    m_state.dirty = false;
+
+    if ((m_size.isEmpty() && (m_state.masksToBounds
+        || m_children.isEmpty())) || !m_state.visible || options.opacity < 0.01 || m_state.opacity < 0.01)
+        return;
+
+    initializeTextureMapper(options.textureMapper);
+    computeReplicaTransform();
+
+    if (m_state.maskLayer) {
+        m_state.maskLayer->initializeTextureMapper(options.textureMapper);
+        m_state.maskLayer->m_state.dirty = false;
+    }
+
+    if (m_state.replicaLayer) {
+        m_state.replicaLayer->initializeTextureMapper(options.textureMapper);
+        m_state.replicaLayer->m_state.dirty = false;
+        if (m_state.replicaLayer->m_state.maskLayer) {
+            m_state.replicaLayer->m_state.maskLayer->initializeTextureMapper(options.textureMapper);
+            m_state.replicaLayer->m_state.maskLayer->m_state.dirty = false;
+        }
+    }
+
+    TextureMapperNode* replica = m_state.replicaLayer;
+    const bool isSurface = (m_layerType == ClipLayer
+                            || m_layerType == TransparencyLayer
+                            || (m_layerType == RootLayer
+                                && (options.textureMapper->allowSurfaceForRoot() || m_state.hasSurfaceDescendants)
+                                ));
+    if (isSurface)
+        uploadTextureFromContent(options.textureMapper, options.visibleRect);
+    const IntRect boundingRectfromNearestSurface = m_transforms.targetBoundingRect;
+
+    options.opacity *= m_state.opacity;
+
+    TexmapPaintOptions optionsForDescendants(options);
+    optionsForDescendants.opacity = isSurface ? 1 : options.opacity;
+    options.isSurface = isSurface;
+
+    if (m_layerType == ClipLayer) {
+        optionsForDescendants.visibleRect = TransformationMatrix().translate(-boundingRectfromNearestSurface.x(), -boundingRectfromNearestSurface.y()).mapRect(options.visibleRect);
+        optionsForDescendants.scissorRect = IntRect(0, 0, m_size.width(), m_size.height());
+    }
+
+    if (m_layerType == ScissorLayer)
+        optionsForDescendants.scissorRect.intersect(m_transforms.targetBoundingRect);
+    options.textureMapper->setClip(optionsForDescendants.scissorRect);
+
+    TextureMapperCacheLock(m_texture.get());
+    TextureMapperCacheLock(m_surface.get());
+    TextureMapperCacheLock(m_replicaSurface.get());
+
+    gTextureMapperCache.purge();
+
+    if (isSurface) {
+        ASSERT(m_surface);
+        if (!m_surface->isValid())
+            isDirty = true;
+        if (m_state.tiled) {
+            m_surface->reset(options.visibleRect.size());
+            m_surface->setOffset(options.visibleRect.location());
+        } else if (isDirty)
+            m_surface->reset(m_layerType == TransparencyLayer ? options.surface->size() : m_size);
+        gTextureMapperCache.mark(m_surface.get());
+        options.textureMapper->bindSurface(m_surface.get());
+
+        optionsForDescendants.surface = m_surface.get();
+    } else if (m_surface)
+        m_surface->destroy();
+
+    RefPtr<BitmapTexture> maskTexture;
+    RefPtr<BitmapTexture> replicaMaskTexture;
+    if (TextureMapperNode* mask = m_state.maskLayer) {
+        mask->uploadTextureFromContent(options.textureMapper, options.visibleRect);
+        maskTexture = mask->m_texture;
+    }
+
+    if (replica && replica->m_state.maskLayer) {
+        replica->m_state.maskLayer->uploadTextureFromContent(options.textureMapper, options.visibleRect);
+        replicaMaskTexture = replica->m_state.maskLayer->m_texture;
+    }
+
+    int childrenSize = m_children.size();
+    if (isDirty || !isSurface || m_state.tiled || !m_surface->isValid()) {
+        bool didPaintSelf = false;
+        if (!m_state.preserves3D || m_children.isEmpty()) {
+            paintSelf(options);
+            didPaintSelf = true;
+        }
+
+        if (m_children.isEmpty() && !isSurface)
+            return;
+
+        if (m_layerType == ScissorLayer)
+            optionsForDescendants.scissorRect.intersect(m_transforms.target.mapRect(IntRect(0, 0, m_size.width(), m_size.height())));
+
+        for (int i = 0; i < childrenSize; ++i) {
+            TextureMapperNode* layer = m_children[i];
+            if (!layer)
+                continue;
+
+            if (!didPaintSelf && layer->m_transforms.centerZ >= 0) {
+                paintSelf(options);
+                didPaintSelf = true;
+            }
+            layer->paintRecursive(optionsForDescendants);
+            if (isSurface) {
+                ASSERT(m_surface);
+                gTextureMapperCache.mark(m_surface.get());
+                options.textureMapper->bindSurface(m_surface.get());
+            }
+        }
+        if (!didPaintSelf) {
+            paintSelf(options);
+            didPaintSelf = true;
+        }
+    }
+
+    if (m_layerType == RootLayer || m_layerType == DefaultLayer || m_layerType == ScissorLayer)
+        return;
+
+    ASSERT(m_surface);
+    BitmapTexture& texture = *m_surface.get();
+    if (replica) {
+        ASSERT(m_replicaSurface);
+        m_replicaSurface->reset(options.surface->size());
+        m_replicaSurface->setOffset(options.surface->offset());
+        gTextureMapperCache.mark(m_replicaSurface.get());
+        options.textureMapper->bindSurface(m_replicaSurface.get());
+        options.textureMapper->drawTexture(texture, replicaRect(), m_transforms.replica, replica->m_state.opacity, replicaMaskTexture ? replicaMaskTexture.get() : maskTexture.get());
+        options.textureMapper->drawTexture(texture, IntRect(IntPoint(0, 0), options.surface->size()), TransformationMatrix(), 1.0f, maskTexture.get());
+        options.textureMapper->bindSurface(options.surface);
+        gTextureMapperCache.mark(options.surface);
+        options.textureMapper->drawTexture(*m_replicaSurface.get(), IntRect(IntPoint(0, 0), options.surface->size()), TransformationMatrix(), options.opacity, 0);
+        return;
+    }
+
+    options.textureMapper->bindSurface(options.surface);
+    options.textureMapper->drawTexture(texture,
+                             m_layerType == TransparencyLayer ? IntRect(IntPoint(0, 0), options.surface->size()) :
+                             targetRect(),
+                             m_layerType == TransparencyLayer ? TransformationMatrix() : m_transforms.target,
+                             options.opacity, maskTexture.get());
+    gTextureMapperCache.mark(&texture);
+}
+
+void TextureMapperNode::cleanupTextureMapper()
+{
+    if (m_texture)
+        m_texture->destroy();
+    if (m_surface)
+        m_surface->destroy();
+    if (m_replicaSurface)
+        m_replicaSurface->destroy();
+    for (int i = 0; i < m_children.size(); ++i) {
+        if (m_children[i])
+            m_children[i]->cleanupTextureMapper();
+    }
+    if (m_lastTextureMapper)
+        m_lastTextureMapper->cleanup();
+}
+
+TextureMapperNode::~TextureMapperNode()
+{
+    setNeedsDisplay();
+    {
+        const int childrenSize = m_children.size();
+        for (int i = childrenSize-1; i >= 0; --i) {
+            ASSERT(m_children[i]->m_parent == this);
+            m_children[i]->m_parent = 0;
+        }
+    }
+    if (m_parent)
+        m_parent->m_children.remove(m_parent->m_children.find(this));
+}
+
+void TextureMapperNode::notifyChange(ChangeMask changeMask)
+{
+    m_changeMask |= changeMask;
+    if (!m_layer->client())
+        return;
+    m_layer->client()->notifySyncRequired(m_layer);
+}
+
+void TextureMapperNode::performPostSyncOperations()
+{
+    const LayerType prevLayerType = m_layerType;
+    computeLayerType();
+    if (prevLayerType != m_layerType)
+        m_state.dirty = true;
+    if (m_transforms.dirty)
+        setNeedsDisplay();
+
+    computeTransformations();
+    if (m_state.maskLayer && !m_state.dirty)
+        m_state.dirty = m_state.maskLayer->m_state.dirty;
+    if (m_state.replicaLayer && !m_state.dirty)
+        m_state.dirty = m_state.replicaLayer->m_state.dirty;
+
+    const int size = m_children.size();
+
+    for (int i = size - 1; i >= 0; --i) {
+        TextureMapperNode* layer = m_children[i];
+
+        layer->performPostSyncOperations();
+        if (!m_state.dirty)
+            m_state.dirty = layer->m_state.dirty;
+    }
+    m_state.hasSurfaceDescendants = hasSurfaceDescendants();
+    if (m_state.dirty)
+        m_state.descendantsWithContent = countDescendantsWithContent();
+
+    if (m_state.preserves3D)
+        sortByZOrder(m_children, 0, size);
+    if (m_state.dirty) 
+        setNeedsDisplay();
+}
+
+void TextureMapperNode::syncCompositingState(bool recurse)
+{
+    bool needsToInvalidateTransform = false;
+
+    if (!m_layer)
+        return;
+
+    if (m_changeMask == NoChanges)
+        goto afterCurrentLayerSync;
+
+    setNeedsDisplay();
+    if (m_parent)
+        m_parent->m_state.dirty = true;
+
+    if (m_currentContent.contentType == HTMLContentType && (m_changeMask & ParentChange)) {
+        // The WebCore compositor manages item ownership. We have to make sure graphicsview doesn't
+        // try to snatch that ownership.
+
+        if (!m_layer->parent())
+            m_parent = 0;
+        else
+            m_parent = toTextureMapperNode(m_layer->parent());
+
+        if (!m_layer->parent() && m_parent) {
+            size_t index = m_parent->m_children.find(this);
+            m_parent->m_children.remove(index);
+        }
+
+    }
+
+    if (m_changeMask & ChildrenChange) {
+        m_children.clear();
+        for (size_t i = 0; i < m_layer->children().size(); ++i) {
+            if (TextureMapperNode* child = toTextureMapperNode(m_layer->children()[i])) {
+                if (!child)
+                    continue;
+                m_children.append(child);
+                child->m_parent = this;
+            }
+        }
+        m_state.dirty = true;
+    }
+
+    if (m_changeMask & (SizeChange | ContentsRectChange)) {
+        IntSize wantedSize = IntSize(m_layer->size().width(), m_layer->size().height());
+        if (wantedSize.isEmpty() && m_pendingContent.contentType == HTMLContentType)
+            wantedSize = IntSize(m_layer->contentsRect().width(), m_layer->contentsRect().height());
+
+        if (wantedSize != m_size) {
+            m_size = IntSize(wantedSize.width(), wantedSize.height());
+            if (m_platformClient)
+                m_platformClient->setSizeChanged(m_size);
+            const bool needsTiling = m_size.width() > 2000 || m_size.height() > 2000;
+            if (m_state.tiled != needsTiling)
+                m_state.tiled = needsTiling;
+            m_state.dirty = true;
+        }
+    }
+
+    if (m_changeMask & MaskLayerChange) {
+       if (TextureMapperNode* layer = toTextureMapperNode(m_layer->maskLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (m_changeMask & ReplicaLayerChange) {
+       if (TextureMapperNode* layer = toTextureMapperNode(m_layer->replicaLayer()))
+           layer->m_effectTarget = this;
+    }
+
+    if (m_changeMask & (TransformChange | SizeChange | AnchorPointChange | PositionChange))
+        m_transforms.localDirty = true;
+
+    if (m_changeMask & (ChildrenTransformChange | SizeChange))
+        m_transforms.perspectiveDirty = true;
+
+    if (m_changeMask & (ChildrenTransformChange | Preserves3DChange | TransformChange | AnchorPointChange | SizeChange | ContentsRectChange | BackfaceVisibilityChange | PositionChange | MaskLayerChange | DrawsContentChange | ContentChange | ReplicaLayerChange))    {
+        // Due to the differences between the way WebCore handles transforms and the way Qt handles transforms,
+        // all these elements affect the transforms of all the descendants.
+        needsToInvalidateTransform = true;
+    }
+
+    if (m_changeMask & DisplayChange) 
+        m_state.dirty = true;
+
+    m_state.maskLayer = toTextureMapperNode(m_layer->maskLayer());
+    m_state.replicaLayer = toTextureMapperNode(m_layer->replicaLayer());
+    m_state.pos = m_layer->position();
+    m_state.anchorPoint = m_layer->anchorPoint();
+    m_state.size = m_layer->size();
+    m_state.transform = m_layer->transform();
+    m_state.contentsRect = m_layer->contentsRect();
+    m_state.opacity = m_layer->opacity();
+    m_state.contentsRect = m_layer->contentsRect();
+    m_state.preserves3D = m_layer->preserves3D();
+    m_state.masksToBounds = m_layer->masksToBounds();
+    m_state.drawsContent = m_layer->drawsContent();
+    m_state.contentsOpaque = m_layer->contentsOpaque();
+    m_state.backfaceVisibility = m_layer->backfaceVisibility();
+    m_state.childrenTransform = m_layer->childrenTransform();
+    m_currentContent.contentType = m_pendingContent.contentType;
+    m_currentContent.image = m_pendingContent.image;
+    m_currentContent.media = m_pendingContent.media;
+    m_currentContent.backgroundColor = m_pendingContent.backgroundColor;
+    m_currentContent.needsDisplay = m_currentContent.needsDisplay || m_pendingContent.needsDisplay;
+    m_currentContent.needsDisplayRect.unite(m_pendingContent.needsDisplayRect);
+    m_pendingContent.needsDisplay = false;
+    m_pendingContent.needsDisplayRect = IntRect();
+    m_changeMask = NoChanges;
+    afterCurrentLayerSync:
+    if (needsToInvalidateTransform)
+        invalidateTransform();
+
+    if (m_state.maskLayer) {
+        m_state.maskLayer->syncCompositingState(false);
+        if (m_state.maskLayer->m_size.isEmpty())
+            m_state.maskLayer->m_size = m_size;
+    }
+
+    if (m_state.replicaLayer)
+        m_state.replicaLayer->syncCompositingState(false);
+
+#if 0
+    if (m_state.dirty && m_texture && m_texture->allowOfflineTextureUpload())
+        uploadTextureFromContent(0);
+#endif
+
+    if (!recurse)
+        return;
+
+    const int childrenSize = m_children.size();
+    for (int i = childrenSize-1; i >= 0; --i)
+        m_children[i]->syncCompositingState(true);
+}
+
+GraphicsLayerTextureMapper::GraphicsLayerTextureMapper(GraphicsLayerClient* client)
+    : GraphicsLayer(client)
+    , m_node(new TextureMapperNode(this))
+{
+}
+
+void GraphicsLayerTextureMapper::setName(const String& name)
+{
+    m_node->m_name = name;
+}
+
+GraphicsLayerTextureMapper::~GraphicsLayerTextureMapper()
+{
+}
+
+/* \reimp (GraphicsLayer.h): The current size might change, thus we need to update the whole display.
+*/
+void GraphicsLayerTextureMapper::setNeedsDisplay()
+{
+    m_node->m_pendingContent.needsDisplay = true;
+    m_node->notifyChange(TextureMapperNode::DisplayChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setNeedsDisplayInRect(const FloatRect& rect)
+{
+    if (m_node->m_pendingContent.needsDisplay)
+        return;
+    m_node->m_pendingContent.needsDisplayRect.unite(IntRect(rect));
+    m_node->notifyChange(TextureMapperNode::DisplayChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setParent(GraphicsLayer* layer)
+{
+    m_node->notifyChange(TextureMapperNode::ParentChange);
+    GraphicsLayer::setParent(layer);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+bool GraphicsLayerTextureMapper::setChildren(const Vector<GraphicsLayer*>& children)
+{
+    m_node->notifyChange(TextureMapperNode::ChildrenChange);
+    return GraphicsLayer::setChildren(children);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::addChild(GraphicsLayer* layer)
+{
+    m_node->notifyChange(TextureMapperNode::ChildrenChange);
+    GraphicsLayer::addChild(layer);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::addChildAtIndex(GraphicsLayer* layer, int index)
+{
+    GraphicsLayer::addChildAtIndex(layer, index);
+    m_node->notifyChange(TextureMapperNode::ChildrenChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+     GraphicsLayer::addChildAbove(layer, sibling);
+     m_node->notifyChange(TextureMapperNode::ChildrenChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling)
+{
+
+    GraphicsLayer::addChildBelow(layer, sibling);
+    m_node->notifyChange(TextureMapperNode::ChildrenChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+bool GraphicsLayerTextureMapper::replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild)
+{
+    if (GraphicsLayer::replaceChild(oldChild, newChild)) {
+        m_node->notifyChange(TextureMapperNode::ChildrenChange);
+        return true;
+    }
+
+    return false;
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::removeFromParent()
+{
+    if (!parent())
+        return;
+    m_node->notifyChange(TextureMapperNode::ParentChange);
+    GraphicsLayer::removeFromParent();
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setMaskLayer(GraphicsLayer* value)
+{
+    if (value == maskLayer())
+        return;
+    GraphicsLayer::setMaskLayer(value);
+    m_node->notifyChange(TextureMapperNode::MaskLayerChange);
+}
+
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setReplicatedByLayer(GraphicsLayer* value)
+{
+    if (value == replicaLayer())
+        return;
+    GraphicsLayer::setReplicatedByLayer(value);
+    m_node->notifyChange(TextureMapperNode::ReplicaLayerChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setPosition(const FloatPoint& value)
+{
+    if (value == position())
+        return;
+    GraphicsLayer::setPosition(value);
+    m_node->notifyChange(TextureMapperNode::PositionChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setAnchorPoint(const FloatPoint3D& value)
+{
+    if (value == anchorPoint())
+        return;
+    GraphicsLayer::setAnchorPoint(value);
+    m_node->notifyChange(TextureMapperNode::AnchorPointChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setSize(const FloatSize& value)
+{
+    if (value == size())
+        return;
+
+    GraphicsLayer::setSize(value);
+    m_node->notifyChange(TextureMapperNode::SizeChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setTransform(const TransformationMatrix& value)
+{
+    if (value == transform())
+        return;
+
+    GraphicsLayer::setTransform(value);
+    m_node->notifyChange(TextureMapperNode::TransformChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setChildrenTransform(const TransformationMatrix& value)
+{
+    if (value == childrenTransform())
+        return;
+    GraphicsLayer::setChildrenTransform(value);
+    m_node->notifyChange(TextureMapperNode::ChildrenTransformChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setPreserves3D(bool value)
+{
+    if (value == preserves3D())
+        return;
+    GraphicsLayer::setPreserves3D(value);
+    m_node->notifyChange(TextureMapperNode::Preserves3DChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setMasksToBounds(bool value)
+{
+    if (value == masksToBounds())
+        return;
+    GraphicsLayer::setMasksToBounds(value);
+    m_node->notifyChange(TextureMapperNode::MasksToBoundsChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setDrawsContent(bool value)
+{
+    if (value == drawsContent())
+        return;
+    m_node->notifyChange(TextureMapperNode::DrawsContentChange);
+    GraphicsLayer::setDrawsContent(value);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setBackgroundColor(const Color& value)
+{
+    if (value == m_node->m_pendingContent.backgroundColor)
+        return;
+    m_node->m_pendingContent.backgroundColor = value;
+    GraphicsLayer::setBackgroundColor(value);
+    m_node->notifyChange(TextureMapperNode::BackgroundColorChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::clearBackgroundColor()
+{
+    if (!m_node->m_pendingContent.backgroundColor.isValid())
+        return;
+    m_node->m_pendingContent.backgroundColor = Color();
+    GraphicsLayer::clearBackgroundColor();
+    m_node->notifyChange(TextureMapperNode::BackgroundColorChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setContentsOpaque(bool value)
+{
+    if (value == contentsOpaque())
+        return;
+    m_node->notifyChange(TextureMapperNode::ContentsOpaqueChange);
+    GraphicsLayer::setContentsOpaque(value);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setBackfaceVisibility(bool value)
+{
+    if (value == backfaceVisibility())
+        return;
+    GraphicsLayer::setBackfaceVisibility(value);
+    m_node->notifyChange(TextureMapperNode::BackfaceVisibilityChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setOpacity(float value)
+{
+    if (value == opacity())
+        return;
+    GraphicsLayer::setOpacity(value);
+    m_node->notifyChange(TextureMapperNode::OpacityChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setContentsRect(const IntRect& value)
+{
+    if (value == contentsRect())
+        return;
+    GraphicsLayer::setContentsRect(value);
+    m_node->notifyChange(TextureMapperNode::ContentsRectChange);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setContentsToImage(Image* image)
+{
+    m_node->notifyChange(TextureMapperNode::ContentChange);
+    m_node->m_pendingContent.contentType = image ? TextureMapperNode::DirectImageContentType : TextureMapperNode::HTMLContentType;
+    m_node->m_pendingContent.image = image;
+    GraphicsLayer::setContentsToImage(image);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setContentsBackgroundColor(const Color& color)
+{
+    m_node->notifyChange(TextureMapperNode::ContentChange);
+    m_node->m_pendingContent.contentType = TextureMapperNode::ColorContentType;
+    m_node->m_pendingContent.backgroundColor = color;
+    GraphicsLayer::setContentsBackgroundColor(color);
+}
+
+
+void GraphicsLayerTextureMapper::setContentsToMedia(PlatformLayer* media)
+{
+    GraphicsLayer::setContentsToMedia(media);
+    m_node->notifyChange(TextureMapperNode::ContentChange);
+    m_node->m_pendingContent.contentType = media ? TextureMapperNode::MediaContentType : TextureMapperNode::HTMLContentType;
+    if (media)
+        m_node->m_pendingContent.media = static_cast<TextureMapperVideoLayer*>(media);
+    else
+        m_node->m_pendingContent.media = 0;
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::setContentsOrientation(CompositingCoordinatesOrientation orientation)
+{
+    if (contentsOrientation() == orientation)
+        return;
+    m_node->notifyChange(TextureMapperNode::ContentsOrientationChange);
+    GraphicsLayer::setContentsOrientation(orientation);
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::syncCompositingStateForThisLayerOnly()
+{
+    m_node->syncCompositingState(false);
+    m_node->performPostSyncOperations();
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+void GraphicsLayerTextureMapper::syncCompositingState()
+{
+    GraphicsLayer::syncCompositingState();
+    m_node->syncCompositingState(true);
+    m_node->performPostSyncOperations();
+}
+
+/* \reimp (GraphicsLayer.h)
+ */
+NativeLayer GraphicsLayerTextureMapper::nativeLayer() const
+{
+    return m_node.get();
+}
+
+/* \reimp (GraphicsLayer.h)
+*/
+PlatformLayer* GraphicsLayerTextureMapper::platformLayer() const
+{
+    return m_node.get();
+}
+
+PassOwnPtr<GraphicsLayer> GraphicsLayer::create(GraphicsLayerClient* client)
+{
+    return new GraphicsLayerTextureMapper(client);
+}
+
+}
diff --git a/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h b/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
new file mode 100644
index 0000000..36ebd74
--- /dev/null
+++ b/WebCore/platform/graphics/texmap/GraphicsLayerTextureMapper.h
@@ -0,0 +1,96 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef GraphicsLayerTextureMapper_h
+#define GraphicsLayerTextureMapper_h
+
+#include "GraphicsContext.h"
+#include "GraphicsLayer.h"
+#include "GraphicsLayerClient.h"
+#include "Image.h"
+
+#if ENABLE(3D_CANVAS)
+#include "GraphicsContext3D.h"
+#endif
+
+#define ENABLE_TEXMAP_ANIMATION 0
+
+namespace WebCore {
+
+class TextureMapperNode;
+class BitmapTexture;
+class TextureMapper;
+
+class GraphicsLayerTextureMapper : public GraphicsLayer {
+    friend class TextureMapperNode;
+
+public:
+    GraphicsLayerTextureMapper(GraphicsLayerClient*);
+    virtual ~GraphicsLayerTextureMapper();
+
+    // reimps from GraphicsLayer.h
+    virtual void setNeedsDisplay();
+    virtual void setNeedsDisplayInRect(const FloatRect&);
+    virtual void setParent(GraphicsLayer* layer);
+    virtual bool setChildren(const Vector<GraphicsLayer*>&);
+    virtual void addChild(GraphicsLayer*);
+    virtual void addChildAtIndex(GraphicsLayer*, int index);
+    virtual void addChildAbove(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual void addChildBelow(GraphicsLayer* layer, GraphicsLayer* sibling);
+    virtual bool replaceChild(GraphicsLayer* oldChild, GraphicsLayer* newChild);
+    virtual void removeFromParent();
+    virtual void setMaskLayer(GraphicsLayer* layer);
+    virtual void setPosition(const FloatPoint& p);
+    virtual void setAnchorPoint(const FloatPoint3D& p);
+    virtual void setSize(const FloatSize& size);
+    virtual void setTransform(const TransformationMatrix& t);
+    virtual void setChildrenTransform(const TransformationMatrix& t);
+    virtual void setPreserves3D(bool b);
+    virtual void setMasksToBounds(bool b);
+    virtual void setDrawsContent(bool b);
+    virtual void setBackgroundColor(const Color&);
+    virtual void clearBackgroundColor();
+    virtual void setContentsOpaque(bool b);
+    virtual void setBackfaceVisibility(bool b);
+    virtual void setOpacity(float opacity);
+    virtual void setContentsRect(const IntRect& r);
+    virtual void setReplicatedByLayer(GraphicsLayer*);
+    virtual void setContentsToImage(Image*);
+    virtual void setContentsToMedia(PlatformLayer*);
+    virtual void setContentsBackgroundColor(const Color&);
+#if ENABLE(3D_CANVAS)
+    virtual void setContentsToGraphicsContext3D(const GraphicsContext3D*);
+    virtual void setGraphicsContext3DNeedsDisplay();
+#endif
+    virtual void setContentsOrientation(CompositingCoordinatesOrientation orientation);
+    virtual void syncCompositingState();
+    virtual void syncCompositingStateForThisLayerOnly();
+    virtual void setName(const String& name);
+    virtual NativeLayer nativeLayer() const;
+    virtual PlatformLayer* platformLayer() const;
+
+    virtual bool addAnimation(const KeyframeValueList&, const IntSize& /*boxSize*/, const Animation*,
+                              const String& /*keyframesName*/, double /*timeOffset*/) { return false; }
+
+private:
+    OwnPtr<TextureMapperNode> m_node;
+};
+
+}
+#endif // GraphicsLayerTextureMapper_h
diff --git a/WebCore/platform/graphics/texmap/TextureMapper.h b/WebCore/platform/graphics/texmap/TextureMapper.h
new file mode 100644
index 0000000..03c1c6d
--- /dev/null
+++ b/WebCore/platform/graphics/texmap/TextureMapper.h
@@ -0,0 +1,120 @@
+/*
+ Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+
+ This library is free software; you can redistribute it and/or
+ modify it under the terms of the GNU Library General Public
+ License as published by the Free Software Foundation; either
+ version 2 of the License, or (at your option) any later version.
+
+ This library is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ Library General Public License for more details.
+
+ You should have received a copy of the GNU Library General Public License
+ along with this library; see the file COPYING.LIB.  If not, write to
+ the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ Boston, MA 02110-1301, USA.
+ */
+
+#ifndef TextureMapper_h
+#define TextureMapper_h
+
+#if USE(ACCELERATED_COMPOSITING)
+#if (defined(QT_OPENGL_LIB))
+    #if defined(QT_OPENGL_ES_2) && !defined(TEXMAP_OPENGL_ES_2)
+        #define TEXMAP_OPENGL_ES_2
+    #endif
+#endif
+
+#include "GraphicsContext.h"
+#include "IntRect.h"
+#include "IntSize.h"
+#include "TransformationMatrix.h"
+
+/*
+    TextureMapper is a mechanism that enables hardware acceleration of CSS animations (accelerated compositing) without
+    a need for a platform specific scene-graph library like CoreAnimations or QGraphicsView.
+*/
+
+namespace WebCore {
+
+class TextureMapper;
+
+// A 2D texture that can be the target of software or GL rendering.
+class BitmapTexture  : public RefCounted<BitmapTexture> {
+public:
+    BitmapTexture() : m_lockCount(0) {}
+    virtual ~BitmapTexture() { }
+
+    virtual bool allowOfflineTextureUpload() const { return false; }
+    virtual void destroy() = 0;
+    virtual IntSize size() const = 0;
+    virtual bool isValid() const = 0;
+    virtual void reset(const IntSize& size, bool opaque = false)
+    {
+        m_isOpaque = opaque;
+        m_contentSize = size;
+    }
+
+    virtual PlatformGraphicsContext* beginPaint(const IntRect& dirtyRect) = 0;
+    virtual void endPaint() = 0;
+    virtual PlatformGraphicsContext* beginPaintMedia()
+    {
+        return beginPaint(IntRect(0, 0, size().width(), size().height()));
+    }
+    virtual void setContentsToImage(Image*) = 0;
+    virtual bool save(const String& filename) { return false; }
+
+    inline void lock() { ++m_lockCount; }
+    inline void unlock() { --m_lockCount; }
+    inline bool isLocked() { return m_lockCount; }
+    inline IntSize contentSize() const { return m_contentSize; }
+    inline void setOffset(const IntPoint& o) { m_offset = o; }
+    inline IntPoint offset() const { return m_offset; }
+private:
+    int m_lockCount;
+    IntSize m_contentSize;
+    bool m_isOpaque;
+    IntPoint m_offset;
+};
+
+// A "context" class used to encapsulate accelerated texture mapping functions: i.e. drawing a texture
+// onto the screen or into another texture with a specified transform, opacity and mask.
+class TextureMapper : public RefCounted<TextureMapper> {
+    friend class BitmapTexture;
+
+public:
+    static PassRefPtr<TextureMapper> create(GraphicsContext*);
+    virtual ~TextureMapper() { }
+
+    virtual void drawTexture(const BitmapTexture& texture, const IntRect& target, const TransformationMatrix& matrix = TransformationMatrix(), float opacity = 1.0f, const BitmapTexture* maskTexture = 0) = 0;
+
+    // makes a surface the target for the following drawTexture calls.
+    virtual void bindSurface(BitmapTexture* surface) = 0;
+    virtual void paintToTarget(const BitmapTexture& texture, const IntSize&, const TransformationMatrix& matrix, float opacity, const IntRect& visibleRect)
+    {
+        drawTexture(texture, IntRect(0, 0, texture.contentSize().width(), texture.contentSize().height()), matrix, opacity, 0);
+    }
+
+    virtual void setClip(const IntRect&) = 0;
+    virtual bool allowSurfaceForRoot() const = 0;
+    virtual PassRefPtr<BitmapTexture> createTexture() = 0;
+    virtual const char* type() const = 0;
+    virtual void cleanup() {}
+
+    GraphicsContext* graphicsContext() const
+    {
+        return m_gc;
+    }
+
+protected:
+    TextureMapper(GraphicsContext* gc) : m_gc(gc) {}
+    GraphicsContext* m_gc;
+};
+
+};
+
+#endif
+
+#endif
diff --git a/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h b/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
new file mode 100644
index 0000000..23e9fc9
--- /dev/null
+++ b/WebCore/platform/graphics/texmap/TextureMapperPlatformLayer.h
@@ -0,0 +1,70 @@
+/*
+    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#ifndef TextureMapperPlatformLayer_h
+#define TextureMapperPlatformLayer_h
+
+namespace WebCore {
+
+class GraphicsContext;
+class IntRect;
+class IntSize;
+class TransformationMatrix;
+
+
+// Glue layer to connect the texmap layer to the platform specific container.
+class TextureMapperLayerClient {
+public:
+    virtual ~TextureMapperLayerClient() {}
+    virtual void setNeedsDisplay() = 0;
+    virtual void setNeedsDisplayInRect(const IntRect& rect) = 0;
+    virtual void setSizeChanged(const IntSize&) = 0;
+};
+
+class TextureMapperPlatformLayer {
+public:
+    enum Type {
+        ContentLayer,
+        VideoLayer
+    };
+
+    virtual Type layerType() const = 0;
+    virtual ~TextureMapperPlatformLayer() {}
+};
+
+class TextureMapperContentLayer : public TextureMapperPlatformLayer {
+public:
+    virtual void setPlatformLayerClient(TextureMapperLayerClient*) = 0;
+    virtual void paint(GraphicsContext*, const IntSize&, const IntRect& targetRect, const IntRect& exposedRect, const TransformationMatrix& transform, float opacity) {}
+    virtual IntSize size() const = 0;
+    virtual void cleanupTextureMapper() {}
+    virtual Type layerType() const { return ContentLayer; }
+};
+
+#if ENABLE(VIDEO)
+class TextureMapperVideoLayer : public TextureMapperPlatformLayer {
+public:
+    virtual void paint(GraphicsContext*) = 0;
+    virtual Type layerType() const { return VideoLayer; }
+};
+#endif
+
+}
+
+#endif // TextureMapperPlatformLayer_h
diff --git a/WebCore/platform/graphics/transforms/AffineTransform.cpp b/WebCore/platform/graphics/transforms/AffineTransform.cpp
index be18e07..f275526 100644
--- a/WebCore/platform/graphics/transforms/AffineTransform.cpp
+++ b/WebCore/platform/graphics/transforms/AffineTransform.cpp
@@ -41,8 +41,8 @@ static void affineTransformDecompose(const AffineTransform& matrix, double sr[9]
     AffineTransform m(matrix);
 
     // Compute scaling factors
-    double sx = sqrt(m.a() * m.a() + m.b() * m.b());
-    double sy = sqrt(m.c() * m.c() + m.d() * m.d());
+    double sx = matrix.xScale();
+    double sy = matrix.yScale();
 
     // Compute cross product of transformed unit vectors. If negative,
     // one axis was flipped.
@@ -119,6 +119,16 @@ bool AffineTransform::isIdentity() const
          && m_transform[4] == 0 && m_transform[5] == 0);
 }
 
+double AffineTransform::xScale() const
+{
+    return sqrt(m_transform[0] * m_transform[0] + m_transform[1] * m_transform[1]);
+}
+
+double AffineTransform::yScale() const
+{
+    return sqrt(m_transform[2] * m_transform[2] + m_transform[3] * m_transform[3]);
+}
+
 double AffineTransform::det() const
 {
     return m_transform[0] * m_transform[3] - m_transform[1] * m_transform[2];
diff --git a/WebCore/platform/graphics/transforms/AffineTransform.h b/WebCore/platform/graphics/transforms/AffineTransform.h
index 289ec54..baee102 100644
--- a/WebCore/platform/graphics/transforms/AffineTransform.h
+++ b/WebCore/platform/graphics/transforms/AffineTransform.h
@@ -110,7 +110,10 @@ public:
     AffineTransform& skew(double angleX, double angleY);
     AffineTransform& skewX(double angle);
     AffineTransform& skewY(double angle);
- 
+
+    double xScale() const;
+    double yScale() const;
+
     double det() const;
     bool isInvertible() const;
     AffineTransform inverse() const;
diff --git a/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h b/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
index 7430dbc..0a0aaf0 100644
--- a/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/Matrix3DTransformOperation.h
@@ -37,6 +37,8 @@ public:
         return adoptRef(new Matrix3DTransformOperation(matrix));
     }
 
+    TransformationMatrix matrix() const {return m_matrix; }
+
 private:    
     virtual bool isIdentity() const { return m_matrix.isIdentity(); }
 
diff --git a/WebCore/platform/graphics/transforms/MatrixTransformOperation.h b/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
index ee47a11..fd9b27e 100644
--- a/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/MatrixTransformOperation.h
@@ -42,6 +42,8 @@ public:
         return adoptRef(new MatrixTransformOperation(t));
     }
 
+    TransformationMatrix matrix() const { return TransformationMatrix(m_a, m_b, m_c, m_d, m_e, m_f); }
+
 private:
     virtual bool isIdentity() const { return m_a == 1 && m_b == 0 && m_c == 0 && m_d == 1 && m_e == 0 && m_f == 0; }
 
diff --git a/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h b/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
index a665f3e..834cc83 100644
--- a/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/PerspectiveTransformOperation.h
@@ -36,6 +36,8 @@ public:
     {
         return adoptRef(new PerspectiveTransformOperation(p));
     }
+
+    double perspective() const { return m_p; }
     
 private:
     virtual bool isIdentity() const { return m_p == 0; }
diff --git a/WebCore/platform/graphics/transforms/RotateTransformOperation.h b/WebCore/platform/graphics/transforms/RotateTransformOperation.h
index 699ea43..2acb002 100644
--- a/WebCore/platform/graphics/transforms/RotateTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/RotateTransformOperation.h
@@ -41,6 +41,9 @@ public:
         return adoptRef(new RotateTransformOperation(x, y, z, angle, type));
     }
 
+    double x() const { return m_x; }
+    double y() const { return m_y; }
+    double z() const { return m_z; }
     double angle() const { return m_angle; }
 
 private:
diff --git a/WebCore/platform/graphics/transforms/SkewTransformOperation.h b/WebCore/platform/graphics/transforms/SkewTransformOperation.h
index 6343710..afe9a7b 100644
--- a/WebCore/platform/graphics/transforms/SkewTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/SkewTransformOperation.h
@@ -36,6 +36,9 @@ public:
         return adoptRef(new SkewTransformOperation(angleX, angleY, type));
     }
 
+    double angleX() const { return m_angleX; }
+    double angleY() const { return m_angleY; }
+
 private:
     virtual bool isIdentity() const { return m_angleX == 0 && m_angleY == 0; }
     virtual OperationType getOperationType() const { return m_type; }
diff --git a/WebCore/platform/graphics/transforms/TranslateTransformOperation.h b/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
index a66cc3d..ea48d49 100644
--- a/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
+++ b/WebCore/platform/graphics/transforms/TranslateTransformOperation.h
@@ -46,6 +46,10 @@ public:
     double y(const IntSize& borderBoxSize) const { return m_y.calcFloatValue(borderBoxSize.height()); }
     double z(const IntSize&) const { return m_z.calcFloatValue(1); }
 
+    Length x() const { return m_x; }
+    Length y() const { return m_y; }
+    Length z() const { return m_z; }
+
 private:
     virtual bool isIdentity() const { return m_x.calcFloatValue(1) == 0 && m_y.calcFloatValue(1) == 0 && m_z.calcFloatValue(1) == 0; }
 
diff --git a/WebCore/platform/graphics/win/FontCGWin.cpp b/WebCore/platform/graphics/win/FontCGWin.cpp
index c6437f2..2f1fb41 100644
--- a/WebCore/platform/graphics/win/FontCGWin.cpp
+++ b/WebCore/platform/graphics/win/FontCGWin.cpp
@@ -360,14 +360,14 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
         graphicsContext->clearShadow();
         Color fillColor = graphicsContext->fillColor();
         Color shadowFillColor(shadowColor.red(), shadowColor.green(), shadowColor.blue(), shadowColor.alpha() * fillColor.alpha() / 255);
-        graphicsContext->setFillColor(shadowFillColor, DeviceColorSpace);
+        graphicsContext->setFillColor(shadowFillColor, ColorSpaceDeviceRGB);
         CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowOffset.width(), point.y() + translation.height() + shadowOffset.height());
         CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         if (font->syntheticBoldOffset()) {
             CGContextSetTextPosition(cgContext, point.x() + translation.width() + shadowOffset.width() + font->syntheticBoldOffset(), point.y() + translation.height() + shadowOffset.height());
             CGContextShowGlyphsWithAdvances(cgContext, glyphBuffer.glyphs(from), glyphBuffer.advances(from), numGlyphs);
         }
-        graphicsContext->setFillColor(fillColor, DeviceColorSpace);
+        graphicsContext->setFillColor(fillColor, ColorSpaceDeviceRGB);
     }
 
     CGContextSetTextPosition(cgContext, point.x() + translation.width(), point.y() + translation.height());
@@ -378,7 +378,7 @@ void Font::drawGlyphs(GraphicsContext* graphicsContext, const SimpleFontData* fo
     }
 
     if (hasSimpleShadow)
-        graphicsContext->setShadow(shadowOffset, shadowBlur, shadowColor, DeviceColorSpace);
+        graphicsContext->setShadow(shadowOffset, shadowBlur, shadowColor, ColorSpaceDeviceRGB);
 
     wkRestoreFontSmoothingStyle(cgContext, oldFontSmoothingStyle);
 }
diff --git a/WebCore/platform/graphics/win/GDIExtras.cpp b/WebCore/platform/graphics/win/GDIExtras.cpp
new file mode 100644
index 0000000..4bd95da
--- /dev/null
+++ b/WebCore/platform/graphics/win/GDIExtras.cpp
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "GDIExtras.h"
+
+#include "SoftLinking.h"
+
+namespace WebCore {
+
+#if OS(WINCE)
+SOFT_LINK_LIBRARY(coredll)
+SOFT_LINK_OPTIONAL(coredll, AlphaBlend, BOOL, APIENTRY, (HDC hdcDest, int nXOriginDest, int nYOriginDest, int nWidthDest, int nHeightDest, HDC hdcSrc,
+                                                         int nXOriginSrc, int nYOriginSrc, int nWidthSrc, int nHeightSrc, BLENDFUNCTION blendFunction))
+
+AlphaBlendPointerType AlphaBlendPointer()
+{
+    return AlphaBlendPtr();
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/platform/graphics/win/GDIExtras.h b/WebCore/platform/graphics/win/GDIExtras.h
new file mode 100644
index 0000000..0166124
--- /dev/null
+++ b/WebCore/platform/graphics/win/GDIExtras.h
@@ -0,0 +1,65 @@
+/*
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef GDIExtras_h
+#define GDIExtras_h
+
+#include <windows.h>
+
+namespace WebCore {
+
+typedef BOOL (APIENTRY *AlphaBlendPointerType) (HDC hdcDest, int nXOriginDest, int nYOriginDest, int nWidthDest, int nHeightDest, HDC hdcSrc,
+                                                int nXOriginSrc, int nYOriginSrc, int nWidthSrc, int nHeightSrc, BLENDFUNCTION blendFunction);
+
+#if OS(WINCE)
+AlphaBlendPointerType AlphaBlendPointer();
+#endif
+
+inline bool hasAlphaBlendSupport()
+{
+#if OS(WINCE)
+    return AlphaBlendPointer();
+#else
+    return true;
+#endif
+}
+
+inline bool alphaBlendIfSupported(HDC hdcDest, int nXOriginDest, int nYOriginDest, int nWidthDest, int nHeightDest, HDC hdcSrc,
+                                  int nXOriginSrc, int nYOriginSrc, int nWidthSrc, int nHeightSrc, BLENDFUNCTION blendFunction)
+{
+#if OS(WINCE)
+    AlphaBlendPointerType alphaBlendPointer = AlphaBlendPointer();
+    if (!alphaBlendPointer)
+        return false;
+
+    alphaBlendPointer(hdcDest, nXOriginDest, nYOriginDest, nWidthDest, nHeightDest, hdcSrc, nXOriginSrc, nYOriginSrc, nWidthSrc, nHeightSrc, blendFunction);
+#else
+    AlphaBlend(hdcDest, nXOriginDest, nYOriginDest, nWidthDest, nHeightDest, hdcSrc, nXOriginSrc, nYOriginSrc, nWidthSrc, nHeightSrc, blendFunction);
+#endif
+    return true;
+}
+
+} // namespace WebCore
+
+#endif // GDIExtras_h
diff --git a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
index 0203d42..c9288e5 100644
--- a/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
+++ b/WebCore/platform/graphics/win/GraphicsContextCGWin.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2003, 2004, 2005, 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -70,8 +70,8 @@ GraphicsContext::GraphicsContext(HDC hdc, bool hasAlpha)
     setPaintingDisabled(!m_data->m_cgContext);
     if (m_data->m_cgContext) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor(), DeviceColorSpace);
-        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
+        setPlatformFillColor(fillColor(), ColorSpaceDeviceRGB);
+        setPlatformStrokeColor(strokeColor(), ColorSpaceDeviceRGB);
     }
 }
 
@@ -129,6 +129,8 @@ void GraphicsContext::drawFocusRing(const Vector<Path>& paths, int width, int of
     // FIXME: implement
 }
 
+// FIXME: This is nearly identical to the GraphicsContext::drawFocusRing function in GraphicsContextMac.mm.
+// The code could move to GraphicsContextCG.cpp and be shared.
 void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int offset, const Color& color)
 {
     if (paintingDisabled())
@@ -136,7 +138,7 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
 
     float radius = (width - 1) / 2.0f;
     offset += radius;
-    CGColorRef colorRef = color.isValid() ? createCGColor(color) : 0;
+    CGColorRef colorRef = color.isValid() ? cachedCGColor(color, ColorSpaceDeviceRGB) : 0;
 
     CGMutablePathRef focusRingPath = CGPathCreateMutable();
     unsigned rectCount = rects.size();
@@ -151,8 +153,6 @@ void GraphicsContext::drawFocusRing(const Vector<IntRect>& rects, int width, int
 
     wkDrawFocusRing(context, colorRef, radius);
 
-    CGColorRelease(colorRef);
-
     CGPathRelease(focusRingPath);
 
     CGContextRestoreGState(context);
diff --git a/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
index dad5da1..f7674db 100644
--- a/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
+++ b/WebCore/platform/graphics/win/GraphicsLayerCACF.cpp
@@ -99,9 +99,7 @@ TransformationMatrix CAToTransform3D(const CATransform3D& fromT3D)
 
 static void setLayerBorderColor(WKCACFLayer* layer, const Color& color)
 {
-    CGColorRef borderColor = createCGColor(color);
-    layer->setBorderColor(borderColor);
-    CGColorRelease(borderColor);
+    layer->setBorderColor(cachedCGColor(color, ColorSpaceDeviceRGB));
 }
 
 static void clearBorderColor(WKCACFLayer* layer)
@@ -111,9 +109,7 @@ static void clearBorderColor(WKCACFLayer* layer)
 
 static void setLayerBackgroundColor(WKCACFLayer* layer, const Color& color)
 {
-    CGColorRef bgColor = createCGColor(color);
-    layer->setBackgroundColor(bgColor);
-    CGColorRelease(bgColor);
+    layer->setBackgroundColor(cachedCGColor(color, ColorSpaceDeviceRGB));
 }
 
 static void clearLayerBackgroundColor(WKCACFLayer* layer)
diff --git a/WebCore/platform/graphics/win/ImageCGWin.cpp b/WebCore/platform/graphics/win/ImageCGWin.cpp
index a0fbba7..e65b859 100644
--- a/WebCore/platform/graphics/win/ImageCGWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCGWin.cpp
@@ -78,9 +78,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), ColorSpaceDeviceRGB, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), ColorSpaceDeviceRGB, CompositeCopy);
 
     // Do cleanup
     CGContextRelease(cgContext);
diff --git a/WebCore/platform/graphics/win/ImageCairoWin.cpp b/WebCore/platform/graphics/win/ImageCairoWin.cpp
index e3c5ea0..70b132e 100644
--- a/WebCore/platform/graphics/win/ImageCairoWin.cpp
+++ b/WebCore/platform/graphics/win/ImageCairoWin.cpp
@@ -82,9 +82,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
     IntSize imageSize = BitmapImage::size();
     if (size)
-        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
+        drawFrameMatchingSourceSize(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), ColorSpaceDeviceRGB, CompositeCopy);
     else
-        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
+        draw(&gc, FloatRect(0.0f, 0.0f, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), ColorSpaceDeviceRGB, CompositeCopy);
 
     // Do cleanup
     cairo_destroy(targetRef);
@@ -100,7 +100,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
         if (cairo_image_surface_get_height(image) == static_cast<size_t>(srcSize.height()) && cairo_image_surface_get_width(image) == static_cast<size_t>(srcSize.width())) {
             size_t currentFrame = m_currentFrame;
             m_currentFrame = i;
-            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), DeviceColorSpace, compositeOp);
+            draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, srcSize.width(), srcSize.height()), ColorSpaceDeviceRGB, compositeOp);
             m_currentFrame = currentFrame;
             return;
         }
@@ -108,7 +108,7 @@ void BitmapImage::drawFrameMatchingSourceSize(GraphicsContext* ctxt, const Float
 
     // No image of the correct size was found, fallback to drawing the current frame
     IntSize imageSize = BitmapImage::size();
-    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), DeviceColorSpace, compositeOp);
+    draw(ctxt, dstRect, FloatRect(0.0f, 0.0f, imageSize.width(), imageSize.height()), ColorSpaceDeviceRGB, compositeOp);
 }
 
 } // namespace WebCore
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
index 4a7e45e..4a7e45e 100755..100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateFullscreenWindow.cpp
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
index 354e0bf..1b4f1d9 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.cpp
@@ -42,7 +42,6 @@
 #include "ScrollView.h"
 #include "Settings.h"
 #include "SoftLinking.h"
-#include "StringBuilder.h"
 #include "TimeRanges.h"
 #include "Timer.h"
 #include <AssertMacros.h>
@@ -53,6 +52,7 @@
 #include <wtf/MainThread.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -174,6 +174,8 @@ MediaPlayerPrivateQuickTimeVisualContext::MediaPlayerPrivateQuickTimeVisualConte
     , m_movieTransform(CGAffineTransformIdentity)
 #endif
     , m_visualContextClient(new MediaPlayerPrivateQuickTimeVisualContext::VisualContextClient(this))
+    , m_delayingLoad(false)
+    , m_preload(MediaPlayer::Auto)
 {
 }
 
@@ -241,7 +243,7 @@ static void addCookieParam(StringBuilder& cookieBuilder, const String& name, con
     // Add parameter name, and value if there is one.
     cookieBuilder.append(name);
     if (!value.isEmpty()) {
-        cookieBuilder.append("=");
+        cookieBuilder.append('=');
         cookieBuilder.append(value);
     }
 }
@@ -275,7 +277,7 @@ void MediaPlayerPrivateQuickTimeVisualContext::setUpCookiesForQuickTime(const St
             addCookieParam(cookieBuilder, "expires", rfc2616DateStringFromTime(cookie.expires));
         if (cookie.httpOnly) 
             addCookieParam(cookieBuilder, "httpOnly", String());
-        cookieBuilder.append(";");
+        cookieBuilder.append(';');
 
         String cookieURL;
         if (!cookie.domain.isEmpty()) {
@@ -316,8 +318,28 @@ static void disableComponentsOnce()
         QTMovie::disableComponent(componentsToDisable[i]);
 }
 
+void MediaPlayerPrivateQuickTimeVisualContext::resumeLoad()
+{
+    m_delayingLoad = false;
+
+    if (!m_movieURL.isEmpty())
+        loadInternal(m_movieURL);
+}
+
 void MediaPlayerPrivateQuickTimeVisualContext::load(const String& url)
 {
+    m_movieURL = url;
+
+    if (m_preload == MediaPlayer::None) {
+        m_delayingLoad = true;
+        return;
+    }
+
+    loadInternal(url);
+}
+
+void MediaPlayerPrivateQuickTimeVisualContext::loadInternal(const String& url)
+{
     if (!QTMovie::initializeQuickTime()) {
         // FIXME: is this the right error to return?
         m_networkState = MediaPlayer::DecodeError; 
@@ -347,6 +369,12 @@ void MediaPlayerPrivateQuickTimeVisualContext::load(const String& url)
     m_movie->setVolume(m_player->volume());
 }
 
+void MediaPlayerPrivateQuickTimeVisualContext::prepareToPlay()
+{
+    if (!m_movie || m_delayingLoad)
+        resumeLoad();
+}
+
 void MediaPlayerPrivateQuickTimeVisualContext::play()
 {
     if (!m_movie)
@@ -1005,6 +1033,13 @@ bool MediaPlayerPrivateQuickTimeVisualContext::hasSingleSecurityOrigin() const
     return true;
 }
 
+void MediaPlayerPrivateQuickTimeVisualContext::setPreload(MediaPlayer::Preload preload)
+{
+    m_preload = preload;
+    if (m_delayingLoad && m_preload != MediaPlayer::None)
+        resumeLoad();
+}
+
 MediaPlayerPrivateQuickTimeVisualContext::MediaRenderingMode MediaPlayerPrivateQuickTimeVisualContext::currentRenderingMode() const
 {
     if (!m_movie)
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
index 272b90f..4c62558 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeVisualContext.h
@@ -74,9 +74,12 @@ private:
 
     void load(const String& url);
     void cancelLoad();
+    void loadInternal(const String& url);
+    void resumeLoad();
     
     void play();
     void pause();    
+    void prepareToPlay();
     
     bool paused() const;
     bool seeking() const;
@@ -111,6 +114,8 @@ private:
     bool hasClosedCaptions() const;
     void setClosedCaptionsVisible(bool);
 
+    void setPreload(MediaPlayer::Preload);
+
     void updateStates();
     void doSeek();
     void cancelSeek();
@@ -189,6 +194,9 @@ private:
     bool m_isStreaming;
     bool m_visible;
     bool m_newFrameAvailable;
+    bool m_delayingLoad;
+    String m_movieURL;
+    MediaPlayer::Preload m_preload;
 #if DRAW_FRAME_RATE
     double m_frameCountWhilePlaying;
     double m_timeStartedPlaying;
diff --git a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
index c37f5d5..39e8a11 100644
--- a/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
+++ b/WebCore/platform/graphics/win/MediaPlayerPrivateQuickTimeWin.cpp
@@ -38,7 +38,6 @@
 #include "QTMovieTask.h"
 #include "ScrollView.h"
 #include "SoftLinking.h"
-#include "StringBuilder.h"
 #include "TimeRanges.h"
 #include "Timer.h"
 #include <Wininet.h>
@@ -46,6 +45,7 @@
 #include <wtf/HashSet.h>
 #include <wtf/MathExtras.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -159,7 +159,7 @@ static void addCookieParam(StringBuilder& cookieBuilder, const String& name, con
     // Add parameter name, and value if there is one.
     cookieBuilder.append(name);
     if (!value.isEmpty()) {
-        cookieBuilder.append("=");
+        cookieBuilder.append('=');
         cookieBuilder.append(value);
     }
 }
@@ -194,7 +194,7 @@ void MediaPlayerPrivate::setUpCookiesForQuickTime(const String& url)
             addCookieParam(cookieBuilder, "expires", rfc2616DateStringFromTime(cookie.expires));
         if (cookie.httpOnly) 
             addCookieParam(cookieBuilder, "httpOnly", String());
-        cookieBuilder.append(";");
+        cookieBuilder.append(';');
 
         String cookieURL;
         if (!cookie.domain.isEmpty()) {
diff --git a/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
index 1685a30..d75c854 100644
--- a/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.cpp
@@ -29,8 +29,8 @@
 
 #include "WKCACFContextFlusher.h"
 
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <wtf/StdLibExtras.h>
-#include <QuartzCore/CACFContext.h>
 
 namespace WebCore {
 
@@ -48,24 +48,18 @@ WKCACFContextFlusher::~WKCACFContextFlusher()
 {
 }
 
-void WKCACFContextFlusher::addContext(CACFContextRef context)
+void WKCACFContextFlusher::addContext(WKCACFContext* context)
 {
     ASSERT(context);
 
-    if (m_contexts.add(context).second)
-        CFRetain(context);
+    m_contexts.add(context);
 }
 
-void WKCACFContextFlusher::removeContext(CACFContextRef context)
+void WKCACFContextFlusher::removeContext(WKCACFContext* context)
 {
     ASSERT(context);
 
-    ContextSet::iterator found = m_contexts.find(context);
-    if (found == m_contexts.end())
-        return;
-
-    CFRelease(*found);
-    m_contexts.remove(found);
+    m_contexts.remove(context);
 }
 
 void WKCACFContextFlusher::flushAllContexts()
@@ -76,11 +70,8 @@ void WKCACFContextFlusher::flushAllContexts()
     contextsToFlush.swap(m_contexts);
 
     ContextSet::const_iterator end = contextsToFlush.end();
-    for (ContextSet::const_iterator it = contextsToFlush.begin(); it != end; ++it) {
-        CACFContextRef context = *it;
-        CACFContextFlush(context);
-        CFRelease(context);
-    }
+    for (ContextSet::const_iterator it = contextsToFlush.begin(); it != end; ++it)
+        wkCACFContextFlush(*it);
 }
 
 }
diff --git a/WebCore/platform/graphics/win/WKCACFContextFlusher.h b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
index 9ce76aa..17ec41d 100644
--- a/WebCore/platform/graphics/win/WKCACFContextFlusher.h
+++ b/WebCore/platform/graphics/win/WKCACFContextFlusher.h
@@ -32,7 +32,7 @@
 
 #include <wtf/HashSet.h>
 
-typedef struct _CACFContext* CACFContextRef;
+struct WKCACFContext;
 
 namespace WebCore {
 
@@ -40,8 +40,8 @@ class WKCACFContextFlusher : public Noncopyable {
 public:
     static WKCACFContextFlusher& shared();
 
-    void addContext(CACFContextRef);
-    void removeContext(CACFContextRef);
+    void addContext(WKCACFContext*);
+    void removeContext(WKCACFContext*);
 
     void flushAllContexts();
 
@@ -49,7 +49,7 @@ private:
     WKCACFContextFlusher();
     ~WKCACFContextFlusher();
 
-    typedef HashSet<CACFContextRef> ContextSet;
+    typedef HashSet<WKCACFContext*> ContextSet;
     ContextSet m_contexts;
 };
 
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.cpp b/WebCore/platform/graphics/win/WKCACFLayer.cpp
index bf47925..a8714e3 100644
--- a/WebCore/platform/graphics/win/WKCACFLayer.cpp
+++ b/WebCore/platform/graphics/win/WKCACFLayer.cpp
@@ -30,15 +30,10 @@
 #include "WKCACFLayer.h"
 
 #include "WKCACFLayerRenderer.h"
-#include <wtf/text/CString.h>
-
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <stdio.h>
-#include <QuartzCore/CACFContext.h>
-#include <QuartzCore/CARender.h>
-
-#ifndef NDEBUG
 #include <wtf/CurrentTime.h>
-#endif
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
@@ -190,9 +185,9 @@ WKCACFLayer::~WKCACFLayer()
     CACFLayerSetDisplayCallback(layer(), 0);
 }
 
-void WKCACFLayer::becomeRootLayerForContext(CACFContextRef context)
+void WKCACFLayer::becomeRootLayerForContext(WKCACFContext* context)
 {
-    CACFContextSetLayer(context, layer());
+    wkCACFContextSetLayer(context, layer());
     setNeedsCommit();
 }
 
diff --git a/WebCore/platform/graphics/win/WKCACFLayer.h b/WebCore/platform/graphics/win/WKCACFLayer.h
index 7243508..4c6639a 100644
--- a/WebCore/platform/graphics/win/WKCACFLayer.h
+++ b/WebCore/platform/graphics/win/WKCACFLayer.h
@@ -41,6 +41,8 @@
 #include "PlatformString.h"
 #include "TransformationMatrix.h"
 
+struct WKCACFContext;
+
 namespace WebCore {
 
 class WKCACFLayer;
@@ -83,7 +85,7 @@ public:
     }
 
     // Makes this layer the root when the passed context is rendered
-    void becomeRootLayerForContext(CACFContextRef);
+    void becomeRootLayerForContext(WKCACFContext*);
 
     static RetainPtr<CFTypeRef> cfValue(float value) { return RetainPtr<CFTypeRef>(AdoptCF, CFNumberCreate(0, kCFNumberFloat32Type, &value)); }
     static RetainPtr<CFTypeRef> cfValue(const TransformationMatrix& value)
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
index 4f39b13..73cb794 100755..100644
--- a/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.cpp
@@ -36,9 +36,7 @@
 #include "WKCACFContextFlusher.h"
 #include "WKCACFLayer.h"
 #include "WebCoreInstanceHandle.h"
-#include <CoreGraphics/CGSRegion.h>
-#include <QuartzCore/CACFContext.h>
-#include <QuartzCore/CARenderOGL.h>
+#include <WebKitSystemInterface/WebKitSystemInterface.h>
 #include <wtf/HashMap.h>
 #include <wtf/OwnArrayPtr.h>
 #include <wtf/OwnPtr.h>
@@ -108,7 +106,7 @@ private:
     WKCACFLayerRenderer* m_renderer;
 };
 
-typedef HashMap<CACFContextRef, WKCACFLayerRenderer*> ContextToWindowMap;
+typedef HashMap<WKCACFContext*, WKCACFLayerRenderer*> ContextToWindowMap;
 
 static ContextToWindowMap& windowsForContexts()
 {
@@ -206,7 +204,7 @@ bool WKCACFLayerRenderer::acceleratedCompositingAvailable()
     return available;
 }
 
-void WKCACFLayerRenderer::didFlushContext(CACFContextRef context)
+void WKCACFLayerRenderer::didFlushContext(WKCACFContext* context)
 {
     WKCACFLayerRenderer* window = windowsForContexts().get(context);
     if (!window)
@@ -226,15 +224,13 @@ WKCACFLayerRenderer::WKCACFLayerRenderer(WKCACFLayerRendererClient* client)
     : m_client(client)
     , m_mightBeAbleToCreateDeviceLater(true)
     , m_rootLayer(WKCACFRootLayer::create(this))
-    , m_context(AdoptCF, CACFContextCreate(0))
-    , m_renderContext(static_cast<CARenderContext*>(CACFContextGetRenderContext(m_context.get())))
-    , m_renderer(0)
+    , m_context(wkCACFContextCreate())
     , m_hostWindow(0)
     , m_renderTimer(this, &WKCACFLayerRenderer::renderTimerFired)
     , m_backingStoreDirty(false)
     , m_mustResetLostDeviceBeforeRendering(false)
 {
-    windowsForContexts().set(m_context.get(), this);
+    windowsForContexts().set(m_context, this);
 
     // Under the root layer, we have a clipping layer to clip the content,
     // that contains a scroll layer that we use for scrolling the content.
@@ -250,13 +246,13 @@ WKCACFLayerRenderer::WKCACFLayerRenderer(WKCACFLayerRendererClient* client)
     m_rootLayer->setGeometryFlipped(true);
 
 #ifndef NDEBUG
-    CGColorRef debugColor = createCGColor(Color(255, 0, 0, 204));
+    CGColorRef debugColor = CGColorCreateGenericRGB(1, 0, 0, 0.8);
     m_rootLayer->setBackgroundColor(debugColor);
     CGColorRelease(debugColor);
 #endif
 
     if (m_context)
-        m_rootLayer->becomeRootLayerForContext(m_context.get());
+        m_rootLayer->becomeRootLayerForContext(m_context);
 
 #ifndef NDEBUG
     char* printTreeFlag = getenv("CA_PRINT_TREE");
@@ -267,6 +263,7 @@ WKCACFLayerRenderer::WKCACFLayerRenderer(WKCACFLayerRendererClient* client)
 WKCACFLayerRenderer::~WKCACFLayerRenderer()
 {
     destroyRenderer();
+    wkCACFContextDestroy(m_context);
 }
 
 WKCACFLayer* WKCACFLayerRenderer::rootLayer() const
@@ -298,7 +295,7 @@ void WKCACFLayerRenderer::setRootChildLayer(WKCACFLayer* layer)
    
 void WKCACFLayerRenderer::layerTreeDidChange()
 {
-    WKCACFContextFlusher::shared().addContext(m_context.get());
+    WKCACFContextFlusher::shared().addContext(m_context);
     renderSoon();
 }
 
@@ -373,7 +370,7 @@ bool WKCACFLayerRenderer::createRenderer()
 
     initD3DGeometry();
 
-    m_renderer = CARenderOGLNew(&kCARenderDX9Callbacks, m_d3dDevice.get(), 0);
+    wkCACFContextInitializeD3DDevice(m_context, m_d3dDevice.get());
 
     if (IsWindow(m_hostWindow))
         m_rootLayer->setBounds(bounds());
@@ -384,14 +381,10 @@ bool WKCACFLayerRenderer::createRenderer()
 void WKCACFLayerRenderer::destroyRenderer()
 {
     if (m_context) {
-        CACFContextSetLayer(m_context.get(), 0);
-        windowsForContexts().remove(m_context.get());
-        WKCACFContextFlusher::shared().removeContext(m_context.get());
+        windowsForContexts().remove(m_context);
+        WKCACFContextFlusher::shared().removeContext(m_context);
     }
 
-    if (m_renderer)
-        CARenderOGLDestroy(m_renderer);
-    m_renderer = 0;
     m_d3dDevice = 0;
     if (s_d3d)
         s_d3d->Release();
@@ -476,7 +469,7 @@ void WKCACFLayerRenderer::paint()
     render(dirtyRects);
 }
 
-void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
+void WKCACFLayerRenderer::render(const Vector<CGRect>& windowDirtyRects)
 {
     ASSERT(m_d3dDevice);
 
@@ -499,31 +492,21 @@ void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
     CFTimeInterval t = CACurrentMediaTime();
 
     // Give the renderer some space to use. This needs to be valid until the
-    // CARenderUpdateFinish() call below.
+    // wkCACFContextFinishUpdate() call below.
     char space[4096];
-    CARenderUpdate* u = CARenderUpdateBegin(space, sizeof(space), t, 0, 0, &bounds);
-    if (!u)
+    if (!wkCACFContextBeginUpdate(m_context, space, sizeof(space), t, bounds, windowDirtyRects.data(), windowDirtyRects.size()))
         return;
 
-    CARenderContextLock(m_renderContext);
-    CARenderUpdateAddContext(u, m_renderContext);
-    CARenderContextUnlock(m_renderContext);
-
-    for (size_t i = 0; i < dirtyRects.size(); ++i)
-        CARenderUpdateAddRect(u, &dirtyRects[i]);
-
     HRESULT err = S_OK;
     do {
-        CGSRegionObj rgn = CARenderUpdateCopyRegion(u);
+        // FIXME: don't need to clear dirty region if layer tree is opaque.
 
-        if (!rgn)
+        WKCACFUpdateRectEnumerator* e = wkCACFContextCopyUpdateRectEnumerator(m_context);
+        if (!e)
             break;
 
-        // FIXME: don't need to clear dirty region if layer tree is opaque.
-
         Vector<D3DRECT, 64> rects;
-        CGSRegionEnumeratorObj e = CGSRegionEnumerator(rgn);
-        for (const CGRect* r = CGSNextRect(e); r; r = CGSNextRect(e)) {
+        for (const CGRect* r = wkCACFUpdateRectEnumeratorNextRect(e); r; r = wkCACFUpdateRectEnumeratorNextRect(e)) {
             D3DRECT rect;
             rect.x1 = r->origin.x;
             rect.x2 = rect.x1 + r->size.width;
@@ -532,8 +515,7 @@ void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
 
             rects.append(rect);
         }
-        CGSReleaseRegionEnumerator(e);
-        CGSReleaseRegion(rgn);
+        wkCACFUpdateRectEnumeratorRelease(e);
 
         if (rects.isEmpty())
             break;
@@ -541,13 +523,13 @@ void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
         m_d3dDevice->Clear(rects.size(), rects.data(), D3DCLEAR_TARGET, 0, 1.0f, 0);
 
         m_d3dDevice->BeginScene();
-        CARenderOGLRender(m_renderer, u);
+        wkCACFContextRenderUpdate(m_context);
         m_d3dDevice->EndScene();
 
         err = m_d3dDevice->Present(0, 0, 0, 0);
 
         if (err == D3DERR_DEVICELOST) {
-            CARenderUpdateAddRect(u, &bounds);
+            wkCACFContextAddUpdateRect(m_context, bounds);
             if (!resetDevice(LostDevice)) {
                 // We can't reset the device right now. Try again soon.
                 renderSoon();
@@ -556,7 +538,7 @@ void WKCACFLayerRenderer::render(const Vector<CGRect>& dirtyRects)
         }
     } while (err == D3DERR_DEVICELOST);
 
-    CARenderUpdateFinish(u);
+    wkCACFContextFinishUpdate(m_context);
 
 #ifndef NDEBUG
     if (m_printTree)
@@ -598,7 +580,7 @@ void WKCACFLayerRenderer::initD3DGeometry()
 bool WKCACFLayerRenderer::resetDevice(ResetReason reason)
 {
     ASSERT(m_d3dDevice);
-    ASSERT(m_renderContext);
+    ASSERT(m_context);
 
     HRESULT hr = m_d3dDevice->TestCooperativeLevel();
 
@@ -617,10 +599,10 @@ bool WKCACFLayerRenderer::resetDevice(ResetReason reason)
 
     // We can reset the device.
 
-    // We have to purge the CARenderOGLContext whenever we reset the IDirect3DDevice9 in order to
+    // We have to release the context's D3D resrouces whenever we reset the IDirect3DDevice9 in order to
     // destroy any D3DPOOL_DEFAULT resources that Core Animation has allocated (e.g., textures used
     // for mask layers). See <http://msdn.microsoft.com/en-us/library/bb174425(v=VS.85).aspx>.
-    CARenderOGLPurge(m_renderer);
+    wkCACFContextReleaseD3DResources(m_context);
 
     D3DPRESENT_PARAMETERS parameters = initialPresentationParameters();
     hr = m_d3dDevice->Reset(&parameters);
diff --git a/WebCore/platform/graphics/win/WKCACFLayerRenderer.h b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
index 1d73b99..763fffa 100755..100644
--- a/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
+++ b/WebCore/platform/graphics/win/WKCACFLayerRenderer.h
@@ -41,9 +41,7 @@
 #include <CoreGraphics/CGGeometry.h>
 
 interface IDirect3DDevice9;
-typedef struct _CACFContext* CACFContextRef;
-typedef struct _CARenderContext CARenderContext;
-typedef struct _CARenderOGLContext CARenderOGLContext;
+struct WKCACFContext;
 
 namespace WebCore {
 
@@ -64,7 +62,7 @@ public:
     ~WKCACFLayerRenderer();
 
     static bool acceleratedCompositingAvailable();
-    static void didFlushContext(CACFContextRef);
+    static void didFlushContext(WKCACFContext*);
 
     void setRootContents(CGImageRef);
     void setRootContentsAndDisplay(CGImageRef);
@@ -104,9 +102,7 @@ private:
     COMPtr<IDirect3DDevice9> m_d3dDevice;
     RefPtr<WKCACFRootLayer> m_rootLayer;
     RefPtr<WKCACFLayer> m_rootChildLayer;
-    RetainPtr<CACFContextRef> m_context;
-    CARenderContext* m_renderContext;
-    CARenderOGLContext* m_renderer;
+    WKCACFContext* m_context;
     HWND m_hostWindow;
     Timer<WKCACFLayerRenderer> m_renderTimer;
     bool m_backingStoreDirty;
diff --git a/WebCore/platform/graphics/win/WebLayer.cpp b/WebCore/platform/graphics/win/WebLayer.cpp
index 70a522d..ecda294 100644
--- a/WebCore/platform/graphics/win/WebLayer.cpp
+++ b/WebCore/platform/graphics/win/WebLayer.cpp
@@ -94,7 +94,7 @@ void WebLayer::drawInContext(PlatformGraphicsContext* context)
 #endif
 
     if (m_owner->showRepaintCounter()) {
-        String text = String::format("%d", m_owner->incrementRepaintCount());;
+        String text = String::number(m_owner->incrementRepaintCount());
 
         CGContextSaveGState(context);
 
@@ -129,7 +129,7 @@ void WebLayer::drawInContext(PlatformGraphicsContext* context)
         font.update(0);
 
         GraphicsContext cg(context);
-        cg.setFillColor(Color::black, DeviceColorSpace);
+        cg.setFillColor(Color::black, ColorSpaceDeviceRGB);
         cg.drawText(font, TextRun(text), IntPoint(aBounds.origin.x + 5, aBounds.origin.y + 17));
 
         CGContextRestoreGState(context);        
diff --git a/WebCore/platform/graphics/win/WebTiledLayer.cpp b/WebCore/platform/graphics/win/WebTiledLayer.cpp
index 01dd6ae..4705033 100644
--- a/WebCore/platform/graphics/win/WebTiledLayer.cpp
+++ b/WebCore/platform/graphics/win/WebTiledLayer.cpp
@@ -201,7 +201,7 @@ void WebTiledLayer::addTile()
     CACFLayerInsertSublayer(m_tileParent.get(), newLayer.get(), sublayers ? CFArrayGetCount(sublayers) : 0);
 
     if (m_owner->showDebugBorders()) {
-        CGColorRef borderColor = createCGColor(Color(128, 0, 128, 180));
+        CGColorRef borderColor = CGColorCreateGenericRGB(0.5, 0, 0.5, 0.7);
         CACFLayerSetBorderColor(newLayer.get(), borderColor);
         CGColorRelease(borderColor);
         CACFLayerSetBorderWidth(newLayer.get(), 2);
diff --git a/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp b/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
index a91b988..a0c10fc 100644
--- a/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
+++ b/WebCore/platform/graphics/wince/GraphicsContextWinCE.cpp
@@ -1,5 +1,6 @@
 /*
  *  Copyright (C) 2007-2009 Torch Mobile Inc.
+ *  Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Library General Public
@@ -24,6 +25,7 @@
 #include "AffineTransform.h"
 #include "CharacterNames.h"
 #include "Font.h"
+#include "GDIExtras.h"
 #include "GlyphBuffer.h"
 #include "Gradient.h"
 #include "GraphicsContextPrivate.h"
@@ -322,8 +324,7 @@ public:
         if (hdc == m_dc)
             return;
 
-#if !defined(NO_ALPHABLEND)
-        if (alphaPaint == AlphaPaintOther) {
+        if (alphaPaint == AlphaPaintOther && hasAlphaBlendSupport()) {
             ASSERT(bmp && bmp->bytes() && bmp->is32bit());
             unsigned* pixels = (unsigned*)bmp->bytes();
             const unsigned* const pixelsEnd = pixels + bmp->bitmapInfo().numPixels();
@@ -332,13 +333,13 @@ public:
                 ++pixels;
             }
         }
-        if (m_opacity < 1. || alphaPaint == AlphaPaintOther) {
+        if ((m_opacity < 1. || alphaPaint == AlphaPaintOther) && hasAlphaBlendSupport()) {
             const BLENDFUNCTION blend = { AC_SRC_OVER, 0
                 , m_opacity >= 1. ? 255 : (BYTE)(m_opacity * 255)
                 , alphaPaint == AlphaPaintNone ? 0 : AC_SRC_ALPHA };
-            AlphaBlend(m_dc, origRect.x(), origRect.y(), origRect.width(), origRect.height(), hdc, 0, 0, bmpRect.right, bmpRect.bottom, blend);
+            bool success = alphaBlendIfSupported(m_dc, origRect.x(), origRect.y(), origRect.width(), origRect.height(), hdc, 0, 0, bmpRect.right, bmpRect.bottom, blend);
+            ASSERT_UNUSED(success, success);
         } else
-#endif
             StretchBlt(m_dc, origRect.x(), origRect.y(), origRect.width(), origRect.height(), hdc, 0, 0, bmpRect.right, bmpRect.bottom, SRCCOPY);
     }
 
@@ -347,7 +348,7 @@ public:
     Vector<GraphicsContextPlatformPrivateData> m_backupData;
 };
 
-static HPEN createPen(const Color& col, double fWidth, StrokeStyle style)
+static PassOwnPtr<HPEN> createPen(const Color& col, double fWidth, StrokeStyle style)
 {
     int width = stableRound(fWidth);
     if (width < 1)
@@ -367,12 +368,12 @@ static HPEN createPen(const Color& col, double fWidth, StrokeStyle style)
             break;
     }
 
-    return CreatePen(penStyle, width, RGB(col.red(), col.green(), col.blue()));
+    return adoptPtr(CreatePen(penStyle, width, RGB(col.red(), col.green(), col.blue())));
 }
 
-static inline HGDIOBJ createBrush(const Color& col)
+static inline PassOwnPtr<HBRUSH> createBrush(const Color& col)
 {
-    return CreateSolidBrush(RGB(col.red(), col.green(), col.blue()));
+    return adoptPtr(CreateSolidBrush(RGB(col.red(), col.green(), col.blue())));
 }
 
 template <typename PixelType, bool Is16bit> static void _rotateBitmap(SharedBitmap* destBmp, const SharedBitmap* sourceBmp, const RotationTransform& transform)
@@ -644,41 +645,33 @@ void GraphicsContext::drawRect(const IntRect& rect)
         return;
     trRect.move(transparentDC.toShift());
 
-    HGDIOBJ brush = 0;
+    OwnPtr<HBRUSH> brush;
     HGDIOBJ oldBrush;
     if (fillColor().alpha()) {
         brush = createBrush(fillColor());
-        oldBrush = SelectObject(dc, brush);
+        oldBrush = SelectObject(dc, brush.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_BRUSH));
+        oldBrush = SelectObject(dc, GetStockObject(NULL_BRUSH));
 
-    HGDIOBJ pen = 0;
+    OwnPtr<HPEN> pen;
     HGDIOBJ oldPen;
     if (strokeStyle() != NoStroke) {
         pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-        oldPen = SelectObject(dc, pen);
+        oldPen = SelectObject(dc, pen.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_PEN));
+        oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
 
-    if (!brush && !pen)
-        return;
-
-    if (trRect.width() <= 0)
-        trRect.setWidth(1);
-    if (trRect.height() <= 0)
-        trRect.setHeight(1);
-
-    Rectangle(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+    if (brush || pen) {
+        if (trRect.width() <= 0)
+            trRect.setWidth(1);
+        if (trRect.height() <= 0)
+            trRect.setHeight(1);
 
-    if (pen) {
-        SelectObject(dc, oldPen);
-        DeleteObject(pen);
+        Rectangle(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
     }
 
-    if (brush) {
-        SelectObject(dc, oldBrush);
-        DeleteObject(brush);
-    }
+    SelectObject(dc, oldPen);
+    SelectObject(dc, oldBrush);
 }
 
 void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
@@ -702,14 +695,13 @@ void GraphicsContext::drawLine(const IntPoint& point1, const IntPoint& point2)
     trPoint1 += transparentDC.toShift();
     trPoint2 += transparentDC.toShift();
 
-    HGDIOBJ pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-    HGDIOBJ oldPen = SelectObject(dc, pen);
+    OwnPtr<HPEN> pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
+    HGDIOBJ oldPen = SelectObject(dc, pen.get());
 
     MoveToEx(dc, trPoint1.x(), trPoint1.y(), 0);
     LineTo(dc, trPoint2.x(), trPoint2.y());
 
     SelectObject(dc, oldPen);
-    DeleteObject(pen);
 }
 
 void GraphicsContext::drawEllipse(const IntRect& rect)
@@ -728,32 +720,27 @@ void GraphicsContext::drawEllipse(const IntRect& rect)
         return;
     trRect.move(transparentDC.toShift());
 
-    HGDIOBJ brush = 0;
+    OwnPtr<HBRUSH> brush;
     HGDIOBJ oldBrush;
     if (fillColor().alpha()) {
         brush = createBrush(fillColor());
-        oldBrush = SelectObject(dc, brush);
+        oldBrush = SelectObject(dc, brush.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_BRUSH));
-    HGDIOBJ pen = 0;
-    HGDIOBJ oldPen;
+        oldBrush = SelectObject(dc, GetStockObject(NULL_BRUSH));
+
+    OwnPtr<HPEN> pen;
+    HGDIOBJ oldPen = 0;
     if (strokeStyle() != NoStroke) {
         pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-        oldPen = SelectObject(dc, pen);
+        oldPen = SelectObject(dc, pen.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_PEN));
-
-    Ellipse(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
+        oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
 
-    if (pen) {
-        SelectObject(dc, oldPen);
-        DeleteObject(pen);
-    }
+    if (brush || pen)
+        Ellipse(dc, trRect.x(), trRect.y(), trRect.right(), trRect.bottom());
 
-    if (brush) {
-        SelectObject(dc, oldBrush);
-        DeleteObject(brush);
-    }
+    SelectObject(dc, oldPen);
+    SelectObject(dc, oldBrush);
 }
 
 static inline bool equalAngle(double a, double b) 
@@ -815,8 +802,8 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         return;
     trRect.move(transparentDC.toShift());
 
-    HGDIOBJ pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-    HGDIOBJ oldPen = SelectObject(dc, pen);
+    OwnPtr<HPEN> pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
+    HGDIOBJ oldPen = SelectObject(dc, pen.get());
 
     double a = trRect.width() * 0.5;
     double b = trRect.height() * 0.5;
@@ -872,7 +859,6 @@ void GraphicsContext::strokeArc(const IntRect& rect, int startAngle, int angleSp
         SelectClipRgn(dc, clipRgn.get());
 
     SelectObject(dc, oldPen);
-    DeleteObject(pen);
 }
 
 void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points, bool shouldAntialias)
@@ -916,36 +902,27 @@ void GraphicsContext::drawConvexPolygon(size_t npoints, const FloatPoint* points
         winPoints[i].y += transparentDC.toShift().height();
     }
 
-    HGDIOBJ brush = 0;
+    OwnPtr<HBRUSH> brush;
     HGDIOBJ oldBrush;
     if (fillColor().alpha()) {
         brush = createBrush(fillColor());
-        oldBrush = SelectObject(dc, brush);
+        oldBrush = SelectObject(dc, brush.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_BRUSH));
+        oldBrush = SelectObject(dc, GetStockObject(NULL_BRUSH));
 
-    HGDIOBJ pen = 0;
+    OwnPtr<HPEN> pen;
     HGDIOBJ oldPen;
     if (strokeStyle() != NoStroke) {
         pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-        oldPen = SelectObject(dc, pen);
+        oldPen = SelectObject(dc, pen.get());
     } else
-        SelectObject(dc, GetStockObject(NULL_PEN));
-
-    if (!brush && !pen)
-        return;
-
-    Polygon(dc, winPoints.data(), npoints);
+        oldPen = SelectObject(dc, GetStockObject(NULL_PEN));
 
-    if (pen) {
-        SelectObject(dc, oldPen);
-        DeleteObject(pen);
-    }
+    if (brush || pen)
+        Polygon(dc, winPoints.data(), npoints);
 
-    if (brush) {
-        SelectObject(dc, oldBrush);
-        DeleteObject(brush);
-    }
+    SelectObject(dc, oldPen);
+    SelectObject(dc, oldBrush);
 }
 
 void GraphicsContext::clipConvexPolygon(size_t numPoints, const FloatPoint* points, bool antialiased)
@@ -1104,7 +1081,7 @@ void GraphicsContext::clearRect(const FloatRect& rect)
         return;
     } 
 
-    fillRect(rect, Color(Color::white), DeviceColorSpace);
+    fillRect(rect, Color(Color::white), ColorSpaceDeviceRGB);
 }
 
 void GraphicsContext::strokeRect(const FloatRect& rect, float width)
@@ -1124,8 +1101,8 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float width)
         return;
     trRect.move(transparentDC.toShift());
 
-    HGDIOBJ pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-    HGDIOBJ oldPen = SelectObject(dc, pen);
+    OwnPtr<HPEN> pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
+    HGDIOBJ oldPen = SelectObject(dc, pen.get());
 
     int right = trRect.right() - 1;
     int bottom = trRect.bottom() - 1;
@@ -1141,7 +1118,6 @@ void GraphicsContext::strokeRect(const FloatRect& rect, float width)
     Polyline(dc, intPoints, 5);
 
     SelectObject(dc, oldPen);
-    DeleteObject(pen);
 }
 
 void GraphicsContext::beginTransparencyLayer(float opacity)
@@ -1286,9 +1262,9 @@ void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& to
 
     RECT rectWin = dstRect;
 
-    HGDIOBJ brush = createBrush(shadowColor);
-    HGDIOBJ oldBrush = SelectObject(dc, brush);
-   
+    OwnPtr<HBRUSH> brush = createBrush(shadowColor);
+    HGDIOBJ oldBrush = SelectObject(dc, brush.get());
+
     SelectObject(dc, GetStockObject(NULL_PEN));
 
     IntPoint centerPoint = rectCenterPoint(rectWin);
@@ -1324,7 +1300,6 @@ void GraphicsContext::fillRoundedRect(const IntRect& fillRect, const IntSize& to
     drawRoundCorner(needsNewClip, clipRect, rectWin, dc, stableRound(newBottomRight.width() * 2), stableRound(newBottomRight.height() * 2));
 
     SelectObject(dc, oldBrush);
-    DeleteObject(brush);
 }
 
 
@@ -1382,8 +1357,9 @@ void GraphicsContext::fillPath()
     if (!m_data->m_dc)
         return;
 
+    OwnPtr<HBRUSH> brush = createBrush(c);
+
     if (m_data->m_opacity < 1.0f || m_data->hasAlpha()) {
-        HGDIOBJ brush = createBrush(c);
         for (Vector<Path>::const_iterator i = m_data->m_paths.begin(); i != m_data->m_paths.end(); ++i) {
             IntRect trRect = enclosingIntRect(m_data->mapRect(i->boundingRect()));
             trRect.inflate(1);
@@ -1396,19 +1372,16 @@ void GraphicsContext::fillPath()
             tr.translate(transparentDC.toShift().width(), transparentDC.toShift().height());
 
             SelectObject(dc, GetStockObject(NULL_PEN));
-            HGDIOBJ oldBrush = SelectObject(dc, brush);
+            HGDIOBJ oldBrush = SelectObject(dc, brush.get());
             i->platformPath()->fillPath(dc, &tr);
             SelectObject(dc, oldBrush);
         }
-        DeleteObject(brush);
     } else {
         SelectObject(m_data->m_dc, GetStockObject(NULL_PEN));
-        HGDIOBJ brush = createBrush(c);
-        HGDIOBJ oldBrush = SelectObject(m_data->m_dc, brush);
+        HGDIOBJ oldBrush = SelectObject(m_data->m_dc, brush.get());
         for (Vector<Path>::const_iterator i = m_data->m_paths.begin(); i != m_data->m_paths.end(); ++i)
             i->platformPath()->fillPath(m_data->m_dc, &m_data->m_transform);
         SelectObject(m_data->m_dc, oldBrush);
-        DeleteObject(brush);
     }
 }
 
@@ -1422,8 +1395,9 @@ void GraphicsContext::strokePath()
     if (!m_data->m_dc)
         return;
 
+    OwnPtr<HPEN> pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
+
     if (m_data->m_opacity < 1.0f || m_data->hasAlpha()) {
-        HGDIOBJ pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
         for (Vector<Path>::const_iterator i = m_data->m_paths.begin(); i != m_data->m_paths.end(); ++i) {
             IntRect trRect = enclosingIntRect(m_data->mapRect(i->boundingRect()));
             trRect.inflate(1);
@@ -1436,19 +1410,16 @@ void GraphicsContext::strokePath()
             tr.translate(transparentDC.toShift().width(), transparentDC.toShift().height());
 
             SelectObject(dc, GetStockObject(NULL_BRUSH));
-            HGDIOBJ oldPen = SelectObject(dc, pen);
+            HGDIOBJ oldPen = SelectObject(dc, pen.get());
             i->platformPath()->strokePath(dc, &tr);
             SelectObject(dc, oldPen);
         }
-        DeleteObject(pen);
     } else {
         SelectObject(m_data->m_dc, GetStockObject(NULL_BRUSH));
-        HGDIOBJ pen = createPen(strokeColor(), strokeThickness(), strokeStyle());
-        HGDIOBJ oldPen = SelectObject(m_data->m_dc, pen);
+        HGDIOBJ oldPen = SelectObject(m_data->m_dc, pen.get());
         for (Vector<Path>::const_iterator i = m_data->m_paths.begin(); i != m_data->m_paths.end(); ++i)
             i->platformPath()->strokePath(m_data->m_dc, &m_data->m_transform);
         SelectObject(m_data->m_dc, oldPen);
-        DeleteObject(pen);
     }
 }
 
@@ -1465,7 +1436,7 @@ void GraphicsContext::fillRect(const FloatRect& r, const Gradient* gradient)
     if (numStops == 1) {
         const Gradient::ColorStop& stop = stops.first();
         Color color(stop.red, stop.green, stop.blue, stop.alpha);
-        fillRect(r, color, DeviceColorSpace);
+        fillRect(r, color, ColorSpaceDeviceRGB);
         return;
     } 
     
@@ -1555,7 +1526,7 @@ void GraphicsContext::fillRect(const FloatRect& rect)
     if (m_common->state.fillGradient)
         fillRect(rect, m_common->state.fillGradient.get());
     else
-        fillRect(rect, fillColor(), DeviceColorSpace);
+        fillRect(rect, fillColor(), ColorSpaceDeviceRGB);
 
     restorePlatformState();
 }
diff --git a/WebCore/platform/graphics/wince/ImageWinCE.cpp b/WebCore/platform/graphics/wince/ImageWinCE.cpp
index 61ec954..53b9b68 100644
--- a/WebCore/platform/graphics/wince/ImageWinCE.cpp
+++ b/WebCore/platform/graphics/wince/ImageWinCE.cpp
@@ -82,9 +82,9 @@ bool BitmapImage::getHBITMAPOfSize(HBITMAP bmp, LPSIZE size)
 
         IntSize imageSize = BitmapImage::size();
         if (size)
-            drawFrameMatchingSourceSize(&gc, FloatRect(0, 0, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), DeviceColorSpace, CompositeCopy);
+            drawFrameMatchingSourceSize(&gc, FloatRect(0, 0, bmpInfo.bmWidth, bmpInfo.bmHeight), IntSize(*size), ColorSpaceDeviceRGB, CompositeCopy);
         else
-            draw(&gc, FloatRect(0, 0, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0, 0, imageSize.width(), imageSize.height()), DeviceColorSpace, CompositeCopy);
+            draw(&gc, FloatRect(0, 0, bmpInfo.bmWidth, bmpInfo.bmHeight), FloatRect(0, 0, imageSize.width(), imageSize.height()), ColorSpaceDeviceRGB, CompositeCopy);
     }
 
     SelectObject(hdc.get(), hOldBmp);
diff --git a/WebCore/platform/graphics/wince/PathWinCE.cpp b/WebCore/platform/graphics/wince/PathWinCE.cpp
index 4f0195c..fa4c8fb 100644
--- a/WebCore/platform/graphics/wince/PathWinCE.cpp
+++ b/WebCore/platform/graphics/wince/PathWinCE.cpp
@@ -123,11 +123,6 @@ bool Path::isEmpty() const
     return m_path->isEmpty();
 }
 
-String Path::debugString() const
-{
-    return m_path->debugString();
-}
-
 void Path::apply(void* info, PathApplierFunction function) const
 {
     m_path->apply(info, function);
diff --git a/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp b/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
index 80e01a9..8534f89 100644
--- a/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
+++ b/WebCore/platform/graphics/wince/PlatformPathWinCE.cpp
@@ -754,43 +754,6 @@ void PlatformPath::addEllipse(const FloatRect& r)
     addEllipse(r.location() + radius, radius.width(), radius.height(), 0, 0, true);
 }
 
-String PlatformPath::debugString() const
-{
-    String ret;
-    for (PlatformPathElements::const_iterator i(m_elements.begin()); i != m_elements.end(); ++i) {
-        switch (i->platformType()) {
-        case PlatformPathElement::PathMoveTo:
-        case PlatformPathElement::PathLineTo:
-            ret += String::format("M %f %f\n", i->pointAt(0).m_x, i->pointAt(0).m_y);
-            break;
-        case PlatformPathElement::PathArcTo:
-            ret += String::format("A %f %f %f %f %f %f %c\n"
-                , i->arcTo().m_end.m_x, i->arcTo().m_end.m_y
-                , i->arcTo().m_center.m_x, i->arcTo().m_center.m_y
-                , i->arcTo().m_radius.m_x, i->arcTo().m_radius.m_y
-                , i->arcTo().m_clockwise? 'Y' : 'N');
-            break;
-        case PlatformPathElement::PathQuadCurveTo:
-            ret += String::format("Q %f %f %f %f\n"
-                , i->pointAt(0).m_x, i->pointAt(0).m_y
-                , i->pointAt(1).m_x, i->pointAt(1).m_y);
-            break;
-        case PlatformPathElement::PathBezierCurveTo:
-            ret += String::format("B %f %f %f %f %f %f\n"
-                , i->pointAt(0).m_x, i->pointAt(0).m_y
-                , i->pointAt(1).m_x, i->pointAt(1).m_y
-                , i->pointAt(2).m_x, i->pointAt(2).m_y);
-            break;
-        default:
-            ASSERT(i->platformType() == PlatformPathElement::PathCloseSubpath);
-            ret += "S\n";
-            break;
-        }
-    }
-
-    return ret;
-}
-
 void PlatformPath::apply(void* info, PathApplierFunction function) const
 {
     PathElement pelement;
diff --git a/WebCore/platform/graphics/wince/PlatformPathWinCE.h b/WebCore/platform/graphics/wince/PlatformPathWinCE.h
index 3414b04..4c86fc3 100644
--- a/WebCore/platform/graphics/wince/PlatformPathWinCE.h
+++ b/WebCore/platform/graphics/wince/PlatformPathWinCE.h
@@ -164,7 +164,6 @@ namespace WebCore {
         void addEllipse(const FloatPoint& p, float a, float b, float sar, float ear, bool anticlockwise);
         void addRect(const FloatRect& r);
         void addEllipse(const FloatRect& r);
-        String debugString() const;
         void apply(void* info, PathApplierFunction function) const;
 
     private:
diff --git a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
index a39404a..30daa67 100644
--- a/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
+++ b/WebCore/platform/graphics/wx/GraphicsContextWx.cpp
@@ -120,8 +120,8 @@ GraphicsContext::GraphicsContext(PlatformGraphicsContext* context)
     setPaintingDisabled(!context);
     if (context) {
         // Make sure the context starts in sync with our state.
-        setPlatformFillColor(fillColor(), DeviceColorSpace);
-        setPlatformStrokeColor(strokeColor(), DeviceColorSpace);
+        setPlatformFillColor(fillColor(), ColorSpaceDeviceRGB);
+        setPlatformStrokeColor(strokeColor(), ColorSpaceDeviceRGB);
     }
 #if USE(WXGC)
     m_data->context = (wxGCDC*)context;
diff --git a/WebCore/platform/graphics/wx/PathWx.cpp b/WebCore/platform/graphics/wx/PathWx.cpp
index 3006e27..f5355f2 100644
--- a/WebCore/platform/graphics/wx/PathWx.cpp
+++ b/WebCore/platform/graphics/wx/PathWx.cpp
@@ -117,12 +117,6 @@ bool Path::strokeContains(StrokeStyleApplier*, const FloatPoint&) const
     return false;
 }
 
-String Path::debugString() const
-{
-    notImplemented();
-    return String();
-}
-
 Path& Path::operator=(const Path& path)
 { 
     *m_path = *path.platformPath();
diff --git a/WebCore/platform/gtk/ClipboardGtk.cpp b/WebCore/platform/gtk/ClipboardGtk.cpp
index e7ee432..49bcb7d 100644
--- a/WebCore/platform/gtk/ClipboardGtk.cpp
+++ b/WebCore/platform/gtk/ClipboardGtk.cpp
@@ -139,23 +139,13 @@ void ClipboardGtk::clearAllData()
         m_helper->writeClipboardContents(m_clipboard);
 }
 
-static String joinURIList(Vector<KURL> uriList)
-{
-    if (uriList.isEmpty())
-        return String();
-
-    String joined(uriList[0].string());
-    for (size_t i = 1; i < uriList.size(); i++) {
-        joined.append("\r\n");
-        joined.append(uriList[i].string());
-    }
-
-    return joined;
-}
-
 String ClipboardGtk::getData(const String& typeString, bool& success) const
 {
-    success = false; // Pessimism.
+    success = true; // According to http://www.whatwg.org/specs/web-apps/current-work/multipage/dnd.html
+    // "The getData(format) method must return the data that is associated with the type format converted
+    // to ASCII lowercase, if any, and must return the empty string otherwise." Since success == false 
+    // results in an 'undefined' return value, we always want to return success == true. This parameter
+    // should eventually be removed.
     if (policy() != ClipboardReadable || !m_dataObject)
         return String();
 
@@ -163,33 +153,14 @@ String ClipboardGtk::getData(const String& typeString, bool& success) const
         m_helper->getClipboardContents(m_clipboard);
 
     ClipboardDataType type = dataObjectTypeFromHTMLClipboardType(typeString);
-    if (type == ClipboardDataTypeURIList) {
-        if (!m_dataObject->hasURIList())
-            return String();
-        success = true;
-        return joinURIList(m_dataObject->uriList());
-    }
-
-    if (type == ClipboardDataTypeURL) {
-        if (!m_dataObject->hasURL())
-            return String();
-        success = true;
+    if (type == ClipboardDataTypeURIList)
+        return m_dataObject->uriList();
+    if (type == ClipboardDataTypeURL)
         return m_dataObject->url();
-    }
-
-    if (type == ClipboardDataTypeMarkup) {
-        if (!m_dataObject->hasMarkup())
-            return String();
-        success = true;
+    if (type == ClipboardDataTypeMarkup)
         return m_dataObject->markup();
-    }
-
-    if (type == ClipboardDataTypeText) {
-        if (!m_dataObject->hasText())
-                return String();
-        success = true;
+    if (type == ClipboardDataTypeText)
         return m_dataObject->text();
-    }
 
     return String();
 }
@@ -202,18 +173,8 @@ bool ClipboardGtk::setData(const String& typeString, const String& data)
     bool success = false;
     ClipboardDataType type = dataObjectTypeFromHTMLClipboardType(typeString);
     if (type == ClipboardDataTypeURIList || type == ClipboardDataTypeURL) {
-        Vector<KURL> uriList;
-        gchar** uris = g_uri_list_extract_uris(data.utf8().data());
-        if (uris) {
-            gchar** currentURI = uris;
-            while (*currentURI) {
-                uriList.append(KURL(KURL(), *currentURI));
-                currentURI++;
-            }
-            g_strfreev(uris);
-            m_dataObject->setURIList(uriList);
-            success = true;
-        }
+        m_dataObject->setURIList(data);
+        success = true;
     } else if (type == ClipboardDataTypeMarkup) {
         m_dataObject->setMarkup(data);
         success = true;
@@ -248,9 +209,11 @@ HashSet<String> ClipboardGtk::types() const
     if (m_dataObject->hasURIList()) {
         types.add("text/uri-list");
         types.add("URL");
-        types.add("Files");
     }
 
+    if (m_dataObject->hasFilenames())
+        types.add("Files");
+
     return types;
 }
 
@@ -263,11 +226,9 @@ PassRefPtr<FileList> ClipboardGtk::files() const
         m_helper->getClipboardContents(m_clipboard);
 
     RefPtr<FileList> fileList = FileList::create();
-    Vector<String> fileVector(m_dataObject->files());
-
-    for (size_t i = 0; i < fileVector.size(); i++)
-        fileList->append(File::create(fileVector[i]));
-
+    const Vector<String>& filenames = m_dataObject->filenames();
+    for (size_t i = 0; i < filenames.size(); i++)
+        fileList->append(File::create(filenames[i]));
     return fileList.release();
 }
 
diff --git a/WebCore/platform/gtk/CursorGtk.cpp b/WebCore/platform/gtk/CursorGtk.cpp
index d1f1293..9971bfb 100644
--- a/WebCore/platform/gtk/CursorGtk.cpp
+++ b/WebCore/platform/gtk/CursorGtk.cpp
@@ -28,28 +28,17 @@
 
 #include "config.h"
 #include "CursorGtk.h"
+#include "GtkVersioning.h"
 
 #include "Image.h"
 #include "IntPoint.h"
+#include "PlatformRefPtrCairo.h"
 #include <gdk/gdk.h>
 #include <gtk/gtk.h>
 #include <wtf/Assertions.h>
 
 namespace WebCore {
 
-static GdkPixmap* createPixmapFromBits(const unsigned char* bits, const IntSize& size)
-{
-    cairo_surface_t* dataSurface = cairo_image_surface_create_for_data(const_cast<unsigned char*>(bits), CAIRO_FORMAT_A1, size.width(), size.height(), size.width() / 8);
-    GdkPixmap* pixmap = gdk_pixmap_new(0, size.width(), size.height(), 1);
-    cairo_t* cr = gdk_cairo_create(pixmap);
-    cairo_set_source_surface(cr, dataSurface, 0, 0);
-    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
-    cairo_paint(cr);
-    cairo_destroy(cr);
-    cairo_surface_destroy(dataSurface);
-    return pixmap;
-}
-
 static PlatformRefPtr<GdkCursor> createNamedCursor(CustomCursorType cursorType)
 {
     CustomCursor cursor = CustomCursors[cursorType];
@@ -57,12 +46,17 @@ static PlatformRefPtr<GdkCursor> createNamedCursor(CustomCursorType cursorType)
     if (c)
         return c;
 
-    const GdkColor fg = { 0, 0, 0, 0 };
-    const GdkColor bg = { 65535, 65535, 65535, 65535 };
     IntSize cursorSize = IntSize(32, 32);
-    PlatformRefPtr<GdkPixmap> source = adoptPlatformRef(createPixmapFromBits(cursor.bits, cursorSize));
-    PlatformRefPtr<GdkPixmap> mask = adoptPlatformRef(createPixmapFromBits(cursor.mask_bits, cursorSize));
-    return adoptPlatformRef(gdk_cursor_new_from_pixmap(source.get(), mask.get(), &fg, &bg, cursor.hot_x, cursor.hot_y));
+    PlatformRefPtr<cairo_surface_t> source = adoptPlatformRef(cairo_image_surface_create_for_data(const_cast<unsigned char*>(cursor.bits), CAIRO_FORMAT_A1, 32, 32, 4));
+    PlatformRefPtr<cairo_surface_t> mask = adoptPlatformRef(cairo_image_surface_create_for_data(const_cast<unsigned char*>(cursor.mask_bits), CAIRO_FORMAT_A1, 32, 32, 4));
+    PlatformRefPtr<cairo_surface_t> surface = adoptPlatformRef(cairo_image_surface_create(CAIRO_FORMAT_A1, 32, 32));
+    PlatformRefPtr<cairo_t> cr = adoptPlatformRef(cairo_create(surface.get()));
+
+    cairo_set_source_surface(cr.get(), source.get(), cursor.hot_x, cursor.hot_y);
+    cairo_mask_surface(cr.get(), mask.get(), cursor.hot_x, cursor.hot_y);
+
+    PlatformRefPtr<GdkPixbuf> pixbuf = adoptPlatformRef(gdk_pixbuf_get_from_surface(surface.get(), 0, 0, 32, 32));
+    return adoptPlatformRef(gdk_cursor_new_from_pixbuf(gdk_display_get_default(), pixbuf.get(), 0, 0));
 }
 
 static PlatformRefPtr<GdkCursor> createCustomCursor(Image* image, const IntPoint& hotSpot)
diff --git a/WebCore/platform/gtk/DataObjectGtk.cpp b/WebCore/platform/gtk/DataObjectGtk.cpp
index db13345..05a2da9 100644
--- a/WebCore/platform/gtk/DataObjectGtk.cpp
+++ b/WebCore/platform/gtk/DataObjectGtk.cpp
@@ -59,8 +59,51 @@ void DataObjectGtk::setMarkup(const String& newMarkup)
     m_markup = newMarkup;
 }
 
+void DataObjectGtk::setURIList(const String& uriListString)
+{
+    m_uriList = uriListString;
+
+    // This code is originally from: platform/chromium/ChromiumDataObject.cpp.
+    // FIXME: We should make this code cross-platform eventually.
+
+    // Line separator is \r\n per RFC 2483 - however, for compatibility
+    // reasons we also allow just \n here.
+    Vector<String> uriList;
+    uriListString.split('\n', uriList);
+
+    // Process the input and copy the first valid URL into the url member.
+    // In case no URLs can be found, subsequent calls to getData("URL")
+    // will get an empty string. This is in line with the HTML5 spec (see
+    // "The DragEvent and DataTransfer interfaces"). Also extract all filenames
+    // from the URI list.
+    bool setURL = false;
+    for (size_t i = 0; i < uriList.size(); ++i) {
+        String& line = uriList[i];
+        line = line.stripWhiteSpace();
+        if (line.isEmpty())
+            continue;
+        if (line[0] == '#')
+            continue;
+
+        KURL url = KURL(KURL(), line);
+        if (url.isValid()) {
+            if (!setURL) {
+                m_url = url;
+                setURL = true;
+            }
+
+            GOwnPtr<GError> error;
+            GOwnPtr<gchar> filename(g_filename_from_uri(line.utf8().data(), 0, &error.outPtr()));
+            if (!error && filename)
+                m_filenames.append(String::fromUTF8(filename.get()));
+        }
+    }
+}
+
 void DataObjectGtk::setURL(const KURL& url, const String& label)
 {
+    m_url = url;
+    m_uriList = url;
     setText(url.string());
 
     String actualLabel(label);
@@ -75,10 +118,6 @@ void DataObjectGtk::setURL(const KURL& url, const String& label)
     append(markup, String::fromUTF8(escaped.get()));
     append(markup, "</a>");
     setMarkup(String::adopt(markup));
-
-    Vector<KURL> uriList;
-    uriList.append(url);
-    setURIList(uriList);
 }
 
 void DataObjectGtk::clearText()
@@ -93,34 +132,6 @@ void DataObjectGtk::clearMarkup()
     m_markup = "";
 }
 
-Vector<String> DataObjectGtk::files()
-{
-    Vector<KURL> uris(uriList());
-    Vector<String> files;
-
-    for (size_t i = 0; i < uris.size(); i++) {
-        KURL& uri = uris[0];
-        if (!uri.isValid() || !uri.isLocalFile())
-            continue;
-
-        files.append(uri.string());
-    }
-
-    return files;
-}
-
-String DataObjectGtk::url()
-{
-    Vector<KURL> uris(uriList());
-    for (size_t i = 0; i < uris.size(); i++) {
-        KURL& uri = uris[0];
-        if (uri.isValid())
-            return uri;
-    }
-
-    return String();
-}
-
 String DataObjectGtk::urlLabel()
 {
     if (hasText())
@@ -132,18 +143,19 @@ String DataObjectGtk::urlLabel()
     return String();
 }
 
-bool DataObjectGtk::hasURL()
-{
-    return !url().isEmpty();
-}
-
 void DataObjectGtk::clear()
 {
     m_text = "";
     m_markup = "";
-    m_uriList.clear();
+    m_uriList = "";
+    m_url = KURL();
     m_image = 0;
     m_range = 0;
+
+    // We do not clear filenames. According to the spec: "The clearData() method
+    // does not affect whether any files were included in the drag, so the types
+    // attribute's list might still not be empty after calling clearData() (it would 
+    // still contain the "Files" string if any files were included in the drag)."
 }
 
 DataObjectGtk* DataObjectGtk::forClipboard(GtkClipboard* clipboard)
diff --git a/WebCore/platform/gtk/DataObjectGtk.h b/WebCore/platform/gtk/DataObjectGtk.h
index e6095da..f6b13fd 100644
--- a/WebCore/platform/gtk/DataObjectGtk.h
+++ b/WebCore/platform/gtk/DataObjectGtk.h
@@ -36,28 +36,30 @@ public:
         return adoptRef(new DataObjectGtk());
     }
 
-    Vector<KURL> uriList() { return m_uriList; }
+    const KURL& url() { return m_url; }
+    const String& uriList() { return m_uriList; }
+    const Vector<String>& filenames() { return m_filenames; }
     GdkPixbuf* image() { return m_image.get(); }
     void setRange(PassRefPtr<Range> newRange) { m_range = newRange; }
-    void setURIList(const Vector<KURL>& newURIList) {  m_uriList = newURIList; }
     void setImage(GdkPixbuf* newImage) { m_image = newImage; }
     void setDragContext(GdkDragContext* newDragContext) { m_dragContext = newDragContext; }
     void setURL(const KURL&, const String&);
     bool hasText() { return m_range || !m_text.isEmpty(); }
     bool hasMarkup() { return m_range || !m_markup.isEmpty(); }
     bool hasURIList() { return !m_uriList.isEmpty(); }
+    bool hasURL() { return !m_url.isEmpty() && m_url.isValid(); }
+    bool hasFilenames() { return !m_filenames.isEmpty(); }
     bool hasImage() { return m_image; }
-    void clearURIList() { m_uriList.clear(); }
+    void clearURIList() { m_uriList = ""; }
+    void clearURL() { m_url = KURL(); }
     void clearImage() { m_image = 0; }
     GdkDragContext* dragContext() { return m_dragContext.get(); }
 
     String text();
     String markup();
-    Vector<String> files();
-    void setText(const String& newText);
-    void setMarkup(const String& newMarkup);
-    bool hasURL();
-    String url();
+    void setText(const String&);
+    void setMarkup(const String&);
+    void setURIList(const String&);
     String urlLabel();
     void clear();
     void clearText();
@@ -68,7 +70,9 @@ public:
 private:
     String m_text;
     String m_markup;
-    Vector<KURL> m_uriList;
+    KURL m_url;
+    String m_uriList;
+    Vector<String> m_filenames;
     PlatformRefPtr<GdkPixbuf> m_image;
     PlatformRefPtr<GdkDragContext> m_dragContext;
     RefPtr<Range> m_range;
diff --git a/WebCore/platform/gtk/DragDataGtk.cpp b/WebCore/platform/gtk/DragDataGtk.cpp
index 69966aa..42ddb16 100644
--- a/WebCore/platform/gtk/DragDataGtk.cpp
+++ b/WebCore/platform/gtk/DragDataGtk.cpp
@@ -37,14 +37,12 @@ bool DragData::containsColor() const
 
 bool DragData::containsFiles() const
 {
-    return !m_platformDragData->files().isEmpty();
+    return m_platformDragData->hasFilenames();
 }
 
 void DragData::asFilenames(Vector<String>& result) const
 {
-    Vector<String> files(m_platformDragData->files());
-    for (size_t i = 0; i < files.size(); i++)
-        result.append(files[i]);
+    result = m_platformDragData->filenames();
 }
 
 bool DragData::containsPlainText() const
diff --git a/WebCore/platform/gtk/FileChooserGtk.cpp b/WebCore/platform/gtk/FileChooserGtk.cpp
index 4600215..54763d4 100644
--- a/WebCore/platform/gtk/FileChooserGtk.cpp
+++ b/WebCore/platform/gtk/FileChooserGtk.cpp
@@ -34,7 +34,6 @@
 #include <wtf/text/CString.h>
 
 #include <glib.h>
-#include <gtk/gtk.h>
 
 namespace WebCore {
 
diff --git a/WebCore/platform/gtk/GtkVersioning.c b/WebCore/platform/gtk/GtkVersioning.c
index f5466be..071c5e5 100644
--- a/WebCore/platform/gtk/GtkVersioning.c
+++ b/WebCore/platform/gtk/GtkVersioning.c
@@ -52,7 +52,7 @@ void gtk_adjustment_configure(GtkAdjustment* adjustment, gdouble value, gdouble
 GdkDevice *getDefaultGDKPointerDevice(GdkWindow* window)
 {
 #ifndef GTK_API_VERSION_2
-    GdkDeviceManager *manager =  gdk_display_get_device_manager(gdk_drawable_get_display(window));
+    GdkDeviceManager *manager =  gdk_display_get_device_manager(gdk_window_get_display(window));
     return gdk_device_manager_get_client_pointer(manager);
 #else
     return gdk_device_get_core_pointer();
@@ -98,3 +98,166 @@ const gchar* gtk_menu_item_get_label(GtkMenuItem* menuItem)
     return 0;
 }
 #endif // GTK_CHECK_VERSION(2, 16, 0)
+
+#ifdef GTK_API_VERSION_2
+static cairo_format_t
+gdk_cairo_format_for_content(cairo_content_t content)
+{
+    switch (content) {
+    case CAIRO_CONTENT_COLOR:
+        return CAIRO_FORMAT_RGB24;
+    case CAIRO_CONTENT_ALPHA:
+        return CAIRO_FORMAT_A8;
+    case CAIRO_CONTENT_COLOR_ALPHA:
+    default:
+        return CAIRO_FORMAT_ARGB32;
+    }
+}
+
+static cairo_surface_t*
+gdk_cairo_surface_coerce_to_image(cairo_surface_t* surface,
+                                  cairo_content_t content,
+                                  int width,
+                                  int height)
+{
+    cairo_surface_t * copy;
+    cairo_t * cr;
+
+    if (cairo_surface_get_type(surface) == CAIRO_SURFACE_TYPE_IMAGE
+        && cairo_surface_get_content(surface) == content
+        && cairo_image_surface_get_width(surface) >= width
+        && cairo_image_surface_get_height(surface) >= height)
+        return cairo_surface_reference(surface);
+
+    copy = cairo_image_surface_create(gdk_cairo_format_for_content(content),
+                                      width,
+                                      height);
+
+    cr = cairo_create(copy);
+    cairo_set_operator(cr, CAIRO_OPERATOR_SOURCE);
+    cairo_set_source_surface(cr, surface, 0, 0);
+    cairo_paint(cr);
+    cairo_destroy(cr);
+
+    return copy;
+}
+
+static void
+convert_alpha(guchar * destData, int destStride,
+              guchar * srcData, int srcStride,
+              int srcX, int srcY, int width, int height)
+{
+    int x, y;
+
+    srcData += srcStride * srcY + srcY * 4;
+
+    for (y = 0; y < height; y++) {
+        guint32 * src = (guint32 *) srcData;
+
+        for (x = 0; x < width; x++) {
+            guint alpha = src[x] >> 24;
+
+            if (!alpha) {
+                destData[x * 4 + 0] = 0;
+                destData[x * 4 + 1] = 0;
+                destData[x * 4 + 2] = 0;
+            } else {
+                destData[x * 4 + 0] = (((src[x] & 0xff0000) >> 16) * 255 + alpha / 2) / alpha;
+                destData[x * 4 + 1] = (((src[x] & 0x00ff00) >>  8) * 255 + alpha / 2) / alpha;
+                destData[x * 4 + 2] = (((src[x] & 0x0000ff) >>  0) * 255 + alpha / 2) / alpha;
+            }
+            destData[x * 4 + 3] = alpha;
+        }
+
+        srcData += srcStride;
+        destData += destStride;
+    }
+}
+
+static void
+convert_no_alpha(guchar * destData, int destStride, guchar * srcData,
+                 int srcStride, int srcX, int srcY,
+                 int width, int height)
+{
+    int x, y;
+
+    srcData += srcStride * srcY + srcX * 4;
+
+    for (y = 0; y < height; y++) {
+        guint32 * src = (guint32 *) srcData;
+
+        for (x = 0; x < width; x++) {
+            destData[x * 3 + 0] = src[x] >> 16;
+            destData[x * 3 + 1] = src[x] >>  8;
+            destData[x * 3 + 2] = src[x];
+        }
+
+        srcData += srcStride;
+        destData += destStride;
+    }
+}
+
+/**
+ * gdk_pixbuf_get_from_surface:
+ * @surface: surface to copy from
+ * @src_x: Source X coordinate within @surface
+ * @src_y: Source Y coordinate within @surface
+ * @width: Width in pixels of region to get
+ * @height: Height in pixels of region to get
+ *
+ * Transfers image data from a #cairo_surface_t and converts it to an RGB(A)
+ * representation inside a #GdkPixbuf. This allows you to efficiently read
+ * individual pixels from cairo surfaces. For #GdkWindows, use
+ * gdk_pixbuf_get_from_window() instead.
+ *
+ * This function will create an RGB pixbuf with 8 bits per channel. The pixbuf
+ * will contain an alpha channel if the @surface contains one.
+ *
+ * Return value: (transfer full): A newly-created pixbuf with a reference count
+ * of 1, or %NULL on error
+ **/
+GdkPixbuf*
+gdk_pixbuf_get_from_surface(cairo_surface_t * surface,
+                            int srcX, int srcY,
+                            int width, int height)
+{
+    cairo_content_t content;
+    GdkPixbuf * dest;
+
+    /* General sanity checks */
+    g_return_val_if_fail(!surface, NULL);
+    g_return_val_if_fail(srcX >= 0 && srcY >= 0, NULL);
+    g_return_val_if_fail(width > 0 && height > 0, NULL);
+
+    content = cairo_surface_get_content(surface) | CAIRO_CONTENT_COLOR;
+    dest = gdk_pixbuf_new(GDK_COLORSPACE_RGB,
+                          !!(content & CAIRO_CONTENT_ALPHA),
+                          8,
+                          width, height);
+
+    surface = gdk_cairo_surface_coerce_to_image(surface, content, srcX + width, srcY + height);
+    cairo_surface_flush(surface);
+    if (cairo_surface_status(surface) || !dest) {
+        cairo_surface_destroy(surface);
+        return NULL;
+    }
+
+    if (gdk_pixbuf_get_has_alpha(dest))
+        convert_alpha(gdk_pixbuf_get_pixels(dest),
+                       gdk_pixbuf_get_rowstride(dest),
+                       cairo_image_surface_get_data(surface),
+                       cairo_image_surface_get_stride(surface),
+                       srcX, srcY,
+                       width, height);
+    else
+        convert_no_alpha(gdk_pixbuf_get_pixels(dest),
+                          gdk_pixbuf_get_rowstride(dest),
+                          cairo_image_surface_get_data(surface),
+                          cairo_image_surface_get_stride(surface),
+                          srcX, srcY,
+                          width, height);
+
+    cairo_surface_destroy(surface);
+    return dest;
+}
+#endif // GTK_API_VERSION_2
diff --git a/WebCore/platform/gtk/GtkVersioning.h b/WebCore/platform/gtk/GtkVersioning.h
index a874e9e..b40e497 100644
--- a/WebCore/platform/gtk/GtkVersioning.h
+++ b/WebCore/platform/gtk/GtkVersioning.h
@@ -32,8 +32,18 @@ G_BEGIN_DECLS
 // Macros to avoid deprecation checking churn
 #ifndef GTK_API_VERSION_2
 #define GDK_DISPLAY() (GDK_DISPLAY_XDISPLAY(gdk_display_get_default()))
+#else
+GdkPixbuf* gdk_pixbuf_get_from_surface(cairo_surface_t* surface, int srcX, int srcY,
+                                       int width, int height);
 #endif
 
+#if !GTK_CHECK_VERSION(2, 24, 0)
+#define gdk_window_get_display(window) gdk_drawable_get_display(window)
+#ifdef GDK_DISABLE_DEPRECATED
+#define gdk_window_get_visual gdk_drawable_get_visual
+#endif
+#endif // GTK_CHECK_VERSION(2, 24, 0)
+
 #if !GTK_CHECK_VERSION(2, 21, 2)
 #define gdk_visual_get_depth(visual) (visual)->depth
 #define gdk_visual_get_bits_per_rgb(visual) (visual)->bits_per_rgb
diff --git a/WebCore/platform/gtk/Language.cpp b/WebCore/platform/gtk/LanguageGtk.cpp
index f1d5750..7d7a66d 100644
--- a/WebCore/platform/gtk/Language.cpp
+++ b/WebCore/platform/gtk/LanguageGtk.cpp
@@ -24,16 +24,15 @@
 #include "PlatformString.h"
 #include <wtf/text/CString.h>
 
-#include <gtk/gtk.h>
+#include <glib.h>
 #include <locale.h>
-#include <pango/pango.h>
 
 namespace WebCore {
 
 // Using pango_language_get_default() here is not an option, because
 // it doesn't support changing the locale in runtime, so it returns
 // always the same value.
-String defaultLanguage()
+String platformDefaultLanguage()
 {
     char* localeDefault = setlocale(LC_CTYPE, NULL);
 
diff --git a/WebCore/platform/gtk/PasteboardHelper.cpp b/WebCore/platform/gtk/PasteboardHelper.cpp
index 95df25f..9f75728 100644
--- a/WebCore/platform/gtk/PasteboardHelper.cpp
+++ b/WebCore/platform/gtk/PasteboardHelper.cpp
@@ -92,17 +92,6 @@ GtkTargetList* PasteboardHelper::targetList() const
     return m_targetList;
 }
 
-static Vector<KURL> urisToKURLVector(gchar** uris)
-{
-    ASSERT(uris);
-
-    Vector<KURL> uriList;
-    for (int i = 0; *(uris + i); i++)
-        uriList.append(KURL(KURL(), *(uris + i)));
-
-    return uriList;
-}
-
 static String selectionDataToUTF8String(GtkSelectionData* data)
 {
     // g_strndup guards against selection data that is not null-terminated.
@@ -130,11 +119,7 @@ void PasteboardHelper::getClipboardContents(GtkClipboard* clipboard)
 
     if (gtk_clipboard_wait_is_target_available(clipboard, uriListAtom)) {
         if (GtkSelectionData* data = gtk_clipboard_wait_for_contents(clipboard, uriListAtom)) {
-            gchar** uris = gtk_selection_data_get_uris(data);
-            if (uris) {
-                dataObject->setURIList(urisToKURLVector(uris));
-                g_strfreev(uris);
-            }
+            dataObject->setURIList(selectionDataToUTF8String(data));
             gtk_selection_data_free(data);
         }
     }
@@ -151,13 +136,9 @@ void PasteboardHelper::fillSelectionData(GtkSelectionData* selectionData, guint
             reinterpret_cast<const guchar*>(markup.get()), strlen(markup.get()) + 1);
 
     } else if (info == getIdForTargetType(TargetTypeURIList)) {
-        Vector<KURL> uriList(dataObject->uriList());
-        gchar** uris = g_new0(gchar*, uriList.size() + 1);
-        for (size_t i = 0; i < uriList.size(); i++)
-            uris[i] = g_strdup(uriList[i].string().utf8().data());
-
-        gtk_selection_data_set_uris(selectionData, uris);
-        g_strfreev(uris);
+        CString uriList = dataObject->uriList().utf8();
+        gtk_selection_data_set(selectionData, uriListAtom, 8,
+            reinterpret_cast<const guchar*>(uriList.data()), uriList.length() + 1);
 
     } else if (info == getIdForTargetType(TargetTypeNetscapeURL) && dataObject->hasURL()) {
         String url(dataObject->url());
@@ -209,27 +190,16 @@ void PasteboardHelper::fillDataObjectFromDropData(GtkSelectionData* data, guint
     else if (target == markupAtom)
         dataObject->setMarkup(selectionDataToUTF8String(data));
     else if (target == uriListAtom) {
-        gchar** uris = gtk_selection_data_get_uris(data);
-        if (!uris)
-            return;
-
-        Vector<KURL> uriList(urisToKURLVector(uris));
-        dataObject->setURIList(uriList);
-        g_strfreev(uris);
+        dataObject->setURIList(selectionDataToUTF8String(data));
     } else if (target == netscapeURLAtom) {
         String urlWithLabel(selectionDataToUTF8String(data));
-
         Vector<String> pieces;
         urlWithLabel.split("\n", pieces);
 
         // Give preference to text/uri-list here, as it can hold more
         // than one URI but still take  the label if there is one.
-        if (!dataObject->hasURL()) {
-            Vector<KURL> uriList;
-            uriList.append(KURL(KURL(), pieces[0]));
-            dataObject->setURIList(uriList);
-        }
-
+        if (!dataObject->hasURIList())
+            dataObject->setURIList(pieces[0]);
         if (pieces.size() > 1)
             dataObject->setText(pieces[1]);
     }
diff --git a/WebCore/platform/gtk/PlatformScreenGtk.cpp b/WebCore/platform/gtk/PlatformScreenGtk.cpp
index 6ace728..9c70d0e 100644
--- a/WebCore/platform/gtk/PlatformScreenGtk.cpp
+++ b/WebCore/platform/gtk/PlatformScreenGtk.cpp
@@ -63,8 +63,7 @@ static GdkVisual* getVisual(Widget* widget)
             return 0;
     }
 
-
-    return gdk_drawable_get_visual(GDK_DRAWABLE(gtk_widget_get_window(container)));
+    return gdk_window_get_visual(gtk_widget_get_window(container));
 }
 
 int screenDepth(Widget* widget)
@@ -123,7 +122,7 @@ FloatRect screenAvailableRect(Widget* widget)
         return screenRect(widget);
 
     GdkDrawable* rootWindow = GDK_DRAWABLE(gtk_widget_get_root_window(container));
-    GdkDisplay* display = gdk_drawable_get_display(rootWindow);
+    GdkDisplay* display = gdk_window_get_display(rootWindow);
     Atom xproperty = gdk_x11_get_xatom_by_name_for_display(display, "_NET_WORKAREA");
 
     Atom retType;
diff --git a/WebCore/platform/gtk/PopupMenuGtk.cpp b/WebCore/platform/gtk/PopupMenuGtk.cpp
index d3e933d..a679734 100644
--- a/WebCore/platform/gtk/PopupMenuGtk.cpp
+++ b/WebCore/platform/gtk/PopupMenuGtk.cpp
@@ -90,7 +90,7 @@ void PopupMenuGtk::show(const IntRect& rect, FrameView* view, int index)
 #ifdef GTK_API_VERSION_2
     gtk_widget_size_request(GTK_WIDGET(m_popup.get()), &requisition);
 #else
-    gtk_size_request_get_size(GTK_SIZE_REQUEST(m_popup.get()), &requisition, NULL);
+    gtk_widget_get_preferred_size(GTK_WIDGET(m_popup.get()), &requisition, 0);
 #endif
 
     gtk_widget_set_size_request(GTK_WIDGET(m_popup.get()), std::max(rect.width(), requisition.width), -1);
@@ -107,7 +107,7 @@ void PopupMenuGtk::show(const IntRect& rect, FrameView* view, int index)
 #ifdef GTK_API_VERSION_2
             gtk_widget_get_child_requisition(item, &itemRequisition);
 #else
-            gtk_size_request_get_size(GTK_SIZE_REQUEST(item), &itemRequisition, NULL);
+            gtk_widget_get_preferred_size(item, &itemRequisition, 0);
 #endif
             m_menuPosition.setY(m_menuPosition.y() - itemRequisition.height);
 
diff --git a/WebCore/platform/gtk/RenderThemeGtk.cpp b/WebCore/platform/gtk/RenderThemeGtk.cpp
index 9329179..b2e3fd2 100644
--- a/WebCore/platform/gtk/RenderThemeGtk.cpp
+++ b/WebCore/platform/gtk/RenderThemeGtk.cpp
@@ -192,6 +192,7 @@ RenderThemeGtk::~RenderThemeGtk()
 
 GtkThemeParts* RenderThemeGtk::partsForDrawable(GdkDrawable* drawable) const
 {
+#ifdef GTK_API_VERSION_2
     // A null drawable represents the default screen colormap.
     GdkColormap* colormap = 0;
     if (!drawable)
@@ -205,6 +206,10 @@ GtkThemeParts* RenderThemeGtk::partsForDrawable(GdkDrawable* drawable) const
         parts->colormap = colormap;
         g_hash_table_insert(m_partsTable.get(), colormap, parts);
     }
+#else
+    // For GTK+ 3.0 we no longer have to worry about maintaining a set of widgets per-colormap.
+    static GtkThemeParts* parts = g_slice_new0(GtkThemeParts);
+#endif // GTK_API_VERSION_2
 
     return parts;
 }
@@ -284,6 +289,7 @@ static void adjustMozillaStyle(const RenderThemeGtk* theme, RenderStyle* style,
     style->setPaddingBottom(Length(ypadding + bottom, Fixed));
 }
 
+#ifdef GTK_API_VERSION_2
 bool RenderThemeGtk::paintMozillaGtkWidget(GtkThemeWidgetType type, GraphicsContext* context, const IntRect& rect, GtkWidgetState* widgetState, int flags, GtkTextDirection textDirection)
 {
     // Painting is disabled so just claim to have succeeded
@@ -333,6 +339,18 @@ bool RenderThemeGtk::paintMozillaGtkWidget(GtkThemeWidgetType type, GraphicsCont
 
     return !success;
 }
+#else
+bool RenderThemeGtk::paintMozillaGtkWidget(GtkThemeWidgetType type, GraphicsContext* context, const IntRect& rect, GtkWidgetState* widgetState, int flags, GtkTextDirection textDirection)
+{
+    // Painting is disabled so just claim to have succeeded
+    if (context->paintingDisabled())
+        return false;
+
+    // false == success, because of awesome.
+    GdkRectangle paintRect = rect;
+    return moz_gtk_widget_paint(type, context->platformContext(), &paintRect, widgetState, flags, textDirection) != MOZ_GTK_SUCCESS;
+}
+#endif
 
 bool RenderThemeGtk::paintRenderObject(GtkThemeWidgetType type, RenderObject* renderObject, GraphicsContext* context, const IntRect& rect, int flags)
 {
@@ -343,7 +361,13 @@ bool RenderThemeGtk::paintRenderObject(GtkThemeWidgetType type, RenderObject* re
     GtkWidgetState widgetState;
     widgetState.active = isPressed(renderObject);
     widgetState.focused = isFocused(renderObject);
-    widgetState.inHover = isHovered(renderObject);
+
+    // https://bugs.webkit.org/show_bug.cgi?id=18364
+    // The Mozilla theme drawing code, only paints a button as pressed when it's pressed 
+    // while hovered. Until we move away from the Mozila code, work-around the issue by
+    // forcing a pressed button into the hovered state. This ensures that buttons activated
+    // via the keyboard have the proper rendering.
+    widgetState.inHover = isHovered(renderObject) || (type == MOZ_GTK_BUTTON && isPressed(renderObject));
 
     // FIXME: Disabled does not always give the correct appearance for ReadOnly
     widgetState.disabled = !isEnabled(renderObject) || isReadOnlyControl(renderObject);
@@ -362,16 +386,6 @@ bool RenderThemeGtk::paintRenderObject(GtkThemeWidgetType type, RenderObject* re
     return paintMozillaGtkWidget(type, context, rect, &widgetState, flags, textDirection);
 }
 
-static void setButtonPadding(RenderStyle* style)
-{
-    // FIXME: This looks incorrect.
-    const int padding = 8;
-    style->setPaddingLeft(Length(padding, Fixed));
-    style->setPaddingRight(Length(padding, Fixed));
-    style->setPaddingTop(Length(padding / 2, Fixed));
-    style->setPaddingBottom(Length(padding / 2, Fixed));
-}
-
 static void setToggleSize(const RenderThemeGtk* theme, RenderStyle* style, ControlPart appearance)
 {
     // The width and height are both specified, so we shouldn't change them.
@@ -426,18 +440,9 @@ bool RenderThemeGtk::paintRadio(RenderObject* o, const PaintInfo& i, const IntRe
 
 void RenderThemeGtk::adjustButtonStyle(CSSStyleSelector* selector, RenderStyle* style, WebCore::Element* e) const
 {
-    // FIXME: Is this condition necessary?
-    if (style->appearance() == PushButtonPart) {
-        style->resetBorder();
-        style->setHeight(Length(Auto));
-        style->setWhiteSpace(PRE);
-        setButtonPadding(style);
-    } else {
-        // FIXME: This should not be hard-coded.
-        style->setMinHeight(Length(14, Fixed));
-        style->resetBorderTop();
-        style->resetBorderBottom();
-    }
+    // Some layout tests check explicitly that buttons ignore line-height.
+    if (style->appearance() == PushButtonPart)
+        style->setLineHeight(RenderStyle::initialLineHeight());
 }
 
 bool RenderThemeGtk::paintButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
@@ -499,13 +504,26 @@ void RenderThemeGtk::adjustSearchFieldResultsDecorationStyle(CSSStyleSelector* s
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeGtk::paintSearchFieldResultsDecoration(RenderObject* o, const PaintInfo& i, const IntRect& rect)
+static IntRect centerRectVerticallyInParentInputElement(RenderObject* object, const IntRect& rect)
 {
-    GraphicsContext* context = i.context;
+    IntRect centeredRect(rect);
+    Node* input = object->node()->shadowAncestorNode(); // Get the renderer of <input> element.
+    if (!input->renderer()->isBox()) 
+        return centeredRect;
 
-    static Image* searchImage = Image::loadPlatformThemeIcon(GTK_STOCK_FIND, rect.width()).releaseRef();
-    context->drawImage(searchImage, DeviceColorSpace, rect);
+    // If possible center the y-coordinate of the rect vertically in the parent input element.
+    // We also add one pixel here to ensure that the y coordinate is rounded up for box heights
+    // that are even, which looks in relation to the box text.
+    IntRect inputContentBox = toRenderBox(input->renderer())->absoluteContentBox();
+    centeredRect.setY(inputContentBox.y() + (inputContentBox.height() - centeredRect.height() + 1) / 2);
+    return centeredRect;
+}
 
+bool RenderThemeGtk::paintSearchFieldResultsDecoration(RenderObject* object, const PaintInfo& i, const IntRect& rect)
+{
+    static Image* searchImage = Image::loadPlatformThemeIcon(GTK_STOCK_FIND, rect.width()).releaseRef();
+    IntRect centeredRect(centerRectVerticallyInParentInputElement(object, rect));
+    i.context->drawImage(searchImage, ColorSpaceDeviceRGB, centeredRect);
     return false;
 }
 
@@ -520,14 +538,12 @@ void RenderThemeGtk::adjustSearchFieldCancelButtonStyle(CSSStyleSelector* select
     style->setHeight(Length(size.height(), Fixed));
 }
 
-bool RenderThemeGtk::paintSearchFieldCancelButton(RenderObject* o, const PaintInfo& i, const IntRect& rect)
+bool RenderThemeGtk::paintSearchFieldCancelButton(RenderObject* object, const PaintInfo& i, const IntRect& rect)
 {
-    GraphicsContext* context = i.context;
-
     // TODO: Brightening up the image on hover is desirable here, I believe.
     static Image* cancelImage = Image::loadPlatformThemeIcon(GTK_STOCK_CLEAR, rect.width()).releaseRef();
-    context->drawImage(cancelImage, DeviceColorSpace, rect);
-
+    IntRect centeredRect(centerRectVerticallyInParentInputElement(object, rect));
+    i.context->drawImage(cancelImage, ColorSpaceDeviceRGB, centeredRect);
     return false;
 }
 
@@ -550,7 +566,7 @@ bool RenderThemeGtk::paintSliderTrack(RenderObject* object, const PaintInfo& inf
     if (part == SliderVerticalPart)
         gtkPart = MOZ_GTK_SCALE_VERTICAL;
 
-    return paintRenderObject(gtkPart, object, info.context, rect);
+    return paintRenderObject(gtkPart, object, info.context, toRenderBox(object)->absoluteContentBox());
 }
 
 void RenderThemeGtk::adjustSliderTrackStyle(CSSStyleSelector*, RenderStyle* style, Element*) const
@@ -655,10 +671,46 @@ double RenderThemeGtk::caretBlinkInterval() const
     return time / 2000.;
 }
 
-void RenderThemeGtk::systemFont(int, FontDescription&) const
+static double getScreenDPI()
+{
+    // FIXME: Really this should be the widget's screen.
+    GdkScreen* screen = gdk_screen_get_default();
+    if (!screen)
+        return 96; // Default to 96 DPI.
+
+    float dpi = gdk_screen_get_resolution(screen);
+    if (dpi <= 0)
+        return 96;
+    return dpi;
+}
+
+void RenderThemeGtk::systemFont(int, FontDescription& fontDescription) const
 {
-    // If you remove this notImplemented(), replace it with an comment that explains why.
-    notImplemented();
+    GtkSettings* settings = gtk_settings_get_default();
+    if (!settings)
+        return;
+
+    // This will be a font selection string like "Sans 10" so we cannot use it as the family name.
+    GOwnPtr<gchar> fontName;
+    g_object_get(settings, "gtk-font-name", &fontName.outPtr(), NULL);
+
+    PangoFontDescription* pangoDescription = pango_font_description_from_string(fontName.get());
+    if (!pangoDescription)
+        return;
+
+    fontDescription.firstFamily().setFamily(pango_font_description_get_family(pangoDescription));
+
+    int size = pango_font_description_get_size(pangoDescription) / PANGO_SCALE;
+    // If the size of the font is in points, we need to convert it to pixels.
+    if (!pango_font_description_get_size_is_absolute(pangoDescription))
+        size = size * (getScreenDPI() / 72.0);
+
+    fontDescription.setSpecifiedSize(size);
+    fontDescription.setIsAbsoluteSize(true);
+    fontDescription.setGenericFamily(FontDescription::NoFamily);
+    fontDescription.setWeight(FontWeightNormal);
+    fontDescription.setItalic(false);
+    pango_font_description_free(pangoDescription);
 }
 
 Color RenderThemeGtk::systemColor(int cssValueId) const
@@ -753,8 +805,8 @@ String RenderThemeGtk::extraMediaControlsStyleSheet()
 
 static inline bool paintMediaButton(GraphicsContext* context, const IntRect& r, Image* image, Color panelColor, int mediaIconSize)
 {
-    context->fillRect(FloatRect(r), panelColor, DeviceColorSpace);
-    context->drawImage(image, DeviceColorSpace,
+    context->fillRect(FloatRect(r), panelColor, ColorSpaceDeviceRGB);
+    context->drawImage(image, ColorSpaceDeviceRGB,
                        IntRect(r.x() + (r.width() - mediaIconSize) / 2,
                                r.y() + (r.height() - mediaIconSize) / 2,
                                mediaIconSize, mediaIconSize));
@@ -800,9 +852,9 @@ bool RenderThemeGtk::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pai
 {
     GraphicsContext* context = paintInfo.context;
 
-    context->fillRect(FloatRect(r), m_panelColor, DeviceColorSpace);
+    context->fillRect(FloatRect(r), m_panelColor, ColorSpaceDeviceRGB);
     context->fillRect(FloatRect(IntRect(r.x(), r.y() + (r.height() - m_mediaSliderHeight) / 2,
-                                        r.width(), m_mediaSliderHeight)), m_sliderColor, DeviceColorSpace);
+                                        r.width(), m_mediaSliderHeight)), m_sliderColor, ColorSpaceDeviceRGB);
 
     RenderStyle* style = o->style();
     HTMLMediaElement* mediaElement = toParentMediaElement(o);
@@ -859,7 +911,7 @@ bool RenderThemeGtk::paintMediaSliderTrack(RenderObject* o, const PaintInfo& pai
 bool RenderThemeGtk::paintMediaSliderThumb(RenderObject* o, const PaintInfo& paintInfo, const IntRect& r)
 {
     // Make the thumb nicer with rounded corners.
-    paintInfo.context->fillRoundedRect(r, IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), m_sliderThumbColor, DeviceColorSpace);
+    paintInfo.context->fillRoundedRect(r, IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), IntSize(3, 3), m_sliderThumbColor, ColorSpaceDeviceRGB);
     return false;
 }
 #endif
diff --git a/WebCore/platform/gtk/ScrollbarThemeGtk.cpp b/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
index 2e942fe..19b897c 100644
--- a/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
+++ b/WebCore/platform/gtk/ScrollbarThemeGtk.cpp
@@ -221,14 +221,8 @@ void ScrollbarThemeGtk::paintTrackBackground(GraphicsContext* context, Scrollbar
 
 void ScrollbarThemeGtk::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
 {
+    // This is unused by the moz_gtk_scrollecd_window_paint.
     GtkWidgetState state;
-    state.focused = FALSE;
-    state.isDefault = FALSE;
-    state.canDefault = FALSE;
-    state.disabled = FALSE;
-    state.active = TRUE;
-    state.inHover = FALSE;
-
     IntRect fullScrollbarRect = IntRect(scrollbar->x(), scrollbar->y(), scrollbar->width(), scrollbar->height());
     static_cast<RenderThemeGtk*>(RenderTheme::defaultTheme().get())->paintMozillaGtkWidget(MOZ_GTK_SCROLLED_WINDOW, context, fullScrollbarRect, &state, 0);
 }
@@ -303,7 +297,6 @@ bool ScrollbarThemeGtk::paint(Scrollbar* scrollbar, GraphicsContext* graphicsCon
             scrollMask |= ThumbPart;
     }
 
-    // Paint the scrollbar background (only used by custom CSS scrollbars).
     paintScrollbarBackground(graphicsContext, scrollbar);
 
     if (scrollMask & TrackBGPart)
diff --git a/WebCore/platform/gtk/gtk2drawing.c b/WebCore/platform/gtk/gtk2drawing.c
index fd770d2..2f2edb6 100644
--- a/WebCore/platform/gtk/gtk2drawing.c
+++ b/WebCore/platform/gtk/gtk2drawing.c
@@ -44,6 +44,11 @@
  * Adapted from the gtkdrawing.c, and gtk+2.0 source.
  */
 
+#ifdef GTK_API_VERSION_2
+
+#undef GTK_DISABLE_DEPRECATED
+#undef GDK_DISABLE_DEPRECATED
+
 #include <gdk/gdkprivate.h>
 #include "gtkdrawing.h"
 #include "GtkVersioning.h"
@@ -52,7 +57,6 @@
 
 #define XTHICKNESS(style) (style->xthickness)
 #define YTHICKNESS(style) (style->ythickness)
-#define WINDOW_IS_MAPPED(window) ((window) && GDK_IS_WINDOW(window) && gdk_window_is_visible(window))
 
 static GtkThemeParts *gParts = NULL;
 static style_prop_t style_prop_func;
@@ -122,26 +126,6 @@ ensure_button_widget()
 }
 
 static gint
-ensure_hpaned_widget()
-{
-    if (!gParts->hpanedWidget) {
-        gParts->hpanedWidget = gtk_hpaned_new();
-        setup_widget_prototype(gParts->hpanedWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_vpaned_widget()
-{
-    if (!gParts->vpanedWidget) {
-        gParts->vpanedWidget = gtk_vpaned_new();
-        setup_widget_prototype(gParts->vpanedWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
 ensure_toggle_button_widget()
 {
     if (!gParts->toggleButtonWidget) {
@@ -201,16 +185,6 @@ ensure_scrollbar_widget()
 }
 
 static gint
-ensure_spin_widget()
-{
-  if (!gParts->spinWidget) {
-    gParts->spinWidget = gtk_spin_button_new(NULL, 1, 0);
-    setup_widget_prototype(gParts->spinWidget);
-  }
-  return MOZ_GTK_SUCCESS;
-}
-
-static gint
 ensure_scale_widget()
 {
   if (!gParts->hScaleWidget) {
@@ -337,171 +311,6 @@ ensure_combo_box_widgets()
     return MOZ_GTK_SUCCESS;
 }
 
-/* We need to have pointers to the inner widgets (entry, button, arrow) of
- * the ComboBoxEntry to get the correct rendering from theme engines which
- * special cases their look. Since the inner layout can change, we ask GTK
- * to NULL our pointers when they are about to become invalid because the
- * corresponding widgets don't exist anymore. It's the role of
- * g_object_add_weak_pointer().
- * Note that if we don't find the inner widgets (which shouldn't happen), we
- * fallback to use generic "non-inner" widgets, and they don't need that kind
- * of weak pointer since they are explicit children of gParts->protoWindow and as
- * such GTK holds a strong reference to them. */
-static void
-moz_gtk_get_combo_box_entry_inner_widgets(GtkWidget *widget,
-                                          gpointer client_data)
-{
-    if (GTK_IS_TOGGLE_BUTTON(widget)) {
-        gParts->comboBoxEntryButtonWidget = widget;
-        g_object_add_weak_pointer(G_OBJECT(widget),
-                                  (gpointer) &gParts->comboBoxEntryButtonWidget);
-    } else if (GTK_IS_ENTRY(widget)) {
-        gParts->comboBoxEntryTextareaWidget = widget;
-        g_object_add_weak_pointer(G_OBJECT(widget),
-                                  (gpointer) &gParts->comboBoxEntryTextareaWidget);
-    } else
-        return;
-    gtk_widget_realize(widget);
-    g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-}
-
-static void
-moz_gtk_get_combo_box_entry_arrow(GtkWidget *widget, gpointer client_data)
-{
-    if (GTK_IS_ARROW(widget)) {
-        gParts->comboBoxEntryArrowWidget = widget;
-        g_object_add_weak_pointer(G_OBJECT(widget),
-                                  (gpointer) &gParts->comboBoxEntryArrowWidget);
-        gtk_widget_realize(widget);
-        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-}
-
-static gint
-ensure_combo_box_entry_widgets()
-{
-    GtkWidget* buttonChild;
-
-    if (gParts->comboBoxEntryTextareaWidget &&
-            gParts->comboBoxEntryButtonWidget &&
-            gParts->comboBoxEntryArrowWidget)
-        return MOZ_GTK_SUCCESS;
-
-    /* Create a ComboBoxEntry if needed */
-    if (!gParts->comboBoxEntryWidget) {
-        gParts->comboBoxEntryWidget = gtk_combo_box_entry_new();
-        setup_widget_prototype(gParts->comboBoxEntryWidget);
-    }
-
-    /* Get its inner Entry and Button */
-    gtk_container_forall(GTK_CONTAINER(gParts->comboBoxEntryWidget),
-                         moz_gtk_get_combo_box_entry_inner_widgets,
-                         NULL);
-
-    if (!gParts->comboBoxEntryTextareaWidget) {
-        ensure_entry_widget();
-        gParts->comboBoxEntryTextareaWidget = gParts->entryWidget;
-    }
-
-    if (gParts->comboBoxEntryButtonWidget) {
-        /* Get the Arrow inside the Button */
-        buttonChild = gtk_bin_get_child(GTK_BIN(gParts->comboBoxEntryButtonWidget));
-        if (GTK_IS_HBOX(buttonChild)) {
-            /* appears-as-list = FALSE, cell-view = TRUE; the button
-             * contains an hbox. This hbox is there because ComboBoxEntry
-             * inherits from ComboBox which needs to place a cell renderer,
-             * a separator, and an arrow in the button when appears-as-list
-             * is FALSE. Here the hbox should only contain an arrow, since
-             * a ComboBoxEntry doesn't need all those widgets in the
-             * button. */
-            gtk_container_forall(GTK_CONTAINER(buttonChild),
-                                 moz_gtk_get_combo_box_entry_arrow,
-                                 NULL);
-        } else if(GTK_IS_ARROW(buttonChild)) {
-            /* appears-as-list = TRUE, or cell-view = FALSE;
-             * the button only contains an arrow */
-            gParts->comboBoxEntryArrowWidget = buttonChild;
-            g_object_add_weak_pointer(G_OBJECT(buttonChild), (gpointer)
-                                      &gParts->comboBoxEntryArrowWidget);
-            gtk_widget_realize(gParts->comboBoxEntryArrowWidget);
-            g_object_set_data(G_OBJECT(gParts->comboBoxEntryArrowWidget),
-                              "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-        }
-    } else {
-        /* Shouldn't be reached with current internal gtk implementation;
-         * we use a generic toggle button as last resort fallback to avoid
-         * crashing. */
-        ensure_toggle_button_widget();
-        gParts->comboBoxEntryButtonWidget = gParts->toggleButtonWidget;
-    }
-
-    if (!gParts->comboBoxEntryArrowWidget) {
-        /* Shouldn't be reached with current internal gtk implementation;
-         * we gParts->buttonArrowWidget as last resort fallback to avoid
-         * crashing. */
-        ensure_button_arrow_widget();
-        gParts->comboBoxEntryArrowWidget = gParts->buttonArrowWidget;
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-
-static gint
-ensure_handlebox_widget()
-{
-    if (!gParts->handleBoxWidget) {
-        gParts->handleBoxWidget = gtk_handle_box_new();
-        setup_widget_prototype(gParts->handleBoxWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_toolbar_widget()
-{
-    if (!gParts->toolbarWidget) {
-        ensure_handlebox_widget();
-        gParts->toolbarWidget = gtk_toolbar_new();
-        gtk_container_add(GTK_CONTAINER(gParts->handleBoxWidget), gParts->toolbarWidget);
-        gtk_widget_realize(gParts->toolbarWidget);
-        g_object_set_data(G_OBJECT(gParts->toolbarWidget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_toolbar_separator_widget()
-{
-    if (!gParts->toolbarSeparatorWidget) {
-        ensure_toolbar_widget();
-        gParts->toolbarSeparatorWidget = GTK_WIDGET(gtk_separator_tool_item_new());
-        setup_widget_prototype(gParts->toolbarSeparatorWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_tooltip_widget()
-{
-    if (!gParts->tooltipWidget) {
-        gParts->tooltipWidget = gtk_window_new(GTK_WINDOW_POPUP);
-        gtk_widget_realize(gParts->tooltipWidget);
-        moz_gtk_set_widget_name(gParts->tooltipWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_tab_widget()
-{
-    if (!gParts->tabWidget) {
-        gParts->tabWidget = gtk_notebook_new();
-        setup_widget_prototype(gParts->tabWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
 static gint
 ensure_progress_widget()
 {
@@ -513,200 +322,6 @@ ensure_progress_widget()
 }
 
 static gint
-ensure_statusbar_widget()
-{
-    if (!gParts->statusbarWidget) {
-      gParts->statusbarWidget = gtk_statusbar_new();
-      setup_widget_prototype(gParts->statusbarWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_frame_widget()
-{
-    if (!gParts->frameWidget) {
-        ensure_statusbar_widget();
-        gParts->frameWidget = gtk_frame_new(NULL);
-        gtk_container_add(GTK_CONTAINER(gParts->statusbarWidget), gParts->frameWidget);
-        gtk_widget_realize(gParts->frameWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_menu_bar_widget()
-{
-    if (!gParts->menuBarWidget) {
-        gParts->menuBarWidget = gtk_menu_bar_new();
-        setup_widget_prototype(gParts->menuBarWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_menu_bar_item_widget()
-{
-    if (!gParts->menuBarItemWidget) {
-        ensure_menu_bar_widget();
-        gParts->menuBarItemWidget = gtk_menu_item_new();
-        gtk_menu_shell_append(GTK_MENU_SHELL(gParts->menuBarWidget),
-                              gParts->menuBarItemWidget);
-        gtk_widget_realize(gParts->menuBarItemWidget);
-        g_object_set_data(G_OBJECT(gParts->menuBarItemWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_menu_popup_widget()
-{
-    if (!gParts->menuPopupWidget) {
-        ensure_menu_bar_item_widget();
-        gParts->menuPopupWidget = gtk_menu_new();
-        gtk_menu_item_set_submenu(GTK_MENU_ITEM(gParts->menuBarItemWidget),
-                                  gParts->menuPopupWidget);
-        gtk_widget_realize(gParts->menuPopupWidget);
-        g_object_set_data(G_OBJECT(gParts->menuPopupWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_menu_item_widget()
-{
-    if (!gParts->menuItemWidget) {
-        ensure_menu_popup_widget();
-        gParts->menuItemWidget = gtk_menu_item_new_with_label("M");
-        gtk_menu_shell_append(GTK_MENU_SHELL(gParts->menuPopupWidget),
-                              gParts->menuItemWidget);
-        gtk_widget_realize(gParts->menuItemWidget);
-        g_object_set_data(G_OBJECT(gParts->menuItemWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_image_menu_item_widget()
-{
-    if (!gParts->imageMenuItemWidget) {
-        ensure_menu_popup_widget();
-        gParts->imageMenuItemWidget = gtk_image_menu_item_new();
-        gtk_menu_shell_append(GTK_MENU_SHELL(gParts->menuPopupWidget),
-                              gParts->imageMenuItemWidget);
-        gtk_widget_realize(gParts->imageMenuItemWidget);
-        g_object_set_data(G_OBJECT(gParts->imageMenuItemWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_menu_separator_widget()
-{
-    if (!gParts->menuSeparatorWidget) {
-        ensure_menu_popup_widget();
-        gParts->menuSeparatorWidget = gtk_separator_menu_item_new();
-        gtk_menu_shell_append(GTK_MENU_SHELL(gParts->menuPopupWidget),
-                              gParts->menuSeparatorWidget);
-        gtk_widget_realize(gParts->menuSeparatorWidget);
-        g_object_set_data(G_OBJECT(gParts->menuSeparatorWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_check_menu_item_widget()
-{
-    if (!gParts->checkMenuItemWidget) {
-        ensure_menu_popup_widget();
-        gParts->checkMenuItemWidget = gtk_check_menu_item_new_with_label("M");
-        gtk_menu_shell_append(GTK_MENU_SHELL(gParts->menuPopupWidget),
-                              gParts->checkMenuItemWidget);
-        gtk_widget_realize(gParts->checkMenuItemWidget);
-        g_object_set_data(G_OBJECT(gParts->checkMenuItemWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_tree_view_widget()
-{
-    if (!gParts->treeViewWidget) {
-        gParts->treeViewWidget = gtk_tree_view_new();
-        setup_widget_prototype(gParts->treeViewWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_tree_header_cell_widget()
-{
-    if(!gParts->treeHeaderCellWidget) {
-        /*
-         * Some GTK engines paint the first and last cell
-         * of a TreeView header with a highlight.
-         * Since we do not know where our widget will be relative
-         * to the other buttons in the TreeView header, we must
-         * paint it as a button that is between two others,
-         * thus ensuring it is neither the first or last button
-         * in the header.
-         * GTK doesn't give us a way to do this explicitly,
-         * so we must paint with a button that is between two
-         * others.
-         */
-
-        GtkTreeViewColumn* firstTreeViewColumn;
-        GtkTreeViewColumn* lastTreeViewColumn;
-
-        ensure_tree_view_widget();
-
-        /* Create and append our three columns */
-        firstTreeViewColumn = gtk_tree_view_column_new();
-        gtk_tree_view_column_set_title(firstTreeViewColumn, "M");
-        gtk_tree_view_append_column(GTK_TREE_VIEW(gParts->treeViewWidget), firstTreeViewColumn);
-
-        gParts->middleTreeViewColumn = gtk_tree_view_column_new();
-        gtk_tree_view_column_set_title(gParts->middleTreeViewColumn, "M");
-        gtk_tree_view_append_column(GTK_TREE_VIEW(gParts->treeViewWidget),
-                                    gParts->middleTreeViewColumn);
-
-        lastTreeViewColumn = gtk_tree_view_column_new();
-        gtk_tree_view_column_set_title(lastTreeViewColumn, "M");
-        gtk_tree_view_append_column(GTK_TREE_VIEW(gParts->treeViewWidget), lastTreeViewColumn);
-
-#ifdef GTK_API_VERSION_2
-        /* Use the middle column's header for our button */
-        gParts->treeHeaderCellWidget = gParts->middleTreeViewColumn->button;
-        gParts->treeHeaderSortArrowWidget = gParts->middleTreeViewColumn->arrow;
-#else
-        gParts->treeHeaderCellWidget = gtk_button_new();
-        gParts->treeHeaderSortArrowWidget = gtk_arrow_new(GTK_ARROW_DOWN, GTK_SHADOW_NONE);
-#endif
-        g_object_set_data(G_OBJECT(gParts->treeHeaderCellWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-        g_object_set_data(G_OBJECT(gParts->treeHeaderSortArrowWidget),
-                          "transparent-bg-hint", GINT_TO_POINTER(TRUE));
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-ensure_expander_widget()
-{
-    if (!gParts->expanderWidget) {
-        gParts->expanderWidget = gtk_expander_new("M");
-        setup_widget_prototype(gParts->expanderWidget);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
 ensure_scrolled_window_widget()
 {
     if (!gParts->scrolledWindowWidget) {
@@ -729,7 +344,6 @@ ConvertGtkState(GtkWidgetState* state)
         return GTK_STATE_NORMAL;
 }
 
-#ifdef GTK_API_VERSION_2
 static gint
 TSOffsetStyleGCArray(GdkGC** gcs, gint xorigin, gint yorigin)
 {
@@ -739,12 +353,10 @@ TSOffsetStyleGCArray(GdkGC** gcs, gint xorigin, gint yorigin)
         gdk_gc_set_ts_origin(gcs[i], xorigin, yorigin);
     return MOZ_GTK_SUCCESS;
 }
-#endif
 
 static gint
 TSOffsetStyleGCs(GtkStyle* style, gint xorigin, gint yorigin)
 {
-#ifdef GTK_API_VERSION_2
     TSOffsetStyleGCArray(style->fg_gc, xorigin, yorigin);
     TSOffsetStyleGCArray(style->bg_gc, xorigin, yorigin);
     TSOffsetStyleGCArray(style->light_gc, xorigin, yorigin);
@@ -754,7 +366,6 @@ TSOffsetStyleGCs(GtkStyle* style, gint xorigin, gint yorigin)
     TSOffsetStyleGCArray(style->base_gc, xorigin, yorigin);
     gdk_gc_set_ts_origin(style->black_gc, xorigin, yorigin);
     gdk_gc_set_ts_origin(style->white_gc, xorigin, yorigin);
-#endif
     return MOZ_GTK_SUCCESS;
 }
 
@@ -774,28 +385,18 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     moz_gtk_widget_get_focus(widget, &interior_focus, &focus_width, &focus_pad);
 
-    if (WINDOW_IS_MAPPED(drawable)) {
-        gdk_window_set_back_pixmap(drawable, NULL, TRUE);
-        gdk_window_clear_area(drawable, cliprect->x, cliprect->y,
-                              cliprect->width, cliprect->height);
-    }
-
     gtk_widget_set_state(widget, button_state);
     gtk_widget_set_direction(widget, direction);
 
-#ifdef GTK_API_VERSION_2
     if (state->isDefault)
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_DEFAULT);
-#endif
 
     gtk_button_set_relief(GTK_BUTTON(widget), relief);
 
     /* Some theme engines love to cause us pain in that gtk_paint_focus is a
        no-op on buttons and button-like widgets. They only listen to this flag. */
-#ifdef GTK_API_VERSION_2
     if (state->focused && !state->disabled)
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_FOCUS);
-#endif
 
     if (!interior_focus && state->focused) {
         x += focus_width + focus_pad;
@@ -842,10 +443,8 @@ moz_gtk_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
                         widget, "button", x, y, width, height);
     }
 
-#ifdef GTK_API_VERSION_2
     GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_DEFAULT);
     GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_FOCUS);
-#endif
     return MOZ_GTK_SUCCESS;
 }
 
@@ -912,19 +511,6 @@ moz_gtk_widget_get_focus(GtkWidget* widget, gboolean* interior_focus,
 }
 
 gint
-moz_gtk_splitter_get_metrics(gint orientation, gint* size)
-{
-    if (orientation == GTK_ORIENTATION_HORIZONTAL) {
-        ensure_hpaned_widget();
-        gtk_widget_style_get(gParts->hpanedWidget, "handle_size", size, NULL);
-    } else {
-        ensure_vpaned_widget();
-        gtk_widget_style_get(gParts->vpanedWidget, "handle_size", size, NULL);
-    }
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
 moz_gtk_button_get_inner_border(GtkWidget* widget, GtkBorder* inner_border)
 {
     static const GtkBorder default_inner_border = { 1, 1, 1, 1 };
@@ -1098,8 +684,6 @@ static gint
 moz_gtk_scrolled_window_paint(GdkDrawable* drawable, GdkRectangle* rect,
                               GdkRectangle* cliprect, GtkWidgetState* state)
 {
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = (state->active) ?  GTK_SHADOW_IN : GTK_SHADOW_OUT;
     GtkStyle* style;
     GtkAllocation allocation;
     GtkWidget* widget;
@@ -1116,9 +700,9 @@ moz_gtk_scrolled_window_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
     style = gtk_widget_get_style(widget);
     TSOffsetStyleGCs(style, rect->x - 1, rect->y - 1);
-    gtk_paint_box(style, drawable, state_type, shadow_type, cliprect,
-                  widget, "scrolled_window", rect->x - 1, rect->y - 1,
-                  rect->width + 2, rect->height + 2);
+    gtk_paint_shadow(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN,
+                     cliprect, gParts->scrolledWindowWidget, "scrolled_window",
+                     rect->x, rect->y, rect->width, rect->height);
     return MOZ_GTK_SUCCESS;
 }
 
@@ -1265,9 +849,7 @@ moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
     GtkStyle* style;
     GtkScrollbar *scrollbar;
     GtkAdjustment *adj;
-#ifdef GTK_API_VERSION_2
     gboolean activate_slider;
-#endif
 
     ensure_scrollbar_widget();
 
@@ -1319,7 +901,6 @@ moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
 
     style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
     
-#ifdef GTK_API_VERSION_2
     gtk_widget_style_get(GTK_WIDGET(scrollbar), "activate-slider",
                          &activate_slider, NULL);
     
@@ -1327,7 +908,6 @@ moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
         shadow_type = GTK_SHADOW_IN;
         state_type = GTK_STATE_ACTIVE;
     }
-#endif
 
     TSOffsetStyleGCs(style, rect->x, rect->y);
 
@@ -1341,59 +921,6 @@ moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
 }
 
 static gint
-moz_gtk_spin_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                   GtkTextDirection direction)
-{
-    GtkStyle* style;
-
-    ensure_spin_widget();
-    gtk_widget_set_direction(gParts->spinWidget, direction);
-    style = gtk_widget_get_style(gParts->spinWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN, NULL,
-                  gParts->spinWidget, "spinbutton",
-                  rect->x, rect->y, rect->width, rect->height);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_spin_updown_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                          gboolean isDown, GtkWidgetState* state,
-                          GtkTextDirection direction)
-{
-    GdkRectangle arrow_rect;
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = state_type == GTK_STATE_ACTIVE ?
-                                  GTK_SHADOW_IN : GTK_SHADOW_OUT;
-    GtkStyle* style;
-
-    ensure_spin_widget();
-    style = gtk_widget_get_style(gParts->spinWidget);
-    gtk_widget_set_direction(gParts->spinWidget, direction);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_box(style, drawable, state_type, shadow_type, NULL, gParts->spinWidget,
-                  isDown ? "spinbutton_down" : "spinbutton_up",
-                  rect->x, rect->y, rect->width, rect->height);
-
-    /* hard code these values */
-    arrow_rect.width = 6;
-    arrow_rect.height = 6;
-    arrow_rect.x = rect->x + (rect->width - arrow_rect.width) / 2;
-    arrow_rect.y = rect->y + (rect->height - arrow_rect.height) / 2;
-    arrow_rect.y += isDown ? -1 : 1;
-
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, NULL,
-                    gParts->spinWidget, "spinbutton",
-                    isDown ? GTK_ARROW_DOWN : GTK_ARROW_UP, TRUE,
-                    arrow_rect.x, arrow_rect.y,
-                    arrow_rect.width, arrow_rect.height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
 moz_gtk_scale_paint(GdkDrawable* drawable, GdkRectangle* rect,
                     GdkRectangle* cliprect, GtkWidgetState* state,
                     GtkOrientation flags, GtkTextDirection direction)
@@ -1471,76 +998,6 @@ moz_gtk_scale_thumb_paint(GdkDrawable* drawable, GdkRectangle* rect,
 }
 
 static gint
-moz_gtk_gripper_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                      GdkRectangle* cliprect, GtkWidgetState* state,
-                      GtkTextDirection direction)
-{
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type;
-    GtkStyle* style;
-
-    ensure_handlebox_widget();
-    gtk_widget_set_direction(gParts->handleBoxWidget, direction);
-
-    style = gtk_widget_get_style(gParts->handleBoxWidget);
-    shadow_type = gtk_handle_box_get_shadow_type(GTK_HANDLE_BOX(gParts->handleBoxWidget));
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_box(style, drawable, state_type, shadow_type, cliprect,
-                  gParts->handleBoxWidget, "handlebox_bin", rect->x, rect->y,
-                  rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_hpaned_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                     GdkRectangle* cliprect, GtkWidgetState* state)
-{
-    GtkStateType hpaned_state = ConvertGtkState(state);
-
-    ensure_hpaned_widget();
-    gtk_paint_handle(gtk_widget_get_style(gParts->hpanedWidget), drawable, hpaned_state,
-                     GTK_SHADOW_NONE, cliprect, gParts->hpanedWidget, "paned",
-                     rect->x, rect->y, rect->width, rect->height,
-                     GTK_ORIENTATION_VERTICAL);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_vpaned_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                     GdkRectangle* cliprect, GtkWidgetState* state)
-{
-    GtkStateType vpaned_state = ConvertGtkState(state);
-
-    ensure_vpaned_widget();
-    gtk_paint_handle(gtk_widget_get_style(gParts->vpanedWidget), drawable, vpaned_state,
-                     GTK_SHADOW_NONE, cliprect, gParts->vpanedWidget, "paned",
-                     rect->x, rect->y, rect->width, rect->height,
-                     GTK_ORIENTATION_HORIZONTAL);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_caret_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                    GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GdkRectangle location = *rect;
-    if (direction == GTK_TEXT_DIR_RTL) {
-        /* gtk_draw_insertion_cursor ignores location.width */
-        location.x = rect->x + rect->width;
-    }
-
-    ensure_entry_widget();
-    gtk_draw_insertion_cursor(gParts->entryWidget, drawable, cliprect,
-                              &location, TRUE, direction, FALSE);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
 moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
                     GdkRectangle* cliprect, GtkWidgetState* state,
                     GtkWidget* widget, GtkTextDirection direction)
@@ -1583,17 +1040,8 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
     if (theme_honors_transparency) {
         g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
     } else {
-#ifndef GTK_API_VERSION_2
-        cairo_t* cr = gdk_cairo_create(drawable);
-        gdk_cairo_set_source_color(cr, (const GdkColor*)&style->base[bg_state]);
-        cairo_pattern_set_extend (cairo_get_source(cr), CAIRO_EXTEND_REPEAT);
-        gdk_cairo_rectangle(cr, cliprect);
-        cairo_fill(cr);
-        cairo_destroy(cr);
-#else
         gdk_draw_rectangle(drawable, style->base_gc[bg_state], TRUE,
                            cliprect->x, cliprect->y, cliprect->width, cliprect->height);
-#endif
         g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(FALSE));
     }
 
@@ -1620,9 +1068,7 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
     if (state->focused && !state->disabled) {
         /* This will get us the lit borders that focused textboxes enjoy on
          * some themes. */
-#ifdef GTK_API_VERSION_2
         GTK_WIDGET_SET_FLAGS(widget, GTK_HAS_FOCUS);
-#endif
 
         if (!interior_focus) {
             /* Indent the border a little bit if we have exterior focus 
@@ -1646,152 +1092,12 @@ moz_gtk_entry_paint(GdkDrawable* drawable, GdkRectangle* rect,
 
         /* Now unset the focus flag. We don't want other entries to look
          * like they're focused too! */
-#ifdef GTK_API_VERSION_2
         GTK_WIDGET_UNSET_FLAGS(widget, GTK_HAS_FOCUS);
-#endif
     }
 
     return MOZ_GTK_SUCCESS;
 }
 
-static gint 
-moz_gtk_treeview_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                       GdkRectangle* cliprect, GtkWidgetState* state,
-                       GtkTextDirection direction)
-{
-    gint xthickness, ythickness;
-
-    GtkStyle *style, *treeview_style;
-    GtkStateType state_type;
-
-    ensure_tree_view_widget();
-    ensure_scrolled_window_widget();
-
-    gtk_widget_set_direction(gParts->treeViewWidget, direction);
-    gtk_widget_set_direction(gParts->scrolledWindowWidget, direction);
-
-    /* only handle disabled and normal states, otherwise the whole background
-     * area will be painted differently with other states */
-    state_type = state->disabled ? GTK_STATE_INSENSITIVE : GTK_STATE_NORMAL;
-
-    /* In GTK the treeview sets the background of the window
-     * which contains the cells to the treeview base color.
-     * If we don't set it here the background color will not be correct.*/
-    gtk_widget_modify_bg(gParts->treeViewWidget, state_type,
-                         &gtk_widget_get_style(gParts->treeViewWidget)->base[state_type]);
-
-    style = gtk_widget_get_style(gParts->scrolledWindowWidget);
-    xthickness = XTHICKNESS(style);
-    ythickness = YTHICKNESS(style);
-
-    treeview_style = gtk_widget_get_style(gParts->treeViewWidget);
-    TSOffsetStyleGCs(treeview_style, rect->x, rect->y);
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    gtk_paint_flat_box(treeview_style, drawable, state_type,
-                       GTK_SHADOW_NONE, cliprect, gParts->treeViewWidget, "treeview",
-                       rect->x + xthickness, rect->y + ythickness,
-                       rect->width - 2 * xthickness,
-                       rect->height - 2 * ythickness);
-
-    gtk_paint_shadow(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_IN,
-                     cliprect, gParts->scrolledWindowWidget, "scrolled_window",
-                     rect->x, rect->y, rect->width, rect->height); 
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_tree_header_cell_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                               GdkRectangle* cliprect, GtkWidgetState* state,
-                               gboolean isSorted, GtkTextDirection direction)
-{
-    gtk_tree_view_column_set_sort_indicator(gParts->middleTreeViewColumn,
-                                            isSorted);
-
-    moz_gtk_button_paint(drawable, rect, cliprect, state, GTK_RELIEF_NORMAL,
-                         gParts->treeHeaderCellWidget, direction);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_tree_header_sort_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                                     GdkRectangle* cliprect,
-                                     GtkWidgetState* state, GtkArrowType flags,
-                                     GtkTextDirection direction)
-{
-    GdkRectangle arrow_rect;
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = GTK_SHADOW_IN;
-    GtkArrowType arrow_type = flags;
-    GtkStyle* style;
-
-    ensure_tree_header_cell_widget();
-    gtk_widget_set_direction(gParts->treeHeaderSortArrowWidget, direction);
-
-    /* hard code these values */
-    arrow_rect.width = 11;
-    arrow_rect.height = 11;
-    arrow_rect.x = rect->x + (rect->width - arrow_rect.width) / 2;
-    arrow_rect.y = rect->y + (rect->height - arrow_rect.height) / 2;
-
-    style = gtk_widget_get_style(gParts->treeHeaderSortArrowWidget);
-    TSOffsetStyleGCs(style, arrow_rect.x, arrow_rect.y);
-
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
-                    gParts->treeHeaderSortArrowWidget, "arrow",  arrow_type, TRUE,
-                    arrow_rect.x, arrow_rect.y,
-                    arrow_rect.width, arrow_rect.height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_treeview_expander_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                                GdkRectangle* cliprect, GtkWidgetState* state,
-                                GtkExpanderStyle expander_state,
-                                GtkTextDirection direction)
-{
-    GtkStyle *style;
-    GtkStateType state_type;
-
-    ensure_tree_view_widget();
-    gtk_widget_set_direction(gParts->treeViewWidget, direction);
-
-    style = gtk_widget_get_style(gParts->treeViewWidget);
-
-    /* Because the frame we get is of the entire treeview, we can't get the precise
-     * event state of one expander, thus rendering hover and active feedback useless. */
-    state_type = state->disabled ? GTK_STATE_INSENSITIVE : GTK_STATE_NORMAL;
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_expander(style, drawable, state_type, cliprect, gParts->treeViewWidget, "treeview",
-                       rect->x + rect->width / 2, rect->y + rect->height / 2, expander_state);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_expander_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                       GdkRectangle* cliprect, GtkWidgetState* state,
-                       GtkExpanderStyle expander_state,
-                       GtkTextDirection direction)
-{
-    GtkStyle *style;
-    GtkStateType state_type = ConvertGtkState(state);
-
-    ensure_expander_widget();
-    gtk_widget_set_direction(gParts->expanderWidget, direction);
-
-    style = gtk_widget_get_style(gParts->expanderWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_expander(style, drawable, state_type, cliprect, gParts->expanderWidget, "expander",
-                       rect->x + rect->width / 2, rect->y + rect->height / 2, expander_state);
-
-    return MOZ_GTK_SUCCESS;
-}
-
 static gint
 moz_gtk_combo_box_paint(GdkDrawable* drawable, GdkRectangle* rect,
                         GdkRectangle* cliprect, GtkWidgetState* state,
@@ -1816,11 +1122,7 @@ moz_gtk_combo_box_paint(GdkDrawable* drawable, GdkRectangle* rect,
                                 rect, &arrow_rect, direction, ishtml);
     /* Now arrow_rect contains the inner rect ; we want to correct the width
      * to what the arrow needs (see gtk_combo_box_size_allocate) */
-#ifdef GTK_API_VERSION_2
     gtk_widget_size_request(gParts->comboBoxArrowWidget, &arrow_req);
-#else
-    gtk_size_request_get_size(GTK_SIZE_REQUEST(gParts->comboBoxArrowWidget), &arrow_req, NULL);
-#endif
     if (direction == GTK_TEXT_DIR_LTR)
         arrow_rect.x += arrow_rect.width - arrow_req.width;
     arrow_rect.width = arrow_req.width;
@@ -1878,323 +1180,6 @@ moz_gtk_combo_box_paint(GdkDrawable* drawable, GdkRectangle* rect,
 }
 
 static gint
-moz_gtk_downarrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                        GdkRectangle* cliprect, GtkWidgetState* state)
-{
-    GtkStyle* style;
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = state->active ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
-    GdkRectangle arrow_rect;
-
-    ensure_button_arrow_widget();
-    style = gtk_widget_get_style(gParts->buttonArrowWidget);
-
-    calculate_arrow_rect(gParts->buttonArrowWidget, rect, &arrow_rect,
-                         GTK_TEXT_DIR_LTR);
-
-    TSOffsetStyleGCs(style, arrow_rect.x, arrow_rect.y);
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
-                    gParts->buttonArrowWidget, "arrow",  GTK_ARROW_DOWN, TRUE,
-                    arrow_rect.x, arrow_rect.y, arrow_rect.width, arrow_rect.height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_combo_box_entry_button_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                                     GdkRectangle* cliprect,
-                                     GtkWidgetState* state,
-                                     gboolean input_focus,
-                                     GtkTextDirection direction)
-{
-    gint x_displacement, y_displacement;
-    GdkRectangle arrow_rect, real_arrow_rect;
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = state->active ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
-    GtkStyle* style;
-
-    ensure_combo_box_entry_widgets();
-
-    if (input_focus) {
-        /* Some themes draw a complementary focus ring for the dropdown button
-         * when the dropdown entry has focus */
-#ifdef GTK_API_VERSION_2
-        GTK_WIDGET_SET_FLAGS(gParts->comboBoxEntryTextareaWidget, GTK_HAS_FOCUS);
-#endif
-    }
-
-    moz_gtk_button_paint(drawable, rect, cliprect, state, GTK_RELIEF_NORMAL,
-                         gParts->comboBoxEntryButtonWidget, direction);
-
-#ifdef GTK_API_VERSION_2
-    if (input_focus)
-        GTK_WIDGET_UNSET_FLAGS(gParts->comboBoxEntryTextareaWidget, GTK_HAS_FOCUS);
-#endif
-
-    calculate_button_inner_rect(gParts->comboBoxEntryButtonWidget,
-                                rect, &arrow_rect, direction, FALSE);
-    if (state_type == GTK_STATE_ACTIVE) {
-        gtk_widget_style_get(gParts->comboBoxEntryButtonWidget,
-                             "child-displacement-x", &x_displacement,
-                             "child-displacement-y", &y_displacement,
-                             NULL);
-        arrow_rect.x += x_displacement;
-        arrow_rect.y += y_displacement;
-    }
-
-    calculate_arrow_rect(gParts->comboBoxEntryArrowWidget,
-                         &arrow_rect, &real_arrow_rect, direction);
-
-    style = gtk_widget_get_style(gParts->comboBoxEntryArrowWidget);
-    TSOffsetStyleGCs(style, real_arrow_rect.x, real_arrow_rect.y);
-
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, cliprect,
-                    gParts->comboBoxEntryArrowWidget, "arrow",  GTK_ARROW_DOWN, TRUE,
-                    real_arrow_rect.x, real_arrow_rect.y,
-                    real_arrow_rect.width, real_arrow_rect.height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_container_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                        GdkRectangle* cliprect, GtkWidgetState* state, 
-                        gboolean isradio, GtkTextDirection direction)
-{
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkStyle* style;
-    GtkWidget *widget;
-    gboolean interior_focus;
-    gint focus_width, focus_pad;
-
-    if (isradio) {
-        ensure_radiobutton_widget();
-        widget = gParts->radiobuttonWidget;
-    } else {
-        ensure_checkbox_widget();
-        widget = gParts->checkboxWidget;
-    }
-    gtk_widget_set_direction(widget, direction);
-
-    style = gtk_widget_get_style(widget);
-    moz_gtk_widget_get_focus(widget, &interior_focus, &focus_width,
-                             &focus_pad);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    /* The detail argument for the gtk_paint_* calls below are "checkbutton"
-       even for radio buttons, to match what gtk does. */
-
-    /* this is for drawing a prelight box */
-    if (state_type == GTK_STATE_PRELIGHT || state_type == GTK_STATE_ACTIVE) {
-        gtk_paint_flat_box(style, drawable, GTK_STATE_PRELIGHT,
-                           GTK_SHADOW_ETCHED_OUT, cliprect, widget,
-                           "checkbutton",
-                           rect->x, rect->y, rect->width, rect->height);
-    }
-
-    if (state_type != GTK_STATE_NORMAL && state_type != GTK_STATE_PRELIGHT)
-        state_type = GTK_STATE_NORMAL;
-
-    if (state->focused && !interior_focus) {
-        gtk_paint_focus(style, drawable, state_type, cliprect, widget,
-                        "checkbutton",
-                        rect->x, rect->y, rect->width, rect->height);
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_toggle_label_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                           GdkRectangle* cliprect, GtkWidgetState* state, 
-                           gboolean isradio, GtkTextDirection direction)
-{
-    GtkStateType state_type;
-    GtkStyle *style;
-    GtkWidget *widget;
-    gboolean interior_focus;
-
-    if (!state->focused)
-        return MOZ_GTK_SUCCESS;
-
-    if (isradio) {
-        ensure_radiobutton_widget();
-        widget = gParts->radiobuttonWidget;
-    } else {
-        ensure_checkbox_widget();
-        widget = gParts->checkboxWidget;
-    }
-    gtk_widget_set_direction(widget, direction);
-
-    gtk_widget_style_get(widget, "interior-focus", &interior_focus, NULL);
-    if (!interior_focus)
-        return MOZ_GTK_SUCCESS;
-
-    state_type = ConvertGtkState(state);
-
-    style = gtk_widget_get_style(widget);
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    /* Always "checkbutton" to match gtkcheckbutton.c */
-    gtk_paint_focus(style, drawable, state_type, cliprect, widget,
-                    "checkbutton",
-                    rect->x, rect->y, rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_toolbar_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                      GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkShadowType shadow_type;
-
-    ensure_toolbar_widget();
-    gtk_widget_set_direction(gParts->toolbarWidget, direction);
-
-    style = gtk_widget_get_style(gParts->toolbarWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    gtk_style_apply_default_background(style, drawable, TRUE,
-                                       GTK_STATE_NORMAL,
-                                       cliprect, rect->x, rect->y,
-                                       rect->width, rect->height);
-
-    gtk_widget_style_get(gParts->toolbarWidget, "shadow-type", &shadow_type, NULL);
-
-    gtk_paint_box (style, drawable, GTK_STATE_NORMAL, shadow_type,
-                   cliprect, gParts->toolbarWidget, "toolbar",
-                   rect->x, rect->y, rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_toolbar_separator_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                                GdkRectangle* cliprect,
-                                GtkTextDirection direction)
-{
-    GtkStyle* style;
-    gint     separator_width;
-    gint     paint_width;
-    gboolean wide_separators;
-    
-    /* Defined as constants in GTK+ 2.10.14 */
-    const double start_fraction = 0.2;
-    const double end_fraction = 0.8;
-
-    ensure_toolbar_separator_widget();
-    gtk_widget_set_direction(gParts->toolbarSeparatorWidget, direction);
-
-    style = gtk_widget_get_style(gParts->toolbarSeparatorWidget);
-
-    gtk_widget_style_get(gParts->toolbarWidget,
-                         "wide-separators", &wide_separators,
-                         "separator-width", &separator_width,
-                         NULL);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    if (wide_separators) {
-        if (separator_width > rect->width)
-            separator_width = rect->width;
-
-        gtk_paint_box(style, drawable,
-                      GTK_STATE_NORMAL, GTK_SHADOW_ETCHED_OUT,
-                      cliprect, gParts->toolbarWidget, "vseparator",
-                      rect->x + (rect->width - separator_width) / 2,
-                      rect->y + rect->height * start_fraction,
-                      separator_width,
-                      rect->height * (end_fraction - start_fraction));
-                       
-    } else {
-        paint_width = style->xthickness;
-        
-        if (paint_width > rect->width)
-            paint_width = rect->width;
-    
-        gtk_paint_vline(style, drawable,
-                        GTK_STATE_NORMAL, cliprect, gParts->toolbarSeparatorWidget,
-                        "toolbar",
-                        rect->y + rect->height * start_fraction,
-                        rect->y + rect->height * end_fraction,
-                        rect->x + (rect->width - paint_width) / 2);
-    }
-    
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_tooltip_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                      GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-
-    ensure_tooltip_widget();
-    gtk_widget_set_direction(gParts->tooltipWidget, direction);
-
-    style = gtk_rc_get_style_by_paths(gtk_settings_get_default(),
-                                      "gtk-tooltips", "GtkWindow",
-                                      GTK_TYPE_WINDOW);
-
-    style = gtk_style_attach(style, gtk_widget_get_window(gParts->tooltipWidget));
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_flat_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
-                       cliprect, gParts->tooltipWidget, "tooltip",
-                       rect->x, rect->y, rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_resizer_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                      GdkRectangle* cliprect, GtkWidgetState* state,
-                      GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkStateType state_type = ConvertGtkState(state);
-
-    ensure_window_widget();
-    gtk_widget_set_direction(gParts->protoWindow, direction);
-
-    style = gtk_widget_get_style(gParts->protoWindow);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    gtk_paint_resize_grip(style, drawable, state_type, cliprect, gParts->protoWindow,
-                          NULL, (direction == GTK_TEXT_DIR_LTR) ?
-                          GDK_WINDOW_EDGE_SOUTH_EAST :
-                          GDK_WINDOW_EDGE_SOUTH_WEST,
-                          rect->x, rect->y, rect->width, rect->height);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_frame_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                    GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkShadowType shadow_type;
-
-    ensure_frame_widget();
-    gtk_widget_set_direction(gParts->frameWidget, direction);
-
-    style = gtk_widget_get_style(gParts->frameWidget);
-
-    gtk_widget_style_get(gParts->statusbarWidget, "shadow-type", &shadow_type, NULL);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_shadow(style, drawable, GTK_STATE_NORMAL, shadow_type,
-                     cliprect, gParts->frameWidget, "frame", rect->x, rect->y,
-                     rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
 moz_gtk_progressbar_paint(GdkDrawable* drawable, GdkRectangle* rect,
                           GdkRectangle* cliprect, GtkTextDirection direction)
 {
@@ -2233,438 +1218,6 @@ moz_gtk_progress_chunk_paint(GdkDrawable* drawable, GdkRectangle* rect,
 }
 
 gint
-moz_gtk_get_tab_thickness(void)
-{
-    GtkStyle* style;
-
-    ensure_tab_widget();
-    style = gtk_widget_get_style(gParts->tabWidget);
-    if (YTHICKNESS(style) < 2)
-        return 2; /* some themes don't set ythickness correctly */
-
-    return YTHICKNESS(style);
-}
-
-static gint
-moz_gtk_tab_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                  GdkRectangle* cliprect, GtkTabFlags flags,
-                  GtkTextDirection direction)
-{
-    /* When the tab isn't selected, we just draw a notebook extension.
-     * When it is selected, we overwrite the adjacent border of the tabpanel
-     * touching the tab with a pierced border (called "the gap") to make the
-     * tab appear physically attached to the tabpanel; see details below. */
-
-    GtkStyle* style;
-
-    ensure_tab_widget();
-    gtk_widget_set_direction(gParts->tabWidget, direction);
-
-    style = gtk_widget_get_style(gParts->tabWidget);
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    if ((flags & MOZ_GTK_TAB_SELECTED) == 0) {
-        /* Only draw the tab */
-        gtk_paint_extension(style, drawable, GTK_STATE_ACTIVE, GTK_SHADOW_OUT,
-                            cliprect, gParts->tabWidget, "tab",
-                            rect->x, rect->y, rect->width, rect->height,
-                            (flags & MOZ_GTK_TAB_BOTTOM) ?
-                                GTK_POS_TOP : GTK_POS_BOTTOM );
-    } else {
-        /* Draw the tab and the gap
-         * We want the gap to be positionned exactly on the tabpanel top
-         * border; since tabbox.css may set a negative margin so that the tab
-         * frame rect already overlaps the tabpanel frame rect, we need to take
-         * that into account when drawing. To that effect, nsNativeThemeGTK
-         * passes us this negative margin (bmargin in the graphic below) in the
-         * lowest bits of |flags|.  We use it to set gap_voffset, the distance
-         * between the top of the gap and the bottom of the tab (resp. the
-         * bottom of the gap and the top of the tab when we draw a bottom tab),
-         * while ensuring that the gap always touches the border of the tab,
-         * i.e. 0 <= gap_voffset <= gap_height, to avoid surprinsing results
-         * with big negative or positive margins.
-         * Here is a graphical explanation in the case of top tabs:
-         *             ___________________________
-         *            /                           \
-         *           |            T A B            |
-         * ----------|. . . . . . . . . . . . . . .|----- top of tabpanel
-         *           :    ^       bmargin          :  ^
-         *           :    | (-negative margin,     :  |
-         *  bottom   :    v  passed in flags)      :  |       gap_height
-         *    of  -> :.............................:  |    (the size of the
-         * the tab   .       part of the gap       .  |  tabpanel top border)
-         *           .      outside of the tab     .  v
-         * ----------------------------------------------
-         *
-         * To draw the gap, we use gtk_paint_box_gap(), see comment in
-         * moz_gtk_tabpanels_paint(). This box_gap is made 3 * gap_height tall,
-         * which should suffice to ensure that the only visible border is the
-         * pierced one.  If the tab is in the middle, we make the box_gap begin
-         * a bit to the left of the tab and end a bit to the right, adjusting
-         * the gap position so it still is under the tab, because we want the
-         * rendering of a gap in the middle of a tabpanel.  This is the role of
-         * the gints gap_{l,r}_offset. On the contrary, if the tab is the
-         * first, we align the start border of the box_gap with the start
-         * border of the tab (left if LTR, right if RTL), by setting the
-         * appropriate offset to 0.*/
-        gint gap_loffset, gap_roffset, gap_voffset, gap_height;
-
-        /* Get height needed by the gap */
-        gap_height = moz_gtk_get_tab_thickness();
-
-        /* Extract gap_voffset from the first bits of flags */
-        gap_voffset = flags & MOZ_GTK_TAB_MARGIN_MASK;
-        if (gap_voffset > gap_height)
-            gap_voffset = gap_height;
-
-        /* Set gap_{l,r}_offset to appropriate values */
-        gap_loffset = gap_roffset = 20; /* should be enough */
-        if (flags & MOZ_GTK_TAB_FIRST) {
-            if (direction == GTK_TEXT_DIR_RTL)
-                gap_roffset = 0;
-            else
-                gap_loffset = 0;
-        }
-
-        if (flags & MOZ_GTK_TAB_BOTTOM) {
-            /* Enlarge the cliprect to have room for the full gap height */
-            cliprect->height += gap_height - gap_voffset;
-            cliprect->y -= gap_height - gap_voffset;
-
-            /* Draw the tab */
-            gtk_paint_extension(style, drawable, GTK_STATE_NORMAL,
-                                GTK_SHADOW_OUT, cliprect, gParts->tabWidget, "tab",
-                                rect->x, rect->y + gap_voffset, rect->width,
-                                rect->height - gap_voffset, GTK_POS_TOP);
-
-            /* Draw the gap; erase with background color before painting in
-             * case theme does not */
-            gtk_style_apply_default_background(style, drawable, TRUE,
-                                               GTK_STATE_NORMAL, cliprect,
-                                               rect->x,
-                                               rect->y + gap_voffset
-                                                       - gap_height,
-                                               rect->width, gap_height);
-            gtk_paint_box_gap(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
-                              cliprect, gParts->tabWidget, "notebook",
-                              rect->x - gap_loffset,
-                              rect->y + gap_voffset - 3 * gap_height,
-                              rect->width + gap_loffset + gap_roffset,
-                              3 * gap_height, GTK_POS_BOTTOM,
-                              gap_loffset, rect->width);
-        } else {
-            /* Enlarge the cliprect to have room for the full gap height */
-            cliprect->height += gap_height - gap_voffset;
-
-            /* Draw the tab */
-            gtk_paint_extension(style, drawable, GTK_STATE_NORMAL,
-                                GTK_SHADOW_OUT, cliprect, gParts->tabWidget, "tab",
-                                rect->x, rect->y, rect->width,
-                                rect->height - gap_voffset, GTK_POS_BOTTOM);
-
-            /* Draw the gap; erase with background color before painting in
-             * case theme does not */
-            gtk_style_apply_default_background(style, drawable, TRUE,
-                                               GTK_STATE_NORMAL, cliprect,
-                                               rect->x,
-                                               rect->y + rect->height
-                                                       - gap_voffset,
-                                               rect->width, gap_height);
-            gtk_paint_box_gap(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
-                              cliprect, gParts->tabWidget, "notebook",
-                              rect->x - gap_loffset,
-                              rect->y + rect->height - gap_voffset,
-                              rect->width + gap_loffset + gap_roffset,
-                              3 * gap_height, GTK_POS_TOP,
-                              gap_loffset, rect->width);
-        }
-
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_tabpanels_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                        GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    /* We use gtk_paint_box_gap() to draw the tabpanels widget. gtk_paint_box()
-     * draws an all-purpose box, which a lot of themes render differently.
-     * A zero-width gap is still visible in most themes, so we hide it to the
-     * left (10px should be enough) */
-    GtkStyle* style;
-
-    ensure_tab_widget();
-    gtk_widget_set_direction(gParts->tabWidget, direction);
-
-    style = gtk_widget_get_style(gParts->tabWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_box_gap(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT,
-                      cliprect, gParts->tabWidget, "notebook", rect->x, rect->y,
-                      rect->width, rect->height,
-                      GTK_POS_TOP, -10, 0);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_tab_scroll_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                               GdkRectangle* cliprect, GtkWidgetState* state,
-                               GtkArrowType arrow_type,
-                               GtkTextDirection direction)
-{
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkShadowType shadow_type = state->active ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
-    GtkStyle* style;
-    gint arrow_size = MIN(rect->width, rect->height);
-    gint x = rect->x + (rect->width - arrow_size) / 2;
-    gint y = rect->y + (rect->height - arrow_size) / 2;
-
-    ensure_tab_widget();
-
-    style = gtk_widget_get_style(gParts->tabWidget);
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    if (direction == GTK_TEXT_DIR_RTL) {
-        arrow_type = (arrow_type == GTK_ARROW_LEFT) ?
-                         GTK_ARROW_RIGHT : GTK_ARROW_LEFT;
-    }
-
-    gtk_paint_arrow(style, drawable, state_type, shadow_type, NULL,
-                    gParts->tabWidget, "notebook", arrow_type, TRUE,
-                    x, y, arrow_size, arrow_size);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_menu_bar_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                       GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkShadowType shadow_type;
-    ensure_menu_bar_widget();
-    gtk_widget_set_direction(gParts->menuBarWidget, direction);
-
-    gtk_widget_style_get(gParts->menuBarWidget, "shadow-type", &shadow_type, NULL);
-
-    style = gtk_widget_get_style(gParts->menuBarWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_style_apply_default_background(style, drawable, TRUE, GTK_STATE_NORMAL,
-                                       cliprect, rect->x, rect->y,
-                                       rect->width, rect->height);
-
-    gtk_paint_box(style, drawable, GTK_STATE_NORMAL, shadow_type,
-                  cliprect, gParts->menuBarWidget, "menubar", rect->x, rect->y,
-                  rect->width, rect->height);
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_menu_popup_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                         GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    ensure_menu_popup_widget();
-    gtk_widget_set_direction(gParts->menuPopupWidget, direction);
-
-    style = gtk_widget_get_style(gParts->menuPopupWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_style_apply_default_background(style, drawable, TRUE, GTK_STATE_NORMAL,
-                                       cliprect, rect->x, rect->y,
-                                       rect->width, rect->height);
-    gtk_paint_box(style, drawable, GTK_STATE_NORMAL, GTK_SHADOW_OUT, 
-                  cliprect, gParts->menuPopupWidget, "menu",
-                  rect->x, rect->y, rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_menu_separator_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                             GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    gboolean wide_separators;
-    gint separator_height;
-    guint horizontal_padding;
-    gint paint_height;
-
-    ensure_menu_separator_widget();
-    gtk_widget_set_direction(gParts->menuSeparatorWidget, direction);
-
-    style = gtk_widget_get_style(gParts->menuSeparatorWidget);
-
-    gtk_widget_style_get(gParts->menuSeparatorWidget,
-                         "wide-separators",    &wide_separators,
-                         "separator-height",   &separator_height,
-                         "horizontal-padding", &horizontal_padding,
-                         NULL);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-
-    if (wide_separators) {
-        if (separator_height > rect->height)
-            separator_height = rect->height;
-
-        gtk_paint_box(style, drawable,
-                      GTK_STATE_NORMAL, GTK_SHADOW_ETCHED_OUT,
-                      cliprect, gParts->menuSeparatorWidget, "hseparator",
-                      rect->x + horizontal_padding + style->xthickness,
-                      rect->y + (rect->height - separator_height - style->ythickness) / 2,
-                      rect->width - 2 * (horizontal_padding + style->xthickness),
-                      separator_height);
-    } else {
-        paint_height = style->ythickness;
-        if (paint_height > rect->height)
-            paint_height = rect->height;
-
-        gtk_paint_hline(style, drawable,
-                        GTK_STATE_NORMAL, cliprect, gParts->menuSeparatorWidget,
-                        "menuitem",
-                        rect->x + horizontal_padding + style->xthickness,
-                        rect->x + rect->width - horizontal_padding - style->xthickness - 1,
-                        rect->y + (rect->height - style->ythickness) / 2);
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_menu_item_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                        GdkRectangle* cliprect, GtkWidgetState* state,
-                        gint flags, GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkShadowType shadow_type;
-    GtkWidget* item_widget;
-
-    if (state->inHover && !state->disabled) {
-        if (flags & MOZ_TOPLEVEL_MENU_ITEM) {
-            ensure_menu_bar_item_widget();
-            item_widget = gParts->menuBarItemWidget;
-        } else {
-            ensure_menu_item_widget();
-            item_widget = gParts->menuItemWidget;
-        }
-        gtk_widget_set_direction(item_widget, direction);
-        
-        style = gtk_widget_get_style(item_widget);
-        TSOffsetStyleGCs(style, rect->x, rect->y);
-
-        gtk_widget_style_get(item_widget, "selected-shadow-type",
-                             &shadow_type, NULL);
-
-        gtk_paint_box(style, drawable, GTK_STATE_PRELIGHT, shadow_type,
-                      cliprect, item_widget, "menuitem", rect->x, rect->y,
-                      rect->width, rect->height);
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_menu_arrow_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                         GdkRectangle* cliprect, GtkWidgetState* state,
-                         GtkTextDirection direction)
-{
-    GtkStyle* style;
-    GtkStateType state_type = ConvertGtkState(state);
-
-    ensure_menu_item_widget();
-    gtk_widget_set_direction(gParts->menuItemWidget, direction);
-
-    style = gtk_widget_get_style(gParts->menuItemWidget);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_paint_arrow(style, drawable, state_type,
-                    (state_type == GTK_STATE_PRELIGHT) ? GTK_SHADOW_IN : GTK_SHADOW_OUT,
-                    cliprect, gParts->menuItemWidget, "menuitem",
-                    (direction == GTK_TEXT_DIR_LTR) ? GTK_ARROW_RIGHT : GTK_ARROW_LEFT,
-                    TRUE, rect->x, rect->y, rect->width, rect->height);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_check_menu_item_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                              GdkRectangle* cliprect, GtkWidgetState* state,
-                              gboolean checked, gboolean isradio,
-                              GtkTextDirection direction)
-{
-    GtkStateType state_type = ConvertGtkState(state);
-    GtkStyle* style;
-    GtkShadowType shadow_type = (checked)?GTK_SHADOW_IN:GTK_SHADOW_OUT;
-    gint offset;
-    gint indicator_size;
-    gint x, y;
-
-    moz_gtk_menu_item_paint(drawable, rect, cliprect, state, FALSE, direction);
-
-    ensure_check_menu_item_widget();
-    gtk_widget_set_direction(gParts->checkMenuItemWidget, direction);
-
-    gtk_widget_style_get (gParts->checkMenuItemWidget,
-                          "indicator-size", &indicator_size,
-                          NULL);
-
-#ifdef GTK_API_VERSION_2
-    if (checked || GTK_CHECK_MENU_ITEM(gParts->checkMenuItemWidget)->always_show_toggle) {
-#else
-    if (checked || FALSE) {
-#endif
-      style = gtk_widget_get_style(gParts->checkMenuItemWidget);
-
-      offset = gtk_container_get_border_width(GTK_CONTAINER(gParts->checkMenuItemWidget)) + style->xthickness + 2;
-
-      /* while normally this "3" would be the horizontal-padding style value, passing it to Gecko
-         as the value of menuitem padding causes problems with dropdowns (bug 406129), so in the menu.css
-         file this is hardcoded as 3px. Yes it sucks, but we don't really have a choice. */
-      x = (direction == GTK_TEXT_DIR_RTL) ?
-            rect->width - indicator_size - offset - 3: rect->x + offset + 3;
-      y = rect->y + (rect->height - indicator_size) / 2;
-
-      TSOffsetStyleGCs(style, x, y);
-      gtk_check_menu_item_set_active(GTK_CHECK_MENU_ITEM(gParts->checkMenuItemWidget),
-                                     checked);
-
-      if (isradio) {
-        gtk_paint_option(style, drawable, state_type, shadow_type, cliprect,
-                         gParts->checkMenuItemWidget, "option",
-                         x, y, indicator_size, indicator_size);
-      } else {
-        gtk_paint_check(style, drawable, state_type, shadow_type, cliprect,
-                        gParts->checkMenuItemWidget, "check",
-                        x, y, indicator_size, indicator_size);
-      }
-    }
-
-    return MOZ_GTK_SUCCESS;
-}
-
-static gint
-moz_gtk_window_paint(GdkDrawable* drawable, GdkRectangle* rect,
-                     GdkRectangle* cliprect, GtkTextDirection direction)
-{
-    GtkStyle* style;
-
-    ensure_window_widget();
-    gtk_widget_set_direction(gParts->protoWindow, direction);
-
-    style = gtk_widget_get_style(gParts->protoWindow);
-
-    TSOffsetStyleGCs(style, rect->x, rect->y);
-    gtk_style_apply_default_background(style, drawable, TRUE,
-                                       GTK_STATE_NORMAL,
-                                       cliprect, rect->x, rect->y,
-                                       rect->width, rect->height);
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
 moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                           gint* right, gint* bottom, GtkTextDirection direction,
                           gboolean inhtml)
@@ -2705,52 +1258,6 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
         ensure_entry_widget();
         w = gParts->entryWidget;
         break;
-    case MOZ_GTK_TREEVIEW:
-        ensure_tree_view_widget();
-        w = gParts->treeViewWidget;
-        break;
-    case MOZ_GTK_TREE_HEADER_CELL:
-        {
-            /* A Tree Header in GTK is just a different styled button 
-             * It must be placed in a TreeView for getting the correct style
-             * assigned.
-             * That is why the following code is the same as for MOZ_GTK_BUTTON.  
-             * */
-
-            GtkBorder inner_border;
-            gboolean interior_focus;
-            gint focus_width, focus_pad;
-            GtkStyle* style;
-
-            ensure_tree_header_cell_widget();
-            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(gParts->treeHeaderCellWidget));
-
-            moz_gtk_widget_get_focus(gParts->treeHeaderCellWidget, &interior_focus, &focus_width, &focus_pad);
-            moz_gtk_button_get_inner_border(gParts->treeHeaderCellWidget, &inner_border);
-            *left += focus_width + focus_pad + inner_border.left;
-            *right += focus_width + focus_pad + inner_border.right;
-            *top += focus_width + focus_pad + inner_border.top;
-            *bottom += focus_width + focus_pad + inner_border.bottom;
-            
-            style = gtk_widget_get_style(gParts->treeHeaderCellWidget);
-            *left += style->xthickness;
-            *right += style->xthickness;
-            *top += style->ythickness;
-            *bottom += style->ythickness;
-            return MOZ_GTK_SUCCESS;
-        }
-    case MOZ_GTK_TREE_HEADER_SORTARROW:
-        ensure_tree_header_cell_widget();
-        w = gParts->treeHeaderSortArrowWidget;
-        break;
-    case MOZ_GTK_DROPDOWN_ENTRY:
-        ensure_combo_box_entry_widgets();
-        w = gParts->comboBoxEntryTextareaWidget;
-        break;
-    case MOZ_GTK_DROPDOWN_ARROW:
-        ensure_combo_box_entry_widgets();
-        w = gParts->comboBoxEntryButtonWidget;
-        break;
     case MOZ_GTK_DROPDOWN:
         {
             /* We need to account for the arrow on the dropdown, so text
@@ -2791,11 +1298,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
                         XTHICKNESS(style);
             }
 
-#ifdef GTK_API_VERSION_2
             gtk_widget_size_request(gParts->comboBoxArrowWidget, &arrow_req);
-#else
-            gtk_size_request_get_size(GTK_SIZE_REQUEST(gParts->comboBoxArrowWidget), &arrow_req, NULL);
-#endif
             if (direction == GTK_TEXT_DIR_RTL)
                 *left += separator_width + arrow_req.width;
             else
@@ -2803,20 +1306,10 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
 
             return MOZ_GTK_SUCCESS;
         }
-    case MOZ_GTK_TABPANELS:
-        ensure_tab_widget();
-        w = gParts->tabWidget;
-        break;
     case MOZ_GTK_PROGRESSBAR:
         ensure_progress_widget();
         w = gParts->progresWidget;
         break;
-    case MOZ_GTK_SPINBUTTON_ENTRY:
-    case MOZ_GTK_SPINBUTTON_UP:
-    case MOZ_GTK_SPINBUTTON_DOWN:
-        ensure_spin_widget();
-        w = gParts->spinWidget;
-        break;
     case MOZ_GTK_SCALE_HORIZONTAL:
         ensure_scale_widget();
         w = gParts->hScaleWidget;
@@ -2825,89 +1318,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
         ensure_scale_widget();
         w = gParts->vScaleWidget;
         break;
-    case MOZ_GTK_FRAME:
-        ensure_frame_widget();
-        w = gParts->frameWidget;
-        break;
-    case MOZ_GTK_CHECKBUTTON_LABEL:
-    case MOZ_GTK_RADIOBUTTON_LABEL:
-        {
-            gboolean interior_focus;
-            gint focus_width, focus_pad;
-
-            /* If the focus is interior, then the label has a border of
-               (focus_width + focus_pad). */
-            if (widget == MOZ_GTK_CHECKBUTTON_LABEL) {
-                ensure_checkbox_widget();
-                moz_gtk_widget_get_focus(gParts->checkboxWidget, &interior_focus,
-                                           &focus_width, &focus_pad);
-            }
-            else {
-                ensure_radiobutton_widget();
-                moz_gtk_widget_get_focus(gParts->radiobuttonWidget, &interior_focus,
-                                        &focus_width, &focus_pad);
-            }
-
-            if (interior_focus)
-                *left = *top = *right = *bottom = (focus_width + focus_pad);
-            else
-                *left = *top = *right = *bottom = 0;
-
-            return MOZ_GTK_SUCCESS;
-        }
-
-    case MOZ_GTK_CHECKBUTTON_CONTAINER:
-    case MOZ_GTK_RADIOBUTTON_CONTAINER:
-        {
-            gboolean interior_focus;
-            gint focus_width, focus_pad;
-
-            /* If the focus is _not_ interior, then the container has a border
-               of (focus_width + focus_pad). */
-            if (widget == MOZ_GTK_CHECKBUTTON_CONTAINER) {
-                ensure_checkbox_widget();
-                moz_gtk_widget_get_focus(gParts->checkboxWidget, &interior_focus,
-                                           &focus_width, &focus_pad);
-                w = gParts->checkboxWidget;
-            } else {
-                ensure_radiobutton_widget();
-                moz_gtk_widget_get_focus(gParts->radiobuttonWidget, &interior_focus,
-                                        &focus_width, &focus_pad);
-                w = gParts->radiobuttonWidget;
-            }
-
-            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(w));
-
-            if (!interior_focus) {
-                *left += (focus_width + focus_pad);
-                *right += (focus_width + focus_pad);
-                *top += (focus_width + focus_pad);
-                *bottom += (focus_width + focus_pad);
-            }
-
-            return MOZ_GTK_SUCCESS;
-        }
-    case MOZ_GTK_MENUPOPUP:
-        ensure_menu_popup_widget();
-        w = gParts->menuPopupWidget;
-        break;
-    case MOZ_GTK_MENUITEM:
-        ensure_menu_item_widget();
-        ensure_menu_bar_item_widget();
-        w = gParts->menuItemWidget;
-        break;
-    case MOZ_GTK_CHECKMENUITEM:
-    case MOZ_GTK_RADIOMENUITEM:
-        ensure_check_menu_item_widget();
-        w = gParts->checkMenuItemWidget;
-        break;
-    case MOZ_GTK_TAB:
-        ensure_tab_widget();
-        w = gParts->tabWidget;
-        break;
     /* These widgets have no borders, since they are not containers. */
-    case MOZ_GTK_SPLITTER_HORIZONTAL:
-    case MOZ_GTK_SPLITTER_VERTICAL:
     case MOZ_GTK_CHECKBUTTON:
     case MOZ_GTK_RADIOBUTTON:
     case MOZ_GTK_SCROLLBAR_BUTTON:
@@ -2917,23 +1328,7 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
     case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
     case MOZ_GTK_SCALE_THUMB_HORIZONTAL:
     case MOZ_GTK_SCALE_THUMB_VERTICAL:
-    case MOZ_GTK_GRIPPER:
     case MOZ_GTK_PROGRESS_CHUNK:
-    case MOZ_GTK_EXPANDER:
-    case MOZ_GTK_TREEVIEW_EXPANDER:
-    case MOZ_GTK_TOOLBAR_SEPARATOR:
-    case MOZ_GTK_MENUSEPARATOR:
-    /* These widgets have no borders.*/
-    case MOZ_GTK_SPINBUTTON:
-    case MOZ_GTK_TOOLTIP:
-    case MOZ_GTK_WINDOW:
-    case MOZ_GTK_RESIZER:
-    case MOZ_GTK_MENUARROW:
-    case MOZ_GTK_TOOLBARBUTTON_ARROW:
-    case MOZ_GTK_TOOLBAR:
-    case MOZ_GTK_MENUBAR:
-    case MOZ_GTK_TAB_SCROLLARROW:
-    case MOZ_GTK_ENTRY_CARET:
         *left = *top = *right = *bottom = 0;
         return MOZ_GTK_SUCCESS;
     default:
@@ -2949,131 +1344,6 @@ moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
 }
 
 gint
-moz_gtk_get_combo_box_entry_button_size(gint* width, gint* height)
-{
-    /*
-     * We get the requisition of the drop down button, which includes
-     * all padding, border and focus line widths the button uses,
-     * as well as the minimum arrow size and its padding
-     * */
-    GtkRequisition requisition;
-    ensure_combo_box_entry_widgets();
-
-#ifdef GTK_API_VERSION_2
-    gtk_widget_size_request(gParts->comboBoxEntryButtonWidget, &requisition);
-#else
-    gtk_size_request_get_size(GTK_SIZE_REQUEST(gParts->comboBoxEntryButtonWidget), &requisition, NULL);
-#endif
-
-    *width = requisition.width;
-    *height = requisition.height;
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_tab_scroll_arrow_size(gint* width, gint* height)
-{
-    gint arrow_size;
-
-    ensure_tab_widget();
-    gtk_widget_style_get(gParts->tabWidget,
-                         "scroll-arrow-hlength", &arrow_size,
-                         NULL);
-
-    *height = *width = arrow_size;
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_downarrow_size(gint* width, gint* height)
-{
-    GtkRequisition requisition;
-    ensure_button_arrow_widget();
-
-#ifdef GTK_API_VERSION_2
-    gtk_widget_size_request(gParts->buttonArrowWidget, &requisition);
-#else
-    gtk_size_request_get_size(GTK_SIZE_REQUEST(gParts->buttonArrowWidget), &requisition, NULL);
-#endif
-
-    *width = requisition.width;
-    *height = requisition.height;
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_toolbar_separator_width(gint* size)
-{
-    gboolean wide_separators;
-    gint separator_width;
-    GtkStyle* style;
-
-    ensure_toolbar_widget();
-
-    style = gtk_widget_get_style(gParts->toolbarWidget);
-
-    gtk_widget_style_get(gParts->toolbarWidget,
-                         "space-size", size,
-                         "wide-separators",  &wide_separators,
-                         "separator-width", &separator_width,
-                         NULL);
-
-    /* Just in case... */
-    *size = MAX(*size, (wide_separators ? separator_width : style->xthickness));
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_expander_size(gint* size)
-{
-    ensure_expander_widget();
-    gtk_widget_style_get(gParts->expanderWidget,
-                         "expander-size", size,
-                         NULL);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_treeview_expander_size(gint* size)
-{
-    ensure_tree_view_widget();
-    gtk_widget_style_get(gParts->treeViewWidget,
-                         "expander-size", size,
-                         NULL);
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
-moz_gtk_get_menu_separator_height(gint *size)
-{
-    gboolean wide_separators;
-    gint     separator_height;
-    GtkStyle *style;
-
-    ensure_menu_separator_widget();
-
-    gtk_widget_style_get(gParts->menuSeparatorWidget,
-                          "wide-separators",  &wide_separators,
-                          "separator-height", &separator_height,
-                          NULL);
-
-    style = gtk_widget_get_style(gParts->menuSeparatorWidget);
-
-    if (wide_separators)
-        *size = separator_height + style->ythickness;
-    else
-        *size = style->ythickness * 2;
-
-    return MOZ_GTK_SUCCESS;
-}
-
-gint
 moz_gtk_get_scalethumb_metrics(GtkOrientation orient, gint* thumb_length, gint* thumb_height)
 {
   GtkWidget* widget;
@@ -3109,19 +1379,6 @@ moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics *metrics)
     return MOZ_GTK_SUCCESS;
 }
 
-gboolean
-moz_gtk_images_in_menus()
-{
-    gboolean result;
-    GtkSettings* settings;
-
-    ensure_image_menu_item_widget();
-    settings = gtk_widget_get_settings(gParts->imageMenuItemWidget);
-
-    g_object_get(settings, "gtk-menu-images", &result, NULL);
-    return result;
-}
-
 gint
 moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
                      GdkRectangle* rect, GdkRectangle* cliprect,
@@ -3177,96 +1434,15 @@ moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
         return moz_gtk_scale_thumb_paint(drawable, rect, cliprect, state,
                                          (GtkOrientation) flags, direction);
         break;
-    case MOZ_GTK_SPINBUTTON:
-        return moz_gtk_spin_paint(drawable, rect, direction);
-        break;
-    case MOZ_GTK_SPINBUTTON_UP:
-    case MOZ_GTK_SPINBUTTON_DOWN:
-        return moz_gtk_spin_updown_paint(drawable, rect,
-                                         (widget == MOZ_GTK_SPINBUTTON_DOWN),
-                                         state, direction);
-        break;
-    case MOZ_GTK_SPINBUTTON_ENTRY:
-        ensure_spin_widget();
-        return moz_gtk_entry_paint(drawable, rect, cliprect, state,
-                                   gParts->spinWidget, direction);
-        break;
-    case MOZ_GTK_GRIPPER:
-        return moz_gtk_gripper_paint(drawable, rect, cliprect, state,
-                                     direction);
-        break;
-    case MOZ_GTK_TREEVIEW:
-        return moz_gtk_treeview_paint(drawable, rect, cliprect, state,
-                                      direction);
-        break;
-    case MOZ_GTK_TREE_HEADER_CELL:
-        return moz_gtk_tree_header_cell_paint(drawable, rect, cliprect, state,
-                                              flags, direction);
-        break;
-    case MOZ_GTK_TREE_HEADER_SORTARROW:
-        return moz_gtk_tree_header_sort_arrow_paint(drawable, rect, cliprect,
-                                                    state,
-                                                    (GtkArrowType) flags,
-                                                    direction);
-        break;
-    case MOZ_GTK_TREEVIEW_EXPANDER:
-        return moz_gtk_treeview_expander_paint(drawable, rect, cliprect, state,
-                                               (GtkExpanderStyle) flags, direction);
-        break;
-    case MOZ_GTK_EXPANDER:
-        return moz_gtk_expander_paint(drawable, rect, cliprect, state,
-                                      (GtkExpanderStyle) flags, direction);
-        break;
     case MOZ_GTK_ENTRY:
         ensure_entry_widget();
         return moz_gtk_entry_paint(drawable, rect, cliprect, state,
                                    gParts->entryWidget, direction);
         break;
-    case MOZ_GTK_ENTRY_CARET:
-        return moz_gtk_caret_paint(drawable, rect, cliprect, direction);
-        break;
     case MOZ_GTK_DROPDOWN:
         return moz_gtk_combo_box_paint(drawable, rect, cliprect, state,
                                        (gboolean) flags, direction);
         break;
-    case MOZ_GTK_DROPDOWN_ARROW:
-        return moz_gtk_combo_box_entry_button_paint(drawable, rect, cliprect,
-                                                    state, flags, direction);
-        break;
-    case MOZ_GTK_DROPDOWN_ENTRY:
-        ensure_combo_box_entry_widgets();
-        return moz_gtk_entry_paint(drawable, rect, cliprect, state,
-                                   gParts->comboBoxEntryTextareaWidget, direction);
-        break;
-    case MOZ_GTK_CHECKBUTTON_CONTAINER:
-    case MOZ_GTK_RADIOBUTTON_CONTAINER:
-        return moz_gtk_container_paint(drawable, rect, cliprect, state,
-                                       (widget == MOZ_GTK_RADIOBUTTON_CONTAINER),
-                                       direction);
-        break;
-    case MOZ_GTK_CHECKBUTTON_LABEL:
-    case MOZ_GTK_RADIOBUTTON_LABEL:
-        return moz_gtk_toggle_label_paint(drawable, rect, cliprect, state,
-                                          (widget == MOZ_GTK_RADIOBUTTON_LABEL),
-                                          direction);
-        break;
-    case MOZ_GTK_TOOLBAR:
-        return moz_gtk_toolbar_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_TOOLBAR_SEPARATOR:
-        return moz_gtk_toolbar_separator_paint(drawable, rect, cliprect,
-                                               direction);
-        break;
-    case MOZ_GTK_TOOLTIP:
-        return moz_gtk_tooltip_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_FRAME:
-        return moz_gtk_frame_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_RESIZER:
-        return moz_gtk_resizer_paint(drawable, rect, cliprect, state,
-                                     direction);
-        break;
     case MOZ_GTK_PROGRESSBAR:
         return moz_gtk_progressbar_paint(drawable, rect, cliprect, direction);
         break;
@@ -3274,54 +1450,6 @@ moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
         return moz_gtk_progress_chunk_paint(drawable, rect, cliprect,
                                             direction);
         break;
-    case MOZ_GTK_TAB:
-        return moz_gtk_tab_paint(drawable, rect, cliprect,
-                                 (GtkTabFlags) flags, direction);
-        break;
-    case MOZ_GTK_TABPANELS:
-        return moz_gtk_tabpanels_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_TAB_SCROLLARROW:
-        return moz_gtk_tab_scroll_arrow_paint(drawable, rect, cliprect, state,
-                                              (GtkArrowType) flags, direction);
-        break;
-    case MOZ_GTK_MENUBAR:
-        return moz_gtk_menu_bar_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_MENUPOPUP:
-        return moz_gtk_menu_popup_paint(drawable, rect, cliprect, direction);
-        break;
-    case MOZ_GTK_MENUSEPARATOR:
-        return moz_gtk_menu_separator_paint(drawable, rect, cliprect,
-                                            direction);
-        break;
-    case MOZ_GTK_MENUITEM:
-        return moz_gtk_menu_item_paint(drawable, rect, cliprect, state, flags,
-                                       direction);
-        break;
-    case MOZ_GTK_MENUARROW:
-        return moz_gtk_menu_arrow_paint(drawable, rect, cliprect, state,
-                                        direction);
-        break;
-    case MOZ_GTK_TOOLBARBUTTON_ARROW:
-        return moz_gtk_downarrow_paint(drawable, rect, cliprect, state);
-        break;
-    case MOZ_GTK_CHECKMENUITEM:
-    case MOZ_GTK_RADIOMENUITEM:
-        return moz_gtk_check_menu_item_paint(drawable, rect, cliprect, state,
-                                             (gboolean) flags,
-                                             (widget == MOZ_GTK_RADIOMENUITEM),
-                                             direction);
-        break;
-    case MOZ_GTK_SPLITTER_HORIZONTAL:
-        return moz_gtk_vpaned_paint(drawable, rect, cliprect, state);
-        break;
-    case MOZ_GTK_SPLITTER_VERTICAL:
-        return moz_gtk_hpaned_paint(drawable, rect, cliprect, state);
-        break;
-    case MOZ_GTK_WINDOW:
-        return moz_gtk_window_paint(drawable, rect, cliprect, direction);
-        break;
     default:
         g_warning("Unknown widget type: %d", widget);
     }
@@ -3354,11 +1482,6 @@ void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts)
     if (!parts)
         return;
 
-    if (parts->tooltipWidget) {
-        gtk_widget_destroy(parts->tooltipWidget);
-        parts->tooltipWidget = NULL;
-    }
-
     if (parts->protoWindow) {
         gtk_widget_destroy(parts->protoWindow);
         parts->protoWindow = NULL;
@@ -3372,3 +1495,5 @@ GtkWidget* moz_gtk_get_progress_widget()
     ensure_progress_widget();
     return gParts->progresWidget;
 }
+
+#endif // GTK_API_VERSION_2
diff --git a/WebCore/platform/gtk/gtk3drawing.c b/WebCore/platform/gtk/gtk3drawing.c
new file mode 100644
index 0000000..dda110d
--- /dev/null
+++ b/WebCore/platform/gtk/gtk3drawing.c
@@ -0,0 +1,1416 @@
+/* -*- Mode: C++; tab-width: 4; indent-tabs-mode: nil; c-basic-offset: 4 -*- */
+/* ***** BEGIN LICENSE BLOCK *****
+ * Version: MPL 1.1/GPL 2.0/LGPL 2.1
+ *
+ * The contents of this file are subject to the Mozilla Public License Version
+ * 1.1 (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ * http://www.mozilla.org/MPL/
+ *
+ * Software distributed under the License is distributed on an "AS IS" basis,
+ * WITHOUT WARRANTY OF ANY KIND, either express or implied. See the License
+ * for the specific language governing rights and limitations under the
+ * License.
+ *
+ * The Original Code is mozilla.org code.
+ *
+ * The Initial Developer of the Original Code is
+ * Netscape Communications Corporation.
+ * Portions created by the Initial Developer are Copyright (C) 2002
+ * the Initial Developer. All Rights Reserved.
+ *
+ * Contributor(s):
+ *  Brian Ryner <bryner@brianryner.com>  (Original Author)
+ *  Pierre Chanial <p_ch@verizon.net>
+ *  Michael Ventnor <m.ventnor@gmail.com>
+ *  Alp Toker <alp@nuanti.com>
+ *
+ * Alternatively, the contents of this file may be used under the terms of
+ * either the GNU General Public License Version 2 or later (the "GPL"), or
+ * the GNU Lesser General Public License Version 2.1 or later (the "LGPL"),
+ * in which case the provisions of the GPL or the LGPL are applicable instead
+ * of those above. If you wish to allow use of your version of this file only
+ * under the terms of either the GPL or the LGPL, and not to allow others to
+ * use your version of this file under the terms of the MPL, indicate your
+ * decision by deleting the provisions above and replace them with the notice
+ * and other provisions required by the GPL or the LGPL. If you do not delete
+ * the provisions above, a recipient may use your version of this file under
+ * the terms of any one of the MPL, the GPL or the LGPL.
+ *
+ * ***** END LICENSE BLOCK ***** */
+
+/*
+ * This file contains painting functions for each of the gtk2 widgets.
+ * Adapted from the gtkdrawing.c, and gtk+2.0 source.
+ */
+
+#ifndef GTK_API_VERSION_2
+
+#include <gdk/gdkprivate.h>
+#include "gtkdrawing.h"
+#include "GtkVersioning.h"
+#include <math.h>
+#include <string.h>
+
+#define XTHICKNESS(style) (style->xthickness)
+#define YTHICKNESS(style) (style->ythickness)
+
+static GtkThemeParts *gParts = NULL;
+static style_prop_t style_prop_func;
+static gboolean have_arrow_scaling;
+static gboolean is_initialized;
+
+void
+moz_gtk_use_theme_parts(GtkThemeParts* parts)
+{
+    gParts = parts;
+}
+
+/* Because we have such an unconventional way of drawing widgets, signal to the GTK theme engine
+   that they are drawing for Mozilla instead of a conventional GTK app so they can do any specific
+   things they may want to do. */
+static void
+moz_gtk_set_widget_name(GtkWidget* widget)
+{
+    gtk_widget_set_name(widget, "MozillaGtkWidget");
+}
+
+gint
+moz_gtk_enable_style_props(style_prop_t styleGetProp)
+{
+    style_prop_func = styleGetProp;
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_window_widget()
+{
+    if (!gParts->protoWindow) {
+        gParts->protoWindow = gtk_window_new(GTK_WINDOW_POPUP);
+        gtk_widget_realize(gParts->protoWindow);
+        moz_gtk_set_widget_name(gParts->protoWindow);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+setup_widget_prototype(GtkWidget* widget)
+{
+    ensure_window_widget();
+    if (!gParts->protoLayout) {
+        gParts->protoLayout = gtk_fixed_new();
+        gtk_container_add(GTK_CONTAINER(gParts->protoWindow), gParts->protoLayout);
+    }
+
+    gtk_container_add(GTK_CONTAINER(gParts->protoLayout), widget);
+    gtk_widget_realize(widget);
+    g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_button_widget()
+{
+    if (!gParts->buttonWidget) {
+        gParts->buttonWidget = gtk_button_new_with_label("M");
+        setup_widget_prototype(gParts->buttonWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_toggle_button_widget()
+{
+    if (!gParts->toggleButtonWidget) {
+        gParts->toggleButtonWidget = gtk_toggle_button_new();
+        setup_widget_prototype(gParts->toggleButtonWidget);
+        /* toggle button must be set active to get the right style on hover. */
+        gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(gParts->toggleButtonWidget), TRUE);
+  }
+  return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_button_arrow_widget()
+{
+    if (!gParts->buttonArrowWidget) {
+        ensure_toggle_button_widget();
+
+        gParts->buttonArrowWidget = gtk_arrow_new(GTK_ARROW_DOWN, GTK_SHADOW_OUT);
+        gtk_container_add(GTK_CONTAINER(gParts->toggleButtonWidget), gParts->buttonArrowWidget);
+        gtk_widget_realize(gParts->buttonArrowWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_checkbox_widget()
+{
+    if (!gParts->checkboxWidget) {
+        gParts->checkboxWidget = gtk_check_button_new_with_label("M");
+        setup_widget_prototype(gParts->checkboxWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_radiobutton_widget()
+{
+    if (!gParts->radiobuttonWidget) {
+        gParts->radiobuttonWidget = gtk_radio_button_new_with_label(NULL, "M");
+        setup_widget_prototype(gParts->radiobuttonWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_scrollbar_widget()
+{
+    if (!gParts->vertScrollbarWidget) {
+        gParts->vertScrollbarWidget = gtk_vscrollbar_new(NULL);
+        setup_widget_prototype(gParts->vertScrollbarWidget);
+    }
+    if (!gParts->horizScrollbarWidget) {
+        gParts->horizScrollbarWidget = gtk_hscrollbar_new(NULL);
+        setup_widget_prototype(gParts->horizScrollbarWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_scale_widget()
+{
+  if (!gParts->hScaleWidget) {
+    gParts->hScaleWidget = gtk_hscale_new(NULL);
+    setup_widget_prototype(gParts->hScaleWidget);
+  }
+  if (!gParts->vScaleWidget) {
+    gParts->vScaleWidget = gtk_vscale_new(NULL);
+    setup_widget_prototype(gParts->vScaleWidget);
+  }
+  return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_entry_widget()
+{
+    if (!gParts->entryWidget) {
+        gParts->entryWidget = gtk_entry_new();
+        setup_widget_prototype(gParts->entryWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+/* We need to have pointers to the inner widgets (button, separator, arrow)
+ * of the ComboBox to get the correct rendering from theme engines which
+ * special cases their look. Since the inner layout can change, we ask GTK
+ * to NULL our pointers when they are about to become invalid because the
+ * corresponding widgets don't exist anymore. It's the role of
+ * g_object_add_weak_pointer().
+ * Note that if we don't find the inner widgets (which shouldn't happen), we
+ * fallback to use generic "non-inner" widgets, and they don't need that kind
+ * of weak pointer since they are explicit children of gParts->protoWindow and as
+ * such GTK holds a strong reference to them. */
+static void
+moz_gtk_get_combo_box_inner_button(GtkWidget *widget, gpointer client_data)
+{
+    if (GTK_IS_TOGGLE_BUTTON(widget)) {
+        gParts->comboBoxButtonWidget = widget;
+        g_object_add_weak_pointer(G_OBJECT(widget),
+                                  (gpointer) &gParts->comboBoxButtonWidget);
+        gtk_widget_realize(widget);
+        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
+    }
+}
+
+static void
+moz_gtk_get_combo_box_button_inner_widgets(GtkWidget *widget,
+                                           gpointer client_data)
+{
+    if (GTK_IS_SEPARATOR(widget)) {
+        gParts->comboBoxSeparatorWidget = widget;
+        g_object_add_weak_pointer(G_OBJECT(widget),
+                                  (gpointer) &gParts->comboBoxSeparatorWidget);
+    } else if (GTK_IS_ARROW(widget)) {
+        gParts->comboBoxArrowWidget = widget;
+        g_object_add_weak_pointer(G_OBJECT(widget),
+                                  (gpointer) &gParts->comboBoxArrowWidget);
+    } else
+        return;
+    gtk_widget_realize(widget);
+    g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
+}
+
+static gint
+ensure_combo_box_widgets()
+{
+    GtkWidget* buttonChild;
+
+    if (gParts->comboBoxButtonWidget && gParts->comboBoxArrowWidget)
+        return MOZ_GTK_SUCCESS;
+
+    /* Create a ComboBox if needed */
+    if (!gParts->comboBoxWidget) {
+        gParts->comboBoxWidget = gtk_combo_box_new();
+        setup_widget_prototype(gParts->comboBoxWidget);
+    }
+
+    /* Get its inner Button */
+    gtk_container_forall(GTK_CONTAINER(gParts->comboBoxWidget),
+                         moz_gtk_get_combo_box_inner_button,
+                         NULL);
+
+    if (gParts->comboBoxButtonWidget) {
+        /* Get the widgets inside the Button */
+        buttonChild = gtk_bin_get_child(GTK_BIN(gParts->comboBoxButtonWidget));
+        if (GTK_IS_HBOX(buttonChild)) {
+            /* appears-as-list = FALSE, cell-view = TRUE; the button
+             * contains an hbox. This hbox is there because the ComboBox
+             * needs to place a cell renderer, a separator, and an arrow in
+             * the button when appears-as-list is FALSE. */
+            gtk_container_forall(GTK_CONTAINER(buttonChild),
+                                 moz_gtk_get_combo_box_button_inner_widgets,
+                                 NULL);
+        } else if(GTK_IS_ARROW(buttonChild)) {
+            /* appears-as-list = TRUE, or cell-view = FALSE;
+             * the button only contains an arrow */
+            gParts->comboBoxArrowWidget = buttonChild;
+            g_object_add_weak_pointer(G_OBJECT(buttonChild), (gpointer)
+                                      &gParts->comboBoxArrowWidget);
+            gtk_widget_realize(gParts->comboBoxArrowWidget);
+            g_object_set_data(G_OBJECT(gParts->comboBoxArrowWidget),
+                              "transparent-bg-hint", GINT_TO_POINTER(TRUE));
+        }
+    } else {
+        /* Shouldn't be reached with current internal gtk implementation; we
+         * use a generic toggle button as last resort fallback to avoid
+         * crashing. */
+        ensure_toggle_button_widget();
+        gParts->comboBoxButtonWidget = gParts->toggleButtonWidget;
+    }
+
+    if (!gParts->comboBoxArrowWidget) {
+        /* Shouldn't be reached with current internal gtk implementation;
+         * we gParts->buttonArrowWidget as last resort fallback to avoid
+         * crashing. */
+        ensure_button_arrow_widget();
+        gParts->comboBoxArrowWidget = gParts->buttonArrowWidget;
+    }
+
+    /* We don't test the validity of gParts->comboBoxSeparatorWidget since there
+     * is none when "appears-as-list" = TRUE or "cell-view" = FALSE; if it
+     * is invalid we just won't paint it. */
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_progress_widget()
+{
+    if (!gParts->progresWidget) {
+        gParts->progresWidget = gtk_progress_bar_new();
+        setup_widget_prototype(gParts->progresWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+ensure_scrolled_window_widget()
+{
+    if (!gParts->scrolledWindowWidget) {
+        gParts->scrolledWindowWidget = gtk_scrolled_window_new(NULL, NULL);
+        setup_widget_prototype(gParts->scrolledWindowWidget);
+    }
+    return MOZ_GTK_SUCCESS;
+}
+
+static GtkStateType
+ConvertGtkState(GtkWidgetState* state)
+{
+    if (state->disabled)
+        return GTK_STATE_INSENSITIVE;
+    else if (state->depressed)
+        return (state->inHover ? GTK_STATE_PRELIGHT : GTK_STATE_ACTIVE);
+    else if (state->inHover)
+        return (state->active ? GTK_STATE_ACTIVE : GTK_STATE_PRELIGHT);
+    else
+        return GTK_STATE_NORMAL;
+}
+
+static gint
+moz_gtk_button_paint(cairo_t* cr, GdkRectangle* rect,
+                     GtkWidgetState* state, GtkReliefStyle relief,
+                     GtkWidget* widget, GtkTextDirection direction)
+{
+    GtkShadowType shadow_type;
+    GtkStyle* style = gtk_widget_get_style(widget);
+    GtkStateType button_state = ConvertGtkState(state);
+    gint x = rect->x, y=rect->y, width=rect->width, height=rect->height;
+    GdkWindow* window = gtk_widget_get_window(widget);
+
+    gboolean interior_focus;
+    gint focus_width, focus_pad;
+
+    moz_gtk_widget_get_focus(widget, &interior_focus, &focus_width, &focus_pad);
+
+    if (window && gdk_window_is_visible(window)) {
+        gdk_window_set_background_pattern(window, NULL);
+    }
+
+    gtk_widget_set_state(widget, button_state);
+    gtk_widget_set_direction(widget, direction);
+    gtk_button_set_relief(GTK_BUTTON(widget), relief);
+
+    if (!interior_focus && state->focused) {
+        x += focus_width + focus_pad;
+        y += focus_width + focus_pad;
+        width -= 2 * (focus_width + focus_pad);
+        height -= 2 * (focus_width + focus_pad);
+    }
+
+    shadow_type = button_state == GTK_STATE_ACTIVE ||
+                      state->depressed ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+
+    if (state->isDefault && relief == GTK_RELIEF_NORMAL) {
+        gtk_paint_box(style, cr, button_state, shadow_type,
+                      widget, "buttondefault", x, y, width, height);
+    }
+
+    if (relief != GTK_RELIEF_NONE || state->depressed ||
+           (button_state != GTK_STATE_NORMAL &&
+            button_state != GTK_STATE_INSENSITIVE)) {
+        /* the following line can trigger an assertion (Crux theme)
+           file ../../gdk/gdkwindow.c: line 1846 (gdk_window_clear_area):
+           assertion `GDK_IS_WINDOW (window)' failed */
+        gtk_paint_box(style, cr, button_state, shadow_type,
+                      widget, "button", x, y, width, height);
+    }
+
+    if (state->focused) {
+        if (interior_focus) {
+            GtkStyle* style = gtk_widget_get_style(widget);
+            x += style->xthickness + focus_pad;
+            y += style->ythickness + focus_pad;
+            width -= 2 * (style->xthickness + focus_pad);
+            height -= 2 * (style->ythickness + focus_pad);
+        } else {
+            x -= focus_width + focus_pad;
+            y -= focus_width + focus_pad;
+            width += 2 * (focus_width + focus_pad);
+            height += 2 * (focus_width + focus_pad);
+        }
+
+        gtk_paint_focus(style, cr, button_state,
+                        widget, "button", x, y, width, height);
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_init()
+{
+    GtkWidgetClass *entry_class;
+
+    is_initialized = TRUE;
+    have_arrow_scaling = (gtk_major_version > 2 ||
+                          (gtk_major_version == 2 && gtk_minor_version >= 12));
+
+    /* Add style property to GtkEntry.
+     * Adding the style property to the normal GtkEntry class means that it
+     * will work without issues inside GtkComboBox and for Spinbuttons. */
+    entry_class = g_type_class_ref(GTK_TYPE_ENTRY);
+    gtk_widget_class_install_style_property(entry_class,
+        g_param_spec_boolean("honors-transparent-bg-hint",
+                             "Transparent BG enabling flag",
+                             "If TRUE, the theme is able to draw the GtkEntry on non-prefilled background.",
+                             FALSE,
+                             G_PARAM_READWRITE));
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_checkbox_get_metrics(gint* indicator_size, gint* indicator_spacing)
+{
+    ensure_checkbox_widget();
+
+    gtk_widget_style_get (gParts->checkboxWidget,
+                          "indicator_size", indicator_size,
+                          "indicator_spacing", indicator_spacing,
+                          NULL);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_radio_get_metrics(gint* indicator_size, gint* indicator_spacing)
+{
+    ensure_radiobutton_widget();
+
+    gtk_widget_style_get (gParts->radiobuttonWidget,
+                          "indicator_size", indicator_size,
+                          "indicator_spacing", indicator_spacing,
+                          NULL);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_widget_get_focus(GtkWidget* widget, gboolean* interior_focus,
+                         gint* focus_width, gint* focus_pad)
+{
+    gtk_widget_style_get (widget,
+                          "interior-focus", interior_focus,
+                          "focus-line-width", focus_width,
+                          "focus-padding", focus_pad,
+                          NULL);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_button_get_inner_border(GtkWidget* widget, GtkBorder* inner_border)
+{
+    static const GtkBorder default_inner_border = { 1, 1, 1, 1 };
+    GtkBorder *tmp_border;
+
+    gtk_widget_style_get (widget, "inner-border", &tmp_border, NULL);
+
+    if (tmp_border) {
+        *inner_border = *tmp_border;
+        gtk_border_free(tmp_border);
+    }
+    else
+        *inner_border = default_inner_border;
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_toggle_paint(cairo_t* cr, GdkRectangle* rect,
+                     GtkWidgetState* state, gboolean selected,
+                     gboolean inconsistent, gboolean isradio,
+                     GtkTextDirection direction)
+{
+    GtkStateType state_type = ConvertGtkState(state);
+    GtkShadowType shadow_type = (selected)?GTK_SHADOW_IN:GTK_SHADOW_OUT;
+    gint indicator_size, indicator_spacing;
+    gint x, y, width, height;
+    gint focus_x, focus_y, focus_width, focus_height;
+    GtkWidget *w;
+    GtkStyle *style;
+
+    if (isradio) {
+        moz_gtk_radio_get_metrics(&indicator_size, &indicator_spacing);
+        w = gParts->radiobuttonWidget;
+    } else {
+        moz_gtk_checkbox_get_metrics(&indicator_size, &indicator_spacing);
+        w = gParts->checkboxWidget;
+    }
+
+    // "GetMinimumWidgetSize was ignored"
+    // FIXME: This assert causes a build failure in WebKitGTK+ debug
+    // builds, because it uses 'false' in its definition. We may want
+    // to force this file to be built with g++, by renaming it.
+    // ASSERT(rect->width == indicator_size);
+
+    /*
+     * vertically center in the box, since XUL sometimes ignores our
+     * GetMinimumWidgetSize in the vertical dimension
+     */
+    x = rect->x;
+    y = rect->y + (rect->height - indicator_size) / 2;
+    width = indicator_size;
+    height = indicator_size;
+
+    focus_x = x - indicator_spacing;
+    focus_y = y - indicator_spacing;
+    focus_width = width + 2 * indicator_spacing;
+    focus_height = height + 2 * indicator_spacing;
+
+    style = gtk_widget_get_style(w);
+
+    gtk_widget_set_sensitive(w, !state->disabled);
+    gtk_widget_set_direction(w, direction);
+    gtk_toggle_button_set_active(GTK_TOGGLE_BUTTON(w), selected);
+
+    if (isradio) {
+        gtk_paint_option(style, cr, state_type, shadow_type,
+                         gParts->radiobuttonWidget, "radiobutton", x, y,
+                         width, height);
+        if (state->focused) {
+            gtk_paint_focus(style, cr, GTK_STATE_ACTIVE,
+                            gParts->radiobuttonWidget, "radiobutton", focus_x, focus_y,
+                            focus_width, focus_height);
+        }
+    }
+    else {
+       /*
+        * 'indeterminate' type on checkboxes. In GTK, the shadow type
+        * must also be changed for the state to be drawn.
+        */
+        if (inconsistent) {
+            gtk_toggle_button_set_inconsistent(GTK_TOGGLE_BUTTON(gParts->checkboxWidget), TRUE);
+            shadow_type = GTK_SHADOW_ETCHED_IN;
+        } else {
+            gtk_toggle_button_set_inconsistent(GTK_TOGGLE_BUTTON(gParts->checkboxWidget), FALSE);
+        }
+
+        gtk_paint_check(style, cr, state_type, shadow_type,
+                        gParts->checkboxWidget, "checkbutton", x, y, width, height);
+        if (state->focused) {
+            gtk_paint_focus(style, cr, GTK_STATE_ACTIVE,
+                            gParts->checkboxWidget, "checkbutton", focus_x, focus_y,
+                            focus_width, focus_height);
+        }
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+calculate_button_inner_rect(GtkWidget* button, GdkRectangle* rect,
+                            GdkRectangle* inner_rect,
+                            GtkTextDirection direction,
+                            gboolean ignore_focus)
+{
+    GtkBorder inner_border;
+    gboolean interior_focus;
+    gint focus_width, focus_pad;
+    GtkStyle* style;
+
+    style = gtk_widget_get_style(button);
+
+    /* This mirrors gtkbutton's child positioning */
+    moz_gtk_button_get_inner_border(button, &inner_border);
+    moz_gtk_widget_get_focus(button, &interior_focus,
+                             &focus_width, &focus_pad);
+
+    if (ignore_focus)
+        focus_width = focus_pad = 0;
+
+    inner_rect->x = rect->x + XTHICKNESS(style) + focus_width + focus_pad;
+    inner_rect->x += direction == GTK_TEXT_DIR_LTR ?
+                        inner_border.left : inner_border.right;
+    inner_rect->y = rect->y + inner_border.top + YTHICKNESS(style) +
+                    focus_width + focus_pad;
+    inner_rect->width = MAX(1, rect->width - inner_border.left -
+       inner_border.right - (XTHICKNESS(style) + focus_pad + focus_width) * 2);
+    inner_rect->height = MAX(1, rect->height - inner_border.top -
+       inner_border.bottom - (YTHICKNESS(style) + focus_pad + focus_width) * 2);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+
+static gint
+calculate_arrow_rect(GtkWidget* arrow, GdkRectangle* rect,
+                     GdkRectangle* arrow_rect, GtkTextDirection direction)
+{
+    /* defined in gtkarrow.c */
+    gfloat arrow_scaling = 0.7;
+    gfloat xalign, xpad;
+    gint extent;
+    GtkMisc* misc = GTK_MISC(arrow);
+    gfloat misc_xalign, misc_yalign;
+    gint misc_xpad, misc_ypad;
+
+    if (have_arrow_scaling)
+        gtk_widget_style_get(arrow, "arrow_scaling", &arrow_scaling, NULL);
+
+    gtk_misc_get_padding(misc, &misc_xpad, &misc_ypad);
+    gtk_misc_get_alignment(misc, &misc_xalign, &misc_yalign);
+
+    extent = MIN((rect->width - misc_xpad * 2),
+                 (rect->height - misc_ypad * 2)) * arrow_scaling;
+
+    xalign = direction == GTK_TEXT_DIR_LTR ? misc_xalign : 1.0 - misc_xalign;
+    xpad = misc_xpad + (rect->width - extent) * xalign;
+
+    arrow_rect->x = direction == GTK_TEXT_DIR_LTR ?
+                        floor(rect->x + xpad) : ceil(rect->x + xpad);
+    arrow_rect->y = floor(rect->y + misc_ypad +
+                          ((rect->height - extent) * misc_yalign));
+
+    arrow_rect->width = arrow_rect->height = extent;
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scrolled_window_paint(cairo_t* cr, GdkRectangle* rect,
+                              GtkWidgetState* state)
+{
+    GtkStateType state_type = ConvertGtkState(state);
+    GtkShadowType shadow_type = (state->active) ?  GTK_SHADOW_IN : GTK_SHADOW_OUT;
+    GtkStyle* style;
+    GtkAllocation allocation;
+    GtkWidget* widget;
+
+    ensure_scrolled_window_widget();
+    widget = gParts->scrolledWindowWidget;
+
+    gtk_widget_get_allocation(widget, &allocation);
+    allocation.x = rect->x;
+    allocation.y = rect->y;
+    allocation.width = rect->width;
+    allocation.height = rect->height;
+    gtk_widget_set_allocation(widget, &allocation);
+
+    style = gtk_widget_get_style(widget);
+    gtk_paint_box(style, cr, state_type, shadow_type,
+                  widget, "scrolled_window", rect->x - 1, rect->y - 1,
+                  rect->width + 2, rect->height + 2);
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scrollbar_button_paint(cairo_t* cr, GdkRectangle* rect,
+                               GtkWidgetState* state,
+                               GtkScrollbarButtonFlags flags,
+                               GtkTextDirection direction)
+{
+    GtkStateType state_type = ConvertGtkState(state);
+    GtkShadowType shadow_type = (state->active) ?
+        GTK_SHADOW_IN : GTK_SHADOW_OUT;
+    GdkRectangle arrow_rect;
+    GtkStyle* style;
+    GtkWidget *scrollbar;
+    GtkAllocation allocation;
+    GtkArrowType arrow_type;
+    gint arrow_displacement_x, arrow_displacement_y;
+    const char* detail = (flags & MOZ_GTK_STEPPER_VERTICAL) ?
+                           "vscrollbar" : "hscrollbar";
+
+    ensure_scrollbar_widget();
+
+    if (flags & MOZ_GTK_STEPPER_VERTICAL)
+        scrollbar = gParts->vertScrollbarWidget;
+    else
+        scrollbar = gParts->horizScrollbarWidget;
+
+    gtk_widget_set_direction(scrollbar, direction);
+
+    /* Some theme engines (i.e., ClearLooks) check the scrollbar's allocation
+       to determine where it should paint rounded corners on the buttons.
+       We need to trick them into drawing the buttons the way we want them. */
+
+    gtk_widget_get_allocation(scrollbar, &allocation);
+    allocation.x = rect->x;
+    allocation.y = rect->y;
+    allocation.width = rect->width;
+    allocation.height = rect->height;
+
+    if (flags & MOZ_GTK_STEPPER_VERTICAL) {
+        allocation.height *= 5;
+        if (flags & MOZ_GTK_STEPPER_DOWN) {
+            arrow_type = GTK_ARROW_DOWN;
+            if (flags & MOZ_GTK_STEPPER_BOTTOM)
+                allocation.y -= 4 * rect->height;
+            else
+                allocation.y -= rect->height;
+
+        } else {
+            arrow_type = GTK_ARROW_UP;
+            if (flags & MOZ_GTK_STEPPER_BOTTOM)
+                allocation.y -= 3 * rect->height;
+        }
+    } else {
+        allocation.width *= 5;
+        if (flags & MOZ_GTK_STEPPER_DOWN) {
+            arrow_type = GTK_ARROW_RIGHT;
+            if (flags & MOZ_GTK_STEPPER_BOTTOM)
+                allocation.x -= 4 * rect->width;
+            else
+                allocation.x -= rect->width;
+        } else {
+            arrow_type = GTK_ARROW_LEFT;
+            if (flags & MOZ_GTK_STEPPER_BOTTOM)
+                allocation.x -= 3 * rect->width;
+        }
+    }
+
+    gtk_widget_set_allocation(scrollbar, &allocation);
+    style = gtk_widget_get_style(scrollbar);
+
+    gtk_paint_box(style, cr, state_type, shadow_type,
+                  scrollbar, detail, rect->x, rect->y,
+                  rect->width, rect->height);
+
+    arrow_rect.width = rect->width / 2;
+    arrow_rect.height = rect->height / 2;
+    arrow_rect.x = rect->x + (rect->width - arrow_rect.width) / 2;
+    arrow_rect.y = rect->y + (rect->height - arrow_rect.height) / 2;
+
+    if (state_type == GTK_STATE_ACTIVE) {
+        gtk_widget_style_get(scrollbar,
+                             "arrow-displacement-x", &arrow_displacement_x,
+                             "arrow-displacement-y", &arrow_displacement_y,
+                             NULL);
+
+        arrow_rect.x += arrow_displacement_x;
+        arrow_rect.y += arrow_displacement_y;
+    }
+
+    gtk_paint_arrow(style, cr, state_type, shadow_type,
+                    scrollbar, detail, arrow_type, TRUE, arrow_rect.x,
+                    arrow_rect.y, arrow_rect.width, arrow_rect.height);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scrollbar_trough_paint(GtkThemeWidgetType widget,
+                               cairo_t* cr, GdkRectangle* rect,
+                               GtkWidgetState* state,
+                               GtkTextDirection direction)
+{
+    GtkStyle* style;
+    GtkScrollbar *scrollbar;
+
+    ensure_scrollbar_widget();
+
+    if (widget ==  MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL)
+        scrollbar = GTK_SCROLLBAR(gParts->horizScrollbarWidget);
+    else
+        scrollbar = GTK_SCROLLBAR(gParts->vertScrollbarWidget);
+
+    gtk_widget_set_direction(GTK_WIDGET(scrollbar), direction);
+
+    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
+
+    gtk_paint_box(style, cr, GTK_STATE_ACTIVE, GTK_SHADOW_IN,
+                  GTK_WIDGET(scrollbar), "trough", rect->x, rect->y,
+                  rect->width, rect->height);
+
+    if (state->focused) {
+        gtk_paint_focus(style, cr, GTK_STATE_ACTIVE,
+                        GTK_WIDGET(scrollbar), "trough",
+                        rect->x, rect->y, rect->width, rect->height);
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scrollbar_thumb_paint(GtkThemeWidgetType widget,
+                              cairo_t* cr, GdkRectangle* rect,
+                              GtkWidgetState* state,
+                              GtkTextDirection direction)
+{
+    GtkStateType state_type = (state->inHover || state->active) ?
+        GTK_STATE_PRELIGHT : GTK_STATE_NORMAL;
+    GtkShadowType shadow_type = GTK_SHADOW_OUT;
+    GtkStyle* style;
+    GtkScrollbar *scrollbar;
+    GtkAdjustment *adj;
+
+    ensure_scrollbar_widget();
+
+    if (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL)
+        scrollbar = GTK_SCROLLBAR(gParts->horizScrollbarWidget);
+    else
+        scrollbar = GTK_SCROLLBAR(gParts->vertScrollbarWidget);
+
+    gtk_widget_set_direction(GTK_WIDGET(scrollbar), direction);
+
+    /* Make sure to set the scrollbar range before painting so that
+       everything is drawn properly.  At least the bluecurve (and
+       maybe other) themes don't draw the top or bottom black line
+       surrounding the scrollbar if the theme thinks that it's butted
+       up against the scrollbar arrows.  Note the increases of the
+       clip rect below. */
+    adj = gtk_range_get_adjustment(GTK_RANGE(scrollbar));
+
+    if (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL) {
+        gtk_adjustment_set_page_size(adj, rect->width);
+    }
+    else {
+        gtk_adjustment_set_page_size(adj, rect->height);
+    }
+
+    gtk_adjustment_configure(adj,
+                             state->curpos,
+                             0,
+                             state->maxpos,
+                             gtk_adjustment_get_step_increment(adj),
+                             gtk_adjustment_get_page_increment(adj),
+                             gtk_adjustment_get_page_size(adj));
+
+    style = gtk_widget_get_style(GTK_WIDGET(scrollbar));
+
+    gtk_paint_slider(style, cr, state_type, shadow_type,
+                     GTK_WIDGET(scrollbar), "slider", rect->x, rect->y,
+                     rect->width,  rect->height,
+                     (widget == MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL) ?
+                     GTK_ORIENTATION_HORIZONTAL : GTK_ORIENTATION_VERTICAL);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scale_paint(cairo_t* cr, GdkRectangle* rect,
+                    GtkWidgetState* state, GtkOrientation flags,
+                    GtkTextDirection direction)
+{
+  gint x = 0, y = 0;
+  GtkStateType state_type = ConvertGtkState(state);
+  GtkStyle* style;
+  GtkWidget* widget;
+
+  ensure_scale_widget();
+  widget = ((flags == GTK_ORIENTATION_HORIZONTAL) ? gParts->hScaleWidget : gParts->vScaleWidget);
+  gtk_widget_set_direction(widget, direction);
+
+  style = gtk_widget_get_style(widget);
+
+  if (flags == GTK_ORIENTATION_HORIZONTAL) {
+    x = XTHICKNESS(style);
+    y++;
+  }
+  else {
+    x++;
+    y = YTHICKNESS(style);
+  }
+
+  gtk_style_apply_default_background(style, cr, gtk_widget_get_window (widget),
+                                     GTK_STATE_NORMAL,
+                                     rect->x, rect->y,
+                                     rect->width, rect->height);
+
+  gtk_paint_box(style, cr, GTK_STATE_ACTIVE, GTK_SHADOW_IN,
+                widget, "trough", rect->x + x, rect->y + y,
+                rect->width - 2*x, rect->height - 2*y);
+
+  if (state->focused)
+    gtk_paint_focus(style, cr, state_type, widget, "trough",
+                    rect->x, rect->y, rect->width, rect->height);
+
+  return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_scale_thumb_paint(cairo_t* cr, GdkRectangle* rect,
+                          GtkWidgetState* state, GtkOrientation flags,
+                          GtkTextDirection direction)
+{
+  GtkStateType state_type = ConvertGtkState(state);
+  GtkStyle* style;
+  GtkWidget* widget;
+  gint thumb_width, thumb_height, x, y;
+
+  ensure_scale_widget();
+  widget = ((flags == GTK_ORIENTATION_HORIZONTAL) ? gParts->hScaleWidget : gParts->vScaleWidget);
+  gtk_widget_set_direction(widget, direction);
+
+  style = gtk_widget_get_style(widget);
+
+  /* determine the thumb size, and position the thumb in the center in the opposite axis */
+  if (flags == GTK_ORIENTATION_HORIZONTAL) {
+    moz_gtk_get_scalethumb_metrics(GTK_ORIENTATION_HORIZONTAL, &thumb_width, &thumb_height);
+    x = rect->x;
+    y = rect->y + (rect->height - thumb_height) / 2;
+  }
+  else {
+    moz_gtk_get_scalethumb_metrics(GTK_ORIENTATION_VERTICAL, &thumb_height, &thumb_width);
+    x = rect->x + (rect->width - thumb_width) / 2;
+    y = rect->y;
+  }
+
+  gtk_paint_slider(style, cr, state_type, GTK_SHADOW_OUT,
+                   widget, (flags == GTK_ORIENTATION_HORIZONTAL) ? "hscale" : "vscale",
+                   x, y, thumb_width, thumb_height, flags);
+
+  return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_entry_paint(cairo_t* cr, GdkRectangle* rect,
+                    GtkWidgetState* state, GtkWidget* widget,
+                    GtkTextDirection direction)
+{
+    GtkStateType bg_state = state->disabled ?
+                                GTK_STATE_INSENSITIVE : GTK_STATE_NORMAL;
+    gint x, y, width = rect->width, height = rect->height;
+    GtkStyle* style;
+    gboolean interior_focus;
+    gboolean theme_honors_transparency = FALSE;
+    gint focus_width;
+
+    gtk_widget_set_direction(widget, direction);
+
+    style = gtk_widget_get_style(widget);
+
+    gtk_widget_style_get(widget,
+                         "interior-focus", &interior_focus,
+                         "focus-line-width", &focus_width,
+                         "honors-transparent-bg-hint", &theme_honors_transparency,
+                         NULL);
+
+    /* gtkentry.c uses two windows, one for the entire widget and one for the
+     * text area inside it. The background of both windows is set to the "base"
+     * color of the new state in gtk_entry_state_changed, but only the inner
+     * textarea window uses gtk_paint_flat_box when exposed */
+
+    /* This gets us a lovely greyish disabledish look */
+    gtk_widget_set_sensitive(widget, !state->disabled);
+
+    /* GTK fills the outer widget window with the base color before drawing the widget.
+     * Some older themes rely on this behavior, but many themes nowadays use rounded
+     * corners on their widgets. While most GTK apps are blissfully unaware of this
+     * problem due to their use of the default window background, we render widgets on
+     * many kinds of backgrounds on the web.
+     * If the theme is able to cope with transparency, then we can skip pre-filling
+     * and notify the theme it will paint directly on the canvas. */
+    if (theme_honors_transparency) {
+        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(TRUE));
+    } else {
+        cairo_save(cr);
+        gdk_cairo_set_source_color(cr, (const GdkColor*)&style->base[bg_state]);
+        cairo_pattern_set_extend(cairo_get_source(cr), CAIRO_EXTEND_REPEAT);
+        cairo_fill(cr);
+        cairo_restore(cr);
+        g_object_set_data(G_OBJECT(widget), "transparent-bg-hint", GINT_TO_POINTER(FALSE));
+    }
+
+    /* Get the position of the inner window, see _gtk_entry_get_borders */
+    x = XTHICKNESS(style);
+    y = YTHICKNESS(style);
+
+    if (!interior_focus) {
+        x += focus_width;
+        y += focus_width;
+    }
+
+    /* Simulate an expose of the inner window */
+    gtk_paint_flat_box(style, cr, bg_state, GTK_SHADOW_NONE,
+                       widget, "entry_bg",  rect->x + x,
+                       rect->y + y, rect->width - 2*x, rect->height - 2*y);
+
+    /* Now paint the shadow and focus border.
+     * We do like in gtk_entry_draw_frame, we first draw the shadow, a tad
+     * smaller when focused if the focus is not interior, then the focus. */
+    x = rect->x;
+    y = rect->y;
+
+    if (state->focused && !state->disabled) {
+        /* This will get us the lit borders that focused textboxes enjoy on
+         * some themes. */
+        if (!interior_focus) {
+            /* Indent the border a little bit if we have exterior focus
+               (this is what GTK does to draw native entries) */
+            x += focus_width;
+            y += focus_width;
+            width -= 2 * focus_width;
+            height -= 2 * focus_width;
+        }
+    }
+
+    gtk_paint_shadow(style, cr, GTK_STATE_NORMAL, GTK_SHADOW_IN,
+                     widget, "entry", x, y, width, height);
+
+    if (state->focused && !state->disabled) {
+        if (!interior_focus) {
+            gtk_paint_focus(style, cr,  GTK_STATE_NORMAL,
+                            widget, "entry",
+                            rect->x, rect->y, rect->width, rect->height);
+        }
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_combo_box_paint(cairo_t* cr, GdkRectangle* rect,
+                        GtkWidgetState* state, gboolean ishtml,
+                        GtkTextDirection direction)
+{
+    GdkRectangle arrow_rect, real_arrow_rect;
+    gint /* arrow_size, */ separator_width;
+    gboolean wide_separators;
+    GtkStateType state_type = ConvertGtkState(state);
+    GtkShadowType shadow_type = state->active ? GTK_SHADOW_IN : GTK_SHADOW_OUT;
+    GtkStyle* style;
+    GtkRequisition arrow_req;
+
+    ensure_combo_box_widgets();
+
+    /* Also sets the direction on gParts->comboBoxButtonWidget, which is then
+     * inherited by the separator and arrow */
+    moz_gtk_button_paint(cr, rect, state, GTK_RELIEF_NORMAL,
+                         gParts->comboBoxButtonWidget, direction);
+
+    calculate_button_inner_rect(gParts->comboBoxButtonWidget,
+                                rect, &arrow_rect, direction, ishtml);
+    /* Now arrow_rect contains the inner rect ; we want to correct the width
+     * to what the arrow needs (see gtk_combo_box_size_allocate) */
+    gtk_widget_get_preferred_size(gParts->comboBoxArrowWidget, &arrow_req, NULL);
+    if (direction == GTK_TEXT_DIR_LTR)
+        arrow_rect.x += arrow_rect.width - arrow_req.width;
+    arrow_rect.width = arrow_req.width;
+
+    calculate_arrow_rect(gParts->comboBoxArrowWidget,
+                         &arrow_rect, &real_arrow_rect, direction);
+
+    style = gtk_widget_get_style(gParts->comboBoxArrowWidget);
+
+    gtk_widget_size_allocate(gParts->comboBoxWidget, rect);
+
+    gtk_paint_arrow(style, cr, state_type, shadow_type,
+                    gParts->comboBoxArrowWidget, "arrow",  GTK_ARROW_DOWN, TRUE,
+                    real_arrow_rect.x, real_arrow_rect.y,
+                    real_arrow_rect.width, real_arrow_rect.height);
+
+
+    /* If there is no separator in the theme, there's nothing left to do. */
+    if (!gParts->comboBoxSeparatorWidget)
+        return MOZ_GTK_SUCCESS;
+
+    style = gtk_widget_get_style(gParts->comboBoxSeparatorWidget);
+
+    gtk_widget_style_get(gParts->comboBoxSeparatorWidget,
+                         "wide-separators", &wide_separators,
+                         "separator-width", &separator_width,
+                         NULL);
+
+    if (wide_separators) {
+        if (direction == GTK_TEXT_DIR_LTR)
+            arrow_rect.x -= separator_width;
+        else
+            arrow_rect.x += arrow_rect.width;
+
+        gtk_paint_box(style, cr,
+                      GTK_STATE_NORMAL, GTK_SHADOW_ETCHED_OUT,
+                      gParts->comboBoxSeparatorWidget, "vseparator",
+                      arrow_rect.x, arrow_rect.y,
+                      separator_width, arrow_rect.height);
+    } else {
+        if (direction == GTK_TEXT_DIR_LTR)
+            arrow_rect.x -= XTHICKNESS(style);
+        else
+            arrow_rect.x += arrow_rect.width;
+
+        gtk_paint_vline(style, cr, GTK_STATE_NORMAL,
+                        gParts->comboBoxSeparatorWidget, "vseparator",
+                        arrow_rect.y, arrow_rect.y + arrow_rect.height,
+                        arrow_rect.x);
+    }
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_progressbar_paint(cairo_t* cr, GdkRectangle* rect,
+                          GtkTextDirection direction)
+{
+    GtkStyle* style;
+
+    ensure_progress_widget();
+    gtk_widget_set_direction(gParts->progresWidget, direction);
+
+    style = gtk_widget_get_style(gParts->progresWidget);
+
+    gtk_paint_box(style, cr, GTK_STATE_NORMAL, GTK_SHADOW_IN,
+                  gParts->progresWidget, "trough", rect->x, rect->y,
+                  rect->width, rect->height);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+static gint
+moz_gtk_progress_chunk_paint(cairo_t* cr, GdkRectangle* rect,
+                             GtkTextDirection direction)
+{
+    GtkStyle* style;
+
+    ensure_progress_widget();
+    gtk_widget_set_direction(gParts->progresWidget, direction);
+
+    style = gtk_widget_get_style(gParts->progresWidget);
+
+    gtk_paint_box(style, cr, GTK_STATE_PRELIGHT, GTK_SHADOW_OUT,
+                  gParts->progresWidget, "bar", rect->x, rect->y,
+                  rect->width, rect->height);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_get_widget_border(GtkThemeWidgetType widget, gint* left, gint* top,
+                          gint* right, gint* bottom, GtkTextDirection direction,
+                          gboolean inhtml)
+{
+    GtkWidget* w;
+    GtkStyle *style;
+
+    switch (widget) {
+    case MOZ_GTK_BUTTON:
+        {
+            GtkBorder inner_border;
+            gboolean interior_focus;
+            gint focus_width, focus_pad;
+            GtkStyle *style;
+
+            ensure_button_widget();
+            *left = *top = *right = *bottom = gtk_container_get_border_width(GTK_CONTAINER(gParts->buttonWidget));
+
+            /* Don't add this padding in HTML, otherwise the buttons will
+               become too big and stuff the layout. */
+            if (!inhtml) {
+                moz_gtk_widget_get_focus(gParts->buttonWidget, &interior_focus, &focus_width, &focus_pad);
+                moz_gtk_button_get_inner_border(gParts->buttonWidget, &inner_border);
+                *left += focus_width + focus_pad + inner_border.left;
+                *right += focus_width + focus_pad + inner_border.right;
+                *top += focus_width + focus_pad + inner_border.top;
+                *bottom += focus_width + focus_pad + inner_border.bottom;
+            }
+
+            style = gtk_widget_get_style(gParts->buttonWidget);
+            *left += style->xthickness;
+            *right += style->xthickness;
+            *top += style->ythickness;
+            *bottom += style->ythickness;
+            return MOZ_GTK_SUCCESS;
+        }
+    case MOZ_GTK_ENTRY:
+        ensure_entry_widget();
+        w = gParts->entryWidget;
+        break;
+    case MOZ_GTK_DROPDOWN:
+        {
+            /* We need to account for the arrow on the dropdown, so text
+             * doesn't come too close to the arrow, or in some cases spill
+             * into the arrow. */
+            gboolean ignored_interior_focus, wide_separators;
+            gint focus_width, focus_pad, separator_width;
+            GtkRequisition arrow_req;
+            GtkStyle* style;
+
+            ensure_combo_box_widgets();
+
+            *left = gtk_container_get_border_width(GTK_CONTAINER(gParts->comboBoxButtonWidget));
+
+            if (!inhtml) {
+                moz_gtk_widget_get_focus(gParts->comboBoxButtonWidget,
+                                         &ignored_interior_focus,
+                                         &focus_width, &focus_pad);
+                *left += focus_width + focus_pad;
+            }
+
+            style = gtk_widget_get_style(gParts->comboBoxButtonWidget);
+            *top = *left + style->ythickness;
+            *left += style->xthickness;
+
+            *right = *left; *bottom = *top;
+
+            /* If there is no separator, don't try to count its width. */
+            separator_width = 0;
+            if (gParts->comboBoxSeparatorWidget) {
+                gtk_widget_style_get(gParts->comboBoxSeparatorWidget,
+                                     "wide-separators", &wide_separators,
+                                     "separator-width", &separator_width,
+                                     NULL);
+
+                if (!wide_separators)
+                    separator_width =
+                        XTHICKNESS(style);
+            }
+
+            gtk_widget_get_preferred_size(gParts->comboBoxArrowWidget, &arrow_req, NULL);
+            if (direction == GTK_TEXT_DIR_RTL)
+                *left += separator_width + arrow_req.width;
+            else
+                *right += separator_width + arrow_req.width;
+
+            return MOZ_GTK_SUCCESS;
+        }
+    case MOZ_GTK_PROGRESSBAR:
+        ensure_progress_widget();
+        w = gParts->progresWidget;
+        break;
+    case MOZ_GTK_SCALE_HORIZONTAL:
+        ensure_scale_widget();
+        w = gParts->hScaleWidget;
+        break;
+    case MOZ_GTK_SCALE_VERTICAL:
+        ensure_scale_widget();
+        w = gParts->vScaleWidget;
+        break;
+    /* These widgets have no borders, since they are not containers. */
+    case MOZ_GTK_CHECKBUTTON:
+    case MOZ_GTK_RADIOBUTTON:
+    case MOZ_GTK_SCROLLBAR_BUTTON:
+    case MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_TRACK_VERTICAL:
+    case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
+    case MOZ_GTK_SCALE_THUMB_HORIZONTAL:
+    case MOZ_GTK_SCALE_THUMB_VERTICAL:
+    case MOZ_GTK_PROGRESS_CHUNK:
+        *left = *top = *right = *bottom = 0;
+        return MOZ_GTK_SUCCESS;
+    default:
+        g_warning("Unsupported widget type: %d", widget);
+        return MOZ_GTK_UNKNOWN_WIDGET;
+    }
+
+    style = gtk_widget_get_style(w);
+    *right = *left = XTHICKNESS(style);
+    *bottom = *top = YTHICKNESS(style);
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_get_scalethumb_metrics(GtkOrientation orient, gint* thumb_length, gint* thumb_height)
+{
+  GtkWidget* widget;
+
+  ensure_scale_widget();
+  widget = ((orient == GTK_ORIENTATION_HORIZONTAL) ? gParts->hScaleWidget : gParts->vScaleWidget);
+
+  gtk_widget_style_get (widget,
+                        "slider_length", thumb_length,
+                        "slider_width", thumb_height,
+                        NULL);
+
+  return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics *metrics)
+{
+    ensure_scrollbar_widget();
+
+    gtk_widget_style_get (gParts->horizScrollbarWidget,
+                          "slider_width", &metrics->slider_width,
+                          "trough_border", &metrics->trough_border,
+                          "stepper_size", &metrics->stepper_size,
+                          "stepper_spacing", &metrics->stepper_spacing,
+                          "trough_under_steppers", &metrics->trough_under_steppers,
+                          "has_secondary_forward_stepper", &metrics->has_secondary_forward_stepper,
+                          "has_secondary_backward_stepper", &metrics->has_secondary_backward_stepper,
+                          NULL);
+
+    metrics->min_slider_size = gtk_range_get_min_slider_size(GTK_RANGE(gParts->horizScrollbarWidget));
+
+    return MOZ_GTK_SUCCESS;
+}
+
+gint
+moz_gtk_widget_paint(GtkThemeWidgetType widget, cairo_t* cr,
+                     GdkRectangle* rect, GtkWidgetState* state,
+                     gint flags, GtkTextDirection direction)
+{
+    switch (widget) {
+    case MOZ_GTK_BUTTON:
+        if (state->depressed) {
+            ensure_toggle_button_widget();
+            return moz_gtk_button_paint(cr, rect, state,
+                                        (GtkReliefStyle) flags,
+                                        gParts->toggleButtonWidget, direction);
+        }
+        ensure_button_widget();
+        return moz_gtk_button_paint(cr, rect, state,
+                                    (GtkReliefStyle) flags, gParts->buttonWidget,
+                                    direction);
+        break;
+    case MOZ_GTK_CHECKBUTTON:
+    case MOZ_GTK_RADIOBUTTON:
+        return moz_gtk_toggle_paint(cr, rect, state,
+                                    !!(flags & MOZ_GTK_WIDGET_CHECKED),
+                                    !!(flags & MOZ_GTK_WIDGET_INCONSISTENT),
+                                    (widget == MOZ_GTK_RADIOBUTTON),
+                                    direction);
+        break;
+    case MOZ_GTK_SCROLLBAR_BUTTON:
+        return moz_gtk_scrollbar_button_paint(cr, rect, state,
+                                              (GtkScrollbarButtonFlags) flags,
+                                              direction);
+        break;
+    case MOZ_GTK_SCROLLBAR_TRACK_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_TRACK_VERTICAL:
+        return moz_gtk_scrollbar_trough_paint(widget, cr, rect,
+                                              state, direction);
+        break;
+    case MOZ_GTK_SCROLLBAR_THUMB_HORIZONTAL:
+    case MOZ_GTK_SCROLLBAR_THUMB_VERTICAL:
+        return moz_gtk_scrollbar_thumb_paint(widget, cr, rect,
+                                             state, direction);
+        break;
+    case MOZ_GTK_SCROLLED_WINDOW:
+        return moz_gtk_scrolled_window_paint(cr, rect, state);
+        break;
+    case MOZ_GTK_SCALE_HORIZONTAL:
+    case MOZ_GTK_SCALE_VERTICAL:
+        return moz_gtk_scale_paint(cr, rect, state,
+                                   (GtkOrientation) flags, direction);
+        break;
+    case MOZ_GTK_SCALE_THUMB_HORIZONTAL:
+    case MOZ_GTK_SCALE_THUMB_VERTICAL:
+        return moz_gtk_scale_thumb_paint(cr, rect, state,
+                                         (GtkOrientation) flags, direction);
+        break;
+    case MOZ_GTK_ENTRY:
+        ensure_entry_widget();
+        return moz_gtk_entry_paint(cr, rect, state,
+                                   gParts->entryWidget, direction);
+        break;
+    case MOZ_GTK_DROPDOWN:
+        return moz_gtk_combo_box_paint(cr, rect, state,
+                                       (gboolean) flags, direction);
+        break;
+    case MOZ_GTK_PROGRESSBAR:
+        return moz_gtk_progressbar_paint(cr, rect, direction);
+        break;
+    case MOZ_GTK_PROGRESS_CHUNK:
+        return moz_gtk_progress_chunk_paint(cr, rect, direction);
+        break;
+    default:
+        g_warning("Unknown widget type: %d", widget);
+    }
+
+    return MOZ_GTK_UNKNOWN_WIDGET;
+}
+
+GtkWidget* moz_gtk_get_scrollbar_widget(void)
+{
+    if (!is_initialized)
+        return NULL;
+    ensure_scrollbar_widget();
+    return gParts->horizScrollbarWidget;
+}
+
+gint
+moz_gtk_shutdown()
+{
+    GtkWidgetClass *entry_class;
+    entry_class = g_type_class_peek(GTK_TYPE_ENTRY);
+    g_type_class_unref(entry_class);
+
+    is_initialized = FALSE;
+
+    return MOZ_GTK_SUCCESS;
+}
+
+void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts)
+{
+    if (!parts)
+        return;
+
+    if (parts->protoWindow) {
+        gtk_widget_destroy(parts->protoWindow);
+        parts->protoWindow = NULL;
+    }
+}
+
+GtkWidget* moz_gtk_get_progress_widget()
+{
+    if (!is_initialized)
+        return NULL;
+    ensure_progress_widget();
+    return gParts->progresWidget;
+}
+
+#endif // GTK_API_VERSION_2
diff --git a/WebCore/platform/gtk/gtkdrawing.h b/WebCore/platform/gtk/gtkdrawing.h
index c00da97..a981543 100644
--- a/WebCore/platform/gtk/gtkdrawing.h
+++ b/WebCore/platform/gtk/gtkdrawing.h
@@ -81,7 +81,9 @@ typedef struct {
 } MozGtkScrollbarMetrics;
 
 typedef struct _GtkThemeParts {
+#ifdef GTK_API_VERSION_2
     GdkColormap* colormap;
+#endif // GTK_API_VERSION_2
     GtkWidget* protoWindow;
     GtkWidget* protoLayout;
     GtkWidget* buttonWidget;
@@ -91,7 +93,6 @@ typedef struct _GtkThemeParts {
     GtkWidget* radiobuttonWidget;
     GtkWidget* horizScrollbarWidget;
     GtkWidget* vertScrollbarWidget;
-    GtkWidget* spinWidget;
     GtkWidget* hScaleWidget;
     GtkWidget* vScaleWidget;
     GtkWidget* entryWidget;
@@ -103,28 +104,7 @@ typedef struct _GtkThemeParts {
     GtkWidget* comboBoxEntryTextareaWidget;
     GtkWidget* comboBoxEntryButtonWidget;
     GtkWidget* comboBoxEntryArrowWidget;
-    GtkWidget* handleBoxWidget;
-    GtkWidget* toolbarWidget;
-    GtkWidget* frameWidget;
-    GtkWidget* statusbarWidget;
     GtkWidget* progresWidget;
-    GtkWidget* tabWidget;
-    GtkWidget* tooltipWidget;
-    GtkWidget* menuBarWidget;
-    GtkWidget* menuBarItemWidget;
-    GtkWidget* menuPopupWidget;
-    GtkWidget* menuItemWidget;
-    GtkWidget* imageMenuItemWidget;
-    GtkWidget* checkMenuItemWidget;
-    GtkWidget* treeViewWidget;
-    GtkTreeViewColumn* middleTreeViewColumn;
-    GtkWidget* treeHeaderCellWidget;
-    GtkWidget* treeHeaderSortArrowWidget;
-    GtkWidget* expanderWidget;
-    GtkWidget* toolbarSeparatorWidget;
-    GtkWidget* menuSeparatorWidget;
-    GtkWidget* hpanedWidget;
-    GtkWidget* vpanedWidget;
     GtkWidget* scrolledWindowWidget;
 } GtkThemeParts;
 
@@ -134,24 +114,6 @@ typedef enum {
   MOZ_GTK_STEPPER_VERTICAL    = 1 << 2
 } GtkScrollbarButtonFlags;
 
-/** flags for tab state **/
-typedef enum {
-  /* first eight bits are used to pass a margin */
-  MOZ_GTK_TAB_MARGIN_MASK     = 0xFF,
-  /* bottom tabs */
-  MOZ_GTK_TAB_BOTTOM          = 1 << 8,
-  /* the first tab in the group */
-  MOZ_GTK_TAB_FIRST           = 1 << 9,
-  /* the selected tab */
-  MOZ_GTK_TAB_SELECTED        = 1 << 10
-} GtkTabFlags;
-
-/** flags for menuitems **/
-typedef enum {
-  /* menuitem is part of the menubar */
-  MOZ_TOPLEVEL_MENU_ITEM      = 1 << 0
-} GtkMenuItemFlags;
-
 /* function type for moz_gtk_enable_style_props */
 typedef gint (*style_prop_t)(GtkStyle*, const gchar*, gint);
 
@@ -191,80 +153,13 @@ typedef enum {
   /* Paints a GtkScale thumb. */
   MOZ_GTK_SCALE_THUMB_HORIZONTAL,
   MOZ_GTK_SCALE_THUMB_VERTICAL,
-  /* Paints a GtkSpinButton */
-  MOZ_GTK_SPINBUTTON,
-  MOZ_GTK_SPINBUTTON_UP,
-  MOZ_GTK_SPINBUTTON_DOWN,
-  MOZ_GTK_SPINBUTTON_ENTRY,
-  /* Paints the gripper of a GtkHandleBox. */
-  MOZ_GTK_GRIPPER,
-  /* Paints a GtkEntry. */
   MOZ_GTK_ENTRY,
-  /* Paints the native caret (or in GTK-speak: insertion cursor) */
-  MOZ_GTK_ENTRY_CARET,
   /* Paints a GtkOptionMenu. */
   MOZ_GTK_DROPDOWN,
-  /* Paints a dropdown arrow (a GtkButton containing a down GtkArrow). */
-  MOZ_GTK_DROPDOWN_ARROW,
-  /* Paints an entry in an editable option menu */
-  MOZ_GTK_DROPDOWN_ENTRY,
-  /* Paints the container part of a GtkCheckButton. */
-  MOZ_GTK_CHECKBUTTON_CONTAINER,
-  /* Paints the container part of a GtkRadioButton. */
-  MOZ_GTK_RADIOBUTTON_CONTAINER,
-  /* Paints the label of a GtkCheckButton (focus outline) */
-  MOZ_GTK_CHECKBUTTON_LABEL,
-  /* Paints the label of a GtkRadioButton (focus outline) */
-  MOZ_GTK_RADIOBUTTON_LABEL,
-  /* Paints the background of a GtkHandleBox. */
-  MOZ_GTK_TOOLBAR,
-  /* Paints a toolbar separator */
-  MOZ_GTK_TOOLBAR_SEPARATOR,
-  /* Paints a GtkToolTip */
-  MOZ_GTK_TOOLTIP,
-  /* Paints a GtkFrame (e.g. a status bar panel). */
-  MOZ_GTK_FRAME,
-  /* Paints a resize grip for a GtkWindow */
-  MOZ_GTK_RESIZER,
   /* Paints a GtkProgressBar. */
   MOZ_GTK_PROGRESSBAR,
   /* Paints a progress chunk of a GtkProgressBar. */
-  MOZ_GTK_PROGRESS_CHUNK,
-  /* Paints a tab of a GtkNotebook. flags is a GtkTabFlags, defined above. */
-  MOZ_GTK_TAB,
-  /* Paints the background and border of a GtkNotebook. */
-  MOZ_GTK_TABPANELS,
-  /* Paints a GtkArrow for a GtkNotebook. flags is a GtkArrowType. */
-  MOZ_GTK_TAB_SCROLLARROW,
-  /* Paints the background and border of a GtkTreeView */
-  MOZ_GTK_TREEVIEW,
-  /* Paints treeheader cells */
-  MOZ_GTK_TREE_HEADER_CELL,
-  /* Paints sort arrows in treeheader cells */
-  MOZ_GTK_TREE_HEADER_SORTARROW,
-  /* Paints an expander for a GtkTreeView */
-  MOZ_GTK_TREEVIEW_EXPANDER,
-  /* Paints a GtkExpander */
-  MOZ_GTK_EXPANDER,
-  /* Paints the background of the menu bar. */
-  MOZ_GTK_MENUBAR,
-  /* Paints the background of menus, context menus. */
-  MOZ_GTK_MENUPOPUP,
-  /* Paints the arrow of menuitems that contain submenus */
-  MOZ_GTK_MENUARROW,
-  /* Paints an arrow that points down */
-  MOZ_GTK_TOOLBARBUTTON_ARROW,
-  /* Paints items of menubar and popups. */
-  MOZ_GTK_MENUITEM,
-  MOZ_GTK_CHECKMENUITEM,
-  MOZ_GTK_RADIOMENUITEM,
-  MOZ_GTK_MENUSEPARATOR,
-  /* Paints a GtkVPaned separator */
-  MOZ_GTK_SPLITTER_HORIZONTAL,
-  /* Paints a GtkHPaned separator */
-  MOZ_GTK_SPLITTER_VERTICAL,
-  /* Paints the background of a window, dialog or page. */
-  MOZ_GTK_WINDOW
+  MOZ_GTK_PROGRESS_CHUNK
 } GtkThemeWidgetType;
 
 /*** General library functions ***/
@@ -318,12 +213,18 @@ void moz_gtk_destroy_theme_parts_widgets(GtkThemeParts* parts);
  * flags:     widget-dependant flags; see the GtkThemeWidgetType definition.
  * direction: the text direction, to draw the widget correctly LTR and RTL.
  */
+#ifdef GTK_API_VERSION_2
 gint
 moz_gtk_widget_paint(GtkThemeWidgetType widget, GdkDrawable* drawable,
                      GdkRectangle* rect, GdkRectangle* cliprect,
                      GtkWidgetState* state, gint flags,
                      GtkTextDirection direction);
-
+#else
+gint
+moz_gtk_widget_paint(GtkThemeWidgetType widget, cairo_t* cr,
+                     GdkRectangle* rect, GtkWidgetState* state,
+                     gint flags, GtkTextDirection direction);
+#endif
 
 /*** Widget metrics ***/
 /**
@@ -362,16 +263,6 @@ moz_gtk_checkbox_get_metrics(gint* indicator_size, gint* indicator_spacing);
 gint
 moz_gtk_radio_get_metrics(gint* indicator_size, gint* indicator_spacing);
 
-/**
- * Get the inner-border value for a GtkButton widget (button or tree header)
- * widget:             [IN]  the widget to get the border value for 
- * inner_border:       [OUT] the inner border
- *
- * returns:   MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint
-moz_gtk_button_get_inner_border(GtkWidget* widget, GtkBorder* inner_border);
-
 /** Get the focus metrics for a treeheadercell, button, checkbox, or radio button.
  * widget:             [IN]  the widget to get the focus metrics for    
  * interior_focus:     [OUT] whether the focus is drawn around the
@@ -406,91 +297,12 @@ gint
 moz_gtk_get_scrollbar_metrics(MozGtkScrollbarMetrics* metrics);
 
 /**
- * Get the desired size of a dropdown arrow button
- * width:   [OUT] the desired width
- * height:  [OUT] the desired height
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_combo_box_entry_button_size(gint* width, gint* height);
-
-/**
- * Get the desired size of a scroll arrow widget
- * width:   [OUT] the desired width
- * height:  [OUT] the desired height
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_tab_scroll_arrow_size(gint* width, gint* height);
-
-/**
- * Get the desired size of a toolbar button dropdown arrow
- * width:   [OUT] the desired width
- * height:  [OUT] the desired height
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_downarrow_size(gint* width, gint* height);
-
-/**
- * Get the desired size of a toolbar separator
- * size:    [OUT] the desired width
- *
- * returns: MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_toolbar_separator_width(gint* size);
-
-/**
- * Get the size of a regular GTK expander that shows/hides content
- * size:    [OUT] the size of the GTK expander, size = width = height.
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_expander_size(gint* size);
-
-/**
- * Get the size of a treeview's expander (we call them twisties)
- * size:    [OUT] the size of the GTK expander, size = width = height.
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_treeview_expander_size(gint* size);
-
-/**
- * Get the desired height of a menu separator
- * size:    [OUT] the desired height
- *
- * returns: MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_get_menu_separator_height(gint* size);
-
-/**
- * Get the desired size of a splitter
- * orientation:   [IN]  GTK_ORIENTATION_HORIZONTAL or GTK_ORIENTATION_VERTICAL
- * size:          [OUT] width or height of the splitter handle
- *
- * returns:    MOZ_GTK_SUCCESS if there was no error, an error code otherwise
- */
-gint moz_gtk_splitter_get_metrics(gint orientation, gint* size);
-
-/**
  * Retrieve an actual GTK scrollbar widget for style analysis. It will not
  * be modified.
  */
 GtkWidget* moz_gtk_get_scrollbar_widget(void);
 
 /**
- * Get the YTHICKNESS of a tab (notebook extension).
- */
-gint moz_gtk_get_tab_thickness(void);
-
-/**
- * Get a boolean which indicates whether or not to use images in menus.
- * If TRUE, use images in menus.
- */
-gboolean moz_gtk_images_in_menus(void);
-
-/**
  * Retrieve an actual GTK progress bar widget for style analysis. It will not
  * be modified.
  */
diff --git a/WebCore/platform/image-decoders/ImageDecoder.cpp b/WebCore/platform/image-decoders/ImageDecoder.cpp
index 1c3dcf8..10c0b3b 100644
--- a/WebCore/platform/image-decoders/ImageDecoder.cpp
+++ b/WebCore/platform/image-decoders/ImageDecoder.cpp
@@ -31,6 +31,7 @@
 #include "ICOImageDecoder.h"
 #include "JPEGImageDecoder.h"
 #include "PNGImageDecoder.h"
+#include "WEBPImageDecoder.h"
 #include "SharedBuffer.h"
 
 using namespace std;
@@ -78,6 +79,19 @@ ImageDecoder* ImageDecoder::create(const SharedBuffer& data, bool premultiplyAlp
     if (!memcmp(contents, "\xFF\xD8\xFF", 3))
         return new JPEGImageDecoder(premultiplyAlpha);
 
+#if USE(WEBP)
+    if (!memcmp(contents, "RIFF", 4)) {
+        static const unsigned webpExtraMarker = 6;
+        static const unsigned webpExtraMarkeroffset = 8;
+        char header[webpExtraMarker];
+        unsigned length = copyFromSharedBuffer(header, webpExtraMarker, data, webpExtraMarkeroffset);
+        if (length >= webpExtraMarker) {
+            if (!memcmp(header, "WEBPVP", webpExtraMarker))
+                return new WEBPImageDecoder(premultiplyAlpha);
+        }
+    }
+#endif
+
     // BMP
     if (strncmp(contents, "BM", 2) == 0)
         return new BMPImageDecoder(premultiplyAlpha);
diff --git a/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp b/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
new file mode 100644
index 0000000..5794fd6
--- /dev/null
+++ b/WebCore/platform/image-decoders/webp/WEBPImageDecoder.cpp
@@ -0,0 +1,123 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WEBPImageDecoder.h"
+
+#if USE(WEBP)
+
+#include "webp/decode.h"
+
+namespace WebCore {
+
+WEBPImageDecoder::WEBPImageDecoder(bool premultiplyAlpha)
+    : ImageDecoder(premultiplyAlpha)
+{
+}
+
+WEBPImageDecoder::~WEBPImageDecoder()
+{
+}
+
+bool WEBPImageDecoder::isSizeAvailable()
+{
+    if (!ImageDecoder::isSizeAvailable())
+         decode(true);
+
+    return ImageDecoder::isSizeAvailable();
+}
+
+RGBA32Buffer* WEBPImageDecoder::frameBufferAtIndex(size_t index)
+{
+    if (index)
+        return 0;
+
+    if (m_frameBufferCache.isEmpty()) {
+        m_frameBufferCache.resize(1);
+        m_frameBufferCache[0].setPremultiplyAlpha(m_premultiplyAlpha);
+    }
+
+    RGBA32Buffer& frame = m_frameBufferCache[0];
+    if (frame.status() != RGBA32Buffer::FrameComplete)
+        decode(false);
+    return &frame;
+}
+
+
+bool WEBPImageDecoder::decode(bool onlySize)
+{
+    // Minimum number of bytes needed to ensure one can parse size information.
+    static const size_t sizeOfHeader = 30;
+    // Number of bytes per pixel.
+    static const int bytesPerPixel = 3;
+
+    if (failed())
+        return false;
+    const size_t dataSize = m_data->buffer().size();
+    const uint8_t* dataBytes =
+        reinterpret_cast<const uint8_t*>(m_data->buffer().data());
+    int width, height;
+    if (dataSize < sizeOfHeader)
+        return true;
+    if (!WebPGetInfo(dataBytes, dataSize, &width, &height))
+        return setFailed();
+    if (onlySize)
+        return setSize(width, height) || setFailed();
+
+    // FIXME: Add support for progressive decoding.
+    if (!isAllDataReceived())
+        return true;
+    if (m_frameBufferCache.isEmpty())
+        return true;
+    RGBA32Buffer& buffer = m_frameBufferCache[0];
+    if (buffer.status() == RGBA32Buffer::FrameEmpty) {
+        ASSERT(width == size().width());
+        ASSERT(height == size().height());
+        if (!buffer.setSize(width, height))
+            return setFailed();
+    }
+    const int stride = width * bytesPerPixel;
+    Vector<uint8_t> rgb;
+    rgb.reserveCapacity(height * stride);
+    if (!WebPDecodeBGRInto(dataBytes, dataSize, &rgb[0], height * stride, stride))
+        return setFailed();
+    // FIXME: remove this data copy.
+    for (int y = 0; y < height; ++y) {
+        const uint8_t* const src = &rgb[y * stride];
+        for (int x = 0; x < width; ++x)
+            buffer.setRGBA(x, y, src[bytesPerPixel * x + 2], src[bytesPerPixel * x + 1], src[bytesPerPixel * x + 0], 0xff);
+    }
+    buffer.setStatus(RGBA32Buffer::FrameComplete);
+    buffer.setHasAlpha(false);
+    buffer.setRect(IntRect(IntPoint(), size()));
+    return true;
+}
+
+}
+
+#endif
diff --git a/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h b/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
new file mode 100644
index 0000000..266c0ff
--- /dev/null
+++ b/WebCore/platform/image-decoders/webp/WEBPImageDecoder.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WEBPImageDecoder_h
+#define WEBPImageDecoder_h
+
+#include "ImageDecoder.h"
+
+#if USE(WEBP)
+
+namespace WebCore {
+
+class WEBPImageDecoder : public ImageDecoder {
+public:
+    WEBPImageDecoder(bool premultiplyAlpha);
+    virtual ~WEBPImageDecoder();
+    virtual String filenameExtension() const { return "vp8"; }
+    virtual bool isSizeAvailable();
+    virtual RGBA32Buffer* frameBufferAtIndex(size_t index);
+    virtual bool supportsAlpha() const { return false; }
+
+private:
+    // Returns false in case of decoding failure.
+    bool decode(bool onlySize);
+};
+
+} // namespace WebCore
+
+#endif
+
+#endif
diff --git a/WebCore/platform/mac/Language.mm b/WebCore/platform/mac/Language.mm
index 96caaa6..bb51cb5 100644
--- a/WebCore/platform/mac/Language.mm
+++ b/WebCore/platform/mac/Language.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2003, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2003, 2005, 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,32 +10,106 @@
  *    notice, this list of conditions and the following disclaimer in the
  *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #import "config.h"
 #import "Language.h"
 
 #import "BlockExceptions.h"
-#import "PlatformString.h"
-#import "WebCoreViewFactory.h"
+#import "WebCoreSystemInterface.h"
+#import <wtf/Assertions.h>
+#import <wtf/MainThread.h>
+#import <wtf/text/WTFString.h>
+
+using namespace WebCore;
+
+static NSString *preferredLanguageCode;
+
+@interface LanguageChangeObserver : NSObject {
+}
+@end
+
+@implementation LanguageChangeObserver
+
++ (void)_webkit_languagePreferencesDidChange
+{
+    ASSERT(isMainThread());
+
+    [preferredLanguageCode release];
+    preferredLanguageCode = nil;
+
+    languageDidChange();
+}
+
+@end
 
 namespace WebCore {
 
-String defaultLanguage()
+static NSString *createHTTPStyleLanguageCode(NSString *languageCode)
 {
+    ASSERT(isMainThread());
+
+    // Look up the language code using CFBundle.
+    CFStringRef preferredLanguageCode = wkCopyCFLocalizationPreferredName((CFStringRef)languageCode);
+
+    if (preferredLanguageCode)
+        languageCode = (NSString *)preferredLanguageCode;
+    
+    // Make the string lowercase.
+    NSString *lowercaseLanguageCode = [languageCode lowercaseString];
+    
+    // Turn a '_' into a '-' if it appears after a 2-letter language code.
+    if ([lowercaseLanguageCode length] < 3 || [lowercaseLanguageCode characterAtIndex:2] != '_')
+        return lowercaseLanguageCode;
+
+    NSMutableString *result = [lowercaseLanguageCode mutableCopy];
+    [result replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
+
+    if (preferredLanguageCode)
+        CFRelease(preferredLanguageCode);
+
+    return result;
+}
+
+String platformDefaultLanguage()
+{
+    ASSERT(isMainThread());
+
     BEGIN_BLOCK_OBJC_EXCEPTIONS;
-    return [[WebCoreViewFactory sharedFactory] defaultLanguageCode];
+
+    if (!preferredLanguageCode) {
+        [[NSUserDefaults standardUserDefaults] synchronize];
+        NSArray *languages = [[NSUserDefaults standardUserDefaults] stringArrayForKey:@"AppleLanguages"];
+        if (![languages count])
+            preferredLanguageCode = @"en";
+        else
+            preferredLanguageCode = createHTTPStyleLanguageCode([languages objectAtIndex:0]);
+    }
+
+    NSString *code = [[preferredLanguageCode retain] autorelease];
+
+    static bool languageChangeObserverAdded;
+    if (!languageChangeObserverAdded) {
+        [[NSDistributedNotificationCenter defaultCenter] addObserver:[LanguageChangeObserver self]
+                                                            selector:@selector(_webkit_languagePreferencesDidChange)
+                                                                name:@"AppleLanguagePreferencesChangedNotification"
+                                                              object:nil];
+        languageChangeObserverAdded = true;
+    }
+
+    return code;
+
     END_BLOCK_OBJC_EXCEPTIONS;
     return String();
 }
diff --git a/WebCore/platform/mac/LoggingMac.mm b/WebCore/platform/mac/LoggingMac.mm
index 3e83579..ee2f39e 100644
--- a/WebCore/platform/mac/LoggingMac.mm
+++ b/WebCore/platform/mac/LoggingMac.mm
@@ -62,6 +62,7 @@ void InitializeLoggingChannelsIfNecessary()
     initializeWithUserDefault(LogHistory);
     initializeWithUserDefault(LogPageCache);
     initializeWithUserDefault(LogPlatformLeaks);
+    initializeWithUserDefault(LogResourceLoading);
     initializeWithUserDefault(LogNetwork);
     initializeWithUserDefault(LogFTP);
     initializeWithUserDefault(LogThreading);
diff --git a/WebCore/platform/mac/ScrollbarThemeMac.mm b/WebCore/platform/mac/ScrollbarThemeMac.mm
index bfa584a..ce3be1a 100644
--- a/WebCore/platform/mac/ScrollbarThemeMac.mm
+++ b/WebCore/platform/mac/ScrollbarThemeMac.mm
@@ -378,10 +378,9 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
         trackInfo.enableState = kThemeTrackNothingToScroll;
     trackInfo.trackInfo.scrollbar.pressState = scrollbarPartToHIPressedState(scrollbar->pressedPart());
     
-    CGAffineTransform currentCTM = CGContextGetCTM(context->platformContext());
-    
     // The Aqua scrollbar is buggy when rotated and scaled.  We will just draw into a bitmap if we detect a scale or rotation.
-    bool canDrawDirectly = currentCTM.a == 1.0f && currentCTM.b == 0.0f && currentCTM.c == 0.0f && (currentCTM.d == 1.0f || currentCTM.d == -1.0f);
+    const AffineTransform& currentCTM = context->getCTM();
+    bool canDrawDirectly = currentCTM.isIdentityOrTranslationOrFlipped();
     if (canDrawDirectly)
         HIThemeDrawTrack(&trackInfo, 0, context->platformContext(), kHIThemeOrientationNormal);
     else {
@@ -396,7 +395,7 @@ bool ScrollbarThemeMac::paint(Scrollbar* scrollbar, GraphicsContext* context, co
             return true;
         
         HIThemeDrawTrack(&trackInfo, 0, imageBuffer->context()->platformContext(), kHIThemeOrientationNormal);
-        context->drawImageBuffer(imageBuffer.get(), DeviceColorSpace, scrollbar->frameRect().location());
+        context->drawImageBuffer(imageBuffer.get(), ColorSpaceDeviceRGB, scrollbar->frameRect().location());
     }
 
     return true;
diff --git a/WebCore/platform/mac/SharedTimerMac.mm b/WebCore/platform/mac/SharedTimerMac.mm
index b9eaaef..cc9ff17 100644
--- a/WebCore/platform/mac/SharedTimerMac.mm
+++ b/WebCore/platform/mac/SharedTimerMac.mm
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2006 Apple Inc. All rights reserved.
+ * Copyright (C) 2006, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,51 +26,131 @@
 #import "config.h"
 #import "SharedTimer.h"
 
+#import <IOKit/IOMessage.h>
+#import <IOKit/pwr_mgt/IOPMLib.h>
 #import <wtf/Assertions.h>
+#import <wtf/Noncopyable.h>
+#import <wtf/PassOwnPtr.h>
 #import <wtf/UnusedParam.h>
 
-@class WebCorePowerNotifier;
+#include <stdio.h>
+
+// On Snow Leopard and newer we'll ask IOKit to deliver notifications on a queue.
+#if defined(BUILDING_ON_TIGER) || defined(BUILDING_ON_LEOPARD)
+#define IOKIT_WITHOUT_LIBDISPATCH 1
+#endif
 
 namespace WebCore {
 
-static WebCorePowerNotifier *powerNotifier;
 static CFRunLoopTimerRef sharedTimer;
 static void (*sharedTimerFiredFunction)();
 static void timerFired(CFRunLoopTimerRef, void*);
 
+#if !defined(IOKIT_WITHOUT_LIBDISPATCH) && defined(BUILDING_ON_SNOW_LEOPARD)
+extern "C" void IONotificationPortSetDispatchQueue(IONotificationPortRef notify, dispatch_queue_t queue);
+#endif
+
+class PowerObserver {
+    WTF_MAKE_NONCOPYABLE(PowerObserver);
+    
+public:
+    static PassOwnPtr<PowerObserver> create()
+    {
+        return adoptPtr(new PowerObserver);
+    }
+    ~PowerObserver();
+
+private:
+    PowerObserver();
+
+    static void didReceiveSystemPowerNotification(void* context, io_service_t, uint32_t messageType, void* messageArgument);
+    void didReceiveSystemPowerNotification(io_service_t, uint32_t messageType, void* messageArgument);
+
+    void restartSharedTimer();
+
+    io_connect_t m_powerConnection;
+    IONotificationPortRef m_notificationPort;
+    io_object_t m_notifierReference;
+#ifdef IOKIT_WITHOUT_LIBDISPATCH
+    CFRunLoopSourceRef m_runLoopSource;
+#else
+    dispatch_queue_t m_dispatchQueue;
+#endif
+};
+
+PowerObserver::PowerObserver()
+    : m_powerConnection(0)
+    , m_notificationPort(0)
+    , m_notifierReference(0)
+#ifdef IOKIT_WITHOUT_LIBDISPATCH
+    , m_runLoopSource(0)    
+#else
+    , m_dispatchQueue(dispatch_queue_create("com.apple.WebKit.PowerObserver", 0))
+#endif
+{
+    m_powerConnection = IORegisterForSystemPower(this, &m_notificationPort, didReceiveSystemPowerNotification, &m_notifierReference);
+    if (!m_powerConnection)
+        return;
+
+#ifdef IOKIT_WITHOUT_LIBDISPATCH
+    m_runLoopSource = IONotificationPortGetRunLoopSource(m_notificationPort);
+    CFRunLoopAddSource(CFRunLoopGetMain(), m_runLoopSource, kCFRunLoopCommonModes);
+#else
+    IONotificationPortSetDispatchQueue(m_notificationPort, m_dispatchQueue);
+#endif
 }
 
-@interface WebCorePowerNotifier : NSObject
-@end
+PowerObserver::~PowerObserver()
+{
+    if (!m_powerConnection)
+        return;
+
+#ifdef IOKIT_WITHOUT_LIBDISPATCH
+    CFRunLoopRemoveSource(CFRunLoopGetMain(), m_runLoopSource, kCFRunLoopCommonModes);
+#else
+    dispatch_release(m_dispatchQueue);
+#endif
+
+    IODeregisterForSystemPower(&m_notifierReference);
+    IOServiceClose(m_powerConnection);
+    IONotificationPortDestroy(m_notificationPort);
+}
 
-@implementation WebCorePowerNotifier
+void PowerObserver::didReceiveSystemPowerNotification(void* context, io_service_t service, uint32_t messageType, void* messageArgument)
+{
+    static_cast<PowerObserver*>(context)->didReceiveSystemPowerNotification(service, messageType, messageArgument);
+}
 
-- (id)init
+void PowerObserver::didReceiveSystemPowerNotification(io_service_t, uint32_t messageType, void* messageArgument)
 {
-    self = [super init];
-    
-    if (self)
-        [[[NSWorkspace sharedWorkspace] notificationCenter] addObserver:self
-                                                               selector:@selector(didWake:)
-                                                                   name:NSWorkspaceDidWakeNotification 
-                                                                 object:nil];
-    
-    return self;
+    IOAllowPowerChange(m_powerConnection, reinterpret_cast<long>(messageArgument));
+
+    // We only care about the "wake from sleep" message.
+    if (messageType != kIOMessageSystemWillPowerOn)
+        return;
+
+#ifdef IOKIT_WITHOUT_LIBDISPATCH
+    restartSharedTimer();
+#else
+    // We need to restart the timer on the main thread.
+    CFRunLoopPerformBlock(CFRunLoopGetMain(), kCFRunLoopCommonModes, ^() {
+        restartSharedTimer();
+    });
+#endif
 }
 
-- (void)didWake:(NSNotification *)unusedNotification
+void PowerObserver::restartSharedTimer()
 {
-    UNUSED_PARAM(unusedNotification);
+    ASSERT(CFRunLoopGetCurrent() == CFRunLoopGetMain());
 
-    if (WebCore::sharedTimer) {
-        WebCore::stopSharedTimer();
-        WebCore::timerFired(0, 0);
-    }
-}
+    if (!sharedTimer)
+        return;
 
-@end
+    stopSharedTimer();
+    timerFired(0, 0);
+}
 
-namespace WebCore {
+static PowerObserver* PowerObserver;
 
 void setSharedTimerFiredFunction(void (*f)())
 {
@@ -100,11 +180,8 @@ void setSharedTimerFireTime(double fireTime)
     sharedTimer = CFRunLoopTimerCreate(0, fireDate, 0, 0, 0, timerFired, 0);
     CFRunLoopAddTimer(CFRunLoopGetCurrent(), sharedTimer, kCFRunLoopCommonModes);
     
-    if (!powerNotifier) {
-        powerNotifier = [[WebCorePowerNotifier alloc] init];
-        CFRetain(powerNotifier);
-        [powerNotifier release];
-    }
+    if (!PowerObserver)
+        PowerObserver = PowerObserver::create().leakPtr();
 }
 
 void stopSharedTimer()
@@ -116,4 +193,4 @@ void stopSharedTimer()
     }
 }
 
-}
+} // namespace WebCore
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.h b/WebCore/platform/mac/WebCoreSystemInterface.h
index 0cc7fd5..7cac443 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.h
+++ b/WebCore/platform/mac/WebCoreSystemInterface.h
@@ -94,6 +94,7 @@ extern CFReadStreamRef (*wkCreateCustomCFReadStream)(void *(*formCreate)(CFReadS
     void (*formSchedule)(CFReadStreamRef, CFRunLoopRef, CFStringRef, void *), 
     void (*formUnschedule)(CFReadStreamRef, CFRunLoopRef, CFStringRef, void *),
     void *context);
+extern CFStringRef (*wkCopyCFLocalizationPreferredName)(CFStringRef);
 extern NSString* (*wkCopyNSURLResponseStatusLine)(NSURLResponse*);
 extern id (*wkCreateNSURLConnectionDelegateProxy)(void);
 extern void (*wkDrawBezeledTextFieldCell)(NSRect, BOOL enabled);
diff --git a/WebCore/platform/mac/WebCoreSystemInterface.mm b/WebCore/platform/mac/WebCoreSystemInterface.mm
index 309a8fb..52e0064 100644
--- a/WebCore/platform/mac/WebCoreSystemInterface.mm
+++ b/WebCore/platform/mac/WebCoreSystemInterface.mm
@@ -29,6 +29,7 @@
 
 void (*wkAdvanceDefaultButtonPulseAnimation)(NSButtonCell *);
 BOOL (*wkCGContextGetShouldSmoothFonts)(CGContextRef);
+CFStringRef (*wkCopyCFLocalizationPreferredName)(CFStringRef);
 NSString* (*wkCopyNSURLResponseStatusLine)(NSURLResponse*);
 NSString* (*wkCreateURLPasteboardFlavorTypeName)(void);
 NSString* (*wkCreateURLNPasteboardFlavorTypeName)(void);
diff --git a/WebCore/platform/network/BlobData.cpp b/WebCore/platform/network/BlobData.cpp
index 21e8917..ff39ecc 100644
--- a/WebCore/platform/network/BlobData.cpp
+++ b/WebCore/platform/network/BlobData.cpp
@@ -31,40 +31,46 @@
 #include "config.h"
 #include "BlobData.h"
 
+#include <wtf/OwnPtr.h>
+#include <wtf/PassOwnPtr.h>
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+#include <wtf/Vector.h>
+
 namespace WebCore {
 
 const long long BlobDataItem::toEndOfFile = -1;
 const double BlobDataItem::doNotCheckFileChange = 0;
 
-void BlobDataItem::copy(const BlobDataItem& item)
+RawData::RawData()
 {
-    type = item.type;
-    data = item.data; // This is OK because the underlying storage is Vector<char>.
-    path = item.path.crossThreadString();
-    url = item.url.copy();
-    offset = item.offset;
-    length = item.length;
-    expectedModificationTime = item.expectedModificationTime;
 }
 
-PassOwnPtr<BlobData> BlobData::copy() const
+void RawData::detachFromCurrentThread()
 {
-    OwnPtr<BlobData> blobData = adoptPtr(new BlobData());
-    blobData->m_contentType = m_contentType.crossThreadString();
-    blobData->m_contentDisposition = m_contentDisposition.crossThreadString();
-    blobData->m_items.resize(m_items.size());
-    for (size_t i = 0; i < m_items.size(); ++i)
-        blobData->m_items.at(i).copy(m_items.at(i));
+}
+
+void BlobDataItem::detachFromCurrentThread()
+{
+    data->detachFromCurrentThread();
+    path = path.crossThreadString();
+    url = url.copy();
+}
 
-    return blobData.release();
+PassOwnPtr<BlobData> BlobData::create()
+{
+    return adoptPtr(new BlobData());
 }
 
-void BlobData::appendData(const CString& data)
+void BlobData::detachFromCurrentThread()
 {
-    m_items.append(BlobDataItem(data));
+    m_contentType = m_contentType.crossThreadString();
+    m_contentDisposition = m_contentDisposition.crossThreadString();
+    for (size_t i = 0; i < m_items.size(); ++i)
+        m_items.at(i).detachFromCurrentThread();
 }
 
-void BlobData::appendData(const CString& data, long long offset, long long length)
+void BlobData::appendData(PassRefPtr<RawData> data, long long offset, long long length)
 {
     m_items.append(BlobDataItem(data, offset, length));
 }
diff --git a/WebCore/platform/network/BlobData.h b/WebCore/platform/network/BlobData.h
index 13e3b9c..1ff6344 100644
--- a/WebCore/platform/network/BlobData.h
+++ b/WebCore/platform/network/BlobData.h
@@ -33,12 +33,30 @@
 
 #include "KURL.h"
 #include "PlatformString.h"
-#include <wtf/PassOwnPtr.h>
-#include <wtf/Vector.h>
-#include <wtf/text/CString.h>
+#include <wtf/Forward.h>
+#include <wtf/ThreadSafeShared.h>
 
 namespace WebCore {
 
+class RawData : public ThreadSafeShared<RawData> {
+public:
+    static PassRefPtr<RawData> create()
+    {
+        return adoptRef(new RawData());
+    }
+
+    void detachFromCurrentThread();
+
+    const char* data() const { return m_data.data(); }
+    size_t length() const { return m_data.size(); }
+    Vector<char>* mutableData() { return &m_data; }
+
+private:
+    RawData();
+
+    Vector<char> m_data;
+};
+
 struct BlobDataItem {
     static const long long toEndOfFile;
     static const double doNotCheckFileChange;
@@ -53,7 +71,7 @@ struct BlobDataItem {
     }
 
     // Constructor for String type (complete string).
-    explicit BlobDataItem(const CString& data)
+    explicit BlobDataItem(PassRefPtr<RawData> data)
         : type(Data)
         , data(data)
         , offset(0)
@@ -62,16 +80,6 @@ struct BlobDataItem {
     {
     }
 
-    // Constructor for String type (partial string).
-    BlobDataItem(const CString& data, long long offset, long long length)
-        : type(Data)
-        , data(data)
-        , offset(offset)
-        , length(length)
-        , expectedModificationTime(doNotCheckFileChange)
-    {
-    }
-
     // Constructor for File type (complete file).
     explicit BlobDataItem(const String& path)
         : type(File)
@@ -102,13 +110,13 @@ struct BlobDataItem {
     {
     }
 
-    // Gets a copy of the data suitable for passing to another thread.
-    void copy(const BlobDataItem&);
+    // Detaches from current thread so that it can be passed to another thread.
+    void detachFromCurrentThread();
 
     enum { Data, File, Blob } type;
     
     // For Data type.
-    CString data;
+    RefPtr<RawData> data;
 
     // For File type.
     String path;
@@ -119,19 +127,29 @@ struct BlobDataItem {
     long long offset;
     long long length;
     double expectedModificationTime;
+
+private:
+    friend class BlobData;
+
+    // Constructor for String type (partial string).
+    BlobDataItem(PassRefPtr<RawData> data, long long offset, long long length)
+        : type(Data)
+        , data(data)
+        , offset(offset)
+        , length(length)
+        , expectedModificationTime(doNotCheckFileChange)
+    {
+    }
 };
 
 typedef Vector<BlobDataItem> BlobDataItemList;
 
 class BlobData {
 public:
-    static PassOwnPtr<BlobData> create()
-    {
-        return adoptPtr(new BlobData());
-    }
+    static PassOwnPtr<BlobData> create();
 
-    // Gets a copy of the data suitable for passing to another thread.
-    PassOwnPtr<BlobData> copy() const;
+    // Detaches from current thread so that it can be passed to another thread.
+    void detachFromCurrentThread();
 
     const String& contentType() const { return m_contentType; }
     void setContentType(const String& contentType) { m_contentType = contentType; }
@@ -141,8 +159,8 @@ public:
 
     const BlobDataItemList& items() const { return m_items; }
     void swapItems(BlobDataItemList&);
-    
-    void appendData(const CString&);
+
+    void appendData(PassRefPtr<RawData>, long long offset, long long length);
     void appendFile(const String& path);
     void appendFile(const String& path, long long offset, long long length, double expectedModificationTime);
     void appendBlob(const KURL&, long long offset, long long length);
@@ -154,7 +172,7 @@ private:
     BlobData() { }
 
     // This is only exposed to BlobStorageData.
-    void appendData(const CString&, long long offset, long long length);
+    void appendData(const RawData&, long long offset, long long length);
 
     String m_contentType;
     String m_contentDisposition;
diff --git a/WebCore/platform/network/BlobRegistryImpl.cpp b/WebCore/platform/network/BlobRegistryImpl.cpp
index c5beb64..2c4e8fa 100644
--- a/WebCore/platform/network/BlobRegistryImpl.cpp
+++ b/WebCore/platform/network/BlobRegistryImpl.cpp
@@ -134,7 +134,7 @@ void BlobRegistryImpl::registerBlobURL(const KURL& url, PassOwnPtr<BlobData> blo
     for (BlobDataItemList::const_iterator iter = blobData->items().begin(); iter != blobData->items().end(); ++iter) {
         switch (iter->type) {
         case BlobDataItem::Data:
-            blobStorageData->m_data.appendData(iter->data, 0, iter->data.length());
+            blobStorageData->m_data.appendData(iter->data, 0, iter->data->length());
             break;
         case BlobDataItem::File:
             blobStorageData->m_data.appendFile(iter->path, iter->offset, iter->length, iter->expectedModificationTime);
@@ -158,10 +158,7 @@ void BlobRegistryImpl::registerBlobURL(const KURL& url, const KURL& srcURL)
     if (!src)
         return;
 
-    RefPtr<BlobStorageData> blobStorageData = BlobStorageData::create(src->contentType(), src->contentDisposition());
-    appendStorageItems(blobStorageData.get(), src->items());
-    
-    m_blobs.set(url.string(), blobStorageData);
+    m_blobs.set(url.string(), src);
 }
 
 void BlobRegistryImpl::unregisterBlobURL(const KURL& url)
diff --git a/WebCore/platform/network/BlobResourceHandle.cpp b/WebCore/platform/network/BlobResourceHandle.cpp
index 48ac2c0..753052a 100644
--- a/WebCore/platform/network/BlobResourceHandle.cpp
+++ b/WebCore/platform/network/BlobResourceHandle.cpp
@@ -359,7 +359,7 @@ int BlobResourceHandle::readDataSync(const BlobDataItem& item, char* buf, int le
     int bytesToRead = (length > remaining) ? static_cast<int>(remaining) : length;
     if (bytesToRead > m_totalRemainingSize)
         bytesToRead = static_cast<int>(m_totalRemainingSize);
-    memcpy(buf, item.data.data() + item.offset + m_currentItemReadSize, bytesToRead);
+    memcpy(buf, item.data->data() + item.offset + m_currentItemReadSize, bytesToRead);
     m_totalRemainingSize -= bytesToRead;
 
     m_currentItemReadSize += bytesToRead;
@@ -434,7 +434,7 @@ void BlobResourceHandle::readDataAsync(const BlobDataItem& item)
     long long bytesToRead = item.length - m_currentItemReadSize;
     if (bytesToRead > m_totalRemainingSize)
         bytesToRead = m_totalRemainingSize;
-    consumeData(item.data.data() + item.offset + m_currentItemReadSize, static_cast<int>(bytesToRead));
+    consumeData(item.data->data() + item.offset + m_currentItemReadSize, static_cast<int>(bytesToRead));
     m_currentItemReadSize = 0;
 }
 
diff --git a/WebCore/platform/network/CredentialStorage.cpp b/WebCore/platform/network/CredentialStorage.cpp
index 38f71a4..428181d 100644
--- a/WebCore/platform/network/CredentialStorage.cpp
+++ b/WebCore/platform/network/CredentialStorage.cpp
@@ -29,7 +29,7 @@
 #include "Credential.h"
 #include "KURL.h"
 #include "ProtectionSpaceHash.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/text/StringHash.h>
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
@@ -60,9 +60,9 @@ static PathToDefaultProtectionSpaceMap& pathToDefaultProtectionSpaceMap()
 static String originStringFromURL(const KURL& url)
 {
     if (url.port())
-        return url.protocol() + "://" + url.host() + String::format(":%i/", url.port());
-    
-    return url.protocol() + "://" + url.host() + "/";
+        return makeString(url.protocol(), "://", url.host(), ':', String::number(url.port()), '/');
+
+    return makeString(url.protocol(), "://", url.host(), '/');
 }
 
 static String protectionSpaceMapKeyFromURL(const KURL& url)
diff --git a/WebCore/platform/network/DataURL.cpp b/WebCore/platform/network/DataURL.cpp
new file mode 100644
index 0000000..5de1b34
--- /dev/null
+++ b/WebCore/platform/network/DataURL.cpp
@@ -0,0 +1,92 @@
+/*
+ * Copyright (C) 2007 Alp Toker <alp@atoker.com>
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "DataURL.h"
+
+#include "Base64.h"
+#include "HTTPParsers.h"
+#include "ResourceHandle.h"
+#include "ResourceHandleClient.h"
+#include "ResourceRequest.h"
+#include "ResourceResponse.h"
+#include "TextEncoding.h"
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+void handleDataURL(ResourceHandle* handle)
+{
+    ASSERT(handle->firstRequest().url().protocolIs("data"));
+    String url = handle->firstRequest().url().string();
+
+    int index = url.find(',');
+    if (index == -1) {
+        handle->client()->cannotShowURL(handle);
+        return;
+    }
+
+    String mediaType = url.substring(5, index - 5);
+    String data = url.substring(index + 1);
+
+    bool base64 = mediaType.endsWith(";base64", false);
+    if (base64)
+        mediaType = mediaType.left(mediaType.length() - 7);
+
+    if (mediaType.isEmpty())
+        mediaType = "text/plain;charset=US-ASCII";
+
+    String mimeType = extractMIMETypeFromMediaType(mediaType);
+    String charset = extractCharsetFromMediaType(mediaType);
+
+    ResourceResponse response;
+    response.setMimeType(mimeType);
+    response.setTextEncodingName(charset);
+    response.setURL(handle->firstRequest().url());
+
+    if (base64) {
+        data = decodeURLEscapeSequences(data);
+        handle->client()->didReceiveResponse(handle, response);
+
+        Vector<char> out;
+        if (base64Decode(data, out, IgnoreWhitespace) && out.size() > 0) {
+            response.setExpectedContentLength(out.size());
+            handle->client()->didReceiveData(handle, out.data(), out.size(), 0);
+        }
+    } else {
+        data = decodeURLEscapeSequences(data, TextEncoding(charset));
+        handle->client()->didReceiveResponse(handle, response);
+
+        CString encodedData = TextEncoding().encode(data.characters(), data.length(), URLEncodedEntitiesForUnencodables);
+        response.setExpectedContentLength(encodedData.length());
+        if (encodedData.length())
+            handle->client()->didReceiveData(handle, encodedData.data(), encodedData.length(), 0);
+    }
+
+    handle->client()->didFinishLoading(handle, 0);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/DataURL.h b/WebCore/platform/network/DataURL.h
new file mode 100644
index 0000000..33076a0
--- /dev/null
+++ b/WebCore/platform/network/DataURL.h
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DataURL_h
+#define DataURL_h
+
+namespace WebCore {
+
+class ResourceHandle;
+
+void handleDataURL(ResourceHandle*);
+
+}
+
+#endif // DataURL_h
diff --git a/WebCore/platform/network/HTTPHeaderMap.cpp b/WebCore/platform/network/HTTPHeaderMap.cpp
index e304ffa..92079a0 100644
--- a/WebCore/platform/network/HTTPHeaderMap.cpp
+++ b/WebCore/platform/network/HTTPHeaderMap.cpp
@@ -37,6 +37,14 @@ using namespace std;
 
 namespace WebCore {
 
+HTTPHeaderMap::HTTPHeaderMap()
+{
+}
+
+HTTPHeaderMap::~HTTPHeaderMap()
+{
+}
+
 PassOwnPtr<CrossThreadHTTPHeaderMapData> HTTPHeaderMap::copyData() const
 {
     OwnPtr<CrossThreadHTTPHeaderMapData> data(new CrossThreadHTTPHeaderMapData());
@@ -58,7 +66,17 @@ void HTTPHeaderMap::adopt(PassOwnPtr<CrossThreadHTTPHeaderMapData> data)
         set(header.first, header.second);
     }
 }
-    
+
+String HTTPHeaderMap::get(const AtomicString& name) const
+{
+    return HashMap<AtomicString, String, CaseFoldingHash>::get(name);
+}
+
+pair<HTTPHeaderMap::iterator, bool> HTTPHeaderMap::add(const AtomicString& name, const String& value)
+{
+    return HashMap<AtomicString, String, CaseFoldingHash>::add(name, value);
+}
+
 // Adapter that allows the HashMap to take C strings as keys.
 struct CaseFoldingCStringTranslator {
     static unsigned hash(const char* cString)
diff --git a/WebCore/platform/network/HTTPHeaderMap.h b/WebCore/platform/network/HTTPHeaderMap.h
index c6145bd..02071e3 100644
--- a/WebCore/platform/network/HTTPHeaderMap.h
+++ b/WebCore/platform/network/HTTPHeaderMap.h
@@ -41,20 +41,17 @@ namespace WebCore {
 
     class HTTPHeaderMap : public HashMap<AtomicString, String, CaseFoldingHash> {
     public:
+        HTTPHeaderMap();
+        ~HTTPHeaderMap();
+
         // Gets a copy of the data suitable for passing to another thread.
         PassOwnPtr<CrossThreadHTTPHeaderMapData> copyData() const;
 
         void adopt(PassOwnPtr<CrossThreadHTTPHeaderMapData>);
         
-        String get(const AtomicString& name) const
-        {
-            return HashMap<AtomicString, String, CaseFoldingHash>::get(name);
-        }
+        String get(const AtomicString& name) const;
 
-        pair<iterator, bool> add(const AtomicString& name, const String& value)
-        {
-            return HashMap<AtomicString, String, CaseFoldingHash>::add(name, value);
-        }
+        pair<iterator, bool> add(const AtomicString& name, const String& value);
 
         // Alternate accessors that are faster than converting the char* to AtomicString first.
         bool contains(const char*) const;
diff --git a/WebCore/platform/network/ProxyServer.cpp b/WebCore/platform/network/ProxyServer.cpp
new file mode 100644
index 0000000..7ef283b
--- /dev/null
+++ b/WebCore/platform/network/ProxyServer.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyServer.h"
+
+#include <wtf/text/StringBuilder.h>
+
+namespace WebCore {
+
+static void appendProxyServerString(StringBuilder& builder, const ProxyServer& proxyServer)
+{
+    switch (proxyServer.type()) {
+    case ProxyServer::Direct:
+        builder.append("DIRECT");
+        return;
+    case ProxyServer::HTTP:
+    case ProxyServer::HTTPS:
+        builder.append("PROXY");
+        break;
+    case ProxyServer::SOCKS:
+        builder.append("SOCKS");
+        break;
+    }
+    
+    builder.append(' ');
+
+    ASSERT(!proxyServer.hostName().isNull());
+    builder.append(proxyServer.hostName());
+
+    builder.append(':');
+    ASSERT(proxyServer.port() != -1);
+    builder.append(String::number(proxyServer.port()));
+}
+
+String toString(const Vector<ProxyServer>& proxyServers)
+{
+    if (proxyServers.isEmpty())
+        return "DIRECT";
+
+    StringBuilder stringBuilder;
+    for (size_t i = 0; i < proxyServers.size(); ++i) {
+        if (i)
+            stringBuilder.append("; ");
+
+        appendProxyServerString(stringBuilder, proxyServers[i]);
+    }
+
+    return stringBuilder.toString();
+}
+
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/ProxyServer.h b/WebCore/platform/network/ProxyServer.h
new file mode 100644
index 0000000..8f7612e
--- /dev/null
+++ b/WebCore/platform/network/ProxyServer.h
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef ProxyServer_h
+#define ProxyServer_h
+
+#include <wtf/Vector.h>
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class KURL;
+class NetworkingContext;
+
+// Represents a single proxy server.
+class ProxyServer {
+public:
+    enum Type {
+        Direct,
+        HTTP,
+        HTTPS,
+        SOCKS,
+    };
+
+    ProxyServer()
+        : m_type(Direct)
+        , m_port(-1)
+    {
+    }
+
+    ProxyServer(Type type, const String& hostName, int port)
+        : m_type(type)
+        , m_hostName(hostName)
+        , m_port(port)
+    {
+    }
+        
+    Type type() const { return m_type; }
+    const String& hostName() const { return m_hostName; }
+    int port() const { return m_port; }
+
+private:
+    Type m_type;
+    String m_hostName;
+    int m_port;
+};
+
+// Return a vector of proxy servers for the given URL.
+Vector<ProxyServer> proxyServersForURL(const KURL&, const NetworkingContext*);
+
+// Converts the given vector of proxy servers to a PAC string, as described in
+// http://web.archive.org/web/20060424005037/wp.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html
+String toString(const Vector<ProxyServer>&);
+    
+} // namespace WebCore
+
+#endif // ProxyServer_h
diff --git a/WebCore/platform/network/ResourceHandle.h b/WebCore/platform/network/ResourceHandle.h
index 2ea42b1..bb94b59 100644
--- a/WebCore/platform/network/ResourceHandle.h
+++ b/WebCore/platform/network/ResourceHandle.h
@@ -94,16 +94,6 @@ class ResourceHandle : public RefCounted<ResourceHandle>
     , public AuthenticationClient
 #endif
     {
-protected:
-    ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
-
-private:
-    enum FailureType {
-        NoFailure,
-        BlockedFailure,
-        InvalidURLFailure
-    };
-
 public:
     static PassRefPtr<ResourceHandle> create(NetworkingContext*, const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
     static void loadResourceSynchronously(NetworkingContext*, const ResourceRequest&, StoredCredentials, ResourceError&, ResourceResponse&, Vector<char>& data);
@@ -203,7 +193,16 @@ public:
     using RefCounted<ResourceHandle>::ref;
     using RefCounted<ResourceHandle>::deref;
 
+protected:
+    ResourceHandle(const ResourceRequest&, ResourceHandleClient*, bool defersLoading, bool shouldContentSniff);
+
 private:
+    enum FailureType {
+        NoFailure,
+        BlockedFailure,
+        InvalidURLFailure
+    };
+
     void platformSetDefersLoading(bool);
 
     void scheduleFailure(FailureType);
diff --git a/WebCore/platform/network/ResourceHandleInternal.h b/WebCore/platform/network/ResourceHandleInternal.h
index 96fbf00..9cccecd 100644
--- a/WebCore/platform/network/ResourceHandleInternal.h
+++ b/WebCore/platform/network/ResourceHandleInternal.h
@@ -46,6 +46,8 @@
 #endif
 
 #if USE(SOUP)
+#include "soup-requester.h"
+#include <GRefPtr.h>
 #include <libsoup/soup.h>
 class Frame;
 #endif
@@ -108,15 +110,11 @@ namespace WebCore {
             , m_formDataStream(loader)
 #endif
 #if USE(SOUP)
-            , m_msg(0)
             , m_cancelled(false)
-            , m_gfile(0)
-            , m_inputStream(0)
-            , m_cancellable(0)
             , m_buffer(0)
-            , m_bufferSize(0)
             , m_total(0)
             , m_idleHandler(0)
+            , m_gotChunkHandler(0)
 #endif
 #if PLATFORM(QT)
             , m_job(0)
@@ -133,6 +131,9 @@ namespace WebCore {
             m_user = url.user();
             m_pass = url.pass();
             m_firstRequest.removeCredentials();
+#if USE(SOUP)
+            m_requester = adoptPlatformRef(webkit_soup_requester_new());
+#endif
         }
         
         ~ResourceHandleInternal();
@@ -185,16 +186,18 @@ namespace WebCore {
         Vector<char> m_postBytes;
 #endif
 #if USE(SOUP)
-        SoupMessage* m_msg;
+        PlatformRefPtr<SoupMessage> m_soupMessage;
         ResourceResponse m_response;
         bool m_cancelled;
-        GFile* m_gfile;
-        GInputStream* m_inputStream;
-        GCancellable* m_cancellable;
+        PlatformRefPtr<WebKitSoupRequest> m_soupRequest;
+        PlatformRefPtr<WebKitSoupRequester> m_requester;
+        PlatformRefPtr<GInputStream> m_inputStream;
+        PlatformRefPtr<GCancellable> m_cancellable;
         char* m_buffer;
-        gsize m_bufferSize, m_total;
+        gsize m_total;
         guint m_idleHandler;
         RefPtr<NetworkingContext> m_context;
+        gulong m_gotChunkHandler;
 #endif
 #if PLATFORM(QT)
         QNetworkReplyHandler* m_job;
diff --git a/WebKit/mac/Misc/WebIconFetcher.h b/WebCore/platform/network/ResourceRawHeaders.h
index d27ad94..e5f8d99 100644
--- a/WebKit/mac/Misc/WebIconFetcher.h
+++ b/WebCore/platform/network/ResourceRawHeaders.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
+ * Copyright (C) 2010 Google, Inc. All Rights Reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -23,14 +23,19 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
  */
 
-#import <Cocoa/Cocoa.h>
 
-@class WebIconFetcherPrivate;
+#ifndef ResourceRawHeaders_h
+#define ResourceRawHeaders_h
 
-@interface WebIconFetcher : NSObject {
-    WebIconFetcherPrivate *_private;
-}
+#include "HTTPHeaderMap.h"
+
+namespace WebCore {
 
-- (void)cancel;
+struct ResourceRawHeaders : RefCounted<ResourceRawHeaders> {
+    HTTPHeaderMap requestHeaders;
+    HTTPHeaderMap responseHeaders;
+};
+
+}
 
-@end
+#endif
diff --git a/WebCore/platform/network/ResourceRequestBase.cpp b/WebCore/platform/network/ResourceRequestBase.cpp
index fd8832f..5312007 100644
--- a/WebCore/platform/network/ResourceRequestBase.cpp
+++ b/WebCore/platform/network/ResourceRequestBase.cpp
@@ -65,6 +65,7 @@ PassOwnPtr<ResourceRequest> ResourceRequestBase::adopt(PassOwnPtr<CrossThreadRes
     }
     request->setHTTPBody(data->m_httpBody);
     request->setAllowCookies(data->m_allowCookies);
+    request->doPlatformAdopt(data);
     return request.release();
 }
 
@@ -87,7 +88,7 @@ PassOwnPtr<CrossThreadResourceRequestData> ResourceRequestBase::copyData() const
     if (m_httpBody)
         data->m_httpBody = m_httpBody->deepCopy();
     data->m_allowCookies = m_allowCookies;
-    return data.release();
+    return asResourceRequest().doPlatformCopyData(data.release());
 }
 
 bool ResourceRequestBase::isEmpty() const
@@ -355,7 +356,7 @@ bool equalIgnoringHeaderFields(const ResourceRequestBase& a, const ResourceReque
     return true;
 }
 
-bool operator==(const ResourceRequestBase& a, const ResourceRequestBase& b)
+bool ResourceRequestBase::compare(const ResourceRequest& a, const ResourceRequest& b)
 {
     if (!equalIgnoringHeaderFields(a, b))
         return false;
@@ -363,7 +364,7 @@ bool operator==(const ResourceRequestBase& a, const ResourceRequestBase& b)
     if (a.httpHeaderFields() != b.httpHeaderFields())
         return false;
         
-    return true;
+    return ResourceRequest::platformCompare(a, b);
 }
 
 bool ResourceRequestBase::isConditional() const
diff --git a/WebCore/platform/network/ResourceRequestBase.h b/WebCore/platform/network/ResourceRequestBase.h
index 1622cdd..33a184e 100644
--- a/WebCore/platform/network/ResourceRequestBase.h
+++ b/WebCore/platform/network/ResourceRequestBase.h
@@ -136,10 +136,16 @@ namespace WebCore {
         bool reportLoadTiming() const { return m_reportLoadTiming; }
         void setReportLoadTiming(bool reportLoadTiming) { m_reportLoadTiming = reportLoadTiming; }
 
+        // Whether actual headers being sent/received should be collected and reported for the request.
+        bool reportRawHeaders() const { return m_reportRawHeaders; }
+        void setReportRawHeaders(bool reportRawHeaders) { m_reportRawHeaders = reportRawHeaders; }
+
         // What this request is for.
         TargetType targetType() const { return m_targetType; }
         void setTargetType(TargetType type) { m_targetType = type; }
 
+        static bool compare(const ResourceRequest&, const ResourceRequest&);
+
     protected:
         // Used when ResourceRequest is initialized from a platform representation of the request
         ResourceRequestBase()
@@ -147,6 +153,7 @@ namespace WebCore {
             , m_platformRequestUpdated(true)
             , m_reportUploadProgress(false)
             , m_reportLoadTiming(false)
+            , m_reportRawHeaders(false)
             , m_targetType(TargetIsSubresource)
         {
         }
@@ -161,6 +168,7 @@ namespace WebCore {
             , m_platformRequestUpdated(false)
             , m_reportUploadProgress(false)
             , m_reportLoadTiming(false)
+            , m_reportRawHeaders(false)
             , m_targetType(TargetIsSubresource)
         {
         }
@@ -168,6 +176,9 @@ namespace WebCore {
         void updatePlatformRequest() const; 
         void updateResourceRequest() const; 
 
+        // The ResourceRequest subclass may "shadow" this method to compare platform specific fields
+        static bool platformCompare(const ResourceRequest&, const ResourceRequest&) { return true; }
+
         KURL m_url;
 
         ResourceRequestCachePolicy m_cachePolicy;
@@ -182,6 +193,7 @@ namespace WebCore {
         mutable bool m_platformRequestUpdated;
         bool m_reportUploadProgress;
         bool m_reportLoadTiming;
+        bool m_reportRawHeaders;
         TargetType m_targetType;
 
     private:
@@ -190,10 +202,10 @@ namespace WebCore {
 
     bool equalIgnoringHeaderFields(const ResourceRequestBase&, const ResourceRequestBase&);
 
-    bool operator==(const ResourceRequestBase&, const ResourceRequestBase&);
-    inline bool operator!=(ResourceRequestBase& a, const ResourceRequestBase& b) { return !(a == b); }
+    inline bool operator==(const ResourceRequest& a, const ResourceRequest& b) { return ResourceRequestBase::compare(a, b); }
+    inline bool operator!=(ResourceRequest& a, const ResourceRequest& b) { return !(a == b); }
 
-    struct CrossThreadResourceRequestData : Noncopyable {
+    struct CrossThreadResourceRequestDataBase : Noncopyable {
         KURL m_url;
 
         ResourceRequestCachePolicy m_cachePolicy;
diff --git a/WebCore/platform/network/ResourceResponseBase.cpp b/WebCore/platform/network/ResourceResponseBase.cpp
index e231652..a254168 100644
--- a/WebCore/platform/network/ResourceResponseBase.cpp
+++ b/WebCore/platform/network/ResourceResponseBase.cpp
@@ -39,6 +39,11 @@ namespace WebCore {
 
 static void parseCacheHeader(const String& header, Vector<pair<String, String> >& result);
 
+inline const ResourceResponse& ResourceResponseBase::asResourceResponse() const
+{
+    return *static_cast<const ResourceResponse*>(this);
+}
+
 ResourceResponseBase::ResourceResponseBase()  
     : m_expectedContentLength(0)
     , m_httpStatusCode(0)
@@ -107,7 +112,7 @@ PassOwnPtr<ResourceResponse> ResourceResponseBase::adopt(PassOwnPtr<CrossThreadR
     response->m_httpHeaderFields.adopt(data->m_httpHeaders.release());
     response->setLastModifiedDate(data->m_lastModifiedDate);
     response->setResourceLoadTiming(data->m_resourceLoadTiming.release());
-
+    response->doPlatformAdopt(data);
     return response.release();
 }
 
@@ -125,7 +130,7 @@ PassOwnPtr<CrossThreadResourceResponseData> ResourceResponseBase::copyData() con
     data->m_lastModifiedDate = lastModifiedDate();
     if (m_resourceLoadTiming)
         data->m_resourceLoadTiming = m_resourceLoadTiming->deepCopy();
-    return data.release();
+    return asResourceResponse().doPlatformCopyData(data.release());
 }
 
 bool ResourceResponseBase::isHTTP() const
@@ -515,6 +520,20 @@ void ResourceResponseBase::setResourceLoadTiming(PassRefPtr<ResourceLoadTiming>
     m_resourceLoadTiming = resourceLoadTiming;
 }
 
+PassRefPtr<ResourceRawHeaders> ResourceResponseBase::resourceRawHeaders() const
+{
+    lazyInit();
+
+    return m_resourceRawHeaders.get();
+}
+
+void ResourceResponseBase::setResourceRawHeaders(PassRefPtr<ResourceRawHeaders> headers)
+{
+    lazyInit();
+
+    m_resourceRawHeaders = headers;
+}
+
 void ResourceResponseBase::lazyInit() const
 {
     const_cast<ResourceResponse*>(static_cast<const ResourceResponse*>(this))->platformLazyInit();
diff --git a/WebCore/platform/network/ResourceResponseBase.h b/WebCore/platform/network/ResourceResponseBase.h
index 65e24ad..4da13bb 100644
--- a/WebCore/platform/network/ResourceResponseBase.h
+++ b/WebCore/platform/network/ResourceResponseBase.h
@@ -30,6 +30,7 @@
 #include "HTTPHeaderMap.h"
 #include "KURL.h"
 #include "ResourceLoadTiming.h"
+#include "ResourceRawHeaders.h"
 
 #include <wtf/PassOwnPtr.h>
 #include <wtf/RefPtr.h>
@@ -109,6 +110,9 @@ public:
     ResourceLoadTiming* resourceLoadTiming() const;
     void setResourceLoadTiming(PassRefPtr<ResourceLoadTiming>);
 
+    PassRefPtr<ResourceRawHeaders> resourceRawHeaders() const;
+    void setResourceRawHeaders(PassRefPtr<ResourceRawHeaders>);
+
     // The ResourceResponse subclass may "shadow" this method to provide platform-specific memory usage information
     unsigned memoryUsage() const
     {
@@ -116,7 +120,7 @@ public:
         return 1280;
     }
 
-    static bool compare(const ResourceResponse& a, const ResourceResponse& b);
+    static bool compare(const ResourceResponse&, const ResourceResponse&);
 
 protected:
     ResourceResponseBase();
@@ -143,10 +147,12 @@ protected:
     unsigned m_connectionID;
     bool m_connectionReused : 1;
     RefPtr<ResourceLoadTiming> m_resourceLoadTiming;
+    RefPtr<ResourceRawHeaders> m_resourceRawHeaders;
 
     bool m_isNull : 1;
     
 private:
+    const ResourceResponse& asResourceResponse() const;
     void parseCacheControlDirectives() const;
 
     mutable bool m_haveParsedCacheControlHeader : 1;
@@ -169,7 +175,7 @@ private:
 inline bool operator==(const ResourceResponse& a, const ResourceResponse& b) { return ResourceResponseBase::compare(a, b); }
 inline bool operator!=(const ResourceResponse& a, const ResourceResponse& b) { return !(a == b); }
 
-struct CrossThreadResourceResponseData : Noncopyable {
+struct CrossThreadResourceResponseDataBase : Noncopyable {
     KURL m_url;
     String m_mimeType;
     long long m_expectedContentLength;
diff --git a/WebCore/platform/network/android/ResourceRequest.h b/WebCore/platform/network/android/ResourceRequest.h
index 1edd4bf..745c2ef 100644
--- a/WebCore/platform/network/android/ResourceRequest.h
+++ b/WebCore/platform/network/android/ResourceRequest.h
@@ -53,6 +53,12 @@ public:
 
 private:
     friend class ResourceRequestBase;
+
+    PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+};
+
+struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/android/ResourceResponse.h b/WebCore/platform/network/android/ResourceResponse.h
index e6ae2cc..78307b9 100644
--- a/WebCore/platform/network/android/ResourceResponse.h
+++ b/WebCore/platform/network/android/ResourceResponse.h
@@ -46,6 +46,12 @@ private:
     {
         notImplemented();
     }
+
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+};
+
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/cf/ProxyServerCFNet.cpp b/WebCore/platform/network/cf/ProxyServerCFNet.cpp
new file mode 100644
index 0000000..3bef808
--- /dev/null
+++ b/WebCore/platform/network/cf/ProxyServerCFNet.cpp
@@ -0,0 +1,98 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyServer.h"
+
+#include "KURL.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
+static void addProxyServersForURL(Vector<ProxyServer>& proxyServers, const KURL& url)
+{
+    RetainPtr<CFDictionaryRef> proxySettings(AdoptCF, CFNetworkCopySystemProxySettings());
+    if (!proxySettings)
+        return;
+
+    RetainPtr<CFURLRef> cfURL(AdoptCF, url.createCFURL());
+    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL(cfURL.get(), proxySettings.get()));
+    if (!proxiesForURL)
+        return;
+
+    CFIndex numProxies = CFArrayGetCount(proxiesForURL.get());
+    for (CFIndex i = 0; i < numProxies; ++i) {
+        CFDictionaryRef proxyDictionary = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxiesForURL.get(), i));
+
+        ProxyServer::Type type = ProxyServer::Direct;
+        CFStringRef typeString = static_cast<CFStringRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyTypeKey));
+        if (CFEqual(typeString, kCFProxyTypeAutoConfigurationURL)) {
+            // FIXME: Handle PAC URLs.
+            continue;
+        } 
+        
+        if (CFEqual(typeString, kCFProxyTypeNone)) {
+            proxyServers.append(ProxyServer(ProxyServer::Direct, String(), -1));
+            continue;
+        }
+        
+        if (CFEqual(typeString, kCFProxyTypeHTTP))
+            type = ProxyServer::HTTP;
+        else if (CFEqual(typeString, kCFProxyTypeHTTPS))
+            type = ProxyServer::HTTPS;
+        else if (CFEqual(typeString, kCFProxyTypeSOCKS))
+            type = ProxyServer::SOCKS;
+        else {
+            // We don't know how to handle this type.
+            continue;
+        }
+
+        CFStringRef host = static_cast<CFStringRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyHostNameKey));
+        CFNumberRef port = static_cast<CFNumberRef>(CFDictionaryGetValue(proxyDictionary, kCFProxyPortNumberKey));
+        SInt32 portValue;
+        CFNumberGetValue(port, kCFNumberSInt32Type, &portValue);
+
+        proxyServers.append(ProxyServer(type, host, portValue));
+    }
+}
+
+Vector<ProxyServer> proxyServersForURL(const KURL& url, const NetworkingContext*)
+{
+    Vector<ProxyServer> proxyServers;
+    
+    addProxyServersForURL(proxyServers, url);
+    return proxyServers;
+    
+}
+#else
+Vector<ProxyServer> proxyServersForURL(const KURL&, const NetworkingContext*)
+{
+    // FIXME: Implement.
+    return Vector<ProxyServer>();
+}
+#endif
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/cf/ResourceRequest.h b/WebCore/platform/network/cf/ResourceRequest.h
index e361af5..9ed79f2 100644
--- a/WebCore/platform/network/cf/ResourceRequest.h
+++ b/WebCore/platform/network/cf/ResourceRequest.h
@@ -68,10 +68,16 @@ namespace WebCore {
 
         void doUpdatePlatformRequest();
         void doUpdateResourceRequest();
-        
+
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+
         RetainPtr<CFURLRequestRef> m_cfRequest;      
     };
 
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
+    };
+
 } // namespace WebCore
 
 #endif // ResourceRequest_h
diff --git a/WebCore/platform/network/cf/ResourceResponse.h b/WebCore/platform/network/cf/ResourceResponse.h
index 04cc82c..5e27670 100644
--- a/WebCore/platform/network/cf/ResourceResponse.h
+++ b/WebCore/platform/network/cf/ResourceResponse.h
@@ -70,12 +70,18 @@ private:
     friend class ResourceResponseBase;
 
     void platformLazyInit();
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+
     static bool platformCompare(const ResourceResponse& a, const ResourceResponse& b);
 
     RetainPtr<CFURLResponseRef> m_cfResponse;
     bool m_isUpToDate;
 };
 
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
+};
+
 } // namespace WebCore
 
 #endif // ResourceResponse_h
diff --git a/WebCore/platform/network/cf/SocketStreamHandle.h b/WebCore/platform/network/cf/SocketStreamHandle.h
index 63bf9a7..8643db7 100644
--- a/WebCore/platform/network/cf/SocketStreamHandle.h
+++ b/WebCore/platform/network/cf/SocketStreamHandle.h
@@ -36,6 +36,7 @@
 #include "SocketStreamHandleBase.h"
 #include <wtf/RetainPtr.h>
 
+
 namespace WebCore {
 
     class AuthenticationChallenge;
diff --git a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
index c66de33..800301a 100644
--- a/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
+++ b/WebCore/platform/network/cf/SocketStreamHandleCFNet.cpp
@@ -194,8 +194,10 @@ void SocketStreamHandle::chooseProxy()
 
 void SocketStreamHandle::chooseProxyFromArray(CFArrayRef proxyArray)
 {
-    if (!proxyArray)
+    if (!proxyArray) {
         m_connectionType = Direct;
+        return;
+    }
 
     CFIndex proxyArrayCount = CFArrayGetCount(proxyArray);
 
@@ -565,7 +567,7 @@ void SocketStreamHandle::writeStreamCallback(CFStreamEventType type)
             break;
         }
 
-        ASSERT(m_state = Open);
+        ASSERT(m_state == Open);
         ASSERT(m_connectingSubstate == Connected);
 
         sendPendingData();
diff --git a/WebCore/platform/network/chromium/ResourceRequest.cpp b/WebCore/platform/network/chromium/ResourceRequest.cpp
index 016bd34..a33895a 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.cpp
+++ b/WebCore/platform/network/chromium/ResourceRequest.cpp
@@ -37,4 +37,19 @@ unsigned initializeMaximumHTTPConnectionCountPerHost()
     return 10000;
 }
 
+PassOwnPtr<CrossThreadResourceRequestData> ResourceRequest::doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const
+{
+    data->m_requestorID = m_requestorID;
+    data->m_requestorProcessID = m_requestorProcessID;
+    data->m_appCacheHostID = m_appCacheHostID;
+    return data;
+}
+
+void ResourceRequest::doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData> data)
+{
+    m_requestorID = data->m_requestorID;
+    m_requestorProcessID = data->m_requestorProcessID;
+    m_appCacheHostID = data->m_appCacheHostID;
+}
+
 } // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceRequest.h b/WebCore/platform/network/chromium/ResourceRequest.h
index 8ef0c5e..8571cf4 100644
--- a/WebCore/platform/network/chromium/ResourceRequest.h
+++ b/WebCore/platform/network/chromium/ResourceRequest.h
@@ -90,6 +90,15 @@ namespace WebCore {
         void doUpdatePlatformRequest() {}
         void doUpdateResourceRequest() {}
 
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData>) const;
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>);
+
+        int m_requestorID;
+        int m_requestorProcessID;
+        int m_appCacheHostID;
+    };
+
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
         int m_requestorID;
         int m_requestorProcessID;
         int m_appCacheHostID;
diff --git a/WebCore/platform/network/chromium/ResourceResponse.cpp b/WebCore/platform/network/chromium/ResourceResponse.cpp
new file mode 100644
index 0000000..acd44d3
--- /dev/null
+++ b/WebCore/platform/network/chromium/ResourceResponse.cpp
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Google, Inc.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "ResourceResponse.h"
+
+namespace WebCore {
+
+PassOwnPtr<CrossThreadResourceResponseData> ResourceResponse::doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const
+{
+    data->m_appCacheID = m_appCacheID;
+    data->m_appCacheManifestURL = m_appCacheManifestURL.copy();
+    data->m_isContentFiltered = m_isContentFiltered;
+    data->m_isMultipartPayload = m_isMultipartPayload;
+    data->m_wasFetchedViaSPDY = m_wasFetchedViaSPDY;
+    data->m_wasNpnNegotiated = m_wasNpnNegotiated;
+    data->m_wasAlternateProtocolAvailable = m_wasAlternateProtocolAvailable;
+    data->m_wasFetchedViaProxy = m_wasFetchedViaProxy;
+    data->m_responseTime = m_responseTime;
+    return data;
+}
+
+void ResourceResponse::doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData> data)
+{
+    m_appCacheID = data->m_appCacheID;
+    m_appCacheManifestURL = data->m_appCacheManifestURL.copy();
+    m_isContentFiltered = data->m_isContentFiltered;
+    m_isMultipartPayload = data->m_isMultipartPayload;
+    m_wasFetchedViaSPDY = data->m_wasFetchedViaSPDY;
+    m_wasNpnNegotiated = data->m_wasNpnNegotiated;
+    m_wasAlternateProtocolAvailable = data->m_wasAlternateProtocolAvailable;
+    m_wasFetchedViaProxy = data->m_wasFetchedViaProxy;
+    m_responseTime = data->m_responseTime;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/chromium/ResourceResponse.h b/WebCore/platform/network/chromium/ResourceResponse.h
index 852b9f5..5e99994 100644
--- a/WebCore/platform/network/chromium/ResourceResponse.h
+++ b/WebCore/platform/network/chromium/ResourceResponse.h
@@ -109,6 +109,9 @@ namespace WebCore {
             notImplemented();
         }
 
+        PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData>) const;
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>);
+
         // The id of the appcache this response was retrieved from, or zero if
         // the response was not retrieved from an appcache.
         long long m_appCacheID;
@@ -142,6 +145,18 @@ namespace WebCore {
         double m_responseTime;
     };
 
+    struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
+        long long m_appCacheID;
+        KURL m_appCacheManifestURL;
+        bool m_isContentFiltered;
+        bool m_isMultipartPayload;
+        bool m_wasFetchedViaSPDY;
+        bool m_wasNpnNegotiated;
+        bool m_wasAlternateProtocolAvailable;
+        bool m_wasFetchedViaProxy;
+        double m_responseTime;
+    };
+
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/platform/network/curl/ProxyServerCurl.cpp b/WebCore/platform/network/curl/ProxyServerCurl.cpp
new file mode 100644
index 0000000..212768a
--- /dev/null
+++ b/WebCore/platform/network/curl/ProxyServerCurl.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyServer.h"
+
+#include "KURL.h"
+#include <wtf/RetainPtr.h>
+
+namespace WebCore {
+
+Vector<ProxyServer> proxyServersForURL(const KURL&, const NetworkingContext*)
+{
+    // FIXME: Implement.
+    return Vector<ProxyServer>();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/curl/ResourceHandleCurl.cpp b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
index 052ac56..f360f86 100644
--- a/WebCore/platform/network/curl/ResourceHandleCurl.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleCurl.cpp
@@ -83,14 +83,6 @@ void WebCoreSynchronousLoader::didFail(ResourceHandle*, const ResourceError& err
     m_error = error;
 }
 
-
-static HashSet<String>& allowsAnyHTTPSCertificateHosts()
-{
-    static HashSet<String> hosts;
-
-    return hosts;
-}
-
 ResourceHandleInternal::~ResourceHandleInternal()
 {
     fastFree(m_url);
@@ -133,6 +125,13 @@ bool ResourceHandle::supportsBufferedData()
 }
 
 #if PLATFORM(WIN) && PLATFORM(CF)
+static HashSet<String>& allowsAnyHTTPSCertificateHosts()
+{
+    static HashSet<String> hosts;
+
+    return hosts;
+}
+
 void ResourceHandle::setHostAllowsAnyHTTPSCertificate(const String& host)
 {
     allowsAnyHTTPSCertificateHosts().add(host.lower());
diff --git a/WebCore/platform/network/curl/ResourceHandleManager.cpp b/WebCore/platform/network/curl/ResourceHandleManager.cpp
index a4d71e0..2e4259c 100644
--- a/WebCore/platform/network/curl/ResourceHandleManager.cpp
+++ b/WebCore/platform/network/curl/ResourceHandleManager.cpp
@@ -34,14 +34,13 @@
 #include "config.h"
 #include "ResourceHandleManager.h"
 
-#include "Base64.h"
+#include "DataURL.h"
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
 #include "ResourceError.h"
 #include "ResourceHandle.h"
 #include "ResourceHandleInternal.h"
-#include "TextEncoding.h"
 
 #include <errno.h>
 #include <stdio.h>
@@ -121,8 +120,9 @@ static void curl_unlock_callback(CURL* handle, curl_lock_data data, void* userPt
 ResourceHandleManager::ResourceHandleManager()
     : m_downloadTimer(this, &ResourceHandleManager::downloadTimerCallback)
     , m_cookieJarFileName(0)
-    , m_runningJobs(0)
     , m_certificatePath (certificatePath())
+    , m_runningJobs(0)
+
 {
     curl_global_init(CURL_GLOBAL_ALL);
     m_curlMultiHandle = curl_multi_init();
@@ -164,7 +164,7 @@ static void handleLocalReceiveResponse (CURL* handle, ResourceHandle* job, Resou
     // TODO: See if there is a better approach for handling this.
      const char* hdr;
      CURLcode err = curl_easy_getinfo(handle, CURLINFO_EFFECTIVE_URL, &hdr);
-     ASSERT(CURLE_OK == err);
+     ASSERT_UNUSED(err, CURLE_OK == err);
      d->m_response.setURL(KURL(ParsedURLString, hdr));
      if (d->client())
          d->client()->didReceiveResponse(job, d->m_response);
@@ -372,7 +372,7 @@ void ResourceHandleManager::downloadTimerCallback(Timer<ResourceHandleManager>*
         ASSERT(handle);
         ResourceHandle* job = 0;
         CURLcode err = curl_easy_getinfo(handle, CURLINFO_PRIVATE, &job);
-        ASSERT(CURLE_OK == err);
+        ASSERT_UNUSED(err, CURLE_OK == err);
         ASSERT(job);
         if (!job)
             continue;
@@ -572,67 +572,12 @@ bool ResourceHandleManager::startScheduledJobs()
     return started;
 }
 
-static void parseDataUrl(ResourceHandle* handle)
-{
-    ResourceHandleClient* client = handle->client();
-
-    ASSERT(client);
-    if (!client)
-        return;
-
-    String url = handle->firstRequest().url().string();
-    ASSERT(url.startsWith("data:", false));
-
-    int index = url.find(',');
-    if (index == -1) {
-        client->cannotShowURL(handle);
-        return;
-    }
-
-    String mediaType = url.substring(5, index - 5);
-    String data = url.substring(index + 1);
-
-    bool base64 = mediaType.endsWith(";base64", false);
-    if (base64)
-        mediaType = mediaType.left(mediaType.length() - 7);
-
-    if (mediaType.isEmpty())
-        mediaType = "text/plain;charset=US-ASCII";
-
-    String mimeType = extractMIMETypeFromMediaType(mediaType);
-    String charset = extractCharsetFromMediaType(mediaType);
-
-    ResourceResponse response;
-    response.setMimeType(mimeType);
-
-    if (base64) {
-        data = decodeURLEscapeSequences(data);
-        response.setTextEncodingName(charset);
-        client->didReceiveResponse(handle, response);
-
-        // WebCore's decoder fails on Acid3 test 97 (whitespace).
-        Vector<char> out;
-        CString latin1 = data.latin1();
-        if (base64Decode(latin1.data(), latin1.length(), out) && out.size() > 0)
-            client->didReceiveData(handle, out.data(), out.size(), 0);
-    } else {
-        // We have to convert to UTF-16 early due to limitations in KURL
-        data = decodeURLEscapeSequences(data, TextEncoding(charset));
-        response.setTextEncodingName("UTF-16");
-        client->didReceiveResponse(handle, response);
-        if (data.length() > 0)
-            client->didReceiveData(handle, reinterpret_cast<const char*>(data.characters()), data.length() * sizeof(UChar), 0);
-    }
-
-    client->didFinishLoading(handle, 0);
-}
-
 void ResourceHandleManager::dispatchSynchronousJob(ResourceHandle* job)
 {
     KURL kurl = job->firstRequest().url();
 
-    if (kurl.protocolIs("data")) {
-        parseDataUrl(job);
+    if (kurl.protocolIsData()) {
+        handleDataURL(job);
         return;
     }
 
@@ -662,8 +607,8 @@ void ResourceHandleManager::startJob(ResourceHandle* job)
 {
     KURL kurl = job->firstRequest().url();
 
-    if (kurl.protocolIs("data")) {
-        parseDataUrl(job);
+    if (kurl.protocolIsData()) {
+        handleDataURL(job);
         return;
     }
 
@@ -711,7 +656,7 @@ void ResourceHandleManager::initializeHandle(ResourceHandle* job)
         CURLcode error = curl_easy_pause(d->m_handle, CURLPAUSE_ALL);
         // If we did not pause the handle, we would ASSERT in the
         // header callback. So just assert here.
-        ASSERT(error == CURLE_OK);
+        ASSERT_UNUSED(error, error == CURLE_OK);
     }
 #endif
 #ifndef NDEBUG
diff --git a/WebCore/platform/network/curl/ResourceRequest.h b/WebCore/platform/network/curl/ResourceRequest.h
index 12dc214..c88501a 100644
--- a/WebCore/platform/network/curl/ResourceRequest.h
+++ b/WebCore/platform/network/curl/ResourceRequest.h
@@ -69,6 +69,12 @@ namespace WebCore {
 
         void doUpdatePlatformRequest() {}
         void doUpdateResourceRequest() {}
+
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+    };
+
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/curl/ResourceResponse.h b/WebCore/platform/network/curl/ResourceResponse.h
index 860e902..49dd56c 100644
--- a/WebCore/platform/network/curl/ResourceResponse.h
+++ b/WebCore/platform/network/curl/ResourceResponse.h
@@ -28,7 +28,7 @@
 
 #include "ResourceResponseBase.h"
 
-typedef const struct _CFURLResponse* CFURLResponseRef;
+typedef struct _CFURLResponse* CFURLResponseRef;
 
 namespace WebCore {
 
@@ -52,9 +52,17 @@ public:
     CFURLResponseRef cfURLResponse() const { return 0; }
 
 private:
+    friend class ResourceResponseBase;
+
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+
     bool m_responseFired;
 };
 
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
+};
+
 } // namespace WebCore
 
 #endif // ResourceResponse_h
diff --git a/WebCore/platform/network/mac/FormDataStreamMac.mm b/WebCore/platform/network/mac/FormDataStreamMac.mm
index ed98356..9b5884f 100644
--- a/WebCore/platform/network/mac/FormDataStreamMac.mm
+++ b/WebCore/platform/network/mac/FormDataStreamMac.mm
@@ -424,7 +424,7 @@ void setHTTPBody(NSMutableURLRequest *request, PassRefPtr<FormData> formData)
                     for (size_t j = 0; j < blobData->items().size(); ++j) {
                         const BlobDataItem& blobItem = blobData->items()[j];
                         if (blobItem.type == BlobDataItem::Data) {
-                            newFormData->appendData(blobItem.data.data() + static_cast<int>(blobItem.offset), static_cast<int>(blobItem.length));
+                            newFormData->appendData(blobItem.data->data() + static_cast<int>(blobItem.offset), static_cast<int>(blobItem.length));
                         } else {
                             ASSERT(blobItem.type == BlobDataItem::File);
                             newFormData->appendFileRange(blobItem.path, blobItem.offset, blobItem.length, blobItem.expectedModificationTime);
diff --git a/WebCore/platform/network/mac/ResourceRequest.h b/WebCore/platform/network/mac/ResourceRequest.h
index b09e72d..ea0d13a 100644
--- a/WebCore/platform/network/mac/ResourceRequest.h
+++ b/WebCore/platform/network/mac/ResourceRequest.h
@@ -73,10 +73,16 @@ namespace WebCore {
 
         void doUpdatePlatformRequest();
         void doUpdateResourceRequest();
-        
+
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+
         RetainPtr<NSURLRequest> m_nsRequest;
     };
 
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
+    };
+
 } // namespace WebCore
 
 #endif // ResourceRequest_h
diff --git a/WebCore/platform/network/mac/ResourceResponse.h b/WebCore/platform/network/mac/ResourceResponse.h
index 16b0cbf..2867e9f 100644
--- a/WebCore/platform/network/mac/ResourceResponse.h
+++ b/WebCore/platform/network/mac/ResourceResponse.h
@@ -75,12 +75,19 @@ private:
     friend class ResourceResponseBase;
 
     void platformLazyInit();
+
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+
     static bool platformCompare(const ResourceResponse& a, const ResourceResponse& b);
 
     RetainPtr<NSURLResponse> m_nsResponse;
     bool m_isUpToDate;
 };
 
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
+};
+
 } // namespace WebCore
 
 #endif // ResourceResponse_h
diff --git a/WebCore/platform/network/qt/ProxyServerQt.cpp b/WebCore/platform/network/qt/ProxyServerQt.cpp
new file mode 100644
index 0000000..0bf3687
--- /dev/null
+++ b/WebCore/platform/network/qt/ProxyServerQt.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyServer.h"
+
+#include "KURL.h"
+#include "NetworkingContext.h"
+
+#include <QNetworkAccessManager>
+#include <QNetworkProxy>
+#include <QNetworkProxyFactory>
+#include <QNetworkProxyQuery>
+#include <QUrl>
+
+namespace WebCore {
+
+Vector<ProxyServer> proxyServersForURL(const KURL& url, const NetworkingContext* context)
+{
+    Vector<ProxyServer> servers;
+    
+    const QNetworkAccessManager* accessManager = context ? context->networkAccessManager() : 0;
+    QNetworkProxyFactory* proxyFactory = accessManager ? accessManager->proxyFactory() : 0;
+
+    if (proxyFactory) {
+        const QList<QNetworkProxy> proxies = proxyFactory->queryProxy(QNetworkProxyQuery(url));
+        Q_FOREACH(const QNetworkProxy& proxy, proxies) {
+            ProxyServer::Type proxyType;
+            switch (proxy.type()) {
+            case QNetworkProxy::Socks5Proxy:
+                proxyType = ProxyServer::SOCKS;
+                break;
+            case QNetworkProxy::HttpProxy:
+            case QNetworkProxy::HttpCachingProxy:
+            case QNetworkProxy::FtpCachingProxy:
+                proxyType = ProxyServer::HTTP;
+                break;
+            case QNetworkProxy::DefaultProxy:
+            case QNetworkProxy::NoProxy:
+            default:
+                proxyType = ProxyServer::Direct;
+                break;
+            }
+            servers.append(ProxyServer(proxyType, proxy.hostName(), proxy.port()));
+        }
+    }
+
+    return servers;
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
index ca3af75..01e624e 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.cpp
@@ -30,6 +30,7 @@
 #include "ResourceRequest.h"
 #include <QDateTime>
 #include <QFile>
+#include <QFileInfo>
 #include <QNetworkReply>
 #include <QNetworkCookie>
 #include <qwebframe.h>
@@ -59,11 +60,14 @@ FormDataIODevice::FormDataIODevice(FormData* data)
     : m_formElements(data ? data->elements() : Vector<FormDataElement>())
     , m_currentFile(0)
     , m_currentDelta(0)
+    , m_fileSize(0)
+    , m_dataSize(0)
 {
     setOpenMode(FormDataIODevice::ReadOnly);
 
     if (!m_formElements.isEmpty() && m_formElements[0].m_type == FormDataElement::encodedFile)
         openFileForCurrentElement();
+    computeSize();
 }
 
 FormDataIODevice::~FormDataIODevice()
@@ -71,6 +75,20 @@ FormDataIODevice::~FormDataIODevice()
     delete m_currentFile;
 }
 
+qint64 FormDataIODevice::computeSize() 
+{
+    for (int i = 0; i < m_formElements.size(); ++i) {
+        const FormDataElement& element = m_formElements[i];
+        if (element.m_type == FormDataElement::data) 
+            m_dataSize += element.m_data.size();
+        else {
+            QFileInfo fi(element.m_filename);
+            m_fileSize += fi.size();
+        }
+    }
+    return m_dataSize + m_fileSize;
+}
+
 void FormDataIODevice::moveToNextElement()
 {
     if (m_currentFile)
@@ -137,6 +155,29 @@ bool FormDataIODevice::isSequential() const
     return true;
 }
 
+String QNetworkReplyHandler::httpMethod() const
+{
+    switch (m_method) {
+    case QNetworkAccessManager::GetOperation:
+        return "GET";
+    case QNetworkAccessManager::HeadOperation:
+        return "HEAD";
+    case QNetworkAccessManager::PostOperation:
+        return "POST";
+    case QNetworkAccessManager::PutOperation:
+        return "PUT";
+    case QNetworkAccessManager::DeleteOperation:
+        return "DELETE";
+#if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
+    case QNetworkAccessManager::CustomOperation:
+        return m_resourceHandle->firstRequest().httpMethod();
+#endif
+    default:
+        ASSERT_NOT_REACHED();
+        return "GET";
+    }
+}
+
 QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode loadMode)
     : QObject(0)
     , m_reply(0)
@@ -164,11 +205,12 @@ QNetworkReplyHandler::QNetworkReplyHandler(ResourceHandle* handle, LoadMode load
     else if (r.httpMethod() == "DELETE")
         m_method = QNetworkAccessManager::DeleteOperation;
 #if QT_VERSION >= QT_VERSION_CHECK(4, 7, 0)
-    else if (r.httpMethod() == "OPTIONS")
+    else
         m_method = QNetworkAccessManager::CustomOperation;
-#endif
+#else
     else
         m_method = QNetworkAccessManager::UnknownOperation;
+#endif
 
     QObject* originatingObject = 0;
     if (m_resourceHandle->getInternal()->m_context)
@@ -359,13 +401,17 @@ void QNetworkReplyHandler::sendResponseIfNeeded()
         }
         m_redirected = true;
 
-        ResourceRequest newRequest = m_resourceHandle->firstRequest();
-        newRequest.setURL(newUrl);
 
-        if (((statusCode >= 301 && statusCode <= 303) || statusCode == 307) && newRequest.httpMethod() == "POST") {
+        //  Status Code 301 (Moved Permanently), 302 (Moved Temporarily), 303 (See Other):
+        //    - If original request is POST convert to GET and redirect automatically
+        //  Status Code 307 (Temporary Redirect) and all other redirect status codes:
+        //    - Use the HTTP method from the previous request
+        if ((statusCode >= 301 && statusCode <= 303) && m_resourceHandle->firstRequest().httpMethod() == "POST")
             m_method = QNetworkAccessManager::GetOperation;
-            newRequest.setHTTPMethod("GET");
-        }
+
+        ResourceRequest newRequest = m_resourceHandle->firstRequest();
+        newRequest.setHTTPMethod(httpMethod());
+        newRequest.setURL(newUrl);
 
         // Should not set Referer after a redirect from a secure resource to non-secure one.
         if (!newRequest.url().protocolIs("https") && protocolIs(newRequest.httpReferrer(), "https"))
@@ -453,6 +499,9 @@ void QNetworkReplyHandler::start()
             break;
         case QNetworkAccessManager::PostOperation: {
             FormDataIODevice* postDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            // We may be uploading files so prevent QNR from buffering data
+            m_request.setHeader(QNetworkRequest::ContentLengthHeader, postDevice->getFormDataSize());
+            m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
             m_reply = manager->post(m_request, postDevice);
             postDevice->setParent(m_reply);
             break;
@@ -462,6 +511,9 @@ void QNetworkReplyHandler::start()
             break;
         case QNetworkAccessManager::PutOperation: {
             FormDataIODevice* putDevice = new FormDataIODevice(d->m_firstRequest.httpBody()); 
+            // We may be uploading files so prevent QNR from buffering data
+            m_request.setHeader(QNetworkRequest::ContentLengthHeader, putDevice->getFormDataSize());
+            m_request.setAttribute(QNetworkRequest::DoNotBufferUploadDataAttribute, QVariant(true));
             m_reply = manager->put(m_request, putDevice);
             putDevice->setParent(m_reply);
             break;
diff --git a/WebCore/platform/network/qt/QNetworkReplyHandler.h b/WebCore/platform/network/qt/QNetworkReplyHandler.h
index f6b2358..884a1a4 100644
--- a/WebCore/platform/network/qt/QNetworkReplyHandler.h
+++ b/WebCore/platform/network/qt/QNetworkReplyHandler.h
@@ -67,6 +67,7 @@ private slots:
 private:
     void start();
     void resetState();
+    String httpMethod() const;
 
     QNetworkReply* m_reply;
     ResourceHandle* m_resourceHandle;
@@ -97,6 +98,7 @@ public:
     ~FormDataIODevice();
 
     bool isSequential() const;
+    qint64 getFormDataSize() const { return m_fileSize + m_dataSize; }
 
 protected:
     qint64 readData(char*, qint64);
@@ -104,12 +106,15 @@ protected:
 
 private:
     void moveToNextElement();
+    qint64 computeSize();
     void openFileForCurrentElement();
 
 private:
     Vector<FormDataElement> m_formElements;
     QFile* m_currentFile;
     qint64 m_currentDelta;
+    qint64 m_fileSize;
+    qint64 m_dataSize;
 };
 
 }
diff --git a/WebCore/platform/network/qt/ResourceRequest.h b/WebCore/platform/network/qt/ResourceRequest.h
index fb69326..0c7b62b 100644
--- a/WebCore/platform/network/qt/ResourceRequest.h
+++ b/WebCore/platform/network/qt/ResourceRequest.h
@@ -66,6 +66,12 @@ namespace WebCore {
 
         void doUpdatePlatformRequest() {}
         void doUpdateResourceRequest() {}
+
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+    };
+
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/qt/ResourceResponse.h b/WebCore/platform/network/qt/ResourceResponse.h
index 345ef25..288cf84 100644
--- a/WebCore/platform/network/qt/ResourceResponse.h
+++ b/WebCore/platform/network/qt/ResourceResponse.h
@@ -40,6 +40,15 @@ public:
         : ResourceResponseBase(url, mimeType, expectedLength, textEncodingName, filename)
     {
     }
+
+private:
+    friend class ResourceResponseBase;
+
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+};
+
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/qt/SocketStreamHandle.h b/WebCore/platform/network/qt/SocketStreamHandle.h
index 5c55749..e725344 100644
--- a/WebCore/platform/network/qt/SocketStreamHandle.h
+++ b/WebCore/platform/network/qt/SocketStreamHandle.h
@@ -38,6 +38,10 @@
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 
+#if !PLATFORM(QT)
+#error This should only be built on Qt
+#endif
+
 namespace WebCore {
 
     class AuthenticationChallenge;
diff --git a/WebCore/platform/network/qt/SocketStreamHandlePrivate.h b/WebCore/platform/network/qt/SocketStreamHandlePrivate.h
index 235f1b1..d074f42 100644
--- a/WebCore/platform/network/qt/SocketStreamHandlePrivate.h
+++ b/WebCore/platform/network/qt/SocketStreamHandlePrivate.h
@@ -54,7 +54,7 @@ public slots:
     void socketReadyRead();
     int send(const char* data, int len);
     void close();
-    void socketSentdata();
+    void socketSentData();
     void socketClosed();
     void socketError(QAbstractSocket::SocketError);
     void socketClosedCallback();
diff --git a/WebCore/platform/network/qt/SocketStreamHandleQt.cpp b/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
index cc508b6..10550ae 100644
--- a/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
+++ b/WebCore/platform/network/qt/SocketStreamHandleQt.cpp
@@ -110,7 +110,7 @@ void SocketStreamHandlePrivate::close()
         m_socket->close();
 }
 
-void SocketStreamHandlePrivate::socketSentdata()
+void SocketStreamHandlePrivate::socketSentData()
 {
     if (m_streamHandle)
         m_streamHandle->sendPendingData();
diff --git a/WebCore/platform/network/soup/ProxyServerSoup.cpp b/WebCore/platform/network/soup/ProxyServerSoup.cpp
new file mode 100644
index 0000000..50b32de
--- /dev/null
+++ b/WebCore/platform/network/soup/ProxyServerSoup.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Brent Fulgham <bfulgham@webkit.org>. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "ProxyServer.h"
+
+#include "KURL.h"
+
+namespace WebCore {
+
+Vector<ProxyServer> proxyServersForURL(const KURL&, const NetworkingContext*)
+{
+    // FIXME: Implement.
+    return Vector<ProxyServer>();
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/network/soup/ResourceHandleSoup.cpp b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
index 0d84388..05c659f 100644
--- a/WebCore/platform/network/soup/ResourceHandleSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceHandleSoup.cpp
@@ -45,8 +45,8 @@
 #include "ResourceHandleInternal.h"
 #include "ResourceResponse.h"
 #include "SharedBuffer.h"
+#include "soup-request-http.h"
 #include "TextEncoding.h"
-
 #include <errno.h>
 #include <fcntl.h>
 #include <gio/gio.h>
@@ -58,6 +58,8 @@
 
 namespace WebCore {
 
+#define READ_BUFFER_SIZE 8192
+
 class WebCoreSynchronousLoader : public ResourceHandleClient, public Noncopyable {
 public:
     WebCoreSynchronousLoader(ResourceError&, ResourceResponse &, Vector<char>&);
@@ -120,16 +122,16 @@ void WebCoreSynchronousLoader::run()
         g_main_loop_run(m_mainLoop);
 }
 
-static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying);
-static bool startData(ResourceHandle* handle, String urlString);
-static bool startGio(ResourceHandle* handle, KURL url);
+static void cleanupSoupRequestOperation(ResourceHandle*, bool isDestroying);
+static void sendRequestCallback(GObject*, GAsyncResult*, gpointer);
+static void readCallback(GObject*, GAsyncResult*, gpointer);
+static void closeCallback(GObject*, GAsyncResult*, gpointer);
+static bool startGio(ResourceHandle*, KURL);
 
 ResourceHandleInternal::~ResourceHandleInternal()
 {
-    if (m_msg) {
-        g_object_unref(m_msg);
-        m_msg = 0;
-    }
+    if (m_soupRequest)
+        g_object_set_data(G_OBJECT(m_soupRequest.get()), "webkit-resource", 0);
 
     if (m_idleHandler) {
         g_source_remove(m_idleHandler);
@@ -139,11 +141,7 @@ ResourceHandleInternal::~ResourceHandleInternal()
 
 ResourceHandle::~ResourceHandle()
 {
-    if (d->m_msg)
-        g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
-                                             0, 0, 0, 0, this);
-
-    cleanupGioOperation(this, true);
+    cleanupSoupRequestOperation(this, true);
 }
 
 void ResourceHandle::prepareForURL(const KURL &url)
@@ -185,9 +183,8 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     if (d->m_cancelled)
         return;
 
-    char* uri = soup_uri_to_string(soup_message_get_uri(msg), false);
-    String location = String(uri);
-    g_free(uri);
+    GOwnPtr<char> uri(soup_uri_to_string(soup_message_get_uri(msg), false));
+    String location = String::fromUTF8(uri.get());
     KURL newURL = KURL(handle->firstRequest().url(), location);
 
     ResourceRequest request = handle->firstRequest();
@@ -213,7 +210,7 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
     String firstPartyString = request.firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
-        soup_message_set_first_party(d->m_msg, firstParty.get());
+        soup_message_set_first_party(d->m_soupMessage.get(), firstParty.get());
     }
 #endif
 }
@@ -221,8 +218,10 @@ static void restartedCallback(SoupMessage* msg, gpointer data)
 static void gotHeadersCallback(SoupMessage* msg, gpointer data)
 {
     // For 401, we will accumulate the resource body, and only use it
-    // in case authentication with the soup feature doesn't happen
-    if (msg->status_code == SOUP_STATUS_UNAUTHORIZED) {
+    // in case authentication with the soup feature doesn't happen.
+    // For 302 we accumulate the body too because it could be used by
+    // some servers to redirect with a clunky http-equiv=REFRESH
+    if (statusWillBeHandledBySoup(msg->status_code)) {
         soup_message_body_set_accumulate(msg->response_body, TRUE);
         return;
     }
@@ -295,51 +294,6 @@ static void gotChunkCallback(SoupMessage* msg, SoupBuffer* chunk, gpointer data)
     client->didReceiveData(handle.get(), chunk->data, chunk->length, false);
 }
 
-// Called at the end of the message, with all the necessary about the last informations.
-// Doesn't get called for redirects.
-static void finishedCallback(SoupSession *session, SoupMessage* msg, gpointer data)
-{
-    RefPtr<ResourceHandle> handle = adoptRef(static_cast<ResourceHandle*>(data));
-    // TODO: maybe we should run this code even if there's no client?
-    if (!handle)
-        return;
-
-    ResourceHandleInternal* d = handle->getInternal();
-
-    ResourceHandleClient* client = handle->client();
-    if (!client)
-        return;
-
-    if (d->m_cancelled)
-        return;
-
-    if (SOUP_STATUS_IS_TRANSPORT_ERROR(msg->status_code)) {
-        char* uri = soup_uri_to_string(soup_message_get_uri(msg), false);
-        ResourceError error(g_quark_to_string(SOUP_HTTP_ERROR),
-                            msg->status_code,
-                            uri,
-                            String::fromUTF8(msg->reason_phrase));
-        g_free(uri);
-        client->didFail(handle.get(), error);
-        return;
-    }
-
-    if (msg->status_code == SOUP_STATUS_UNAUTHORIZED) {
-        fillResponseFromMessage(msg, &d->m_response);
-        client->didReceiveResponse(handle.get(), d->m_response);
-
-        // WebCore might have cancelled the job in the while
-        if (d->m_cancelled)
-            return;
-
-        if (msg->response_body->data)
-            client->didReceiveData(handle.get(), msg->response_body->data, msg->response_body->length, true);
-    }
-
-    client->didFinishLoading(handle.get(), 0);
-}
-
-// parseDataUrl() is taken from the CURL http backend.
 static gboolean parseDataUrl(gpointer callbackData)
 {
     ResourceHandle* handle = static_cast<ResourceHandle*>(callbackData);
@@ -364,7 +318,6 @@ static gboolean parseDataUrl(gpointer callbackData)
     }
 
     String mediaType = url.substring(5, index - 5);
-    String data = url.substring(index + 1);
 
     bool isBase64 = mediaType.endsWith(";base64", false);
     if (isBase64)
@@ -380,42 +333,43 @@ static gboolean parseDataUrl(gpointer callbackData)
     response.setURL(handle->firstRequest().url());
     response.setMimeType(mimeType);
 
-    if (isBase64) {
-        data = decodeURLEscapeSequences(data);
-        response.setTextEncodingName(charset);
-        client->didReceiveResponse(handle, response);
-
-        // The load may be cancelled, and the client may be destroyed
-        // by any of the client reporting calls, so we check, and bail
-        // out in either of those cases.
-        if (d->m_cancelled || !handle->client())
-            return false;
-
-        // Use the GLib Base64, since WebCore's decoder isn't
-        // general-purpose and fails on Acid3 test 97 (whitespace).
-        size_t outLength = 0;
-        char* outData = 0;
-        outData = reinterpret_cast<char*>(g_base64_decode(data.utf8().data(), &outLength));
-        if (outData && outLength > 0)
-            client->didReceiveData(handle, outData, outLength, 0);
-        g_free(outData);
-    } else {
-        // We have to convert to UTF-16 early due to limitations in KURL
-        data = decodeURLEscapeSequences(data, TextEncoding(charset));
-        response.setTextEncodingName("UTF-16");
-        client->didReceiveResponse(handle, response);
-
-        if (d->m_cancelled || !handle->client())
-            return false;
-
-        if (data.length() > 0)
-            client->didReceiveData(handle, reinterpret_cast<const char*>(data.characters()), data.length() * sizeof(UChar), 0);
-    }
+    // For non base64 encoded data we have to convert to UTF-16 early
+    // due to limitations in KURL
+    response.setTextEncodingName(isBase64 ? charset : "UTF-16");
+    client->didReceiveResponse(handle, response);
 
+    // The load may be cancelled, and the client may be destroyed
+    // by any of the client reporting calls, so we check, and bail
+    // out in either of those cases.
     if (d->m_cancelled || !handle->client())
         return false;
 
-    client->didFinishLoading(handle, 0);
+    SoupSession* session = handle->defaultSession();
+    GOwnPtr<GError> error;
+    d->m_soupRequest = adoptPlatformRef(webkit_soup_requester_request(d->m_requester.get(), handle->firstRequest().url().string().utf8().data(), session, &error.outPtr()));
+    if (error) {
+        d->m_soupRequest = 0;
+        client->didFinishLoading(handle, 0);
+        return false;
+    }
+
+    d->m_inputStream = adoptPlatformRef(webkit_soup_request_send(d->m_soupRequest.get(), 0, &error.outPtr()));
+    if (error) {
+        d->m_inputStream = 0;
+        client->didFinishLoading(handle, 0);
+        return false;
+    }
+
+    d->m_buffer = static_cast<char*>(g_slice_alloc0(READ_BUFFER_SIZE));
+    d->m_total = 0;
+
+    g_object_set_data(G_OBJECT(d->m_inputStream.get()), "webkit-resource", handle);
+    // balanced by a deref() in cleanupSoupRequestOperation, which should always run
+    handle->ref();
+
+    d->m_cancellable = adoptPlatformRef(g_cancellable_new());
+    g_input_stream_read_async(d->m_inputStream.get(), d->m_buffer, READ_BUFFER_SIZE, G_PRIORITY_DEFAULT,
+                              d->m_cancellable.get(), readCallback, GINT_TO_POINTER(!isBase64));
 
     return false;
 }
@@ -469,6 +423,132 @@ static void ensureSessionIsInitialized(SoupSession* session)
     g_object_set_data(G_OBJECT(session), "webkit-init", reinterpret_cast<void*>(0xdeadbeef));
 }
 
+static void cleanupSoupRequestOperation(ResourceHandle* handle, bool isDestroying = false)
+{
+    ResourceHandleInternal* d = handle->getInternal();
+
+    if (d->m_soupRequest) {
+        g_object_set_data(G_OBJECT(d->m_soupRequest.get()), "webkit-resource", 0);
+        d->m_soupRequest.clear();
+    }
+
+    if (d->m_inputStream) {
+        g_object_set_data(G_OBJECT(d->m_inputStream.get()), "webkit-resource", 0);
+        d->m_inputStream.clear();
+    }
+
+    d->m_cancellable.clear();
+
+    if (d->m_soupMessage) {
+        g_signal_handlers_disconnect_matched(d->m_soupMessage.get(), G_SIGNAL_MATCH_DATA,
+                                             0, 0, 0, 0, handle);
+        d->m_soupMessage.clear();
+    }
+
+    if (d->m_buffer) {
+        g_slice_free1(READ_BUFFER_SIZE, d->m_buffer);
+        d->m_buffer = 0;
+    }
+
+    if (!isDestroying)
+        handle->deref();
+}
+
+static void sendRequestCallback(GObject* source, GAsyncResult* res, gpointer userData)
+{
+    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
+    if (!handle)
+        return;
+
+    ResourceHandleInternal* d = handle->getInternal();
+    ResourceHandleClient* client = handle->client();
+
+    if (d->m_gotChunkHandler) {
+        // No need to call gotChunkHandler anymore. Received data will
+        // be reported by readCallback
+        if (g_signal_handler_is_connected(d->m_soupMessage.get(), d->m_gotChunkHandler))
+            g_signal_handler_disconnect(d->m_soupMessage.get(), d->m_gotChunkHandler);
+    }
+
+    if (d->m_cancelled || !client) {
+        cleanupSoupRequestOperation(handle.get());
+        return;
+    }
+
+    GOwnPtr<GError> error;
+    GInputStream* in = webkit_soup_request_send_finish(d->m_soupRequest.get(), res, &error.outPtr());
+
+    if (error) {
+        SoupMessage* soupMsg = d->m_soupMessage.get();
+        gboolean isTransportError = d->m_soupMessage && SOUP_STATUS_IS_TRANSPORT_ERROR(soupMsg->status_code);
+
+        if (isTransportError || (error->domain == G_IO_ERROR)) {
+            SoupURI* uri = webkit_soup_request_get_uri(d->m_soupRequest.get());
+            GOwnPtr<char> uriStr(soup_uri_to_string(uri, false));
+            gint errorCode = isTransportError ? soupMsg->status_code : error->code;
+            const gchar* errorMsg = isTransportError ? soupMsg->reason_phrase : error->message;
+            const gchar* quarkStr = isTransportError ? g_quark_to_string(SOUP_HTTP_ERROR) : g_quark_to_string(G_IO_ERROR);
+            ResourceError resourceError(quarkStr, errorCode, uriStr.get(), String::fromUTF8(errorMsg));
+
+            cleanupSoupRequestOperation(handle.get());
+            client->didFail(handle.get(), resourceError);
+            return;
+        }
+
+        if (d->m_soupMessage && statusWillBeHandledBySoup(d->m_soupMessage->status_code)) {
+            fillResponseFromMessage(soupMsg, &d->m_response);
+            client->didReceiveResponse(handle.get(), d->m_response);
+
+            // WebCore might have cancelled the job in the while
+            if (!d->m_cancelled && soupMsg->response_body->data)
+                client->didReceiveData(handle.get(), soupMsg->response_body->data, soupMsg->response_body->length, true);
+        }
+
+        // didReceiveData above might have cancelled it
+        if (d->m_cancelled || !client) {
+            cleanupSoupRequestOperation(handle.get());
+            return;
+        }
+
+        client->didFinishLoading(handle.get(), 0);
+        return;
+    }
+
+    if (d->m_cancelled) {
+        cleanupSoupRequestOperation(handle.get());
+        return;
+    }
+
+    d->m_inputStream = adoptPlatformRef(in);
+    d->m_buffer = static_cast<char*>(g_slice_alloc0(READ_BUFFER_SIZE));
+    d->m_total = 0;
+
+    // readCallback needs it
+    g_object_set_data(G_OBJECT(d->m_inputStream.get()), "webkit-resource", handle.get());
+
+    // We need to check if it's a file: URL and if it is a regular
+    // file as it could be a directory. In that case Soup properly
+    // returns a stream whose content is a HTML with a list of files
+    // in the directory
+    if (equalIgnoringCase(handle->firstRequest().url().protocol(), "file")
+        && G_IS_FILE_INPUT_STREAM(in)) {
+        ResourceResponse response;
+
+        response.setURL(handle->firstRequest().url());
+        response.setMimeType(webkit_soup_request_get_content_type(d->m_soupRequest.get()));
+        response.setExpectedContentLength(webkit_soup_request_get_content_length(d->m_soupRequest.get()));
+        client->didReceiveResponse(handle.get(), response);
+
+        if (d->m_cancelled) {
+            cleanupSoupRequestOperation(handle.get());
+            return;
+        }
+    }
+
+    g_input_stream_read_async(d->m_inputStream.get(), d->m_buffer, READ_BUFFER_SIZE,
+                              G_PRIORITY_DEFAULT, d->m_cancellable.get(), readCallback, 0);
+}
+
 static bool startHttp(ResourceHandle* handle)
 {
     ASSERT(handle);
@@ -483,26 +563,37 @@ static bool startHttp(ResourceHandle* handle)
     url.removeFragmentIdentifier();
     request.setURL(url);
 
-    d->m_msg = request.toSoupMessage();
-    if (!d->m_msg)
+    GOwnPtr<GError> error;
+    d->m_soupRequest = adoptPlatformRef(webkit_soup_requester_request(d->m_requester.get(), url.string().utf8().data(), session, &error.outPtr()));
+    if (error) {
+        d->m_soupRequest = 0;
         return false;
+    }
+
+    g_object_set_data(G_OBJECT(d->m_soupRequest.get()), "webkit-resource", handle);
+
+    d->m_soupMessage = adoptPlatformRef(webkit_soup_request_http_get_message(WEBKIT_SOUP_REQUEST_HTTP(d->m_soupRequest.get())));
+    if (!d->m_soupMessage)
+        return false;
+
+    SoupMessage* soupMessage = d->m_soupMessage.get();
+    request.updateSoupMessage(soupMessage);
 
     if (!handle->shouldContentSniff())
-        soup_message_disable_feature(d->m_msg, SOUP_TYPE_CONTENT_SNIFFER);
+        soup_message_disable_feature(soupMessage, SOUP_TYPE_CONTENT_SNIFFER);
 
-    g_signal_connect(d->m_msg, "restarted", G_CALLBACK(restartedCallback), handle);
-    g_signal_connect(d->m_msg, "got-headers", G_CALLBACK(gotHeadersCallback), handle);
-    g_signal_connect(d->m_msg, "content-sniffed", G_CALLBACK(contentSniffedCallback), handle);
-    g_signal_connect(d->m_msg, "got-chunk", G_CALLBACK(gotChunkCallback), handle);
+    g_signal_connect(soupMessage, "restarted", G_CALLBACK(restartedCallback), handle);
+    g_signal_connect(soupMessage, "got-headers", G_CALLBACK(gotHeadersCallback), handle);
+    g_signal_connect(soupMessage, "content-sniffed", G_CALLBACK(contentSniffedCallback), handle);
+    d->m_gotChunkHandler = g_signal_connect(soupMessage, "got-chunk", G_CALLBACK(gotChunkCallback), handle);
 
 #ifdef HAVE_LIBSOUP_2_29_90
     String firstPartyString = request.firstPartyForCookies().string();
     if (!firstPartyString.isEmpty()) {
         GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
-        soup_message_set_first_party(d->m_msg, firstParty.get());
+        soup_message_set_first_party(soupMessage, firstParty.get());
     }
 #endif
-    g_object_set_data(G_OBJECT(d->m_msg), "resourceHandle", reinterpret_cast<void*>(handle));
 
     FormData* httpBody = d->m_firstRequest.httpBody();
     if (httpBody && !httpBody->isEmpty()) {
@@ -512,7 +603,7 @@ static bool startHttp(ResourceHandle* handle)
         if (numElements < 2) {
             Vector<char> body;
             httpBody->flatten(body);
-            soup_message_set_request(d->m_msg, d->m_firstRequest.httpContentType().utf8().data(),
+            soup_message_set_request(soupMessage, d->m_firstRequest.httpContentType().utf8().data(),
                                      SOUP_MEMORY_COPY, body.data(), body.size());
         } else {
             /*
@@ -521,27 +612,25 @@ static bool startHttp(ResourceHandle* handle)
              * copying into memory; TODO: support upload of non-local
              * (think sftp://) files by using GIO?
              */
-            soup_message_body_set_accumulate(d->m_msg->request_body, FALSE);
+            soup_message_body_set_accumulate(soupMessage->request_body, FALSE);
             for (size_t i = 0; i < numElements; i++) {
                 const FormDataElement& element = httpBody->elements()[i];
 
                 if (element.m_type == FormDataElement::data)
-                    soup_message_body_append(d->m_msg->request_body, SOUP_MEMORY_TEMPORARY, element.m_data.data(), element.m_data.size());
+                    soup_message_body_append(soupMessage->request_body, SOUP_MEMORY_TEMPORARY, element.m_data.data(), element.m_data.size());
                 else {
                     /*
                      * mapping for uploaded files code inspired by technique used in
                      * libsoup's simple-httpd test
                      */
-                    GError* error = 0;
+                    GOwnPtr<GError> error;
                     CString fileName = fileSystemRepresentation(element.m_filename);
-                    GMappedFile* fileMapping = g_mapped_file_new(fileName.data(), false, &error);
+                    GMappedFile* fileMapping = g_mapped_file_new(fileName.data(), false, &error.outPtr());
 
                     if (error) {
-                        g_error_free(error);
-                        g_signal_handlers_disconnect_matched(d->m_msg, G_SIGNAL_MATCH_DATA,
+                        g_signal_handlers_disconnect_matched(soupMessage, G_SIGNAL_MATCH_DATA,
                                                              0, 0, 0, 0, handle);
-                        g_object_unref(d->m_msg);
-                        d->m_msg = 0;
+                        d->m_soupMessage.clear();
 
                         return false;
                     }
@@ -549,38 +638,31 @@ static bool startHttp(ResourceHandle* handle)
                     SoupBuffer* soupBuffer = soup_buffer_new_with_owner(g_mapped_file_get_contents(fileMapping),
                                                                         g_mapped_file_get_length(fileMapping),
                                                                         fileMapping,
-#if GLIB_CHECK_VERSION(2, 21, 3)
                                                                         reinterpret_cast<GDestroyNotify>(g_mapped_file_unref));
-#else
-                                                                        reinterpret_cast<GDestroyNotify>(g_mapped_file_free));
-#endif
-                    soup_message_body_append_buffer(d->m_msg->request_body, soupBuffer);
+                    soup_message_body_append_buffer(soupMessage->request_body, soupBuffer);
                     soup_buffer_free(soupBuffer);
                 }
             }
         }
     }
 
-    // balanced by a deref() in finishedCallback, which should always run
+    // balanced by a deref() in cleanupSoupRequestOperation, which should always run
     handle->ref();
 
     // Make sure we have an Accept header for subresources; some sites
     // want this to serve some of their subresources
-    if (!soup_message_headers_get_one(d->m_msg->request_headers, "Accept"))
-        soup_message_headers_append(d->m_msg->request_headers, "Accept", "*/*");
+    if (!soup_message_headers_get_one(soupMessage->request_headers, "Accept"))
+        soup_message_headers_append(soupMessage->request_headers, "Accept", "*/*");
 
-    // Balanced in ResourceHandleInternal's destructor; we need to
-    // keep our own ref, because after queueing the message, the
-    // session owns the initial reference.
-    g_object_ref(d->m_msg);
-    soup_session_queue_message(session, d->m_msg, finishedCallback, handle);
+    d->m_cancellable = adoptPlatformRef(g_cancellable_new());
+    webkit_soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
 
     return true;
 }
 
 bool ResourceHandle::start(NetworkingContext* context)
 {
-    ASSERT(!d->m_msg);
+    ASSERT(!d->m_soupMessage);
 
     // The frame could be null if the ResourceHandle is not associated to any
     // Frame, e.g. if we are downloading a file.
@@ -620,10 +702,10 @@ bool ResourceHandle::start(NetworkingContext* context)
 void ResourceHandle::cancel()
 {
     d->m_cancelled = true;
-    if (d->m_msg)
-        soup_session_cancel_message(defaultSession(), d->m_msg, SOUP_STATUS_CANCELLED);
+    if (d->m_soupMessage)
+        soup_session_cancel_message(defaultSession(), d->m_soupMessage.get(), SOUP_STATUS_CANCELLED);
     else if (d->m_cancellable)
-        g_cancellable_cancel(d->m_cancellable);
+        g_cancellable_cancel(d->m_cancellable.get());
 }
 
 PassRefPtr<SharedBuffer> ResourceHandle::bufferedData()
@@ -667,38 +749,6 @@ void ResourceHandle::loadResourceSynchronously(NetworkingContext* context, const
     syncLoader.run();
 }
 
-// GIO-based loader
-
-static void cleanupGioOperation(ResourceHandle* handle, bool isDestroying = false)
-{
-    ResourceHandleInternal* d = handle->getInternal();
-
-    if (d->m_gfile) {
-        g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", 0);
-        g_object_unref(d->m_gfile);
-        d->m_gfile = 0;
-    }
-
-    if (d->m_cancellable) {
-        g_object_unref(d->m_cancellable);
-        d->m_cancellable = 0;
-    }
-
-    if (d->m_inputStream) {
-        g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", 0);
-        g_object_unref(d->m_inputStream);
-        d->m_inputStream = 0;
-    }
-
-    if (d->m_buffer) {
-        g_free(d->m_buffer);
-        d->m_buffer = 0;
-    }
-
-    if (!isDestroying)
-        handle->deref();
-}
-
 static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
 {
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
@@ -708,8 +758,8 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
     ResourceHandleInternal* d = handle->getInternal();
     ResourceHandleClient* client = handle->client();
 
-    g_input_stream_close_finish(d->m_inputStream, res, 0);
-    cleanupGioOperation(handle.get());
+    g_input_stream_close_finish(d->m_inputStream.get(), res, 0);
+    cleanupSoupRequestOperation(handle.get());
 
     // The load may have been cancelled, the client may have been
     // destroyed already. In such cases calling didFinishLoading is a
@@ -720,210 +770,92 @@ static void closeCallback(GObject* source, GAsyncResult* res, gpointer)
     client->didFinishLoading(handle.get(), 0);
 }
 
-static void readCallback(GObject* source, GAsyncResult* res, gpointer)
+static void readCallback(GObject* source, GAsyncResult* asyncResult, gpointer data)
 {
     RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
     if (!handle)
         return;
 
+    bool convertToUTF16 = static_cast<bool>(data);
     ResourceHandleInternal* d = handle->getInternal();
     ResourceHandleClient* client = handle->client();
 
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(handle.get());
+        cleanupSoupRequestOperation(handle.get());
         return;
     }
 
-    GError* error = 0;
+    GOwnPtr<GError> error;
 
-    gssize bytesRead = g_input_stream_read_finish(d->m_inputStream, res, &error);
+    gssize bytesRead = g_input_stream_read_finish(d->m_inputStream.get(), asyncResult, &error.outPtr());
     if (error) {
-        char* uri = g_file_get_uri(d->m_gfile);
-        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
-                                    error->code,
-                                    uri,
+        SoupURI* uri = webkit_soup_request_get_uri(d->m_soupRequest.get());
+        GOwnPtr<char> uriStr(soup_uri_to_string(uri, false));
+        ResourceError resourceError(g_quark_to_string(G_IO_ERROR), error->code, uriStr.get(),
                                     error ? String::fromUTF8(error->message) : String());
-        g_free(uri);
-        g_error_free(error);
-        cleanupGioOperation(handle.get());
+        cleanupSoupRequestOperation(handle.get());
         client->didFail(handle.get(), resourceError);
         return;
     }
 
     if (!bytesRead) {
-        g_input_stream_close_async(d->m_inputStream, G_PRIORITY_DEFAULT,
+        g_input_stream_close_async(d->m_inputStream.get(), G_PRIORITY_DEFAULT,
                                    0, closeCallback, 0);
         return;
     }
 
     d->m_total += bytesRead;
-    client->didReceiveData(handle.get(), d->m_buffer, bytesRead, d->m_total);
-
-    // didReceiveData may cancel the load, which may release the last reference.
-    if (d->m_cancelled) {
-        cleanupGioOperation(handle.get());
-        return;
+    if (G_LIKELY(!convertToUTF16))
+        client->didReceiveData(handle.get(), d->m_buffer, bytesRead, d->m_total);
+    else {
+        // We have to convert it to UTF-16 due to limitations in KURL
+        String data = String::fromUTF8(d->m_buffer, bytesRead);
+        client->didReceiveData(handle.get(), reinterpret_cast<const char*>(data.characters()), data.length() * sizeof(UChar), 0);
     }
 
-    g_input_stream_read_async(d->m_inputStream, d->m_buffer, d->m_bufferSize,
-                              G_PRIORITY_DEFAULT, d->m_cancellable,
-                              readCallback, 0);
-}
-
-static void openCallback(GObject* source, GAsyncResult* res, gpointer)
-{
-    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
-    if (!handle)
-        return;
-
-    ResourceHandleInternal* d = handle->getInternal();
-    ResourceHandleClient* client = handle->client();
-
+    // didReceiveData may cancel the load, which may release the last reference.
     if (d->m_cancelled || !client) {
-        cleanupGioOperation(handle.get());
-        return;
-    }
-
-    GError* error = 0;
-    GFileInputStream* in = g_file_read_finish(G_FILE(source), res, &error);
-    if (error) {
-        char* uri = g_file_get_uri(d->m_gfile);
-        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
-                                    error->code,
-                                    uri,
-                                    error ? String::fromUTF8(error->message) : String());
-        g_free(uri);
-        g_error_free(error);
-        cleanupGioOperation(handle.get());
-        client->didFail(handle.get(), resourceError);
+        cleanupSoupRequestOperation(handle.get());
         return;
     }
 
-    d->m_inputStream = G_INPUT_STREAM(in);
-    d->m_bufferSize = 8192;
-    d->m_buffer = static_cast<char*>(g_malloc(d->m_bufferSize));
-    d->m_total = 0;
-
-    g_object_set_data(G_OBJECT(d->m_inputStream), "webkit-resource", handle.get());
-    g_input_stream_read_async(d->m_inputStream, d->m_buffer, d->m_bufferSize,
-                              G_PRIORITY_DEFAULT, d->m_cancellable,
-                              readCallback, 0);
+    g_input_stream_read_async(d->m_inputStream.get(), d->m_buffer, READ_BUFFER_SIZE, G_PRIORITY_DEFAULT,
+                              d->m_cancellable.get(), readCallback, data);
 }
 
-static void queryInfoCallback(GObject* source, GAsyncResult* res, gpointer)
-{
-    RefPtr<ResourceHandle> handle = static_cast<ResourceHandle*>(g_object_get_data(source, "webkit-resource"));
-    if (!handle)
-        return;
-
-    ResourceHandleInternal* d = handle->getInternal();
-    ResourceHandleClient* client = handle->client();
-
-    if (d->m_cancelled) {
-        cleanupGioOperation(handle.get());
-        return;
-    }
-
-    ResourceResponse response;
-
-    char* uri = g_file_get_uri(d->m_gfile);
-    response.setURL(KURL(KURL(), uri));
-    g_free(uri);
-
-    GError* error = 0;
-    GFileInfo* info = g_file_query_info_finish(d->m_gfile, res, &error);
-
-    if (error) {
-        // FIXME: to be able to handle ftp URIs properly, we must
-        // check if the error is G_IO_ERROR_NOT_MOUNTED, and if so,
-        // call g_file_mount_enclosing_volume() to mount the ftp
-        // server (and then keep track of the fact that we mounted it,
-        // and set a timeout to unmount it later after it's been idle
-        // for a while).
-        char* uri = g_file_get_uri(d->m_gfile);
-        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
-                                    error->code,
-                                    uri,
-                                    error ? String::fromUTF8(error->message) : String());
-        g_free(uri);
-        g_error_free(error);
-        cleanupGioOperation(handle.get());
-        client->didFail(handle.get(), resourceError);
-        return;
-    }
-
-    if (g_file_info_get_file_type(info) != G_FILE_TYPE_REGULAR) {
-        // FIXME: what if the URI points to a directory? Should we
-        // generate a listing? How? What do other backends do here?
-        char* uri = g_file_get_uri(d->m_gfile);
-        ResourceError resourceError(g_quark_to_string(G_IO_ERROR),
-                                    G_IO_ERROR_FAILED,
-                                    uri,
-                                    String());
-        g_free(uri);
-        cleanupGioOperation(handle.get());
-        client->didFail(handle.get(), resourceError);
-        return;
-    }
-
-    // According to http://library.gnome.org/devel/gio/stable/gio-GContentType.html
-    // GContentType on Unix is the mime type, but not on Win32.
-    GOwnPtr<gchar> mimeType(g_content_type_get_mime_type(g_file_info_get_content_type(info)));
-    response.setMimeType(mimeType.get());
-    response.setExpectedContentLength(g_file_info_get_size(info));
-
-    GTimeVal tv;
-    g_file_info_get_modification_time(info, &tv);
-    response.setLastModifiedDate(tv.tv_sec);
-
-    client->didReceiveResponse(handle.get(), response);
-
-    if (d->m_cancelled) {
-        cleanupGioOperation(handle.get());
-        return;
-    }
-
-    g_file_read_async(d->m_gfile, G_PRIORITY_DEFAULT, d->m_cancellable,
-                      openCallback, 0);
-}
 static bool startGio(ResourceHandle* handle, KURL url)
 {
     ASSERT(handle);
 
-    ResourceHandleInternal* d = handle->getInternal();
-
     if (handle->firstRequest().httpMethod() != "GET" && handle->firstRequest().httpMethod() != "POST")
         return false;
 
+    SoupSession* session = handle->defaultSession();
+    ResourceHandleInternal* d = handle->getInternal();
+
     // GIO doesn't know how to handle refs and queries, so remove them
     // TODO: use KURL.fileSystemPath after KURLGtk and FileSystemGtk are
     // using GIO internally, and providing URIs instead of file paths
     url.removeFragmentIdentifier();
     url.setQuery(String());
     url.removePort();
+    CString urlStr = url.string().utf8();
 
-#if !OS(WINDOWS)
-    // we avoid the escaping for local files, because
-    // g_filename_from_uri (used internally by GFile) has problems
-    // decoding strings with arbitrary percent signs
-    if (url.isLocalFile())
-        d->m_gfile = g_file_new_for_path(url.prettyURL().utf8().data() + sizeof("file://") - 1);
-    else
-#endif
-        d->m_gfile = g_file_new_for_uri(url.string().utf8().data());
-    g_object_set_data(G_OBJECT(d->m_gfile), "webkit-resource", handle);
+    GOwnPtr<GError> error;
+    d->m_soupRequest = adoptPlatformRef(webkit_soup_requester_request(d->m_requester.get(), urlStr.data(), session, &error.outPtr()));
+    if (error) {
+        d->m_soupRequest = 0;
+        return false;
+    }
+
+    g_object_set_data(G_OBJECT(d->m_soupRequest.get()), "webkit-resource", handle);
 
-    // balanced by a deref() in cleanupGioOperation, which should always run
+    // balanced by a deref() in cleanupSoupRequestOperation, which should always run
     handle->ref();
 
-    d->m_cancellable = g_cancellable_new();
-    g_file_query_info_async(d->m_gfile,
-                            G_FILE_ATTRIBUTE_STANDARD_TYPE ","
-                            G_FILE_ATTRIBUTE_STANDARD_CONTENT_TYPE ","
-                            G_FILE_ATTRIBUTE_STANDARD_SIZE,
-                            G_FILE_QUERY_INFO_NONE,
-                            G_PRIORITY_DEFAULT, d->m_cancellable,
-                            queryInfoCallback, 0);
+    d->m_cancellable = adoptPlatformRef(g_cancellable_new());
+    webkit_soup_request_send_async(d->m_soupRequest.get(), d->m_cancellable.get(), sendRequestCallback, 0);
+
     return true;
 }
 
diff --git a/WebCore/platform/network/soup/ResourceRequest.h b/WebCore/platform/network/soup/ResourceRequest.h
index a1d916f..879a47f 100644
--- a/WebCore/platform/network/soup/ResourceRequest.h
+++ b/WebCore/platform/network/soup/ResourceRequest.h
@@ -67,8 +67,9 @@ namespace WebCore {
             updateFromSoupMessage(soupMessage);
         }
 
+        void updateSoupMessage(SoupMessage*) const;
         SoupMessage* toSoupMessage() const;
-        void updateFromSoupMessage(SoupMessage* soupMessage);
+        void updateFromSoupMessage(SoupMessage*);
 
         SoupMessageFlags soupMessageFlags() const { return m_soupFlags; }
         void setSoupMessageFlags(SoupMessageFlags soupFlags) { m_soupFlags = soupFlags; }
@@ -80,6 +81,12 @@ namespace WebCore {
 
         void doUpdatePlatformRequest() {};
         void doUpdateResourceRequest() {};
+
+        PassOwnPtr<CrossThreadResourceRequestData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceRequestData> data) const { return data; }
+        void doPlatformAdopt(PassOwnPtr<CrossThreadResourceRequestData>) { }
+    };
+
+    struct CrossThreadResourceRequestData : public CrossThreadResourceRequestDataBase {
     };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/soup/ResourceRequestSoup.cpp b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
index 62deb01..380fc84 100644
--- a/WebCore/platform/network/soup/ResourceRequestSoup.cpp
+++ b/WebCore/platform/network/soup/ResourceRequestSoup.cpp
@@ -33,6 +33,29 @@ using namespace std;
 
 namespace WebCore {
 
+void ResourceRequest::updateSoupMessage(SoupMessage* soupMessage) const
+{
+    g_object_set(soupMessage, SOUP_MESSAGE_METHOD, httpMethod().utf8().data(), NULL);
+
+    const HTTPHeaderMap& headers = httpHeaderFields();
+    SoupMessageHeaders* soupHeaders = soupMessage->request_headers;
+    if (!headers.isEmpty()) {
+        HTTPHeaderMap::const_iterator end = headers.end();
+        for (HTTPHeaderMap::const_iterator it = headers.begin(); it != end; ++it)
+            soup_message_headers_append(soupHeaders, it->first.string().utf8().data(), it->second.utf8().data());
+    }
+
+#ifdef HAVE_LIBSOUP_2_29_90
+    String firstPartyString = firstPartyForCookies().string();
+    if (!firstPartyString.isEmpty()) {
+        GOwnPtr<SoupURI> firstParty(soup_uri_new(firstPartyString.utf8().data()));
+        soup_message_set_first_party(soupMessage, firstParty.get());
+    }
+#endif
+
+    soup_message_set_flags(soupMessage, m_soupFlags);
+}
+
 SoupMessage* ResourceRequest::toSoupMessage() const
 {
     SoupMessage* soupMessage = soup_message_new(httpMethod().utf8().data(), url().string().utf8().data());
diff --git a/WebCore/platform/network/soup/ResourceResponse.h b/WebCore/platform/network/soup/ResourceResponse.h
index e6d872c..e7213f5 100644
--- a/WebCore/platform/network/soup/ResourceResponse.h
+++ b/WebCore/platform/network/soup/ResourceResponse.h
@@ -63,9 +63,13 @@ private:
 
     SoupMessageFlags m_soupFlags;
 
-    void doUpdateResourceResponse()
-    {
-    }
+    void doUpdateResourceResponse() { }
+
+    PassOwnPtr<CrossThreadResourceResponseData> doPlatformCopyData(PassOwnPtr<CrossThreadResourceResponseData> data) const { return data; }
+    void doPlatformAdopt(PassOwnPtr<CrossThreadResourceResponseData>) { }
+};
+
+struct CrossThreadResourceResponseData : public CrossThreadResourceResponseDataBase {
 };
 
 } // namespace WebCore
diff --git a/WebCore/platform/network/soup/cache/soup-directory-input-stream.c b/WebCore/platform/network/soup/cache/soup-directory-input-stream.c
new file mode 100644
index 0000000..c14863b
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-directory-input-stream.c
@@ -0,0 +1,200 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2008 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "soup-directory-input-stream.h"
+
+#include <libsoup/soup.h>
+#include <stdio.h>
+#include <string.h>
+
+#define INIT_STRING "<html><head><title>OMG!</title></head><body><table>"
+#define EXIT_STRING "</table></html>"
+
+G_DEFINE_TYPE (WebKitSoupDirectoryInputStream, webkit_soup_directory_input_stream, G_TYPE_INPUT_STREAM)
+
+static SoupBuffer *
+webkit_soup_directory_input_stream_parse_info (WebKitSoupDirectoryInputStream * stream,
+					       GFileInfo * info)
+{
+	SoupBuffer *buffer;
+	GString *string;
+	const char *s;
+	char *escaped, *path, *xml_string;
+
+	if (!g_file_info_get_name (info))
+		return NULL;
+
+	s = g_file_info_get_display_name (info);
+	if (!s) {
+		s = g_file_info_get_name (info);
+		/* FIXME: convert somehow? */
+		if (!g_utf8_validate (s, -1, NULL))
+			return NULL;
+	}
+	string = g_string_new ("<tr>");
+
+	xml_string = g_markup_escape_text (s, -1);
+	escaped = g_uri_escape_string (g_file_info_get_name (info), NULL, FALSE);
+	path = g_strconcat (stream->uri, "/", escaped, NULL);
+	g_free (escaped);
+	g_string_append_printf (string, "<td><a href=\"%s\">%s</a></td>", path, xml_string);
+	g_free (path);
+	g_free (xml_string);
+	g_string_append (string, "</tr>");
+
+	buffer = soup_buffer_new (SOUP_MEMORY_TAKE, string->str, string->len);
+	g_string_free (string, FALSE);
+
+	return buffer;
+}
+
+static SoupBuffer *
+webkit_soup_directory_input_stream_read_next_file (WebKitSoupDirectoryInputStream  *stream,
+						   GCancellable              *cancellable,
+						   GError                   **error)
+{
+	GFileInfo *info;
+	SoupBuffer *buffer;
+	GError *err = NULL;
+
+	do {
+		info = g_file_enumerator_next_file (stream->enumerator, cancellable, &err);
+		if (info == NULL) {
+			if (err) {
+				g_propagate_error (error, err);
+				return NULL;
+			} else if (!stream->done) {
+				stream->done = TRUE;
+				return soup_buffer_new (SOUP_MEMORY_STATIC,
+							EXIT_STRING,
+							sizeof (EXIT_STRING));
+			} else {
+				return NULL;
+			}
+		}
+
+		buffer = webkit_soup_directory_input_stream_parse_info (stream, info);
+	} while (buffer == NULL);
+
+	return buffer;
+}
+
+static gssize
+webkit_soup_directory_input_stream_read (GInputStream  *input,
+					 void          *buffer,
+					 gsize count,
+					 GCancellable  *cancellable,
+					 GError       **error)
+{
+	WebKitSoupDirectoryInputStream *stream = WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (input);
+	gsize total, size;
+
+	for (total = 0; total < count; total += size) {
+		if (stream->buffer == NULL) {
+			stream->buffer = webkit_soup_directory_input_stream_read_next_file (stream, cancellable, error);
+			if (stream->buffer == NULL) {
+				/* FIXME: Is this correct or should we forward the error? */
+				if (total)
+					g_clear_error (error);
+				return total;
+			}
+		}
+
+		size = MIN (stream->buffer->length, count - total);
+		memcpy ((char *)buffer + total, stream->buffer->data, size);
+		if (size == stream->buffer->length) {
+			soup_buffer_free (stream->buffer);
+			stream->buffer = NULL;
+		} else {
+			SoupBuffer *sub = soup_buffer_new_subbuffer (stream->buffer,
+								     size,
+								     stream->buffer->length - size);
+			soup_buffer_free (stream->buffer);
+			stream->buffer = sub;
+		}
+	}
+
+	return total;
+}
+
+static gboolean
+webkit_soup_directory_input_stream_close (GInputStream  *input,
+					  GCancellable  *cancellable,
+					  GError       **error)
+{
+	WebKitSoupDirectoryInputStream *stream = WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (input);
+	gboolean result;
+
+	if (stream->buffer) {
+		soup_buffer_free (stream->buffer);
+		stream->buffer = NULL;
+	}
+
+	result = g_file_enumerator_close (stream->enumerator,
+					  cancellable,
+					  error);
+	g_object_unref (stream->enumerator);
+	stream->enumerator = NULL;
+
+	g_free (stream->uri);
+	stream->uri = NULL;
+
+	return result;
+}
+
+static void
+webkit_soup_directory_input_stream_class_init (WebKitSoupDirectoryInputStreamClass *stream_class)
+{
+	GInputStreamClass *inputstream_class = G_INPUT_STREAM_CLASS (stream_class);
+
+	inputstream_class->read_fn = webkit_soup_directory_input_stream_read;
+	inputstream_class->close_fn = webkit_soup_directory_input_stream_close;
+}
+
+static void
+webkit_soup_directory_input_stream_init (WebKitSoupDirectoryInputStream *stream)
+{
+	stream->buffer = soup_buffer_new (SOUP_MEMORY_STATIC,
+					  INIT_STRING,
+					  sizeof (INIT_STRING));
+}
+
+GInputStream *
+webkit_soup_directory_input_stream_new (GFileEnumerator *enumerator,
+					SoupURI         *uri)
+{
+	GInputStream *stream;
+
+	g_return_val_if_fail (G_IS_FILE_ENUMERATOR (enumerator), NULL);
+	g_return_val_if_fail (uri != NULL, NULL);
+
+	stream = g_object_new (WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, NULL);
+
+	WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (stream)->enumerator = g_object_ref (enumerator);
+	WEBKIT_SOUP_DIRECTORY_INPUT_STREAM (stream)->uri = soup_uri_to_string (uri, FALSE);
+
+	return stream;
+}
+
diff --git a/WebCore/platform/network/soup/cache/soup-directory-input-stream.h b/WebCore/platform/network/soup/cache/soup-directory-input-stream.h
new file mode 100644
index 0000000..0c5b0be
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-directory-input-stream.h
@@ -0,0 +1,62 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2010 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H
+#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H 1
+
+#include <gio/gio.h>
+#include <libsoup/soup-types.h>
+#include <libsoup/soup-message-body.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM            (webkit_soup_directory_input_stream_get_type ())
+#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStream))
+#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStreamClass))
+#define WEBKIT_IS_SOUP_DIRECTORY_INPUT_STREAM(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM))
+#define WEBKIT_IS_SOUP_DIRECTORY_INPUT_STREAM_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM))
+#define WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_DIRECTORY_INPUT_STREAM, WebKitSoupDirectoryInputStreamClass))
+
+typedef struct _WebKitSoupDirectoryInputStream WebKitSoupDirectoryInputStream;
+typedef struct _WebKitSoupDirectoryInputStreamClass WebKitSoupDirectoryInputStreamClass;
+
+struct _WebKitSoupDirectoryInputStream {
+	GInputStream parent;
+
+	GFileEnumerator *enumerator;
+	char *uri;
+	SoupBuffer *buffer;
+	gboolean done;
+};
+
+struct _WebKitSoupDirectoryInputStreamClass {
+	GInputStreamClass parent_class;
+};
+
+GType          webkit_soup_directory_input_stream_get_type (void);
+
+GInputStream *webkit_soup_directory_input_stream_new (GFileEnumerator *enumerator,
+						      SoupURI         *uri);
+
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_DIRECTORY_INPUT_STREAM_H */
diff --git a/WebCore/platform/network/soup/cache/soup-http-input-stream.c b/WebCore/platform/network/soup/cache/soup-http-input-stream.c
new file mode 100644
index 0000000..dc95d6e
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-http-input-stream.c
@@ -0,0 +1,921 @@
+/* soup-input-stream.c, based on gsocketinputstream.c
+ *
+ * Copyright (C) 2006-2007 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#include <config.h>
+
+#include <string.h>
+
+#include <glib.h>
+#include <gio/gio.h>
+
+#include <libsoup/soup.h>
+
+#include "soup-http-input-stream.h"
+
+static void webkit_soup_http_input_stream_seekable_iface_init (GSeekableIface *seekable_iface);
+
+G_DEFINE_TYPE_WITH_CODE (WebKitSoupHTTPInputStream, webkit_soup_http_input_stream, G_TYPE_INPUT_STREAM,
+			 G_IMPLEMENT_INTERFACE (G_TYPE_SEEKABLE,
+						webkit_soup_http_input_stream_seekable_iface_init))
+
+typedef void (*WebKitSoupHTTPInputStreamCallback)(GInputStream *);
+
+typedef struct {
+	SoupSession *session;
+	GMainContext *async_context;
+	SoupMessage *msg;
+	gboolean got_headers, finished;
+	goffset offset;
+
+	GCancellable *cancellable;
+	GSource *cancel_watch;
+	WebKitSoupHTTPInputStreamCallback got_headers_cb;
+	WebKitSoupHTTPInputStreamCallback got_chunk_cb;
+	WebKitSoupHTTPInputStreamCallback finished_cb;
+	WebKitSoupHTTPInputStreamCallback cancelled_cb;
+
+	guchar *leftover_buffer;
+	gsize leftover_bufsize, leftover_offset;
+
+	guchar *caller_buffer;
+	gsize caller_bufsize, caller_nread;
+	GAsyncReadyCallback outstanding_callback;
+	GSimpleAsyncResult *result;
+} WebKitSoupHTTPInputStreamPrivate;
+#define WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamPrivate))
+
+
+static gssize   webkit_soup_http_input_stream_read (GInputStream         *stream,
+						    void                 *buffer,
+						    gsize count,
+						    GCancellable         *cancellable,
+						    GError              **error);
+static gboolean webkit_soup_http_input_stream_close (GInputStream         *stream,
+						     GCancellable         *cancellable,
+						     GError              **error);
+static void     webkit_soup_http_input_stream_read_async (GInputStream         *stream,
+							  void                 *buffer,
+							  gsize count,
+							  int io_priority,
+							  GCancellable         *cancellable,
+							  GAsyncReadyCallback callback,
+							  gpointer data);
+static gssize   webkit_soup_http_input_stream_read_finish (GInputStream         *stream,
+							   GAsyncResult         *result,
+							   GError              **error);
+static void     webkit_soup_http_input_stream_close_async (GInputStream         *stream,
+							   int io_priority,
+							   GCancellable         *cancellable,
+							   GAsyncReadyCallback callback,
+							   gpointer data);
+static gboolean webkit_soup_http_input_stream_close_finish (GInputStream         *stream,
+							    GAsyncResult         *result,
+							    GError              **error);
+
+static goffset  webkit_soup_http_input_stream_tell (GSeekable            *seekable);
+
+static gboolean webkit_soup_http_input_stream_can_seek (GSeekable            *seekable);
+static gboolean webkit_soup_http_input_stream_seek (GSeekable            *seekable,
+						    goffset offset,
+						    GSeekType type,
+						    GCancellable         *cancellable,
+						    GError              **error);
+
+static gboolean webkit_soup_http_input_stream_can_truncate (GSeekable            *seekable);
+static gboolean webkit_soup_http_input_stream_truncate (GSeekable            *seekable,
+							goffset offset,
+							GCancellable         *cancellable,
+							GError              **error);
+
+static void webkit_soup_http_input_stream_got_headers (SoupMessage *msg, gpointer stream);
+static void webkit_soup_http_input_stream_got_chunk (SoupMessage *msg, SoupBuffer *chunk, gpointer stream);
+static void webkit_soup_http_input_stream_finished (SoupMessage *msg, gpointer stream);
+
+static void
+webkit_soup_http_input_stream_finalize (GObject *object)
+{
+	WebKitSoupHTTPInputStream *stream = WEBKIT_SOUP_HTTP_INPUT_STREAM (object);
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	g_object_unref (priv->session);
+
+	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_got_headers), stream);
+	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_got_chunk), stream);
+	g_signal_handlers_disconnect_by_func (priv->msg, G_CALLBACK (webkit_soup_http_input_stream_finished), stream);
+	g_object_unref (priv->msg);
+	g_free (priv->leftover_buffer);
+
+	if (G_OBJECT_CLASS (webkit_soup_http_input_stream_parent_class)->finalize)
+		(*G_OBJECT_CLASS (webkit_soup_http_input_stream_parent_class)->finalize)(object);
+}
+
+static void
+webkit_soup_http_input_stream_class_init (WebKitSoupHTTPInputStreamClass *klass)
+{
+	GObjectClass *gobject_class = G_OBJECT_CLASS (klass);
+	GInputStreamClass *stream_class = G_INPUT_STREAM_CLASS (klass);
+
+	g_type_class_add_private (klass, sizeof (WebKitSoupHTTPInputStreamPrivate));
+
+	gobject_class->finalize = webkit_soup_http_input_stream_finalize;
+
+	stream_class->read_fn = webkit_soup_http_input_stream_read;
+	stream_class->close_fn = webkit_soup_http_input_stream_close;
+	stream_class->read_async = webkit_soup_http_input_stream_read_async;
+	stream_class->read_finish = webkit_soup_http_input_stream_read_finish;
+	stream_class->close_async = webkit_soup_http_input_stream_close_async;
+	stream_class->close_finish = webkit_soup_http_input_stream_close_finish;
+}
+
+static void
+webkit_soup_http_input_stream_seekable_iface_init (GSeekableIface *seekable_iface)
+{
+	seekable_iface->tell = webkit_soup_http_input_stream_tell;
+	seekable_iface->can_seek = webkit_soup_http_input_stream_can_seek;
+	seekable_iface->seek = webkit_soup_http_input_stream_seek;
+	seekable_iface->can_truncate = webkit_soup_http_input_stream_can_truncate;
+	seekable_iface->truncate_fn = webkit_soup_http_input_stream_truncate;
+}
+
+static void
+webkit_soup_http_input_stream_init (WebKitSoupHTTPInputStream *stream)
+{
+	;
+}
+
+static void
+webkit_soup_http_input_stream_queue_message (WebKitSoupHTTPInputStream *stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	priv->got_headers = priv->finished = FALSE;
+
+	/* Add an extra ref since soup_session_queue_message steals one */
+	g_object_ref (priv->msg);
+	soup_session_queue_message (priv->session, priv->msg, NULL, NULL);
+}
+
+/**
+ * webkit_soup_http_input_stream_new:
+ * @session: the #SoupSession to use
+ * @msg: the #SoupMessage whose response will be streamed
+ *
+ * Prepares to send @msg over @session, and returns a #GInputStream
+ * that can be used to read the response.
+ *
+ * @msg may not be sent until the first read call; if you need to look
+ * at the status code or response headers before reading the body, you
+ * can use webkit_soup_http_input_stream_send() or webkit_soup_http_input_stream_send_async()
+ * to force the message to be sent and the response headers read.
+ *
+ * If @msg gets a non-2xx result, the first read (or send) will return
+ * an error with type %WEBKIT_SOUP_HTTP_INPUT_STREAM_HTTP_ERROR.
+ *
+ * Internally, #WebKitSoupHTTPInputStream is implemented using asynchronous I/O,
+ * so if you are using the synchronous API (eg,
+ * g_input_stream_read()), you should create a new #GMainContext and
+ * set it as the %SOUP_SESSION_ASYNC_CONTEXT property on @session. (If
+ * you don't, then synchronous #GInputStream calls will cause the main
+ * loop to be run recursively.) The async #GInputStream API works fine
+ * with %SOUP_SESSION_ASYNC_CONTEXT either set or unset.
+ *
+ * Returns: a new #GInputStream.
+ **/
+WebKitSoupHTTPInputStream *
+webkit_soup_http_input_stream_new (SoupSession *session, SoupMessage *msg)
+{
+	WebKitSoupHTTPInputStream *stream;
+	WebKitSoupHTTPInputStreamPrivate *priv;
+
+	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), NULL);
+
+	stream = g_object_new (WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, NULL);
+	priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	priv->session = g_object_ref (session);
+	priv->async_context = soup_session_get_async_context (session);
+	priv->msg = g_object_ref (msg);
+
+	g_signal_connect (msg, "got_headers",
+			  G_CALLBACK (webkit_soup_http_input_stream_got_headers), stream);
+	g_signal_connect (msg, "got_chunk",
+			  G_CALLBACK (webkit_soup_http_input_stream_got_chunk), stream);
+	g_signal_connect (msg, "finished",
+			  G_CALLBACK (webkit_soup_http_input_stream_finished), stream);
+
+	webkit_soup_http_input_stream_queue_message (stream);
+	return stream;
+}
+
+static void
+webkit_soup_http_input_stream_got_headers (SoupMessage *msg, gpointer stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	/* If the status is unsuccessful, we just ignore the signal and let
+	 * libsoup keep going (eventually either it will requeue the request
+	 * (after handling authentication/redirection), or else the
+	 * "finished" handler will run).
+	 */
+	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code))
+		return;
+
+	priv->got_headers = TRUE;
+	if (!priv->caller_buffer) {
+		/* Not ready to read the body yet */
+		soup_session_pause_message (priv->session, msg);
+	}
+
+	if (priv->got_headers_cb)
+		priv->got_headers_cb (stream);
+}
+
+static void
+webkit_soup_http_input_stream_got_chunk (SoupMessage *msg, SoupBuffer *chunk_buffer,
+					 gpointer stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	const gchar *chunk = chunk_buffer->data;
+	gsize chunk_size = chunk_buffer->length;
+
+	/* We only pay attention to the chunk if it's part of a successful
+	 * response.
+	 */
+	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code))
+		return;
+
+	/* Sanity check */
+	if (priv->caller_bufsize == 0 || priv->leftover_bufsize != 0)
+		g_warning ("webkit_soup_http_input_stream_got_chunk called again before previous chunk was processed");
+
+	/* Copy what we can into priv->caller_buffer */
+	if (priv->caller_bufsize - priv->caller_nread > 0) {
+		gsize nread = MIN (chunk_size, priv->caller_bufsize - priv->caller_nread);
+
+		memcpy (priv->caller_buffer + priv->caller_nread, chunk, nread);
+		priv->caller_nread += nread;
+		priv->offset += nread;
+		chunk += nread;
+		chunk_size -= nread;
+	}
+
+	if (chunk_size > 0) {
+		/* Copy the rest into priv->leftover_buffer. If
+		 * there's already some data there, realloc and
+		 * append. Otherwise just copy.
+		 */
+		if (priv->leftover_bufsize) {
+			priv->leftover_buffer = g_realloc (priv->leftover_buffer,
+							   priv->leftover_bufsize + chunk_size);
+			memcpy (priv->leftover_buffer + priv->leftover_bufsize,
+				chunk, chunk_size);
+			priv->leftover_bufsize += chunk_size;
+		} else {
+			priv->leftover_bufsize = chunk_size;
+			priv->leftover_buffer = g_memdup (chunk, chunk_size);
+			priv->leftover_offset = 0;
+		}
+	}
+
+	soup_session_pause_message (priv->session, msg);
+	if (priv->got_chunk_cb)
+		priv->got_chunk_cb (stream);
+}
+
+static void
+webkit_soup_http_input_stream_finished (SoupMessage *msg, gpointer stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	priv->finished = TRUE;
+
+	if (priv->finished_cb)
+		priv->finished_cb (stream);
+}
+
+static gboolean
+webkit_soup_http_input_stream_cancelled (GIOChannel *chan, GIOCondition condition,
+					 gpointer stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	priv->cancel_watch = NULL;
+
+	soup_session_pause_message (priv->session, priv->msg);
+	if (priv->cancelled_cb)
+		priv->cancelled_cb (stream);
+
+	return FALSE;
+}
+
+static void
+webkit_soup_http_input_stream_prepare_for_io (GInputStream *stream,
+					      GCancellable *cancellable,
+					      guchar       *buffer,
+					      gsize count)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	int cancel_fd;
+
+	priv->cancellable = cancellable;
+	cancel_fd = g_cancellable_get_fd (cancellable);
+	if (cancel_fd != -1) {
+		GIOChannel *chan = g_io_channel_unix_new (cancel_fd);
+		priv->cancel_watch = soup_add_io_watch (priv->async_context, chan,
+							G_IO_IN | G_IO_ERR | G_IO_HUP,
+							webkit_soup_http_input_stream_cancelled,
+							stream);
+		g_io_channel_unref (chan);
+	}
+
+	priv->caller_buffer = buffer;
+	priv->caller_bufsize = count;
+	priv->caller_nread = 0;
+
+	if (priv->got_headers)
+		soup_session_unpause_message (priv->session, priv->msg);
+}
+
+static void
+webkit_soup_http_input_stream_done_io (GInputStream *stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	if (priv->cancel_watch) {
+		g_source_destroy (priv->cancel_watch);
+		priv->cancel_watch = NULL;
+		g_cancellable_release_fd (priv->cancellable);
+	}
+	priv->cancellable = NULL;
+
+	priv->caller_buffer = NULL;
+	priv->caller_bufsize = 0;
+}
+
+static gboolean
+set_error_if_http_failed (SoupMessage *msg, GError **error)
+{
+	if (!SOUP_STATUS_IS_SUCCESSFUL (msg->status_code)) {
+		g_set_error_literal (error, SOUP_HTTP_ERROR,
+				     msg->status_code, msg->reason_phrase);
+		return TRUE;
+	}
+	return FALSE;
+}
+
+static gsize
+read_from_leftover (WebKitSoupHTTPInputStreamPrivate *priv,
+		    gpointer buffer, gsize bufsize)
+{
+	gsize nread;
+
+	if (priv->leftover_bufsize - priv->leftover_offset <= bufsize) {
+		nread = priv->leftover_bufsize - priv->leftover_offset;
+		memcpy (buffer, priv->leftover_buffer + priv->leftover_offset, nread);
+
+		g_free (priv->leftover_buffer);
+		priv->leftover_buffer = NULL;
+		priv->leftover_bufsize = priv->leftover_offset = 0;
+	} else {
+		nread = bufsize;
+		memcpy (buffer, priv->leftover_buffer + priv->leftover_offset, nread);
+		priv->leftover_offset += nread;
+	}
+
+	priv->offset += nread;
+	return nread;
+}
+
+/* This does the work of webkit_soup_http_input_stream_send(), assuming that the
+ * GInputStream pending flag has already been set. It is also used by
+ * webkit_soup_http_input_stream_send_async() in some circumstances.
+ */
+static gboolean
+webkit_soup_http_input_stream_send_internal (GInputStream  *stream,
+					     GCancellable  *cancellable,
+					     GError       **error)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, NULL, 0);
+	while (!priv->finished && !priv->got_headers &&
+	       !g_cancellable_is_cancelled (cancellable))
+		g_main_context_iteration (priv->async_context, TRUE);
+	webkit_soup_http_input_stream_done_io (stream);
+
+	if (g_cancellable_set_error_if_cancelled (cancellable, error))
+		return FALSE;
+	else if (set_error_if_http_failed (priv->msg, error))
+		return FALSE;
+	return TRUE;
+}
+
+static void
+send_sync_finished (GInputStream *stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	GError *error = NULL;
+
+	if (!g_cancellable_set_error_if_cancelled (priv->cancellable, &error))
+		set_error_if_http_failed (priv->msg, &error);
+
+	priv->got_headers_cb = NULL;
+	priv->finished_cb = NULL;
+
+	/* Wake up the main context iteration */
+	g_source_attach (g_idle_source_new (), NULL);
+}
+
+/**
+ * webkit_soup_http_input_stream_send:
+ * @httpstream: a #WebKitSoupHTTPInputStream
+ * @cancellable: optional #GCancellable object, %NULL to ignore.
+ * @error: location to store the error occuring, or %NULL to ignore
+ *
+ * Synchronously sends the HTTP request associated with @stream, and
+ * reads the response headers. Call this after webkit_soup_http_input_stream_new()
+ * and before the first g_input_stream_read() if you want to check the
+ * HTTP status code before you start reading.
+ *
+ * Return value: %TRUE if msg has a successful (2xx) status, %FALSE if
+ * not.
+ **/
+gboolean
+webkit_soup_http_input_stream_send (WebKitSoupHTTPInputStream  *httpstream,
+				    GCancellable         *cancellable,
+				    GError              **error)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (httpstream);
+	GInputStream *istream = (GInputStream *)httpstream;
+	gboolean result;
+
+	g_return_val_if_fail (WEBKIT_IS_SOUP_HTTP_INPUT_STREAM (httpstream), FALSE);
+
+	if (!g_input_stream_set_pending (istream, error))
+		return FALSE;
+
+	priv->got_headers_cb = send_sync_finished;
+	priv->finished_cb = send_sync_finished;
+
+	result = webkit_soup_http_input_stream_send_internal (istream, cancellable, error);
+	g_input_stream_clear_pending (istream);
+
+	return result;
+}
+
+static gssize
+webkit_soup_http_input_stream_read (GInputStream *stream,
+				    void         *buffer,
+				    gsize count,
+				    GCancellable *cancellable,
+				    GError      **error)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	if (priv->finished)
+		return 0;
+
+	/* If there is data leftover from a previous read, return it. */
+	if (priv->leftover_bufsize)
+		return read_from_leftover (priv, buffer, count);
+
+	/* No leftover data, accept one chunk from the network */
+	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, buffer, count);
+	while (!priv->finished && priv->caller_nread == 0 &&
+	       !g_cancellable_is_cancelled (cancellable))
+		g_main_context_iteration (priv->async_context, TRUE);
+	webkit_soup_http_input_stream_done_io (stream);
+
+	if (priv->caller_nread > 0)
+		return priv->caller_nread;
+
+	if (g_cancellable_set_error_if_cancelled (cancellable, error))
+		return -1;
+	else if (set_error_if_http_failed (priv->msg, error))
+		return -1;
+	else
+		return 0;
+}
+
+static gboolean
+webkit_soup_http_input_stream_close (GInputStream *stream,
+				     GCancellable *cancellable,
+				     GError      **error)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	if (!priv->finished)
+		soup_session_cancel_message (priv->session, priv->msg, SOUP_STATUS_CANCELLED);
+
+	return TRUE;
+}
+
+static void
+wrapper_callback (GObject *source_object, GAsyncResult *res,
+		  gpointer user_data)
+{
+	GInputStream *stream = G_INPUT_STREAM (source_object);
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	g_input_stream_clear_pending (stream);
+	if (priv->outstanding_callback)
+		(*priv->outstanding_callback)(source_object, res, user_data);
+	priv->outstanding_callback = NULL;
+	g_object_unref (stream);
+}
+
+static void
+send_async_thread (GSimpleAsyncResult *res,
+		   GObject *object,
+		   GCancellable *cancellable)
+{
+	GError *error = NULL;
+	gboolean success;
+
+	success = webkit_soup_http_input_stream_send_internal (G_INPUT_STREAM (object),
+							cancellable, &error);
+	g_simple_async_result_set_op_res_gboolean (res, success);
+	if (error) {
+		g_simple_async_result_set_from_error (res, error);
+		g_error_free (error);
+	}
+}
+
+static void
+webkit_soup_http_input_stream_send_async_in_thread (GInputStream        *stream,
+						    int io_priority,
+						    GCancellable        *cancellable,
+						    GAsyncReadyCallback callback,
+						    gpointer user_data)
+{
+	GSimpleAsyncResult *res;
+
+	res = g_simple_async_result_new (G_OBJECT (stream), callback, user_data,
+					 webkit_soup_http_input_stream_send_async_in_thread);
+	g_simple_async_result_run_in_thread (res, send_async_thread,
+					     io_priority, cancellable);
+	g_object_unref (res);
+}
+
+static void
+send_async_finished (GInputStream *stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	GSimpleAsyncResult *result;
+	GError *error = NULL;
+
+	if (!g_cancellable_set_error_if_cancelled (priv->cancellable, &error))
+		set_error_if_http_failed (priv->msg, &error);
+
+	priv->got_headers_cb = NULL;
+	priv->finished_cb = NULL;
+	webkit_soup_http_input_stream_done_io (stream);
+
+	result = priv->result;
+	priv->result = NULL;
+
+	g_simple_async_result_set_op_res_gboolean (result, error == NULL);
+	if (error) {
+		g_simple_async_result_set_from_error (result, error);
+		g_error_free (error);
+	}
+	g_simple_async_result_complete (result);
+}
+
+static void
+webkit_soup_http_input_stream_send_async_internal (GInputStream        *stream,
+						   int io_priority,
+						   GCancellable        *cancellable,
+						   GAsyncReadyCallback callback,
+						   gpointer user_data)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+
+	g_object_ref (stream);
+	priv->outstanding_callback = callback;
+
+	/* If the session uses the default GMainContext, then we can do
+	 * async I/O directly. But if it has its own main context, it's
+	 * easier to just run it in another thread.
+	 */
+	if (soup_session_get_async_context (priv->session)) {
+		webkit_soup_http_input_stream_send_async_in_thread (stream, io_priority, cancellable,
+							     wrapper_callback, user_data);
+		return;
+	}
+
+	priv->got_headers_cb = send_async_finished;
+	priv->finished_cb = send_async_finished;
+
+	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, NULL, 0);
+	priv->result = g_simple_async_result_new (G_OBJECT (stream),
+						  wrapper_callback, user_data,
+						  webkit_soup_http_input_stream_send_async);
+}
+
+/**
+ * webkit_soup_http_input_stream_send_async:
+ * @httpstream: a #WebKitSoupHTTPInputStream
+ * @io_priority: the io priority of the request.
+ * @cancellable: optional #GCancellable object, %NULL to ignore.
+ * @callback: callback to call when the request is satisfied
+ * @user_data: the data to pass to callback function
+ *
+ * Asynchronously sends the HTTP request associated with @stream, and
+ * reads the response headers. Call this after webkit_soup_http_input_stream_new()
+ * and before the first g_input_stream_read_async() if you want to
+ * check the HTTP status code before you start reading.
+ **/
+void
+webkit_soup_http_input_stream_send_async (WebKitSoupHTTPInputStream *httpstream,
+					  int io_priority,
+					  GCancellable        *cancellable,
+					  GAsyncReadyCallback callback,
+					  gpointer user_data)
+{
+	GInputStream *istream = (GInputStream *)httpstream;
+	GError *error = NULL;
+
+	g_return_if_fail (WEBKIT_IS_SOUP_HTTP_INPUT_STREAM (httpstream));
+
+	if (!g_input_stream_set_pending (istream, &error)) {
+		g_simple_async_report_gerror_in_idle (G_OBJECT (httpstream),
+						      callback,
+						      user_data,
+						      error);
+		g_error_free (error);
+		return;
+	}
+	webkit_soup_http_input_stream_send_async_internal (istream, io_priority, cancellable,
+						    callback, user_data);
+}
+
+/**
+ * webkit_soup_http_input_stream_send_finish:
+ * @httpstream: a #WebKitSoupHTTPInputStream
+ * @result: a #GAsyncResult.
+ * @error: a #GError location to store the error occuring, or %NULL to
+ * ignore.
+ *
+ * Finishes a webkit_soup_http_input_stream_send_async() operation.
+ *
+ * Return value: %TRUE if the message was sent successfully and
+ * received a successful status code, %FALSE if not.
+ **/
+gboolean
+webkit_soup_http_input_stream_send_finish (WebKitSoupHTTPInputStream  *httpstream,
+					   GAsyncResult         *result,
+					   GError              **error)
+{
+	GSimpleAsyncResult *simple;
+
+	g_return_val_if_fail (G_IS_SIMPLE_ASYNC_RESULT (result), FALSE);
+	simple = G_SIMPLE_ASYNC_RESULT (result);
+
+	g_return_val_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_http_input_stream_send_async, FALSE);
+
+	if (g_simple_async_result_propagate_error (simple, error))
+		return FALSE;
+
+	return g_simple_async_result_get_op_res_gboolean (simple);
+}
+
+static void
+read_async_done (GInputStream *stream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	GSimpleAsyncResult *result;
+	GError *error = NULL;
+
+	result = priv->result;
+	priv->result = NULL;
+
+	if (g_cancellable_set_error_if_cancelled (priv->cancellable, &error) ||
+	    set_error_if_http_failed (priv->msg, &error)) {
+		g_simple_async_result_set_from_error (result, error);
+		g_error_free (error);
+	} else
+		g_simple_async_result_set_op_res_gssize (result, priv->caller_nread);
+
+	priv->got_chunk_cb = NULL;
+	priv->finished_cb = NULL;
+	priv->cancelled_cb = NULL;
+	webkit_soup_http_input_stream_done_io (stream);
+
+	g_simple_async_result_complete (result);
+	g_object_unref (result);
+}
+
+static void
+webkit_soup_http_input_stream_read_async (GInputStream        *stream,
+					  void                *buffer,
+					  gsize count,
+					  int io_priority,
+					  GCancellable        *cancellable,
+					  GAsyncReadyCallback callback,
+					  gpointer user_data)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (stream);
+	GSimpleAsyncResult *result;
+
+	/* If the session uses the default GMainContext, then we can do
+	 * async I/O directly. But if it has its own main context, we fall
+	 * back to the async-via-sync-in-another-thread implementation.
+	 */
+	if (soup_session_get_async_context (priv->session)) {
+		G_INPUT_STREAM_CLASS (webkit_soup_http_input_stream_parent_class)->
+		read_async (stream, buffer, count, io_priority,
+			    cancellable, callback, user_data);
+		return;
+	}
+
+	result = g_simple_async_result_new (G_OBJECT (stream),
+					    callback, user_data,
+					    webkit_soup_http_input_stream_read_async);
+
+	if (priv->finished) {
+		g_simple_async_result_set_op_res_gssize (result, 0);
+		g_simple_async_result_complete_in_idle (result);
+		g_object_unref (result);
+		return;
+	}
+
+	if (priv->leftover_bufsize) {
+		gsize nread = read_from_leftover (priv, buffer, count);
+		g_simple_async_result_set_op_res_gssize (result, nread);
+		g_simple_async_result_complete_in_idle (result);
+		g_object_unref (result);
+		return;
+	}
+
+	priv->result = result;
+
+	priv->got_chunk_cb = read_async_done;
+	priv->finished_cb = read_async_done;
+	priv->cancelled_cb = read_async_done;
+	webkit_soup_http_input_stream_prepare_for_io (stream, cancellable, buffer, count);
+}
+
+static gssize
+webkit_soup_http_input_stream_read_finish (GInputStream  *stream,
+					   GAsyncResult  *result,
+					   GError       **error)
+{
+	GSimpleAsyncResult *simple;
+
+	g_return_val_if_fail (G_IS_SIMPLE_ASYNC_RESULT (result), -1);
+	simple = G_SIMPLE_ASYNC_RESULT (result);
+	g_return_val_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_http_input_stream_read_async, -1);
+
+	return g_simple_async_result_get_op_res_gssize (simple);
+}
+
+static void
+webkit_soup_http_input_stream_close_async (GInputStream       *stream,
+					   int io_priority,
+					   GCancellable       *cancellable,
+					   GAsyncReadyCallback callback,
+					   gpointer user_data)
+{
+	GSimpleAsyncResult *result;
+	gboolean success;
+	GError *error = NULL;
+
+	result = g_simple_async_result_new (G_OBJECT (stream),
+					    callback, user_data,
+					    webkit_soup_http_input_stream_close_async);
+	success = webkit_soup_http_input_stream_close (stream, cancellable, &error);
+	g_simple_async_result_set_op_res_gboolean (result, success);
+	if (error) {
+		g_simple_async_result_set_from_error (result, error);
+		g_error_free (error);
+	}
+
+	g_simple_async_result_complete_in_idle (result);
+	g_object_unref (result);
+}
+
+static gboolean
+webkit_soup_http_input_stream_close_finish (GInputStream  *stream,
+					    GAsyncResult  *result,
+					    GError       **error)
+{
+	/* Failures handled in generic close_finish code */
+	return TRUE;
+}
+
+static goffset
+webkit_soup_http_input_stream_tell (GSeekable *seekable)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (seekable);
+
+	return priv->offset;
+}
+
+static gboolean
+webkit_soup_http_input_stream_can_seek (GSeekable *seekable)
+{
+	return TRUE;
+}
+
+extern void soup_message_io_cleanup (SoupMessage *msg);
+
+static gboolean
+webkit_soup_http_input_stream_seek (GSeekable     *seekable,
+				    goffset offset,
+				    GSeekType type,
+				    GCancellable  *cancellable,
+				    GError       **error)
+{
+	GInputStream *stream = G_INPUT_STREAM (seekable);
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (seekable);
+	char *range;
+
+	if (type == G_SEEK_END) {
+		/* FIXME: we could send "bytes=-offset", but unless we
+		 * know the Content-Length, we wouldn't be able to
+		 * answer a tell() properly. We could find the
+		 * Content-Length by doing a HEAD...
+		 */
+
+		g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
+				     "G_SEEK_END not currently supported");
+		return FALSE;
+	}
+
+	if (!g_input_stream_set_pending (stream, error))
+		return FALSE;
+
+	soup_session_cancel_message (priv->session, priv->msg, SOUP_STATUS_CANCELLED);
+	soup_message_io_cleanup (priv->msg);
+
+	switch (type) {
+		case G_SEEK_CUR:
+			offset += priv->offset;
+		/* fall through */
+
+		case G_SEEK_SET:
+			range = g_strdup_printf ("bytes=%" G_GUINT64_FORMAT "-", (guint64)offset);
+			priv->offset = offset;
+			break;
+
+		case G_SEEK_END:
+			range = NULL; /* keep compilers happy */
+			g_return_val_if_reached (FALSE);
+			break;
+
+		default:
+			g_return_val_if_reached (FALSE);
+	}
+
+	soup_message_headers_remove (priv->msg->request_headers, "Range");
+	soup_message_headers_append (priv->msg->request_headers, "Range", range);
+	g_free (range);
+
+	webkit_soup_http_input_stream_queue_message (WEBKIT_SOUP_HTTP_INPUT_STREAM (stream));
+
+	g_input_stream_clear_pending (stream);
+	return TRUE;
+}
+
+static gboolean
+webkit_soup_http_input_stream_can_truncate (GSeekable *seekable)
+{
+	return FALSE;
+}
+
+static gboolean
+webkit_soup_http_input_stream_truncate (GSeekable     *seekable,
+					goffset offset,
+					GCancellable  *cancellable,
+					GError       **error)
+{
+	g_set_error_literal (error, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
+			     "Truncate not allowed on input stream");
+	return FALSE;
+}
+
+SoupMessage *
+webkit_soup_http_input_stream_get_message (WebKitSoupHTTPInputStream *httpstream)
+{
+	WebKitSoupHTTPInputStreamPrivate *priv = WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_PRIVATE (httpstream);
+	return priv->msg ? g_object_ref (priv->msg) : NULL;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-http-input-stream.h b/WebCore/platform/network/soup/cache/soup-http-input-stream.h
new file mode 100644
index 0000000..6b98559
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-http-input-stream.h
@@ -0,0 +1,77 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2006, 2007, 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General
+ * Public License along with this library; if not, write to the
+ * Free Software Foundation, Inc., 59 Temple Place, Suite 330,
+ * Boston, MA 02111-1307, USA.
+ */
+
+#ifndef __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__
+#define __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__
+
+#include <gio/gio.h>
+#include <libsoup/soup-types.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM         (webkit_soup_http_input_stream_get_type ())
+#define WEBKIT_SOUP_HTTP_INPUT_STREAM(o)           (G_TYPE_CHECK_INSTANCE_CAST ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStream))
+#define WEBKIT_SOUP_HTTP_INPUT_STREAM_CLASS(k)     (G_TYPE_CHECK_CLASS_CAST ((k), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamClass))
+#define WEBKIT_IS_SOUP_HTTP_INPUT_STREAM(o)        (G_TYPE_CHECK_INSTANCE_TYPE ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM))
+#define WEBKIT_IS_SOUP_HTTP_INPUT_STREAM_CLASS(k)  (G_TYPE_CHECK_CLASS_TYPE ((k), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM))
+#define WEBKIT_SOUP_HTTP_INPUT_STREAM_GET_CLASS(o) (G_TYPE_INSTANCE_GET_CLASS ((o), WEBKIT_TYPE_SOUP_HTTP_INPUT_STREAM, WebKitSoupHTTPInputStreamClass))
+
+typedef struct WebKitSoupHTTPInputStream WebKitSoupHTTPInputStream;
+typedef struct WebKitSoupHTTPInputStreamClass WebKitSoupHTTPInputStreamClass;
+
+struct WebKitSoupHTTPInputStream {
+	GInputStream parent;
+};
+
+struct WebKitSoupHTTPInputStreamClass {
+	GInputStreamClass parent_class;
+
+	/* Padding for future expansion */
+	void (*_g_reserved1)(void);
+	void (*_g_reserved2)(void);
+	void (*_g_reserved3)(void);
+	void (*_g_reserved4)(void);
+	void (*_g_reserved5)(void);
+};
+
+GType webkit_soup_http_input_stream_get_type (void) G_GNUC_CONST;
+
+WebKitSoupHTTPInputStream *webkit_soup_http_input_stream_new (SoupSession         *session,
+							      SoupMessage         *msg);
+
+gboolean             webkit_soup_http_input_stream_send (WebKitSoupHTTPInputStream *httpstream,
+							 GCancellable        *cancellable,
+							 GError             **error);
+
+void                 webkit_soup_http_input_stream_send_async (WebKitSoupHTTPInputStream *httpstream,
+							       int io_priority,
+							       GCancellable        *cancellable,
+							       GAsyncReadyCallback callback,
+							       gpointer user_data);
+gboolean             webkit_soup_http_input_stream_send_finish (WebKitSoupHTTPInputStream *httpstream,
+								GAsyncResult        *result,
+								GError             **error);
+
+SoupMessage         *webkit_soup_http_input_stream_get_message (WebKitSoupHTTPInputStream *httpstream);
+
+G_END_DECLS
+
+#endif /* __WEBKIT_SOUP_HTTP_INPUT_STREAM_H__ */
diff --git a/WebCore/platform/network/soup/cache/soup-request-data.c b/WebCore/platform/network/soup/cache/soup-request-data.c
new file mode 100644
index 0000000..ced5c4a
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-data.c
@@ -0,0 +1,170 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-request-data.c: data: URI request object
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+#include "soup-request-data.h"
+
+#include "soup-requester.h"
+#include <libsoup/soup.h>
+#include <glib/gi18n.h>
+
+G_DEFINE_TYPE (WebKitSoupRequestData, webkit_soup_request_data, WEBKIT_TYPE_SOUP_REQUEST)
+
+struct _WebKitSoupRequestDataPrivate {
+	gsize content_length;
+	char *content_type;
+};
+
+static void
+webkit_soup_request_data_init (WebKitSoupRequestData *data)
+{
+	data->priv = G_TYPE_INSTANCE_GET_PRIVATE (data, WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataPrivate);
+}
+
+static void
+webkit_soup_request_data_finalize (GObject *object)
+{
+	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (object);
+
+	g_free (data->priv->content_type);
+
+	G_OBJECT_CLASS (webkit_soup_request_data_parent_class)->finalize (object);
+}
+
+static gboolean
+webkit_soup_request_data_check_uri (WebKitSoupRequest  *request,
+				    SoupURI      *uri,
+				    GError      **error)
+{
+	return uri->host == NULL;
+}
+
+static GInputStream *
+webkit_soup_request_data_send (WebKitSoupRequest   *request,
+			       GCancellable  *cancellable,
+			       GError       **error)
+{
+	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
+	SoupURI *uri = webkit_soup_request_get_uri (request);
+	GInputStream *memstream;
+	const char *comma, *semi, *start, *end;
+	gboolean base64 = FALSE;
+
+	gchar *uristr = soup_uri_to_string (uri, FALSE);
+	comma = strchr (uristr, ',');
+	if (comma && comma != uristr) {
+		/* Deal with MIME type / params */
+		semi = memchr (uristr, ';', comma - uristr);
+		end = semi ? semi : comma;
+
+		if (semi && !g_ascii_strncasecmp (semi, ";base64", MAX ((size_t) (comma - semi), strlen (";base64"))))
+			base64 = TRUE;
+
+		if (end != uristr)
+			if (base64)
+				data->priv->content_type = g_strndup (uristr, end - uristr);
+			else
+				data->priv->content_type =
+					webkit_soup_request_uri_decoded_copy (uristr, end - uristr);
+	}
+
+	memstream = g_memory_input_stream_new ();
+
+	start = comma ? comma + 1 : uristr;
+
+	if (*start) {
+		guchar *buf;
+
+		if (base64) {
+			int inlen, state = 0;
+			guint save = 0;
+
+			inlen = strlen (start);
+			buf = g_malloc0 (inlen * 3 / 4 + 3);
+			data->priv->content_length =
+				g_base64_decode_step (start, inlen, buf,
+						      &state, &save);
+			if (state != 0) {
+				g_free (buf);
+				goto fail;
+			}
+		} else {
+			/* Cannot use g_uri_unescape_string nor
+			   soup_uri_decode because we don't want to
+			   fail for things like "%3E%%3C" -> ">%<" */
+			buf = (guchar *)webkit_soup_request_uri_decoded_copy (start, strlen (start));
+			if (!buf)
+				goto fail;
+			data->priv->content_length = strlen ((char *)buf);
+		}
+
+		g_memory_input_stream_add_data (G_MEMORY_INPUT_STREAM (memstream),
+						buf, data->priv->content_length,
+						g_free);
+	}
+	g_free (uristr);
+
+	return memstream;
+
+ fail:
+	g_free (uristr);
+	g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
+		     _ ("Unable to decode URI: %s"), start);
+	g_object_unref (memstream);
+	return NULL;
+}
+
+static goffset
+webkit_soup_request_data_get_content_length (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
+
+	return data->priv->content_length;
+}
+
+static const char *
+webkit_soup_request_data_get_content_type (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestData *data = WEBKIT_SOUP_REQUEST_DATA (request);
+
+	return data->priv->content_type;
+}
+
+static void
+webkit_soup_request_data_class_init (WebKitSoupRequestDataClass *request_data_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (request_data_class);
+	WebKitSoupRequestClass *request_class =
+		WEBKIT_SOUP_REQUEST_CLASS (request_data_class);
+
+	g_type_class_add_private (request_data_class, sizeof (WebKitSoupRequestDataPrivate));
+
+	object_class->finalize = webkit_soup_request_data_finalize;
+
+	request_class->check_uri = webkit_soup_request_data_check_uri;
+	request_class->send = webkit_soup_request_data_send;
+	request_class->get_content_length = webkit_soup_request_data_get_content_length;
+	request_class->get_content_type = webkit_soup_request_data_get_content_type;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-request-data.h b/WebCore/platform/network/soup/cache/soup-request-data.h
new file mode 100644
index 0000000..c9631a4
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-data.h
@@ -0,0 +1,52 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_REQUEST_DATA_H
+#define WEBKIT_SOUP_REQUEST_DATA_H 1
+
+#include "soup-request.h"
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_REQUEST_DATA            (webkit_soup_request_data_get_type ())
+#define WEBKIT_SOUP_REQUEST_DATA(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestData))
+#define WEBKIT_SOUP_REQUEST_DATA_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataClass))
+#define WEBKIT_IS_SOUP_REQUEST_DATA(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_DATA))
+#define WEBKIT_IS_SOUP_REQUEST_DATA_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_DATA))
+#define WEBKIT_SOUP_REQUEST_DATA_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_DATA, WebKitSoupRequestDataClass))
+
+typedef struct _WebKitSoupRequestDataPrivate WebKitSoupRequestDataPrivate;
+
+typedef struct {
+	WebKitSoupRequest parent;
+
+	WebKitSoupRequestDataPrivate *priv;
+} WebKitSoupRequestData;
+
+typedef struct {
+	WebKitSoupRequestClass parent;
+} WebKitSoupRequestDataClass;
+
+GType webkit_soup_request_data_get_type (void);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_REQUEST_DATA_H */
diff --git a/WebCore/platform/network/soup/cache/soup-request-file.c b/WebCore/platform/network/soup/cache/soup-request-file.c
new file mode 100644
index 0000000..24ccb10
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-file.c
@@ -0,0 +1,331 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-request-file.c: file: URI request object
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "soup-request-file.h"
+#include "soup-directory-input-stream.h"
+#include "soup-requester.h"
+#include <glib/gi18n.h>
+
+G_DEFINE_TYPE (WebKitSoupRequestFile, webkit_soup_request_file, WEBKIT_TYPE_SOUP_REQUEST)
+
+struct _WebKitSoupRequestFilePrivate {
+	GFile *gfile;
+
+	char *mime_type;
+	goffset size;
+};
+
+GFile *
+webkit_soup_request_file_get_file (WebKitSoupRequestFile *file)
+{
+	return g_object_ref (file->priv->gfile);
+}
+
+static void
+webkit_soup_request_file_init (WebKitSoupRequestFile *file)
+{
+	file->priv = G_TYPE_INSTANCE_GET_PRIVATE (file, WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFilePrivate);
+
+	file->priv->size = -1;
+}
+
+static void
+webkit_soup_request_file_finalize (GObject *object)
+{
+	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (object);
+
+	if (file->priv->gfile)
+		g_object_unref (file->priv->gfile);
+	g_free (file->priv->mime_type);
+
+	G_OBJECT_CLASS (webkit_soup_request_file_parent_class)->finalize (object);
+}
+
+static gboolean
+webkit_soup_request_file_check_uri (WebKitSoupRequest  *request,
+				    SoupURI      *uri,
+				    GError      **error)
+{
+	/* "file:/foo" is not valid */
+	if (!uri->host)
+		return FALSE;
+
+	/* but it must be "file:///..." or "file://localhost/..." */
+	if (uri->scheme == SOUP_URI_SCHEME_FILE &&
+	    *uri->host &&
+	    g_ascii_strcasecmp (uri->host, "localhost") != 0)
+		return FALSE;
+
+	return TRUE;
+}
+
+static void
+webkit_soup_request_file_ftp_main_loop_quit (GObject      *object,
+					     GAsyncResult *result,
+					     gpointer loop)
+{
+	g_main_loop_quit (loop);
+}
+
+/* This is a somewhat hacky way to get FTP to almost work. The proper way to
+ * get FTP to _really_ work involves hacking GIO to have APIs to handle
+ * canoncial URLs.
+ */
+static GFile *
+webkit_soup_request_file_ensure_file_ftp (SoupURI       *uri,
+					  GCancellable  *cancellable,
+					  GError       **error)
+{
+	SoupURI *host;
+	char *s;
+	GFile *file, *result;
+	GMount *mount;
+
+	host = soup_uri_copy_host (uri);
+	s = soup_uri_to_string (host, FALSE);
+	file = g_file_new_for_uri (s);
+	soup_uri_free (host);
+	g_free (s);
+
+	mount = g_file_find_enclosing_mount (file, cancellable, error);
+	if (mount == NULL && g_file_supports_thread_contexts (file)) {
+		GMainContext *context = g_main_context_new ();
+		GMainLoop *loop = g_main_loop_new (context, FALSE);
+
+		g_clear_error (error);
+		g_main_context_push_thread_default (context);
+		g_file_mount_enclosing_volume (file,
+					       G_MOUNT_MOUNT_NONE,
+					       NULL, /* FIXME! */
+					       cancellable,
+					       webkit_soup_request_file_ftp_main_loop_quit,
+					       loop);
+		g_main_loop_run (loop);
+		g_main_context_pop_thread_default (context);
+		g_main_loop_unref (loop);
+		g_main_context_unref (context);
+		mount = g_file_find_enclosing_mount (file, cancellable, error);
+	}
+	if (mount == NULL)
+		return NULL;
+	g_object_unref (file);
+
+	file = g_mount_get_default_location (mount);
+	g_object_unref (mount);
+
+	s = g_strdup (uri->path);
+	if (strchr (s, ';'))
+		*strchr (s, ';') = 0;
+
+	result = g_file_resolve_relative_path (file, s);
+	g_free (s);
+	g_object_unref (file);
+
+	return result;
+}
+
+static gboolean
+webkit_soup_request_file_ensure_file (WebKitSoupRequestFile  *file,
+				      GCancellable     *cancellable,
+				      GError          **error)
+{
+	SoupURI *uri;
+
+	if (file->priv->gfile)
+		return TRUE;
+
+	uri = webkit_soup_request_get_uri (WEBKIT_SOUP_REQUEST (file));
+	if (uri->scheme == SOUP_URI_SCHEME_FILE) {
+		/* We cannot use soup_uri_decode as it incorrectly
+		 * returns NULL for incorrectly encoded URIs (that
+		 * could be valid filenames). This will be hopefully
+		 * shipped in libsoup 2.32.1 but we want to land this
+		 * first. TODO: replace uri_decoded_copy by
+		 * soup_uri_decode when the required libsoup version
+		 * is bumped out to 2.32.1
+		 */
+		gchar *decoded_uri = webkit_soup_request_uri_decoded_copy (uri->path, strlen (uri->path));
+
+		if (decoded_uri) {
+			/* Do not use new_for_uri() as the decoded URI
+			 *  could not be a valid URI
+			 */
+			file->priv->gfile = g_file_new_for_path (decoded_uri);
+			g_free (decoded_uri);
+		}
+
+		return TRUE;
+	} else if (uri->scheme == SOUP_URI_SCHEME_FTP) {
+		file->priv->gfile = webkit_soup_request_file_ensure_file_ftp (uri,
+									      cancellable,
+									      error);
+		return file->priv->gfile != NULL;
+	}
+
+	g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME,
+		     _ ("Unsupported URI scheme '%s'"), uri->scheme);
+	return FALSE;
+}
+
+static GInputStream *
+webkit_soup_request_file_send (WebKitSoupRequest          *request,
+			       GCancellable         *cancellable,
+			       GError              **error)
+{
+	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
+	GInputStream *stream;
+	GError *my_error = NULL;
+
+	if (!webkit_soup_request_file_ensure_file (file, cancellable, error))
+		return NULL;
+
+	stream = G_INPUT_STREAM (g_file_read (file->priv->gfile,
+					      cancellable, &my_error));
+	if (stream == NULL) {
+		if (g_error_matches (my_error, G_IO_ERROR, G_IO_ERROR_IS_DIRECTORY)) {
+			GFileEnumerator *enumerator;
+			g_clear_error (&my_error);
+			enumerator = g_file_enumerate_children (file->priv->gfile,
+								"*",
+								G_FILE_QUERY_INFO_NONE,
+								cancellable,
+								error);
+			if (enumerator) {
+				stream = webkit_soup_directory_input_stream_new (enumerator,
+										 webkit_soup_request_get_uri (request));
+				g_object_unref (enumerator);
+				file->priv->mime_type = g_strdup ("text/html");
+			}
+		} else {
+			g_propagate_error (error, my_error);
+		}
+	} else {
+		GFileInfo *info = g_file_query_info (file->priv->gfile,
+						     G_FILE_ATTRIBUTE_STANDARD_CONTENT_TYPE ","
+						     G_FILE_ATTRIBUTE_STANDARD_SIZE,
+						     0, cancellable, NULL);
+		if (info) {
+			const char *content_type;
+			file->priv->size = g_file_info_get_size (info);
+			content_type = g_file_info_get_content_type (info);
+
+			if (content_type)
+				file->priv->mime_type = g_content_type_get_mime_type (content_type);
+			g_object_unref (info);
+		}
+	}
+
+	return stream;
+}
+
+static void
+webkit_soup_request_file_send_async_thread (GSimpleAsyncResult *res,
+					    GObject            *object,
+					    GCancellable       *cancellable)
+{
+	GInputStream *stream;
+	WebKitSoupRequest *request;
+	GError *error = NULL;
+
+	request = WEBKIT_SOUP_REQUEST (object);
+
+	stream = webkit_soup_request_file_send (request, cancellable, &error);
+
+	if (stream == NULL) {
+		g_simple_async_result_set_from_error (res, error);
+		g_error_free (error);
+	} else {
+		g_simple_async_result_set_op_res_gpointer (res, stream, g_object_unref);
+	}
+}
+
+static void
+webkit_soup_request_file_send_async (WebKitSoupRequest          *request,
+				     GCancellable         *cancellable,
+				     GAsyncReadyCallback callback,
+				     gpointer user_data)
+{
+	GSimpleAsyncResult *res;
+
+	res = g_simple_async_result_new (G_OBJECT (request), callback, user_data, webkit_soup_request_file_send_async);
+
+	g_simple_async_result_run_in_thread (res, webkit_soup_request_file_send_async_thread, G_PRIORITY_DEFAULT, cancellable);
+	g_object_unref (res);
+}
+
+static GInputStream *
+webkit_soup_request_file_send_finish (WebKitSoupRequest          *request,
+				      GAsyncResult         *result,
+				      GError              **error)
+{
+	GSimpleAsyncResult *simple = G_SIMPLE_ASYNC_RESULT (result);
+
+	g_warn_if_fail (g_simple_async_result_get_source_tag (simple) == webkit_soup_request_file_send_async);
+
+	if (g_simple_async_result_propagate_error (simple, error))
+		return NULL;
+
+	return g_object_ref (g_simple_async_result_get_op_res_gpointer (simple));
+}
+
+static goffset
+webkit_soup_request_file_get_content_length (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
+
+	return file->priv->size;
+}
+
+static const char *
+webkit_soup_request_file_get_content_type (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestFile *file = WEBKIT_SOUP_REQUEST_FILE (request);
+
+	if (!file->priv->mime_type)
+		return "application/octet-stream";
+
+	return file->priv->mime_type;
+}
+
+static void
+webkit_soup_request_file_class_init (WebKitSoupRequestFileClass *request_file_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (request_file_class);
+	WebKitSoupRequestClass *request_class =
+		WEBKIT_SOUP_REQUEST_CLASS (request_file_class);
+
+	g_type_class_add_private (request_file_class, sizeof (WebKitSoupRequestFilePrivate));
+
+	object_class->finalize = webkit_soup_request_file_finalize;
+
+	request_class->check_uri = webkit_soup_request_file_check_uri;
+	request_class->send = webkit_soup_request_file_send;
+	request_class->send_async = webkit_soup_request_file_send_async;
+	request_class->send_finish = webkit_soup_request_file_send_finish;
+	request_class->get_content_length = webkit_soup_request_file_get_content_length;
+	request_class->get_content_type = webkit_soup_request_file_get_content_type;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-request-file.h b/WebCore/platform/network/soup/cache/soup-request-file.h
new file mode 100644
index 0000000..459e82a
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-file.h
@@ -0,0 +1,54 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_REQUEST_FILE_H
+#define WEBKIT_SOUP_REQUEST_FILE_H 1
+
+#include "soup-request.h"
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_REQUEST_FILE            (webkit_soup_request_file_get_type ())
+#define WEBKIT_SOUP_REQUEST_FILE(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFile))
+#define WEBKIT_SOUP_REQUEST_FILE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFileClass))
+#define WEBKIT_IS_SOUP_REQUEST_FILE(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_FILE))
+#define WEBKIT_IS_SOUP_REQUEST_FILE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_FILE))
+#define WEBKIT_SOUP_REQUEST_FILE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_FILE, WebKitSoupRequestFileClass))
+
+typedef struct _WebKitSoupRequestFilePrivate WebKitSoupRequestFilePrivate;
+
+typedef struct {
+	WebKitSoupRequest parent;
+
+	WebKitSoupRequestFilePrivate *priv;
+} WebKitSoupRequestFile;
+
+typedef struct {
+	WebKitSoupRequestClass parent;
+} WebKitSoupRequestFileClass;
+
+GType webkit_soup_request_file_get_type (void);
+
+GFile  *webkit_soup_request_file_get_file (WebKitSoupRequestFile *file);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_REQUEST_FILE_H */
diff --git a/WebCore/platform/network/soup/cache/soup-request-http.c b/WebCore/platform/network/soup/cache/soup-request-http.c
new file mode 100644
index 0000000..f157cfc
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-http.c
@@ -0,0 +1,340 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-request-http.c: http: URI request object
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <glib/gi18n.h>
+
+#include "soup-cache.h"
+#include "soup-cache-private.h"
+#include "soup-http-input-stream.h"
+#include "soup-request-http.h"
+
+G_DEFINE_TYPE (WebKitSoupRequestHTTP, webkit_soup_request_http, WEBKIT_TYPE_SOUP_REQUEST)
+
+struct _WebKitSoupRequestHTTPPrivate {
+	SoupMessage *msg;
+};
+
+/**
+ * webkit_soup_request_http_get_message:
+ * @http: a #WebKitSoupRequestHTTP object
+ *
+ * Gets a new reference to the #SoupMessage associated to this SoupRequest
+ *
+ * Returns: a new reference to the #SoupMessage
+ **/
+SoupMessage *
+webkit_soup_request_http_get_message (WebKitSoupRequestHTTP *http)
+{
+	g_return_val_if_fail (WEBKIT_IS_SOUP_REQUEST_HTTP (http), NULL);
+
+	return g_object_ref (http->priv->msg);
+}
+
+static void
+webkit_soup_request_http_init (WebKitSoupRequestHTTP *http)
+{
+	http->priv = G_TYPE_INSTANCE_GET_PRIVATE (http, WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPPrivate);
+}
+
+static gboolean
+webkit_soup_request_http_check_uri (WebKitSoupRequest  *request,
+				    SoupURI      *uri,
+				    GError      **error)
+{
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
+
+	if (!SOUP_URI_VALID_FOR_HTTP (uri))
+		return FALSE;
+
+	http->priv->msg = soup_message_new_from_uri (SOUP_METHOD_GET, uri);
+	return TRUE;
+}
+
+static void
+webkit_soup_request_http_finalize (GObject *object)
+{
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (object);
+
+	if (http->priv->msg)
+		g_object_unref (http->priv->msg);
+
+	G_OBJECT_CLASS (webkit_soup_request_http_parent_class)->finalize (object);
+}
+
+static GInputStream *
+webkit_soup_request_http_send (WebKitSoupRequest          *request,
+			       GCancellable         *cancellable,
+			       GError              **error)
+{
+	WebKitSoupHTTPInputStream *httpstream;
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
+
+	httpstream = webkit_soup_http_input_stream_new (webkit_soup_request_get_session (request), http->priv->msg);
+	if (!webkit_soup_http_input_stream_send (httpstream, cancellable, error)) {
+		g_object_unref (httpstream);
+		return NULL;
+	}
+	return (GInputStream *)httpstream;
+}
+
+
+static void
+sent_async (GObject *source, GAsyncResult *result, gpointer user_data)
+{
+	WebKitSoupHTTPInputStream *httpstream = WEBKIT_SOUP_HTTP_INPUT_STREAM (source);
+	GSimpleAsyncResult *simple = user_data;
+	GError *error = NULL;
+
+	if (webkit_soup_http_input_stream_send_finish (httpstream, result, &error)) {
+		g_simple_async_result_set_op_res_gpointer (simple, httpstream, g_object_unref);
+	} else {
+		g_simple_async_result_set_from_error (simple, error);
+		g_error_free (error);
+		g_object_unref (httpstream);
+	}
+	g_simple_async_result_complete (simple);
+	g_object_unref (simple);
+}
+
+
+typedef struct {
+	WebKitSoupRequestHTTP *req;
+	SoupMessage *original;
+	GCancellable *cancellable;
+	GAsyncReadyCallback callback;
+	gpointer user_data;
+} ConditionalHelper;
+
+
+static void
+conditional_get_ready_cb (SoupSession *session, SoupMessage *msg, gpointer user_data)
+{
+	ConditionalHelper *helper = (ConditionalHelper *)user_data;
+	GSimpleAsyncResult *simple;
+	WebKitSoupHTTPInputStream *httpstream;
+
+	simple = g_simple_async_result_new (G_OBJECT (helper->req),
+					    helper->callback, helper->user_data,
+					    conditional_get_ready_cb);
+
+	if (msg->status_code == SOUP_STATUS_NOT_MODIFIED) {
+		WebKitSoupCache *cache = (WebKitSoupCache *)soup_session_get_feature (session, WEBKIT_TYPE_SOUP_CACHE);
+
+		httpstream = (WebKitSoupHTTPInputStream *)webkit_soup_cache_send_response (cache, msg);
+		if (httpstream) {
+			const gchar *content_type;
+
+			g_simple_async_result_set_op_res_gpointer (simple, httpstream, g_object_unref);
+
+			soup_message_got_headers (helper->original);
+			content_type = soup_message_headers_get_content_type (msg->response_headers, NULL);
+			soup_message_content_sniffed (helper->original, content_type, NULL);
+
+			g_simple_async_result_complete (simple);
+
+			soup_message_finished (helper->original);
+
+			g_object_unref (simple);
+		} else {
+			/* Ask again for the resource, somehow the cache cannot locate it */
+			httpstream = webkit_soup_http_input_stream_new (session, helper->original);
+			webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
+								  helper->cancellable, sent_async, simple);
+		}
+	} else {
+		/* It is in the cache but it was modified remotely */
+		httpstream = webkit_soup_http_input_stream_new (session, helper->original);
+		webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
+							  helper->cancellable, sent_async, simple);
+	}
+
+	g_object_unref (helper->req);
+	g_object_unref (helper->original);
+	g_slice_free (ConditionalHelper, helper);
+}
+
+typedef struct {
+	WebKitSoupRequestHTTP *http;
+	GAsyncReadyCallback callback;
+	gpointer user_data;
+} SendAsyncHelper;
+
+static void webkit_soup_request_http_send_async (WebKitSoupRequest          *request,
+						 GCancellable         *cancellable,
+						 GAsyncReadyCallback callback,
+						 gpointer user_data);
+
+static gboolean
+send_async_cb (gpointer data)
+{
+	GSimpleAsyncResult *simple;
+	WebKitSoupHTTPInputStream *httpstream;
+	SoupSession *session;
+	WebKitSoupCache *cache;
+	SendAsyncHelper *helper = (SendAsyncHelper *)data;
+
+	session = webkit_soup_request_get_session (WEBKIT_SOUP_REQUEST (helper->http));
+	cache = (WebKitSoupCache *)soup_session_get_feature (session, WEBKIT_TYPE_SOUP_CACHE);
+
+	httpstream = (WebKitSoupHTTPInputStream *)webkit_soup_cache_send_response (cache, SOUP_MESSAGE (helper->http->priv->msg));
+
+	if (httpstream) {
+		const gchar *content_type;
+
+		simple = g_simple_async_result_new (G_OBJECT (helper->http),
+						    helper->callback, helper->user_data,
+						    webkit_soup_request_http_send_async);
+		g_simple_async_result_set_op_res_gpointer (simple, httpstream, g_object_unref);
+
+		/* Update message status */
+		soup_message_set_status (helper->http->priv->msg, SOUP_STATUS_OK);
+
+		/* Issue signals  */
+		soup_message_got_headers (helper->http->priv->msg);
+		content_type = soup_message_headers_get_content_type (helper->http->priv->msg->response_headers, NULL);
+		soup_message_content_sniffed (helper->http->priv->msg, content_type, NULL);
+
+		g_simple_async_result_complete (simple);
+
+		soup_message_finished (helper->http->priv->msg);
+
+		g_object_unref (simple);
+	}
+
+	g_slice_free (SendAsyncHelper, helper);
+
+	return FALSE;
+}
+
+static void
+webkit_soup_request_http_send_async (WebKitSoupRequest          *request,
+				     GCancellable         *cancellable,
+				     GAsyncReadyCallback callback,
+				     gpointer user_data)
+{
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
+	WebKitSoupHTTPInputStream *httpstream;
+	GSimpleAsyncResult *simple;
+	SoupSession *session;
+	WebKitSoupCache *cache;
+
+	session = webkit_soup_request_get_session (request);
+	cache = (WebKitSoupCache *)soup_session_get_feature (session, WEBKIT_TYPE_SOUP_CACHE);
+
+	if (cache) {
+		WebKitSoupCacheResponse response;
+
+		response = webkit_soup_cache_has_response (cache, http->priv->msg);
+		if (response == WEBKIT_SOUP_CACHE_RESPONSE_FRESH) {
+			/* Do return the stream asynchronously as in
+			   the other cases. It's not enough to use
+			   g_simple_async_result_complete_in_idle as
+			   the signals must be also emitted
+			   asynchronously */
+			SendAsyncHelper *helper = g_slice_new (SendAsyncHelper);
+			helper->http = http;
+			helper->callback = callback;
+			helper->user_data = user_data;
+			g_timeout_add (0, send_async_cb, helper);
+			return;
+		} else if (response == WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION) {
+			SoupMessage *conditional_msg;
+			ConditionalHelper *helper;
+
+			conditional_msg = webkit_soup_cache_generate_conditional_request (cache, http->priv->msg);
+
+			helper = g_slice_new0 (ConditionalHelper);
+			helper->req = g_object_ref (http);
+			helper->original = g_object_ref (http->priv->msg);
+			helper->cancellable = cancellable;
+			helper->callback = callback;
+			helper->user_data = user_data;
+			soup_session_queue_message (session, conditional_msg,
+						    conditional_get_ready_cb,
+						    helper);
+			return;
+		}
+	}
+
+	simple = g_simple_async_result_new (G_OBJECT (http),
+					    callback, user_data,
+					    webkit_soup_request_http_send_async);
+	httpstream = webkit_soup_http_input_stream_new (webkit_soup_request_get_session (request),
+							http->priv->msg);
+	webkit_soup_http_input_stream_send_async (httpstream, G_PRIORITY_DEFAULT,
+						  cancellable, sent_async, simple);
+}
+
+static GInputStream *
+webkit_soup_request_http_send_finish (WebKitSoupRequest          *request,
+				      GAsyncResult         *result,
+				      GError              **error)
+{
+	GSimpleAsyncResult *simple;
+
+	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (request), webkit_soup_request_http_send_async) || g_simple_async_result_is_valid (result, G_OBJECT (request), conditional_get_ready_cb), NULL);
+
+	simple = G_SIMPLE_ASYNC_RESULT (result);
+	if (g_simple_async_result_propagate_error (simple, error))
+		return NULL;
+	return g_object_ref (g_simple_async_result_get_op_res_gpointer (simple));
+}
+
+static goffset
+webkit_soup_request_http_get_content_length (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
+
+	return soup_message_headers_get_content_length (http->priv->msg->response_headers);
+}
+
+static const char *
+webkit_soup_request_http_get_content_type (WebKitSoupRequest *request)
+{
+	WebKitSoupRequestHTTP *http = WEBKIT_SOUP_REQUEST_HTTP (request);
+
+	return soup_message_headers_get_content_type (http->priv->msg->response_headers, NULL);
+}
+
+static void
+webkit_soup_request_http_class_init (WebKitSoupRequestHTTPClass *request_http_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (request_http_class);
+	WebKitSoupRequestClass *request_class =
+		WEBKIT_SOUP_REQUEST_CLASS (request_http_class);
+
+	g_type_class_add_private (request_http_class, sizeof (WebKitSoupRequestHTTPPrivate));
+
+	object_class->finalize = webkit_soup_request_http_finalize;
+
+	request_class->check_uri = webkit_soup_request_http_check_uri;
+	request_class->send = webkit_soup_request_http_send;
+	request_class->send_async = webkit_soup_request_http_send_async;
+	request_class->send_finish = webkit_soup_request_http_send_finish;
+	request_class->get_content_length = webkit_soup_request_http_get_content_length;
+	request_class->get_content_type = webkit_soup_request_http_get_content_type;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-request-http.h b/WebCore/platform/network/soup/cache/soup-request-http.h
new file mode 100644
index 0000000..a06a821
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request-http.h
@@ -0,0 +1,54 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_REQUEST_HTTP_H
+#define WEBKIT_SOUP_REQUEST_HTTP_H 1
+
+#include "soup-request.h"
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_REQUEST_HTTP            (webkit_soup_request_http_get_type ())
+#define WEBKIT_SOUP_REQUEST_HTTP(object)         (G_TYPE_CHECK_INSTANCE_CAST ((object), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTP))
+#define WEBKIT_SOUP_REQUEST_HTTP_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPClass))
+#define WEBKIT_IS_SOUP_REQUEST_HTTP(object)      (G_TYPE_CHECK_INSTANCE_TYPE ((object), WEBKIT_TYPE_SOUP_REQUEST_HTTP))
+#define WEBKIT_IS_SOUP_REQUEST_HTTP_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST_HTTP))
+#define WEBKIT_SOUP_REQUEST_HTTP_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST_HTTP, WebKitSoupRequestHTTPClass))
+
+typedef struct _WebKitSoupRequestHTTPPrivate WebKitSoupRequestHTTPPrivate;
+
+typedef struct {
+	WebKitSoupRequest parent;
+
+	WebKitSoupRequestHTTPPrivate *priv;
+} WebKitSoupRequestHTTP;
+
+typedef struct {
+	WebKitSoupRequestClass parent;
+} WebKitSoupRequestHTTPClass;
+
+GType webkit_soup_request_http_get_type (void);
+
+SoupMessage  *webkit_soup_request_http_get_message (WebKitSoupRequestHTTP *http);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_REQUEST_HTTP_H */
diff --git a/WebCore/platform/network/soup/cache/soup-request.c b/WebCore/platform/network/soup/cache/soup-request.c
new file mode 100644
index 0000000..46b9f5a
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request.c
@@ -0,0 +1,312 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-request.c: Protocol-independent streaming request interface
+ *
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010, Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include <glib/gi18n.h>
+
+#include "soup-request.h"
+#include "soup-requester.h"
+
+/**
+ * SECTION:soup-request
+ * @short_description: Protocol-independent streaming request interface
+ *
+ * FIXME
+ **/
+
+/**
+ * WebKitSoupRequest:
+ *
+ * FIXME
+ *
+ * Since: 2.30
+ **/
+
+static void webkit_soup_request_initable_interface_init (GInitableIface *initable_interface);
+
+G_DEFINE_TYPE_WITH_CODE (WebKitSoupRequest, webkit_soup_request, G_TYPE_OBJECT,
+			 G_IMPLEMENT_INTERFACE (G_TYPE_INITABLE,
+						webkit_soup_request_initable_interface_init))
+
+enum {
+	PROP_0,
+	PROP_URI,
+	PROP_SESSION
+};
+
+struct _WebKitSoupRequestPrivate {
+	SoupURI *uri;
+	SoupSession *session;
+};
+
+static void
+webkit_soup_request_init (WebKitSoupRequest *request)
+{
+	request->priv = G_TYPE_INSTANCE_GET_PRIVATE (request, WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestPrivate);
+}
+
+static void
+webkit_soup_request_finalize (GObject *object)
+{
+	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
+
+	if (request->priv->uri)
+		soup_uri_free (request->priv->uri);
+	if (request->priv->session)
+		g_object_unref (request->priv->session);
+
+	G_OBJECT_CLASS (webkit_soup_request_parent_class)->finalize (object);
+}
+
+static void
+webkit_soup_request_set_property (GObject      *object,
+				  guint prop_id,
+				  const GValue *value,
+				  GParamSpec   *pspec)
+{
+	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
+
+	switch (prop_id) {
+	case PROP_URI:
+		if (request->priv->uri)
+			soup_uri_free (request->priv->uri);
+		request->priv->uri = g_value_dup_boxed (value);
+		break;
+	case PROP_SESSION:
+		if (request->priv->session)
+			g_object_unref (request->priv->session);
+		request->priv->session = g_value_dup_object (value);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+webkit_soup_request_get_property (GObject    *object,
+				  guint prop_id,
+				  GValue     *value,
+				  GParamSpec *pspec)
+{
+	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (object);
+
+	switch (prop_id) {
+	case PROP_URI:
+		g_value_set_boxed (value, request->priv->uri);
+		break;
+	case PROP_SESSION:
+		g_value_set_object (value, request->priv->session);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static gboolean
+webkit_soup_request_initable_init (GInitable     *initable,
+				   GCancellable  *cancellable,
+				   GError       **error)
+{
+	WebKitSoupRequest *request = WEBKIT_SOUP_REQUEST (initable);
+	gboolean ok;
+
+	if (!request->priv->uri) {
+		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
+			     _ ("No URI provided"));
+		return FALSE;
+	}
+
+	ok = WEBKIT_SOUP_REQUEST_GET_CLASS (initable)->
+		check_uri (request, request->priv->uri, error);
+
+	if (!ok && error) {
+		char *uri_string = soup_uri_to_string (request->priv->uri, FALSE);
+		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
+			     _ ("Invalid '%s' URI: %s"),
+			     request->priv->uri->scheme,
+			     uri_string);
+		g_free (uri_string);
+	}
+
+	return ok;
+}
+
+static gboolean
+webkit_soup_request_default_check_uri (WebKitSoupRequest  *request,
+				       SoupURI      *uri,
+				       GError      **error)
+{
+	return TRUE;
+}
+
+/* Default implementation: assume the sync implementation doesn't block */
+static void
+webkit_soup_request_default_send_async (WebKitSoupRequest          *request,
+					GCancellable         *cancellable,
+					GAsyncReadyCallback callback,
+					gpointer user_data)
+{
+	GSimpleAsyncResult *simple;
+
+	simple = g_simple_async_result_new (G_OBJECT (request),
+					    callback, user_data,
+					    webkit_soup_request_default_send_async);
+	g_simple_async_result_complete_in_idle (simple);
+	g_object_unref (simple);
+}
+
+static GInputStream *
+webkit_soup_request_default_send_finish (WebKitSoupRequest          *request,
+					 GAsyncResult         *result,
+					 GError              **error)
+{
+	g_return_val_if_fail (g_simple_async_result_is_valid (result, G_OBJECT (request), webkit_soup_request_default_send_async), NULL);
+
+	return webkit_soup_request_send (request, NULL, error);
+}
+
+GInputStream *
+webkit_soup_request_send (WebKitSoupRequest          *request,
+			  GCancellable         *cancellable,
+			  GError              **error)
+{
+	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
+		send (request, cancellable, error);
+}
+
+void
+webkit_soup_request_send_async (WebKitSoupRequest          *request,
+				GCancellable         *cancellable,
+				GAsyncReadyCallback callback,
+				gpointer user_data)
+{
+	WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
+		send_async (request, cancellable, callback, user_data);
+}
+
+GInputStream *
+webkit_soup_request_send_finish (WebKitSoupRequest          *request,
+				 GAsyncResult         *result,
+				 GError              **error)
+{
+	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->
+		send_finish (request, result, error);
+}
+
+static void
+webkit_soup_request_class_init (WebKitSoupRequestClass *request_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (request_class);
+
+	g_type_class_add_private (request_class, sizeof (WebKitSoupRequestPrivate));
+
+	request_class->check_uri = webkit_soup_request_default_check_uri;
+	request_class->send_async = webkit_soup_request_default_send_async;
+	request_class->send_finish = webkit_soup_request_default_send_finish;
+
+	object_class->finalize = webkit_soup_request_finalize;
+	object_class->set_property = webkit_soup_request_set_property;
+	object_class->get_property = webkit_soup_request_get_property;
+
+	g_object_class_install_property (
+		 object_class, PROP_URI,
+		 g_param_spec_boxed (WEBKIT_SOUP_REQUEST_URI,
+				     "URI",
+				     "The request URI",
+				     SOUP_TYPE_URI,
+				     G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+	g_object_class_install_property (
+		 object_class, PROP_SESSION,
+		 g_param_spec_object (WEBKIT_SOUP_REQUEST_SESSION,
+				      "Session",
+				      "The request's session",
+				      SOUP_TYPE_SESSION,
+				      G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+}
+
+static void
+webkit_soup_request_initable_interface_init (GInitableIface *initable_interface)
+{
+	initable_interface->init = webkit_soup_request_initable_init;
+}
+
+SoupURI *
+webkit_soup_request_get_uri (WebKitSoupRequest *request)
+{
+	return request->priv->uri;
+}
+
+SoupSession *
+webkit_soup_request_get_session (WebKitSoupRequest *request)
+{
+	return request->priv->session;
+}
+
+goffset
+webkit_soup_request_get_content_length (WebKitSoupRequest *request)
+{
+	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->get_content_length (request);
+}
+
+const char *
+webkit_soup_request_get_content_type (WebKitSoupRequest  *request)
+{
+	return WEBKIT_SOUP_REQUEST_GET_CLASS (request)->get_content_type (request);
+}
+
+#define XDIGIT(c) ((c) <= '9' ? (c) - '0' : ((c) & 0x4F) - 'A' + 10)
+#define HEXCHAR(s) ((XDIGIT (s[1]) << 4) + XDIGIT (s[2]))
+
+/* Copy&pasted from libsoup's soup-uri.c after applying the patch in
+ * https://bugzilla.gnome.org/show_bug.cgi?id=630540. We need this
+ * instead of soup_uri_decode() as it incorrectly returns NULL for
+ * incorrectly encoded URLs. TODO: remove this when required libsoup
+ * version is bumped out to 2.32.1
+ */
+gchar *
+webkit_soup_request_uri_decoded_copy (const char *part, int length)
+{
+	unsigned char *s, *d;
+        char *decoded = g_strndup (part, length);
+
+        s = d = (unsigned char *)decoded;
+        do {
+                if (*s == '%') {
+                        if (!g_ascii_isxdigit (s[1]) ||
+                            !g_ascii_isxdigit (s[2])) {
+                                *d++ = *s;
+                                continue;
+                        }
+                        *d++ = HEXCHAR (s);
+                        s += 2;
+                } else
+                        *d++ = *s;
+        } while (*s++);
+
+        return decoded;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-request.h b/WebCore/platform/network/soup/cache/soup-request.h
new file mode 100644
index 0000000..837d8f4
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-request.h
@@ -0,0 +1,100 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2009 Red Hat, Inc.
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_REQUEST_H
+#define WEBKIT_SOUP_REQUEST_H 1
+
+#include <libsoup/soup.h>
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_REQUEST            (webkit_soup_request_get_type ())
+#define WEBKIT_SOUP_REQUEST(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequest))
+#define WEBKIT_SOUP_REQUEST_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestClass))
+#define WEBKIT_IS_SOUP_REQUEST(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUEST))
+#define WEBKIT_IS_SOUP_REQUEST_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((klass), WEBKIT_TYPE_SOUP_REQUEST))
+#define WEBKIT_SOUP_REQUEST_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUEST, WebKitSoupRequestClass))
+
+typedef struct _WebKitSoupRequest WebKitSoupRequest;
+typedef struct _WebKitSoupRequestPrivate WebKitSoupRequestPrivate;
+typedef struct _WebKitSoupRequestClass WebKitSoupRequestClass;
+
+struct _WebKitSoupRequest {
+	GObject parent;
+
+	WebKitSoupRequestPrivate *priv;
+};
+
+struct _WebKitSoupRequestClass {
+	GObjectClass parent;
+
+	gboolean (*check_uri)(WebKitSoupRequest          *req_base,
+			      SoupURI              *uri,
+			      GError              **error);
+
+	GInputStream * (*send)(WebKitSoupRequest          *request,
+			       GCancellable         *cancellable,
+			       GError              **error);
+	void (*send_async)(WebKitSoupRequest          *request,
+			   GCancellable         *cancellable,
+			   GAsyncReadyCallback callback,
+			   gpointer user_data);
+	GInputStream * (*send_finish)(WebKitSoupRequest          *request,
+				      GAsyncResult         *result,
+				      GError              **error);
+
+	goffset (*get_content_length)(WebKitSoupRequest   *request);
+	const char *   (*get_content_type)(WebKitSoupRequest   *request);
+};
+
+GType webkit_soup_request_get_type (void);
+
+#define WEBKIT_SOUP_REQUEST_URI     "uri"
+#define WEBKIT_SOUP_REQUEST_SESSION "session"
+
+GInputStream *webkit_soup_request_send (WebKitSoupRequest          *request,
+					GCancellable         *cancellable,
+					GError              **error);
+void          webkit_soup_request_send_async (WebKitSoupRequest          *request,
+					      GCancellable         *cancellable,
+					      GAsyncReadyCallback callback,
+					      gpointer user_data);
+GInputStream *webkit_soup_request_send_finish (WebKitSoupRequest          *request,
+					       GAsyncResult         *result,
+					       GError              **error);
+
+SoupURI      *webkit_soup_request_get_uri (WebKitSoupRequest          *request);
+SoupSession  *webkit_soup_request_get_session (WebKitSoupRequest          *request);
+
+goffset       webkit_soup_request_get_content_length (WebKitSoupRequest          *request);
+const char   *webkit_soup_request_get_content_type (WebKitSoupRequest          *request);
+
+/* Used by WebKitSoupRequestFile and WebKitSoupRequestData. Ideally
+ * should be located in some util file but I'll place it here as it
+ * will be removed with libsoup 2.32.1 that will ship fixed versions
+ * of soup_uri_decode/normalize
+ */
+gchar *webkit_soup_request_uri_decoded_copy (const char *part, int length);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_REQUEST_H */
diff --git a/WebCore/platform/network/soup/cache/soup-requester.c b/WebCore/platform/network/soup/cache/soup-requester.c
new file mode 100644
index 0000000..4d8a860
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-requester.c
@@ -0,0 +1,188 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-requester.c:
+ *
+ * Copyright (C) 2010, Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+#include "soup-requester.h"
+
+#include "soup-request-data.h"
+#include "soup-request-file.h"
+#include "soup-request-http.h"
+#include <glib/gi18n.h>
+#include <libsoup/soup.h>
+
+struct _WebKitSoupRequesterPrivate {
+	GHashTable *request_types;
+};
+
+#define WEBKIT_SOUP_REQUESTER_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterPrivate))
+
+G_DEFINE_TYPE (WebKitSoupRequester, webkit_soup_requester, G_TYPE_OBJECT)
+
+static void webkit_soup_requester_init (WebKitSoupRequester *requester)
+{
+	requester->priv = WEBKIT_SOUP_REQUESTER_GET_PRIVATE (requester);
+
+	requester->priv->request_types = 0;
+}
+
+static void finalize (GObject *object)
+{
+	WebKitSoupRequester *requester = WEBKIT_SOUP_REQUESTER (object);
+
+	if (requester->priv->request_types)
+		g_hash_table_destroy (requester->priv->request_types);
+
+	G_OBJECT_CLASS (webkit_soup_requester_parent_class)->finalize (object);
+}
+
+static void webkit_soup_requester_class_init (WebKitSoupRequesterClass *requester_class)
+{
+	GObjectClass *object_class = G_OBJECT_CLASS (requester_class);
+
+	g_type_class_add_private (requester_class, sizeof (WebKitSoupRequesterPrivate));
+
+	/* virtual method override */
+	object_class->finalize = finalize;
+}
+
+static void init_request_types (WebKitSoupRequesterPrivate *priv)
+{
+	if (priv->request_types)
+		return;
+
+	priv->request_types = g_hash_table_new_full (soup_str_case_hash,
+						     soup_str_case_equal,
+						     g_free, 0);
+	g_hash_table_insert (priv->request_types, g_strdup ("file"),
+			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_FILE));
+	g_hash_table_insert (priv->request_types, g_strdup ("data"),
+			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_DATA));
+	g_hash_table_insert (priv->request_types, g_strdup ("http"),
+			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_HTTP));
+	g_hash_table_insert (priv->request_types, g_strdup ("https"),
+			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_HTTP));
+	g_hash_table_insert (priv->request_types, g_strdup ("ftp"),
+			     GSIZE_TO_POINTER (WEBKIT_TYPE_SOUP_REQUEST_FILE));
+}
+
+WebKitSoupRequester *webkit_soup_requester_new (void)
+{
+	return (WebKitSoupRequester *)g_object_new (WEBKIT_TYPE_SOUP_REQUESTER, NULL);
+}
+
+WebKitSoupRequest *webkit_soup_requester_request (WebKitSoupRequester *requester, const char *uriString, SoupSession *session, GError **error)
+{
+	SoupURI *uri = NULL;
+	WebKitSoupRequest *req;
+
+	uri = soup_uri_new (uriString);
+	if (!uri) {
+		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_BAD_URI,
+			     _ ("Could not parse URI '%s'"), uriString);
+		return 0;
+	}
+
+	req = webkit_soup_requester_request_uri (requester, uri, session, error);
+	soup_uri_free (uri);
+	return req;
+}
+
+WebKitSoupRequest *webkit_soup_requester_request_uri (WebKitSoupRequester *requester, SoupURI *uri, SoupSession *session, GError **error)
+{
+	GType requestType;
+
+	g_return_val_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester), 0);
+
+	init_request_types (requester->priv);
+	requestType = (GType)GPOINTER_TO_SIZE (g_hash_table_lookup (requester->priv->request_types, uri->scheme));
+	if (!requestType) {
+		g_set_error (error, WEBKIT_SOUP_ERROR, WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME,
+			     _ ("Unsupported URI scheme '%s'"), uri->scheme);
+		return 0;
+	}
+
+	if (g_type_is_a (requestType, G_TYPE_INITABLE)) {
+		return (WebKitSoupRequest *)g_initable_new (requestType, 0, error,
+							    "uri", uri,
+							    "session", session,
+							    NULL);
+	} else {
+		return (WebKitSoupRequest *)g_object_new (requestType,
+							  "uri", uri,
+							  "session", session,
+							  NULL);
+	}
+}
+
+/* RFC 2396, 3.1 */
+static gboolean
+soup_scheme_is_valid (const char *scheme)
+{
+	if (scheme == NULL ||
+	    !g_ascii_isalpha (*scheme))
+		return FALSE;
+
+	scheme++;
+	while (*scheme) {
+		if (!g_ascii_isalpha (*scheme) &&
+		    !g_ascii_isdigit (*scheme) &&
+		    *scheme != '+' &&
+		    *scheme != '-' &&
+		    *scheme != '.')
+			return FALSE;
+		scheme++;
+	}
+	return TRUE;
+}
+
+void
+webkit_soup_requester_add_protocol (WebKitSoupRequester *requester,
+				    const char  *scheme,
+				    GType request_type)
+{
+	g_return_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester));
+	g_return_if_fail (soup_scheme_is_valid (scheme));
+
+	init_request_types (requester->priv);
+	g_hash_table_insert (requester->priv->request_types, g_strdup (scheme),
+			     GSIZE_TO_POINTER (request_type));
+}
+
+void
+webkit_soup_requester_remove_protocol (WebKitSoupRequester *requester,
+				       const char  *scheme)
+{
+	g_return_if_fail (WEBKIT_IS_SOUP_REQUESTER (requester));
+	g_return_if_fail (soup_scheme_is_valid (scheme));
+
+	init_request_types (requester->priv);
+	g_hash_table_remove (requester->priv->request_types, scheme);
+}
+
+GQuark
+webkit_soup_error_quark (void)
+{
+	static GQuark error;
+	if (!error)
+		error = g_quark_from_static_string ("webkit_soup_error_quark");
+	return error;
+}
diff --git a/WebCore/platform/network/soup/cache/soup-requester.h b/WebCore/platform/network/soup/cache/soup-requester.h
new file mode 100644
index 0000000..71ff103
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/soup-requester.h
@@ -0,0 +1,81 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * Copyright (C) 2010 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_REQUESTER_H
+#define WEBKIT_SOUP_REQUESTER_H 1
+
+#include "soup-request.h"
+#include <libsoup/soup.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_REQUESTER            (webkit_soup_requester_get_type ())
+#define WEBKIT_SOUP_REQUESTER(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequester))
+#define WEBKIT_SOUP_REQUESTER_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterClass))
+#define WEBKIT_IS_SOUP_REQUESTER(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUESTER))
+#define WEBKIT_IS_SOUP_REQUESTER_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_REQUESTER))
+#define WEBKIT_SOUP_REQUESTER_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_REQUESTER, WebKitSoupRequesterClass))
+
+#define WEBKIT_SOUP_ERROR webkit_soup_error_quark ()
+
+typedef enum {
+	WEBKIT_SOUP_ERROR_BAD_URI,
+	WEBKIT_SOUP_ERROR_UNSUPPORTED_URI_SCHEME
+} WebKitSoupError;
+
+typedef struct _WebKitSoupRequester WebKitSoupRequester;
+typedef struct _WebKitSoupRequesterPrivate WebKitSoupRequesterPrivate;
+
+struct _WebKitSoupRequester {
+	GObject parent;
+
+	WebKitSoupRequesterPrivate *priv;
+};
+
+typedef struct {
+	GObjectClass parent_class;
+} WebKitSoupRequesterClass;
+
+GType webkit_soup_requester_get_type (void);
+
+WebKitSoupRequester *webkit_soup_requester_new (void);
+
+GQuark webkit_soup_error_quark (void);
+
+WebKitSoupRequest *webkit_soup_requester_request (WebKitSoupRequester *requester,
+						  const char *uriString,
+						  SoupSession *session,
+						  GError **error);
+
+WebKitSoupRequest *webkit_soup_requester_request_uri (WebKitSoupRequester *requester,
+						      SoupURI *uri,
+						      SoupSession *session,
+						      GError **error);
+
+void webkit_soup_requester_add_protocol (WebKitSoupRequester *requester,
+					 const char  *scheme,
+					 GType request_type);
+
+void webkit_soup_requester_remove_protocol (WebKitSoupRequester *requester,
+					    const char  *scheme);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_REQUESTER_H */
diff --git a/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h b/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h
new file mode 100644
index 0000000..8af8de2
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/webkit/soup-cache-private.h
@@ -0,0 +1,42 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-cache-private.h:
+ *
+ * Copyright (C) 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_CACHE_PRIVATE_H
+#define WEBKIT_SOUP_CACHE_PRIVATE_H 1
+
+#include "soup-cache.h"
+#include <libsoup/soup-message.h>
+
+G_BEGIN_DECLS
+
+WebKitSoupCacheResponse webkit_soup_cache_has_response (WebKitSoupCache   *cache,
+							SoupMessage *msg);
+GInputStream *webkit_soup_cache_send_response (WebKitSoupCache   *cache,
+					       SoupMessage *msg);
+WebKitSoupCacheability  webkit_soup_cache_get_cacheability (WebKitSoupCache   *cache,
+							    SoupMessage *msg);
+SoupMessage *webkit_soup_cache_generate_conditional_request (WebKitSoupCache   *cache,
+							     SoupMessage *original);
+
+G_END_DECLS
+
+#endif /* WEBKIT_SOUP_CACHE_PRIVATE_H */
diff --git a/WebCore/platform/network/soup/cache/webkit/soup-cache.c b/WebCore/platform/network/soup/cache/webkit/soup-cache.c
new file mode 100644
index 0000000..73b15ba
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/webkit/soup-cache.c
@@ -0,0 +1,1653 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-cache.c
+ *
+ * Copyright (C) 2009, 2010 Igalia S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+/* TODO:
+ * - Need to hook the feature in the sync SoupSession.
+ * - Need more tests.
+ */
+
+#ifdef HAVE_CONFIG_H
+#include <config.h>
+#endif
+
+#include "soup-cache.h"
+#include "soup-cache-private.h"
+#include <libsoup/soup.h>
+#include <gio/gio.h>
+#include <stdlib.h>
+
+static SoupSessionFeatureInterface *webkit_soup_cache_default_feature_interface;
+static void webkit_soup_cache_session_feature_init (SoupSessionFeatureInterface *feature_interface, gpointer interface_data);
+
+#define DEFAULT_MAX_SIZE 50 * 1024 * 1024
+#define MAX_ENTRY_DATA_PERCENTAGE 10 /* Percentage of the total size
+	                                of the cache that can be
+	                                filled by a single entry */
+
+typedef struct _WebKitSoupCacheEntry {
+	char *key;
+	char *filename;
+	guint freshness_lifetime;
+	gboolean must_revalidate;
+	GString *data;
+	gsize pos;
+	gsize length;
+	time_t corrected_initial_age;
+	time_t response_time;
+	gboolean writing;
+	gboolean dirty;
+	gboolean got_body;
+	gboolean being_validated;
+	SoupMessageHeaders *headers;
+	GOutputStream *stream;
+	GError *error;
+	guint hits;
+	GCancellable *cancellable;
+} WebKitSoupCacheEntry;
+
+struct _WebKitSoupCachePrivate {
+	char *cache_dir;
+	GHashTable *cache;
+	guint n_pending;
+	SoupSession *session;
+	WebKitSoupCacheType cache_type;
+	guint size;
+	guint max_size;
+	guint max_entry_data_size; /* Computed value. Here for performance reasons */
+	GList *lru_start;
+};
+
+typedef struct {
+	WebKitSoupCache *cache;
+	WebKitSoupCacheEntry *entry;
+	SoupMessage *msg;
+	gulong got_chunk_handler;
+	gulong got_body_handler;
+	gulong restarted_handler;
+} WebKitSoupCacheWritingFixture;
+
+enum {
+	PROP_0,
+	PROP_CACHE_DIR,
+	PROP_CACHE_TYPE
+};
+
+#define WEBKIT_SOUP_CACHE_GET_PRIVATE(o) (G_TYPE_INSTANCE_GET_PRIVATE ((o), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCachePrivate))
+
+G_DEFINE_TYPE_WITH_CODE (WebKitSoupCache, webkit_soup_cache, G_TYPE_OBJECT,
+			 G_IMPLEMENT_INTERFACE (SOUP_TYPE_SESSION_FEATURE,
+						webkit_soup_cache_session_feature_init))
+
+static gboolean webkit_soup_cache_entry_remove (WebKitSoupCache *cache, WebKitSoupCacheEntry *entry);
+static void make_room_for_new_entry (WebKitSoupCache *cache, guint length_to_add);
+static gboolean cache_accepts_entries_of_size (WebKitSoupCache *cache, guint length_to_add);
+
+static WebKitSoupCacheability
+get_cacheability (WebKitSoupCache *cache, SoupMessage *msg)
+{
+	WebKitSoupCacheability cacheability;
+	const char *cache_control;
+
+	/* 1. The request method must be cacheable */
+	if (msg->method == SOUP_METHOD_GET)
+		cacheability = WEBKIT_SOUP_CACHE_CACHEABLE;
+	else if (msg->method == SOUP_METHOD_HEAD ||
+		 msg->method == SOUP_METHOD_TRACE ||
+		 msg->method == SOUP_METHOD_CONNECT)
+		return WEBKIT_SOUP_CACHE_UNCACHEABLE;
+	else
+		return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
+
+	cache_control = soup_message_headers_get (msg->response_headers, "Cache-Control");
+	if (cache_control) {
+		GHashTable *hash;
+		WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
+
+		hash = soup_header_parse_param_list (cache_control);
+
+		/* Shared caches MUST NOT store private resources */
+		if (priv->cache_type == WEBKIT_SOUP_CACHE_SHARED) {
+			if (g_hash_table_lookup_extended (hash, "private", NULL, NULL)) {
+				soup_header_free_param_list (hash);
+				return WEBKIT_SOUP_CACHE_UNCACHEABLE;
+			}
+		}
+
+		/* 2. The 'no-store' cache directive does not appear in the
+		 * headers
+		 */
+		if (g_hash_table_lookup_extended (hash, "no-store", NULL, NULL)) {
+			soup_header_free_param_list (hash);
+			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
+		}
+
+		/* This does not appear in section 2.1, but I think it makes
+		 * sense to check it too?
+		 */
+		if (g_hash_table_lookup_extended (hash, "no-cache", NULL, NULL)) {
+			soup_header_free_param_list (hash);
+			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
+		}
+	}
+
+	switch (msg->status_code) {
+	case SOUP_STATUS_PARTIAL_CONTENT:
+		/* We don't cache partial responses, but they only
+		 * invalidate cached full responses if the headers
+		 * don't match.
+		 */
+		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
+		break;
+
+	case SOUP_STATUS_NOT_MODIFIED:
+		/* A 304 response validates an existing cache entry */
+		cacheability = WEBKIT_SOUP_CACHE_VALIDATES;
+		break;
+
+	case SOUP_STATUS_MULTIPLE_CHOICES:
+	case SOUP_STATUS_MOVED_PERMANENTLY:
+	case SOUP_STATUS_GONE:
+		/* FIXME: cacheable unless indicated otherwise */
+		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
+		break;
+
+	case SOUP_STATUS_FOUND:
+	case SOUP_STATUS_TEMPORARY_REDIRECT:
+		/* FIXME: cacheable if explicitly indicated */
+		cacheability = WEBKIT_SOUP_CACHE_UNCACHEABLE;
+		break;
+
+	case SOUP_STATUS_SEE_OTHER:
+	case SOUP_STATUS_FORBIDDEN:
+	case SOUP_STATUS_NOT_FOUND:
+	case SOUP_STATUS_METHOD_NOT_ALLOWED:
+		return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
+
+	default:
+		/* Any 5xx status or any 4xx status not handled above
+		 * is uncacheable but doesn't break the cache.
+		 */
+		if ((msg->status_code >= SOUP_STATUS_BAD_REQUEST &&
+		     msg->status_code <= SOUP_STATUS_FAILED_DEPENDENCY) ||
+		    msg->status_code >= SOUP_STATUS_INTERNAL_SERVER_ERROR)
+			return WEBKIT_SOUP_CACHE_UNCACHEABLE;
+
+		/* An unrecognized 2xx, 3xx, or 4xx response breaks
+		 * the cache.
+		 */
+		if ((msg->status_code > SOUP_STATUS_PARTIAL_CONTENT &&
+		     msg->status_code < SOUP_STATUS_MULTIPLE_CHOICES) ||
+		    (msg->status_code > SOUP_STATUS_TEMPORARY_REDIRECT &&
+		     msg->status_code < SOUP_STATUS_INTERNAL_SERVER_ERROR))
+			return (WEBKIT_SOUP_CACHE_UNCACHEABLE | WEBKIT_SOUP_CACHE_INVALIDATES);
+		break;
+	}
+
+	return cacheability;
+}
+
+static void
+webkit_soup_cache_entry_free (WebKitSoupCacheEntry *entry, gboolean purge)
+{
+	if (purge) {
+		GFile *file = g_file_new_for_path (entry->filename);
+		g_file_delete (file, NULL, NULL);
+		g_object_unref (file);
+	}
+
+	g_free (entry->filename);
+	entry->filename = NULL;
+	g_free (entry->key);
+	entry->key = NULL;
+
+	if (entry->headers) {
+		soup_message_headers_free (entry->headers);
+		entry->headers = NULL;
+	}
+
+	if (entry->data) {
+		g_string_free (entry->data, TRUE);
+		entry->data = NULL;
+	}
+	if (entry->error) {
+		g_error_free (entry->error);
+		entry->error = NULL;
+	}
+	if (entry->cancellable) {
+		g_object_unref (entry->cancellable);
+		entry->cancellable = NULL;
+	}
+
+	g_slice_free (WebKitSoupCacheEntry, entry);
+}
+
+static void
+copy_headers (const char *name, const char *value, SoupMessageHeaders *headers)
+{
+	soup_message_headers_append (headers, name, value);
+}
+
+static void
+update_headers (const char *name, const char *value, SoupMessageHeaders *headers)
+{
+	if (soup_message_headers_get (headers, name))
+		soup_message_headers_replace (headers, name, value);
+	else
+		soup_message_headers_append (headers, name, value);
+}
+
+static guint
+webkit_soup_cache_entry_get_current_age (WebKitSoupCacheEntry *entry)
+{
+	time_t now = time (NULL);
+	time_t resident_time;
+
+	resident_time = now - entry->response_time;
+	return entry->corrected_initial_age + resident_time;
+}
+
+static gboolean
+webkit_soup_cache_entry_is_fresh_enough (WebKitSoupCacheEntry *entry, gint min_fresh)
+{
+	guint limit = (min_fresh == -1) ? webkit_soup_cache_entry_get_current_age (entry) : (guint) min_fresh;
+	return entry->freshness_lifetime > limit;
+}
+
+static char *
+soup_message_get_cache_key (SoupMessage *msg)
+{
+	SoupURI *uri = soup_message_get_uri (msg);
+	return soup_uri_to_string (uri, FALSE);
+}
+
+static void
+webkit_soup_cache_entry_set_freshness (WebKitSoupCacheEntry *entry, SoupMessage *msg, WebKitSoupCache *cache)
+{
+	const char *cache_control;
+	const char *expires, *date, *last_modified;
+	GHashTable *hash;
+
+	hash = NULL;
+
+	cache_control = soup_message_headers_get (entry->headers, "Cache-Control");
+	if (cache_control) {
+		const char *max_age, *s_maxage;
+		gint64 freshness_lifetime = 0;
+		WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
+
+		hash = soup_header_parse_param_list (cache_control);
+
+		/* Should we re-validate the entry when it goes stale */
+		entry->must_revalidate = g_hash_table_lookup_extended (hash, "must-revalidate", NULL, NULL);
+
+		/* Section 2.3.1 */
+		if (priv->cache_type == WEBKIT_SOUP_CACHE_SHARED) {
+			s_maxage = g_hash_table_lookup (hash, "s-maxage");
+			if (s_maxage) {
+				freshness_lifetime = g_ascii_strtoll (s_maxage, NULL, 10);
+				if (freshness_lifetime) {
+					/* Implies proxy-revalidate. TODO: is it true? */
+					entry->must_revalidate = TRUE;
+					soup_header_free_param_list (hash);
+					return;
+				}
+			}
+		}
+
+		/* If 'max-age' cache directive is present, use that */
+		max_age = g_hash_table_lookup (hash, "max-age");
+		if (max_age)
+			freshness_lifetime = g_ascii_strtoll (max_age, NULL, 10);
+
+		if (freshness_lifetime) {
+			entry->freshness_lifetime = (guint)MIN (freshness_lifetime, G_MAXUINT32);
+			soup_header_free_param_list (hash);
+			return;
+		}
+	}
+
+	if (hash != NULL)
+		soup_header_free_param_list (hash);
+
+	/* If the 'Expires' response header is present, use its value
+	 * minus the value of the 'Date' response header
+	 */
+	expires = soup_message_headers_get (entry->headers, "Expires");
+	date = soup_message_headers_get (entry->headers, "Date");
+	if (expires && date) {
+		SoupDate *expires_d, *date_d;
+		time_t expires_t, date_t;
+
+		expires_d = soup_date_new_from_string (expires);
+		if (expires_d) {
+			date_d = soup_date_new_from_string (date);
+
+			expires_t = soup_date_to_time_t (expires_d);
+			date_t = soup_date_to_time_t (date_d);
+
+			soup_date_free (expires_d);
+			soup_date_free (date_d);
+
+			if (expires_t && date_t) {
+				entry->freshness_lifetime = (guint)MAX (expires_t - date_t, 0);
+				return;
+			}
+		} else {
+			/* If Expires is not a valid date we should
+			   treat it as already expired, see section
+			   3.3 */
+			entry->freshness_lifetime = 0;
+			return;
+		}
+	}
+
+	/* Otherwise an heuristic may be used */
+
+	/* Heuristics MUST NOT be used with these status codes
+	   (section 2.3.1.1) */
+	if (msg->status_code != SOUP_STATUS_OK &&
+	    msg->status_code != SOUP_STATUS_NON_AUTHORITATIVE &&
+	    msg->status_code != SOUP_STATUS_PARTIAL_CONTENT &&
+	    msg->status_code != SOUP_STATUS_MULTIPLE_CHOICES &&
+	    msg->status_code != SOUP_STATUS_MOVED_PERMANENTLY &&
+	    msg->status_code != SOUP_STATUS_GONE)
+		goto expire;
+
+	/* TODO: attach warning 113 if response's current_age is more
+	   than 24h (section 2.3.1.1) when using heuristics */
+
+	/* Last-Modified based heuristic */
+	last_modified = soup_message_headers_get (entry->headers, "Last-Modified");
+	if (last_modified) {
+		SoupDate *soup_date;
+		time_t now, last_modified_t;
+
+		soup_date = soup_date_new_from_string (last_modified);
+		last_modified_t = soup_date_to_time_t (soup_date);
+		now = time (NULL);
+
+#define HEURISTIC_FACTOR 0.1 /* From Section 2.3.1.1 */
+
+		entry->freshness_lifetime = MAX (0, (now - last_modified_t) * HEURISTIC_FACTOR);
+		soup_date_free (soup_date);
+	}
+
+	return;
+
+ expire:
+	/* If all else fails, make the entry expire immediately */
+	entry->freshness_lifetime = 0;
+}
+
+static WebKitSoupCacheEntry *
+webkit_soup_cache_entry_new (WebKitSoupCache *cache, SoupMessage *msg, time_t request_time, time_t response_time)
+{
+	WebKitSoupCacheEntry *entry;
+	SoupMessageHeaders *headers;
+	const char *date;
+	char *md5;
+
+	entry = g_slice_new0 (WebKitSoupCacheEntry);
+	entry->dirty = FALSE;
+	entry->writing = FALSE;
+	entry->got_body = FALSE;
+	entry->being_validated = FALSE;
+	entry->data = g_string_new (NULL);
+	entry->pos = 0;
+	entry->error = NULL;
+
+	/* key & filename */
+	entry->key = soup_message_get_cache_key (msg);
+	md5 = g_compute_checksum_for_string (G_CHECKSUM_MD5, entry->key, -1);
+	entry->filename = g_build_filename (cache->priv->cache_dir, md5, NULL);
+	g_free (md5);
+
+	/* Headers */
+	headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_RESPONSE);
+	soup_message_headers_foreach (msg->response_headers,
+				      (SoupMessageHeadersForeachFunc)copy_headers,
+				      headers);
+	entry->headers = headers;
+
+	/* LRU list */
+	entry->hits = 0;
+
+	/* Section 2.3.1, Freshness Lifetime */
+	webkit_soup_cache_entry_set_freshness (entry, msg, cache);
+
+	/* Section 2.3.2, Calculating Age */
+	date = soup_message_headers_get (entry->headers, "Date");
+
+	if (date) {
+		SoupDate *soup_date;
+		const char *age;
+		time_t date_value, apparent_age, corrected_received_age, response_delay, age_value = 0;
+
+		soup_date = soup_date_new_from_string (date);
+		date_value = soup_date_to_time_t (soup_date);
+		soup_date_free (soup_date);
+
+		age = soup_message_headers_get (entry->headers, "Age");
+		if (age)
+			age_value = g_ascii_strtoll (age, NULL, 10);
+
+		entry->response_time = response_time;
+		apparent_age = MAX (0, entry->response_time - date_value);
+		corrected_received_age = MAX (apparent_age, age_value);
+		response_delay = entry->response_time - request_time;
+		entry->corrected_initial_age = corrected_received_age + response_delay;
+	} else {
+		/* Is this correct ? */
+		entry->corrected_initial_age = time (NULL);
+	}
+
+	return entry;
+}
+
+static void
+webkit_soup_cache_writing_fixture_free (WebKitSoupCacheWritingFixture *fixture)
+{
+	/* Free fixture. And disconnect signals, we don't want to
+	   listen to more SoupMessage events as we're finished with
+	   this resource */
+	if (g_signal_handler_is_connected (fixture->msg, fixture->got_chunk_handler))
+		g_signal_handler_disconnect (fixture->msg, fixture->got_chunk_handler);
+	if (g_signal_handler_is_connected (fixture->msg, fixture->got_body_handler))
+		g_signal_handler_disconnect (fixture->msg, fixture->got_body_handler);
+	if (g_signal_handler_is_connected (fixture->msg, fixture->restarted_handler))
+		g_signal_handler_disconnect (fixture->msg, fixture->restarted_handler);
+	g_object_unref (fixture->msg);
+	g_object_unref (fixture->cache);
+	g_slice_free (WebKitSoupCacheWritingFixture, fixture);
+}
+
+static void
+close_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
+{
+	WebKitSoupCacheEntry *entry = fixture->entry;
+	WebKitSoupCache *cache = fixture->cache;
+	GOutputStream *stream = G_OUTPUT_STREAM (source);
+	goffset content_length;
+
+	g_warn_if_fail (entry->error == NULL);
+
+	/* FIXME: what do we do on error ? */
+
+	if (stream) {
+		g_output_stream_close_finish (stream, result, NULL);
+		g_object_unref (stream);
+	}
+	entry->stream = NULL;
+
+	content_length = soup_message_headers_get_content_length (entry->headers);
+
+	/* If the process was cancelled, then delete the entry from
+	   the cache. Do it also if the size of a chunked resource is
+	   too much for the cache */
+	if (g_cancellable_is_cancelled (entry->cancellable)) {
+		entry->dirty = FALSE;
+		webkit_soup_cache_entry_remove (cache, entry);
+		webkit_soup_cache_entry_free (entry, TRUE);
+		entry = NULL;
+	} else if ((soup_message_headers_get_encoding (entry->headers) == SOUP_ENCODING_CHUNKED) ||
+		   entry->length != (gsize) content_length) {
+		/** Two options here:
+		 *
+		 * 1. "chunked" data, entry was temporarily added to
+		 * cache (as content-length is 0) and now that we have
+		 * the actual size we have to evaluate if we want it
+		 * in the cache or not
+		 *
+		 * 2. Content-Length has a different value than actual
+		 * length, means that the content was encoded for
+		 * transmission (typically compressed) and thus we
+		 * have to substract the content-length value that was
+		 * added to the cache and add the unencoded length
+		 **/
+		gint length_to_add = entry->length - content_length;
+
+		/* Make room in cache if needed */
+		if (cache_accepts_entries_of_size (cache, length_to_add)) {
+			make_room_for_new_entry (cache, length_to_add);
+
+			cache->priv->size += length_to_add;
+		} else {
+			entry->dirty = FALSE;
+			webkit_soup_cache_entry_remove (cache, entry);
+			webkit_soup_cache_entry_free (entry, TRUE);
+			entry = NULL;
+		}
+	}
+
+	if (entry) {
+		/* Get rid of the GString in memory for the resource now */
+		if (entry->data) {
+			g_string_free (entry->data, TRUE);
+			entry->data = NULL;
+		}
+
+		entry->dirty = FALSE;
+		entry->writing = FALSE;
+		entry->got_body = FALSE;
+		entry->pos = 0;
+
+		g_object_unref (entry->cancellable);
+		entry->cancellable = NULL;
+	}
+
+	cache->priv->n_pending--;
+
+	/* Frees */
+	webkit_soup_cache_writing_fixture_free (fixture);
+}
+
+static void
+write_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
+{
+	GOutputStream *stream = G_OUTPUT_STREAM (source);
+	GError *error = NULL;
+	gssize write_size;
+	WebKitSoupCacheEntry *entry = fixture->entry;
+
+	if (g_cancellable_is_cancelled (entry->cancellable)) {
+		g_output_stream_close_async (stream,
+					     G_PRIORITY_LOW,
+					     entry->cancellable,
+					     (GAsyncReadyCallback)close_ready_cb,
+					     fixture);
+		return;
+	}
+
+	write_size = g_output_stream_write_finish (stream, result, &error);
+	if (write_size <= 0 || error) {
+		if (error)
+			entry->error = error;
+		g_output_stream_close_async (stream,
+					     G_PRIORITY_LOW,
+					     entry->cancellable,
+					     (GAsyncReadyCallback)close_ready_cb,
+					     fixture);
+		/* FIXME: We should completely stop caching the
+		   resource at this point */
+	} else {
+		entry->pos += write_size;
+
+		/* Are we still writing and is there new data to write
+		   already ? */
+		if (entry->data && entry->pos < entry->data->len) {
+			g_output_stream_write_async (entry->stream,
+						     entry->data->str + entry->pos,
+						     entry->data->len - entry->pos,
+						     G_PRIORITY_LOW,
+						     entry->cancellable,
+						     (GAsyncReadyCallback)write_ready_cb,
+						     fixture);
+		} else {
+			entry->writing = FALSE;
+
+			if (entry->got_body) {
+				/* If we already received 'got-body'
+				   and we have written all the data,
+				   we can close the stream */
+				g_output_stream_close_async (entry->stream,
+							     G_PRIORITY_LOW,
+							     entry->cancellable,
+							     (GAsyncReadyCallback)close_ready_cb,
+							     fixture);
+			}
+		}
+	}
+}
+
+static void
+msg_got_chunk_cb (SoupMessage *msg, SoupBuffer *chunk, WebKitSoupCacheWritingFixture *fixture)
+{
+	WebKitSoupCacheEntry *entry = fixture->entry;
+
+	g_return_if_fail (chunk->data && chunk->length);
+	g_return_if_fail (entry);
+
+	/* Ignore this if the writing or appending was cancelled */
+	if (!g_cancellable_is_cancelled (entry->cancellable)) {
+		g_string_append_len (entry->data, chunk->data, chunk->length);
+		entry->length = entry->data->len;
+
+		if (!cache_accepts_entries_of_size (fixture->cache, entry->length)) {
+			/* Quickly cancel the caching of the resource */
+			g_cancellable_cancel (entry->cancellable);
+		}
+	}
+
+	/* FIXME: remove the error check when we cancel the caching at
+	   the first write error */
+	/* Only write if the entry stream is ready */
+	if (entry->writing == FALSE && entry->error == NULL && entry->stream) {
+		GString *data = entry->data;
+		entry->writing = TRUE;
+		g_output_stream_write_async (entry->stream,
+					     data->str + entry->pos,
+					     data->len - entry->pos,
+					     G_PRIORITY_LOW,
+					     entry->cancellable,
+					     (GAsyncReadyCallback)write_ready_cb,
+					     fixture);
+	}
+}
+
+static void
+msg_got_body_cb (SoupMessage *msg, WebKitSoupCacheWritingFixture *fixture)
+{
+	WebKitSoupCacheEntry *entry = fixture->entry;
+	g_return_if_fail (entry);
+
+	entry->got_body = TRUE;
+
+	if (!entry->stream && entry->pos != entry->length)
+		/* The stream is not ready to be written but we still
+		   have data to write, we'll write it when the stream
+		   is opened for writing */
+		return;
+
+
+	if (entry->pos != entry->length) {
+		/* If we still have data to write, write it,
+		   write_ready_cb will close the stream */
+		if (entry->writing == FALSE && entry->error == NULL && entry->stream) {
+			g_output_stream_write_async (entry->stream,
+						     entry->data->str + entry->pos,
+						     entry->data->len - entry->pos,
+						     G_PRIORITY_LOW,
+						     entry->cancellable,
+						     (GAsyncReadyCallback)write_ready_cb,
+						     fixture);
+		}
+		return;
+	}
+
+	if (entry->stream && !entry->writing)
+		g_output_stream_close_async (entry->stream,
+					     G_PRIORITY_LOW,
+					     entry->cancellable,
+					     (GAsyncReadyCallback)close_ready_cb,
+					     fixture);
+}
+
+static gboolean
+webkit_soup_cache_entry_remove (WebKitSoupCache *cache, WebKitSoupCacheEntry *entry)
+{
+	GList *lru_item;
+
+	/* if (entry->dirty && !g_cancellable_is_cancelled (entry->cancellable)) { */
+	if (entry->dirty) {
+		g_cancellable_cancel (entry->cancellable);
+		return FALSE;
+	}
+
+	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
+
+	/* Remove from cache */
+	if (!g_hash_table_remove (cache->priv->cache, entry->key))
+		return FALSE;
+
+	/* Remove from LRU */
+	lru_item = g_list_find (cache->priv->lru_start, entry);
+	cache->priv->lru_start = g_list_delete_link (cache->priv->lru_start, lru_item);
+
+	/* Adjust cache size */
+	cache->priv->size -= entry->length;
+
+	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
+
+	return TRUE;
+}
+
+static gint
+lru_compare_func (gconstpointer a, gconstpointer b)
+{
+	WebKitSoupCacheEntry *entry_a = (WebKitSoupCacheEntry *)a;
+	WebKitSoupCacheEntry *entry_b = (WebKitSoupCacheEntry *)b;
+
+	/** The rationale of this sorting func is
+	 *
+	 * 1. sort by hits -> LRU algorithm, then
+	 *
+	 * 2. sort by freshness lifetime, we better discard first
+	 * entries that are close to expire
+	 *
+	 * 3. sort by size, replace first small size resources as they
+	 * are cheaper to download
+	 **/
+
+	/* Sort by hits */
+	if (entry_a->hits != entry_b->hits)
+		return entry_a->hits - entry_b->hits;
+
+	/* Sort by freshness_lifetime */
+	if (entry_a->freshness_lifetime != entry_b->freshness_lifetime)
+		return entry_a->freshness_lifetime - entry_b->freshness_lifetime;
+
+	/* Sort by size */
+	return entry_a->length - entry_b->length;
+}
+
+static gboolean
+cache_accepts_entries_of_size (WebKitSoupCache *cache, guint length_to_add)
+{
+	/* We could add here some more heuristics. TODO: review how
+	   this is done by other HTTP caches */
+
+	return length_to_add <= cache->priv->max_entry_data_size;
+}
+
+static void
+make_room_for_new_entry (WebKitSoupCache *cache, guint length_to_add)
+{
+	GList *lru_entry = cache->priv->lru_start;
+
+	/* Check that there is enough room for the new entry. This is
+	   an approximation as we're not working out the size of the
+	   cache file or the size of the headers for performance
+	   reasons. TODO: check if that would be really that expensive */
+
+	while (lru_entry &&
+	       (length_to_add + cache->priv->size > cache->priv->max_size)) {
+		WebKitSoupCacheEntry *old_entry = (WebKitSoupCacheEntry *)lru_entry->data;
+
+		/* Discard entries. Once cancelled resources will be
+		 * freed in close_ready_cb
+		 */
+		if (webkit_soup_cache_entry_remove (cache, old_entry)) {
+			webkit_soup_cache_entry_free (old_entry, TRUE);
+			lru_entry = cache->priv->lru_start;
+		} else
+			lru_entry = g_list_next (lru_entry);
+	}
+}
+
+static gboolean
+webkit_soup_cache_entry_insert_by_key (WebKitSoupCache *cache,
+				       const char *key,
+				       WebKitSoupCacheEntry *entry,
+				       gboolean sort)
+{
+	guint length_to_add = 0;
+
+	if (soup_message_headers_get_encoding (entry->headers) != SOUP_ENCODING_CHUNKED)
+		length_to_add = soup_message_headers_get_content_length (entry->headers);
+
+	/* Check if we are going to store the resource depending on its size */
+	if (length_to_add) {
+		if (!cache_accepts_entries_of_size (cache, length_to_add))
+			return FALSE;
+
+		/* Make room for new entry if needed */
+		make_room_for_new_entry (cache, length_to_add);
+	}
+
+	g_hash_table_insert (cache->priv->cache, g_strdup (key), entry);
+
+	/* Compute new cache size */
+	cache->priv->size += length_to_add;
+
+	/* Update LRU */
+	if (sort)
+		cache->priv->lru_start = g_list_insert_sorted (cache->priv->lru_start, entry, lru_compare_func);
+	else
+		cache->priv->lru_start = g_list_prepend (cache->priv->lru_start, entry);
+
+	g_assert (g_list_length (cache->priv->lru_start) == g_hash_table_size (cache->priv->cache));
+
+	return TRUE;
+}
+
+static void
+msg_restarted_cb (SoupMessage *msg, WebKitSoupCacheEntry *entry)
+{
+	/* FIXME: What should we do here exactly? */
+}
+
+static void
+append_to_ready_cb (GObject *source, GAsyncResult *result, WebKitSoupCacheWritingFixture *fixture)
+{
+	GFile *file = (GFile *)source;
+	GOutputStream *stream;
+	WebKitSoupCacheEntry *entry = fixture->entry;
+
+	stream = (GOutputStream *)g_file_append_to_finish (file, result, &entry->error);
+
+	if (g_cancellable_is_cancelled (entry->cancellable) || entry->error) {
+		fixture->cache->priv->n_pending--;
+		entry->dirty = FALSE;
+		webkit_soup_cache_entry_remove (fixture->cache, entry);
+		webkit_soup_cache_entry_free (entry, TRUE);
+		webkit_soup_cache_writing_fixture_free (fixture);
+		return;
+	}
+
+	entry->stream = g_object_ref (stream);
+	g_object_unref (file);
+
+	/* If we already got all the data we have to initiate the
+	   writing here, since we won't get more 'got-chunk'
+	   signals */
+	if (entry->got_body) {
+		GString *data = entry->data;
+
+		/* It could happen that reading the data from server
+		   was completed before this happens. In that case
+		   there is no data */
+		if (data) {
+			entry->writing = TRUE;
+			g_output_stream_write_async (entry->stream,
+						     data->str + entry->pos,
+						     data->len - entry->pos,
+						     G_PRIORITY_LOW,
+						     entry->cancellable,
+						     (GAsyncReadyCallback)write_ready_cb,
+						     fixture);
+		}
+	}
+}
+
+typedef struct {
+	time_t request_time;
+	SoupSessionFeature *feature;
+	gulong got_headers_handler;
+} RequestHelper;
+
+static void
+msg_got_headers_cb (SoupMessage *msg, gpointer user_data)
+{
+	WebKitSoupCache *cache;
+	WebKitSoupCacheability cacheable;
+	RequestHelper *helper;
+	time_t request_time, response_time;
+
+	response_time = time (NULL);
+
+	helper = (RequestHelper *)user_data;
+	cache = WEBKIT_SOUP_CACHE (helper->feature);
+	request_time = helper->request_time;
+	g_signal_handlers_disconnect_by_func (msg, msg_got_headers_cb, user_data);
+	g_slice_free (RequestHelper, helper);
+
+	cacheable = webkit_soup_cache_get_cacheability (cache, msg);
+
+	if (cacheable & WEBKIT_SOUP_CACHE_CACHEABLE) {
+		WebKitSoupCacheEntry *entry;
+		char *key;
+		GFile *file;
+		WebKitSoupCacheWritingFixture *fixture;
+
+		/* Check if we are already caching this resource */
+		key = soup_message_get_cache_key (msg);
+		entry = g_hash_table_lookup (cache->priv->cache, key);
+		g_free (key);
+
+		if (entry && entry->dirty)
+			return;
+
+		/* Create a new entry, deleting any old one if present */
+		if (entry) {
+			webkit_soup_cache_entry_remove (cache, entry);
+			webkit_soup_cache_entry_free (entry, TRUE);
+		}
+
+		entry = webkit_soup_cache_entry_new (cache, msg, request_time, response_time);
+		entry->hits = 1;
+
+		/* Do not continue if it can not be stored */
+		if (!webkit_soup_cache_entry_insert_by_key (cache, (const gchar *)entry->key, entry, TRUE)) {
+			webkit_soup_cache_entry_free (entry, TRUE);
+			return;
+		}
+
+		fixture = g_slice_new0 (WebKitSoupCacheWritingFixture);
+		fixture->cache = g_object_ref (cache);
+		fixture->entry = entry;
+		fixture->msg = g_object_ref (msg);
+
+		/* We connect now to these signals and buffer the data
+		   if it comes before the file is ready for writing */
+		fixture->got_chunk_handler =
+			g_signal_connect (msg, "got-chunk", G_CALLBACK (msg_got_chunk_cb), fixture);
+		fixture->got_body_handler =
+			g_signal_connect (msg, "got-body", G_CALLBACK (msg_got_body_cb), fixture);
+		fixture->restarted_handler =
+			g_signal_connect (msg, "restarted", G_CALLBACK (msg_restarted_cb), entry);
+
+		/* Prepare entry */
+		file = g_file_new_for_path (entry->filename);
+		cache->priv->n_pending++;
+
+		entry->dirty = TRUE;
+		entry->cancellable = g_cancellable_new ();
+		g_file_append_to_async (file, 0,
+					G_PRIORITY_LOW, entry->cancellable,
+					(GAsyncReadyCallback)append_to_ready_cb,
+					fixture);
+	} else if (cacheable & WEBKIT_SOUP_CACHE_INVALIDATES) {
+		char *key;
+		WebKitSoupCacheEntry *entry;
+
+		key = soup_message_get_cache_key (msg);
+		entry = g_hash_table_lookup (cache->priv->cache, key);
+		g_free (key);
+
+		if (entry) {
+			if (webkit_soup_cache_entry_remove (cache, entry))
+				webkit_soup_cache_entry_free (entry, TRUE);
+		}
+	} else if (cacheable & WEBKIT_SOUP_CACHE_VALIDATES) {
+		char *key;
+		WebKitSoupCacheEntry *entry;
+
+		key = soup_message_get_cache_key (msg);
+		entry = g_hash_table_lookup (cache->priv->cache, key);
+		g_free (key);
+
+		g_return_if_fail (entry);
+
+		entry->being_validated = FALSE;
+
+		/* We update the headers of the existing cache item,
+		   plus its age */
+		soup_message_headers_foreach (msg->response_headers,
+					      (SoupMessageHeadersForeachFunc)update_headers,
+					      entry->headers);
+		webkit_soup_cache_entry_set_freshness (entry, msg, cache);
+	}
+}
+
+GInputStream *
+webkit_soup_cache_send_response (WebKitSoupCache *cache, SoupMessage *msg)
+{
+	char *key;
+	WebKitSoupCacheEntry *entry;
+	char *current_age;
+	GInputStream *stream = NULL;
+	GFile *file;
+
+	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), NULL);
+	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), NULL);
+
+	key = soup_message_get_cache_key (msg);
+	entry = g_hash_table_lookup (cache->priv->cache, key);
+	g_return_val_if_fail (entry, NULL);
+
+	/* If we are told to send a response from cache any validation
+	   in course is over by now */
+	entry->being_validated = FALSE;
+
+	/* Headers */
+	soup_message_headers_foreach (entry->headers,
+				      (SoupMessageHeadersForeachFunc)update_headers,
+				      msg->response_headers);
+
+	/* Add 'Age' header with the current age */
+	current_age = g_strdup_printf ("%d", webkit_soup_cache_entry_get_current_age (entry));
+	soup_message_headers_replace (msg->response_headers,
+				      "Age",
+				      current_age);
+	g_free (current_age);
+
+	/* TODO: the original idea was to save reads, but current code
+	   assumes that a stream is always returned. Need to reach
+	   some agreement here. Also we have to handle the situation
+	   were the file was no longer there (for example files
+	   removed without notifying the cache */
+	file = g_file_new_for_path (entry->filename);
+	stream = (GInputStream *)g_file_read (file, NULL, NULL);
+
+	return stream;
+}
+
+static void
+request_started (SoupSessionFeature *feature, SoupSession *session,
+		 SoupMessage *msg, SoupSocket *socket)
+{
+	RequestHelper *helper = g_slice_new0 (RequestHelper);
+	helper->request_time = time (NULL);
+	helper->feature = feature;
+	helper->got_headers_handler = g_signal_connect (msg, "got-headers",
+							G_CALLBACK (msg_got_headers_cb),
+							helper);
+}
+
+static void
+attach (SoupSessionFeature *feature, SoupSession *session)
+{
+	WebKitSoupCache *cache = WEBKIT_SOUP_CACHE (feature);
+	cache->priv->session = session;
+
+	webkit_soup_cache_default_feature_interface->attach (feature, session);
+}
+
+static void
+webkit_soup_cache_session_feature_init (SoupSessionFeatureInterface *feature_interface,
+					gpointer interface_data)
+{
+	webkit_soup_cache_default_feature_interface =
+		g_type_default_interface_peek (SOUP_TYPE_SESSION_FEATURE);
+
+	feature_interface->attach = attach;
+	feature_interface->request_started = request_started;
+}
+
+static void
+webkit_soup_cache_init (WebKitSoupCache *cache)
+{
+	WebKitSoupCachePrivate *priv;
+
+	priv = cache->priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
+
+	priv->cache = g_hash_table_new_full (g_str_hash,
+					     g_str_equal,
+					     (GDestroyNotify)g_free,
+					     NULL);
+
+	/* LRU */
+	priv->lru_start = NULL;
+
+	/* */
+	priv->n_pending = 0;
+
+	/* Cache size */
+	priv->max_size = DEFAULT_MAX_SIZE;
+	priv->max_entry_data_size = priv->max_size / MAX_ENTRY_DATA_PERCENTAGE;
+	priv->size = 0;
+}
+
+static void
+remove_cache_item (gpointer key,
+		   gpointer value,
+		   WebKitSoupCache *cache)
+{
+	WebKitSoupCacheEntry *entry = g_hash_table_lookup (cache->priv->cache, (const gchar *)key);
+	if (webkit_soup_cache_entry_remove (cache, entry))
+		webkit_soup_cache_entry_free (entry, FALSE);
+}
+
+static void
+webkit_soup_cache_finalize (GObject *object)
+{
+	WebKitSoupCachePrivate *priv;
+
+	priv = WEBKIT_SOUP_CACHE (object)->priv;
+
+	g_hash_table_foreach (priv->cache, (GHFunc)remove_cache_item, object);
+	g_hash_table_destroy (priv->cache);
+	g_free (priv->cache_dir);
+
+	g_list_free (priv->lru_start);
+	priv->lru_start = NULL;
+
+	G_OBJECT_CLASS (webkit_soup_cache_parent_class)->finalize (object);
+}
+
+static void
+webkit_soup_cache_set_property (GObject *object, guint prop_id,
+				const GValue *value, GParamSpec *pspec)
+{
+	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE (object)->priv;
+
+	switch (prop_id) {
+	case PROP_CACHE_DIR:
+		priv->cache_dir = g_value_dup_string (value);
+		/* Create directory if it does not exist (FIXME: should we?) */
+		if (!g_file_test (priv->cache_dir, G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR))
+			g_mkdir_with_parents (priv->cache_dir, 0700);
+		break;
+	case PROP_CACHE_TYPE:
+		priv->cache_type = g_value_get_enum (value);
+		/* TODO: clear private entries and issue a warning if moving to shared? */
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+webkit_soup_cache_get_property (GObject *object, guint prop_id,
+				GValue *value, GParamSpec *pspec)
+{
+	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE (object)->priv;
+
+	switch (prop_id) {
+	case PROP_CACHE_DIR:
+		g_value_set_string (value, priv->cache_dir);
+		break;
+	case PROP_CACHE_TYPE:
+		g_value_set_enum (value, priv->cache_type);
+		break;
+	default:
+		G_OBJECT_WARN_INVALID_PROPERTY_ID (object, prop_id, pspec);
+		break;
+	}
+}
+
+static void
+webkit_soup_cache_constructed (GObject *object)
+{
+	WebKitSoupCachePrivate *priv;
+
+	priv = WEBKIT_SOUP_CACHE (object)->priv;
+
+	if (!priv->cache_dir) {
+		/* Set a default cache dir, different for each user */
+		priv->cache_dir = g_build_filename (g_get_user_cache_dir (),
+						    "httpcache",
+						    NULL);
+		if (!g_file_test (priv->cache_dir, G_FILE_TEST_EXISTS | G_FILE_TEST_IS_DIR))
+			g_mkdir_with_parents (priv->cache_dir, 0700);
+	}
+
+	if (G_OBJECT_CLASS (webkit_soup_cache_parent_class)->constructed)
+		G_OBJECT_CLASS (webkit_soup_cache_parent_class)->constructed (object);
+}
+
+#define WEBKIT_SOUP_CACHE_TYPE_TYPE (webkit_soup_cache_type_get_type ())
+static GType
+webkit_soup_cache_type_get_type (void)
+{
+	static GType cache_type = 0;
+
+	static const GEnumValue cache_types[] = {
+		{ WEBKIT_SOUP_CACHE_SINGLE_USER, "Single user cache", "user" },
+		{ WEBKIT_SOUP_CACHE_SHARED, "Shared cache", "shared" },
+		{ 0, NULL, NULL }
+	};
+
+	if (!cache_type) {
+		cache_type = g_enum_register_static ("WebKitSoupCacheTypeType", cache_types);
+	}
+	return cache_type;
+}
+
+static void
+webkit_soup_cache_class_init (WebKitSoupCacheClass *cache_class)
+{
+	GObjectClass *gobject_class = (GObjectClass *)cache_class;
+
+	gobject_class->finalize = webkit_soup_cache_finalize;
+	gobject_class->constructed = webkit_soup_cache_constructed;
+	gobject_class->set_property = webkit_soup_cache_set_property;
+	gobject_class->get_property = webkit_soup_cache_get_property;
+
+	cache_class->get_cacheability = get_cacheability;
+
+	g_object_class_install_property (gobject_class, PROP_CACHE_DIR,
+					 g_param_spec_string ("cache-dir",
+							      "Cache directory",
+							      "The directory to store the cache files",
+							      NULL,
+							      G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+
+	g_object_class_install_property (gobject_class, PROP_CACHE_TYPE,
+					 g_param_spec_enum ("cache-type",
+							    "Cache type",
+							    "Whether the cache is private or shared",
+							    WEBKIT_SOUP_CACHE_TYPE_TYPE,
+							    WEBKIT_SOUP_CACHE_SINGLE_USER,
+							    G_PARAM_READWRITE | G_PARAM_CONSTRUCT_ONLY));
+
+	g_type_class_add_private (cache_class, sizeof (WebKitSoupCachePrivate));
+}
+
+/**
+ * webkit_soup_cache_new:
+ * @cache_dir: the directory to store the cached data, or %NULL to use the default one
+ * @cache_type: the #WebKitSoupCacheType of the cache
+ *
+ * Creates a new #WebKitSoupCache.
+ *
+ * Returns: a new #WebKitSoupCache
+ *
+ * Since: 2.28
+ **/
+WebKitSoupCache *
+webkit_soup_cache_new (const char *cache_dir, WebKitSoupCacheType cache_type)
+{
+	return g_object_new (WEBKIT_TYPE_SOUP_CACHE,
+			     "cache-dir", cache_dir,
+			     "cache-type", cache_type,
+			     NULL);
+}
+
+/**
+ * webkit_soup_cache_has_response:
+ * @cache: a #WebKitSoupCache
+ * @msg: a #SoupMessage
+ *
+ * This function calculates whether the @cache object has a proper
+ * response for the request @msg given the flags both in the request
+ * and the cached reply and the time ellapsed since it was cached.
+ *
+ * Returns: whether or not the @cache has a valid response for @msg
+ **/
+WebKitSoupCacheResponse
+webkit_soup_cache_has_response (WebKitSoupCache *cache, SoupMessage *msg)
+{
+	char *key;
+	WebKitSoupCacheEntry *entry;
+	const char *cache_control;
+	GHashTable *hash;
+	gpointer value;
+	gboolean must_revalidate;
+	int max_age, max_stale, min_fresh;
+	GList *lru_item, *item;
+
+	key = soup_message_get_cache_key (msg);
+	entry = g_hash_table_lookup (cache->priv->cache, key);
+
+	/* 1. The presented Request-URI and that of stored response
+	 * match
+	 */
+	if (!entry)
+		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
+
+	/* Increase hit count. Take sorting into account */
+	entry->hits++;
+	lru_item = g_list_find (cache->priv->lru_start, entry);
+	item = lru_item;
+	while (item->next && lru_compare_func (item->data, item->next->data) > 0)
+		item = g_list_next (item);
+
+	if (item != lru_item) {
+		cache->priv->lru_start = g_list_remove_link (cache->priv->lru_start, lru_item);
+		item = g_list_insert_sorted (item, lru_item->data, lru_compare_func);
+		g_list_free (lru_item);
+	}
+
+	if (entry->dirty || entry->being_validated)
+		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
+
+	/* 2. The request method associated with the stored response
+	 *  allows it to be used for the presented request
+	 */
+
+	/* In practice this means we only return our resource for GET,
+	 * cacheability for other methods is a TODO in the RFC
+	 * (TODO: although we could return the headers for HEAD
+	 * probably).
+	 */
+	if (msg->method != SOUP_METHOD_GET)
+		return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
+
+	/* 3. Selecting request-headers nominated by the stored
+	 * response (if any) match those presented.
+	 */
+
+	/* TODO */
+
+	/* 4. The presented request and stored response are free from
+	 * directives that would prevent its use.
+	 */
+
+	must_revalidate = FALSE;
+	max_age = max_stale = min_fresh = -1;
+
+	cache_control = soup_message_headers_get (msg->request_headers, "Cache-Control");
+	if (cache_control) {
+		hash = soup_header_parse_param_list (cache_control);
+
+		if (g_hash_table_lookup_extended (hash, "no-store", NULL, NULL)) {
+			g_hash_table_destroy (hash);
+			return WEBKIT_SOUP_CACHE_RESPONSE_STALE;
+		}
+
+		if (g_hash_table_lookup_extended (hash, "no-cache", NULL, NULL)) {
+			entry->must_revalidate = TRUE;
+		}
+
+		if (g_hash_table_lookup_extended (hash, "max-age", NULL, &value)) {
+			max_age = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
+		}
+
+		/* max-stale can have no value set, we need to use _extended */
+		if (g_hash_table_lookup_extended (hash, "max-stale", NULL, &value)) {
+			if (value)
+				max_stale = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
+			else
+				max_stale = G_MAXINT32;
+		}
+
+		value = g_hash_table_lookup (hash, "min-fresh");
+		if (value)
+			min_fresh = (int)MIN (g_ascii_strtoll (value, NULL, 10), G_MAXINT32);
+
+		g_hash_table_destroy (hash);
+
+		if (max_age != -1) {
+			guint current_age = webkit_soup_cache_entry_get_current_age (entry);
+
+			/* If we are over max-age and max-stale is not
+			   set, do not use the value from the cache
+			   without validation */
+			if ((guint) max_age <= current_age && max_stale == -1)
+				return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
+		}
+	}
+
+	/* 5. The stored response is either: fresh, allowed to be
+	 * served stale or succesfully validated
+	 */
+	/* TODO consider also proxy-revalidate & s-maxage */
+	if (entry->must_revalidate)
+		return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
+
+	if (!webkit_soup_cache_entry_is_fresh_enough (entry, min_fresh)) {
+		/* Not fresh, can it be served stale? */
+		if (max_stale != -1) {
+			/* G_MAXINT32 means we accept any staleness */
+			if (max_stale == G_MAXINT32)
+				return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
+
+			if ((webkit_soup_cache_entry_get_current_age (entry) - entry->freshness_lifetime) <= (guint) max_stale)
+				return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
+		}
+
+		return WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION;
+	}
+
+	return WEBKIT_SOUP_CACHE_RESPONSE_FRESH;
+}
+
+/**
+ * webkit_soup_cache_get_cacheability:
+ * @cache: a #WebKitSoupCache
+ * @msg: a #SoupMessage
+ *
+ * Calculates whether the @msg can be cached or not.
+ *
+ * Returns: a #WebKitSoupCacheability value indicating whether the @msg can be cached or not.
+ **/
+WebKitSoupCacheability
+webkit_soup_cache_get_cacheability (WebKitSoupCache *cache, SoupMessage *msg)
+{
+	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), WEBKIT_SOUP_CACHE_UNCACHEABLE);
+	g_return_val_if_fail (SOUP_IS_MESSAGE (msg), WEBKIT_SOUP_CACHE_UNCACHEABLE);
+
+	return WEBKIT_SOUP_CACHE_GET_CLASS (cache)->get_cacheability (cache, msg);
+}
+
+static gboolean
+force_flush_timeout (gpointer data)
+{
+	gboolean *forced = (gboolean *)data;
+	*forced = TRUE;
+
+	return FALSE;
+}
+
+/**
+ * webkit_soup_cache_flush:
+ * @cache: a #WebKitSoupCache
+ * @session: the #SoupSession associated with the @cache
+ *
+ * This function will force all pending writes in the @cache to be
+ * committed to disk. For doing so it will iterate the #GMainContext
+ * associated with the @session (which can be the default one) as long
+ * as needed.
+ **/
+void
+webkit_soup_cache_flush (WebKitSoupCache *cache)
+{
+	GMainContext *async_context;
+	SoupSession *session;
+	guint timeout_id;
+	gboolean forced = FALSE;
+
+	g_return_if_fail (WEBKIT_IS_SOUP_CACHE (cache));
+
+	session = cache->priv->session;
+	g_return_if_fail (SOUP_IS_SESSION (session));
+	async_context = soup_session_get_async_context (session);
+
+	/* We give cache 10 secs to finish */
+	timeout_id = g_timeout_add (10000, force_flush_timeout, &forced);
+
+	while (!forced && cache->priv->n_pending > 0)
+		g_main_context_iteration (async_context, FALSE);
+
+	if (!forced)
+		g_source_remove (timeout_id);
+	else
+		g_warning ("Cache flush finished despite %d pending requests", cache->priv->n_pending);
+}
+
+static void
+clear_cache_item (gpointer key,
+		  gpointer value,
+		  WebKitSoupCache *cache)
+{
+	WebKitSoupCacheEntry *entry = g_hash_table_lookup (cache->priv->cache, (const gchar *)key);
+	if (webkit_soup_cache_entry_remove (cache, entry))
+		webkit_soup_cache_entry_free (entry, TRUE);
+}
+
+/**
+ * webkit_soup_cache_clear:
+ * @cache: a #WebKitSoupCache
+ *
+ * Will remove all entries in the @cache plus all the cache files
+ * associated with them.
+ **/
+void
+webkit_soup_cache_clear (WebKitSoupCache *cache)
+{
+	GHashTable *hash;
+
+	g_return_if_fail (WEBKIT_IS_SOUP_CACHE (cache));
+
+	hash = cache->priv->cache;
+	g_return_if_fail (hash);
+
+	g_hash_table_foreach (hash, (GHFunc)clear_cache_item, cache);
+}
+
+SoupMessage *
+webkit_soup_cache_generate_conditional_request (WebKitSoupCache *cache, SoupMessage *original)
+{
+	SoupMessage *msg;
+	SoupURI *uri;
+	WebKitSoupCacheEntry *entry;
+	char *key;
+	const char *value;
+
+	g_return_val_if_fail (WEBKIT_IS_SOUP_CACHE (cache), NULL);
+	g_return_val_if_fail (SOUP_IS_MESSAGE (original), NULL);
+
+	/* First copy the data we need from the original message */
+	uri = soup_message_get_uri (original);
+	msg = soup_message_new_from_uri (original->method, uri);
+
+	soup_message_headers_foreach (original->request_headers,
+				      (SoupMessageHeadersForeachFunc)copy_headers,
+				      msg->request_headers);
+
+	/* Now add the validator entries in the header from the cached
+	   data */
+	key = soup_message_get_cache_key (original);
+	entry = g_hash_table_lookup (cache->priv->cache, key);
+	g_free (key);
+
+	g_return_val_if_fail (entry, NULL);
+
+	entry->being_validated = TRUE;
+
+	value = soup_message_headers_get (entry->headers, "Last-Modified");
+	if (value)
+		soup_message_headers_append (msg->request_headers,
+					     "If-Modified-Since",
+					     value);
+	value = soup_message_headers_get (entry->headers, "ETag");
+	if (value)
+		soup_message_headers_append (msg->request_headers,
+					     "If-None-Match",
+					     value);
+	return msg;
+}
+
+#define WEBKIT_SOUP_CACHE_FILE "soup.cache"
+
+#define WEBKIT_SOUP_CACHE_HEADERS_FORMAT "{ss}"
+#define WEBKIT_SOUP_CACHE_PHEADERS_FORMAT "(ssbuuuuua" WEBKIT_SOUP_CACHE_HEADERS_FORMAT ")"
+#define WEBKIT_SOUP_CACHE_ENTRIES_FORMAT "a" WEBKIT_SOUP_CACHE_PHEADERS_FORMAT
+
+/* Basically the same format than above except that some strings are
+   prepended with &. This way the GVariant returns a pointer to the
+   data instead of duplicating the string */
+#define WEBKIT_SOUP_CACHE_DECODE_HEADERS_FORMAT "{&s&s}"
+
+static void
+pack_entry (gpointer data,
+	    gpointer user_data)
+{
+	WebKitSoupCacheEntry *entry = (WebKitSoupCacheEntry *) data;
+	SoupMessageHeadersIter iter;
+	const gchar *header_key, *header_value;
+	GVariantBuilder *headers_builder;
+	GVariantBuilder *entries_builder = (GVariantBuilder *)user_data;
+
+	/* Do not store non-consolidated entries */
+	if (entry->dirty || entry->writing || !entry->key)
+		return;
+
+	/* Pack headers */
+	headers_builder = g_variant_builder_new (G_VARIANT_TYPE_ARRAY);
+	soup_message_headers_iter_init (&iter, entry->headers);
+	while (soup_message_headers_iter_next (&iter, &header_key, &header_value)) {
+		if (g_utf8_validate (header_value, -1, NULL))
+			g_variant_builder_add (headers_builder, WEBKIT_SOUP_CACHE_HEADERS_FORMAT,
+					       header_key, header_value);
+	}
+
+	/* Entry data */
+	g_variant_builder_add (entries_builder, WEBKIT_SOUP_CACHE_PHEADERS_FORMAT,
+			       entry->key, entry->filename, entry->must_revalidate,
+			       entry->freshness_lifetime, entry->corrected_initial_age,
+			       entry->response_time, entry->hits, entry->length, headers_builder);
+
+	g_variant_builder_unref (headers_builder);
+}
+
+void
+webkit_soup_cache_dump (WebKitSoupCache *cache)
+{
+	WebKitSoupCachePrivate *priv = WEBKIT_SOUP_CACHE_GET_PRIVATE (cache);
+	gchar *filename;
+	GVariantBuilder *entries_builder;
+	GVariant *cache_variant;
+
+	if (!g_list_length (cache->priv->lru_start))
+		return;
+
+	/* Create the builder and iterate over all entries */
+	entries_builder = g_variant_builder_new (G_VARIANT_TYPE_ARRAY);
+	g_list_foreach (cache->priv->lru_start, pack_entry, entries_builder);
+
+	/* Serialize and dump */
+	cache_variant = g_variant_new (WEBKIT_SOUP_CACHE_ENTRIES_FORMAT, entries_builder);
+	g_variant_builder_unref (entries_builder);
+
+	filename = g_build_filename (priv->cache_dir, WEBKIT_SOUP_CACHE_FILE, NULL);
+	g_file_set_contents (filename, (const gchar *)g_variant_get_data (cache_variant),
+			     g_variant_get_size (cache_variant), NULL);
+	g_free (filename);
+	g_variant_unref (cache_variant);
+}
+
+void
+webkit_soup_cache_load (WebKitSoupCache *cache)
+{
+	gchar *filename = NULL, *contents = NULL;
+	GVariant *cache_variant;
+	GVariantIter *entries_iter, *headers_iter;
+	GVariantType *variant_format;
+	gsize length;
+	WebKitSoupCacheEntry *entry;
+	WebKitSoupCachePrivate *priv = cache->priv;
+
+	filename = g_build_filename (priv->cache_dir, WEBKIT_SOUP_CACHE_FILE, NULL);
+	if (!g_file_get_contents (filename, &contents, &length, NULL)) {
+		g_free (filename);
+		return;
+	}
+	g_free (filename);
+
+	variant_format = g_variant_type_new (WEBKIT_SOUP_CACHE_ENTRIES_FORMAT);
+	cache_variant = g_variant_new_from_data (variant_format, (const gchar *)contents, length, FALSE, NULL, NULL);
+	g_variant_type_free (variant_format);
+
+	g_variant_get (cache_variant, WEBKIT_SOUP_CACHE_ENTRIES_FORMAT, &entries_iter);
+	entry = g_slice_new0 (WebKitSoupCacheEntry);
+
+	while (g_variant_iter_loop (entries_iter, WEBKIT_SOUP_CACHE_PHEADERS_FORMAT,
+				    &entry->key, &entry->filename, &entry->must_revalidate,
+				    &entry->freshness_lifetime, &entry->corrected_initial_age,
+				    &entry->response_time, &entry->hits, &entry->length,
+                                    &headers_iter)) {
+		const gchar *header_key, *header_value;
+
+		/* SoupMessage Headers */
+		entry->headers = soup_message_headers_new (SOUP_MESSAGE_HEADERS_RESPONSE);
+		while (g_variant_iter_loop (headers_iter, WEBKIT_SOUP_CACHE_DECODE_HEADERS_FORMAT, &header_key, &header_value))
+			soup_message_headers_append (entry->headers, header_key, header_value);
+
+		/* Insert in cache */
+		if (!webkit_soup_cache_entry_insert_by_key (cache, (const gchar *)entry->key, entry, FALSE))
+			webkit_soup_cache_entry_free (entry, TRUE);
+
+		/* New entry for the next iteration. This creates an
+		   extra object the last iteration but it's worth it
+		   as we save several if's */
+		entry = g_slice_new0 (WebKitSoupCacheEntry);
+	}
+	/* Remove last created entry */
+	g_slice_free (WebKitSoupCacheEntry, entry);
+
+	/* Sort LRU (shouldn't be needed). First reverse as elements
+	 * are always prepended when inserting
+	 */
+	cache->priv->lru_start = g_list_reverse (cache->priv->lru_start);
+	cache->priv->lru_start = g_list_sort (cache->priv->lru_start, lru_compare_func);
+
+	/* frees */
+	g_variant_iter_free (entries_iter);
+	g_variant_unref (cache_variant);
+}
+
+void
+webkit_soup_cache_set_max_size (WebKitSoupCache *cache,
+				guint max_size)
+{
+	cache->priv->max_size = max_size;
+	cache->priv->max_entry_data_size = cache->priv->max_size / MAX_ENTRY_DATA_PERCENTAGE;
+}
+
+guint
+webkit_soup_cache_get_max_size (WebKitSoupCache *cache)
+{
+	return cache->priv->max_size;
+}
diff --git a/WebCore/platform/network/soup/cache/webkit/soup-cache.h b/WebCore/platform/network/soup/cache/webkit/soup-cache.h
new file mode 100644
index 0000000..e447cfc
--- /dev/null
+++ b/WebCore/platform/network/soup/cache/webkit/soup-cache.h
@@ -0,0 +1,102 @@
+/* -*- Mode: C; tab-width: 8; indent-tabs-mode: t; c-basic-offset: 8 -*- */
+/*
+ * soup-cache.h:
+ *
+ * Copyright (C) 2009, 2010 Igalia, S.L.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef WEBKIT_SOUP_CACHE_H
+#define WEBKIT_SOUP_CACHE_H 1
+
+#if BUILDING_GTK__
+#include <webkit/webkitdefines.h>
+#else
+#ifndef WEBKIT_API
+#define WEBKIT_API
+#endif
+#endif
+
+#include <libsoup/soup-types.h>
+#include <gio/gio.h>
+
+G_BEGIN_DECLS
+
+#define WEBKIT_TYPE_SOUP_CACHE            (webkit_soup_cache_get_type ())
+#define WEBKIT_SOUP_CACHE(obj)            (G_TYPE_CHECK_INSTANCE_CAST ((obj), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCache))
+#define WEBKIT_SOUP_CACHE_CLASS(klass)    (G_TYPE_CHECK_CLASS_CAST ((klass), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCacheClass))
+#define WEBKIT_IS_SOUP_CACHE(obj)         (G_TYPE_CHECK_INSTANCE_TYPE ((obj), WEBKIT_TYPE_SOUP_CACHE))
+#define WEBKIT_IS_SOUP_CACHE_CLASS(klass) (G_TYPE_CHECK_CLASS_TYPE ((obj), WEBKIT_TYPE_SOUP_CACHE))
+#define WEBKIT_SOUP_CACHE_GET_CLASS(obj)  (G_TYPE_INSTANCE_GET_CLASS ((obj), WEBKIT_TYPE_SOUP_CACHE, WebKitSoupCacheClass))
+
+typedef struct _WebKitSoupCache WebKitSoupCache;
+typedef struct _WebKitSoupCachePrivate WebKitSoupCachePrivate;
+
+typedef enum {
+	WEBKIT_SOUP_CACHE_CACHEABLE = (1 << 0),
+	WEBKIT_SOUP_CACHE_UNCACHEABLE = (1 << 1),
+	WEBKIT_SOUP_CACHE_INVALIDATES = (1 << 2),
+	WEBKIT_SOUP_CACHE_VALIDATES = (1 << 3)
+} WebKitSoupCacheability;
+
+typedef enum {
+	WEBKIT_SOUP_CACHE_RESPONSE_FRESH,
+	WEBKIT_SOUP_CACHE_RESPONSE_NEEDS_VALIDATION,
+	WEBKIT_SOUP_CACHE_RESPONSE_STALE
+} WebKitSoupCacheResponse;
+
+typedef enum {
+	WEBKIT_SOUP_CACHE_SINGLE_USER,
+	WEBKIT_SOUP_CACHE_SHARED
+} WebKitSoupCacheType;
+
+struct _WebKitSoupCache {
+	GObject parent_instance;
+
+	WebKitSoupCachePrivate *priv;
+};
+
+typedef struct {
+	GObjectClass parent_class;
+
+	/* methods */
+	WebKitSoupCacheability (*get_cacheability)(WebKitSoupCache *cache, SoupMessage *msg);
+
+	/* Padding for future expansion */
+	void (*_libsoup_reserved1)(void);
+	void (*_libsoup_reserved2)(void);
+	void (*_libsoup_reserved3)(void);
+} WebKitSoupCacheClass;
+
+WEBKIT_API GType             webkit_soup_cache_get_type (void);
+WEBKIT_API WebKitSoupCache  *webkit_soup_cache_new (const char  *cache_dir,
+						    WebKitSoupCacheType cache_type);
+WEBKIT_API void              webkit_soup_cache_flush (WebKitSoupCache   *cache);
+WEBKIT_API void              webkit_soup_cache_clear (WebKitSoupCache   *cache);
+
+WEBKIT_API void              webkit_soup_cache_dump (WebKitSoupCache *cache);
+WEBKIT_API void              webkit_soup_cache_load (WebKitSoupCache *cache);
+
+WEBKIT_API void              webkit_soup_cache_set_max_size (WebKitSoupCache *cache,
+							     guint max_size);
+WEBKIT_API guint             webkit_soup_cache_get_max_size (WebKitSoupCache *cache);
+
+G_END_DECLS
+
+
+#endif /* WEBKIT_SOUP_CACHE_H */
+
diff --git a/WebCore/platform/network/win/CookieJarWin.cpp b/WebCore/platform/network/win/CookieJarWin.cpp
index 2bdd6b3..a2afbc6 100644
--- a/WebCore/platform/network/win/CookieJarWin.cpp
+++ b/WebCore/platform/network/win/CookieJarWin.cpp
@@ -48,13 +48,17 @@ String cookies(const Document* /*document*/, const KURL& url)
 {
     String str = url.string();
 
-    DWORD count = str.length() + 1;
-    InternetGetCookie(str.charactersWithNullTermination(), 0, 0, &count);
+    DWORD count = 0;
+    if (!InternetGetCookie(str.charactersWithNullTermination(), 0, 0, &count))
+        return String();
+
     if (count <= 1) // Null terminator counts as 1.
         return String();
 
     Vector<UChar> buffer(count);
-    InternetGetCookie(str.charactersWithNullTermination(), 0, buffer.data(), &count);
+    if (!InternetGetCookie(str.charactersWithNullTermination(), 0, buffer.data(), &count))
+        return String();
+
     buffer.shrink(count - 1); // Ignore the null terminator.
     return String::adopt(buffer);
 }
diff --git a/WebCore/platform/network/win/ResourceHandleWin.cpp b/WebCore/platform/network/win/ResourceHandleWin.cpp
index 5de2e1b..28035b9 100644
--- a/WebCore/platform/network/win/ResourceHandleWin.cpp
+++ b/WebCore/platform/network/win/ResourceHandleWin.cpp
@@ -27,6 +27,7 @@
 #include "config.h"
 #include "ResourceHandle.h"
 
+#include "DataURL.h"
 #include "HTTPParsers.h"
 #include "MIMETypeRegistry.h"
 #include "MainThread.h"
@@ -259,7 +260,7 @@ bool ResourceHandle::onRequestComplete()
 
 bool ResourceHandle::start(NetworkingContext* context)
 {
-    if (request().url().isLocalFile()) {
+    if (firstRequest().url().isLocalFile() || firstRequest().url().protocolIsData()) {
         ref(); // balanced by deref in fileLoadTimer
         if (d->m_loadSynchronously)
             fileLoadTimer(0);
@@ -349,6 +350,11 @@ void ResourceHandle::fileLoadTimer(Timer<ResourceHandle>*)
     RefPtr<ResourceHandle> protector(this);
     deref(); // balances ref in start
 
+    if (firstRequest().url().protocolIsData()) {
+        handleDataURL(this);
+        return;
+    }
+
     String fileName = firstRequest().url().fileSystemPath();
     HANDLE fileHandle = CreateFileW(fileName.charactersWithNullTermination(), GENERIC_READ, 0, 0, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
 
diff --git a/WebCore/platform/qt/ClipboardQt.cpp b/WebCore/platform/qt/ClipboardQt.cpp
index 90e3bfe..20cf62b 100644
--- a/WebCore/platform/qt/ClipboardQt.cpp
+++ b/WebCore/platform/qt/ClipboardQt.cpp
@@ -28,7 +28,6 @@
 #include "config.h"
 #include "ClipboardQt.h"
 
-#include "CSSHelper.h"
 #include "CachedImage.h"
 #include "Document.h"
 #include "DragData.h"
@@ -36,6 +35,7 @@
 #include "FileList.h"
 #include "Frame.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "Image.h"
 #include "IntPoint.h"
 #include "KURL.h"
@@ -276,7 +276,7 @@ void ClipboardQt::declareAndWriteDragImage(Element* element, const KURL& url, co
     if (imageURL.isEmpty())
         return;
 
-    KURL fullURL = frame->document()->completeURL(deprecatedParseURL(imageURL));
+    KURL fullURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(imageURL));
     if (fullURL.isEmpty())
         return;
 
diff --git a/WebCore/platform/qt/CursorQt.cpp b/WebCore/platform/qt/CursorQt.cpp
index 227b80c..5883600 100644
--- a/WebCore/platform/qt/CursorQt.cpp
+++ b/WebCore/platform/qt/CursorQt.cpp
@@ -72,15 +72,13 @@ Cursor& Cursor::operator=(const Cursor& other)
     return *this;
 }
 
+#ifndef QT_NO_CURSOR
 static QCursor* createCustomCursor(Image* image, const IntPoint& hotSpot)
 {
-#ifndef QT_NO_CURSOR
     IntPoint effectiveHotSpot = determineHotSpot(image, hotSpot);
     return new QCursor(*(image->nativeImageForCurrentFrame()), effectiveHotSpot.x(), effectiveHotSpot.y());
-#else
-    return 0;
-#endif
 }
+#endif
 
 void Cursor::ensurePlatformCursor() const
 {
diff --git a/WebCore/platform/qt/Language.cpp b/WebCore/platform/qt/LanguageQt.cpp
index 0d2900b..71e554f 100644
--- a/WebCore/platform/qt/Language.cpp
+++ b/WebCore/platform/qt/LanguageQt.cpp
@@ -32,7 +32,7 @@
 
 namespace WebCore {
 
-String defaultLanguage()
+String platformDefaultLanguage()
 {
     QLocale locale;
     return locale.name().replace("_", "-");
diff --git a/WebCore/platform/qt/PlatformBridge.h b/WebCore/platform/qt/PlatformBridge.h
index 918e139..e478d8f 100644
--- a/WebCore/platform/qt/PlatformBridge.h
+++ b/WebCore/platform/qt/PlatformBridge.h
@@ -27,7 +27,6 @@
 #define PlatformBridge_h
 
 #include "KURL.h"
-#include "npapi.h"
 #include "PlatformString.h"
 
 #include <wtf/Vector.h>
@@ -77,7 +76,9 @@
    static_cast<size_t>(!(sizeof(a) % sizeof(*(a)))))
 
 
-class NPObject;
+typedef struct NPObject NPObject;
+typedef struct _NPP NPP_t;
+typedef NPP_t* NPP;
 
 namespace WebCore {
 
diff --git a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
index 33e9552..498bb88 100644
--- a/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
+++ b/WebCore/platform/qt/PlatformKeyboardEventQt.cpp
@@ -505,6 +505,79 @@ int windowsKeyCodeForKeyEvent(unsigned int keycode, bool isKeypad)
     }
 }
 
+static bool isVirtualKeyCodeRepresentingCharacter(int code)
+{
+    switch (code) {
+    case VK_SPACE:
+    case VK_0:
+    case VK_1:
+    case VK_2:
+    case VK_3:
+    case VK_4:
+    case VK_5:
+    case VK_6:
+    case VK_7:
+    case VK_8:
+    case VK_9:
+    case VK_A:
+    case VK_B:
+    case VK_C:
+    case VK_D:
+    case VK_E:
+    case VK_F:
+    case VK_G:
+    case VK_H:
+    case VK_I:
+    case VK_J:
+    case VK_K:
+    case VK_L:
+    case VK_M:
+    case VK_N:
+    case VK_O:
+    case VK_P:
+    case VK_Q:
+    case VK_R:
+    case VK_S:
+    case VK_T:
+    case VK_U:
+    case VK_V:
+    case VK_W:
+    case VK_X:
+    case VK_Y:
+    case VK_Z:
+    case VK_NUMPAD0:
+    case VK_NUMPAD1:
+    case VK_NUMPAD2:
+    case VK_NUMPAD3:
+    case VK_NUMPAD4:
+    case VK_NUMPAD5:
+    case VK_NUMPAD6:
+    case VK_NUMPAD7:
+    case VK_NUMPAD8:
+    case VK_NUMPAD9:
+    case VK_MULTIPLY:
+    case VK_ADD:
+    case VK_SEPARATOR:
+    case VK_SUBTRACT:
+    case VK_DECIMAL:
+    case VK_DIVIDE:
+    case VK_OEM_1:
+    case VK_OEM_PLUS:
+    case VK_OEM_COMMA:
+    case VK_OEM_MINUS:
+    case VK_OEM_PERIOD:
+    case VK_OEM_2:
+    case VK_OEM_3:
+    case VK_OEM_4:
+    case VK_OEM_5:
+    case VK_OEM_6:
+    case VK_OEM_7:
+        return true;
+    default:
+        return false;
+    }
+}
+
 PlatformKeyboardEvent::PlatformKeyboardEvent(QKeyEvent* event)
 {
     const int state = event->modifiers();
@@ -539,7 +612,7 @@ void PlatformKeyboardEvent::disambiguateKeyDownEvent(Type type, bool)
             we try to detect this situation and still set the text, to ensure that the
             general event handling sends a key press event after this disambiguation.
         */
-        if (m_text.isEmpty() && m_windowsVirtualKeyCode && m_qtEvent->key() < Qt::Key_Escape)
+        if (m_text.isEmpty() && m_windowsVirtualKeyCode && isVirtualKeyCodeRepresentingCharacter(m_windowsVirtualKeyCode))
             m_text.append(UChar(m_windowsVirtualKeyCode));
 
         m_keyIdentifier = String();
@@ -562,6 +635,18 @@ void PlatformKeyboardEvent::getCurrentModifierState(bool& shiftKey, bool& ctrlKe
     metaKey = false;
 }
 
+uint32_t PlatformKeyboardEvent::nativeModifiers() const
+{
+    ASSERT(m_qtEvent);
+    return m_qtEvent->nativeModifiers();
+}
+
+uint32_t PlatformKeyboardEvent::nativeScanCode() const
+{
+    ASSERT(m_qtEvent);
+    return m_qtEvent->nativeScanCode();
+}
+
 }
 
 // vim: ts=4 sw=4 et
diff --git a/WebCore/platform/qt/QWebPageClient.h b/WebCore/platform/qt/QWebPageClient.h
index 9301cd5..f5d8c1b 100644
--- a/WebCore/platform/qt/QWebPageClient.h
+++ b/WebCore/platform/qt/QWebPageClient.h
@@ -30,6 +30,7 @@
 #include <QCursor>
 #endif
 
+#include <QPalette>
 #include <QRect>
 
 QT_BEGIN_NAMESPACE
diff --git a/WebCore/platform/qt/Maemo5Webstyle.cpp b/WebCore/platform/qt/QtMobileWebStyle.cpp
index 42b0b71..240faa5 100644
--- a/WebCore/platform/qt/Maemo5Webstyle.cpp
+++ b/WebCore/platform/qt/QtMobileWebStyle.cpp
@@ -18,7 +18,7 @@
  *
  */
 #include "config.h"
-#include "Maemo5Webstyle.h"
+#include "QtMobileWebStyle.h"
 
 #include "QtStyleOptionWebComboBox.h"
 
@@ -26,7 +26,7 @@
 #include <QPixmapCache>
 #include <QStyleOption>
 
-Maemo5WebStyle::Maemo5WebStyle()
+QtMobileWebStyle::QtMobileWebStyle()
 {
 }
 
@@ -44,10 +44,10 @@ static inline void drawRectangularControlBackground(QPainter* painter, const QPe
     painter->setBrush(oldBrush);
 }
 
-void Maemo5WebStyle::drawChecker(QPainter* painter, int size, QColor color) const
+void QtMobileWebStyle::drawChecker(QPainter* painter, int size, QColor color) const
 {
     int border = qMin(qMax(1, int(0.2 * size)), 6);
-    int checkerSize = size - 2 * border;
+    int checkerSize = qMax(size - 2 * border, 3);
     int width = checkerSize / 3;
     int middle = qMax(3 * checkerSize / 7, 3);
     int x = ((size - checkerSize) >> 1);
@@ -67,7 +67,7 @@ void Maemo5WebStyle::drawChecker(QPainter* painter, int size, QColor color) cons
     painter->drawLines(lines.constData(), lines.size());
 }
 
-QPixmap Maemo5WebStyle::findChecker(const QRect& rect, bool disabled) const
+QPixmap QtMobileWebStyle::findChecker(const QRect& rect, bool disabled) const
 {
     int size = qMin(rect.width(), rect.height());
     QPixmap result;
@@ -77,24 +77,31 @@ QPixmap Maemo5WebStyle::findChecker(const QRect& rect, bool disabled) const
         result = QPixmap(size, size);
         result.fill(Qt::transparent);
         QPainter painter(&result);
-        drawChecker(&painter, size, disabled ? Qt::gray : Qt::black);
+        drawChecker(&painter, size, disabled ? Qt::lightGray : Qt::darkGray);
         QPixmapCache::insert(key, result);
     }
     return result;
 }
 
-void Maemo5WebStyle::drawRadio(QPainter* painter, const QSize& size, bool checked, QColor color) const
+void QtMobileWebStyle::drawRadio(QPainter* painter, const QSize& size, bool checked, QColor color) const
 {
     painter->setRenderHint(QPainter::Antialiasing, true);
 
     // deflate one pixel
     QRect rect = QRect(QPoint(1, 1), QSize(size.width() - 2, size.height() - 2));
+    const QPoint centerGradient(rect.bottomRight() * 0.7);
+
+    QRadialGradient radialGradient(centerGradient, centerGradient.x() - 1);
+    radialGradient.setColorAt(0.0, Qt::white);
+    radialGradient.setColorAt(0.6, Qt::white);
+    radialGradient.setColorAt(1.0, color);
 
-    QPen pen(Qt::black);
-    pen.setWidth(1);
     painter->setPen(color);
-    painter->setBrush(Qt::white);
+    painter->setBrush(color);
+    painter->drawEllipse(rect);
+    painter->setBrush(radialGradient);
     painter->drawEllipse(rect);
+
     int border = 0.1 * (rect.width() + rect.height());
     border = qMin(qMax(2, border), 10);
     rect.adjust(border, border, -border, -border);
@@ -105,7 +112,7 @@ void Maemo5WebStyle::drawRadio(QPainter* painter, const QSize& size, bool checke
     }
 }
 
-QPixmap Maemo5WebStyle::findRadio(const QSize& size, bool checked, bool disabled) const
+QPixmap QtMobileWebStyle::findRadio(const QSize& size, bool checked, bool disabled) const
 {
     QPixmap result;
     static const QString prefix = "$qt-maemo5-" + QLatin1String(metaObject()->className()) + "-radio-";
@@ -115,19 +122,29 @@ QPixmap Maemo5WebStyle::findRadio(const QSize& size, bool checked, bool disabled
         result = QPixmap(size);
         result.fill(Qt::transparent);
         QPainter painter(&result);
-        drawRadio(&painter, size, checked, disabled ? Qt::gray : Qt::black);
+        drawRadio(&painter, size, checked, disabled ? Qt::lightGray : Qt::darkGray);
         QPixmapCache::insert(key, result);
     }
     return result;
 }
 
-void Maemo5WebStyle::drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget) const
+void QtMobileWebStyle::drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget) const
 {
     switch (element) {
     case CE_CheckBox: {
         QRect rect = option->rect;
         const bool disabled = !(option->state & State_Enabled);
-        drawRectangularControlBackground(painter, QPen(disabled ? Qt::gray : Qt::black), rect, option->palette.base());
+
+        QLinearGradient linearGradient(rect.topLeft(), rect.bottomLeft());
+        if (disabled) {
+            linearGradient.setColorAt(0.0, Qt::lightGray);
+            linearGradient.setColorAt(0.5, Qt::white);
+        } else {
+            linearGradient.setColorAt(0.0, Qt::darkGray);
+            linearGradient.setColorAt(0.5, Qt::white);
+        }
+
+        drawRectangularControlBackground(painter, QPen(disabled ? Qt::lightGray : Qt::darkGray), rect, linearGradient);
         rect.adjust(1, 1, -1, -1);
 
         if (option->state & State_Off)
@@ -155,7 +172,7 @@ void Maemo5WebStyle::drawControl(ControlElement element, const QStyleOption* opt
     }
 }
 
-void Maemo5WebStyle::drawMultipleComboButton(QPainter* painter, const QSize& size, QColor color) const
+void QtMobileWebStyle::drawMultipleComboButton(QPainter* painter, const QSize& size, QColor color) const
 {
     int rectWidth = size.width() - 1;
     int width = qMax(2, rectWidth >> 3);
@@ -170,17 +187,25 @@ void Maemo5WebStyle::drawMultipleComboButton(QPainter* painter, const QSize& siz
     painter->drawRect(2 * (width + distance), top, width, width);
 }
 
-void Maemo5WebStyle::drawSimpleComboButton(QPainter* painter, const QSize& size, QColor color) const
+void QtMobileWebStyle::drawSimpleComboButton(QPainter* painter, const QSize& size, QColor color) const
 {
-    QPolygon polygon;
     int width = size.width();
-    polygon.setPoints(3, 0, 0,  width - 1, 0,  width >> 1, size.height());
+    int midle = width >> 1;
+    QVector<QLine> lines(width + 1);
+
+    for (int x = 0, y = 0;  x < midle; x++, y++) {
+        lines[x] = QLine(x, y, x, y + 2);
+        lines[x + midle] = QLine(width - x - 1, y, width - x - 1, y + 2);
+    }
+    // Just to ensure the lines' intersection.
+    lines[width] = QLine(midle, midle, midle, midle + 2);
+
     painter->setPen(color);
     painter->setBrush(color);
-    painter->drawPolygon(polygon);
+    painter->drawLines(lines);
 }
 
-QSize Maemo5WebStyle::getButtonImageSize(const QSize& buttonSize) const
+QSize QtMobileWebStyle::getButtonImageSize(const QSize& buttonSize) const
 {
     const int border = qMax(3, buttonSize.width() >> 3) << 1;
 
@@ -195,10 +220,10 @@ QSize Maemo5WebStyle::getButtonImageSize(const QSize& buttonSize) const
     else
         width = height << 1;
 
-    return QSize(width + 1, width >> 1);
+    return QSize(width + 1, width);
 }
 
-QPixmap Maemo5WebStyle::findComboButton(const QSize& size, bool multiple, bool disabled) const
+QPixmap QtMobileWebStyle::findComboButton(const QSize& size, bool multiple, bool disabled) const
 {
     QPixmap result;
     QSize imageSize = getButtonImageSize(size);
@@ -214,15 +239,15 @@ QPixmap Maemo5WebStyle::findComboButton(const QSize& size, bool multiple, bool d
         result.fill(Qt::transparent);
         QPainter painter(&result);
         if (multiple)
-            drawMultipleComboButton(&painter, imageSize, disabled ? Qt::gray : Qt::black);
+            drawMultipleComboButton(&painter, imageSize, disabled ? Qt::lightGray : Qt::darkGray);
         else
-            drawSimpleComboButton(&painter, imageSize, disabled ? Qt::gray : Qt::black);
+            drawSimpleComboButton(&painter, imageSize, disabled ? Qt::lightGray : Qt::darkGray);
         QPixmapCache::insert(key, result);
     }
     return result;
 }
 
-void Maemo5WebStyle::drawComplexControl(ComplexControl control, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget) const
+void QtMobileWebStyle::drawComplexControl(ComplexControl control, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget) const
 {
     switch (control) {
     case CC_ComboBox: {
diff --git a/WebCore/platform/qt/Maemo5Webstyle.h b/WebCore/platform/qt/QtMobileWebStyle.h
index ce717b6..779bd26 100644
--- a/WebCore/platform/qt/Maemo5Webstyle.h
+++ b/WebCore/platform/qt/QtMobileWebStyle.h
@@ -18,14 +18,14 @@
  *
  */
 
-#ifndef Maemo5Webstyle_h
-#define Maemo5Webstyle_h
+#ifndef QtMobileWebStyle_h
+#define QtMobileWebStyle_h
 
 #include <QWindowsStyle>
 
-class Maemo5WebStyle : public QWindowsStyle {
+class QtMobileWebStyle : public QWindowsStyle {
 public:
-    Maemo5WebStyle();
+    QtMobileWebStyle();
 
     void drawControl(ControlElement element, const QStyleOption* option, QPainter* painter, const QWidget* widget = 0) const;
     void drawComplexControl(ComplexControl cc, const QStyleOptionComplex* option, QPainter* painter, const QWidget* widget = 0) const;
@@ -44,4 +44,4 @@ private:
 
 };
 
-#endif // Maemo5WebStyle_h
+#endif // QtMobileWebStyle_h
diff --git a/WebCore/platform/qt/RenderThemeQt.cpp b/WebCore/platform/qt/RenderThemeQt.cpp
index 7388b76..50b5de6 100644
--- a/WebCore/platform/qt/RenderThemeQt.cpp
+++ b/WebCore/platform/qt/RenderThemeQt.cpp
@@ -43,7 +43,7 @@
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
 #if USE(QT_MOBILE_THEME)
-#include "Maemo5Webstyle.h"
+#include "QtMobileWebStyle.h"
 #endif
 #include "NotImplemented.h"
 #include "Page.h"
@@ -152,7 +152,7 @@ RenderThemeQt::RenderThemeQt(Page* page)
 #endif
 
 #if USE(QT_MOBILE_THEME)
-    m_fallbackStyle = new Maemo5WebStyle;
+    m_fallbackStyle = new QtMobileWebStyle;
 #else
     m_fallbackStyle = QStyleFactory::create(QLatin1String("windows"));
 #endif
@@ -779,6 +779,7 @@ bool RenderThemeQt::paintSliderTrack(RenderObject* o, const PaintInfo& pi,
     QStyleOptionSlider option;
     if (p.widget)
        option.initFrom(p.widget);
+    option.subControls = QStyle::SC_SliderGroove | QStyle::SC_SliderHandle;
     ControlPart appearance = initializeCommonQStyleOptions(option, o);
 
     RenderSlider* renderSlider = toRenderSlider(o);
diff --git a/WebCore/platform/sql/SQLiteDatabase.cpp b/WebCore/platform/sql/SQLiteDatabase.cpp
index 80d3946..b9e7639 100644
--- a/WebCore/platform/sql/SQLiteDatabase.cpp
+++ b/WebCore/platform/sql/SQLiteDatabase.cpp
@@ -34,6 +34,7 @@
 #include <sqlite3.h>
 #include <wtf/Threading.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -64,8 +65,7 @@ bool SQLiteDatabase::open(const String& filename, bool forWebSQLDatabase)
 {
     close();
 
-    m_lastError = SQLiteFileSystem::openDatabase(filename, &m_db, forWebSQLDatabase);
-    if (m_lastError != SQLITE_OK) {
+    if (SQLiteFileSystem::openDatabase(filename, &m_db, forWebSQLDatabase) != SQLITE_OK) {
         LOG_ERROR("SQLite database failed to load from %s\nCause - %s", filename.ascii().data(),
             sqlite3_errmsg(m_db));
         sqlite3_close(m_db);
@@ -100,6 +100,7 @@ void SQLiteDatabase::close()
 
 void SQLiteDatabase::interrupt()
 {
+#if !ENABLE(SINGLE_THREADED)
     m_interrupted = true;
     while (!m_lockingMutex.tryLock()) {
         MutexLocker locker(m_databaseClosingMutex);
@@ -110,6 +111,7 @@ void SQLiteDatabase::interrupt()
     }
 
     m_lockingMutex.unlock();
+#endif
 }
 
 bool SQLiteDatabase::isInterrupted()
@@ -217,7 +219,7 @@ int64_t SQLiteDatabase::totalSize()
 
 void SQLiteDatabase::setSynchronous(SynchronousPragma sync)
 {
-    executeCommand(String::format("PRAGMA synchronous = %i", sync));
+    executeCommand(makeString("PRAGMA synchronous = ", String::number(sync)));
 }
 
 void SQLiteDatabase::setBusyTimeout(int ms)
diff --git a/WebCore/platform/sql/SQLiteDatabase.h b/WebCore/platform/sql/SQLiteDatabase.h
index 8151380..c329273 100644
--- a/WebCore/platform/sql/SQLiteDatabase.h
+++ b/WebCore/platform/sql/SQLiteDatabase.h
@@ -139,7 +139,6 @@ private:
     int pageSize();
     
     sqlite3* m_db;
-    int m_lastError;
     int m_pageSize;
     
     bool m_transactionInProgress;
diff --git a/WebCore/platform/text/Base64.cpp b/WebCore/platform/text/Base64.cpp
index cc22cf8..98b537a 100644
--- a/WebCore/platform/text/Base64.cpp
+++ b/WebCore/platform/text/Base64.cpp
@@ -2,6 +2,7 @@
    Copyright (C) 2000-2001 Dawit Alemayehu <adawit@kde.org>
    Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
    Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+   Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
 
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU Lesser General Public License (LGPL)
@@ -25,6 +26,7 @@
 
 #include <limits.h>
 #include <wtf/StringExtras.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebCore {
 
@@ -70,7 +72,7 @@ void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insert
         return;
 
     // If the input string is pathologically large, just return nothing.
-    // Note: Keep this in sync with the "out_len" computation below.
+    // Note: Keep this in sync with the "outLength" computation below.
     // Rather than being perfectly precise, this is a bit conservative.
     const unsigned maxInputBufferSize = UINT_MAX / 77 * 76 / 4 * 3 - 2;
     if (len > maxInputBufferSize)
@@ -79,21 +81,21 @@ void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insert
     unsigned sidx = 0;
     unsigned didx = 0;
 
-    unsigned out_len = ((len + 2) / 3) * 4;
+    unsigned outLength = ((len + 2) / 3) * 4;
 
     // Deal with the 76 character per line limit specified in RFC 2045.
-    insertLFs = (insertLFs && out_len > 76);
+    insertLFs = (insertLFs && outLength > 76);
     if (insertLFs)
-        out_len += ((out_len - 1) / 76);
+        outLength += ((outLength - 1) / 76);
 
     int count = 0;
-    out.grow(out_len);
+    out.grow(outLength);
 
     // 3-byte to 4-byte conversion + 0-63 to ascii printable conversion
     if (len > 1) {
         while (sidx < len - 2) {
             if (insertLFs) {
-                if (count && (count % 76) == 0)
+                if (count && !(count % 76))
                     out[didx++] = '\n';
                 count += 4;
             }
@@ -106,7 +108,7 @@ void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insert
     }
 
     if (sidx < len) {
-        if (insertLFs && (count > 0) && (count % 76) == 0)
+        if (insertLFs && (count > 0) && !(count % 76))
            out[didx++] = '\n';
 
         out[didx++] = base64EncMap[(data[sidx] >> 2) & 077];
@@ -124,7 +126,7 @@ void base64Encode(const char* data, unsigned len, Vector<char>& out, bool insert
     }
 }
 
-bool base64Decode(const Vector<char>& in, Vector<char>& out)
+bool base64Decode(const Vector<char>& in, Vector<char>& out, Base64DecodePolicy policy)
 {
     out.clear();
 
@@ -132,36 +134,49 @@ bool base64Decode(const Vector<char>& in, Vector<char>& out)
     if (in.size() > UINT_MAX)
         return false;
 
-    return base64Decode(in.data(), in.size(), out);
+    return base64Decode(in.data(), in.size(), out, policy);
 }
 
-bool base64Decode(const char* data, unsigned len, Vector<char>& out)
+template<typename T>
+static inline bool base64DecodeInternal(const T* data, unsigned len, Vector<char>& out, Base64DecodePolicy policy)
 {
     out.clear();
-    if (len == 0)
+    if (!len)
         return true;
 
-    while (len && data[len-1] == '=')
-        --len;
-
     out.grow(len);
+
+    bool sawEqualsSign = false;
+    unsigned outLength = 0;
     for (unsigned idx = 0; idx < len; idx++) {
-        unsigned char ch = data[idx];
-        if ((ch > 47 && ch < 58) || (ch > 64 && ch < 91) || (ch > 96 && ch < 123) || ch == '+' || ch == '/' || ch == '=')
-            out[idx] = base64DecMap[ch];
-        else
+        unsigned ch = data[idx];
+        if (ch == '=')
+            sawEqualsSign = true;
+        else if (('0' <= ch && ch <= '9') || ('A' <= ch && ch <= 'Z') || ('a' <= ch && ch <= 'z') || ch == '+' || ch == '/') {
+            if (sawEqualsSign)
+                return false;
+            out[outLength] = base64DecMap[ch];
+            outLength++;
+        } else if (policy == FailOnInvalidCharacter || (policy == IgnoreWhitespace && !isSpaceOrNewline(ch)))
             return false;
     }
 
+    if (!outLength)
+        return !sawEqualsSign;
+
+    // Valid data is (n * 4 + [0,2,3]) characters long.
+    if ((outLength % 4) == 1)
+        return false;
+    
     // 4-byte to 3-byte conversion
-    unsigned outLen = len - ((len + 3) / 4);
-    if (!outLen || ((outLen + 2) / 3) * 4 < len)
+    outLength -= (outLength + 3) / 4;
+    if (!outLength)
         return false;
 
     unsigned sidx = 0;
     unsigned didx = 0;
-    if (outLen > 1) {
-        while (didx < outLen - 2) {
+    if (outLength > 1) {
+        while (didx < outLength - 2) {
             out[didx] = (((out[sidx] << 2) & 255) | ((out[sidx + 1] >> 4) & 003));
             out[didx + 1] = (((out[sidx + 1] << 4) & 255) | ((out[sidx + 2] >> 2) & 017));
             out[didx + 2] = (((out[sidx + 2] << 6) & 255) | (out[sidx + 3] & 077));
@@ -170,16 +185,26 @@ bool base64Decode(const char* data, unsigned len, Vector<char>& out)
         }
     }
 
-    if (didx < outLen)
+    if (didx < outLength)
         out[didx] = (((out[sidx] << 2) & 255) | ((out[sidx + 1] >> 4) & 003));
 
-    if (++didx < outLen)
+    if (++didx < outLength)
         out[didx] = (((out[sidx + 1] << 4) & 255) | ((out[sidx + 2] >> 2) & 017));
 
-    if (outLen < out.size())
-        out.shrink(outLen);
+    if (outLength < out.size())
+        out.shrink(outLength);
 
     return true;
 }
 
+bool base64Decode(const char* data, unsigned len, Vector<char>& out, Base64DecodePolicy policy)
+{
+    return base64DecodeInternal<char>(data, len, out, policy);
 }
+
+bool base64Decode(const String& in, Vector<char>& out, Base64DecodePolicy policy)
+{
+    return base64DecodeInternal<UChar>(in.characters(), in.length(), out, policy);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/text/Base64.h b/WebCore/platform/text/Base64.h
index 53b29b0..211bd3c 100644
--- a/WebCore/platform/text/Base64.h
+++ b/WebCore/platform/text/Base64.h
@@ -1,5 +1,6 @@
 /*
- * Copyright (C) 2006 Alexey Proskuryakov (ap@webkit.org)
+ * Copyright (C) 2006 Alexey Proskuryakov <ap@webkit.org>
+ * Copyright (C) 2010 Patrick Gansterer <paroga@paroga.com>
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,16 +27,19 @@
 #ifndef Base64_h
 #define Base64_h
 
+#include <wtf/Forward.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
+enum Base64DecodePolicy { FailOnInvalidCharacter, IgnoreWhitespace, IgnoreInvalidCharacters };
+
 void base64Encode(const Vector<char>&, Vector<char>&, bool insertLFs = false);
 void base64Encode(const char*, unsigned, Vector<char>&, bool insertLFs = false);
 
-// this decoder is not general purpose - it returns an error if it encounters a linefeed, as needed for window.atob
-bool base64Decode(const Vector<char>&, Vector<char>&);
-bool base64Decode(const char*, unsigned, Vector<char>&);
+bool base64Decode(const String&, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
+bool base64Decode(const Vector<char>&, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
+bool base64Decode(const char*, unsigned, Vector<char>&, Base64DecodePolicy = FailOnInvalidCharacter);
 
 }
 
diff --git a/WebCore/platform/text/LineEnding.cpp b/WebCore/platform/text/LineEnding.cpp
index 545f22b..00a90eb 100644
--- a/WebCore/platform/text/LineEnding.cpp
+++ b/WebCore/platform/text/LineEnding.cpp
@@ -35,12 +35,69 @@
 #include "PlatformString.h"
 #include <wtf/text/CString.h>
 
-namespace WebCore {
+namespace {
 
-// Normalize all line-endings to CRLF.
-CString normalizeLineEndingsToCRLF(const CString& from)
+class OutputBuffer {
+public:
+    virtual char* allocate(size_t size) = 0;
+    virtual void copy(const CString&) = 0;
+    virtual ~OutputBuffer() { }
+};
+
+class CStringBuffer : public OutputBuffer {
+public:
+    CStringBuffer(CString& buffer)
+        : m_buffer(buffer)
+    {
+    }
+    virtual ~CStringBuffer() { }
+
+    virtual char* allocate(size_t size)
+    {
+        char* ptr;
+        m_buffer = CString::newUninitialized(size, ptr);
+        return ptr;
+    }
+
+    virtual void copy(const CString& source)
+    {
+        m_buffer = source;
+    }
+
+    const CString& buffer() const { return m_buffer; }
+
+private:
+    CString m_buffer;
+};
+
+class VectorCharAppendBuffer : public OutputBuffer {
+public:
+    VectorCharAppendBuffer(Vector<char>& buffer)
+        : m_buffer(buffer)
+    {
+    }
+    virtual ~VectorCharAppendBuffer() { }
+
+    virtual char* allocate(size_t size)
+    {
+        size_t oldSize = m_buffer.size();
+        m_buffer.grow(oldSize + size);
+        return m_buffer.data() + oldSize;
+    }
+
+    virtual void copy(const CString& source)
+    {
+        m_buffer.append(source.data(), source.length());
+    }
+
+private:
+    Vector<char>& m_buffer;
+};
+
+void internalNormalizeLineEndingsToCRLF(const CString& from, OutputBuffer& buffer)
 {
-    unsigned newLen = 0;
+    // Compute the new length.
+    size_t newLen = 0;
     const char* p = from.data();
     while (char c = *p++) {
         if (c == '\r') {
@@ -57,13 +114,18 @@ CString normalizeLineEndingsToCRLF(const CString& from)
             newLen += 1;
         }
     }
-    if (newLen == from.length())
-        return from;
+    if (newLen < from.length())
+        return;
+
+    if (newLen == from.length()) {
+        buffer.copy(from);
+        return;
+    }
 
-    // Make a copy of the string.
     p = from.data();
-    char* q;
-    CString result = CString::newUninitialized(newLen, q);
+    char* q = buffer.allocate(newLen);
+
+    // Make a copy of the string.
     while (char c = *p++) {
         if (c == '\r') {
             // Safe to look ahead because of trailing '\0'.
@@ -81,13 +143,19 @@ CString normalizeLineEndingsToCRLF(const CString& from)
             *q++ = c;
         }
     }
-    return result;
 }
 
+};
+
+namespace WebCore {
+
+void normalizeToCROrLF(const CString& from, Vector<char>& result, bool toCR);
+
 // Normalize all line-endings to CR or LF.
-static CString normalizeToCROrLF(const CString& from, bool toCR)
+void normalizeToCROrLF(const CString& from, Vector<char>& result, bool toCR)
 {
-    unsigned newLen = 0;
+    // Compute the new length.
+    size_t newLen = 0;
     bool needFix = false;
     const char* p = from.data();
     char fromEndingChar = toCR ? '\n' : '\r';
@@ -103,13 +171,20 @@ static CString normalizeToCROrLF(const CString& from, bool toCR)
         }
         newLen += 1;
     }
-    if (!needFix)
-        return from;
 
-    // Make a copy of the string.
+    // Grow the result buffer.
     p = from.data();
-    char* q;
-    CString result = CString::newUninitialized(newLen, q);
+    size_t oldResultSize = result.size();
+    result.grow(oldResultSize + newLen);
+    char* q = result.data() + oldResultSize;
+
+    // If no need to fix the string, just copy the string over.
+    if (!needFix) {
+        memcpy(q, p, from.length());
+        return;
+    }
+
+    // Make a copy of the string.
     while (char c = *p++) {
         if (c == '\r' && *p == '\n') {
             // Turn CRLF or CR into CR or LF.
@@ -123,27 +198,33 @@ static CString normalizeToCROrLF(const CString& from, bool toCR)
             *q++ = c;
         }
     }
-    return result;
 }
 
-// Normalize all line-endings to CR.
-CString normalizeLineEndingsToCR(const CString& from)
+CString normalizeLineEndingsToCRLF(const CString& from)
+{
+    CString result;
+    CStringBuffer buffer(result);
+    internalNormalizeLineEndingsToCRLF(from, buffer);
+    return buffer.buffer();
+}
+
+void normalizeLineEndingsToCR(const CString& from, Vector<char>& result)
 {
-    return normalizeToCROrLF(from, true);
+    normalizeToCROrLF(from, result, true);
 }
 
-// Normalize all line-endings to LF.
-CString normalizeLineEndingsToLF(const CString& from)
+void normalizeLineEndingsToLF(const CString& from, Vector<char>& result)
 {
-    return normalizeToCROrLF(from, false);
+    normalizeToCROrLF(from, result, false);
 }
 
-CString normalizeLineEndingsToNative(const CString& from)
+void normalizeLineEndingsToNative(const CString& from, Vector<char>& result)
 {
 #if OS(WINDOWS)
-    return normalizeLineEndingsToCRLF(from);
+    VectorCharAppendBuffer buffer(result);
+    internalNormalizeLineEndingsToCRLF(from, buffer);
 #else
-    return normalizeLineEndingsToLF(from);
+    normalizeLineEndingsToLF(from, result);
 #endif
 }
 
diff --git a/WebCore/platform/text/LineEnding.h b/WebCore/platform/text/LineEnding.h
index ab8d6ee..4306ce8 100644
--- a/WebCore/platform/text/LineEnding.h
+++ b/WebCore/platform/text/LineEnding.h
@@ -33,25 +33,22 @@
 #define LineEnding_h
 
 #include <wtf/Forward.h>
-
-namespace WTF {
-class CString;
-}
+#include <wtf/Vector.h>
 
 namespace WebCore {
 
 // Normalize all line-endings in the given string to CRLF.
-WTF::CString normalizeLineEndingsToCRLF(const WTF::CString&);
+CString normalizeLineEndingsToCRLF(const CString& from);
 
-// Normalize all line-endings in the given string to CR.
-WTF::CString normalizeLineEndingsToCR(const WTF::CString&);
+// Normalize all line-endings in the given string to CR and append the result to the given buffer.
+void normalizeLineEndingsToCR(const CString& from, Vector<char>& result);
 
-// Normalize all line-endings in the given string to LF.
-WTF::CString normalizeLineEndingsToLF(const WTF::CString&);
+// Normalize all line-endings in the given string to LF and append the result to the given buffer.
+void normalizeLineEndingsToLF(const CString& from, Vector<char>& result);
 
-// Normalize all line-endings in the given string to the native line-endings.
+// Normalize all line-endings in the given string to the native line-endings and append the result to the given buffer.
 // (Normalize to CRLF on Windows and normalize to LF on all other platforms.)
-WTF::CString normalizeLineEndingsToNative(const WTF::CString&);
+void normalizeLineEndingsToNative(const CString& from, Vector<char>& result);
 
 } // namespace WebCore
 
diff --git a/WebCore/platform/text/StringBuilder.cpp b/WebCore/platform/text/StringBuilder.cpp
deleted file mode 100644
index 1c47129..0000000
--- a/WebCore/platform/text/StringBuilder.cpp
+++ /dev/null
@@ -1,132 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
- 
-#include "config.h"
-#include "StringBuilder.h"
-
-#include <wtf/text/StringBuffer.h>
-
-namespace WebCore {
-
-void StringBuilder::append(const String& string)
-{
-    if (string.isNull())
-        return;
-
-    if (m_totalLength == UINT_MAX)
-        m_totalLength = string.length();
-    else
-        m_totalLength += string.length();
-
-    if (!string.isEmpty())
-        m_strings.append(string);
-}
-
-void StringBuilder::append(UChar c)
-{
-    if (m_totalLength == UINT_MAX)
-        m_totalLength = 1;
-    else
-        m_totalLength += 1;
-
-    m_strings.append(String(&c, 1));
-}
-
-void StringBuilder::append(char c)
-{
-    if (m_totalLength == UINT_MAX)
-        m_totalLength = 1;
-    else
-        m_totalLength += 1;
-
-    m_strings.append(String(&c, 1));
-}
-
-String StringBuilder::toString(ConcatMode mode) const
-{
-    if (isNull())
-        return String();
-
-    unsigned count = m_strings.size();
-
-    if (!count)
-        return String(StringImpl::empty());
-    if (count == 1)
-        return m_strings[0];
-
-    UChar* buffer;
-    unsigned totalLength = m_totalLength;
-    if (mode == ConcatAddingSpacesBetweenIndividualStrings)
-        totalLength += count - 1;
-    String result = String::createUninitialized(totalLength, buffer);
-
-    UChar* p = buffer;
-
-    // We could handle both Concat modes in a single for loop, not doing that for performance reasons.
-    if (mode == ConcatUnaltered) {
-        for (unsigned i = 0; i < count; ++i) {
-            StringImpl* string = m_strings[i].impl();
-            unsigned length = string->length(); 
-            memcpy(p, string->characters(), length * 2);
-            p += length;
-        }
-    } else {
-        ASSERT(mode == ConcatAddingSpacesBetweenIndividualStrings);
-        for (unsigned i = 0; i < count; ++i) {
-            StringImpl* string = m_strings[i].impl();
-            unsigned length = string->length(); 
-            memcpy(p, string->characters(), length * 2);
-            p += length;
-
-            // Add space after string before the start of the next string, if we're not processing the last string.
-            if (i < count - 1) {
-                *p = ' ';
-                ++p;
-            }
-        }
-    }
-    ASSERT(p == totalLength + buffer);
-
-    return result;
-}
-
-void StringBuilder::clear()
-{
-    m_totalLength = UINT_MAX;
-    m_strings.clear();
-}
-
-unsigned StringBuilder::length() const
-{
-    if (m_totalLength == UINT_MAX)
-        return 0;
-    return m_totalLength;
-}
-
-}
diff --git a/WebCore/platform/text/TextEncoding.cpp b/WebCore/platform/text/TextEncoding.cpp
index 29ae170..921ceeb 100644
--- a/WebCore/platform/text/TextEncoding.cpp
+++ b/WebCore/platform/text/TextEncoding.cpp
@@ -133,6 +133,10 @@ CString TextEncoding::encode(const UChar* characters, size_t length, Unencodable
     // normalization will be done by Windows CE API
     OwnPtr<TextCodec> textCodec = newTextCodec(*this);
     return textCodec.get() ? textCodec->encode(characters, length, handling) : CString();
+#elif USE(BREWMP_UNICODE)
+    // FIXME: not sure if Brew MP normalizes the input string automatically
+    OwnPtr<TextCodec> textCodec = newTextCodec(*this);
+    return textCodec.get() ? textCodec->encode(characters, length, handling) : CString();
 #endif
 }
 
diff --git a/WebCore/platform/text/TextEncodingRegistry.cpp b/WebCore/platform/text/TextEncodingRegistry.cpp
index 40fcdc5..fbe5826 100644
--- a/WebCore/platform/text/TextEncodingRegistry.cpp
+++ b/WebCore/platform/text/TextEncodingRegistry.cpp
@@ -31,6 +31,7 @@
 #include "TextCodecLatin1.h"
 #include "TextCodecUserDefined.h"
 #include "TextCodecUTF16.h"
+#include "TextEncoding.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/HashFunctions.h>
@@ -51,6 +52,9 @@
 #if USE(GLIB_UNICODE)
 #include "gtk/TextCodecGtk.h"
 #endif
+#if USE(BREWMP_UNICODE)
+#include "brew/TextCodecBrew.h"
+#endif
 #if OS(WINCE) && !PLATFORM(QT)
 #include "TextCodecWinCE.h"
 #endif
@@ -235,6 +239,11 @@ static void buildBaseTextCodecMaps()
     TextCodecGtk::registerBaseCodecs(addToTextCodecMap);
 #endif
 
+#if USE(BREWMP_UNICODE)
+    TextCodecBrew::registerBaseEncodingNames(addToTextEncodingNameMap);
+    TextCodecBrew::registerBaseCodecs(addToTextCodecMap);
+#endif
+
 #if OS(WINCE) && !PLATFORM(QT)
     TextCodecWinCE::registerBaseEncodingNames(addToTextEncodingNameMap);
     TextCodecWinCE::registerBaseCodecs(addToTextCodecMap);
diff --git a/WebCore/platform/text/brew/TextBoundariesBrew.cpp b/WebCore/platform/text/brew/TextBoundariesBrew.cpp
new file mode 100644
index 0000000..506bdcf
--- /dev/null
+++ b/WebCore/platform/text/brew/TextBoundariesBrew.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2006 Zack Rusin <zack@kde.org>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "TextBoundaries.h"
+
+#include "NotImplemented.h"
+#include "PlatformString.h"
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+int findNextWordFromIndex(const UChar* buffer, int len, int position, bool forward)
+{
+    notImplemented();
+    return 0;
+}
+
+void findWordBoundary(const UChar* buffer, int len, int position, int* start, int* end)
+{
+    if (position > len) {
+        *start = 0;
+        *end = 0;
+        return;
+    }
+
+    String str(buffer, len);
+
+    int currentPosition = position - 1;
+    String foundWord;
+    while (currentPosition >= 0 && isLetter(str[currentPosition])) {
+        UChar c = str[currentPosition];
+        foundWord.insert(&c, 1, 0);
+        --currentPosition;
+    }
+
+    // currentPosition == 0 means the first char is not letter
+    // currentPosition == -1 means we reached the beginning
+    int startPos = (currentPosition < 0) ? 0 : ++currentPosition;
+    currentPosition = position;
+    while (isLetter(str[currentPosition])) {
+        foundWord.append(str[currentPosition]);
+        ++currentPosition;
+    }
+
+    *start = startPos;
+    *end = currentPosition;
+}
+
+}
diff --git a/WebCore/platform/text/brew/TextBreakIteratorBrew.cpp b/WebCore/platform/text/brew/TextBreakIteratorBrew.cpp
new file mode 100644
index 0000000..7f46e4f
--- /dev/null
+++ b/WebCore/platform/text/brew/TextBreakIteratorBrew.cpp
@@ -0,0 +1,312 @@
+/*
+ * Copyright (C) 2006 Lars Knoll <lars@trolltech.com>
+ * Copyright (C) 2007-2009 Torch Mobile, Inc.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 59 Temple Place - Suite 330,
+ * Boston, MA 02111-1307, USA.
+ *
+ */
+
+#include "config.h"
+#include "TextBreakIterator.h"
+
+#include "PlatformString.h"
+#include <wtf/StdLibExtras.h>
+#include <wtf/unicode/Unicode.h>
+
+using namespace WTF::Unicode;
+
+namespace WebCore {
+
+// Hack, not entirely correct
+static inline bool isCharStop(UChar c)
+{
+    CharCategory charCategory = category(c);
+    return charCategory != Mark_NonSpacing && (charCategory != Other_Surrogate || (c < 0xd800 || c >= 0xdc00));
+}
+
+static inline bool isLineStop(UChar c)
+{
+    return category(c) != Separator_Line;
+}
+
+static inline bool isSentenceStop(UChar c)
+{
+    return isPunct(c);
+}
+
+class TextBreakIterator {
+public:
+    void reset(const UChar* str, int len)
+    {
+        string = str;
+        length = len;
+        currentPos = 0;
+    }
+    virtual int first() = 0;
+    virtual int next() = 0;
+    virtual int previous() = 0;
+    int following(int position)
+    {
+        currentPos = position;
+        return next();
+    }
+    int preceding(int position)
+    {
+        currentPos = position;
+        return previous();
+    }
+
+    int currentPos;
+    const UChar* string;
+    int length;
+};
+
+struct WordBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct CharBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct LineBreakIterator: TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+struct SentenceBreakIterator : TextBreakIterator {
+    virtual int first();
+    virtual int next();
+    virtual int previous();
+};
+
+int WordBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int WordBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int WordBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSpace(string[currentPos]))
+            break;
+        if (isSpace(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int CharBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int CharBreakIterator::next()
+{
+    if (currentPos >= length)
+        return -1;
+    ++currentPos;
+    while (currentPos < length && !isCharStop(string[currentPos]))
+        ++currentPos;
+    return currentPos;
+}
+
+int CharBreakIterator::previous()
+{
+    if (currentPos <= 0)
+        return -1;
+    if (currentPos > length)
+        currentPos = length;
+    --currentPos;
+    while (currentPos > 0 && !isCharStop(string[currentPos]))
+        --currentPos;
+    return currentPos;
+}
+
+int LineBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int LineBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int LineBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isLineStop(string[currentPos]))
+            break;
+        if (isLineStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::first()
+{
+    currentPos = 0;
+    return currentPos;
+}
+
+int SentenceBreakIterator::next()
+{
+    if (currentPos == length) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos < length) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        ++currentPos;
+    }
+    return currentPos;
+}
+
+int SentenceBreakIterator::previous()
+{
+    if (!currentPos) {
+        currentPos = -1;
+        return currentPos;
+    }
+    bool haveSpace = false;
+    while (currentPos > 0) {
+        if (haveSpace && !isSentenceStop(string[currentPos]))
+            break;
+        if (isSentenceStop(string[currentPos]))
+            haveSpace = true;
+        --currentPos;
+    }
+    return currentPos;
+}
+
+TextBreakIterator* wordBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(WordBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* characterBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(CharBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* lineBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(LineBreakIterator , iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+TextBreakIterator* sentenceBreakIterator(const UChar* string, int length)
+{
+    DEFINE_STATIC_LOCAL(SentenceBreakIterator, iterator, ());
+    iterator.reset(string, length);
+    return &iterator;
+}
+
+int textBreakFirst(TextBreakIterator* breakIterator)
+{
+    return breakIterator->first();
+}
+
+int textBreakNext(TextBreakIterator* breakIterator)
+{
+    return breakIterator->next();
+}
+
+int textBreakPreceding(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->preceding(position);
+}
+
+int textBreakFollowing(TextBreakIterator* breakIterator, int position)
+{
+    return breakIterator->following(position);
+}
+
+int textBreakCurrent(TextBreakIterator* breakIterator)
+{
+    return breakIterator->currentPos;
+}
+
+bool isTextBreak(TextBreakIterator*, int)
+{
+    return true;
+}
+
+TextBreakIterator* cursorMovementIterator(const UChar* string, int length)
+{
+    return characterBreakIterator(string, length);
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/text/brew/TextCodecBrew.cpp b/WebCore/platform/text/brew/TextCodecBrew.cpp
new file mode 100644
index 0000000..1f32298
--- /dev/null
+++ b/WebCore/platform/text/brew/TextCodecBrew.cpp
@@ -0,0 +1,214 @@
+/*
+ * Copyright (C) 2010 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#include "config.h"
+#include "TextCodecBrew.h"
+
+#include "AEEAppGen.h"
+#include "AEEICharsetConv.h"
+#include "NotImplemented.h"
+#include "PlatformString.h"
+#include <wtf/Assertions.h>
+#include <wtf/text/CString.h>
+
+namespace WebCore {
+
+// FIXME: Not sure if there are Brew MP devices which use big endian.
+const char* WebCore::TextCodecBrew::m_internalEncodingName = "UTF-16LE";
+
+static PassOwnPtr<TextCodec> newTextCodecBrew(const TextEncoding& encoding, const void*)
+{
+    return new TextCodecBrew(encoding);
+}
+
+void TextCodecBrew::registerBaseEncodingNames(EncodingNameRegistrar registrar)
+{
+    registrar("UTF-8", "UTF-8");
+}
+
+void TextCodecBrew::registerBaseCodecs(TextCodecRegistrar registrar)
+{
+    registrar("UTF-8", newTextCodecBrew, 0);
+}
+
+void TextCodecBrew::registerExtendedEncodingNames(EncodingNameRegistrar registrar)
+{
+    // FIXME: Not sure how to enumerate all available encodings.
+    notImplemented();
+}
+
+void TextCodecBrew::registerExtendedCodecs(TextCodecRegistrar registrar)
+{
+    notImplemented();
+}
+
+TextCodecBrew::TextCodecBrew(const TextEncoding& encoding)
+    : m_charsetConverter(0)
+    , m_encoding(encoding)
+    , m_numBufferedBytes(0)
+{
+    String format = String::format("%s>%s", encoding.name(), m_internalEncodingName);
+
+    IShell* shell = reinterpret_cast<AEEApplet*>(GETAPPINSTANCE())->m_pIShell;
+    AEECLSID classID = ISHELL_GetHandler(shell, AEEIID_ICharsetConv, format.latin1().data());
+    ISHELL_CreateInstance(shell, classID, reinterpret_cast<void**>(&m_charsetConverter));
+
+    ASSERT(m_charsetConverter);
+}
+
+TextCodecBrew::~TextCodecBrew()
+{
+    if (m_charsetConverter)
+        ICharsetConv_Release(m_charsetConverter);
+}
+
+String TextCodecBrew::decode(const char* bytes, size_t length, bool flush, bool stopOnError, bool& sawError)
+{
+    int code = ICharsetConv_Initialize(m_charsetConverter, m_encoding.name(), m_internalEncodingName, 0);
+    ASSERT(code == AEE_SUCCESS);
+
+    Vector<UChar> result;
+    Vector<unsigned char> prefixedBytes(length);
+
+    int srcSize;
+    unsigned char* srcBegin;
+
+    if (m_numBufferedBytes) {
+        srcSize = length + m_numBufferedBytes;
+        prefixedBytes.grow(srcSize);
+        memcpy(prefixedBytes.data(), m_bufferedBytes, m_numBufferedBytes);
+        memcpy(prefixedBytes.data() + m_numBufferedBytes, bytes, length);
+
+        srcBegin = prefixedBytes.data();
+
+        // all buffered bytes are consumed now
+        m_numBufferedBytes = 0;
+    } else {
+        srcSize = length;
+        srcBegin = const_cast<unsigned char*>(reinterpret_cast<const unsigned char*>(bytes));
+    }
+
+    unsigned char* src = srcBegin;
+    unsigned char* srcEnd = srcBegin + srcSize;
+
+    Vector<UChar> dstBuffer(srcSize);
+
+    while (src < srcEnd) {
+        int numCharsConverted;
+        unsigned char* dstBegin = reinterpret_cast<unsigned char*>(dstBuffer.data());
+        unsigned char* dst = dstBegin;
+        int dstSize = dstBuffer.size() * sizeof(UChar);
+
+        code = ICharsetConv_CharsetConvert(m_charsetConverter, &src, &srcSize, &dst, &dstSize, &numCharsConverted);
+        ASSERT(code != AEE_ENOSUCH);
+
+        if (code == AEE_EBUFFERTOOSMALL) {
+            // Increase the buffer and try it again.
+            dstBuffer.grow(dstBuffer.size() * 2);
+            continue;
+        }
+
+        if (code == AEE_EBADITEM) {
+            sawError = true;
+            if (stopOnError) {
+                result.append(L'?');
+                break;
+            }
+
+            src++;
+        }
+
+        if (code == AEE_EINCOMPLETEITEM) {
+            if (flush) {
+                LOG_ERROR("Partial bytes at end of input while flush requested.");
+                sawError = true;
+                return String();
+            }
+
+            m_numBufferedBytes = srcEnd - src;
+            memcpy(m_bufferedBytes, src, m_numBufferedBytes);
+            break;
+        }
+
+        int numChars = (dst - dstBegin) / sizeof(UChar);
+        if (numChars > 0)
+            result.append(dstBuffer.data(), numChars);
+    }
+
+    return String::adopt(result);
+}
+
+CString TextCodecBrew::encode(const UChar* characters, size_t length, UnencodableHandling handling)
+{
+    if (!length)
+        return "";
+
+    unsigned int replacementCharacter = '?';
+
+    // FIXME: Impossible to handle EntitiesForUnencodables or URLEncodedEntitiesForUnencodables with ICharsetConv.
+    int code = ICharsetConv_Initialize(m_charsetConverter, m_internalEncodingName, m_encoding.name(), replacementCharacter);
+    ASSERT(code == AEE_SUCCESS);
+
+    Vector<char> result;
+
+    int srcSize = length * sizeof(UChar);
+    unsigned char* srcBegin = const_cast<unsigned char*>(reinterpret_cast<const unsigned char*>(characters));
+    unsigned char* src = srcBegin;
+    unsigned char* srcEnd = srcBegin + srcSize;
+
+    Vector<unsigned char> dstBuffer(length * sizeof(UChar));
+
+    while (src < srcEnd) {
+        int numCharsConverted;
+        unsigned char* dstBegin = dstBuffer.data();
+        unsigned char* dst = dstBegin;
+        int dstSize = dstBuffer.size();
+
+        code = ICharsetConv_CharsetConvert(m_charsetConverter, &src, &srcSize, &dst, &dstSize, &numCharsConverted);
+        ASSERT(code != AEE_EINCOMPLETEITEM);
+
+        if (code == AEE_ENOSUCH) {
+            LOG_ERROR("Conversion error, Code=%d", code);
+            return CString();
+        }
+
+        if (code == AEE_EBUFFERTOOSMALL) {
+            // Increase the buffer and try it again.
+            dstBuffer.grow(dstBuffer.size() * 2);
+            continue;
+        }
+
+        if (code == AEE_EBADITEM)
+            src += sizeof(UChar); // Skip the invalid character
+
+        int numBytes = dst - dstBegin;
+        if (numBytes > 0)
+            result.append(dstBuffer.data(), numBytes);
+    }
+
+    return CString(result.data(), result.size());
+}
+
+} // namespace WebCore
diff --git a/WebCore/platform/text/brew/TextCodecBrew.h b/WebCore/platform/text/brew/TextCodecBrew.h
new file mode 100644
index 0000000..97e2c87
--- /dev/null
+++ b/WebCore/platform/text/brew/TextCodecBrew.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Company 100, Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE COMPUTER, INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE COMPUTER, INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+#ifndef TextCodecBrew_h
+#define TextCodecBrew_h
+
+#include "TextCodec.h"
+#include "TextEncoding.h"
+
+typedef struct ICharsetConv ICharsetConv;
+
+namespace WebCore {
+
+class TextCodecBrew : public TextCodec {
+public:
+    static void registerBaseEncodingNames(EncodingNameRegistrar);
+    static void registerBaseCodecs(TextCodecRegistrar);
+
+    static void registerExtendedEncodingNames(EncodingNameRegistrar);
+    static void registerExtendedCodecs(TextCodecRegistrar);
+
+    TextCodecBrew(const TextEncoding&);
+    virtual ~TextCodecBrew();
+
+    virtual String decode(const char*, size_t length, bool flush, bool stopOnError, bool& sawError);
+    virtual CString encode(const UChar*, size_t length, UnencodableHandling);
+
+private:
+    TextEncoding m_encoding;
+    size_t m_numBufferedBytes;
+    unsigned char m_bufferedBytes[16]; // bigger than any single multi-byte character
+    ICharsetConv* m_charsetConverter;
+
+    static const char* m_internalEncodingName;
+};
+
+} // namespace WebCore
+
+#endif // TextCodecBrew_h
diff --git a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
index dda443f..b9f5a9e 100644
--- a/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
+++ b/WebCore/platform/text/qt/TextBreakIteratorQt.cpp
@@ -33,6 +33,12 @@
 
 namespace WebCore {
 
+#if USE(QT_ICU_TEXT_BREAKING)
+const char* currentTextBreakLocaleID()
+{
+    return QLocale::system().name().toLatin1();
+}
+#else
     static unsigned char buffer[1024];
 
     class TextBreakIterator : public QTextBoundaryFinder {
@@ -135,5 +141,6 @@ namespace WebCore {
     {
         return true;
     }
+#endif
 
 }
diff --git a/WebCore/platform/text/wince/TextCodecWinCE.cpp b/WebCore/platform/text/wince/TextCodecWinCE.cpp
index 499035f..da6d5a5 100644
--- a/WebCore/platform/text/wince/TextCodecWinCE.cpp
+++ b/WebCore/platform/text/wince/TextCodecWinCE.cpp
@@ -33,6 +33,7 @@
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/text/StringHash.h>
 #include <wtf/unicode/UTF8.h>
 
@@ -110,7 +111,7 @@ LanguageManager::LanguageManager()
                 info.m_aliases.append(name);
                 info.m_aliases.append(String(cpInfo.wszHeaderCharset).latin1());
                 info.m_aliases.append(String(cpInfo.wszBodyCharset).latin1());
-                String cpName = String::format("cp%d", cpInfo.uiCodePage);
+                String cpName = makeString("cp", String::number(cpInfo.uiCodePage));
                 info.m_aliases.append(cpName.latin1());
                 supportedCharsets().add(i->second.data());
             }
diff --git a/WebCore/platform/win/ClipboardUtilitiesWin.cpp b/WebCore/platform/win/ClipboardUtilitiesWin.cpp
index 0130a70..19888bf 100644
--- a/WebCore/platform/win/ClipboardUtilitiesWin.cpp
+++ b/WebCore/platform/win/ClipboardUtilitiesWin.cpp
@@ -33,7 +33,9 @@
 #include "markup.h"
 #include <shlwapi.h>
 #include <wininet.h> // for INTERNET_MAX_URL_LENGTH
+#include <wtf/StringExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #if PLATFORM(CF)
 #include <CoreFoundation/CoreFoundation.h>
@@ -239,7 +241,11 @@ void markupToCFHTML(const String& markup, const String& srcURL, Vector<char>& re
     unsigned endFragmentOffset = startFragmentOffset + markupUTF8.length();
     unsigned endHTMLOffset = endFragmentOffset + strlen(endMarkup);
 
-    append(result, String::format(header, startHTMLOffset, endHTMLOffset, startFragmentOffset, endFragmentOffset).utf8());
+    unsigned headerBufferLength = startHTMLOffset + 1; // + 1 for '\0' terminator.
+    char* headerBuffer = (char*)malloc(headerBufferLength);
+    snprintf(headerBuffer, headerBufferLength, header, startHTMLOffset, endHTMLOffset, startFragmentOffset, endFragmentOffset);
+    append(result, CString(headerBuffer));
+    free(headerBuffer);
     if (sourceURLUTF8.length()) {
         append(result, sourceURLPrefix);
         append(result, sourceURLUTF8);
diff --git a/WebCore/platform/win/ClipboardWin.cpp b/WebCore/platform/win/ClipboardWin.cpp
index 529963f..7a54737 100644
--- a/WebCore/platform/win/ClipboardWin.cpp
+++ b/WebCore/platform/win/ClipboardWin.cpp
@@ -38,6 +38,7 @@
 #include "FrameLoader.h"
 #include "FrameView.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "Image.h"
 #include "MIMETypeRegistry.h"
 #include "NotImplemented.h"
@@ -50,7 +51,6 @@
 #include "ResourceResponse.h"
 #include "SharedBuffer.h"
 #include "WCDataObject.h"
-#include "csshelper.h"
 #include "markup.h"
 #include <shlwapi.h>
 #include <wininet.h>
@@ -723,7 +723,7 @@ void ClipboardWin::declareAndWriteDragImage(Element* element, const KURL& url, c
     if (imageURL.isEmpty()) 
         return;
 
-    String fullURL = frame->document()->completeURL(deprecatedParseURL(imageURL)).string();
+    String fullURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(imageURL)).string();
     if (fullURL.isEmpty()) 
         return;
     STGMEDIUM medium = {0};
diff --git a/WebCore/platform/win/Language.cpp b/WebCore/platform/win/LanguageWin.cpp
index 676510b..cafda5d 100644
--- a/WebCore/platform/win/Language.cpp
+++ b/WebCore/platform/win/LanguageWin.cpp
@@ -26,8 +26,7 @@
 #include "config.h"
 #include "Language.h"
 
-#include "PlatformString.h"
-#include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -45,10 +44,11 @@ static String localeInfo(LCTYPE localeType, const String& fallback)
     if (localeName.isEmpty())
         return fallback;
 
+    localeName.truncate(localeName.length() - 1);
     return localeName;
 }
 
-String defaultLanguage()
+String platformDefaultLanguage()
 {
     static String computedDefaultLanguage;
     if (!computedDefaultLanguage.isEmpty())
@@ -60,7 +60,7 @@ String defaultLanguage()
     if (countryName.isEmpty())
         computedDefaultLanguage = languageName;
     else
-        computedDefaultLanguage = String::format("%s-%s", languageName.latin1().data(), countryName.latin1().data());
+        computedDefaultLanguage = makeString(languageName, '-', countryName);
 
     return computedDefaultLanguage;
 }
diff --git a/WebCore/platform/win/PlatformScreenWin.cpp b/WebCore/platform/win/PlatformScreenWin.cpp
index 4af9e17..21fa10d 100644
--- a/WebCore/platform/win/PlatformScreenWin.cpp
+++ b/WebCore/platform/win/PlatformScreenWin.cpp
@@ -68,14 +68,18 @@ static DEVMODE deviceInfoForWidget(Widget* widget)
 int screenDepth(Widget* widget)
 {
     DEVMODE deviceInfo = deviceInfoForWidget(widget);
+    if (deviceInfo.dmBitsPerPel == 32) {
+        // Some video drivers return 32, but this function is supposed to ignore the alpha
+        // component. See <http://webkit.org/b/42972>.
+        return 24;
+    }
     return deviceInfo.dmBitsPerPel;
 }
 
 int screenDepthPerComponent(Widget* widget)
 {
     // FIXME: Assumes RGB -- not sure if this is right.
-    DEVMODE deviceInfo = deviceInfoForWidget(widget);
-    return deviceInfo.dmBitsPerPel / 3;
+    return screenDepth(widget) / 3;
 }
 
 bool screenIsMonochrome(Widget* widget)
diff --git a/WebCore/platform/win/PopupMenuWin.cpp b/WebCore/platform/win/PopupMenuWin.cpp
index a782b03..e86aef9 100644
--- a/WebCore/platform/win/PopupMenuWin.cpp
+++ b/WebCore/platform/win/PopupMenuWin.cpp
@@ -619,11 +619,11 @@ void PopupMenuWin::paint(const IntRect& damageRect, HDC hdc)
 
         // Draw the background for this menu item
         if (itemStyle.isVisible())
-            context.fillRect(itemRect, optionBackgroundColor, DeviceColorSpace);
+            context.fillRect(itemRect, optionBackgroundColor, ColorSpaceDeviceRGB);
 
         if (client()->itemIsSeparator(index)) {
             IntRect separatorRect(itemRect.x() + separatorPadding, itemRect.y() + (itemRect.height() - separatorHeight) / 2, itemRect.width() - 2 * separatorPadding, separatorHeight);
-            context.fillRect(separatorRect, optionTextColor, DeviceColorSpace);
+            context.fillRect(separatorRect, optionTextColor, ColorSpaceDeviceRGB);
             continue;
         }
 
@@ -633,7 +633,7 @@ void PopupMenuWin::paint(const IntRect& damageRect, HDC hdc)
         const UChar* string = itemText.characters();
         TextRun textRun(string, length, false, 0, 0, itemText.defaultWritingDirection() == WTF::Unicode::RightToLeft);
 
-        context.setFillColor(optionTextColor, DeviceColorSpace);
+        context.setFillColor(optionTextColor, ColorSpaceDeviceRGB);
         
         Font itemFont = client()->menuStyle().font();
         if (client()->itemIsLabel(index)) {
diff --git a/WebCore/platform/win/WebCoreTextRenderer.cpp b/WebCore/platform/win/WebCoreTextRenderer.cpp
index f771e00..a32fa4f 100644
--- a/WebCore/platform/win/WebCoreTextRenderer.cpp
+++ b/WebCore/platform/win/WebCoreTextRenderer.cpp
@@ -49,7 +49,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
 {
     TextRun run(text.characters(), text.length());
 
-    context.setFillColor(color, DeviceColorSpace);
+    context.setFillColor(color, ColorSpaceDeviceRGB);
     if (isOneLeftToRightRun(run))
         font.drawText(&context, run, point);
     else
@@ -71,7 +71,7 @@ static void doDrawTextAtPoint(GraphicsContext& context, const String& text, cons
         IntPoint underlinePoint(point);
         underlinePoint.move(beforeWidth, 1);
 
-        context.setStrokeColor(color, DeviceColorSpace);
+        context.setStrokeColor(color, ColorSpaceDeviceRGB);
         context.drawLineForText(underlinePoint, underlinedWidth, false);
     }
 }
diff --git a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
index 82259f4..56a5d07 100644
--- a/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
+++ b/WebCore/platform/wx/wxcode/mac/carbon/non-kerned-drawing.cpp
@@ -48,7 +48,7 @@ void drawTextWithSpacing(GraphicsContext* graphicsContext, const SimpleFontData*
     wxGCDC* dc = static_cast<wxGCDC*>(graphicsContext->platformContext());
 
     wxFont* wxfont = font->getWxFont();
-    graphicsContext->setFillColor(graphicsContext->fillColor(), DeviceColorSpace);
+    graphicsContext->setFillColor(graphicsContext->fillColor(), ColorSpaceDeviceRGB);
 
     CGContextRef cgContext = static_cast<CGContextRef>(dc->GetGraphicsContext()->GetNativeContext());
 
diff --git a/WebCore/plugins/DOMMimeType.cpp b/WebCore/plugins/DOMMimeType.cpp
index e1fa7f1..e799314 100644
--- a/WebCore/plugins/DOMMimeType.cpp
+++ b/WebCore/plugins/DOMMimeType.cpp
@@ -25,7 +25,7 @@
 #include "Page.h"
 #include "PluginData.h"
 #include "Settings.h"
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
diff --git a/WebCore/plugins/PluginDebug.cpp b/WebCore/plugins/PluginDebug.cpp
index ace8b21..8c3efcb 100644
--- a/WebCore/plugins/PluginDebug.cpp
+++ b/WebCore/plugins/PluginDebug.cpp
@@ -163,6 +163,14 @@ CString prettyNameForNPPVariable(NPPVariable variable, void* value)
     }
 }
 
+CString prettyNameForNPNURLVariable(NPNURLVariable variable)
+{
+    switch (variable) {
+    case NPNURLVCookie: return "NPNURLVCookie";
+    case NPNURLVProxy: return "NPNURLVProxy";
+    default: return "Unknown variable";
+    }
+}
 } // namespace WebCore
 
 #endif // !LOG_DISABLED
diff --git a/WebCore/plugins/PluginDebug.h b/WebCore/plugins/PluginDebug.h
index 254864f..017e686 100644
--- a/WebCore/plugins/PluginDebug.h
+++ b/WebCore/plugins/PluginDebug.h
@@ -41,6 +41,7 @@ const char* prettyNameForNPError(NPError error);
 
 CString prettyNameForNPNVariable(NPNVariable variable);
 CString prettyNameForNPPVariable(NPPVariable variable, void* value);
+CString prettyNameForNPNURLVariable(NPNURLVariable variable);
 
 #ifdef XP_MACOSX
 const char* prettyNameForDrawingModel(NPDrawingModel drawingModel);
diff --git a/WebCore/plugins/PluginPackage.cpp b/WebCore/plugins/PluginPackage.cpp
index bb25312..2e0308b 100644
--- a/WebCore/plugins/PluginPackage.cpp
+++ b/WebCore/plugins/PluginPackage.cpp
@@ -206,9 +206,14 @@ void PluginPackage::determineQuirks(const String& mimeType)
             m_quirks.add(PluginQuirkWantsMozillaUserAgent);
         }
 
-#if PLATFORM(QT) && CPU(X86)
-        // 32-bit Flash will crash on repeated calls to SetWindow in windowed mode
+#if PLATFORM(QT)
+        // Flash will crash on repeated calls to SetWindow in windowed mode
         m_quirks.add(PluginQuirkDontCallSetWindowMoreThanOnce);
+
+#if CPU(X86_64)
+        // 64-bit Flash freezes if right-click is sent in windowless mode
+        m_quirks.add(PluginQuirkIgnoreRightClickInWindowlessMode);
+#endif
 #endif
 
         m_quirks.add(PluginQuirkRequiresDefaultScreenDepth);
@@ -329,6 +334,9 @@ void PluginPackage::initializeBrowserFuncs()
     m_browserFuncs.setexception = _NPN_SetException;
     m_browserFuncs.enumerate = _NPN_Enumerate;
     m_browserFuncs.construct = _NPN_Construct;
+    m_browserFuncs.getvalueforurl = NPN_GetValueForURL;
+    m_browserFuncs.setvalueforurl = NPN_SetValueForURL;
+    m_browserFuncs.getauthenticationinfo = NPN_GetAuthenticationInfo;
 }
 #endif
 
diff --git a/WebCore/plugins/PluginQuirkSet.h b/WebCore/plugins/PluginQuirkSet.h
index 7f52f6a..1a684fe 100644
--- a/WebCore/plugins/PluginQuirkSet.h
+++ b/WebCore/plugins/PluginQuirkSet.h
@@ -47,7 +47,8 @@ namespace WebCore {
         PluginQuirkDontAllowMultipleInstances = 1 << 11,
         PluginQuirkRequiresGtkToolKit = 1 << 12,
         PluginQuirkRequiresDefaultScreenDepth = 1 << 13,
-        PluginQuirkDontCallSetWindowMoreThanOnce = 1 << 14
+        PluginQuirkDontCallSetWindowMoreThanOnce = 1 << 14,
+        PluginQuirkIgnoreRightClickInWindowlessMode = 1 << 15
     };
 
     class PluginQuirkSet {
diff --git a/WebCore/plugins/PluginStream.cpp b/WebCore/plugins/PluginStream.cpp
index 8d7a561..a6486c9 100644
--- a/WebCore/plugins/PluginStream.cpp
+++ b/WebCore/plugins/PluginStream.cpp
@@ -35,6 +35,7 @@
 #include "SubresourceLoader.h"
 #include <StringExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 // We use -2 here because some plugins like to return -1 to indicate error
 // and this way we won't clash with them.
@@ -145,8 +146,7 @@ void PluginStream::startStream()
         Vector<UChar> stringBuilder;
         String separator(": ");
 
-        String statusLine = String::format("HTTP %d OK\n", m_resourceResponse.httpStatusCode());
-
+        String statusLine = makeString("HTTP ", String::number(m_resourceResponse.httpStatusCode()), " OK\n");
         stringBuilder.append(statusLine.characters(), statusLine.length());
 
         HTTPHeaderMap::const_iterator end = m_resourceResponse.httpHeaderFields().end();
diff --git a/WebCore/plugins/PluginView.cpp b/WebCore/plugins/PluginView.cpp
index 2522e0f..ef35579 100644
--- a/WebCore/plugins/PluginView.cpp
+++ b/WebCore/plugins/PluginView.cpp
@@ -32,6 +32,7 @@
 #include "Bridge.h"
 #endif
 #include "Chrome.h"
+#include "CookieJar.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -55,6 +56,7 @@
 #include "PluginDebug.h"
 #include "PluginMainThreadScheduler.h"
 #include "PluginPackage.h"
+#include "ProxyServer.h"
 #include "RenderBox.h"
 #include "RenderObject.h"
 #include "ScriptController.h"
@@ -184,9 +186,9 @@ void PluginView::handleEvent(Event* event)
         handleFocusEvent(true);
 #endif
 #if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
-    else if (event->type() == eventNames().DOMFocusOutEvent || event->type() == eventNames().focusoutEvent)
+    else if (event->type() == eventNames().focusoutEvent)
         handleFocusOutEvent();
-    else if (event->type() == eventNames().DOMFocusInEvent || event->type() == eventNames().focusinEvent)
+    else if (event->type() == eventNames().focusinEvent)
         handleFocusInEvent();
 #endif
 }
@@ -1337,7 +1339,7 @@ void PluginView::paintMissingPluginIcon(GraphicsContext* context, const IntRect&
 
     context->save();
     context->clip(windowClipRect());
-    context->drawImage(nullPluginImage.get(), DeviceColorSpace, imageRect.location());
+    context->drawImage(nullPluginImage.get(), ColorSpaceDeviceRGB, imageRect.location());
     context->restore();
 }
 
@@ -1481,6 +1483,119 @@ NPError PluginView::getValue(NPNVariable variable, void* value)
         return NPERR_GENERIC_ERROR;
     }
 }
+
+static Frame* getFrame(Frame* parentFrame, Element* element)
+{
+    if (parentFrame)
+        return parentFrame;
+    
+    Document* document = element->document();
+    if (!document)
+        document = element->ownerDocument();
+    if (document)
+        return document->frame();
+    
+    return 0;
+}
+
+NPError PluginView::getValueForURL(NPNURLVariable variable, const char* url, char** value, uint32_t* len)
+{
+    LOG(Plugins, "PluginView::getValueForURL(%s)", prettyNameForNPNURLVariable(variable).data());
+
+    NPError result = NPERR_NO_ERROR;
+
+    switch (variable) {
+    case NPNURLVCookie: {
+        KURL u(m_baseURL, url);
+        if (u.isValid()) {
+            Frame* frame = getFrame(parentFrame(), m_element);
+            if (frame) {
+                const CString cookieStr = cookies(frame->document(), u).utf8();
+                if (!cookieStr.isNull()) {
+                    const int size = cookieStr.length();
+                    *value = static_cast<char*>(NPN_MemAlloc(size+1));
+                    if (*value) {
+                        memset(*value, 0, size+1);
+                        memcpy(*value, cookieStr.data(), size+1);
+                        if (len)
+                            *len = size;
+                    } else
+                        result = NPERR_OUT_OF_MEMORY_ERROR;
+                }
+            }
+        } else
+            result = NPERR_INVALID_URL;
+        break;
+    }
+    case NPNURLVProxy: {
+        KURL u(m_baseURL, url);
+        if (u.isValid()) {
+            Frame* frame = getFrame(parentFrame(), m_element);
+            const FrameLoader* frameLoader = frame ? frame->loader() : 0;
+            const NetworkingContext* context = frameLoader ? frameLoader->networkingContext() : 0;
+            const CString proxyStr = toString(proxyServersForURL(u, context)).utf8();
+            if (!proxyStr.isNull()) {
+                const int size = proxyStr.length();
+                *value = static_cast<char*>(NPN_MemAlloc(size+1));
+                if (*value) {
+                    memset(*value, 0, size+1);
+                    memcpy(*value, proxyStr.data(), size+1);
+                    if (len)
+                        *len = size;
+                } else
+                    result = NPERR_OUT_OF_MEMORY_ERROR;
+            }
+        } else
+            result = NPERR_INVALID_URL;
+        break;
+    }
+    default:
+        result = NPERR_GENERIC_ERROR;
+        LOG(Plugins, "PluginView::getValueForURL: %s", prettyNameForNPNURLVariable(variable).data());
+        break;
+    }
+
+    return result;
+}
+
+
+NPError PluginView::setValueForURL(NPNURLVariable variable, const char* url, const char* value, uint32_t len)
+{
+    LOG(Plugins, "PluginView::setValueForURL(%s)", prettyNameForNPNURLVariable(variable).data());
+
+    NPError result = NPERR_NO_ERROR;
+
+    switch (variable) {
+    case NPNURLVCookie: {
+        KURL u(m_baseURL, url);
+        if (u.isValid()) {
+            const String cookieStr = String::fromUTF8(value, len);
+            Frame* frame = getFrame(parentFrame(), m_element);
+            if (frame && !cookieStr.isEmpty())
+                setCookies(frame->document(), u, cookieStr);
+        } else
+            result = NPERR_INVALID_URL;
+        break;
+    }
+    case NPNURLVProxy:
+        LOG(Plugins, "PluginView::setValueForURL(%s): Plugins are NOT allowed to set proxy information.", prettyNameForNPNURLVariable(variable).data());
+        result = NPERR_GENERIC_ERROR;
+        break;
+    default:
+        LOG(Plugins, "PluginView::setValueForURL: %s", prettyNameForNPNURLVariable(variable).data());
+        result = NPERR_GENERIC_ERROR;
+        break;
+    }
+
+    return result;
+}
+
+NPError PluginView::getAuthenticationInfo(const char* protocol, const char* host, int32_t port, const char* scheme, const char* realm, char** username, uint32_t* ulen, char** password, uint32_t* plen)
+{
+    LOG(Plugins, "PluginView::getAuthenticationInfo: protocol=%s, host=%s, port=%d", protocol, host, port);
+    notImplemented();
+    return NPERR_GENERIC_ERROR;
+}
 #endif
 
 void PluginView::privateBrowsingStateChanged(bool privateBrowsingEnabled)
diff --git a/WebCore/plugins/PluginView.h b/WebCore/plugins/PluginView.h
index 3d4e13e..68325cd 100644
--- a/WebCore/plugins/PluginView.h
+++ b/WebCore/plugins/PluginView.h
@@ -32,9 +32,9 @@
 #include "HaltablePlugin.h"
 #include "IntRect.h"
 #include "MediaCanStartListener.h"
+#include "PluginViewBase.h"
 #include "ResourceRequest.h"
 #include "Timer.h"
-#include "Widget.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/OwnPtr.h>
@@ -65,7 +65,8 @@ typedef PlatformWidget PlatformPluginWidget;
 #include <QPixmap>
 #endif
 #endif
-#if PLATFORM(QT) && defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
+#if PLATFORM(QT)
+#include <QGraphicsItem>
 #include <QImage>
 class QPainter;
 #endif
@@ -133,7 +134,7 @@ namespace WebCore {
         virtual void didFail(const ResourceError&) = 0;
     };
 
-    class PluginView : public Widget
+    class PluginView : public PluginViewBase
 #if ENABLE(NETSCAPE_PLUGIN_API)
                      , private PluginStreamClient
 #endif
@@ -181,6 +182,9 @@ namespace WebCore {
         NPError getValue(NPNVariable variable, void* value);
         static NPError getValueStatic(NPNVariable variable, void* value);
         NPError setValue(NPPVariable variable, void* value);
+        NPError getValueForURL(NPNURLVariable variable, const char* url, char** value, uint32_t* len);
+        NPError setValueForURL(NPNURLVariable variable, const char* url, const char* value, uint32_t len);
+        NPError getAuthenticationInfo(const char* protocol, const char* host, int32_t port, const char* scheme, const char* realm, char** username, uint32_t* ulen, char** password, uint32_t* plen);
         void invalidateRect(NPRect*);
         void invalidateRegion(NPRegion);
 #endif
@@ -269,6 +273,14 @@ namespace WebCore {
 #endif
         void keepAlive();
 
+#if USE(ACCELERATED_COMPOSITING)
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API) && PLATFORM(QT)
+        virtual PlatformLayer* platformLayer() const;
+#else
+        virtual PlatformLayer* platformLayer() const { return 0; }
+#endif
+#endif
+
     private:
         PluginView(Frame* parentFrame, const IntSize&, PluginPackage*, Element*, const KURL&, const Vector<String>& paramNames, const Vector<String>& paramValues, const String& mimeType, bool loadManually);
 
@@ -448,11 +460,20 @@ private:
         void initXEvent(XEvent* event);
 #endif
 
-#if PLATFORM(QT) && defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
+#if PLATFORM(QT) 
+#if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
         QImage m_image;
         bool m_renderToImage;
         void paintUsingImageSurfaceExtension(QPainter* painter, const IntRect& exposedRect);
 #endif
+#if defined(XP_UNIX) && ENABLE(NETSCAPE_PLUGIN_API)
+        void paintUsingXPixmap(QPainter* painter, const QRect &exposedRect);
+#if USE(ACCELERATED_COMPOSITING)
+        OwnPtr<PlatformLayer> m_platformLayer;
+        friend class PluginGraphicsLayerQt;
+#endif // USE(ACCELERATED_COMPOSITING)
+#endif
+#endif // PLATFORM(QT)
 
         IntRect m_clipRect; // The clip rect to apply to a windowed plug-in
         IntRect m_windowRect; // Our window rect.
diff --git a/WebCore/plugins/PluginViewBase.h b/WebCore/plugins/PluginViewBase.h
index 4e5fe1a..8dc667a 100644
--- a/WebCore/plugins/PluginViewBase.h
+++ b/WebCore/plugins/PluginViewBase.h
@@ -45,9 +45,10 @@ public:
 #endif
 
     virtual JSC::JSObject* scriptObject(JSC::JSGlobalObject*) { return 0; }
+    virtual void privateBrowsingStateChanged(bool) { }
 
 protected:
-    PluginViewBase(PlatformWidget widget) : Widget(widget) { }
+    PluginViewBase(PlatformWidget widget = 0) : Widget(widget) { }
     
 private:
     virtual bool isPluginViewBase() const { return true; }
diff --git a/WebCore/plugins/gtk/PluginViewGtk.cpp b/WebCore/plugins/gtk/PluginViewGtk.cpp
index bee7821..6954af3 100644
--- a/WebCore/plugins/gtk/PluginViewGtk.cpp
+++ b/WebCore/plugins/gtk/PluginViewGtk.cpp
@@ -137,13 +137,14 @@ void PluginView::updatePluginWidget()
 
 #if defined(XP_UNIX)
     if (!m_isWindowed) {
+        Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
         if (m_drawable)
-            XFreePixmap(GDK_DISPLAY(), m_drawable);
+            XFreePixmap(display, m_drawable);
             
-        m_drawable = XCreatePixmap(GDK_DISPLAY(), getRootWindow(m_parentFrame.get()),
+        m_drawable = XCreatePixmap(display, getRootWindow(m_parentFrame.get()),
                                    m_windowRect.width(), m_windowRect.height(),
                                    ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth);
-        XSync(GDK_DISPLAY(), false); // make sure that the server knows about the Drawable
+        XSync(display, false); // make sure that the server knows about the Drawable
     }
 #endif
 
@@ -187,75 +188,48 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (!m_drawable)
         return;
 
-    const bool syncX = m_pluginDisplay && m_pluginDisplay != GDK_DISPLAY();
+    Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
+    const bool syncX = m_pluginDisplay && m_pluginDisplay != display;
 
     IntRect exposedRect(rect);
     exposedRect.intersect(frameRect());
     exposedRect.move(-frameRect().x(), -frameRect().y());
 
-    Window dummyW;
-    int dummyI;
-    unsigned int dummyUI, actualDepth = 0;
-    XGetGeometry(GDK_DISPLAY(), m_drawable, &dummyW, &dummyI, &dummyI,
-                 &dummyUI, &dummyUI, &dummyUI, &actualDepth);
-
-    const unsigned int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
-    ASSERT(drawableDepth == actualDepth);
-
-    cairo_surface_t* drawableSurface = cairo_xlib_surface_create(GDK_DISPLAY(),
-                                                                 m_drawable,
-                                                                 m_visual,
-                                                                 m_windowRect.width(),
-                                                                 m_windowRect.height());
-
-    if (m_isTransparent && drawableDepth != 32) {
-        // Attempt to fake it when we don't have an alpha channel on our
-        // pixmap.  If that's not possible, at least clear the window to
-        // avoid drawing artifacts.
-        GtkWidget* widget = m_parentFrame->view()->hostWindow()->platformPageClient();
-        GdkDrawable* gdkBackingStore = 0;
-        gint xoff = 0, yoff = 0;
-
-        gdk_window_get_internal_paint_info(gtk_widget_get_window(widget), &gdkBackingStore, &xoff, &yoff);
-
-        GC gc = XDefaultGC(GDK_DISPLAY(), gdk_screen_get_number(gdk_screen_get_default()));
-        if (gdkBackingStore) {
-            XCopyArea(GDK_DISPLAY(), GDK_DRAWABLE_XID(gdkBackingStore), m_drawable, gc,
-                      m_windowRect.x() + exposedRect.x() - xoff,
-                      m_windowRect.y() + exposedRect.y() - yoff,
-                      exposedRect.width(), exposedRect.height(),
-                      exposedRect.x(), exposedRect.y());
-        } else {
-            // no valid backing store; clear to the background color
-            XFillRectangle(GDK_DISPLAY(), m_drawable, gc,
-                           exposedRect.x(), exposedRect.y(),
-                           exposedRect.width(), exposedRect.height());
-        }
-    } else if (m_isTransparent) {
+    PlatformRefPtr<cairo_surface_t> drawableSurface = adoptPlatformRef(cairo_xlib_surface_create(display,
+                                                                                                 m_drawable,
+                                                                                                 m_visual,
+                                                                                                 m_windowRect.width(),
+                                                                                                 m_windowRect.height()));
+
+    if (m_isTransparent) {
         // If we have a 32 bit drawable and the plugin wants transparency,
         // we'll clear the exposed area to transparent first.  Otherwise,
         // we'd end up with junk in there from the last paint, or, worse,
         // uninitialized data.
-        cairo_t* crFill = cairo_create(drawableSurface);
+        PlatformRefPtr<cairo_t> cr = adoptPlatformRef(cairo_create(drawableSurface.get()));
 
-        cairo_set_operator(crFill, CAIRO_OPERATOR_SOURCE);
-        cairo_pattern_t* fill = cairo_pattern_create_rgba(0., 0., 0., 0.);
-        cairo_set_source(crFill, fill);
+        if (!(cairo_surface_get_content(drawableSurface.get()) & CAIRO_CONTENT_ALPHA)) {
+            // Attempt to fake it when we don't have an alpha channel on our
+            // pixmap.  If that's not possible, at least clear the window to
+            // avoid drawing artifacts.
 
-        cairo_rectangle(crFill, exposedRect.x(), exposedRect.y(),
-                        exposedRect.width(), exposedRect.height());
-        cairo_clip(crFill);
-        cairo_paint(crFill);
+            // This Would not work without double buffering, but we always use it.
+            cairo_set_source_surface(cr.get(), cairo_get_group_target(context->platformContext()),
+                                     -m_windowRect.x(), -m_windowRect.y());
+            cairo_set_operator(cr.get(), CAIRO_OPERATOR_SOURCE);
+        } else
+            cairo_set_operator(cr.get(), CAIRO_OPERATOR_CLEAR);
 
-        cairo_destroy(crFill);
-        cairo_pattern_destroy(fill);
+        cairo_rectangle(cr.get(), exposedRect.x(), exposedRect.y(),
+                        exposedRect.width(), exposedRect.height());
+        cairo_fill(cr.get());
     }
 
     XEvent xevent;
     memset(&xevent, 0, sizeof(XEvent));
     XGraphicsExposeEvent& exposeEvent = xevent.xgraphicsexpose;
     exposeEvent.type = GraphicsExpose;
-    exposeEvent.display = GDK_DISPLAY();
+    exposeEvent.display = display;
     exposeEvent.drawable = m_drawable;
     exposeEvent.x = exposedRect.x();
     exposeEvent.y = exposedRect.y();
@@ -270,7 +244,7 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     cairo_t* cr = context->platformContext();
     cairo_save(cr);
 
-    cairo_set_source_surface(cr, drawableSurface, frameRect().x(), frameRect().y());
+    cairo_set_source_surface(cr, drawableSurface.get(), frameRect().x(), frameRect().y());
 
     cairo_rectangle(cr,
                     frameRect().x() + exposedRect.x(), frameRect().y() + exposedRect.y(),
@@ -284,7 +258,6 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     cairo_paint(cr);
 
     cairo_restore(cr);
-    cairo_surface_destroy(drawableSurface);
 #endif // defined(XP_UNIX)
 }
 
@@ -346,7 +319,7 @@ void PluginView::initXEvent(XEvent* xEvent)
 
     xEvent->xany.serial = 0; // we are unaware of the last request processed by X Server
     xEvent->xany.send_event = false;
-    xEvent->xany.display = GDK_DISPLAY();
+    xEvent->xany.display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
     // NOTE: event->xany.window doesn't always correspond to the .window property of other XEvent's
     // but does in the case of KeyPress, KeyRelease, ButtonPress, ButtonRelease, and MotionNotify
     // events; thus, this is right:
@@ -637,7 +610,7 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
     case NPNVxDisplay:
 #if defined(XP_UNIX)
         if (m_needsXEmbed)
-            *(void **)value = (void *)GDK_DISPLAY();
+            *(void **)value = (void *)GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
         else
             *(void **)value = (void *)GTK_XTBIN(platformPluginWidget())->xtclient.xtdisplay;
         *result = NPERR_NO_ERROR;
@@ -732,8 +705,9 @@ static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
     *visual = 0;
     *colormap = 0;
 
+    Display* display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
     int rmaj, rmin;
-    if (depth == 32 && (!XRenderQueryVersion(GDK_DISPLAY(), &rmaj, &rmin) || (rmaj == 0 && rmin < 5)))
+    if (depth == 32 && (!XRenderQueryVersion(display, &rmaj, &rmin) || (rmaj == 0 && rmin < 5)))
         return;
 
     XVisualInfo templ;
@@ -741,14 +715,14 @@ static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
     templ.depth   = depth;
     templ.c_class = TrueColor;
     int nVisuals;
-    XVisualInfo* visualInfo = XGetVisualInfo(GDK_DISPLAY(), VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nVisuals);
+    XVisualInfo* visualInfo = XGetVisualInfo(display, VisualScreenMask | VisualDepthMask | VisualClassMask, &templ, &nVisuals);
 
     if (!nVisuals)
         return;
 
     if (depth == 32) {
         for (int idx = 0; idx < nVisuals; ++idx) {
-            XRenderPictFormat* format = XRenderFindVisualFormat(GDK_DISPLAY(), visualInfo[idx].visual);
+            XRenderPictFormat* format = XRenderFindVisualFormat(display, visualInfo[idx].visual);
             if (format->type == PictTypeDirect && format->direct.alphaMask) {
                  *visual = visualInfo[idx].visual;
                  break;
@@ -760,7 +734,7 @@ static void getVisualAndColormap(int depth, Visual** visual, Colormap* colormap)
     XFree(visualInfo);
 
     if (*visual)
-        *colormap = XCreateColormap(GDK_DISPLAY(), GDK_ROOT_WINDOW(), *visual, AllocNone);
+        *colormap = XCreateColormap(display, GDK_ROOT_WINDOW(), *visual, AllocNone);
 }
 #endif
 
@@ -842,9 +816,9 @@ bool PluginView::platformStart()
             m_npWindow.window = (void*)gtk_socket_get_id(GTK_SOCKET(platformPluginWidget()));
             GdkWindow* window = gtk_widget_get_window(widget);
             ws->display = GDK_WINDOW_XDISPLAY(window);
-            ws->visual = GDK_VISUAL_XVISUAL(gdk_drawable_get_visual(GDK_DRAWABLE(window)));
-            ws->depth = gdk_visual_get_depth(gdk_drawable_get_visual(GDK_DRAWABLE(window)));
-            ws->colormap = GDK_COLORMAP_XCOLORMAP(gdk_drawable_get_colormap(GDK_DRAWABLE(window)));
+            ws->visual = GDK_VISUAL_XVISUAL(gdk_window_get_visual(window));
+            ws->depth = gdk_visual_get_depth(gdk_window_get_visual(window));
+            ws->colormap = XCreateColormap(ws->display, GDK_ROOT_WINDOW(), ws->visual, AllocNone);
         } else {
             m_npWindow.window = (void*)GTK_XTBIN(platformPluginWidget())->xtwindow;
             ws->display = GTK_XTBIN(platformPluginWidget())->xtdisplay;
@@ -874,7 +848,7 @@ bool PluginView::platformStart()
             ws->depth = gdk_visual_get_depth(gvisual);
         }
 
-        ws->display = GDK_DISPLAY();
+        ws->display = GDK_DISPLAY_XDISPLAY(gdk_display_get_default());
         ws->visual = m_visual;
         ws->colormap = m_colormap;
 
@@ -904,7 +878,7 @@ void PluginView::platformDestroy()
 {
 #if defined(XP_UNIX)
     if (m_drawable) {
-        XFreePixmap(GDK_DISPLAY(), m_drawable);
+        XFreePixmap(GDK_DISPLAY_XDISPLAY(gdk_display_get_default()), m_drawable);
         m_drawable = 0;
     }
 #endif
diff --git a/WebCore/plugins/gtk/gtk2xtbin.c b/WebCore/plugins/gtk/gtk2xtbin.c
index a0808d9..31c564f 100644
--- a/WebCore/plugins/gtk/gtk2xtbin.c
+++ b/WebCore/plugins/gtk/gtk2xtbin.c
@@ -72,7 +72,7 @@ static void            gtk_xtbin_class_init (GtkXtBinClass *klass);
 static void            gtk_xtbin_init       (GtkXtBin      *xtbin);
 static void            gtk_xtbin_realize    (GtkWidget      *widget);
 static void            gtk_xtbin_unrealize    (GtkWidget      *widget);
-static void            gtk_xtbin_destroy    (GtkObject      *object);
+static void            gtk_xtbin_dispose    (GObject      *object);
 
 /* Xt aware XEmbed */
 static void       xt_client_init      (XtClient * xtclient, 
@@ -244,7 +244,7 @@ static void
 gtk_xtbin_class_init (GtkXtBinClass *klass)
 {
   GtkWidgetClass *widget_class;
-  GtkObjectClass *object_class;
+  GObjectClass   *object_class;
 
   parent_class = g_type_class_peek_parent (klass);
 
@@ -252,8 +252,8 @@ gtk_xtbin_class_init (GtkXtBinClass *klass)
   widget_class->realize = gtk_xtbin_realize;
   widget_class->unrealize = gtk_xtbin_unrealize;
 
-  object_class = GTK_OBJECT_CLASS (klass);
-  object_class->destroy = gtk_xtbin_destroy;
+  object_class = G_OBJECT_CLASS (klass);
+  object_class->dispose = gtk_xtbin_dispose;
 }
 
 static void
@@ -326,8 +326,9 @@ gtk_xtbin_new (GdkWindow *parent_window, String * f)
 {
   GtkXtBin *xtbin;
   gpointer user_data;
+  GdkScreen *screen;
   GdkVisual* visual;
-  GdkColormap* colormap;
+  Colormap colormap;
 
   assert(parent_window != NULL);
   xtbin = g_object_new (GTK_TYPE_XTBIN, NULL);
@@ -341,12 +342,15 @@ gtk_xtbin_new (GdkWindow *parent_window, String * f)
   /* Initialize the Xt toolkit */
   xtbin->parent_window = parent_window;
 
-  visual = gtk_widget_get_default_visual();
-  colormap = gtk_widget_get_default_colormap();
+  screen = gtk_widget_get_screen(GTK_WIDGET(parent_window));
+  visual = gdk_screen_get_system_visual(screen);
+  colormap = XCreateColormap(GDK_DISPLAY_XDISPLAY(gdk_screen_get_display(screen)),
+                             GDK_WINDOW_XWINDOW(gdk_screen_get_root_window(screen)),
+                             GDK_VISUAL_XVISUAL(visual), AllocNone);
 
   xt_client_init(&(xtbin->xtclient), 
                  GDK_VISUAL_XVISUAL(visual),
-                 GDK_COLORMAP_XCOLORMAP(colormap),
+                 colormap,
                  gdk_visual_get_depth(visual));
 
   if (!xtbin->xtclient.xtdisplay) {
@@ -480,7 +484,7 @@ gtk_xtbin_unrealize (GtkWidget *object)
 }
 
 static void
-gtk_xtbin_destroy (GtkObject *object)
+gtk_xtbin_dispose (GObject *object)
 {
   GtkXtBin *xtbin;
 
@@ -514,7 +518,7 @@ gtk_xtbin_destroy (GtkObject *object)
     }
   }
 
-  GTK_OBJECT_CLASS(parent_class)->destroy(object);
+  G_OBJECT_CLASS(parent_class)->dispose(object);
 }
 
 /*
diff --git a/WebCore/plugins/mac/PluginViewMac.mm b/WebCore/plugins/mac/PluginViewMac.mm
index e0ad135..aef9420 100644
--- a/WebCore/plugins/mac/PluginViewMac.mm
+++ b/WebCore/plugins/mac/PluginViewMac.mm
@@ -359,7 +359,7 @@ void PluginView::setFocus(bool focused)
 
 #ifndef NP_NO_CARBON
     EventRecord record;
-    record.what = getFocusEvent;
+    record.what = NPEventType_GetFocusEvent;
     record.message = 0;
     record.when = TickCount();
     record.where = globalMousePosForPlugin();
@@ -576,9 +576,9 @@ void PluginView::handleMouseEvent(MouseEvent* event)
         m_lastMousePos = mousePosForPlugin(event);
         return;
     } else if (event->type() == eventNames().mouseoverEvent) {
-        record.what = adjustCursorEvent;
+        record.what = NPEventType_AdjustCursorEvent;
     } else if (event->type() == eventNames().mouseoutEvent) {
-        record.what = adjustCursorEvent;
+        record.what = NPEventType_AdjustCursorEvent;
     } else if (event->type() == eventNames().mousedownEvent) {
         record.what = mouseDown;
         // The plugin needs focus to receive keyboard events
@@ -600,7 +600,7 @@ void PluginView::handleMouseEvent(MouseEvent* event)
         record.modifiers |= controlKey;
 
     if (!dispatchNPEvent(record)) {
-        if (record.what == adjustCursorEvent)
+        if (record.what == NPEventType_AdjustCursorEvent)
             return; // Signals that the plugin wants a normal cursor
 
         LOG(Events, "PluginView::handleMouseEvent(): Mouse event type %d at %d,%d not accepted",
diff --git a/WebCore/plugins/npapi.cpp b/WebCore/plugins/npapi.cpp
index 070c3ce..9d404b1 100644
--- a/WebCore/plugins/npapi.cpp
+++ b/WebCore/plugins/npapi.cpp
@@ -176,6 +176,7 @@ void NPN_PluginThreadAsyncCall(NPP instance, void (*func) (void *), void *userDa
     PluginMainThreadScheduler::scheduler().scheduleCall(instance, func, userData);
 }
 
+<<<<<<< HEAD
 #ifdef PLUGIN_SCHEDULE_TIMER
 uint32_t NPN_ScheduleTimer(NPP instance, uint32_t interval, NPBool repeat,
                          void (*timerFunc)(NPP npp, uint32_t timerID))
@@ -191,3 +192,19 @@ void NPN_UnscheduleTimer(NPP instance, uint32_t timerID)
 #endif
 
 
+=======
+NPError NPN_GetValueForURL(NPP instance, NPNURLVariable variable, const char* url, char** value, uint32_t* len)
+{
+    return pluginViewForInstance(instance)->getValueForURL(variable, url, value, len);
+}
+
+NPError NPN_SetValueForURL(NPP instance, NPNURLVariable variable, const char* url, const char* value, uint32_t len)
+{
+    return pluginViewForInstance(instance)->setValueForURL(variable, url, value, len);
+}
+
+NPError NPN_GetAuthenticationInfo(NPP instance, const char* protocol, const char* host, int32_t port, const char* scheme, const char* realm, char** username, uint32_t* ulen, char** password, uint32_t* plen)
+{
+    return pluginViewForInstance(instance)->getAuthenticationInfo(protocol, host, port, scheme, realm, username, ulen, password, plen);
+}
+>>>>>>> webkit.org at r70209
diff --git a/WebCore/plugins/qt/PluginViewQt.cpp b/WebCore/plugins/qt/PluginViewQt.cpp
index b7e1268..9b4e595 100644
--- a/WebCore/plugins/qt/PluginViewQt.cpp
+++ b/WebCore/plugins/qt/PluginViewQt.cpp
@@ -31,6 +31,8 @@
 #if USE(JSC)
 #include "Bridge.h"
 #endif
+#include "Chrome.h"
+#include "ChromeClient.h"
 #include "Document.h"
 #include "DocumentLoader.h"
 #include "Element.h"
@@ -69,8 +71,10 @@
 
 #include <QApplication>
 #include <QDesktopWidget>
+#include <QGraphicsWidget>
 #include <QKeyEvent>
 #include <QPainter>
+#include <QStyleOptionGraphicsItem>
 #include <QWidget>
 #include <QX11Info>
 #include <X11/X.h>
@@ -96,6 +100,24 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
+#if USE(ACCELERATED_COMPOSITING)
+// Qt's GraphicsLayer (GraphicsLayerQt) requires layers to be QGraphicsWidgets
+class PluginGraphicsLayerQt : public QGraphicsWidget {
+public:
+    PluginGraphicsLayerQt(PluginView* view) : m_view(view) { }
+    ~PluginGraphicsLayerQt() { }
+
+    void paint(QPainter* painter, const QStyleOptionGraphicsItem* option, QWidget* widget = 0)
+    {
+        Q_UNUSED(widget);
+        m_view->paintUsingXPixmap(painter, option->exposedRect.toRect());
+    }
+
+private:
+    PluginView* m_view;
+};
+#endif
+
 void PluginView::updatePluginWidget()
 {
     if (!parent())
@@ -145,9 +167,11 @@ void PluginView::updatePluginWidget()
         || (QWebPagePrivate::drtRun && platformPluginWidget() && (m_windowRect != oldWindowRect || m_clipRect != oldClipRect)))
         setNPWindowIfNeeded();
 
-    // Make sure we get repainted afterwards. This is necessary for downward
-    // scrolling to move the plugin widget properly.
-    invalidate();
+    if (!m_platformLayer) {
+        // Make sure we get repainted afterwards. This is necessary for downward
+        // scrolling to move the plugin widget properly.
+        invalidate();
+    }
 }
 
 void PluginView::setFocus(bool focused)
@@ -237,40 +261,8 @@ void PluginView::paintUsingImageSurfaceExtension(QPainter* painter, const IntRec
 }
 #endif
 
-void PluginView::paint(GraphicsContext* context, const IntRect& rect)
+void PluginView::paintUsingXPixmap(QPainter* painter, const QRect &exposedRect)
 {
-    if (!m_isStarted) {
-        paintMissingPluginIcon(context, rect);
-        return;
-    }
-
-    if (context->paintingDisabled())
-        return;
-
-    setNPWindowIfNeeded();
-
-    if (m_isWindowed)
-        return;
-
-    if (!m_drawable
-#if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
-        && m_image.isNull()
-#endif
-       )
-        return;
-
-    QPainter* painter = context->platformContext();
-    IntRect exposedRect(rect);
-    exposedRect.intersect(frameRect());
-    exposedRect.move(-frameRect().x(), -frameRect().y());
-
-#if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
-    if (!m_image.isNull()) {
-        paintUsingImageSurfaceExtension(painter, exposedRect);
-        return;
-    }
-#endif
-
     QPixmap qtDrawable = QPixmap::fromX11Pixmap(m_drawable, QPixmap::ExplicitlyShared);
     const int drawableDepth = ((NPSetWindowCallbackStruct*)m_npWindow.ws_info)->depth;
     ASSERT(drawableDepth == qtDrawable.depth());
@@ -328,8 +320,51 @@ void PluginView::paint(GraphicsContext* context, const IntRect& rect)
     if (syncX)
         XSync(m_pluginDisplay, false); // sync changes by plugin
 
-    painter->drawPixmap(QPoint(frameRect().x() + exposedRect.x(), frameRect().y() + exposedRect.y()), qtDrawable,
-                        exposedRect);
+    painter->drawPixmap(QPoint(exposedRect.x(), exposedRect.y()), qtDrawable, exposedRect);
+}
+
+void PluginView::paint(GraphicsContext* context, const IntRect& rect)
+{
+    if (!m_isStarted) {
+        paintMissingPluginIcon(context, rect);
+        return;
+    }
+
+    if (context->paintingDisabled())
+        return;
+
+    setNPWindowIfNeeded();
+
+    if (m_isWindowed)
+        return;
+
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_platformLayer)
+        return;
+#endif
+
+    if (!m_drawable
+#if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
+        && m_image.isNull()
+#endif
+       )
+        return;
+
+    QPainter* painter = context->platformContext();
+    IntRect exposedRect(rect);
+    exposedRect.intersect(frameRect());
+    exposedRect.move(-frameRect().x(), -frameRect().y());
+
+#if defined(MOZ_PLATFORM_MAEMO) && (MOZ_PLATFORM_MAEMO >= 5)
+    if (!m_image.isNull()) {
+        paintUsingImageSurfaceExtension(painter, exposedRect);
+        return;
+    }
+#endif
+
+    painter->translate(frameRect().x(), frameRect().y());
+    paintUsingXPixmap(painter, exposedRect);
+    painter->translate(-frameRect().x(), -frameRect().y());
 }
 
 // TODO: Unify across ports.
@@ -372,19 +407,21 @@ void PluginView::initXEvent(XEvent* xEvent)
 
 void setXKeyEventSpecificFields(XEvent* xEvent, KeyboardEvent* event)
 {
-    QKeyEvent* qKeyEvent = event->keyEvent()->qtEvent();
+    const PlatformKeyboardEvent* keyEvent = event->keyEvent();
 
     xEvent->type = (event->type() == eventNames().keydownEvent) ? 2 : 3; // ints as Qt unsets KeyPress and KeyRelease
     xEvent->xkey.root = QX11Info::appRootWindow();
     xEvent->xkey.subwindow = 0; // we have no child window
     xEvent->xkey.time = event->timeStamp();
-    xEvent->xkey.state = qKeyEvent->nativeModifiers();
-    xEvent->xkey.keycode = qKeyEvent->nativeScanCode();
+    xEvent->xkey.state = keyEvent->nativeModifiers();
+    xEvent->xkey.keycode = keyEvent->nativeScanCode();
 
     // We may not have a nativeScanCode() if the key event is from DRT's eventsender. In that
     // case just populate the XEvent's keycode with the Qt platform-independent keycode. The only
     // place this keycode will be used is in webkit_test_plugin_handle_event().
     if (QWebPagePrivate::drtRun && !xEvent->xkey.keycode) {
+        QKeyEvent* qKeyEvent = keyEvent->qtEvent();
+        ASSERT(qKeyEvent);
         if (!qKeyEvent->text().isEmpty())
             xEvent->xkey.keycode = int(qKeyEvent->text().at(0).unicode() + qKeyEvent->modifiers());
         else if (qKeyEvent->key() && (qKeyEvent->key() != Qt::Key_unknown))
@@ -499,6 +536,9 @@ void PluginView::handleMouseEvent(MouseEvent* event)
     if (m_isWindowed)
         return;
 
+    if (event->button() == RightButton && m_plugin->quirks().contains(PluginQuirkIgnoreRightClickInWindowlessMode))
+        return;
+
     if (event->type() == eventNames().mousedownEvent) {
         // Give focus to the plugin on click
         if (Page* page = m_parentFrame->page())
@@ -744,6 +784,13 @@ bool PluginView::platformGetValue(NPNVariable variable, void* value, NPError* re
 
 void PluginView::invalidateRect(const IntRect& rect)
 {
+#if USE(ACCELERATED_COMPOSITING)
+    if (m_platformLayer) {
+        m_platformLayer->update(QRectF(rect));
+        return;
+    }
+#endif
+
     if (m_isWindowed) {
         if (platformWidget())
             platformWidget()->update(rect);
@@ -760,11 +807,12 @@ void PluginView::invalidateRect(NPRect* rect)
         return;
     }
     IntRect r(rect->left, rect->top, rect->right - rect->left, rect->bottom - rect->top);
-    invalidateWindowlessPluginRect(r);
+    invalidateRect(r);
 }
 
 void PluginView::invalidateRegion(NPRegion region)
 {
+    Q_UNUSED(region);
     invalidate();
 }
 
@@ -869,6 +917,16 @@ bool PluginView::platformStart()
     } else {
         setPlatformWidget(0);
         m_pluginDisplay = getPluginDisplay();
+
+#if USE(ACCELERATED_COMPOSITING)
+        if (m_parentFrame->page()->chrome()->client()->allowsAcceleratedCompositing()
+            && m_parentFrame->page()->settings() 
+            && m_parentFrame->page()->settings()->acceleratedCompositingEnabled()) {
+            m_platformLayer = new PluginGraphicsLayerQt(this);
+            // Trigger layer computation in RenderLayerCompositor
+            m_element->setNeedsStyleRecalc(SyntheticStyleChange);
+        }
+#endif
     }
 
     show();
@@ -942,5 +1000,12 @@ void PluginView::halt()
 void PluginView::restart()
 {
 }
+ 
+#if USE(ACCELERATED_COMPOSITING)
+PlatformLayer* PluginView::platformLayer() const
+{
+    return m_platformLayer.get();
+}
+#endif
 
 } // namespace WebCore
diff --git a/WebCore/plugins/symbian/PluginViewSymbian.cpp b/WebCore/plugins/symbian/PluginViewSymbian.cpp
index b9f82ad..b8a72b1 100644
--- a/WebCore/plugins/symbian/PluginViewSymbian.cpp
+++ b/WebCore/plugins/symbian/PluginViewSymbian.cpp
@@ -1,5 +1,5 @@
 /*
-    Copyright (C) 2009 Nokia Corporation and/or its subsidiary(-ies)
+    Copyright (C) 2009, 2010 Nokia Corporation and/or its subsidiary(-ies)
 
     This library is free software; you can redistribute it and/or
     modify it under the terms of the GNU Library General Public
@@ -180,6 +180,7 @@ void PluginView::handleKeyboardEvent(KeyboardEvent* event)
     if (m_isWindowed)
         return;
 
+    ASSERT(event->keyEvent()->qtEvent());
     QEvent& npEvent = *(event->keyEvent()->qtEvent());
     if (!dispatchNPEvent(npEvent))
         event->setDefaultHandled();
@@ -412,6 +413,7 @@ bool PluginView::platformStart()
         m_npWindow.type = NPWindowTypeDrawable;
         m_npWindow.window = 0; // Not used?
     }    
+    updatePluginWidget();
     setNPWindowIfNeeded();
     
     return true;
diff --git a/WebCore/rendering/CounterNode.cpp b/WebCore/rendering/CounterNode.cpp
index c164c81..ac83d5a 100644
--- a/WebCore/rendering/CounterNode.cpp
+++ b/WebCore/rendering/CounterNode.cpp
@@ -41,6 +41,11 @@ CounterNode::CounterNode(RenderObject* o, bool hasResetType, int value)
 {
 }
 
+PassRefPtr<CounterNode> CounterNode::create(RenderObject* renderer, bool hasResetType, int value)
+{
+    return adoptRef(new CounterNode(renderer, hasResetType, value));
+}
+
 CounterNode* CounterNode::nextInPreOrderAfterChildren(const CounterNode* stayWithin) const
 {
     if (this == stayWithin)
diff --git a/WebCore/rendering/CounterNode.h b/WebCore/rendering/CounterNode.h
index e35fb61..529d409 100644
--- a/WebCore/rendering/CounterNode.h
+++ b/WebCore/rendering/CounterNode.h
@@ -24,6 +24,7 @@
 
 #include <wtf/Forward.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/RefCounted.h>
 
 // This implements a counter tree that is used for finding parents in counters() lookup,
 // and for propagating count changes when nodes are added or removed.
@@ -38,9 +39,9 @@ namespace WebCore {
 
 class RenderObject;
 
-class CounterNode : public Noncopyable {
+class CounterNode : public RefCounted<CounterNode> {
 public:
-    CounterNode(RenderObject*, bool isReset, int value);
+    static PassRefPtr<CounterNode> create(RenderObject*, bool isReset, int value);
 
     bool actsAsReset() const { return m_hasResetType || !m_parent; }
     bool hasResetType() const { return m_hasResetType; }
@@ -64,6 +65,7 @@ public:
     void removeChild(CounterNode*, const AtomicString& identifier);
 
 private:
+    CounterNode(RenderObject*, bool isReset, int value);
     int computeCountInParent() const;
     void recount(const AtomicString& identifier);
 
diff --git a/WebCore/rendering/EllipsisBox.cpp b/WebCore/rendering/EllipsisBox.cpp
index 1d71d35..f9c4f03 100644
--- a/WebCore/rendering/EllipsisBox.cpp
+++ b/WebCore/rendering/EllipsisBox.cpp
@@ -114,7 +114,7 @@ bool EllipsisBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     }
 
     IntRect boundsRect = IntRect(tx, ty, m_logicalWidth, m_height);
-    if (visibleToHitTesting() && boundsRect.intersects(result.rectFromPoint(x, y))) {
+    if (visibleToHitTesting() && boundsRect.intersects(result.rectForPoint(x, y))) {
         renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), x, y, boundsRect))
             return true;
diff --git a/WebCore/rendering/HitTestResult.cpp b/WebCore/rendering/HitTestResult.cpp
index 35a6d23..1bc238f 100644
--- a/WebCore/rendering/HitTestResult.cpp
+++ b/WebCore/rendering/HitTestResult.cpp
@@ -29,6 +29,7 @@
 #include "HTMLInputElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "RenderImage.h"
 #include "Scrollbar.h"
 #include "SelectionController.h"
@@ -305,14 +306,14 @@ KURL HitTestResult::absoluteImageURL() const
     } else
         return KURL();
 
-    return m_innerNonSharedNode->document()->completeURL(deprecatedParseURL(urlString));
+    return m_innerNonSharedNode->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
 }
 
 KURL HitTestResult::absoluteMediaURL() const
 {
 #if ENABLE(VIDEO)
     if (HTMLMediaElement* mediaElt = mediaElement())
-        return m_innerNonSharedNode->document()->completeURL(deprecatedParseURL(mediaElt->currentSrc()));
+        return m_innerNonSharedNode->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(mediaElt->currentSrc()));
     return KURL();
 #else
     return KURL();
@@ -461,7 +462,7 @@ KURL HitTestResult::absoluteLinkURL() const
     else
         return KURL();
 
-    return m_innerURLElement->document()->completeURL(deprecatedParseURL(urlString));
+    return m_innerURLElement->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(urlString));
 }
 
 bool HitTestResult::isLiveLink() const
@@ -530,7 +531,7 @@ bool HitTestResult::addNodeToRectBasedTestResult(Node* node, int x, int y, const
     node = node->shadowAncestorNode();
     m_rectBasedTestResult.add(node);
 
-    return !rect.contains(rectFromPoint(x, y));
+    return !rect.contains(rectForPoint(x, y));
 }
 
 void HitTestResult::append(const HitTestResult& other)
@@ -552,7 +553,7 @@ void HitTestResult::append(const HitTestResult& other)
         m_rectBasedTestResult.add(it->get());
 }
 
-IntRect HitTestResult::rectFromPoint(const IntPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
+IntRect HitTestResult::rectForPoint(const IntPoint& point, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding)
 {
     IntPoint actualPoint(point);
     actualPoint -= IntSize(leftPadding, topPadding);
diff --git a/WebCore/rendering/HitTestResult.h b/WebCore/rendering/HitTestResult.h
index 1304e22..8d9b18d 100644
--- a/WebCore/rendering/HitTestResult.h
+++ b/WebCore/rendering/HitTestResult.h
@@ -98,9 +98,9 @@ public:
 
     // Rect-based hit test related methods.
     bool isRectBasedTest() const { return m_isRectBased; }
-    IntRect rectFromPoint(int x, int y) const;
-    IntRect rectFromPoint(const IntPoint&) const;
-    static IntRect rectFromPoint(const IntPoint&, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
+    IntRect rectForPoint(int x, int y) const;
+    IntRect rectForPoint(const IntPoint&) const;
+    static IntRect rectForPoint(const IntPoint&, unsigned topPadding, unsigned rightPadding, unsigned bottomPadding, unsigned leftPadding);
     int topPadding() const { return m_topPadding; }
     int rightPadding() const { return m_rightPadding; }
     int bottomPadding() const { return m_bottomPadding; }
@@ -134,9 +134,9 @@ private:
     ListHashSet<RefPtr<Node> > m_rectBasedTestResult;
 };
 
-inline IntRect HitTestResult::rectFromPoint(int x, int y) const
+inline IntRect HitTestResult::rectForPoint(int x, int y) const
 {
-    return rectFromPoint(IntPoint(x, y), m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
+    return rectForPoint(IntPoint(x, y), m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
 }
 
 // Formula:
@@ -144,9 +144,9 @@ inline IntRect HitTestResult::rectFromPoint(int x, int y) const
 // y = p.y() - topPadding
 // width = leftPadding + rightPadding + 1
 // height = topPadding + bottomPadding + 1
-inline IntRect HitTestResult::rectFromPoint(const IntPoint& point) const
+inline IntRect HitTestResult::rectForPoint(const IntPoint& point) const
 {
-    return rectFromPoint(point, m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
+    return rectForPoint(point, m_topPadding, m_rightPadding, m_bottomPadding, m_leftPadding);
 }
 
 String displayString(const String&, const Node*);
diff --git a/WebCore/rendering/InlineBox.cpp b/WebCore/rendering/InlineBox.cpp
index 91cbaff..2028d4e 100644
--- a/WebCore/rendering/InlineBox.cpp
+++ b/WebCore/rendering/InlineBox.cpp
@@ -95,14 +95,14 @@ int InlineBox::logicalHeight() const
     if (renderer()->isText())
         return m_isText ? renderer()->style(m_firstLine)->font().height() : 0;
     if (renderer()->isBox() && parent())
-        return toRenderBox(m_renderer)->height();
+        return m_isVertical ? toRenderBox(m_renderer)->width() : toRenderBox(m_renderer)->height();
 
     ASSERT(isInlineFlowBox());
     RenderBoxModelObject* flowObject = boxModelObject();
     const Font& font = renderer()->style(m_firstLine)->font();
     int result = font.height();
     if (parent())
-        result += flowObject->borderAndPaddingHeight();
+        result += flowObject->borderAndPaddingLogicalHeight();
     return result;
 }
 
diff --git a/WebCore/rendering/InlineBox.h b/WebCore/rendering/InlineBox.h
index 1cd88ff..38a7805 100644
--- a/WebCore/rendering/InlineBox.h
+++ b/WebCore/rendering/InlineBox.h
@@ -21,6 +21,7 @@
 #ifndef InlineBox_h
 #define InlineBox_h
 
+#include "RenderBR.h"
 #include "RenderBoxModelObject.h"
 #include "TextDirection.h"
 
@@ -139,6 +140,7 @@ public:
     virtual bool isRootInlineBox() const { return false; }
 #if ENABLE(SVG)
     virtual bool isSVGInlineTextBox() const { return false; }
+    virtual bool isSVGInlineFlowBox() const { return false; }
     virtual bool isSVGRootInlineBox() const { return false; }
 #endif
 
@@ -216,6 +218,7 @@ public:
 
     // The logicalLeft position is the left edge of the line box in a horizontal line and the top edge in a vertical line.
     int logicalLeft() const { return !m_isVertical ? m_x : m_y; }
+    int logicalRight() const { return logicalLeft() + logicalWidth(); }
     void setLogicalLeft(int left)
     {
         if (!m_isVertical)
@@ -241,8 +244,9 @@ public:
     // The logical height is our extent in the block flow direction, i.e., height for horizontal text and width for vertical text.
     int logicalHeight() const;
 
-    inline int baselinePosition(bool isRootLineBox) const { return renderer()->baselinePosition(m_firstLine, isRootLineBox); }
-    inline int lineHeight(bool isRootLineBox) const { return renderer()->lineHeight(m_firstLine, isRootLineBox); }
+    virtual int baselinePosition() const { return boxModelObject()->baselinePosition(m_firstLine, m_isVertical ? VerticalLine : HorizontalLine, PositionOnContainingLine); }
+    virtual int lineHeight() const { return boxModelObject()->lineHeight(m_firstLine, m_isVertical ? VerticalLine : HorizontalLine, PositionOnContainingLine); }
+    
 
     virtual int caretMinOffset() const;
     virtual int caretMaxOffset() const;
@@ -251,8 +255,9 @@ public:
     unsigned char bidiLevel() const { return m_bidiEmbeddingLevel; }
     void setBidiLevel(unsigned char level) { m_bidiEmbeddingLevel = level; }
     TextDirection direction() const { return m_bidiEmbeddingLevel % 2 ? RTL : LTR; }
-    int caretLeftmostOffset() const { return direction() == LTR ? caretMinOffset() : caretMaxOffset(); }
-    int caretRightmostOffset() const { return direction() == LTR ? caretMaxOffset() : caretMinOffset(); }
+    bool isLeftToRightDirection() const { return direction() == LTR; }
+    int caretLeftmostOffset() const { return isLeftToRightDirection() ? caretMinOffset() : caretMaxOffset(); }
+    int caretRightmostOffset() const { return isLeftToRightDirection() ? caretMaxOffset() : caretMinOffset(); }
 
     virtual void clearTruncation() { }
 
diff --git a/WebCore/rendering/InlineFlowBox.cpp b/WebCore/rendering/InlineFlowBox.cpp
index 588d054..79c571d 100644
--- a/WebCore/rendering/InlineFlowBox.cpp
+++ b/WebCore/rendering/InlineFlowBox.cpp
@@ -83,8 +83,6 @@ void InlineFlowBox::addToLine(InlineBox* child)
     child->setIsVertical(m_isVertical);
     if (child->isText())
         m_hasTextChildren = true;
-    if (child->renderer()->selectionState() != RenderObject::SelectionNone)
-        root()->setHasSelectedChildren(true);
 
     checkConsistency();
 }
@@ -209,7 +207,7 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
 
     // The root inline box never has borders/margins/padding.
     if (parent()) {
-        bool ltr = renderer()->style()->direction() == LTR;
+        bool ltr = renderer()->style()->isLeftToRightDirection();
 
         // Check to see if all initial lines are unconstructed.  If so, then
         // we know the inline began on this line (unless we are a continuation).
@@ -253,24 +251,24 @@ void InlineFlowBox::determineSpacingForFlowBoxes(bool lastLine, RenderObject* en
     }
 }
 
-int InlineFlowBox::placeBoxesInInlineDirection(int xPos, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
+int InlineFlowBox::placeBoxesInInlineDirection(int logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
 {
     // Set our x position.
-    setX(xPos);
+    setLogicalLeft(logicalLeft);
 
-    int leftLayoutOverflow = xPos;
-    int rightLayoutOverflow = xPos;
-    int leftVisualOverflow = xPos;
-    int rightVisualOverflow = xPos;
+    int logicalLeftLayoutOverflow = logicalLeft;
+    int logicalRightLayoutOverflow = logicalLeft;
+    int logicalLeftVisualOverflow = logicalLeft;
+    int logicalRightVisualOverflow = logicalLeft;
 
-    int boxShadowLeft;
-    int boxShadowRight;
-    renderer()->style(m_firstLine)->getBoxShadowHorizontalExtent(boxShadowLeft, boxShadowRight);
+    int boxShadowLogicalLeft;
+    int boxShadowLogicalRight;
+    renderer()->style(m_firstLine)->getBoxShadowInlineDirectionExtent(boxShadowLogicalLeft, boxShadowLogicalRight);
 
-    leftVisualOverflow = min(xPos + boxShadowLeft, leftVisualOverflow);
+    logicalLeftVisualOverflow = min(logicalLeft + boxShadowLogicalLeft, logicalLeftVisualOverflow);
 
-    int startX = xPos;
-    xPos += borderLogicalLeft() + paddingLogicalLeft();
+    int startLogicalLeft = logicalLeft;
+    logicalLeft += borderLogicalLeft() + paddingLogicalLeft();
     
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isText()) {
@@ -278,81 +276,87 @@ int InlineFlowBox::placeBoxesInInlineDirection(int xPos, bool& needsWordSpacing,
             RenderText* rt = toRenderText(text->renderer());
             if (rt->textLength()) {
                 if (needsWordSpacing && isSpaceOrNewline(rt->characters()[text->start()]))
-                    xPos += rt->style(m_firstLine)->font().wordSpacing();
+                    logicalLeft += rt->style(m_firstLine)->font().wordSpacing();
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[text->end()]);
             }
-            text->setX(xPos);
+            text->setLogicalLeft(logicalLeft);
             
             int strokeOverflow = static_cast<int>(ceilf(rt->style()->textStrokeWidth() / 2.0f));
             
             // If letter-spacing is negative, we should factor that into right layout overflow. (Even in RTL, letter-spacing is
             // applied to the right, so this is not an issue with left overflow.
             int letterSpacing = min(0, (int)rt->style(m_firstLine)->font().letterSpacing());
-            rightLayoutOverflow = max(xPos + text->logicalWidth() - letterSpacing, rightLayoutOverflow);
+            logicalRightLayoutOverflow = max(logicalLeft + text->logicalWidth() - letterSpacing, logicalRightLayoutOverflow);
 
             GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.find(static_cast<InlineTextBox*>(curr));
             GlyphOverflow* glyphOverflow = it == textBoxDataMap.end() ? 0 : &it->second.second;
 
-            int leftGlyphOverflow = -strokeOverflow - (glyphOverflow ? glyphOverflow->left : 0);
-            int rightGlyphOverflow = strokeOverflow - letterSpacing + (glyphOverflow ? glyphOverflow->right : 0);
+            int logicalLeftGlyphOverflow = -strokeOverflow - (glyphOverflow ? glyphOverflow->left : 0);
+            int logicalRightGlyphOverflow = strokeOverflow - letterSpacing + (glyphOverflow ? glyphOverflow->right : 0);
             
-            int childOverflowLeft = leftGlyphOverflow;
-            int childOverflowRight = rightGlyphOverflow;
-            for (const ShadowData* shadow = rt->style()->textShadow(); shadow; shadow = shadow->next()) {
-                childOverflowLeft = min(childOverflowLeft, shadow->x() - shadow->blur() + leftGlyphOverflow);
-                childOverflowRight = max(childOverflowRight, shadow->x() + shadow->blur() + rightGlyphOverflow);
-            }
-            
-            leftVisualOverflow = min(xPos + childOverflowLeft, leftVisualOverflow);
-            rightVisualOverflow = max(xPos + text->logicalWidth() + childOverflowRight, rightVisualOverflow);
+            int childOverflowLogicalLeft = logicalLeftGlyphOverflow;
+            int childOverflowLogicalRight = logicalRightGlyphOverflow;
+            int textShadowLogicalLeft;
+            int textShadowLogicalRight;
+            rt->style(m_firstLine)->getTextShadowInlineDirectionExtent(textShadowLogicalLeft, textShadowLogicalRight);
+            childOverflowLogicalLeft = min(childOverflowLogicalLeft, textShadowLogicalLeft);
+            childOverflowLogicalRight = max(childOverflowLogicalRight, textShadowLogicalRight);
+            logicalLeftVisualOverflow = min(logicalLeft + childOverflowLogicalLeft, logicalLeftVisualOverflow);
+            logicalRightVisualOverflow = max(logicalLeft + text->logicalWidth() + childOverflowLogicalRight, logicalRightVisualOverflow);
             
-            xPos += text->logicalWidth();
+            logicalLeft += text->logicalWidth();
         } else {
             if (curr->renderer()->isPositioned()) {
-                if (curr->renderer()->parent()->style()->direction() == LTR)
-                    curr->setX(xPos);
+                if (curr->renderer()->parent()->style()->isLeftToRightDirection())
+                    curr->setLogicalLeft(logicalLeft);
                 else
                     // Our offset that we cache needs to be from the edge of the right border box and
                     // not the left border box.  We have to subtract |x| from the width of the block
                     // (which can be obtained from the root line box).
-                    curr->setX(root()->block()->width() - xPos);
+                    curr->setLogicalLeft(root()->block()->logicalWidth() - logicalLeft);
                 continue; // The positioned object has no effect on the width.
             }
             if (curr->renderer()->isRenderInline()) {
                 InlineFlowBox* flow = static_cast<InlineFlowBox*>(curr);
-                xPos += flow->marginLogicalLeft();
-                xPos = flow->placeBoxesInInlineDirection(xPos, needsWordSpacing, textBoxDataMap);
-                xPos += flow->marginLogicalRight();
-                leftLayoutOverflow = min(leftLayoutOverflow, flow->leftLayoutOverflow());
-                rightLayoutOverflow = max(rightLayoutOverflow, flow->rightLayoutOverflow());
-                leftVisualOverflow = min(leftVisualOverflow, flow->leftVisualOverflow());
-                rightVisualOverflow = max(rightVisualOverflow, flow->rightVisualOverflow());
+                logicalLeft += flow->marginLogicalLeft();
+                logicalLeft = flow->placeBoxesInInlineDirection(logicalLeft, needsWordSpacing, textBoxDataMap);
+                logicalLeft += flow->marginLogicalRight();
+                logicalLeftLayoutOverflow = min(logicalLeftLayoutOverflow, flow->logicalLeftLayoutOverflow());
+                logicalRightLayoutOverflow = max(logicalRightLayoutOverflow, flow->logicalRightLayoutOverflow());
+                logicalLeftVisualOverflow = min(logicalLeftVisualOverflow, flow->logicalLeftVisualOverflow());
+                logicalRightVisualOverflow = max(logicalRightVisualOverflow, flow->logicalRightVisualOverflow());
             } else if (!curr->renderer()->isListMarker() || toRenderListMarker(curr->renderer())->isInside()) {
-                xPos += curr->boxModelObject()->marginLeft();
-                curr->setX(xPos);
-                 
+                // The box can have a different writing-mode than the overall line, so this is a bit complicated.
+                // Just get all the physical margin and overflow values by hand based off |isVertical|.
+                int logicalLeftMargin = !isVertical() ? curr->boxModelObject()->marginLeft() : curr->boxModelObject()->marginTop();
+                int logicalRightMargin = !isVertical() ? curr->boxModelObject()->marginRight() : curr->boxModelObject()->marginBottom();
+                
+                logicalLeft += logicalLeftMargin;
+                curr->setLogicalLeft(logicalLeft);
+                       
                 RenderBox* box = toRenderBox(curr->renderer());
-                int childLeftOverflow = box->hasOverflowClip() ? 0 : box->leftLayoutOverflow();
-                int childRightOverflow = box->hasOverflowClip() ? curr->logicalWidth() : box->rightLayoutOverflow();
+
+                int childOverflowLogicalLeft = box->hasOverflowClip() ? 0 : (!isVertical() ? box->leftLayoutOverflow() : box->topLayoutOverflow());
+                int childOverflowLogicalRight = box->hasOverflowClip() ? curr->logicalWidth() : (!isVertical() ? box->rightLayoutOverflow() : box->bottomLayoutOverflow());
                 
-                leftLayoutOverflow = min(xPos + childLeftOverflow, leftLayoutOverflow);
-                rightLayoutOverflow = max(xPos + childRightOverflow, rightLayoutOverflow);
+                logicalLeftLayoutOverflow = min(logicalLeft + childOverflowLogicalLeft, logicalLeftLayoutOverflow);
+                logicalRightLayoutOverflow = max(logicalLeft + childOverflowLogicalRight, logicalRightLayoutOverflow);
 
-                leftVisualOverflow = min(xPos + box->leftVisualOverflow(), leftVisualOverflow);
-                rightVisualOverflow = max(xPos + box->rightVisualOverflow(), rightVisualOverflow);
+                logicalLeftVisualOverflow = min(logicalLeft + (!isVertical() ? box->leftVisualOverflow() : box->topVisualOverflow()), logicalLeftVisualOverflow);
+                logicalRightVisualOverflow = max(logicalLeft + (!isVertical() ? box->rightVisualOverflow() : box->bottomVisualOverflow()), logicalRightVisualOverflow);
                
-                xPos += curr->logicalWidth() + curr->boxModelObject()->marginRight();
+                logicalLeft += curr->logicalWidth() + logicalRightMargin;
             }
         }
     }
 
-    xPos += borderLogicalRight() + paddingLogicalRight();
-    setLogicalWidth(xPos - startX);
-    rightVisualOverflow = max(x() + logicalWidth() + boxShadowRight, rightVisualOverflow);
-    rightLayoutOverflow = max(x() + logicalWidth(), rightLayoutOverflow);
+    logicalLeft += borderLogicalRight() + paddingLogicalRight();
+    setLogicalWidth(logicalLeft - startLogicalLeft);
+    logicalRightVisualOverflow = max(logicalLeft + boxShadowLogicalRight, logicalRightVisualOverflow);
+    logicalRightLayoutOverflow = max(logicalLeft, logicalRightLayoutOverflow);
 
-    setInlineDirectionOverflowPositions(leftLayoutOverflow, rightLayoutOverflow, leftVisualOverflow, rightVisualOverflow);
-    return xPos;
+    setInlineDirectionOverflowPositions(logicalLeftLayoutOverflow, logicalRightLayoutOverflow, logicalLeftVisualOverflow, logicalRightVisualOverflow);
+    return logicalLeft;
 }
 
 void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
@@ -363,9 +367,9 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
         // positioned elements
         if (curr->renderer()->isPositioned())
             continue; // Positioned placeholders don't affect calculations.
-        if (curr->y() == PositionTop || curr->y() == PositionBottom) {
-            int lineHeight = curr->lineHeight(false);
-            if (curr->y() == PositionTop) {
+        if (curr->logicalTop() == PositionTop || curr->logicalTop() == PositionBottom) {
+            int lineHeight = curr->lineHeight();
+            if (curr->logicalTop() == PositionTop) {
                 if (maxAscent + maxDescent < lineHeight)
                     maxDescent = lineHeight - maxAscent;
             }
@@ -386,7 +390,7 @@ void InlineFlowBox::adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
 static int verticalPositionForBox(InlineBox* curr, bool firstLine)
 {
     if (curr->renderer()->isText())
-        return curr->parent()->y();
+        return curr->parent()->logicalTop();
     if (curr->renderer()->isBox())
         return toRenderBox(curr->renderer())->verticalPosition(firstLine);
     return toRenderInline(curr->renderer())->verticalPositionFromCache(firstLine);
@@ -397,8 +401,8 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
 {
     if (isRootInlineBox()) {
         // Examine our root box.
-        int height = lineHeight(true);
-        int baseline = baselinePosition(true);
+        int height = lineHeight();
+        int baseline = baselinePosition();
         if (hasTextChildren() || strictMode) {
             int ascent = baseline;
             int descent = height - ascent;
@@ -451,19 +455,19 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
                 }
             }
         } else {
-            lineHeight = curr->lineHeight(false);
-            baseline = curr->baselinePosition(false);
+            lineHeight = curr->lineHeight();
+            baseline = curr->baselinePosition();
         }
 
-        curr->setY(verticalPositionForBox(curr, m_firstLine));
-        if (curr->y() == PositionTop) {
+        curr->setLogicalTop(verticalPositionForBox(curr, m_firstLine));
+        if (curr->logicalTop() == PositionTop) {
             if (maxPositionTop < lineHeight)
                 maxPositionTop = lineHeight;
-        } else if (curr->y() == PositionBottom) {
+        } else if (curr->logicalTop() == PositionBottom) {
             if (maxPositionBottom < lineHeight)
                 maxPositionBottom = lineHeight;
-        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasHorizontalBordersOrPadding() || strictMode) {
-            int ascent = baseline - curr->y();
+        } else if ((!isInlineFlow || static_cast<InlineFlowBox*>(curr)->hasTextChildren()) || curr->boxModelObject()->hasInlineDirectionBordersOrPadding() || strictMode) {
+            int ascent = baseline - curr->logicalTop();
             int descent = lineHeight - ascent;
             if (maxAscent < ascent)
                 maxAscent = ascent;
@@ -476,10 +480,10 @@ void InlineFlowBox::computeLogicalBoxHeights(int& maxPositionTop, int& maxPositi
     }
 }
 
-void InlineFlowBox::placeBoxesInBlockDirection(int yPos, int maxHeight, int maxAscent, bool strictMode, int& selectionTop, int& selectionBottom)
+void InlineFlowBox::placeBoxesInBlockDirection(int top, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom)
 {
     if (isRootInlineBox())
-        setY(yPos + maxAscent - baselinePosition(true)); // Place our root box.
+        setLogicalTop(top + maxAscent - baselinePosition()); // Place our root box.
 
     for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
         if (curr->renderer()->isPositioned())
@@ -489,47 +493,70 @@ void InlineFlowBox::placeBoxesInBlockDirection(int yPos, int maxHeight, int maxA
         // line-height).
         bool isInlineFlow = curr->isInlineFlowBox();
         if (isInlineFlow)
-            static_cast<InlineFlowBox*>(curr)->placeBoxesInBlockDirection(yPos, maxHeight, maxAscent, strictMode, selectionTop, selectionBottom);
+            static_cast<InlineFlowBox*>(curr)->placeBoxesInBlockDirection(top, maxHeight, maxAscent, strictMode, lineTop, lineBottom);
 
         bool childAffectsTopBottomPos = true;
-        if (curr->y() == PositionTop)
-            curr->setY(yPos);
-        else if (curr->y() == PositionBottom)
-            curr->setY(yPos + maxHeight - curr->lineHeight(false));
+        if (curr->logicalTop() == PositionTop)
+            curr->setLogicalTop(top);
+        else if (curr->logicalTop() == PositionBottom)
+            curr->setLogicalTop(top + maxHeight - curr->lineHeight());
         else {
-            if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasHorizontalBordersOrPadding() && !strictMode)
+            if ((isInlineFlow && !static_cast<InlineFlowBox*>(curr)->hasTextChildren()) && !curr->boxModelObject()->hasInlineDirectionBordersOrPadding() && !strictMode)
                 childAffectsTopBottomPos = false;
-            int posAdjust = maxAscent - curr->baselinePosition(false);
-            curr->setY(curr->y() + yPos + posAdjust);
+            int posAdjust = maxAscent - curr->baselinePosition();
+            curr->setLogicalTop(curr->logicalTop() + top + posAdjust);
         }
         
-        int newY = curr->y();
+        int newLogicalTop = curr->logicalTop();
         if (curr->isText() || curr->isInlineFlowBox()) {
             const Font& font = curr->renderer()->style(m_firstLine)->font();
-            newY += curr->baselinePosition(false) - font.ascent();
-            if (curr->isInlineFlowBox())
-                newY -= curr->boxModelObject()->borderTop() + curr->boxModelObject()->paddingTop();
+            newLogicalTop += curr->baselinePosition() - font.ascent();
+            if (curr->isInlineFlowBox()) {
+                RenderBoxModelObject* boxObject = toRenderBoxModelObject(curr->renderer());
+                newLogicalTop -= boxObject->style(m_firstLine)->isHorizontalWritingMode() ? boxObject->borderTop() + boxObject->paddingTop() : 
+                                 boxObject->borderRight() + boxObject->paddingRight();
+            }
         } else if (!curr->renderer()->isBR()) {
             RenderBox* box = toRenderBox(curr->renderer());
-            newY += box->marginTop();
+            newLogicalTop += box->style(m_firstLine)->isHorizontalWritingMode() ? box->marginTop() : box->marginRight();
         }
 
-        curr->setY(newY);
+        curr->setLogicalTop(newLogicalTop);
 
         if (childAffectsTopBottomPos) {
             int boxHeight = curr->logicalHeight();
-            selectionTop = min(selectionTop, newY);
-            selectionBottom = max(selectionBottom, newY + boxHeight);
+            lineTop = min(lineTop, newLogicalTop);
+            lineBottom = max(lineBottom, newLogicalTop + boxHeight);
         }
     }
 
     if (isRootInlineBox()) {
         const Font& font = renderer()->style(m_firstLine)->font();
-        setY(y() + baselinePosition(true) - font.ascent());
+        setLogicalTop(logicalTop() + baselinePosition() - font.ascent());
+        
         if (hasTextChildren() || strictMode) {
-            selectionTop = min(selectionTop, y());
-            selectionBottom = max(selectionBottom, y() + logicalHeight());
+            lineTop = min(lineTop, logicalTop());
+            lineBottom = max(lineBottom, logicalTop() + logicalHeight());
         }
+        
+        if (renderer()->style()->isFlippedLinesWritingMode())
+            flipLinesInBlockDirection(lineTop, lineBottom);
+    }
+}
+
+void InlineFlowBox::flipLinesInBlockDirection(int lineTop, int lineBottom)
+{
+    // Flip the box on the line such that the top is now relative to the lineBottom instead of the lineTop.
+    setLogicalTop(lineBottom - (logicalTop() - lineTop) - logicalHeight());
+    
+    for (InlineBox* curr = firstChild(); curr; curr = curr->nextOnLine()) {
+        if (curr->renderer()->isPositioned())
+            continue; // Positioned placeholders aren't affected here.
+        
+        if (curr->isInlineFlowBox())
+            static_cast<InlineFlowBox*>(curr)->flipLinesInBlockDirection(lineTop, lineBottom);
+        else
+            curr->setLogicalTop(lineBottom - (curr->logicalTop() - lineTop) - curr->logicalHeight());
     }
 }
 
@@ -612,7 +639,7 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 {
     IntRect overflowRect(visibleOverflowRect());
     overflowRect.move(tx, ty);
-    if (!overflowRect.intersects(result.rectFromPoint(x, y)))
+    if (!overflowRect.intersects(result.rectForPoint(x, y)))
         return false;
 
     // Check children first.
@@ -625,7 +652,7 @@ bool InlineFlowBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& re
 
     // Now check ourselves.
     IntRect rect(tx + m_x, ty + m_y, m_logicalWidth, logicalHeight());
-    if (visibleToHitTesting() && rect.intersects(result.rectFromPoint(x, y))) {
+    if (visibleToHitTesting() && rect.intersects(result.rectForPoint(x, y))) {
         renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty)); // Don't add in m_x or m_y here, we want coords in the containing block's space.
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), x, y, rect))
             return true;
@@ -758,16 +785,18 @@ void InlineFlowBox::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     int x = m_x;
     int y = m_y;
-    int w = logicalWidth();
-    int h = logicalHeight();
+    int w = m_isVertical ? logicalHeight() : logicalWidth();
+    int h = m_isVertical ? logicalWidth() : logicalHeight();
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
     if (!hasTextChildren() && !noQuirksMode) {
         RootInlineBox* rootBox = root();
-        int bottom = min(rootBox->lineBottom(), y + h);
-        y = max(rootBox->lineTop(), y);
-        h = bottom - y;
+        int& top = m_isVertical ? x : y;
+        int& logicalHeight = m_isVertical ? w : h;
+        int bottom = min(rootBox->lineBottom(), top + logicalHeight);
+        top = max(rootBox->lineTop(), top);
+        logicalHeight = bottom - top;
     }
     
     // Move x/y to our coordinates.
@@ -834,16 +863,18 @@ void InlineFlowBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 
     int x = m_x;
     int y = m_y;
-    int w = logicalWidth();
-    int h = logicalHeight();
+    int w = m_isVertical ? logicalHeight() : logicalWidth();
+    int h = m_isVertical ? logicalWidth() : logicalHeight();
 
     // Constrain our background/border painting to the line top and bottom if necessary.
     bool noQuirksMode = renderer()->document()->inNoQuirksMode();
     if (!hasTextChildren() && !noQuirksMode) {
         RootInlineBox* rootBox = root();
-        int bottom = min(rootBox->lineBottom(), y + h);
-        y = max(rootBox->lineTop(), y);
-        h = bottom - y;
+        int& top = m_isVertical ? x : y;
+        int& logicalHeight = m_isVertical ? w : h;
+        int bottom = min(rootBox->lineBottom(), top + logicalHeight);
+        top = max(rootBox->lineTop(), top);
+        logicalHeight = bottom - top;
     }
     
     // Move x/y to our coordinates.
@@ -945,7 +976,7 @@ void InlineFlowBox::paintTextDecorations(PaintInfo& paintInfo, int tx, int ty, b
         if (rootLine->ellipsisBox()) {
             int ellipsisX = m_x + rootLine->ellipsisBox()->x();
             int ellipsisWidth = rootLine->ellipsisBox()->logicalWidth();
-            bool ltr = renderer()->style()->direction() == LTR;
+            bool ltr = renderer()->style()->isLeftToRightDirection();
             if (rootLine == this) {
                 // Trim w and x so that the underline isn't drawn underneath the ellipsis.
                 // ltr: is our right edge farther right than the right edge of the ellipsis.
diff --git a/WebCore/rendering/InlineFlowBox.h b/WebCore/rendering/InlineFlowBox.h
index 2d57cca..ee16a0f 100644
--- a/WebCore/rendering/InlineFlowBox.h
+++ b/WebCore/rendering/InlineFlowBox.h
@@ -154,12 +154,13 @@ public:
     void determineSpacingForFlowBoxes(bool lastLine, RenderObject* endObject);
     int getFlowSpacingLogicalWidth();
     bool onEndChain(RenderObject* endObject);
-    int placeBoxesInInlineDirection(int x, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
+    int placeBoxesInInlineDirection(int logicalLeft, bool& needsWordSpacing, GlyphOverflowAndFallbackFontsMap&);
     void computeLogicalBoxHeights(int& maxPositionTop, int& maxPositionBottom,
                                   int& maxAscent, int& maxDescent, bool strictMode, GlyphOverflowAndFallbackFontsMap&);
     void adjustMaxAscentAndDescent(int& maxAscent, int& maxDescent,
                                    int maxPositionTop, int maxPositionBottom);
-    void placeBoxesInBlockDirection(int y, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom);
+    void placeBoxesInBlockDirection(int logicalTop, int maxHeight, int maxAscent, bool strictMode, int& lineTop, int& lineBottom);
+    void flipLinesInBlockDirection(int lineTop, int lineBottom);
     void computeBlockDirectionOverflow(int lineTop, int lineBottom, bool strictMode, GlyphOverflowAndFallbackFontsMap&);
 
     void removeChild(InlineBox* child);
@@ -185,15 +186,21 @@ public:
     int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : m_x; }
     int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : m_x + m_logicalWidth; }
     IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : IntRect(m_x, m_y, m_logicalWidth, logicalHeight()); }
-
+    int logicalLeftLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? leftLayoutOverflow() : topLayoutOverflow(); }
+    int logicalRightLayoutOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? rightLayoutOverflow() : bottomLayoutOverflow(); }
+    
     int topVisualOverflow() const { return m_overflow ? m_overflow->topVisualOverflow() : m_y; }
     int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : m_y + logicalHeight(); }
     int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : m_x; }
     int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : m_x + m_logicalWidth; }
     IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : IntRect(m_x, m_y, m_logicalWidth, logicalHeight()); }
-
-    void setInlineDirectionOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow);
-    void setBlockDirectionOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight);
+    int logicalLeftVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? leftVisualOverflow() : topVisualOverflow(); }
+    int logicalRightVisualOverflow() const { return renderer()->style()->isHorizontalWritingMode() ? rightVisualOverflow() : bottomVisualOverflow(); }
+    
+    void setInlineDirectionOverflowPositions(int logicalLeftLayoutOverflow, int logicalRightLayoutOverflow,
+                                             int logicalLeftVisualOverflow, int logicalRightVisualOverflow);
+    void setBlockDirectionOverflowPositions(int logicalTopLayoutOverflow, int logicalBottomLayoutOverflow,
+                                            int logicalTopVisualOverflow, int logicalBottomVisualOverflow, int boxLogicalHeight);
 
 protected:
     OwnPtr<RenderOverflow> m_overflow;
@@ -215,18 +222,31 @@ protected:
 #endif
 };
 
-inline void InlineFlowBox::setInlineDirectionOverflowPositions(int leftLayoutOverflow, int rightLayoutOverflow, int leftVisualOverflow, int rightVisualOverflow) 
+inline void InlineFlowBox::setInlineDirectionOverflowPositions(int logicalLeftLayoutOverflow, int logicalRightLayoutOverflow, 
+                                                               int logicalLeftVisualOverflow, int logicalRightVisualOverflow) 
 { 
     if (!m_overflow) {
-        if (leftLayoutOverflow == m_x && rightLayoutOverflow == m_x + m_logicalWidth && leftVisualOverflow == m_x && rightVisualOverflow == m_x + m_logicalWidth)
+        if (logicalLeftLayoutOverflow == logicalLeft() && logicalRightLayoutOverflow == logicalRight() 
+            && logicalLeftVisualOverflow == logicalLeft() && logicalRightVisualOverflow == logicalRight())
             return;
-        m_overflow = adoptPtr(new RenderOverflow(IntRect(m_x, m_y, m_logicalWidth, m_renderer->style(m_firstLine)->font().height())));    
+        
+        int width = isVertical() ? m_renderer->style(m_firstLine)->font().height() : logicalWidth();
+        int height = isVertical() ? logicalWidth() : m_renderer->style(m_firstLine)->font().height();
+        
+        m_overflow = adoptPtr(new RenderOverflow(IntRect(m_x, m_y, width, height)));   
     }
 
-    m_overflow->setLeftLayoutOverflow(leftLayoutOverflow);
-    m_overflow->setRightLayoutOverflow(rightLayoutOverflow);
-    m_overflow->setLeftVisualOverflow(leftVisualOverflow); 
-    m_overflow->setRightVisualOverflow(rightVisualOverflow);  
+    if (isVertical()) {
+        m_overflow->setTopLayoutOverflow(logicalLeftLayoutOverflow);
+        m_overflow->setBottomLayoutOverflow(logicalRightLayoutOverflow);
+        m_overflow->setTopVisualOverflow(logicalLeftVisualOverflow); 
+        m_overflow->setBottomVisualOverflow(logicalRightVisualOverflow);  
+    } else {
+        m_overflow->setLeftLayoutOverflow(logicalLeftLayoutOverflow);
+        m_overflow->setRightLayoutOverflow(logicalRightLayoutOverflow);
+        m_overflow->setLeftVisualOverflow(logicalLeftVisualOverflow); 
+        m_overflow->setRightVisualOverflow(logicalRightVisualOverflow);
+    }
 }
 
 inline void InlineFlowBox::setBlockDirectionOverflowPositions(int topLayoutOverflow, int bottomLayoutOverflow, int topVisualOverflow, int bottomVisualOverflow, int boxHeight)
diff --git a/WebCore/rendering/InlineIterator.h b/WebCore/rendering/InlineIterator.h
index 9310ea8..270364f 100644
--- a/WebCore/rendering/InlineIterator.h
+++ b/WebCore/rendering/InlineIterator.h
@@ -53,7 +53,7 @@ public:
     bool atEnd() const;
 
     UChar current() const;
-    WTF::Unicode::Direction direction() const;
+    ALWAYS_INLINE WTF::Unicode::Direction direction() const;
 
     RenderBlock* block;
     RenderObject* obj;
@@ -220,7 +220,7 @@ ALWAYS_INLINE WTF::Unicode::Direction InlineIterator::direction() const
         return WTF::Unicode::direction(c);
 
     if (obj && obj->isListMarker())
-        return obj->style()->direction() == LTR ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
+        return obj->style()->isLeftToRightDirection() ? WTF::Unicode::LeftToRight : WTF::Unicode::RightToLeft;
 
     return WTF::Unicode::OtherNeutral;
 }
diff --git a/WebCore/rendering/InlineTextBox.cpp b/WebCore/rendering/InlineTextBox.cpp
index 68bff3c..cf100e0 100644
--- a/WebCore/rendering/InlineTextBox.cpp
+++ b/WebCore/rendering/InlineTextBox.cpp
@@ -43,6 +43,22 @@ using namespace std;
 
 namespace WebCore {
 
+int InlineTextBox::baselinePosition() const
+{
+    if (!isText() || !parent())
+        return 0;
+    return parent()->baselinePosition();
+}
+    
+int InlineTextBox::lineHeight() const
+{
+    if (!isText() || !parent())
+        return 0;
+    if (m_renderer->isBR())
+        return toRenderBR(m_renderer)->lineHeight(m_firstLine);
+    return parent()->lineHeight();
+}
+
 int InlineTextBox::selectionTop()
 {
     return root()->selectionTop();
@@ -137,7 +153,7 @@ IntRect InlineTextBox::selectionRect(int tx, int ty, int startPos, int endPos)
         ePos = len;
     }
 
-    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride),
+    IntRect r = enclosingIntRect(f.selectionRectForText(TextRun(characters, len, textObj->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride),
                                                         IntPoint(tx + m_x, ty + selTop), selHeight, sPos, ePos));
     if (r.x() > tx + m_x + m_logicalWidth)
         r.setWidth(0);
@@ -198,7 +214,7 @@ int InlineTextBox::placeEllipsisBox(bool flowIsLTR, int visibleLeftEdge, int vis
         // The inline box may have different directionality than it's parent.  Since truncation
         // behavior depends both on both the parent and the inline block's directionality, we
         // must keep track of these separately.
-        bool ltr = direction() == LTR;
+        bool ltr = isLeftToRightDirection();
         if (ltr != flowIsLTR) {
           // Width in pixels of the visible portion of the box, excluding the ellipsis.
           int visibleBoxWidth = visibleRightEdge - visibleLeftEdge  - ellipsisWidth;
@@ -287,7 +303,7 @@ bool InlineTextBox::nodeAtPoint(const HitTestRequest&, HitTestResult& result, in
         return false;
 
     IntRect rect(tx + m_x, ty + m_y, m_logicalWidth, logicalHeight());
-    if (m_truncation != cFullTruncation && visibleToHitTesting() && rect.intersects(result.rectFromPoint(x, y))) {
+    if (m_truncation != cFullTruncation && visibleToHitTesting() && rect.intersects(result.rectForPoint(x, y))) {
         renderer()->updateHitTestResult(result, IntPoint(x - tx, y - ty));
         if (!result.addNodeToRectBasedTestResult(renderer()->node(), x, y, rect))
             return true;
@@ -382,8 +398,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
         return;
 
     if (m_truncation != cNoTruncation) {
-        TextDirection flowDirection = renderer()->containingBlock()->style()->direction();
-        if (flowDirection != direction()) {
+        if (renderer()->containingBlock()->style()->isLeftToRightDirection() != isLeftToRightDirection()) {
             // Make the visible fragment of text hug the edge closest to the rest of the run by moving the origin
             // at which we start drawing text.
             // e.g. In the case of LTR text truncated in an RTL Context, the correct behavior is:
@@ -395,7 +410,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
             int widthOfVisibleText = toRenderText(renderer())->width(m_start, m_truncation, textPos(), m_firstLine);
             int widthOfHiddenText = m_logicalWidth - widthOfVisibleText;
             // FIXME: The hit testing logic also needs to take this translation int account.
-            tx += direction() == LTR ? widthOfHiddenText : -widthOfHiddenText;
+            tx += isLeftToRightDirection() ? widthOfHiddenText : -widthOfHiddenText;
         }
     }
 
@@ -504,7 +519,7 @@ void InlineTextBox::paint(PaintInfo& paintInfo, int tx, int ty)
 
     int baseline = renderer()->style(m_firstLine)->font().ascent();
     IntPoint textOrigin(m_x + tx, m_y + ty + baseline);
-    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || styleToUse->visuallyOrdered());
+    TextRun textRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || styleToUse->visuallyOrdered());
 
     int sPos = 0;
     int ePos = 0;
@@ -635,7 +650,7 @@ void InlineTextBox::paintSelection(GraphicsContext* context, int tx, int ty, Ren
 
     context->clip(IntRect(m_x + tx, y + ty, m_logicalWidth, h));
     context->drawHighlightForText(font, TextRun(characters, length, textRenderer()->allowTabs(), textPos(), m_toAdd, 
-                                  direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+                                  !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
@@ -658,7 +673,7 @@ void InlineTextBox::paintCompositionBackground(GraphicsContext* context, int tx,
     int y = selectionTop();
     int h = selectionHeight();
     context->drawHighlightForText(font, TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd,
-                                  direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+                                  !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                   IntPoint(m_x + tx, y + ty), h, c, style->colorSpace(), sPos, ePos);
     context->restore();
 }
@@ -694,7 +709,7 @@ void InlineTextBox::paintDecoration(GraphicsContext* context, int tx, int ty, in
     int width = m_logicalWidth;
     if (m_truncation != cNoTruncation) {
         width = toRenderText(renderer())->width(m_start, m_truncation, textPos(), m_firstLine);
-        if (direction() == RTL)
+        if (!isLeftToRightDirection())
             tx += (m_logicalWidth - width);
     }
     
@@ -813,7 +828,7 @@ void InlineTextBox::paintSpellingOrGrammarMarker(GraphicsContext* pt, int tx, in
 
         // Calculate start & width
         IntPoint startPoint(tx + m_x, ty + selectionTop());
-        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+        TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
         int h = selectionHeight();
         
         IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, startPoint, h, startPosition, endPosition));
@@ -858,7 +873,7 @@ void InlineTextBox::paintTextMatchMarker(GraphicsContext* pt, int tx, int ty, co
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     
     // Always compute and store the rect associated with this marker. The computed rect is in absolute coordinates.
     IntRect markerRect = enclosingIntRect(font.selectionRectForText(run, IntPoint(m_x, y), h, sPos, ePos));
@@ -886,7 +901,7 @@ void InlineTextBox::computeRectForReplacementMarker(int /*tx*/, int /*ty*/, cons
     
     int sPos = max(marker.startOffset - m_start, (unsigned)0);
     int ePos = min(marker.endOffset - m_start, (unsigned)m_len);    
-    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered());
+    TextRun run(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered());
     IntPoint startPoint = IntPoint(m_x, y);
     
     // Compute and store the rect associated with this marker.
@@ -1031,7 +1046,7 @@ int InlineTextBox::textPos() const
         return 0;
         
     RenderBlock* blockElement = renderer()->containingBlock();
-    return direction() == RTL ? x() - blockElement->borderRight() - blockElement->paddingRight()
+    return !isLeftToRightDirection() ? x() - blockElement->borderRight() - blockElement->paddingRight()
                       : x() - blockElement->borderLeft() - blockElement->paddingLeft();
 }
 
@@ -1043,7 +1058,7 @@ int InlineTextBox::offsetForPosition(int _x, bool includePartialGlyphs) const
     RenderText* text = toRenderText(renderer());
     RenderStyle* style = text->style(m_firstLine);
     const Font* f = &style->font();
-    return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride || style->visuallyOrdered()),
+    return f->offsetForPosition(TextRun(textRenderer()->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride || style->visuallyOrdered()),
                                 _x - m_x, includePartialGlyphs);
 }
 
@@ -1057,10 +1072,10 @@ int InlineTextBox::positionForOffset(int offset) const
 
     RenderText* text = toRenderText(renderer());
     const Font& f = text->style(m_firstLine)->font();
-    int from = direction() == RTL ? offset - m_start : 0;
-    int to = direction() == RTL ? m_len : offset - m_start;
+    int from = !isLeftToRightDirection() ? offset - m_start : 0;
+    int to = !isLeftToRightDirection() ? m_len : offset - m_start;
     // FIXME: Do we need to add rightBearing here?
-    return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, direction() == RTL, m_dirOverride),
+    return enclosingIntRect(f.selectionRectForText(TextRun(text->text()->characters() + m_start, m_len, textRenderer()->allowTabs(), textPos(), m_toAdd, !isLeftToRightDirection(), m_dirOverride),
                                                    IntPoint(m_x, 0), 0, from, to)).right();
 }
 
diff --git a/WebCore/rendering/InlineTextBox.h b/WebCore/rendering/InlineTextBox.h
index 2bf099b..f010c39 100644
--- a/WebCore/rendering/InlineTextBox.h
+++ b/WebCore/rendering/InlineTextBox.h
@@ -69,6 +69,10 @@ public:
     void setHasHyphen(bool hasHyphen) { m_hasEllipsisBoxOrHyphen = hasHyphen; }
     static inline bool compareByStart(const InlineTextBox* first, const InlineTextBox* second) { return first->start() < second->start(); }
 
+    
+    virtual int baselinePosition() const;
+    virtual int lineHeight() const;
+
 private:
     virtual int selectionTop();
     virtual int selectionHeight();
@@ -78,7 +82,7 @@ public:
 
     virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
     bool isSelected(int startPos, int endPos) const;
-    virtual void selectionStartEnd(int& sPos, int& ePos);
+    void selectionStartEnd(int& sPos, int& ePos);
 
 protected:
     virtual void paint(PaintInfo&, int tx, int ty);
diff --git a/WebCore/rendering/LayoutState.cpp b/WebCore/rendering/LayoutState.cpp
index 0d81b15..3eea51f 100644
--- a/WebCore/rendering/LayoutState.cpp
+++ b/WebCore/rendering/LayoutState.cpp
@@ -34,7 +34,7 @@
 
 namespace WebCore {
 
-LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize& offset, int pageHeight, ColumnInfo* columnInfo)
+LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize& offset, int pageHeight, bool pageHeightChanged, ColumnInfo* columnInfo)
     : m_columnInfo(columnInfo)
     , m_next(prev)
 #ifndef NDEBUG
@@ -86,9 +86,11 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize&
         m_pageHeight = pageHeight;
         m_pageOffset = IntSize(m_layoutOffset.width() + renderer->borderLeft() + renderer->paddingLeft(),
                                m_layoutOffset.height() + renderer->borderTop() + renderer->paddingTop());
+        m_pageHeightChanged = pageHeightChanged;
     } else {
         // If we don't establish a new page height, then propagate the old page height and offset down.
         m_pageHeight = m_next->m_pageHeight;
+        m_pageHeightChanged = m_next->m_pageHeightChanged;
         m_pageOffset = m_next->m_pageOffset;
         
         // Disable pagination for objects we don't support.  For now this includes overflow:scroll/auto and inline blocks.
@@ -107,6 +109,7 @@ LayoutState::LayoutState(LayoutState* prev, RenderBox* renderer, const IntSize&
 LayoutState::LayoutState(RenderObject* root)
     : m_clipped(false)
     , m_pageHeight(0)
+    , m_pageHeightChanged(false)
     , m_columnInfo(0)
     , m_next(0)
 #ifndef NDEBUG
diff --git a/WebCore/rendering/LayoutState.h b/WebCore/rendering/LayoutState.h
index ca4cbfb..cca3e42 100644
--- a/WebCore/rendering/LayoutState.h
+++ b/WebCore/rendering/LayoutState.h
@@ -42,6 +42,7 @@ public:
     LayoutState()
         : m_clipped(false)
         , m_pageHeight(0)
+        , m_pageHeightChanged(false)
         , m_columnInfo(0)
         , m_next(0)
 #ifndef NDEBUG
@@ -50,7 +51,7 @@ public:
     {
     }
 
-    LayoutState(LayoutState*, RenderBox*, const IntSize& offset, int pageHeight, ColumnInfo*);
+    LayoutState(LayoutState*, RenderBox*, const IntSize& offset, int pageHeight, bool pageHeightChanged, ColumnInfo*);
     LayoutState(RenderObject*);
 
     void destroy(RenderArena*);
@@ -67,6 +68,9 @@ public:
     int pageY(int childY) const;
     void addForcedColumnBreak(int childY);
     
+    bool pageHeight() const { return m_pageHeight; }
+    bool pageHeightChanged() const { return m_pageHeightChanged; }
+
 private:
     // The normal operator new is disallowed.
     void* operator new(size_t) throw();
@@ -81,6 +85,7 @@ public:
                            // This is a total delta accumulated from the root.
 
     int m_pageHeight; // The current page height for the pagination model that encloses us.
+    bool m_pageHeightChanged; // If our page height has changed, this will force all blocks to relayout.
     IntSize m_pageOffset; // The offset of the start of the first page in the nearest enclosing pagination model.
     ColumnInfo* m_columnInfo; // If the enclosing pagination model is a column model, then this will store column information for easy retrieval/manipulation.
 
diff --git a/WebCore/rendering/RenderApplet.cpp b/WebCore/rendering/RenderApplet.cpp
index 63a18a0..f9eb56e 100644
--- a/WebCore/rendering/RenderApplet.cpp
+++ b/WebCore/rendering/RenderApplet.cpp
@@ -39,6 +39,10 @@ RenderApplet::RenderApplet(HTMLAppletElement* applet, const HashMap<String, Stri
     setInline(true);
 }
 
+RenderApplet::~RenderApplet()
+{
+}
+
 IntSize RenderApplet::intrinsicSize() const
 {
     // FIXME: This doesn't make sense. We can't just start returning
diff --git a/WebCore/rendering/RenderApplet.h b/WebCore/rendering/RenderApplet.h
index 62f46cd..641568d 100644
--- a/WebCore/rendering/RenderApplet.h
+++ b/WebCore/rendering/RenderApplet.h
@@ -32,6 +32,7 @@ namespace WebCore {
     class RenderApplet : public RenderWidget {
     public:
         RenderApplet(HTMLAppletElement*, const HashMap<String, String>& args);
+        virtual ~RenderApplet();
 
         void createWidgetIfNecessary();
 
diff --git a/WebCore/rendering/RenderBR.cpp b/WebCore/rendering/RenderBR.cpp
index 340d6b7..fb136a4 100644
--- a/WebCore/rendering/RenderBR.cpp
+++ b/WebCore/rendering/RenderBR.cpp
@@ -38,36 +38,17 @@ RenderBR::~RenderBR()
 {
 }
 
-int RenderBR::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderBR::lineHeight(bool firstLine) const
 {
-    if (firstTextBox() && !firstTextBox()->isText())
-        return 0;
-    return RenderText::baselinePosition(firstLine, isRootLineBox);
-}
-
-int RenderBR::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
-{
-    if (firstTextBox() && !firstTextBox()->isText())
-        return 0;
-
-    if (firstLine) {
+    if (firstLine && document()->usesFirstLineRules()) {
         RenderStyle* s = style(firstLine);
-        Length lh = s->lineHeight();
-        if (lh.isNegative()) {
-            if (s == style()) {
-                if (m_lineHeight == -1)
-                    m_lineHeight = RenderObject::lineHeight(false);
-                return m_lineHeight;
-            }
-            return s->font().lineSpacing();
-        }
-        if (lh.isPercent())
-            return lh.calcMinValue(s->fontSize());
-        return lh.value();
+        if (s != style())
+            return s->computedLineHeight();
     }
-
+    
     if (m_lineHeight == -1)
-        m_lineHeight = RenderObject::lineHeight(false);
+        m_lineHeight = style()->computedLineHeight();
+    
     return m_lineHeight;
 }
 
diff --git a/WebCore/rendering/RenderBR.h b/WebCore/rendering/RenderBR.h
index 8850d46..7216b5a 100644
--- a/WebCore/rendering/RenderBR.h
+++ b/WebCore/rendering/RenderBR.h
@@ -43,8 +43,7 @@ public:
     virtual unsigned width(unsigned /*from*/, unsigned /*len*/, const Font&, int /*xpos*/) const { return 0; }
     virtual unsigned width(unsigned /*from*/, unsigned /*len*/, int /*xpos*/, bool /*firstLine = false*/) const { return 0; }
 
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
+    int lineHeight(bool firstLine) const;
 
     // overrides
     virtual bool isBR() const { return true; }
@@ -62,6 +61,22 @@ private:
     mutable int m_lineHeight;
 };
 
+
+inline RenderBR* toRenderBR(RenderObject* object)
+{ 
+    ASSERT(!object || object->isBR());
+    return static_cast<RenderBR*>(object);
+}
+
+inline const RenderBR* toRenderBR(const RenderObject* object)
+{ 
+    ASSERT(!object || object->isBR());
+    return static_cast<const RenderBR*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderBR(const RenderBR*);
+
 } // namespace WebCore
 
 #endif // RenderBR_h
diff --git a/WebCore/rendering/RenderBlock.cpp b/WebCore/rendering/RenderBlock.cpp
index 1e378d8..d951277 100644
--- a/WebCore/rendering/RenderBlock.cpp
+++ b/WebCore/rendering/RenderBlock.cpp
@@ -94,7 +94,7 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int beforeBorderPadding,
     // we're positioned, floating, a table cell.
     m_canCollapseWithChildren = !block->isRenderView() && !block->isRoot() && !block->isPositioned()
         && !block->isFloating() && !block->isTableCell() && !block->hasOverflowClip() && !block->isInlineBlockOrInlineTable()
-        && !block->isBlockFlowRoot();
+        && !block->isWritingModeRoot();
 
     m_canCollapseMarginBeforeWithChildren = m_canCollapseWithChildren && (beforeBorderPadding == 0) && block->style()->marginBeforeCollapse() != MSEPARATE;
 
@@ -108,8 +108,8 @@ RenderBlock::MarginInfo::MarginInfo(RenderBlock* block, int beforeBorderPadding,
     m_quirkContainer = block->isTableCell() || block->isBody() || block->style()->marginBeforeCollapse() == MDISCARD || 
         block->style()->marginAfterCollapse() == MDISCARD;
 
-    m_posMargin = m_canCollapseMarginBeforeWithChildren ? block->maxMarginBefore(RenderBox::PositiveMargin) : 0;
-    m_negMargin = m_canCollapseMarginBeforeWithChildren ? block->maxMarginBefore(RenderBox::NegativeMargin) : 0;
+    m_positiveMargin = m_canCollapseMarginBeforeWithChildren ? block->maxPositiveMarginBefore() : 0;
+    m_negativeMargin = m_canCollapseMarginBeforeWithChildren ? block->maxNegativeMarginBefore() : 0;
 }
 
 // -------------------------------------------------------------------------------------------------------
@@ -1023,24 +1023,25 @@ bool RenderBlock::isSelfCollapsingBlock() const
     // (c) have border/padding,
     // (d) have a min-height
     // (e) have specified that one of our margins can't collapse using a CSS extension
-    if (height() > 0
-        || isTable() || borderAndPaddingHeight()
-        || style()->minHeight().isPositive()
+    if (logicalHeight() > 0
+        || isTable() || borderAndPaddingLogicalHeight()
+        || style()->logicalMinHeight().isPositive()
         || style()->marginBeforeCollapse() == MSEPARATE || style()->marginAfterCollapse() == MSEPARATE)
         return false;
 
-    bool hasAutoHeight = style()->height().isAuto();
-    if (style()->height().isPercent() && !document()->inQuirksMode()) {
+    Length logicalHeightLength = style()->logicalHeight();
+    bool hasAutoHeight = logicalHeightLength.isAuto();
+    if (logicalHeightLength.isPercent() && !document()->inQuirksMode()) {
         hasAutoHeight = true;
         for (RenderBlock* cb = containingBlock(); !cb->isRenderView(); cb = cb->containingBlock()) {
-            if (cb->style()->height().isFixed() || cb->isTableCell())
+            if (cb->style()->logicalHeight().isFixed() || cb->isTableCell())
                 hasAutoHeight = false;
         }
     }
 
     // If the height is 0 or auto, then whether or not we are a self-collapsing block depends
     // on whether we have content that is all self-collapsing or not.
-    if (hasAutoHeight || ((style()->height().isFixed() || style()->height().isPercent()) && style()->height().isZero())) {
+    if (hasAutoHeight || ((logicalHeightLength.isFixed() || logicalHeightLength.isPercent()) && logicalHeightLength.isZero())) {
         // If the block has inline children, see if we generated any line boxes.  If we have any
         // line boxes, then we can't be self-collapsing, since we have content.
         if (childrenInline())
@@ -1125,7 +1126,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
 
     LayoutRepainter repainter(*this, m_everHadLayout && checkForRepaintDuringLayout());
 
-    int oldWidth = width();
+    int oldWidth = logicalWidth();
     int oldColumnWidth = desiredColumnWidth();
 
     computeLogicalWidth();
@@ -1145,6 +1146,7 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
     int previousHeight = logicalHeight();
     setLogicalHeight(0);
     bool hasSpecifiedPageHeight = false;
+    bool pageHeightChanged = false;
     ColumnInfo* colInfo = columnInfo();
     if (hasColumns()) {
         if (!pageHeight) {
@@ -1160,14 +1162,14 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
         }
         if (colInfo->columnHeight() != pageHeight && m_everHadLayout) {
             colInfo->setColumnHeight(pageHeight);
-            markDescendantBlocksAndLinesForLayout(); // We need to dirty all descendant blocks and lines, since the column height is different now.
+            pageHeightChanged = true;
         }
         
         if (!hasSpecifiedPageHeight && !pageHeight)
             colInfo->clearForcedBreaks();
     }
 
-    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection(), pageHeight, colInfo);
+    LayoutStateMaintainer statePusher(view(), this, IntSize(x(), y()), hasColumns() || hasTransform() || hasReflection(), pageHeight, pageHeightChanged, colInfo);
 
     // We use four values, maxTopPos, maxTopNeg, maxBottomPos, and maxBottomNeg, to track
     // our current maximal positive and negative margins.  These values are used when we
@@ -1204,20 +1206,20 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
             layer()->setHasVerticalScrollbar(true);
     }
 
-    int repaintTop = 0;
-    int repaintBottom = 0;
-    int maxFloatBottom = 0;
+    int repaintLogicalTop = 0;
+    int repaintLogicalBottom = 0;
+    int maxFloatLogicalBottom = 0;
     if (!firstChild() && !isAnonymousBlock())
         setChildrenInline(true);
     if (childrenInline())
-        layoutInlineChildren(relayoutChildren, repaintTop, repaintBottom);
+        layoutInlineChildren(relayoutChildren, repaintLogicalTop, repaintLogicalBottom);
     else
-        layoutBlockChildren(relayoutChildren, maxFloatBottom);
+        layoutBlockChildren(relayoutChildren, maxFloatLogicalBottom);
 
     // Expand our intrinsic height to encompass floats.
-    int toAdd = borderAfter() + paddingAfter() + horizontalScrollbarHeight(); // FIXME: https://bugs.webkit.org/show_bug.cgi?id=46645, overflow and block-flow.
-    if (floatBottom() > (logicalHeight() - toAdd) && expandsToEncloseOverhangingFloats())
-        setLogicalHeight(floatBottom() + toAdd);
+    int toAdd = borderAfter() + paddingAfter() + scrollbarLogicalHeight();
+    if (lowestFloatLogicalBottom() > (logicalHeight() - toAdd) && expandsToEncloseOverhangingFloats())
+        setLogicalHeight(lowestFloatLogicalBottom() + toAdd);
     
     if (layoutColumns(hasSpecifiedPageHeight, pageHeight, statePusher))
         return;
@@ -1227,13 +1229,13 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
     computeLogicalHeight();
     int newHeight = logicalHeight();
     if (oldHeight != newHeight) {
-        if (oldHeight > newHeight && maxFloatBottom > newHeight && !childrenInline()) {
+        if (oldHeight > newHeight && maxFloatLogicalBottom > newHeight && !childrenInline()) {
             // One of our children's floats may have become an overhanging float for us. We need to look for it.
             for (RenderObject* child = firstChild(); child; child = child->nextSibling()) {
                 if (child->isBlockFlow() && !child->isFloatingOrPositioned()) {
                     RenderBlock* block = toRenderBlock(child);
-                    if (block->floatBottom() + block->logicalTop() > newHeight)
-                        addOverhangingFloats(block, -block->x(), -block->y(), false);
+                    if (block->lowestFloatLogicalBottom() + block->logicalTop() > newHeight)
+                        addOverhangingFloats(block, -block->logicalLeft(), -block->logicalTop(), false);
                 }
             }
         }
@@ -1273,10 +1275,15 @@ void RenderBlock::layoutBlock(bool relayoutChildren, int pageHeight)
 
     // Repaint with our new bounds if they are different from our old bounds.
     bool didFullRepaint = repainter.repaintAfterLayout();
-    if (!didFullRepaint && repaintTop != repaintBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
-        int repaintLeft = min(leftVisualOverflow(), leftLayoutOverflow());
-        int repaintRight = max(rightVisualOverflow(), rightLayoutOverflow());
-        IntRect repaintRect(repaintLeft, repaintTop, repaintRight - repaintLeft, repaintBottom - repaintTop);
+    if (!didFullRepaint && repaintLogicalTop != repaintLogicalBottom && (style()->visibility() == VISIBLE || enclosingLayer()->hasVisibleContent())) {
+        int repaintLogicalLeft = min(logicalLeftVisualOverflow(), logicalLeftLayoutOverflow());
+        int repaintLogicalRight = max(logicalRightVisualOverflow(), logicalRightLayoutOverflow());
+        
+        IntRect repaintRect;
+        if (style()->isHorizontalWritingMode())
+            repaintRect = IntRect(repaintLogicalLeft, repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop);
+        else
+            repaintRect = IntRect(repaintLogicalTop, repaintLogicalLeft, repaintLogicalBottom - repaintLogicalTop, repaintLogicalRight - repaintLogicalLeft);
 
         // The repaint rect may be split across columns, in which case adjustRectForColumns() will return the union.
         adjustRectForColumns(repaintRect);
@@ -1318,7 +1325,7 @@ void RenderBlock::addOverflowFromFloats()
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (; (r = it.current()); ++it) {
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
-            addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
+            addOverflowFromChild(r->m_renderer, IntSize(r->left() + r->m_renderer->marginLeft(), r->top() + r->m_renderer->marginTop()));
     }
     return;
 }
@@ -1326,13 +1333,13 @@ void RenderBlock::addOverflowFromFloats()
 bool RenderBlock::expandsToEncloseOverhangingFloats() const
 {
     return isInlineBlockOrInlineTable() || isFloatingOrPositioned() || hasOverflowClip() || (parent() && parent()->isFlexibleBox())
-           || hasColumns() || isTableCell() || isFieldset() || isBlockFlowRoot();
+           || hasColumns() || isTableCell() || isFieldset() || isWritingModeRoot();
 }
 
 void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marginInfo)
 {
     if (child->style()->hasStaticX()) {
-        if (style()->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             child->layer()->setStaticX(borderLeft() + paddingLeft());
         else
             child->layer()->setStaticX(borderRight() + paddingRight());
@@ -1343,8 +1350,8 @@ void RenderBlock::adjustPositionedBlock(RenderBox* child, const MarginInfo& marg
         if (!marginInfo.canCollapseWithMarginBefore()) {
             child->computeBlockDirectionMargins(this);
             int marginTop = child->marginTop();
-            int collapsedTopPos = marginInfo.posMargin();
-            int collapsedTopNeg = marginInfo.negMargin();
+            int collapsedTopPos = marginInfo.positiveMargin();
+            int collapsedTopNeg = marginInfo.negativeMargin();
             if (marginTop > 0) {
                 if (marginTop > collapsedTopPos)
                     collapsedTopPos = marginTop;
@@ -1378,9 +1385,9 @@ void RenderBlock::adjustFloatingBlock(const MarginInfo& marginInfo)
     // http://www.hixie.ch/tests/adhoc/css/box/block/margin-collapse/046.html for
     // an example of this scenario.
     int marginOffset = marginInfo.canCollapseWithMarginBefore() ? 0 : marginInfo.margin();
-    setLogicalHeight(height() + marginOffset);
+    setLogicalHeight(logicalHeight() + marginOffset);
     positionNewFloats();
-    setLogicalHeight(height() - marginOffset);
+    setLogicalHeight(logicalHeight() - marginOffset);
 }
 
 bool RenderBlock::handleSpecialChild(RenderBox* child, const MarginInfo& marginInfo)
@@ -1474,15 +1481,18 @@ bool RenderBlock::handleRunInChild(RenderBox* child)
 
 int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
 {
+    // Get the four margin values for the child and cache them.
+    const MarginValues childMargins = marginValuesForChild(child);
+
     // Get our max pos and neg top margins.
-    int posTop = child->maxMarginBefore(PositiveMargin);
-    int negTop = child->maxMarginBefore(NegativeMargin);
+    int posTop = childMargins.positiveMarginBefore();
+    int negTop = childMargins.negativeMarginBefore();
 
     // For self-collapsing blocks, collapse our bottom margins into our
     // top to get new posTop and negTop values.
     if (child->isSelfCollapsingBlock()) {
-        posTop = max(posTop, child->maxMarginAfter(PositiveMargin));
-        negTop = max(negTop, child->maxMarginAfter(NegativeMargin));
+        posTop = max(posTop, childMargins.positiveMarginAfter());
+        negTop = max(negTop, childMargins.negativeMarginAfter());
     }
     
     // See if the top margin is quirky. We only care if this child has
@@ -1494,18 +1504,18 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
         // block.  If it has larger margin values, then we need to update
         // our own maximal values.
         if (!document()->inQuirksMode() || !marginInfo.quirkContainer() || !topQuirk)
-            setMaxMarginBeforeValues(max(posTop, maxPosMarginBefore()), max(negTop, maxNegMarginBefore()));
+            setMaxMarginBeforeValues(max(posTop, maxPositiveMarginBefore()), max(negTop, maxNegativeMarginBefore()));
 
         // The minute any of the margins involved isn't a quirk, don't
         // collapse it away, even if the margin is smaller (www.webreference.com
         // has an example of this, a <dt> with 0.8em author-specified inside
         // a <dl> inside a <td>.
-        if (!marginInfo.determinedMarginBeforeQuirk() && !topQuirk && (posTop-negTop)) {
+        if (!marginInfo.determinedMarginBeforeQuirk() && !topQuirk && (posTop - negTop)) {
             setMarginBeforeQuirk(false);
             marginInfo.setDeterminedMarginBeforeQuirk(true);
         }
 
-        if (!marginInfo.determinedMarginBeforeQuirk() && topQuirk && marginTop() == 0)
+        if (!marginInfo.determinedMarginBeforeQuirk() && topQuirk && !marginBefore())
             // We have no top margin and our top child has a quirky margin.
             // We will pick up this quirky margin and pass it through.
             // This deals with the <td><div><p> case.
@@ -1517,44 +1527,44 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
     if (marginInfo.quirkContainer() && marginInfo.atBeforeSideOfBlock() && (posTop - negTop))
         marginInfo.setMarginBeforeQuirk(topQuirk);
 
-    int beforeCollapseY = height();
-    int ypos = beforeCollapseY;
+    int beforeCollapseLogicalTop = logicalHeight();
+    int logicalTop = beforeCollapseLogicalTop;
     if (child->isSelfCollapsingBlock()) {
         // This child has no height.  We need to compute our
         // position before we collapse the child's margins together,
         // so that we can get an accurate position for the zero-height block.
-        int collapsedTopPos = max(marginInfo.posMargin(), child->maxMarginBefore(PositiveMargin));
-        int collapsedTopNeg = max(marginInfo.negMargin(), child->maxMarginBefore(NegativeMargin));
-        marginInfo.setMargin(collapsedTopPos, collapsedTopNeg);
+        int collapsedBeforePos = max(marginInfo.positiveMargin(), childMargins.positiveMarginBefore());
+        int collapsedBeforeNeg = max(marginInfo.negativeMargin(), childMargins.negativeMarginBefore());
+        marginInfo.setMargin(collapsedBeforePos, collapsedBeforeNeg);
         
         // Now collapse the child's margins together, which means examining our
         // bottom margin values as well. 
-        marginInfo.setPosMarginIfLarger(child->maxMarginAfter(PositiveMargin));
-        marginInfo.setNegMarginIfLarger(child->maxMarginAfter(NegativeMargin));
+        marginInfo.setPositiveMarginIfLarger(childMargins.positiveMarginAfter());
+        marginInfo.setNegativeMarginIfLarger(childMargins.negativeMarginAfter());
 
         if (!marginInfo.canCollapseWithMarginBefore())
             // We need to make sure that the position of the self-collapsing block
             // is correct, since it could have overflowing content
             // that needs to be positioned correctly (e.g., a block that
             // had a specified height of 0 but that actually had subcontent).
-            ypos = height() + collapsedTopPos - collapsedTopNeg;
+            logicalTop = logicalHeight() + collapsedBeforePos - collapsedBeforeNeg;
     }
     else {
         if (child->style()->marginBeforeCollapse() == MSEPARATE) {
-            setLogicalHeight(height() + marginInfo.margin() + child->marginTop());
-            ypos = height();
+            setLogicalHeight(logicalHeight() + marginInfo.margin() + marginBeforeForChild(child));
+            logicalTop = logicalHeight();
         }
         else if (!marginInfo.atBeforeSideOfBlock() ||
             (!marginInfo.canCollapseMarginBeforeWithChildren()
              && (!document()->inQuirksMode() || !marginInfo.quirkContainer() || !marginInfo.marginBeforeQuirk()))) {
             // We're collapsing with a previous sibling's margins and not
             // with the top of the block.
-            setLogicalHeight(height() + max(marginInfo.posMargin(), posTop) - max(marginInfo.negMargin(), negTop));
-            ypos = height();
+            setLogicalHeight(logicalHeight() + max(marginInfo.positiveMargin(), posTop) - max(marginInfo.negativeMargin(), negTop));
+            logicalTop = logicalHeight();
         }
 
-        marginInfo.setPosMargin(child->maxMarginAfter(PositiveMargin));
-        marginInfo.setNegMargin(child->maxMarginAfter(NegativeMargin));
+        marginInfo.setPositiveMargin(childMargins.positiveMarginAfter());
+        marginInfo.setNegativeMargin(childMargins.negativeMarginAfter());
 
         if (marginInfo.margin())
             marginInfo.setMarginAfterQuirk(child->isMarginAfterQuirk() || style()->marginAfterCollapse() == MDISCARD);
@@ -1563,12 +1573,12 @@ int RenderBlock::collapseMargins(RenderBox* child, MarginInfo& marginInfo)
     // If margins would pull us past the top of the next page, then we need to pull back and pretend like the margins
     // collapsed into the page edge.
     bool paginated = view()->layoutState()->isPaginated();
-    if (paginated && ypos > beforeCollapseY) {
-        int oldY = ypos;
-        ypos = min(ypos, nextPageTop(beforeCollapseY));
-        setLogicalHeight(height() + (ypos - oldY));
+    if (paginated && logicalTop > beforeCollapseLogicalTop) {
+        int oldLogicalTop = logicalTop;
+        logicalTop = min(logicalTop, nextPageTop(beforeCollapseLogicalTop));
+        setLogicalHeight(logicalHeight() + (logicalTop - oldLogicalTop));
     }
-    return ypos;
+    return logicalTop;
 }
 
 int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, int oldTopPosMargin, int oldTopNegMargin, int yPos)
@@ -1590,12 +1600,14 @@ int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, i
             if (!curr->isFloatingOrPositioned())
                 atBottomOfBlock = false;
         }
+        
+        MarginValues childMargins = marginValuesForChild(child);
         if (atBottomOfBlock) {
-            marginInfo.setPosMargin(child->maxMarginAfter(PositiveMargin));
-            marginInfo.setNegMargin(child->maxMarginAfter(NegativeMargin));
+            marginInfo.setPositiveMargin(childMargins.positiveMarginAfter());
+            marginInfo.setNegativeMargin(childMargins.negativeMarginAfter());
         } else {
-            marginInfo.setPosMargin(max(child->maxMarginBefore(PositiveMargin), child->maxMarginAfter(PositiveMargin)));
-            marginInfo.setNegMargin(max(child->maxMarginBefore(NegativeMargin), child->maxMarginAfter(NegativeMargin)));
+            marginInfo.setPositiveMargin(max(childMargins.positiveMarginBefore(), childMargins.positiveMarginAfter()));
+            marginInfo.setNegativeMargin(max(childMargins.negativeMarginBefore(), childMargins.negativeMarginAfter()));
         }
         
         // Adjust our height such that we are ready to be collapsed with subsequent siblings (or the bottom
@@ -1618,89 +1630,68 @@ int RenderBlock::clearFloatsIfNeeded(RenderBox* child, MarginInfo& marginInfo, i
     return yPos + heightIncrease;
 }
 
-int RenderBlock::estimateVerticalPosition(RenderBox* child, const MarginInfo& marginInfo)
+int RenderBlock::estimateLogicalTopPosition(RenderBox* child, const MarginInfo& marginInfo)
 {
     // FIXME: We need to eliminate the estimation of vertical position, because when it's wrong we sometimes trigger a pathological
     // relayout if there are intruding floats.
-    int yPosEstimate = height();
+    int logicalTopEstimate = logicalHeight();
     if (!marginInfo.canCollapseWithMarginBefore()) {
-        int childMarginTop = child->selfNeedsLayout() ? child->marginTop() : child->collapsedMarginBefore();
-        yPosEstimate += max(marginInfo.margin(), childMarginTop);
+        int childMarginBefore = child->selfNeedsLayout() ? marginBeforeForChild(child) : collapsedMarginBeforeForChild(child);
+        logicalTopEstimate += max(marginInfo.margin(), childMarginBefore);
     }
     
     bool paginated = view()->layoutState()->isPaginated();
 
-    // Adjust yPosEstimate down to the next page if the margins are so large that we don't fit on the current
+    // Adjust logicalTopEstimate down to the next page if the margins are so large that we don't fit on the current
     // page.
-    if (paginated && yPosEstimate > height())
-        yPosEstimate = min(yPosEstimate, nextPageTop(height()));
+    if (paginated && logicalTopEstimate > logicalHeight())
+        logicalTopEstimate = min(logicalTopEstimate, nextPageTop(logicalHeight()));
 
-    yPosEstimate += getClearDelta(child, yPosEstimate);
+    logicalTopEstimate += getClearDelta(child, logicalTopEstimate);
     
     if (paginated) {
         // If the object has a page or column break value of "before", then we should shift to the top of the next page.
-        yPosEstimate = applyBeforeBreak(child, yPosEstimate);
+        logicalTopEstimate = applyBeforeBreak(child, logicalTopEstimate);
     
         // For replaced elements and scrolled elements, we want to shift them to the next page if they don't fit on the current one.
-        yPosEstimate = adjustForUnsplittableChild(child, yPosEstimate);
+        logicalTopEstimate = adjustForUnsplittableChild(child, logicalTopEstimate);
         
         if (!child->selfNeedsLayout() && child->isRenderBlock())
-            yPosEstimate += toRenderBlock(child)->paginationStrut();
+            logicalTopEstimate += toRenderBlock(child)->paginationStrut();
     }
 
-    return yPosEstimate;
+    return logicalTopEstimate;
 }
 
-void RenderBlock::determineHorizontalPosition(RenderBox* child)
+void RenderBlock::determineLogicalLeftPositionForChild(RenderBox* child)
 {
-    int xPos = borderLeft() + paddingLeft();
-    if (style()->direction() == LTR) {
-        // Add in our left margin.
-        int chPos = xPos + child->marginLeft();
+    int startPosition = borderStart() + paddingStart();
+    int totalAvailableLogicalWidth = borderAndPaddingLogicalWidth() + availableLogicalWidth();
+
+    // Add in our start margin.
+    int childMarginStart = marginStartForChild(child);
+    int newPosition = startPosition + childMarginStart;
         
-        // Some objects (e.g., tables, horizontal rules, overflow:auto blocks) avoid floats.  They need
-        // to shift over as necessary to dodge any floats that might get in the way.
-        if (child->avoidsFloats()) {
-            int leftOff = logicalLeftOffsetForLine(height(), false);
-            if (style()->textAlign() != WEBKIT_CENTER && child->style()->marginLeft().type() != Auto) {
-                if (child->marginLeft() < 0)
-                    leftOff += child->marginLeft();
-                chPos = max(chPos, leftOff); // Let the float sit in the child's margin if it can fit.
-            }
-            else if (leftOff != xPos) {
-                // The object is shifting right. The object might be centered, so we need to
-                // recalculate our horizontal margins. Note that the containing block content
-                // width computation will take into account the delta between |leftOff| and |xPos|
-                // so that we can just pass the content width in directly to the |computeMarginsInContainingBlockInlineDirection|
-                // function.
-                child->computeInlineDirectionMargins(this, availableLogicalWidthForLine(child->y(), false), child->width());
-                chPos = leftOff + child->marginLeft();
-            }
-        }
-        view()->addLayoutDelta(IntSize(child->x() - chPos, 0));
-        child->setLocation(chPos, child->y());
-    } else {
-        xPos += availableLogicalWidth();
-        int chPos = xPos - (child->width() + child->marginRight());
-        if (child->avoidsFloats()) {
-            int rightOff = logicalRightOffsetForLine(height(), false);
-            if (style()->textAlign() != WEBKIT_CENTER && child->style()->marginRight().type() != Auto) {
-                if (child->marginRight() < 0)
-                    rightOff -= child->marginRight();
-                chPos = min(chPos, rightOff - child->width()); // Let the float sit in the child's margin if it can fit.
-            } else if (rightOff != xPos) {
-                // The object is shifting left. The object might be centered, so we need to
-                // recalculate our horizontal margins. Note that the containing block content
-                // width computation will take into account the delta between |rightOff| and |xPos|
-                // so that we can just pass the content width in directly to the |computeInlineDirectionMargins|
-                // function.
-                child->computeInlineDirectionMargins(this, availableLogicalWidthForLine(child->y(), false), child->width());
-                chPos = rightOff - child->marginRight() - child->width();
-            }
+    // Some objects (e.g., tables, horizontal rules, overflow:auto blocks) avoid floats.  They need
+    // to shift over as necessary to dodge any floats that might get in the way.
+    if (child->avoidsFloats()) {
+        int startOff = style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(logicalHeight(), false) : totalAvailableLogicalWidth - logicalRightOffsetForLine(logicalHeight(), false);
+        if (style()->textAlign() != WEBKIT_CENTER && !child->style()->marginStartUsing(style()).isAuto()) {
+            if (childMarginStart < 0)
+                startOff += childMarginStart;
+            newPosition = max(newPosition, startOff); // Let the float sit in the child's margin if it can fit.
+        } else if (startOff != startPosition) {
+            // The object is shifting to the "end" side of the block. The object might be centered, so we need to
+            // recalculate our inline direction margins. Note that the containing block content
+            // width computation will take into account the delta between |startOff| and |startPosition|
+            // so that we can just pass the content width in directly to the |computeMarginsInContainingBlockInlineDirection|
+            // function.
+            child->computeInlineDirectionMargins(this, availableLogicalWidthForLine(logicalTopForChild(child), false), logicalWidthForChild(child));
+            newPosition = startOff + marginStartForChild(child);
         }
-        view()->addLayoutDelta(IntSize(child->x() - chPos, 0));
-        child->setLocation(chPos, child->y());
     }
+
+    setLogicalLeftForChild(child, style()->isLeftToRightDirection() ? newPosition : totalAvailableLogicalWidth - newPosition - logicalWidthForChild(child), ApplyLayoutDelta);
 }
 
 void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
@@ -1708,12 +1699,12 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
     if (marginInfo.canCollapseWithMarginAfter() && !marginInfo.canCollapseWithMarginBefore()) {
         // Update our max pos/neg bottom margins, since we collapsed our bottom margins
         // with our children.
-        setMaxMarginAfterValues(max(maxPosMarginAfter(), marginInfo.posMargin()), max(maxNegMarginAfter(), marginInfo.negMargin()));
+        setMaxMarginAfterValues(max(maxPositiveMarginAfter(), marginInfo.positiveMargin()), max(maxNegativeMarginAfter(), marginInfo.negativeMargin()));
 
         if (!marginInfo.marginAfterQuirk())
             setMarginAfterQuirk(false);
 
-        if (marginInfo.marginAfterQuirk() && marginBottom() == 0)
+        if (marginInfo.marginAfterQuirk() && marginAfter() == 0)
             // We have no bottom margin and our last child has a quirky margin.
             // We will pick up this quirky margin and pass it through.
             // This deals with the <td><div><p> case.
@@ -1721,27 +1712,53 @@ void RenderBlock::setCollapsedBottomMargin(const MarginInfo& marginInfo)
     }
 }
 
-void RenderBlock::handleBottomOfBlock(int top, int bottom, MarginInfo& marginInfo)
+void RenderBlock::handleAfterSideOfBlock(int beforeSide, int afterSide, MarginInfo& marginInfo)
 {
     marginInfo.setAtAfterSideOfBlock(true);
 
     // If we can't collapse with children then go ahead and add in the bottom margin.
     if (!marginInfo.canCollapseWithMarginAfter() && !marginInfo.canCollapseWithMarginBefore()
         && (!document()->inQuirksMode() || !marginInfo.quirkContainer() || !marginInfo.marginAfterQuirk()))
-        setLogicalHeight(height() + marginInfo.margin());
+        setLogicalHeight(logicalHeight() + marginInfo.margin());
         
     // Now add in our bottom border/padding.
-    setLogicalHeight(height() + bottom);
+    setLogicalHeight(logicalHeight() + afterSide);
 
     // Negative margins can cause our height to shrink below our minimal height (border/padding).
     // If this happens, ensure that the computed height is increased to the minimal height.
-    setLogicalHeight(max(height(), top + bottom));
+    setLogicalHeight(max(logicalHeight(), beforeSide + afterSide));
 
     // Update our bottom collapsed margin info.
     setCollapsedBottomMargin(marginInfo);
 }
 
-void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom)
+void RenderBlock::setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode applyDelta)
+{
+    if (style()->isHorizontalWritingMode()) {
+        if (applyDelta == ApplyLayoutDelta)
+            view()->addLayoutDelta(IntSize(child->x() - logicalLeft, 0));
+        child->setX(logicalLeft);
+    } else {
+        if (applyDelta == ApplyLayoutDelta)
+            view()->addLayoutDelta(IntSize(0, child->y() - logicalLeft));
+        child->setY(logicalLeft);
+    }
+}
+
+void RenderBlock::setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode applyDelta)
+{
+    if (style()->isHorizontalWritingMode()) {
+        if (applyDelta == ApplyLayoutDelta)
+            view()->addLayoutDelta(IntSize(0, child->y() - logicalTop));
+        child->setY(logicalTop);
+    } else {
+        if (applyDelta == ApplyLayoutDelta)
+            view()->addLayoutDelta(IntSize(child->x() - logicalTop, 0));
+        child->setX(logicalTop);
+    }
+}
+
+void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatLogicalBottom)
 {
     if (gPercentHeightDescendantsMap) {
         if (HashSet<RenderBox*>* descendants = gPercentHeightDescendantsMap->get(this)) {
@@ -1761,20 +1778,22 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         }
     }
 
-    int top = borderTop() + paddingTop();
-    int bottom = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
+    int beforeEdge = borderBefore() + paddingBefore();
+    int afterEdge = borderAfter() + paddingAfter() + scrollbarLogicalHeight();
 
-    setLogicalHeight(top);
+    setLogicalHeight(beforeEdge);
 
     // The margin struct caches all our current margin collapsing state.  The compact struct caches state when we encounter compacts,
-    MarginInfo marginInfo(this, top, bottom);
+    MarginInfo marginInfo(this, beforeEdge, afterEdge);
 
     // Fieldsets need to find their legend and position it inside the border of the object.
     // The legend then gets skipped during normal layout.
+    // FIXME: Make fieldsets work with block-flow.
+    // https://bugs.webkit.org/show_bug.cgi?id=46785
     RenderObject* legend = layoutLegend(relayoutChildren);
 
-    int previousFloatBottom = 0;
-    maxFloatBottom = 0;
+    int previousFloatLogicalBottom = 0;
+    maxFloatLogicalBottom = 0;
 
     RenderBox* next = firstChildBox();
 
@@ -1788,11 +1807,11 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
         // Make sure we layout children if they need it.
         // FIXME: Technically percentage height objects only need a relayout if their percentage isn't going to be turned into
         // an auto value.  Add a method to determine this, so that we can avoid the relayout.
-        if (relayoutChildren || ((child->style()->height().isPercent() || child->style()->minHeight().isPercent() || child->style()->maxHeight().isPercent()) && !isRenderView()))
+        if (relayoutChildren || ((child->style()->logicalHeight().isPercent() || child->style()->logicalMinHeight().isPercent() || child->style()->logicalMaxHeight().isPercent()) && !isRenderView()))
             child->setChildNeedsLayout(true, false);
 
-        // If relayoutChildren is set and we have percentage padding, we also need to invalidate the child's pref widths.
-        if (relayoutChildren && (child->style()->paddingLeft().isPercent() || child->style()->paddingRight().isPercent()))
+        // If relayoutChildren is set and the child has percentage padding, we also need to invalidate the child's pref widths.
+        if (relayoutChildren && (child->style()->paddingStart().isPercent() || child->style()->paddingEnd().isPercent()))
             child->setPreferredLogicalWidthsDirty(true, false);
 
         // Handle the four types of special elements first.  These include positioned content, floating content, compacts and
@@ -1801,63 +1820,64 @@ void RenderBlock::layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom
             continue;
 
         // Lay out the child.
-        layoutBlockChild(child, marginInfo, previousFloatBottom, maxFloatBottom);
+        layoutBlockChild(child, marginInfo, previousFloatLogicalBottom, maxFloatLogicalBottom);
     }
     
     // Now do the handling of the bottom of the block, adding in our bottom border/padding and
     // determining the correct collapsed bottom margin information.
-    handleBottomOfBlock(top, bottom, marginInfo);
+    handleAfterSideOfBlock(beforeEdge, afterEdge, marginInfo);
 }
 
-void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int& previousFloatBottom, int& maxFloatBottom)
+void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int& previousFloatLogicalBottom, int& maxFloatLogicalBottom)
 {
-    int oldTopPosMargin = maxPosMarginBefore();
-    int oldTopNegMargin = maxNegMarginBefore();
+    int oldPosMarginBefore = maxPositiveMarginBefore();
+    int oldNegMarginBefore = maxNegativeMarginBefore();
 
-    // The child is a normal flow object.  Compute its vertical margins now.
+    // The child is a normal flow object.  Compute the margins we will use for collapsing now.
     child->computeBlockDirectionMargins(this);
 
-    // Do not allow a collapse if the margin top collapse style is set to SEPARATE.
+    // Do not allow a collapse if the margin-before-collapse style is set to SEPARATE.
     if (child->style()->marginBeforeCollapse() == MSEPARATE) {
         marginInfo.setAtBeforeSideOfBlock(false);
         marginInfo.clearMargin();
     }
 
-    // Try to guess our correct y position.  In most cases this guess will
-    // be correct.  Only if we're wrong (when we compute the real y position)
+    // Try to guess our correct logical top position.  In most cases this guess will
+    // be correct.  Only if we're wrong (when we compute the real logical top position)
     // will we have to potentially relayout.
-    int yPosEstimate = estimateVerticalPosition(child, marginInfo);
+    int logicalTopEstimate = estimateLogicalTopPosition(child, marginInfo);
 
     // Cache our old rect so that we can dirty the proper repaint rects if the child moves.
     IntRect oldRect(child->x(), child->y() , child->width(), child->height());
+    int oldLogicalTop = logicalTopForChild(child);
+
 #ifndef NDEBUG
     IntSize oldLayoutDelta = view()->layoutDelta();
 #endif
     // Go ahead and position the child as though it didn't collapse with the top.
-    view()->addLayoutDelta(IntSize(0, child->y() - yPosEstimate));
-    child->setLocation(child->x(), yPosEstimate);
+    setLogicalTopForChild(child, logicalTopEstimate, ApplyLayoutDelta);
 
     RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
     bool markDescendantsWithFloats = false;
-    if (yPosEstimate != oldRect.y() && !child->avoidsFloats() && childRenderBlock && childRenderBlock->containsFloats())
+    if (logicalTopEstimate != oldLogicalTop && !child->avoidsFloats() && childRenderBlock && childRenderBlock->containsFloats())
         markDescendantsWithFloats = true;
     else if (!child->avoidsFloats() || child->shrinkToAvoidFloats()) {
         // If an element might be affected by the presence of floats, then always mark it for
         // layout.
-        int fb = max(previousFloatBottom, floatBottom());
-        if (fb > yPosEstimate)
+        int fb = max(previousFloatLogicalBottom, lowestFloatLogicalBottom());
+        if (fb > logicalTopEstimate)
             markDescendantsWithFloats = true;
     }
 
     if (childRenderBlock) {
         if (markDescendantsWithFloats)
             childRenderBlock->markAllDescendantsWithFloatsForLayout();
-        previousFloatBottom = max(previousFloatBottom, oldRect.y() + toRenderBlock(child)->floatBottom());
+        if (!child->isWritingModeRoot())
+            previousFloatLogicalBottom = max(previousFloatLogicalBottom, oldLogicalTop + childRenderBlock->lowestFloatLogicalBottom());
     }
 
-    bool paginated = view()->layoutState()->isPaginated();
-    if (!child->needsLayout() && paginated && view()->layoutState()->m_pageHeight && childRenderBlock && view()->layoutState()->pageY(child->y()) != childRenderBlock->pageY())
-        childRenderBlock->markForPaginationRelayout();
+    if (!child->needsLayout())
+        child->markForPaginationRelayoutIfNeeded();
 
     bool childHadLayout = child->m_everHadLayout;
     bool childNeededLayout = child->needsLayout();
@@ -1869,23 +1889,24 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
 
     // Now determine the correct ypos based off examination of collapsing margin
     // values.
-    int yBeforeClear = collapseMargins(child, marginInfo);
+    int logicalTopBeforeClear = collapseMargins(child, marginInfo);
 
     // Now check for clear.
-    int yAfterClear = clearFloatsIfNeeded(child, marginInfo, oldTopPosMargin, oldTopNegMargin, yBeforeClear);
+    int logicalTopAfterClear = clearFloatsIfNeeded(child, marginInfo, oldPosMarginBefore, oldNegMarginBefore, logicalTopBeforeClear);
     
+    bool paginated = view()->layoutState()->isPaginated();
     if (paginated) {
-        int oldY = yAfterClear;
+        int oldTop = logicalTopAfterClear;
         
         // If the object has a page or column break value of "before", then we should shift to the top of the next page.
-        yAfterClear = applyBeforeBreak(child, yAfterClear);
+        logicalTopAfterClear = applyBeforeBreak(child, logicalTopAfterClear);
     
         // For replaced elements and scrolled elements, we want to shift them to the next page if they don't fit on the current one.
-        int yBeforeUnsplittableAdjustment = yAfterClear;
-        int yAfterUnsplittableAdjustment = adjustForUnsplittableChild(child, yAfterClear);
+        int logicalTopBeforeUnsplittableAdjustment = logicalTopAfterClear;
+        int logicalTopAfterUnsplittableAdjustment = adjustForUnsplittableChild(child, logicalTopAfterClear);
         
         int paginationStrut = 0;
-        int unsplittableAdjustmentDelta = yAfterUnsplittableAdjustment - yBeforeUnsplittableAdjustment;
+        int unsplittableAdjustmentDelta = logicalTopAfterUnsplittableAdjustment - logicalTopBeforeUnsplittableAdjustment;
         if (unsplittableAdjustmentDelta)
             paginationStrut = unsplittableAdjustmentDelta;
         else if (childRenderBlock && childRenderBlock->paginationStrut())
@@ -1894,26 +1915,25 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
         if (paginationStrut) {
             // We are willing to propagate out to our parent block as long as we were at the top of the block prior
             // to collapsing our margins, and as long as we didn't clear or move as a result of other pagination.
-            if (atBeforeSideOfBlock && oldY == yBeforeClear && !isPositioned() && !isTableCell()) {
+            if (atBeforeSideOfBlock && oldTop == logicalTopBeforeClear && !isPositioned() && !isTableCell()) {
                 // FIXME: Should really check if we're exceeding the page height before propagating the strut, but we don't
                 // have all the information to do so (the strut only has the remaining amount to push).  Gecko gets this wrong too
                 // and pushes to the next page anyway, so not too concerned about it.
-                setPaginationStrut(yAfterClear + paginationStrut);
+                setPaginationStrut(logicalTopAfterClear + paginationStrut);
                 if (childRenderBlock)
                     childRenderBlock->setPaginationStrut(0);
             } else
-                yAfterClear += paginationStrut;
+                logicalTopAfterClear += paginationStrut;
         }
 
         // Similar to how we apply clearance.  Go ahead and boost height() to be the place where we're going to position the child.
-        setLogicalHeight(height() + (yAfterClear - oldY));
+        setLogicalHeight(logicalHeight() + (logicalTopAfterClear - oldTop));
     }
 
-    view()->addLayoutDelta(IntSize(0, yPosEstimate - yAfterClear));
-    child->setLocation(child->x(), yAfterClear);
+    setLogicalTopForChild(child, logicalTopAfterClear, ApplyLayoutDelta);
 
-    // Now we have a final y position.  See if it really does end up being different from our estimate.
-    if (yAfterClear != yPosEstimate) {
+    // Now we have a final top position.  See if it really does end up being different from our estimate.
+    if (logicalTopAfterClear != logicalTopEstimate) {
         if (child->shrinkToAvoidFloats()) {
             // The child's width depends on the line width.
             // When the child shifts to clear an item, its width can
@@ -1924,8 +1944,8 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
         if (childRenderBlock) {
             if (!child->avoidsFloats() && childRenderBlock->containsFloats())
                 childRenderBlock->markAllDescendantsWithFloatsForLayout();
-            if (paginated && !child->needsLayout() && view()->layoutState()->m_pageHeight && view()->layoutState()->pageY(child->y()) != childRenderBlock->pageY())
-                childRenderBlock->markForPaginationRelayout();
+            if (!child->needsLayout())
+                child->markForPaginationRelayoutIfNeeded();
         }
 
         // Our guess was wrong. Make the child lay itself out again.
@@ -1937,19 +1957,19 @@ void RenderBlock::layoutBlockChild(RenderBox* child, MarginInfo& marginInfo, int
     if (marginInfo.atBeforeSideOfBlock() && !child->isSelfCollapsingBlock())
         marginInfo.setAtBeforeSideOfBlock(false);
 
-    // Now place the child in the correct horizontal position
-    determineHorizontalPosition(child);
+    // Now place the child in the correct left position
+    determineLogicalLeftPositionForChild(child);
 
     // Update our height now that the child has been placed in the correct position.
-    setLogicalHeight(height() + child->height());
+    setLogicalHeight(logicalHeight() + logicalHeightForChild(child));
     if (child->style()->marginAfterCollapse() == MSEPARATE) {
-        setLogicalHeight(height() + child->marginBottom());
+        setLogicalHeight(logicalHeight() + marginAfterForChild(child));
         marginInfo.clearMargin();
     }
     // If the child has overhanging floats that intrude into following siblings (or possibly out
     // of this block), then the parent gets notified of the floats now.
     if (childRenderBlock && childRenderBlock->containsFloats())
-        maxFloatBottom = max(maxFloatBottom, addOverhangingFloats(toRenderBlock(child), -child->x(), -child->y(), !childNeededLayout));
+        maxFloatLogicalBottom = max(maxFloatLogicalBottom, addOverhangingFloats(toRenderBlock(child), -child->logicalLeft(), -child->logicalTop(), !childNeededLayout));
 
     IntSize childOffset(child->x() - oldRect.x(), child->y() - oldRect.y());
     if (childOffset.width() || childOffset.height()) {
@@ -2014,8 +2034,6 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
         if (hasColumns())
             view()->layoutState()->clearPaginationInformation(); // Positioned objects are not part of the column flow, so they don't paginate with the columns.
 
-        bool paginated = view()->layoutState()->isPaginated();
-
         RenderBox* r;
         Iterator end = m_positionedObjects->end();
         for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
@@ -2031,11 +2049,8 @@ void RenderBlock::layoutPositionedObjects(bool relayoutChildren)
             //if (relayoutChildren && (r->style()->paddingLeft().isPercent() || r->style()->paddingRight().isPercent()))
                 r->setPreferredLogicalWidthsDirty(true, false);
             
-            if (!r->needsLayout() && paginated && view()->layoutState()->m_pageHeight) {
-                RenderBlock* childRenderBlock = r->isRenderBlock() ? toRenderBlock(r) : 0;
-                if (childRenderBlock && view()->layoutState()->pageY(childRenderBlock->y()) != childRenderBlock->pageY())
-                    childRenderBlock->markForPaginationRelayout();
-            }
+            if (!r->needsLayout())
+                r->markForPaginationRelayoutIfNeeded();
 
             // We don't have to do a full layout.  We just have to update our position. Try that first. If we have shrink-to-fit width
             // and we hit the available width constraint, the layoutIfNeeded() will catch it and do a full layout.
@@ -2061,6 +2076,16 @@ void RenderBlock::markPositionedObjectsForLayout()
     }
 }
 
+void RenderBlock::markForPaginationRelayoutIfNeeded()
+{
+    ASSERT(!needsLayout());
+    if (needsLayout())
+        return;
+
+    if (view()->layoutState()->pageHeightChanged() || (view()->layoutState()->pageHeight() && view()->layoutState()->pageY(y()) != pageY()))
+        setChildNeedsLayout(true, false);
+}
+
 void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants)
 {
     // Repaint any overhanging floats (if we know we're the one to paint them).
@@ -2081,7 +2106,7 @@ void RenderBlock::repaintOverhangingFloats(bool paintAllDescendants)
             // Only repaint the object if it is overhanging, is not in its own layer, and
             // is our responsibility to paint (m_shouldPaint is set). When paintAllDescendants is true, the latter
             // condition is replaced with being a descendant of us.
-            if (r->m_bottom > height() && ((paintAllDescendants && r->m_renderer->isDescendantOf(this)) || r->m_shouldPaint) && !r->m_renderer->hasSelfPaintingLayer()) {
+            if (logicalBottomForFloat(r) > logicalHeight() && ((paintAllDescendants && r->m_renderer->isDescendantOf(this)) || r->m_shouldPaint) && !r->m_renderer->hasSelfPaintingLayer()) {
                 r->m_renderer->repaint();
                 r->m_renderer->repaintOverhangingFloats();
             }
@@ -2134,14 +2159,14 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
     // We need to do multiple passes, breaking up our child painting into strips.
     ColumnInfo* colInfo = columnInfo();
     unsigned colCount = columnCount(colInfo);
-    int currXOffset = style()->direction() == LTR ? 0 : contentWidth();
+    int currXOffset = style()->isLeftToRightDirection() ? 0 : contentWidth();
     int ruleAdd = borderLeft() + paddingLeft();
-    int ruleX = style()->direction() == LTR ? 0 : contentWidth();
+    int ruleX = style()->isLeftToRightDirection() ? 0 : contentWidth();
     for (unsigned i = 0; i < colCount; i++) {
         IntRect colRect = columnRectAt(colInfo, i);
 
         // Move to the next position.
-        if (style()->direction() == LTR) {
+        if (style()->isLeftToRightDirection()) {
             ruleX += colRect.width() + colGap / 2;
             currXOffset += colRect.width() + colGap;
         } else {
@@ -2156,7 +2181,7 @@ void RenderBlock::paintColumnRules(PaintInfo& paintInfo, int tx, int ty)
             int ruleTop = ty + borderTop() + paddingTop();
             int ruleBottom = ruleTop + contentHeight();
             drawLineForBoxSide(paintInfo.context, ruleStart, ruleTop, ruleEnd, ruleBottom,
-                               style()->direction() == LTR ? BSLeft : BSRight, ruleColor, ruleStyle, 0, 0);
+                               style()->isLeftToRightDirection() ? BSLeft : BSRight, ruleColor, ruleStyle, 0, 0);
         }
         
         ruleX = currXOffset;
@@ -2172,7 +2197,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
     unsigned colCount = columnCount(colInfo);
     if (!colCount)
         return;
-    int currXOffset = style()->direction() == LTR ? 0 : contentWidth() - columnRectAt(colInfo, 0).width();
+    int currXOffset = style()->isLeftToRightDirection() ? 0 : contentWidth() - columnRectAt(colInfo, 0).width();
     int currYOffset = 0;
     for (unsigned i = 0; i < colCount; i++) {
         // For each rect, we clip to the rect, and then we adjust our coords.
@@ -2200,7 +2225,7 @@ void RenderBlock::paintColumnContents(PaintInfo& paintInfo, int tx, int ty, bool
         }
         
         // Move to the next position.
-        if (style()->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             currXOffset += colRect.width() + colGap;
         else
             currXOffset -= (colRect.width() + colGap);
@@ -2393,8 +2418,8 @@ void RenderBlock::paintFloats(PaintInfo& paintInfo, int tx, int ty, bool preserv
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer()) {
             PaintInfo currentPaintInfo(paintInfo);
             currentPaintInfo.phase = preservePhase ? paintInfo.phase : PaintPhaseBlockBackground;
-            int currentTX = tx + r->m_left - r->m_renderer->x() + r->m_renderer->marginLeft();
-            int currentTY = ty + r->m_top - r->m_renderer->y() + r->m_renderer->marginTop();
+            int currentTX = tx + r->left() - r->m_renderer->x() + r->m_renderer->marginLeft();
+            int currentTY = ty + r->top() - r->m_renderer->y() + r->m_renderer->marginTop();
             r->m_renderer->paint(currentPaintInfo, currentTX, currentTY);
             if (!preservePhase) {
                 currentPaintInfo.phase = PaintPhaseChildBlockBackgrounds;
@@ -2603,8 +2628,8 @@ GapRects RenderBlock::fillSelectionGaps(RenderBlock* rootBlock, int blockX, int
         if (m_floatingObjects) {
             for (DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects); it.current(); ++it) {
                 FloatingObject* r = it.current();
-                paintInfo->context->clipOut(IntRect(tx + r->m_left + r->m_renderer->marginLeft(), 
-                                                    ty + r->m_top + r->m_renderer->marginTop(),
+                paintInfo->context->clipOut(IntRect(tx + r->left() + r->m_renderer->marginLeft(), 
+                                                    ty + r->top() + r->m_renderer->marginTop(),
                                                     r->m_renderer->width(), r->m_renderer->height()));
             }
         }
@@ -2815,7 +2840,7 @@ IntRect RenderBlock::fillRightSelectionGap(RenderObject* selObj, int xPos, int y
 
 void RenderBlock::getHorizontalSelectionGapInfo(SelectionState state, bool& leftGap, bool& rightGap)
 {
-    bool ltr = style()->direction() == LTR;
+    bool ltr = style()->isLeftToRightDirection();
     leftGap = (state == RenderObject::SelectionInside) ||
               (state == RenderObject::SelectionEnd && ltr) ||
               (state == RenderObject::SelectionStart && !ltr);
@@ -2933,20 +2958,21 @@ RenderBlock::FloatingObject* RenderBlock::insertFloatingObject(RenderBox* o)
     // Create the special object entry & append it to the list
 
     FloatingObject* newObj = new FloatingObject(o->style()->floating() == FLEFT ? FloatingObject::FloatLeft : FloatingObject::FloatRight);
-
-    newObj->m_top = -1;
-    newObj->m_bottom = -1;
     
     // Our location is irrelevant if we're unsplittable or no pagination is in effect.
     // Just go ahead and lay out the float.
-    bool affectedByPagination = o->isRenderBlock() && view()->layoutState()->m_pageHeight;
-    if (!affectedByPagination)
+    bool isChildRenderBlock = o->isRenderBlock();
+    if (isChildRenderBlock && !o->needsLayout() && view()->layoutState()->pageHeightChanged())
+        o->setChildNeedsLayout(true, false);
+        
+    bool affectedByPagination = isChildRenderBlock && view()->layoutState()->m_pageHeight;
+    if (!affectedByPagination || isWritingModeRoot()) // We are unsplittable if we're a block flow root.
         o->layoutIfNeeded();
     else {
         o->computeLogicalWidth();
         o->computeBlockDirectionMargins(this);
     }
-    newObj->m_width = o->width() + o->marginLeft() + o->marginRight();
+    setLogicalWidthForFloat(newObj, logicalWidthForChild(o) + marginStartForChild(o) + marginEndForChild(o));
 
     newObj->m_shouldPaint = !o->hasSelfPaintingLayer(); // If a layer exists, the float will paint itself.  Otherwise someone else will.
     newObj->m_isDescendant = true;
@@ -2964,12 +2990,14 @@ void RenderBlock::removeFloatingObject(RenderBox* o)
         while (it.current()) {
             if (it.current()->m_renderer == o) {
                 if (childrenInline()) {
-                    int bottom = it.current()->m_bottom;
+                    int logicalTop = logicalTopForFloat(it.current());
+                    int logicalBottom = logicalBottomForFloat(it.current());
+                    
                     // Special-case zero- and less-than-zero-height floats: those don't touch
                     // the line that they're on, but it still needs to be dirtied. This is
                     // accomplished by pretending they have a height of 1.
-                    bottom = max(bottom, it.current()->m_top + 1);
-                    markLinesDirtyInVerticalRange(0, bottom);
+                    logicalBottom = max(logicalBottom, logicalTop + 1);
+                    markLinesDirtyInBlockRange(0, logicalBottom);
                 }
                 m_floatingObjects->removeRef(it.current());
             }
@@ -2984,7 +3012,7 @@ void RenderBlock::removeFloatingObjectsBelow(FloatingObject* lastFloat, int y)
         return;
     
     FloatingObject* curr = m_floatingObjects->last();
-    while (curr != lastFloat && (curr->m_top == -1 || curr->m_top >= y)) {
+    while (curr != lastFloat && (!curr->isPlaced() || curr->top() >= y)) {
         m_floatingObjects->removeLast();
         curr = m_floatingObjects->last();
     }
@@ -2995,111 +3023,118 @@ bool RenderBlock::positionNewFloats()
     if (!m_floatingObjects)
         return false;
     
-    FloatingObject* f = m_floatingObjects->last();
+    FloatingObject* floatingObject = m_floatingObjects->last();
 
     // If all floats have already been positioned, then we have no work to do.
-    if (!f || f->m_top != -1)
+    if (!floatingObject || floatingObject->isPlaced())
         return false;
 
     // Move backwards through our floating object list until we find a float that has
     // already been positioned.  Then we'll be able to move forward, positioning all of
     // the new floats that need it.
     FloatingObject* lastFloat = m_floatingObjects->getPrev();
-    while (lastFloat && lastFloat->m_top == -1) {
-        f = m_floatingObjects->prev();
+    while (lastFloat && !lastFloat->isPlaced()) {
+        floatingObject = m_floatingObjects->prev();
         lastFloat = m_floatingObjects->getPrev();
     }
 
-    int y = height();
+    int logicalTop = logicalHeight();
     
-    // The float cannot start above the y position of the last positioned float.
+    // The float cannot start above the top position of the last positioned float.
     if (lastFloat)
-        y = max(lastFloat->m_top, y);
+        logicalTop = max(logicalTopForFloat(lastFloat), logicalTop);
 
     // Now walk through the set of unpositioned floats and place them.
-    while (f) {
+    while (floatingObject) {
         // The containing block is responsible for positioning floats, so if we have floats in our
         // list that come from somewhere else, do not attempt to position them.
-        if (f->m_renderer->containingBlock() != this) {
-            f = m_floatingObjects->next();
+        if (floatingObject->renderer()->containingBlock() != this) {
+            floatingObject = m_floatingObjects->next();
             continue;
         }
 
-        RenderBox* o = f->m_renderer;
+        RenderBox* childBox = floatingObject->renderer();
+        int childLogicalLeftMargin = style()->isLeftToRightDirection() ? marginStartForChild(childBox) : marginEndForChild(childBox);
 
-        int ro = logicalRightOffsetForContent(); // Constant part of right offset.
-        int lo = logicalLeftOffsetForContent(); // Constant part of left offset.
-        int fwidth = f->m_width; // The width we look for.
-        if (ro - lo < fwidth)
-            fwidth = ro - lo; // Never look for more than what will be available.
+        int rightOffset = logicalRightOffsetForContent(); // Constant part of right offset.
+        int leftOffset = logicalLeftOffsetForContent(); // Constant part of left offset.
+        int floatLogicalWidth = logicalWidthForFloat(floatingObject); // The width we look for.
+        if (rightOffset - leftOffset < floatLogicalWidth)
+            floatLogicalWidth = rightOffset - leftOffset; // Never look for more than what will be available.
         
-        IntRect oldRect(o->x(), o->y() , o->width(), o->height());
+        IntRect oldRect(childBox->x(), childBox->y() , childBox->width(), childBox->height());
 
-        if (o->style()->clear() & CLEFT)
-            y = max(leftBottom(), y);
-        if (o->style()->clear() & CRIGHT)
-            y = max(rightBottom(), y);
+        if (childBox->style()->clear() & CLEFT)
+            logicalTop = max(lowestFloatLogicalBottom(FloatingObject::FloatLeft), logicalTop);
+        if (childBox->style()->clear() & CRIGHT)
+            logicalTop = max(lowestFloatLogicalBottom(FloatingObject::FloatRight), logicalTop);
 
-        if (o->style()->floating() == FLEFT) {
+        int floatLogicalLeft;
+        if (childBox->style()->floating() == FLEFT) {
             int heightRemainingLeft = 1;
             int heightRemainingRight = 1;
-            int fx = logicalLeftOffsetForLine(y, lo, false, &heightRemainingLeft);
-            while (logicalRightOffsetForLine(y, ro, false, &heightRemainingRight)-fx < fwidth) {
-                y += min(heightRemainingLeft, heightRemainingRight);
-                fx = logicalLeftOffsetForLine(y, lo, false, &heightRemainingLeft);
+            floatLogicalLeft = logicalLeftOffsetForLine(logicalTop, leftOffset, false, &heightRemainingLeft);
+            while (logicalRightOffsetForLine(logicalTop, rightOffset, false, &heightRemainingRight) - floatLogicalLeft < floatLogicalWidth) {
+                logicalTop += min(heightRemainingLeft, heightRemainingRight);
+                floatLogicalLeft = logicalLeftOffsetForLine(logicalTop, leftOffset, false, &heightRemainingLeft);
             }
-            fx = max(0, fx);
-            f->m_left = fx;
-            o->setLocation(fx + o->marginLeft(), y + o->marginTop());
+            floatLogicalLeft = max(0, floatLogicalLeft);
         } else {
             int heightRemainingLeft = 1;
             int heightRemainingRight = 1;
-            int fx = logicalRightOffsetForLine(y, ro, false, &heightRemainingRight);
-            while (fx - logicalLeftOffsetForLine(y, lo, false, &heightRemainingLeft) < fwidth) {
-                y += min(heightRemainingLeft, heightRemainingRight);
-                fx = logicalRightOffsetForLine(y, ro, false, &heightRemainingRight);
+            floatLogicalLeft = logicalRightOffsetForLine(logicalTop, rightOffset, false, &heightRemainingRight);
+            while (floatLogicalLeft - logicalLeftOffsetForLine(logicalTop, leftOffset, false, &heightRemainingLeft) < floatLogicalWidth) {
+                logicalTop += min(heightRemainingLeft, heightRemainingRight);
+                floatLogicalLeft = logicalRightOffsetForLine(logicalTop, rightOffset, false, &heightRemainingRight);
             }
-            f->m_left = fx - f->m_width;
-            o->setLocation(fx - o->marginRight() - o->width(), y + o->marginTop());
+            floatLogicalLeft -= logicalWidthForFloat(floatingObject); // Use the original width of the float here, since the local variable
+                                                                      // |floatLogicalWidth| was capped to the available line width.
+                                                                      // See fast/block/float/clamped-right-float.html.
         }
+        
+        setLogicalLeftForFloat(floatingObject, floatLogicalLeft);
+        setLogicalLeftForChild(childBox, floatLogicalLeft + childLogicalLeftMargin);
+        setLogicalTopForChild(childBox, logicalTop + marginBeforeForChild(childBox));
 
         if (view()->layoutState()->isPaginated()) {
-            RenderBlock* childBlock = o->isRenderBlock() ? toRenderBlock(o) : 0;
+            RenderBlock* childBlock = childBox->isRenderBlock() ? toRenderBlock(childBox) : 0;
 
-            if (childBlock && view()->layoutState()->m_pageHeight && view()->layoutState()->pageY(o->y()) != childBlock->pageY())
-                childBlock->markForPaginationRelayout();
-            o->layoutIfNeeded();
+            if (!childBox->needsLayout())
+                childBox->markForPaginationRelayoutIfNeeded();;
+            childBox->layoutIfNeeded();
 
             // If we are unsplittable and don't fit, then we need to move down.
             // We include our margins as part of the unsplittable area.
-            int newY = adjustForUnsplittableChild(o, y, true);
+            int newLogicalTop = adjustForUnsplittableChild(childBox, logicalTop, true);
             
             // See if we have a pagination strut that is making us move down further.
             // Note that an unsplittable child can't also have a pagination strut, so this is
             // exclusive with the case above.
             if (childBlock && childBlock->paginationStrut()) {
-                newY += childBlock->paginationStrut();
+                newLogicalTop += childBlock->paginationStrut();
                 childBlock->setPaginationStrut(0);
             }
             
-            if (newY != y) {
-                f->m_paginationStrut = newY - y;
-                y = newY;
-                o->setY(y + o->marginTop());
+            if (newLogicalTop != logicalTop) {
+                floatingObject->m_paginationStrut = newLogicalTop - logicalTop;
+                logicalTop = newLogicalTop;
+                setLogicalTopForChild(childBox, logicalTop + marginBeforeForChild(childBox));
                 if (childBlock)
                     childBlock->setChildNeedsLayout(true, false);
-                o->layoutIfNeeded();
+                childBox->layoutIfNeeded();
             }
         }
 
-        f->m_top = y;
-        f->m_bottom = f->m_top + o->marginTop() + o->height() + o->marginBottom();
-        
+        setLogicalTopForFloat(floatingObject, logicalTop);
+        setLogicalHeightForFloat(floatingObject, logicalHeightForChild(childBox) + marginBeforeForChild(childBox) + marginAfterForChild(childBox));
+
+        floatingObject->setIsPlaced();
+
         // If the child moved, we have to repaint it.
-        if (o->checkForRepaintDuringLayout())
-            o->repaintDuringLayoutIfMoved(oldRect);
+        if (childBox->checkForRepaintDuringLayout())
+            childBox->repaintDuringLayoutIfMoved(oldRect);
 
-        f = m_floatingObjects->next();
+        floatingObject = m_floatingObjects->next();
     }
     return true;
 }
@@ -3110,30 +3145,29 @@ bool RenderBlock::positionNewFloatOnLine(FloatingObject* newFloat, FloatingObjec
     if (!didPosition || !newFloat->m_paginationStrut)
         return didPosition;
     
-    int floatTop = newFloat->m_top;
+    int floatLogicalTop = logicalTopForFloat(newFloat);
     int paginationStrut = newFloat->m_paginationStrut;
     FloatingObject* f = m_floatingObjects->last();
     
     ASSERT(f == newFloat);
 
-    if (floatTop - paginationStrut != height())
+    if (floatLogicalTop - paginationStrut != logicalHeight())
         return didPosition;
 
     for (f = m_floatingObjects->prev(); f && f != lastFloatFromPreviousLine; f = m_floatingObjects->prev()) {
-        if (f->m_top == height()) {
+        if (logicalTopForFloat(f) == logicalHeight()) {
             ASSERT(!f->m_paginationStrut);
             f->m_paginationStrut = paginationStrut;
             RenderBox* o = f->m_renderer;
-            o->setY(o->y() + o->marginTop() + paginationStrut);
+            setLogicalTopForChild(o, logicalTopForChild(o) + marginBeforeForChild(o) + paginationStrut);
             if (o->isRenderBlock())
                 toRenderBlock(o)->setChildNeedsLayout(true, false);
             o->layoutIfNeeded();
-            f->m_top += f->m_paginationStrut;
-            f->m_bottom += f->m_paginationStrut;
+            setLogicalTopForFloat(f, logicalTopForFloat(f) + f->m_paginationStrut);
         }
     }
         
-    setLogicalHeight(height() + paginationStrut);
+    setLogicalHeight(logicalHeight() + paginationStrut);
     
     return didPosition;
 }
@@ -3146,13 +3180,13 @@ void RenderBlock::newLine(EClear clear)
     switch (clear)
     {
         case CLEFT:
-            newY = leftBottom();
+            newY = lowestFloatLogicalBottom(FloatingObject::FloatLeft);
             break;
         case CRIGHT:
-            newY = rightBottom();
+            newY = lowestFloatLogicalBottom(FloatingObject::FloatRight);
             break;
         case CBOTH:
-            newY = floatBottom();
+            newY = lowestFloatLogicalBottom();
         default:
             break;
     }
@@ -3220,30 +3254,26 @@ HashSet<RenderBox*>* RenderBlock::percentHeightDescendants() const
     return gPercentHeightDescendantsMap ? gPercentHeightDescendantsMap->get(this) : 0;
 }
 
-int RenderBlock::logicalLeftOffsetForContent() const
-{
-    return borderLeft() + paddingLeft();
-}
-
-int RenderBlock::logicalLeftOffsetForLine(int y, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
+int RenderBlock::logicalLeftOffsetForLine(int logicalTop, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int left = fixedOffset;
     if (m_floatingObjects) {
-        if ( heightRemaining ) *heightRemaining = 1;
+        if (heightRemaining)
+            *heightRemaining = 1;
         FloatingObject* r;
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-        for ( ; (r = it.current()); ++it )
-        {
-            if (r->m_top <= y && r->m_bottom > y &&
-                r->type() == FloatingObject::FloatLeft &&
-                r->m_left + r->m_width > left) {
-                left = r->m_left + r->m_width;
-                if ( heightRemaining ) *heightRemaining = r->m_bottom - y;
+        for ( ; (r = it.current()); ++it) {
+            if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
+                && r->type() == FloatingObject::FloatLeft
+                && logicalRightForFloat(r) > left) {
+                left = logicalRightForFloat(r);
+                if (heightRemaining)
+                    *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
         }
     }
 
-    if (applyTextIndent && style()->direction() == LTR) {
+    if (applyTextIndent && style()->isLeftToRightDirection()) {
         int cw = 0;
         if (style()->textIndent().isPercent())
             cw = containingBlock()->availableLogicalWidth();
@@ -3253,31 +3283,27 @@ int RenderBlock::logicalLeftOffsetForLine(int y, int fixedOffset, bool applyText
     return left;
 }
 
-int RenderBlock::logicalRightOffsetForContent() const
-{
-    return borderLeft() + paddingLeft() + availableLogicalWidth();
-}
-
-int RenderBlock::logicalRightOffsetForLine(int y, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
+int RenderBlock::logicalRightOffsetForLine(int logicalTop, int fixedOffset, bool applyTextIndent, int* heightRemaining) const
 {
     int right = fixedOffset;
 
     if (m_floatingObjects) {
-        if (heightRemaining) *heightRemaining = 1;
+        if (heightRemaining)
+            *heightRemaining = 1;
         FloatingObject* r;
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-        for ( ; (r = it.current()); ++it )
-        {
-            if (r->m_top <= y && r->m_bottom > y &&
-                r->type() == FloatingObject::FloatRight &&
-                r->m_left < right) {
-                right = r->m_left;
-                if ( heightRemaining ) *heightRemaining = r->m_bottom - y;
+        for ( ; (r = it.current()); ++it) {
+            if (r->isPlaced() && logicalTopForFloat(r) <= logicalTop && logicalBottomForFloat(r) > logicalTop
+                && r->type() == FloatingObject::FloatRight
+                && logicalLeftForFloat(r) < right) {
+                right = logicalLeftForFloat(r);
+                if (heightRemaining)
+                    *heightRemaining = logicalBottomForFloat(r) - logicalTop;
             }
         }
     }
     
-    if (applyTextIndent && style()->direction() == RTL) {
+    if (applyTextIndent && !style()->isLeftToRightDirection()) {
         int cw = 0;
         if (style()->textIndent().isPercent())
             cw = containingBlock()->availableLogicalWidth();
@@ -3294,7 +3320,7 @@ RenderBlock::availableLogicalWidthForLine(int position, bool firstLine) const
     return (result < 0) ? 0 : result;
 }
 
-int RenderBlock::nextFloatBottomBelow(int height) const
+int RenderBlock::nextFloatLogicalBottomBelow(int logicalHeight) const
 {
     if (!m_floatingObjects)
         return 0;
@@ -3303,36 +3329,130 @@ int RenderBlock::nextFloatBottomBelow(int height) const
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for ( ; (r = it.current()); ++it) {
-        if (r->m_bottom > height)
-            bottom = min(r->m_bottom, bottom);
+        int floatBottom = logicalBottomForFloat(r);
+        if (floatBottom > logicalHeight)
+            bottom = min(floatBottom, bottom);
     }
 
     return bottom == INT_MAX ? 0 : bottom;
 }
 
-int
-RenderBlock::floatBottom() const
+int RenderBlock::lowestFloatLogicalBottom(FloatingObject::Type floatType) const
 {
-    if (!m_floatingObjects) return 0;
-    int bottom = 0;
+    if (!m_floatingObjects)
+        return 0;
+    int lowestFloatBottom = 0;
     FloatingObject* r;
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-    for ( ; (r = it.current()); ++it )
-        if (r->m_bottom>bottom)
-            bottom = r->m_bottom;
-    return bottom;
+    for ( ; (r = it.current()); ++it) {
+        if (r->isPlaced() && r->type() & floatType)
+            lowestFloatBottom = max(lowestFloatBottom, logicalBottomForFloat(r));
+    }
+    return lowestFloatBottom;
 }
 
-int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderBlock::topmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int bottom = includeSelf && width() > 0 ? height() : 0;
-
+    IntRect transformedRect = transformedFrameRect();
+    int transformedTop = includeSelf && transformedRect.width() > 0 ? 0 : transformedRect.height();
+    
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return bottom;
+        return transformedTop;
 
-    if (!firstChild() && (!width() || !height()))
-        return bottom;
+    if (!firstChild() && (!transformedRect.width() || !transformedRect.height()))
+        return transformedTop;
+
+    int top = includeSelf && width() > 0 ? 0 : height();
+
+    if (!hasColumns()) {
+        // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
+        // For now, we have to descend into all the children, since we may have a huge abs div inside
+        // a tiny rel div buried somewhere deep in our child tree.  In this case we have to get to
+        // the abs div.
+        for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
+            if (!c->isFloatingOrPositioned() && c->isBox()) {
+                RenderBox* childBox = toRenderBox(c);
+                top = min(top, childBox->transformedFrameRect().y() + childBox->topmostPosition(false));
+            }
+        }
+    }
+
+    if (includeSelf && isRelPositioned())
+        top += relativePositionOffsetY(); 
+
+    if (!includeOverflowInterior && hasOverflowClip())
+        return top;
     
+    int relativeOffset = includeSelf && isRelPositioned() ? relativePositionOffsetY() : 0;
+
+    if (includeSelf)
+        top = min(top, topLayoutOverflow() + relativeOffset);
+
+    if (m_positionedObjects) {
+        RenderBox* r;
+        Iterator end = m_positionedObjects->end();
+        for (Iterator it = m_positionedObjects->begin(); it != end; ++it) {
+            r = *it;
+            // Fixed positioned objects do not scroll and thus should not constitute
+            // part of the topmost position.
+            if (r->style()->position() != FixedPosition) {
+                // FIXME: Should work for overflow sections too.
+                // If a positioned object lies completely to the left of the root it will be unreachable via scrolling.
+                // Therefore we should not allow it to contribute to the topmost position.
+                IntRect transformedR = r->transformedFrameRect();
+                if (!isRenderView() || transformedR.x() + transformedR.width() > 0 || transformedR.x() + r->rightmostPosition(false) > 0) {
+                    int tp = transformedR.y() + r->topmostPosition(false);
+                    top = min(top, tp + relativeOffset);
+                }
+            }
+        }
+    }
+
+    if (hasColumns()) {
+        ColumnInfo* colInfo = columnInfo();
+        for (unsigned i = 0; i < columnCount(colInfo); i++)
+            top = min(top, columnRectAt(colInfo, i).y() + relativeOffset);
+        return top;
+    }
+
+    if (m_floatingObjects) {
+        FloatingObject* r;
+        DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
+        for ( ; (r = it.current()); ++it) {
+            if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
+                int tp = r->top() + r->m_renderer->marginTop() + r->m_renderer->topmostPosition(false);
+                top = min(top, tp + relativeOffset);
+            }
+        }
+    }
+
+    if (!includeSelf && firstRootBox())
+        top = min(top, firstRootBox()->selectionTop() + relativeOffset);
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.y();
+    }
+
+    return top;
+}
+
+int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
+{
+    IntRect transformedRect = transformedFrameRect();
+    int transformedBottom = includeSelf && transformedRect.width() > 0 ? transformedRect.height() : 0;
+
+    if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
+        return transformedBottom;
+
+    if (!firstChild() && (!transformedRect.width() || !transformedRect.height()))
+        return transformedBottom;
+
+    int bottom = includeSelf && width() > 0 ? height() : 0;
+
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
         // For now, we have to descend into all the children, since we may have a huge abs div inside
@@ -3343,7 +3463,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
         for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
             if (!c->isFloatingOrPositioned() && c->isBox()) {
                 RenderBox* childBox = toRenderBox(c);
-                bottom = max(bottom, childBox->y() + childBox->lowestPosition(false));
+                bottom = max(bottom, childBox->transformedFrameRect().y() + childBox->lowestPosition(false));
             }
         }
     }
@@ -3369,8 +3489,9 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely to the left of the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the lowest position.
-                if (!isRenderView() || r->x() + r->width() > 0 || r->x() + r->rightmostPosition(false) > 0) {
-                    int lp = r->y() + r->lowestPosition(false);
+                IntRect transformedR = r->transformedFrameRect();
+                if (!isRenderView() || transformedR.x() + transformedR.width() > 0 || transformedR.x() + r->rightmostPosition(false) > 0) {
+                    int lp = transformedR.y() + r->lowestPosition(false);
                     bottom = max(bottom, lp + relativeOffset);
                 }
             }
@@ -3389,7 +3510,7 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
             if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
-                int lp = r->m_top + r->m_renderer->marginTop() + r->m_renderer->lowestPosition(false);
+                int lp = r->top() + r->m_renderer->marginTop() + r->m_renderer->lowestPosition(false);
                 bottom = max(bottom, lp + relativeOffset);
             }
         }
@@ -3408,24 +3529,36 @@ int RenderBlock::lowestPosition(bool includeOverflowInterior, bool includeSelf)
             while (currBox && currBox->isFloatingOrPositioned())
                 currBox = currBox->previousSiblingBox();
             if (currBox) {
-                int childBottomEdge = currBox->y() + currBox->height() + currBox->collapsedMarginAfter(); // FIXME: "after" is wrong here for lowestPosition.
+                IntRect transformedCurrBox = currBox->transformedFrameRect();
+                int childBottomEdge = transformedCurrBox.y() + transformedCurrBox.height() + currBox->collapsedMarginAfter(); // FIXME: "after" is wrong here for lowestPosition.
                 bottom = max(bottom, childBottomEdge + paddingBottom() + relativeOffset);
             }
         }
     }
-    
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = topmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.height();
+    }
+
     return bottom;
 }
 
-int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int right = includeSelf && height() > 0 ? width() : 0;
+    IntRect transformedRect = transformedFrameRect();
+    int transformedRight = includeSelf && transformedRect.height() > 0 ? transformedRect.width() : 0;
 
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return right;
+        return transformedRight;
 
-    if (!firstChild() && (!width() || !height()))
-        return right;
+    if (!firstChild() && (!transformedRect.width() || !transformedRect.height()))
+        return transformedRight;
+
+    int right = includeSelf && height() > 0 ? width() : 0;
 
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
@@ -3435,7 +3568,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
         for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
             if (!c->isFloatingOrPositioned() && c->isBox()) {
                 RenderBox* childBox = toRenderBox(c);
-                right = max(right, childBox->x() + childBox->rightmostPosition(false));
+                right = max(right, childBox->transformedFrameRect().x() + childBox->rightmostPosition(false));
             }
         }
     }
@@ -3462,8 +3595,9 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely above the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the rightmost position.
-                if (!isRenderView() || r->y() + r->height() > 0 || r->y() + r->lowestPosition(false) > 0) {
-                    int rp = r->x() + r->rightmostPosition(false);
+                IntRect transformedR = r->transformedFrameRect();
+                if (!isRenderView() || transformedR.y() + transformedR.height() > 0 || transformedR.y() + r->lowestPosition(false) > 0) {
+                    int rp = transformedR.x() + r->rightmostPosition(false);
                     right = max(right, rp + relativeOffset);
                 }
             }
@@ -3472,12 +3606,19 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
 
     if (hasColumns()) {
         // This only matters for LTR
-        if (style()->direction() == LTR) {
+        if (style()->isLeftToRightDirection()) {
             ColumnInfo* colInfo = columnInfo();
             unsigned count = columnCount(colInfo);
             if (count)
                 right = max(columnRectAt(colInfo, count - 1).right() + relativeOffset, right);
         }
+        if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+            int top = topmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+            int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+            int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+            IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+            return transformRect.width();
+        }
         return right;
     }
 
@@ -3486,7 +3627,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
             if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
-                int rp = r->m_left + r->m_renderer->marginLeft() + r->m_renderer->rightmostPosition(false);
+                int rp = r->left() + r->m_renderer->marginLeft() + r->m_renderer->rightmostPosition(false);
                 right = max(right, rp + relativeOffset);
             }
         }
@@ -3500,7 +3641,7 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
                 
                 // If this node is a root editable element, then the rightmostPosition should account for a caret at the end.
                 // FIXME: Need to find another way to do this, since scrollbars could show when we don't want them to.
-                if (node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->direction() == LTR && !paddingRight())
+                if (node() && node()->isContentEditable() && node() == node()->rootEditableElement() && style()->isLeftToRightDirection() && !paddingRight())
                     childRightEdge += 1;
                 right = max(right, childRightEdge + paddingRight() + relativeOffset);
             }
@@ -3509,24 +3650,36 @@ int RenderBlock::rightmostPosition(bool includeOverflowInterior, bool includeSel
             for (RenderBox* currBox = firstChildBox(); currBox; currBox = currBox->nextSiblingBox()) {
                 if (currBox->isFloatingOrPositioned())
                     continue;
-                int childRightEdge = currBox->x() + currBox->width() + currBox->marginRight();
+                IntRect transformedChild = currBox->transformedFrameRect();
+                int childRightEdge = transformedChild.x() + transformedChild.width() + currBox->marginRight();
                 right = max(right, childRightEdge + paddingRight() + relativeOffset);
             }
         }
     }
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = topmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.width();
+    }
     
     return right;
 }
 
-int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int left = includeSelf && height() > 0 ? 0 : width();
+    IntRect transformedRect = transformedFrameRect();
+    int transformedLeft = includeSelf && transformedRect.height() > 0 ? 0 : transformedRect.width();
     
     if (!includeOverflowInterior && (hasOverflowClip() || hasControlClip()))
-        return left;
+        return transformedLeft;
 
-    if (!firstChild() && (!width() || !height()))
-        return left;
+    if (!firstChild() && (!transformedRect.width() || !transformedRect.height()))
+        return transformedLeft;
+
+    int left = includeSelf && height() > 0 ? 0 : width();
 
     if (!hasColumns()) {
         // FIXME: Come up with a way to use the layer tree to avoid visiting all the kids.
@@ -3536,7 +3689,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
         for (RenderObject* c = firstChild(); c; c = c->nextSibling()) {
             if (!c->isFloatingOrPositioned() && c->isBox()) {
                 RenderBox* childBox = toRenderBox(c);
-                left = min(left, childBox->x() + childBox->leftmostPosition(false));
+                left = min(left, childBox->transformedFrameRect().x() + childBox->leftmostPosition(false));
             }
         }
     }
@@ -3563,8 +3716,9 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
                 // FIXME: Should work for overflow sections too.
                 // If a positioned object lies completely above the root it will be unreachable via scrolling.
                 // Therefore we should not allow it to contribute to the leftmost position.
-                if (!isRenderView() || r->y() + r->height() > 0 || r->y() + r->lowestPosition(false) > 0) {
-                    int lp = r->x() + r->leftmostPosition(false);
+                IntRect transformedR = r->transformedFrameRect();
+                if (!isRenderView() || transformedR.y() + transformedR.height() > 0 || transformedR.y() + r->lowestPosition(false) > 0) {
+                    int lp = transformedR.x() + r->leftmostPosition(false);
                     left = min(left, lp + relativeOffset);
                 }
             }
@@ -3573,7 +3727,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
 
     if (hasColumns()) {
         // This only matters for RTL
-        if (style()->direction() == RTL) {
+        if (!style()->isLeftToRightDirection()) {
             ColumnInfo* colInfo = columnInfo();
             unsigned count = columnCount(colInfo);
             if (count)
@@ -3587,7 +3741,7 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
         DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
         for ( ; (r = it.current()); ++it ) {
             if (r->m_shouldPaint || r->m_renderer->hasSelfPaintingLayer()) {
-                int lp = r->m_left + r->m_renderer->marginLeft() + r->m_renderer->leftmostPosition(false);
+                int lp = r->left() + r->m_renderer->marginLeft() + r->m_renderer->leftmostPosition(false);
                 left = min(left, lp + relativeOffset);
             }
         }
@@ -3597,51 +3751,31 @@ int RenderBlock::leftmostPosition(bool includeOverflowInterior, bool includeSelf
         for (InlineFlowBox* currBox = firstLineBox(); currBox; currBox = currBox->nextLineBox())
             left = min(left, (int)currBox->x() + relativeOffset);
     }
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = topmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.x();
+    }
     
     return left;
 }
 
-int
-RenderBlock::leftBottom()
-{
-    if (!m_floatingObjects) return 0;
-    int bottom = 0;
-    FloatingObject* r;
-    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-    for ( ; (r = it.current()); ++it )
-        if (r->m_bottom > bottom && r->type() == FloatingObject::FloatLeft)
-            bottom = r->m_bottom;
-
-    return bottom;
-}
-
-int
-RenderBlock::rightBottom()
-{
-    if (!m_floatingObjects) return 0;
-    int bottom = 0;
-    FloatingObject* r;
-    DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-    for ( ; (r = it.current()); ++it )
-        if (r->m_bottom>bottom && r->type() == FloatingObject::FloatRight)
-            bottom = r->m_bottom;
-
-    return bottom;
-}
-
-void RenderBlock::markLinesDirtyInVerticalRange(int top, int bottom, RootInlineBox* highest)
+void RenderBlock::markLinesDirtyInBlockRange(int logicalTop, int logicalBottom, RootInlineBox* highest)
 {
-    if (top >= bottom)
+    if (logicalTop >= logicalBottom)
         return;
 
     RootInlineBox* lowestDirtyLine = lastRootBox();
     RootInlineBox* afterLowest = lowestDirtyLine;
-    while (lowestDirtyLine && lowestDirtyLine->blockHeight() >= bottom) {
+    while (lowestDirtyLine && lowestDirtyLine->blockLogicalHeight() >= logicalBottom) {
         afterLowest = lowestDirtyLine;
         lowestDirtyLine = lowestDirtyLine->prevRootBox();
     }
 
-    while (afterLowest && afterLowest != highest && afterLowest->blockHeight() >= top) {
+    while (afterLowest && afterLowest != highest && afterLowest->blockLogicalHeight() >= logicalTop) {
         afterLowest->markDirty();
         afterLowest = afterLowest->prevRootBox();
     }
@@ -3678,6 +3812,7 @@ void RenderBlock::clearFloats()
     // out of flow (like floating/positioned elements), and we also skip over any objects that may have shifted
     // to avoid floats.
     bool parentHasFloats = false;
+    RenderBlock* parentBlock = toRenderBlock(parent());
     RenderObject* prev = previousSibling();
     while (prev && (prev->isFloatingOrPositioned() || !prev->isBox() || !prev->isRenderBlock() || toRenderBlock(prev)->avoidsFloats())) {
         if (prev->isFloating())
@@ -3686,18 +3821,16 @@ void RenderBlock::clearFloats()
     }
 
     // First add in floats from the parent.
-    int offset = y();
-    if (parentHasFloats) {
-        RenderBlock* parentBlock = toRenderBlock(parent());
-        addIntrudingFloats(parentBlock, parentBlock->borderLeft() + parentBlock->paddingLeft(), offset);
-    }
+    int logicalTopOffset = logicalTop();
+    if (parentHasFloats)
+        addIntrudingFloats(parentBlock, parentBlock->logicalLeftOffsetForContent(), logicalTopOffset);
     
-    int xoffset = 0;
+    int logicalLeftOffset = 0;
     if (prev)
-        offset -= toRenderBox(prev)->y();
-    else if (parent()->isBox()) {
-        prev = parent();
-        xoffset += toRenderBox(prev)->borderLeft() + toRenderBox(prev)->paddingLeft();
+        logicalTopOffset -= toRenderBox(prev)->logicalTop();
+    else {
+        prev = parentBlock;
+        logicalLeftOffset += parentBlock->logicalLeftOffsetForContent();
     }
 
     // Add overhanging floats from the previous RenderBlock, but only if it has a float that intrudes into our space.
@@ -3705,29 +3838,31 @@ void RenderBlock::clearFloats()
         return;
     
     RenderBlock* block = toRenderBlock(prev);
-    if (block->m_floatingObjects && block->floatBottom() > offset)
-        addIntrudingFloats(block, xoffset, offset);
+    if (block->m_floatingObjects && block->lowestFloatLogicalBottom() > logicalTopOffset)
+        addIntrudingFloats(block, logicalLeftOffset, logicalTopOffset);
 
     if (childrenInline()) {
-        int changeTop = numeric_limits<int>::max();
-        int changeBottom = numeric_limits<int>::min();
+        int changeLogicalTop = numeric_limits<int>::max();
+        int changeLogicalBottom = numeric_limits<int>::min();
         if (m_floatingObjects) {
             for (FloatingObject* f = m_floatingObjects->first(); f; f = m_floatingObjects->next()) {
                 FloatingObject* oldFloatingObject = floatMap.get(f->m_renderer);
+                int logicalBottom = logicalBottomForFloat(f);
                 if (oldFloatingObject) {
-                    if (f->m_width != oldFloatingObject->m_width || f->m_left != oldFloatingObject->m_left) {
-                        changeTop = 0;
-                        changeBottom = max(changeBottom, max(f->m_bottom, oldFloatingObject->m_bottom));
-                    } else if (f->m_bottom != oldFloatingObject->m_bottom) {
-                        changeTop = min(changeTop, min(f->m_bottom, oldFloatingObject->m_bottom));
-                        changeBottom = max(changeBottom, max(f->m_bottom, oldFloatingObject->m_bottom));
+                    int oldLogicalBottom = logicalBottomForFloat(oldFloatingObject);
+                    if (logicalWidthForFloat(f) != logicalWidthForFloat(oldFloatingObject) || logicalLeftForFloat(f) != logicalLeftForFloat(oldFloatingObject)) {
+                        changeLogicalTop = 0;
+                        changeLogicalBottom = max(changeLogicalBottom, max(logicalBottom, oldLogicalBottom));
+                    } else if (logicalBottom != oldLogicalBottom) {
+                        changeLogicalTop = min(changeLogicalTop, min(logicalBottom, oldLogicalBottom));
+                        changeLogicalBottom = max(changeLogicalBottom, max(logicalBottom, oldLogicalBottom));
                     }
 
                     floatMap.remove(f->m_renderer);
                     delete oldFloatingObject;
                 } else {
-                    changeTop = 0;
-                    changeBottom = max(changeBottom, f->m_bottom);
+                    changeLogicalTop = 0;
+                    changeLogicalBottom = max(changeLogicalBottom, logicalBottom);
                 }
             }
         }
@@ -3736,39 +3871,37 @@ void RenderBlock::clearFloats()
         for (RendererToFloatInfoMap::iterator it = floatMap.begin(); it != end; ++it) {
             FloatingObject* floatingObject = (*it).second;
             if (!floatingObject->m_isDescendant) {
-                changeTop = 0;
-                changeBottom = max(changeBottom, floatingObject->m_bottom);
+                changeLogicalTop = 0;
+                changeLogicalBottom = max(changeLogicalBottom, logicalBottomForFloat(floatingObject));
             }
         }
         deleteAllValues(floatMap);
 
-        markLinesDirtyInVerticalRange(changeTop, changeBottom);
+        markLinesDirtyInBlockRange(changeLogicalTop, changeLogicalBottom);
     }
 }
 
-int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bool makeChildPaintOtherFloats)
+int RenderBlock::addOverhangingFloats(RenderBlock* child, int logicalLeftOffset, int logicalTopOffset, bool makeChildPaintOtherFloats)
 {
     // Prevent floats from being added to the canvas by the root element, e.g., <html>.
-    if (child->hasOverflowClip() || !child->containsFloats() || child->isRoot() || child->hasColumns() || child->isBlockFlowRoot())
+    if (child->hasOverflowClip() || !child->containsFloats() || child->isRoot() || child->hasColumns() || child->isWritingModeRoot())
         return 0;
 
-    int lowestFloatBottom = 0;
+    int lowestFloatLogicalBottom = 0;
 
     // Floats that will remain the child's responsibility to paint should factor into its
     // overflow.
     DeprecatedPtrListIterator<FloatingObject> it(*child->m_floatingObjects);
     for (FloatingObject* r; (r = it.current()); ++it) {
-        int bottom = child->y() + r->m_bottom;
-        lowestFloatBottom = max(lowestFloatBottom, bottom);
+        int logicalBottom = child->logicalTop() + logicalBottomForFloat(r);
+        lowestFloatLogicalBottom = max(lowestFloatLogicalBottom, logicalBottom);
 
-        if (bottom > height()) {
+        if (logicalBottom > logicalHeight()) {
             // If the object is not in the list, we add it now.
             if (!containsFloat(r->m_renderer)) {
-                FloatingObject *floatingObj = new FloatingObject(r->type());
-                floatingObj->m_top = r->m_top - yoff;
-                floatingObj->m_bottom = r->m_bottom - yoff;
-                floatingObj->m_left = r->m_left - xoff;
-                floatingObj->m_width = r->m_width;
+                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->left() - leftOffset, r->top() - topOffset, r->width(), r->height()));
                 floatingObj->m_renderer = r->m_renderer;
 
                 // The nearest enclosing layer always paints the float (so that zindex and stacking
@@ -3797,45 +3930,48 @@ int RenderBlock::addOverhangingFloats(RenderBlock* child, int xoff, int yoff, bo
             r->m_shouldPaint = true;
 
         if (r->m_shouldPaint && !r->m_renderer->hasSelfPaintingLayer())
-            child->addOverflowFromChild(r->m_renderer, IntSize(r->m_left + r->m_renderer->marginLeft(), r->m_top + r->m_renderer->marginTop()));
+            child->addOverflowFromChild(r->m_renderer, IntSize(r->left() + r->m_renderer->marginLeft(), r->top() + r->m_renderer->marginTop()));
     }
-    return lowestFloatBottom;
+    return lowestFloatLogicalBottom;
 }
 
-void RenderBlock::addIntrudingFloats(RenderBlock* prev, int xoff, int yoff)
+void RenderBlock::addIntrudingFloats(RenderBlock* prev, int logicalLeftOffset, int logicalTopOffset)
 {
     // If the parent or previous sibling doesn't have any floats to add, don't bother.
     if (!prev->m_floatingObjects)
         return;
 
+    logicalLeftOffset += (style()->isHorizontalWritingMode() ? marginLeft() : marginTop());
+                
     DeprecatedPtrListIterator<FloatingObject> it(*prev->m_floatingObjects);
     for (FloatingObject *r; (r = it.current()); ++it) {
-        if (r->m_bottom > yoff) {
+        if (logicalBottomForFloat(r) > logicalTopOffset) {
             // The object may already be in our list. Check for it up front to avoid
             // creating duplicate entries.
             FloatingObject* f = 0;
             if (m_floatingObjects) {
                 DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
                 while ((f = it.current())) {
-                    if (f->m_renderer == r->m_renderer) break;
+                    if (f->m_renderer == r->m_renderer)
+                        break;
                     ++it;
                 }
             }
             if (!f) {
-                FloatingObject *floatingObj = new FloatingObject(r->type());
-                floatingObj->m_top = r->m_top - yoff;
-                floatingObj->m_bottom = r->m_bottom - yoff;
-                floatingObj->m_left = r->m_left - xoff;
+                int leftOffset = style()->isHorizontalWritingMode() ? logicalLeftOffset : logicalTopOffset;
+                int topOffset = style()->isHorizontalWritingMode() ? logicalTopOffset : logicalLeftOffset;
+                
+                FloatingObject* floatingObj = new FloatingObject(r->type(), IntRect(r->left() - leftOffset, r->top() - topOffset, r->width(), r->height()));
+
                 // Applying the child's margin makes no sense in the case where the child was passed in.
-                // since his own margin was added already through the subtraction of the |xoff| variable
-                // above.  |xoff| will equal -flow->marginLeft() in this case, so it's already been taken
-                // into account.  Only apply this code if |child| is false, since otherwise the left margin
+                // since this margin was added already through the modification of the |logicalLeftOffset| variable
+                // above.  |logicalLeftOffset| will equal the margin in this case, so it's already been taken
+                // into account.  Only apply this code if prev is the parent, since otherwise the left margin
                 // will get applied twice.
                 if (prev != parent())
-                    floatingObj->m_left += prev->marginLeft();
-                floatingObj->m_left -= marginLeft();
+                    floatingObj->setLeft(floatingObj->left() + (style()->isHorizontalWritingMode() ? prev->marginLeft() : prev->marginTop()));
+               
                 floatingObj->m_shouldPaint = false;  // We are not in the direct inheritance chain for this float. We will never paint it.
-                floatingObj->m_width = r->m_width;
                 floatingObj->m_renderer = r->m_renderer;
                 
                 // We create the floating object list lazily.
@@ -3890,41 +4026,6 @@ void RenderBlock::markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove
     }
 }
 
-void RenderBlock::markDescendantBlocksAndLinesForLayout(bool inLayout)
-{
-    if (!m_everHadLayout)
-        return;
-
-    setChildNeedsLayout(true, !inLayout);
-
-    // Iterate over our children and mark them as needed.
-    if (!childrenInline()) {
-        for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-            if (child->isFloatingOrPositioned())
-                continue;
-            child->markDescendantBlocksAndLinesForLayout(inLayout);
-        }
-    }
-    
-    // Walk our floating objects and mark them too.
-    if (m_floatingObjects) {
-        DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
-        while (it.current()) {
-            if (it.current()->m_renderer->isRenderBlock())
-                it.current()->m_renderer->markDescendantBlocksAndLinesForLayout(inLayout);
-            ++it;
-        }
-    }
-
-    if (m_positionedObjects) {
-        // FIXME: Technically we don't have to mark the positioned objects if we're the block
-        // that established the columns, but we don't really have that information here.
-        Iterator end = m_positionedObjects->end();
-        for (Iterator it = m_positionedObjects->begin(); it != end; ++it)
-            (*it)->markDescendantBlocksAndLinesForLayout();
-    }
-}
-
 int RenderBlock::getClearDelta(RenderBox* child, int yPos)
 {
     // There is no need to compute clearance if we have no floats.
@@ -3938,13 +4039,13 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
         case CNONE:
             break;
         case CLEFT:
-            bottom = leftBottom();
+            bottom = lowestFloatLogicalBottom(FloatingObject::FloatLeft);
             break;
         case CRIGHT:
-            bottom = rightBottom();
+            bottom = lowestFloatLogicalBottom(FloatingObject::FloatRight);
             break;
         case CBOTH:
-            bottom = floatBottom();
+            bottom = lowestFloatLogicalBottom();
             break;
     }
 
@@ -3972,7 +4073,7 @@ int RenderBlock::getClearDelta(RenderBox* child, int yPos)
             if (childWidthAtY <= widthAtY)
                 return y - yPos;
 
-            y = nextFloatBottomBelow(y);
+            y = nextFloatLogicalBottomBelow(y);
             ASSERT(y >= yPos);
             if (y < yPos)
                 break;
@@ -3999,7 +4100,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
         // Check if we need to do anything at all.
         IntRect overflowBox = visibleOverflowRect();
         overflowBox.move(tx, ty);
-        if (!overflowBox.intersects(result.rectFromPoint(_x, _y)))
+        if (!overflowBox.intersects(result.rectForPoint(_x, _y)))
             return false;
     }
 
@@ -4013,7 +4114,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     // If we have clipping, then we can't have any spillout.
     bool useOverflowClip = hasOverflowClip() && !hasSelfPaintingLayer();
     bool useClip = (hasControlClip() || useOverflowClip);
-    IntRect hitTestArea(result.rectFromPoint(_x, _y));
+    IntRect hitTestArea(result.rectForPoint(_x, _y));
     bool checkChildren = !useClip || (hasControlClip() ? controlClipRect(tx, ty).intersects(hitTestArea) : overflowClipRect(tx, ty).intersects(hitTestArea));
     if (checkChildren) {
         // Hit test descendants first.
@@ -4042,7 +4143,7 @@ bool RenderBlock::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     // Now hit test our background
     if (hitTestAction == HitTestBlockBackground || hitTestAction == HitTestChildBlockBackground) {
         IntRect boundsRect(tx, ty, width(), height());
-        if (visibleToHitTesting() && boundsRect.intersects(result.rectFromPoint(_x, _y))) {
+        if (visibleToHitTesting() && boundsRect.intersects(result.rectForPoint(_x, _y))) {
             updateHitTestResult(result, IntPoint(_x - tx, _y - ty));
             if (!result.addNodeToRectBasedTestResult(node(), _x, _y, boundsRect))
                 return true;
@@ -4066,8 +4167,8 @@ bool RenderBlock::hitTestFloats(const HitTestRequest& request, HitTestResult& re
     DeprecatedPtrListIterator<FloatingObject> it(*m_floatingObjects);
     for (it.toLast(); (floatingObject = it.current()); --it) {
         if (floatingObject->m_shouldPaint && !floatingObject->m_renderer->hasSelfPaintingLayer()) {
-            int xOffset = tx + floatingObject->m_left + floatingObject->m_renderer->marginLeft() - floatingObject->m_renderer->x();
-            int yOffset =  ty + floatingObject->m_top + floatingObject->m_renderer->marginTop() - floatingObject->m_renderer->y();
+            int xOffset = tx + floatingObject->left() + floatingObject->m_renderer->marginLeft() - floatingObject->m_renderer->x();
+            int yOffset =  ty + floatingObject->top() + floatingObject->m_renderer->marginTop() - floatingObject->m_renderer->y();
             if (floatingObject->m_renderer->hitTest(request, result, IntPoint(x, y), xOffset, yOffset)) {
                 updateHitTestResult(result, IntPoint(x - xOffset, y - yOffset));
                 return true;
@@ -4096,13 +4197,13 @@ bool RenderBlock::hitTestColumns(const HitTestRequest& request, HitTestResult& r
         currYOffset += colRect.height();
         colRect.move(tx, ty);
         
-        if (colRect.intersects(result.rectFromPoint(x, y))) {
+        if (colRect.intersects(result.rectForPoint(x, y))) {
             // The point is inside this column.
             // Adjust tx and ty to change where we hit test.
         
             int finalX = tx + currXOffset;
             int finalY = ty + currYOffset;
-            if (result.isRectBasedTest() && !colRect.contains(result.rectFromPoint(x, y)))
+            if (result.isRectBasedTest() && !colRect.contains(result.rectForPoint(x, y)))
                 hitTestContents(request, result, x, y, finalX, finalY, hitTestAction);
             else
                 return hitTestContents(request, result, x, y, finalX, finalY, hitTestAction) || (hitTestAction == HitTestFloat && hitTestFloats(request, result, x, y, finalX, finalY));
@@ -4443,7 +4544,7 @@ IntRect RenderBlock::columnRectAt(ColumnInfo* colInfo, unsigned index) const
     int colHeight = colInfo->columnHeight();
     int colTop = borderTop() + paddingTop();
     int colGap = columnGap();
-    int colLeft = style()->direction() == LTR ? 
+    int colLeft = style()->isLeftToRightDirection() ? 
                       borderLeft() + paddingLeft() + (index * (colWidth + colGap))
                       : borderLeft() + paddingLeft() + contentWidth() - colWidth - (index * (colWidth + colGap));
     return IntRect(colLeft, colTop, colWidth, colHeight);
@@ -4485,8 +4586,8 @@ bool RenderBlock::layoutColumns(bool hasSpecifiedPageHeight, int pageHeight, Lay
 
         if (columnCount(colInfo)) {
             IntRect lastRect = columnRectAt(colInfo, columnCount(colInfo) - 1);
-            int overflowLeft = style()->direction() == RTL ? min(0, lastRect.x()) : 0;
-            int overflowRight = style()->direction() == LTR ? max(width(), lastRect.x() + lastRect.width()) : 0;
+            int overflowLeft = !style()->isLeftToRightDirection() ? min(0, lastRect.x()) : 0;
+            int overflowRight = style()->isLeftToRightDirection() ? max(width(), lastRect.x() + lastRect.width()) : 0;
             int overflowHeight = borderTop() + paddingTop() + colInfo->columnHeight();
             
             setLogicalHeight(overflowHeight + borderBottom() + paddingBottom() + horizontalScrollbarHeight());
@@ -4607,8 +4708,8 @@ void RenderBlock::computePreferredLogicalWidths()
 
     updateFirstLetter();
 
-    if (!isTableCell() && style()->width().isFixed() && style()->width().value() > 0)
-        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(style()->width().value());
+    if (!isTableCell() && style()->logicalWidth().isFixed() && style()->logicalWidth().value() > 0)
+        m_minPreferredLogicalWidth = m_maxPreferredLogicalWidth = computeContentBoxLogicalWidth(style()->logicalWidth().value());
     else {
         m_minPreferredLogicalWidth = 0;
         m_maxPreferredLogicalWidth = 0;
@@ -4635,18 +4736,18 @@ void RenderBlock::computePreferredLogicalWidths()
         }
     }
     
-    if (style()->minWidth().isFixed() && style()->minWidth().value() > 0) {
-        m_maxPreferredLogicalWidth = max(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->minWidth().value()));
-        m_minPreferredLogicalWidth = max(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->minWidth().value()));
+    if (style()->logicalMinWidth().isFixed() && style()->logicalMinWidth().value() > 0) {
+        m_maxPreferredLogicalWidth = max(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->logicalMinWidth().value()));
+        m_minPreferredLogicalWidth = max(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->logicalMinWidth().value()));
     }
     
-    if (style()->maxWidth().isFixed() && style()->maxWidth().value() != undefinedLength) {
-        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->maxWidth().value()));
-        m_minPreferredLogicalWidth = min(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->maxWidth().value()));
+    if (style()->logicalMaxWidth().isFixed() && style()->logicalMaxWidth().value() != undefinedLength) {
+        m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->logicalMaxWidth().value()));
+        m_minPreferredLogicalWidth = min(m_minPreferredLogicalWidth, computeContentBoxLogicalWidth(style()->logicalMaxWidth().value()));
     }
 
     int toAdd = 0;
-    toAdd = borderAndPaddingWidth();
+    toAdd = borderAndPaddingLogicalWidth();
 
     if (hasOverflowClip() && style()->overflowY() == OSCROLL)
         toAdd += verticalScrollbarWidth();
@@ -4732,7 +4833,7 @@ static int getBorderPaddingMargin(const RenderBoxModelObject* child, bool endOfI
 {
     RenderStyle* cstyle = child->style();
     int result = 0;
-    bool leftSide = (cstyle->direction() == LTR) ? !endOfInline : endOfInline;
+    bool leftSide = (cstyle->isLeftToRightDirection()) ? !endOfInline : endOfInline;
     result += getBPMWidth((leftSide ? child->marginLeft() : child->marginRight()),
                           (leftSide ? cstyle->marginLeft() :
                                       cstyle->marginRight()));
@@ -5135,15 +5236,15 @@ bool RenderBlock::hasLineIfEmpty() const
     return false;
 }
 
-int RenderBlock::lineHeight(bool firstLine, bool isRootLineBox) const
+int RenderBlock::lineHeight(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     // Inline blocks are replaced elements. Otherwise, just pass off to
     // the base class.  If we're being queried as though we're the root line
     // box, then the fact that we're an inline-block is irrelevant, and we behave
     // just like a block.
-    if (isReplaced() && !isRootLineBox)
-        return height() + marginTop() + marginBottom();
-    
+    if (isReplaced() && linePositionMode == PositionOnContainingLine)
+        return RenderBox::lineHeight(firstLine, direction, linePositionMode);
+
     if (firstLine && document()->usesFirstLineRules()) {
         RenderStyle* s = style(firstLine);
         if (s != style())
@@ -5156,16 +5257,17 @@ int RenderBlock::lineHeight(bool firstLine, bool isRootLineBox) const
     return m_lineHeight;
 }
 
-int RenderBlock::baselinePosition(bool b, bool isRootLineBox) const
+int RenderBlock::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     // Inline blocks are replaced elements. Otherwise, just pass off to
     // the base class.  If we're being queried as though we're the root line
     // box, then the fact that we're an inline-block is irrelevant, and we behave
     // just like a block.
-    if (isReplaced() && !isRootLineBox) {
+    if (isReplaced() && linePositionMode == PositionOnContainingLine) {
         // For "leaf" theme objects, let the theme decide what the baseline position is.
         // FIXME: Might be better to have a custom CSS property instead, so that if the theme
         // is turned off, checkboxes/radios will still have decent baselines.
+        // FIXME: Need to patch form controls to deal with vertical lines.
         if (style()->hasAppearance() && !theme()->isControlContainer(style()->appearance()))
             return theme()->baselinePosition(this);
             
@@ -5175,22 +5277,29 @@ int RenderBlock::baselinePosition(bool b, bool isRootLineBox) const
         // We also give up on finding a baseline if we have a vertical scrollbar, or if we are scrolled
         // vertically (e.g., an overflow:hidden block that has had scrollTop moved) or if the baseline is outside
         // of our content box.
-        int baselinePos = (layer() && (layer()->marquee() || layer()->verticalScrollbar() || layer()->scrollYOffset() != 0)) ? -1 : lastLineBoxBaseline();
-        if (baselinePos != -1 && baselinePos <= borderTop() + paddingTop() + contentHeight())
-            return marginTop() + baselinePos;
-        return height() + marginTop() + marginBottom();
+        bool ignoreBaseline = (layer() && (layer()->marquee() || (direction == HorizontalLine ? (layer()->verticalScrollbar() || layer()->scrollYOffset() != 0)
+            : (layer()->horizontalScrollbar() || layer()->scrollXOffset() != 0)))) || isWritingModeRoot();
+        int baselinePos = ignoreBaseline ? -1 : lastLineBoxBaseline();
+        
+        int bottomOfContent = direction == HorizontalLine ? borderTop() + paddingTop() + contentHeight() : borderRight() + paddingRight() + contentWidth();
+        if (baselinePos != -1 && baselinePos <= bottomOfContent)
+            return direction == HorizontalLine ? marginTop() + baselinePos : marginRight() + baselinePos;
+            
+        return RenderBox::baselinePosition(firstLine, direction, linePositionMode);
     }
-    return RenderBox::baselinePosition(b, isRootLineBox);
+
+    const Font& f = style(firstLine)->font();
+    return f.ascent() + (lineHeight(firstLine, direction, linePositionMode) - f.height()) / 2;
 }
 
 int RenderBlock::firstLineBoxBaseline() const
 {
-    if (!isBlockFlow())
+    if (!isBlockFlow() || isWritingModeRoot())
         return -1;
 
     if (childrenInline()) {
         if (firstLineBox())
-            return firstLineBox()->y() + style(true)->font().ascent();
+            return firstLineBox()->logicalTop() + style(true)->font().ascent();
         else
             return -1;
     }
@@ -5199,7 +5308,7 @@ int RenderBlock::firstLineBoxBaseline() const
             if (!curr->isFloatingOrPositioned()) {
                 int result = curr->firstLineBoxBaseline();
                 if (result != -1)
-                    return curr->y() + result; // Translate to our coordinate space.
+                    return curr->logicalTop() + result; // Translate to our coordinate space.
             }
         }
     }
@@ -5209,28 +5318,33 @@ int RenderBlock::firstLineBoxBaseline() const
 
 int RenderBlock::lastLineBoxBaseline() const
 {
-    if (!isBlockFlow())
+    if (!isBlockFlow() || isWritingModeRoot())
         return -1;
 
+    LineDirectionMode lineDirection = style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+
     if (childrenInline()) {
-        if (!firstLineBox() && hasLineIfEmpty())
-            return RenderBox::baselinePosition(true, true) + borderTop() + paddingTop();
+        if (!firstLineBox() && hasLineIfEmpty()) {
+            const Font& f = firstLineStyle()->font();
+            return f.ascent() + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - f.height()) / 2 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
+        }
         if (lastLineBox())
-            return lastLineBox()->y() + style(lastLineBox() == firstLineBox())->font().ascent();
+            return lastLineBox()->logicalTop() + style(lastLineBox() == firstLineBox())->font().ascent();
         return -1;
-    }
-    else {
+    } else {
         bool haveNormalFlowChild = false;
         for (RenderBox* curr = lastChildBox(); curr; curr = curr->previousSiblingBox()) {
             if (!curr->isFloatingOrPositioned()) {
                 haveNormalFlowChild = true;
                 int result = curr->lastLineBoxBaseline();
                 if (result != -1)
-                    return curr->y() + result; // Translate to our coordinate space.
+                    return curr->logicalTop() + result; // Translate to our coordinate space.
             }
         }
-        if (!haveNormalFlowChild && hasLineIfEmpty())
-            return RenderBox::baselinePosition(true, true) + borderTop() + paddingTop();
+        if (!haveNormalFlowChild && hasLineIfEmpty()) {
+            const Font& f = firstLineStyle()->font();
+            return f.ascent() + (lineHeight(true, lineDirection, PositionOfInteriorLineBoxes) - f.height()) / 2 + (lineDirection == HorizontalLine ? borderTop() + paddingTop() : borderRight() + paddingRight());
+        }
     }
 
     return -1;
@@ -5279,6 +5393,24 @@ static RenderStyle* styleForFirstLetter(RenderObject* firstLetterBlock, RenderOb
     return pseudoStyle;
 }
 
+// CSS 2.1 http://www.w3.org/TR/CSS21/selector.html#first-letter
+// "Punctuation (i.e, characters defined in Unicode [UNICODE] in the "open" (Ps), "close" (Pe),
+// "initial" (Pi). "final" (Pf) and "other" (Po) punctuation classes), that precedes or follows the first letter should be included"
+static inline bool isPunctuationForFirstLetter(UChar c)
+{
+    CharCategory charCategory = category(c);
+    return charCategory == Punctuation_Open
+        || charCategory == Punctuation_Close
+        || charCategory == Punctuation_InitialQuote
+        || charCategory == Punctuation_FinalQuote
+        || charCategory == Punctuation_Other;
+}
+
+static inline bool shouldSkipForFirstLetter(UChar c)
+{
+    return isSpaceOrNewline(c) || c == noBreakSpace || isPunctuationForFirstLetter(c);
+}
+
 void RenderBlock::updateFirstLetter()
 {
     if (!document()->usesFirstLetterRules())
@@ -5403,15 +5535,27 @@ void RenderBlock::updateFirstLetter()
     if (oldText && oldText->length() > 0) {
         unsigned length = 0;
 
-        // account for leading spaces and punctuation
-        while (length < oldText->length() && (isSpaceOrNewline((*oldText)[length]) || Unicode::isPunct((*oldText)[length])))
+        // Account for leading spaces and punctuation.
+        while (length < oldText->length() && shouldSkipForFirstLetter((*oldText)[length]))
             length++;
 
-        // account for first letter
+        // Account for first letter.
         length++;
+        
+        // Keep looking for whitespace and allowed punctuation, but avoid
+        // accumulating just whitespace into the :first-letter.
+        for (unsigned scanLength = length; scanLength < oldText->length(); ++scanLength) {
+            UChar c = (*oldText)[scanLength]; 
+            
+            if (!shouldSkipForFirstLetter(c))
+                break;
 
-        // construct text fragment for the text after the first letter
-        // NOTE: this might empty
+            if (isPunctuationForFirstLetter(c))
+                length = scanLength + 1;
+         }
+         
+        // Construct a text fragment for the text after the first letter.
+        // This text fragment might be empty.
         RenderTextFragment* remainingText = 
             new (renderArena()) RenderTextFragment(textObj->node() ? textObj->node() : textObj->document(), oldText.get(), length, oldText->length() - length);
         remainingText->setStyle(textObj->style());
@@ -5553,7 +5697,7 @@ void RenderBlock::adjustForBorderFit(int x, int& left, int& right) const
             for (; (r = it.current()); ++it) {
                 // Only examine the object if our m_shouldPaint flag is set.
                 if (r->m_shouldPaint) {
-                    int floatLeft = r->m_left - r->m_renderer->x() + r->m_renderer->marginLeft();
+                    int floatLeft = r->left() - r->m_renderer->x() + r->m_renderer->marginLeft();
                     int floatRight = floatLeft + r->m_renderer->width();
                     left = min(left, floatLeft);
                     right = max(right, floatRight);
@@ -5605,23 +5749,23 @@ void RenderBlock::clearTruncation()
 void RenderBlock::setMaxMarginBeforeValues(int pos, int neg)
 {
     if (!m_rareData) {
-        if (pos == RenderBlockRareData::beforePosDefault(this) && neg == RenderBlockRareData::beforeNegDefault(this))
+        if (pos == RenderBlockRareData::positiveMarginBeforeDefault(this) && neg == RenderBlockRareData::negativeMarginBeforeDefault(this))
             return;
         m_rareData = new RenderBlockRareData(this);
     }
-    m_rareData->m_beforePos = pos;
-    m_rareData->m_beforeNeg = neg;
+    m_rareData->m_margins.setPositiveMarginBefore(pos);
+    m_rareData->m_margins.setNegativeMarginBefore(neg);
 }
 
 void RenderBlock::setMaxMarginAfterValues(int pos, int neg)
 {
     if (!m_rareData) {
-        if (pos == RenderBlockRareData::afterPosDefault(this) && neg == RenderBlockRareData::afterNegDefault(this))
+        if (pos == RenderBlockRareData::positiveMarginAfterDefault(this) && neg == RenderBlockRareData::negativeMarginAfterDefault(this))
             return;
         m_rareData = new RenderBlockRareData(this);
     }
-    m_rareData->m_afterPos = pos;
-    m_rareData->m_afterNeg = neg;
+    m_rareData->m_margins.setPositiveMarginAfter(pos);
+    m_rareData->m_margins.setNegativeMarginAfter(neg);
 }
 
 void RenderBlock::setPaginationStrut(int strut)
@@ -5745,7 +5889,7 @@ IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int*
     // constructed and this kludge is not called any more. So only the caret size
     // of an empty :first-line'd block is wrong. I think we can live with that.
     RenderStyle* currentStyle = firstLineStyle();
-    int height = lineHeight(true);
+    int height = lineHeight(true, currentStyle->isHorizontalWritingMode() ? HorizontalLine : VerticalLine);
 
     enum CaretAlignment { alignLeft, alignRight, alignCenter };
 
@@ -5754,7 +5898,7 @@ IntRect RenderBlock::localCaretRect(InlineBox* inlineBox, int caretOffset, int*
     switch (currentStyle->textAlign()) {
         case TAAUTO:
         case JUSTIFY:
-            if (currentStyle->direction() == RTL)
+            if (!currentStyle->isLeftToRightDirection())
                 alignment = alignRight;
             break;
         case LEFT:
@@ -6020,7 +6164,213 @@ void RenderBlock::adjustLinePositionForPagination(RootInlineBox* lineBox, int& d
         }
     }  
 }
- 
+
+int RenderBlock::collapsedMarginBeforeForChild(RenderBox* child) const
+{
+    // If the child has the same directionality as we do, then we can just return its
+    // collapsed margin.
+    if (!child->isWritingModeRoot())
+        return child->collapsedMarginBefore();
+    
+    // The child has a different directionality.  If the child is parallel, then it's just
+    // flipped relative to us.  We can use the collapsed margin for the opposite edge.
+    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+        return child->collapsedMarginAfter();
+    
+    // The child is perpendicular to us, which means its margins don't collapse but are on the
+    // "logical left/right" sides of the child box.  We can just return the raw margin in this case.  
+    return marginBeforeForChild(child);
+}
+
+int RenderBlock::collapsedMarginAfterForChild(RenderBox* child) const
+{
+    // If the child has the same directionality as we do, then we can just return its
+    // collapsed margin.
+    if (!child->isWritingModeRoot())
+        return child->collapsedMarginAfter();
+    
+    // The child has a different directionality.  If the child is parallel, then it's just
+    // flipped relative to us.  We can use the collapsed margin for the opposite edge.
+    if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode())
+        return child->collapsedMarginBefore();
+    
+    // The child is perpendicular to us, which means its margins don't collapse but are on the
+    // "logical left/right" side of the child box.  We can just return the raw margin in this case.  
+    return marginAfterForChild(child);
+}
+
+int RenderBlock::marginBeforeForChild(RenderBoxModelObject* child) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return child->marginTop();
+    case BottomToTopWritingMode:
+        return child->marginBottom();
+    case LeftToRightWritingMode:
+        return child->marginLeft();
+    case RightToLeftWritingMode:
+        return child->marginRight();
+    }
+    ASSERT_NOT_REACHED();
+    return child->marginTop();
+}
+
+int RenderBlock::marginAfterForChild(RenderBoxModelObject* child) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return child->marginBottom();
+    case BottomToTopWritingMode:
+        return child->marginTop();
+    case LeftToRightWritingMode:
+        return child->marginRight();
+    case RightToLeftWritingMode:
+        return child->marginLeft();
+    }
+    ASSERT_NOT_REACHED();
+    return child->marginBottom();
+}
+    
+int RenderBlock::marginStartForChild(RenderBoxModelObject* child) const
+{
+    if (style()->isHorizontalWritingMode())
+        return style()->isLeftToRightDirection() ? child->marginLeft() : child->marginRight();
+    return style()->isLeftToRightDirection() ? child->marginTop() : child->marginBottom();
+}
+
+int RenderBlock::marginEndForChild(RenderBoxModelObject* child) const
+{
+    if (style()->isHorizontalWritingMode())
+        return style()->isLeftToRightDirection() ? child->marginRight() : child->marginLeft();
+    return style()->isLeftToRightDirection() ? child->marginBottom() : child->marginTop();
+}
+
+void RenderBlock::setMarginStartForChild(RenderBox* child, int margin)
+{
+    if (style()->isHorizontalWritingMode()) {
+        if (style()->isLeftToRightDirection())
+            child->setMarginLeft(margin);
+        else
+            child->setMarginRight(margin);
+    } else {
+        if (style()->isLeftToRightDirection())
+            child->setMarginTop(margin);
+        else
+            child->setMarginBottom(margin);
+    }
+}
+
+void RenderBlock::setMarginEndForChild(RenderBox* child, int margin)
+{
+    if (style()->isHorizontalWritingMode()) {
+        if (style()->isLeftToRightDirection())
+            child->setMarginRight(margin);
+        else
+            child->setMarginLeft(margin);
+    } else {
+        if (style()->isLeftToRightDirection())
+            child->setMarginBottom(margin);
+        else
+            child->setMarginTop(margin);
+    }
+}
+
+void RenderBlock::setMarginBeforeForChild(RenderBox* child, int margin)
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        child->setMarginTop(margin);
+        break;
+    case BottomToTopWritingMode:
+        child->setMarginBottom(margin);
+        break;
+    case LeftToRightWritingMode:
+        child->setMarginLeft(margin);
+        break;
+    case RightToLeftWritingMode:
+        child->setMarginRight(margin);
+        break;
+    }
+}
+
+void RenderBlock::setMarginAfterForChild(RenderBox* child, int margin)
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        child->setMarginBottom(margin);
+        break;
+    case BottomToTopWritingMode:
+        child->setMarginTop(margin);
+        break;
+    case LeftToRightWritingMode:
+        child->setMarginRight(margin);
+        break;
+    case RightToLeftWritingMode:
+        child->setMarginLeft(margin);
+        break;
+    }
+}
+
+RenderBlock::MarginValues RenderBlock::marginValuesForChild(RenderBox* child)
+{
+    int childBeforePositive = 0;
+    int childBeforeNegative = 0;
+    int childAfterPositive = 0;
+    int childAfterNegative = 0;
+
+    int beforeMargin = 0;
+    int afterMargin = 0;
+
+    RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
+    
+    // If the child has the same directionality as we do, then we can just return its
+    // margins in the same direction.
+    if (!child->isWritingModeRoot()) {
+        if (childRenderBlock) {
+            childBeforePositive = childRenderBlock->maxPositiveMarginBefore();
+            childBeforeNegative = childRenderBlock->maxNegativeMarginBefore();
+            childAfterPositive = childRenderBlock->maxPositiveMarginAfter();
+            childAfterNegative = childRenderBlock->maxNegativeMarginAfter();
+        } else {
+            beforeMargin = child->marginBefore();
+            afterMargin = child->marginAfter();
+        }
+    } else if (child->style()->isHorizontalWritingMode() == style()->isHorizontalWritingMode()) {
+        // The child has a different directionality.  If the child is parallel, then it's just
+        // flipped relative to us.  We can use the margins for the opposite edges.
+        if (childRenderBlock) {
+            childBeforePositive = childRenderBlock->maxPositiveMarginAfter();
+            childBeforeNegative = childRenderBlock->maxNegativeMarginAfter();
+            childAfterPositive = childRenderBlock->maxPositiveMarginBefore();
+            childAfterNegative = childRenderBlock->maxNegativeMarginBefore();
+        } else {
+            beforeMargin = child->marginAfter();
+            afterMargin = child->marginBefore();
+        }
+    } else {
+        // The child is perpendicular to us, which means its margins don't collapse but are on the
+        // "logical left/right" sides of the child box.  We can just return the raw margin in this case.
+        beforeMargin = marginBeforeForChild(child);
+        afterMargin = marginAfterForChild(child);
+    }
+
+    // Resolve uncollapsing margins into their positive/negative buckets.
+    if (beforeMargin) {
+        if (beforeMargin > 0)
+            childBeforePositive = beforeMargin;
+        else
+            childBeforeNegative = -beforeMargin;
+    }
+    if (afterMargin) {
+        if (afterMargin > 0)
+            childAfterPositive = afterMargin;
+        else
+            childAfterNegative = -afterMargin;
+    }
+
+    return MarginValues(childBeforePositive, childBeforeNegative, childAfterPositive, childAfterNegative);
+}
+
 const char* RenderBlock::renderName() const
 {
     if (isBody())
diff --git a/WebCore/rendering/RenderBlock.h b/WebCore/rendering/RenderBlock.h
index 0682039..66c8659 100644
--- a/WebCore/rendering/RenderBlock.h
+++ b/WebCore/rendering/RenderBlock.h
@@ -57,8 +57,8 @@ public:
     virtual void destroy();
 
     // These two functions are overridden for inline-block.
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     RenderLineBoxList* lineBoxes() { return &m_lineBoxes; }
     const RenderLineBoxList* lineBoxes() const { return &m_lineBoxes; }
@@ -90,14 +90,7 @@ public:
 
     void markAllDescendantsWithFloatsForLayout(RenderBox* floatToRemove = 0, bool inLayout = true);
     void markPositionedObjectsForLayout();
-    void markForPaginationRelayout()
-    { 
-        if (isTable())
-            markDescendantBlocksAndLinesForLayout();
-        else
-            setChildNeedsLayout(true, false);
-    }
-    virtual void markDescendantBlocksAndLinesForLayout(bool inLayout = true);
+    virtual void markForPaginationRelayoutIfNeeded();
     
     bool containsFloats() { return m_floatingObjects && !m_floatingObjects->isEmpty(); }
     bool containsFloat(RenderObject*);
@@ -105,10 +98,11 @@ public:
     int availableLogicalWidthForLine(int position, bool firstLine) const;
     int logicalRightOffsetForLine(int position, bool firstLine) const { return logicalRightOffsetForLine(position, logicalRightOffsetForContent(), firstLine); }
     int logicalLeftOffsetForLine(int position, bool firstLine) const { return logicalLeftOffsetForLine(position, logicalLeftOffsetForContent(), firstLine); }
-    
-    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+
+    virtual int topmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
     
     virtual VisiblePosition positionForPoint(const IntPoint&);
     
@@ -169,6 +163,51 @@ public:
     void setPaginationStrut(int strut);
     void setPageY(int y);
 
+    // Accessors for logical width/height and margins in the containing block's block-flow direction.
+    enum ApplyLayoutDeltaMode { ApplyLayoutDelta, DoNotApplyLayoutDelta };
+    int logicalWidthForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
+    int logicalHeightForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->height() : child->width(); }
+    int logicalTopForChild(RenderBox* child) { return style()->isHorizontalWritingMode() ? child->y() : child->x(); }
+    void setLogicalLeftForChild(RenderBox* child, int logicalLeft, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
+    void setLogicalTopForChild(RenderBox* child, int logicalTop, ApplyLayoutDeltaMode = DoNotApplyLayoutDelta);
+    int marginBeforeForChild(RenderBoxModelObject* child) const;
+    int marginAfterForChild(RenderBoxModelObject* child) const;
+    int marginStartForChild(RenderBoxModelObject* child) const;
+    int marginEndForChild(RenderBoxModelObject* child) const;
+    void setMarginStartForChild(RenderBox* child, int);
+    void setMarginEndForChild(RenderBox* child, int);
+    void setMarginBeforeForChild(RenderBox* child, int);
+    void setMarginAfterForChild(RenderBox* child, int);
+    int collapsedMarginBeforeForChild(RenderBox* child) const;
+    int collapsedMarginAfterForChild(RenderBox* child) const;
+
+    class MarginValues {
+    public:
+        MarginValues(int beforePos, int beforeNeg, int afterPos, int afterNeg)
+            : m_positiveMarginBefore(beforePos)
+            , m_negativeMarginBefore(beforeNeg)
+            , m_positiveMarginAfter(afterPos)
+            , m_negativeMarginAfter(afterNeg)
+        { }
+        
+        int positiveMarginBefore() const { return m_positiveMarginBefore; }
+        int negativeMarginBefore() const { return m_negativeMarginBefore; }
+        int positiveMarginAfter() const { return m_positiveMarginAfter; }
+        int negativeMarginAfter() const { return m_negativeMarginAfter; }
+        
+        void setPositiveMarginBefore(int pos) { m_positiveMarginBefore = pos; }
+        void setNegativeMarginBefore(int neg) { m_negativeMarginBefore = neg; }
+        void setPositiveMarginAfter(int pos) { m_positiveMarginAfter = pos; }
+        void setNegativeMarginAfter(int neg) { m_negativeMarginAfter = neg; }
+    
+    private:
+        int m_positiveMarginBefore;
+        int m_negativeMarginBefore;
+        int m_positiveMarginAfter;
+        int m_negativeMarginAfter;
+    };
+    MarginValues marginValuesForChild(RenderBox* child);
+
 protected:
     // These functions are only used internally to manipulate the render tree structure via remove/insert/appendChildNode.
     // Since they are typically called only to move objects around within anonymous blocks (which only have layers in
@@ -194,10 +233,10 @@ protected:
     }
     void moveChildrenTo(RenderBlock* to, RenderObject* startChild, RenderObject* endChild, RenderObject* beforeChild, bool fullRemoveInsert = false);
     
-    int maxPosMarginBefore() const { return m_rareData ? m_rareData->m_beforePos : RenderBlockRareData::beforePosDefault(this); }
-    int maxNegMarginBefore() const { return m_rareData ? m_rareData->m_beforeNeg : RenderBlockRareData::beforeNegDefault(this); }
-    int maxPosMarginAfter() const { return m_rareData ? m_rareData->m_afterPos : RenderBlockRareData::afterPosDefault(this); }
-    int maxNegMarginAfter() const { return m_rareData ? m_rareData->m_afterNeg : RenderBlockRareData::afterNegDefault(this); }
+    int maxPositiveMarginBefore() const { return m_rareData ? m_rareData->m_margins.positiveMarginBefore() : RenderBlockRareData::positiveMarginBeforeDefault(this); }
+    int maxNegativeMarginBefore() const { return m_rareData ? m_rareData->m_margins.negativeMarginBefore() : RenderBlockRareData::negativeMarginBeforeDefault(this); }
+    int maxPositiveMarginAfter() const { return m_rareData ? m_rareData->m_margins.positiveMarginAfter() : RenderBlockRareData::positiveMarginAfterDefault(this); }
+    int maxNegativeMarginAfter() const { return m_rareData ? m_rareData->m_margins.negativeMarginAfter() : RenderBlockRareData::negativeMarginAfterDefault(this); }
     
     void setMaxMarginBeforeValues(int pos, int neg);
     void setMaxMarginAfterValues(int pos, int neg);
@@ -205,10 +244,8 @@ protected:
     void initMaxMarginValues()
     {
         if (m_rareData) {
-            m_rareData->m_beforePos = RenderBlockRareData::beforePosDefault(this);
-            m_rareData->m_beforeNeg = RenderBlockRareData::beforeNegDefault(this);
-            m_rareData->m_afterPos = RenderBlockRareData::afterPosDefault(this);
-            m_rareData->m_afterNeg = RenderBlockRareData::afterNegDefault(this);
+            m_rareData->m_margins = MarginValues(RenderBlockRareData::positiveMarginBeforeDefault(this) , RenderBlockRareData::negativeMarginBeforeDefault(this),
+                                                 RenderBlockRareData::positiveMarginAfterDefault(this), RenderBlockRareData::negativeMarginAfterDefault(this));
             m_rareData->m_paginationStrut = 0;
         }
     }
@@ -220,8 +257,8 @@ protected:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintObject(PaintInfo&, int tx, int ty);
 
-    int logicalRightOffsetForContent() const;
-    int logicalLeftOffsetForContent() const;
+    int logicalRightOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() + availableLogicalWidth() : borderTop() + paddingTop() + availableLogicalWidth(); }
+    int logicalLeftOffsetForContent() const { return style()->isHorizontalWritingMode() ? borderLeft() + paddingLeft() : borderTop() + paddingTop(); }
     int logicalRightOffsetForLine(int position, int fixedOffset, bool applyTextIndent = true, int* logicalHeightRemaining = 0) const;
     int logicalLeftOffsetForLine(int position, int fixedOffset, bool applyTextIndent = true, int* logicalHeightRemaining = 0) const;
 
@@ -256,9 +293,9 @@ protected:
     // Only used by RenderSVGText, which explicitely overrides RenderBlock::layoutBlock(), do NOT use for anything else.
     void forceLayoutInlineChildren()
     {
-        int repaintTop = 0;
-        int repaintBottom = 0;
-        layoutInlineChildren(true, repaintTop, repaintBottom);
+        int repaintLogicalTop = 0;
+        int repaintLogicalBottom = 0;
+        layoutInlineChildren(true, repaintLogicalTop, repaintLogicalBottom);
     }
 #endif
 
@@ -284,19 +321,13 @@ private:
     
     virtual bool isSelfCollapsingBlock() const;
 
-    virtual int maxMarginBefore(MarginSign sign) const
-    { 
-        return (sign == PositiveMargin) ? maxPosMarginBefore() : maxNegMarginBefore();
-    }
-    virtual int maxMarginAfter(MarginSign sign) const
-    {
-        return (sign == PositiveMargin) ? maxPosMarginAfter() : maxNegMarginAfter();
-    }
+    virtual int collapsedMarginBefore() const { return maxPositiveMarginBefore() - maxNegativeMarginBefore(); }
+    virtual int collapsedMarginAfter() const { return maxPositiveMarginAfter() - maxNegativeMarginAfter(); }
 
     virtual void repaintOverhangingFloats(bool paintAllDescendants);
 
-    void layoutBlockChildren(bool relayoutChildren, int& maxFloatBottom);
-    void layoutInlineChildren(bool relayoutChildren, int& repaintTop, int& repaintBottom);
+    void layoutBlockChildren(bool relayoutChildren, int& maxFloatLogicalBottom);
+    void layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom);
 
     virtual void positionListMarker() { }
 
@@ -323,37 +354,94 @@ private:
     };
 
     struct FloatingObject : Noncopyable {
-        enum Type {
-            FloatLeft,
-            FloatRight
-        };
+        // Note that Type uses bits so you can use FloatBoth as a mask to query for both left and right.
+        enum Type { FloatLeft = 1, FloatRight = 2, FloatBoth = 3 };
 
         FloatingObject(Type type)
             : m_renderer(0)
-            , m_top(0)
-            , m_bottom(0)
-            , m_left(0)
-            , m_width(0)
             , m_paginationStrut(0)
             , m_type(type)
             , m_shouldPaint(true)
             , m_isDescendant(false)
+            , m_isPlaced(false)
         {
         }
 
-        Type type() { return static_cast<Type>(m_type); }
+        FloatingObject(Type type, const IntRect& frameRect)
+            : m_renderer(0)
+            , m_frameRect(frameRect)
+            , m_paginationStrut(0)
+            , m_type(type)
+            , m_shouldPaint(true)
+            , m_isDescendant(false)
+            , m_isPlaced(true)
+        {
+        }
+
+        Type type() const { return static_cast<Type>(m_type); }
+        RenderBox* renderer() const { return m_renderer; }
+        
+        bool isPlaced() const { return m_isPlaced; }
+        void setIsPlaced(bool placed = true) { m_isPlaced = placed; }
+
+        int left() const { ASSERT(isPlaced()); return m_frameRect.x(); }
+        int right() const { ASSERT(isPlaced()); return m_frameRect.right(); }
+        int top() const { ASSERT(isPlaced()); return m_frameRect.y(); }
+        int bottom() const { ASSERT(isPlaced()); return m_frameRect.bottom(); }
+        int width() const { return m_frameRect.width(); }
+        int height() const { return m_frameRect.height(); }
+    
+        void setLeft(int left) { m_frameRect.setX(left); }
+        void setTop(int top) { m_frameRect.setY(top); }
+        void setWidth(int width) { m_frameRect.setWidth(width); }
+        void setHeight(int height) { m_frameRect.setHeight(height); }
+
+        const IntRect& frameRect() const { ASSERT(isPlaced()); return m_frameRect; }
+        void setFrameRect(const IntRect& frameRect) { m_frameRect = frameRect; }
 
         RenderBox* m_renderer;
-        int m_top;
-        int m_bottom;
-        int m_left;
-        int m_width;
+        IntRect m_frameRect;
         int m_paginationStrut;
-        unsigned m_type : 1; // Type (left or right aligned)
+        unsigned m_type : 2; // Type (left or right aligned)
         bool m_shouldPaint : 1;
         bool m_isDescendant : 1;
+        bool m_isPlaced : 1;
     };
 
+    int logicalTopForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->top() : child->left(); }
+    int logicalBottomForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->bottom() : child->right(); }
+    int logicalLeftForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->left() : child->top(); }
+    int logicalRightForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->right() : child->bottom(); }
+    int logicalWidthForFloat(FloatingObject* child) const { return style()->isHorizontalWritingMode() ? child->width() : child->height(); }
+    void setLogicalTopForFloat(FloatingObject* child, int logicalTop)
+    {
+        if (style()->isHorizontalWritingMode())
+            child->setTop(logicalTop);
+        else
+            child->setLeft(logicalTop);
+    }
+    void setLogicalLeftForFloat(FloatingObject* child, int logicalLeft)
+    {
+        if (style()->isHorizontalWritingMode())
+            child->setLeft(logicalLeft);
+        else
+            child->setTop(logicalLeft);
+    }
+    void setLogicalHeightForFloat(FloatingObject* child, int logicalHeight)
+    {
+        if (style()->isHorizontalWritingMode())
+            child->setHeight(logicalHeight);
+        else
+            child->setWidth(logicalHeight);
+    }
+    void setLogicalWidthForFloat(FloatingObject* child, int logicalWidth)
+    {
+        if (style()->isHorizontalWritingMode())
+            child->setWidth(logicalWidth);
+        else
+            child->setHeight(logicalWidth);
+    }
+
     // The following functions' implementations are in RenderBlockLineLayout.cpp.
     RootInlineBox* determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly,
                                           InlineBidiResolver&, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
@@ -375,6 +463,10 @@ private:
     void deleteEllipsisLineBoxes();
     void checkLinesForTextOverflow();
     void addOverflowFromInlineChildren();
+    int beforeSideVisibleOverflowForLine(RootInlineBox*) const;
+    int afterSideVisibleOverflowForLine(RootInlineBox*) const;
+    int beforeSideLayoutOverflowForLine(RootInlineBox*) const;
+    int afterSideLayoutOverflowForLine(RootInlineBox*) const;
     // End of functions defined in RenderBlockLineLayout.cpp.
 
     void addOverflowFromBlockChildren();
@@ -406,15 +498,13 @@ private:
 
     virtual bool avoidsFloats() const;
 
-    bool hasOverhangingFloats() { return parent() && !hasColumns() && floatBottom() > height(); }
+    bool hasOverhangingFloats() { return parent() && !hasColumns() && lowestFloatLogicalBottom() > logicalHeight(); }
     void addIntrudingFloats(RenderBlock* prev, int xoffset, int yoffset);
     int addOverhangingFloats(RenderBlock* child, int xoffset, int yoffset, bool makeChildPaintOtherFloats);
 
-    int nextFloatBottomBelow(int) const;
-    int floatBottom() const;
-    inline int leftBottom();
-    inline int rightBottom();
-
+    int lowestFloatLogicalBottom(FloatingObject::Type = FloatingObject::FloatBoth) const;
+    int nextFloatLogicalBottomBelow(int) const;
+    
     virtual bool hitTestColumns(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool hitTestContents(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     bool hitTestFloats(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty);
@@ -468,7 +558,7 @@ private:
     void adjustPointToColumnContents(IntPoint&) const;
     void adjustForBorderFit(int x, int& left, int& right) const; // Helper function for borderFitAdjust
 
-    void markLinesDirtyInVerticalRange(int top, int bottom, RootInlineBox* highest = 0);
+    void markLinesDirtyInBlockRange(int logicalTop, int logicalBottom, RootInlineBox* highest = 0);
 
     void newLine(EClear);
 
@@ -524,24 +614,24 @@ private:
         bool m_determinedMarginBeforeQuirk : 1;
 
         // These flags track the previous maximal positive and negative margins.
-        int m_posMargin;
-        int m_negMargin;
+        int m_positiveMargin;
+        int m_negativeMargin;
 
     public:
         MarginInfo(RenderBlock* b, int beforeBorderPadding, int afterBorderPadding);
 
         void setAtBeforeSideOfBlock(bool b) { m_atBeforeSideOfBlock = b; }
         void setAtAfterSideOfBlock(bool b) { m_atAfterSideOfBlock = b; }
-        void clearMargin() { m_posMargin = m_negMargin = 0; }
+        void clearMargin() { m_positiveMargin = m_negativeMargin = 0; }
         void setMarginBeforeQuirk(bool b) { m_marginBeforeQuirk = b; }
         void setMarginAfterQuirk(bool b) { m_marginAfterQuirk = b; }
         void setDeterminedMarginBeforeQuirk(bool b) { m_determinedMarginBeforeQuirk = b; }
-        void setPosMargin(int p) { m_posMargin = p; }
-        void setNegMargin(int n) { m_negMargin = n; }
-        void setPosMarginIfLarger(int p) { if (p > m_posMargin) m_posMargin = p; }
-        void setNegMarginIfLarger(int n) { if (n > m_negMargin) m_negMargin = n; }
+        void setPositiveMargin(int p) { m_positiveMargin = p; }
+        void setNegativeMargin(int n) { m_negativeMargin = n; }
+        void setPositiveMarginIfLarger(int p) { if (p > m_positiveMargin) m_positiveMargin = p; }
+        void setNegativeMarginIfLarger(int n) { if (n > m_negativeMargin) m_negativeMargin = n; }
 
-        void setMargin(int p, int n) { m_posMargin = p; m_negMargin = n; }
+        void setMargin(int p, int n) { m_positiveMargin = p; m_negativeMargin = n; }
 
         bool atBeforeSideOfBlock() const { return m_atBeforeSideOfBlock; }
         bool canCollapseWithMarginBefore() const { return m_atBeforeSideOfBlock && m_canCollapseMarginBeforeWithChildren; }
@@ -552,12 +642,12 @@ private:
         bool determinedMarginBeforeQuirk() const { return m_determinedMarginBeforeQuirk; }
         bool marginBeforeQuirk() const { return m_marginBeforeQuirk; }
         bool marginAfterQuirk() const { return m_marginAfterQuirk; }
-        int posMargin() const { return m_posMargin; }
-        int negMargin() const { return m_negMargin; }
-        int margin() const { return m_posMargin - m_negMargin; }
+        int positiveMargin() const { return m_positiveMargin; }
+        int negativeMargin() const { return m_negativeMargin; }
+        int margin() const { return m_positiveMargin - m_negativeMargin; }
     };
 
-    void layoutBlockChild(RenderBox* child, MarginInfo&, int& previousFloatBottom, int& maxFloatBottom);
+    void layoutBlockChild(RenderBox* child, MarginInfo&, int& previousFloatLogicalBottom, int& maxFloatLogicalBottom);
     void adjustPositionedBlock(RenderBox* child, const MarginInfo&);
     void adjustFloatingBlock(const MarginInfo&);
     bool handleSpecialChild(RenderBox* child, const MarginInfo&);
@@ -566,9 +656,9 @@ private:
     bool handleRunInChild(RenderBox* child);
     int collapseMargins(RenderBox* child, MarginInfo&);
     int clearFloatsIfNeeded(RenderBox* child, MarginInfo&, int oldTopPosMargin, int oldTopNegMargin, int yPos);
-    int estimateVerticalPosition(RenderBox* child, const MarginInfo&);
-    void determineHorizontalPosition(RenderBox* child);
-    void handleBottomOfBlock(int top, int bottom, MarginInfo&);
+    int estimateLogicalTopPosition(RenderBox* child, const MarginInfo&);
+    void determineLogicalLeftPositionForChild(RenderBox* child);
+    void handleAfterSideOfBlock(int top, int bottom, MarginInfo&);
     void setCollapsedBottomMargin(const MarginInfo&);
     // End helper functions and structs used by layoutBlockChildren.
 
@@ -589,41 +679,35 @@ private:
     // split into a sequence of inlines and blocks.  The continuation will either be
     // an anonymous block (that houses other blocks) or it will be an inline flow.
     RenderBoxModelObject* m_continuation;
-
+    
     // Allocated only when some of these fields have non-default values
     struct RenderBlockRareData : Noncopyable {
         RenderBlockRareData(const RenderBlock* block) 
-            : m_beforePos(beforePosDefault(block))
-            , m_beforeNeg(beforeNegDefault(block))
-            , m_afterPos(afterPosDefault(block))
-            , m_afterNeg(afterNegDefault(block))
+            : m_margins(positiveMarginBeforeDefault(block), negativeMarginBeforeDefault(block), positiveMarginAfterDefault(block), negativeMarginAfterDefault(block))
             , m_paginationStrut(0)
             , m_pageY(0)
         { 
         }
 
-        static int beforePosDefault(const RenderBlock* block)
+        static int positiveMarginBeforeDefault(const RenderBlock* block)
         { 
             return std::max(block->marginBefore(), 0);
         }
         
-        static int beforeNegDefault(const RenderBlock* block)
+        static int negativeMarginBeforeDefault(const RenderBlock* block)
         { 
             return std::max(-block->marginBefore(), 0);
         }
-        static int afterPosDefault(const RenderBlock* block)
+        static int positiveMarginAfterDefault(const RenderBlock* block)
         {
             return std::max(block->marginAfter(), 0);
         }
-        static int afterNegDefault(const RenderBlock* block)
+        static int negativeMarginAfterDefault(const RenderBlock* block)
         {
             return std::max(-block->marginAfter(), 0);
         }
         
-        int m_beforePos;
-        int m_beforeNeg;
-        int m_afterPos;
-        int m_afterNeg;
+        MarginValues m_margins;
         int m_paginationStrut;
         int m_pageY;
      };
diff --git a/WebCore/rendering/RenderBlockLineLayout.cpp b/WebCore/rendering/RenderBlockLineLayout.cpp
index 1df4bbc..ce84d31 100644
--- a/WebCore/rendering/RenderBlockLineLayout.cpp
+++ b/WebCore/rendering/RenderBlockLineLayout.cpp
@@ -64,13 +64,12 @@ const unsigned cMaxLineDepth = 200;
 
 static int getBorderPaddingMargin(RenderBoxModelObject* child, bool endOfInline)
 {
-    bool leftSide = (child->style()->direction() == LTR) ? !endOfInline : endOfInline;
-    if (leftSide)
-        return child->marginLeft() + child->paddingLeft() + child->borderLeft();
-    return child->marginRight() + child->paddingRight() + child->borderRight();
+    if (endOfInline)
+        return child->marginEnd() + child->paddingEnd() + child->borderEnd();
+    return child->marginStart() + child->paddingStart() + child->borderStart();
 }
 
-static int inlineWidth(RenderObject* child, bool start = true, bool end = true)
+static int inlineLogicalWidth(RenderObject* child, bool start = true, bool end = true)
 {
     unsigned lineDepth = 1;
     int extraWidth = 0;
@@ -246,12 +245,13 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
 {
     ASSERT(firstRun);
 
+    bool rootHasSelectedChildren = false;
     InlineFlowBox* parentBox = 0;
     for (BidiRun* r = firstRun; r; r = r->next()) {
         // Create a box for our object.
         bool isOnlyRun = (runCount == 1);
         if (runCount == 2 && !r->m_object->isListMarker())
-            isOnlyRun = ((style()->direction() == RTL) ? lastRun : firstRun)->m_object->isListMarker();
+            isOnlyRun = (!style()->isLeftToRightDirection() ? lastRun : firstRun)->m_object->isListMarker();
 
         InlineBox* box = createInlineBoxForRenderer(r->m_object, false, isOnlyRun);
         r->m_box = box;
@@ -260,6 +260,9 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
         if (!box)
             continue;
 
+        if (!rootHasSelectedChildren && box->renderer()->selectionState() != RenderObject::SelectionNone)
+            rootHasSelectedChildren = true;
+
         // If we have no parent box yet, or if the run is not simply a sibling,
         // then we need to construct inline boxes as necessary to properly enclose the
         // run's inline box.
@@ -287,6 +290,11 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
     // be the last continuation of our line list.
     ASSERT(lastLineBox() && !lastLineBox()->isConstructed());
 
+    // Set the m_selectedChildren flag on the root inline box if one of the leaf inline box
+    // from the bidi runs walk above has a selection state.
+    if (rootHasSelectedChildren)
+        lastLineBox()->root()->setHasSelectedChildren(true);
+
     // Set bits on our inline flow boxes that indicate which sides should
     // paint borders/margins/padding.  This knowledge will ultimately be used when
     // we determine the horizontal positions and widths of all the inline boxes on
@@ -302,9 +310,9 @@ RootInlineBox* RenderBlock::constructLine(unsigned runCount, BidiRun* firstRun,
 
 void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox, bool firstLine, BidiRun* firstRun, BidiRun* trailingSpaceRun, bool reachedEnd, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
 {
-    // First determine our total width.
-    int availableWidth = availableLogicalWidthForLine(height(), firstLine);
-    int totWidth = lineBox->getFlowSpacingLogicalWidth();
+    // First determine our total logical width.
+    int availableLogicalWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
+    int totalLogicalWidth = lineBox->getFlowSpacingLogicalWidth();
     bool needsWordSpacing = false;
     unsigned numSpaces = 0;
     ETextAlign textAlign = style()->textAlign();
@@ -328,7 +336,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
 
             if (int length = rt->textLength()) {
                 if (!r->m_start && needsWordSpacing && isSpaceOrNewline(rt->characters()[r->m_start]))
-                    totWidth += rt->style(firstLine)->font().wordSpacing();
+                    totalLogicalWidth += rt->style(firstLine)->font().wordSpacing();
                 needsWordSpacing = !isSpaceOrNewline(rt->characters()[r->m_stop - 1]) && r->m_stop == length;          
             }
             HashSet<const SimpleFontData*> fallbackFonts;
@@ -338,7 +346,7 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
                 const AtomicString& hyphenString = rt->style()->hyphenString();
                 hyphenWidth = rt->style(firstLine)->font().width(TextRun(hyphenString.characters(), hyphenString.length()));
             }
-            r->m_box->setLogicalWidth(rt->width(r->m_start, r->m_stop - r->m_start, totWidth, firstLine, &fallbackFonts, &glyphOverflow) + hyphenWidth);
+            r->m_box->setLogicalWidth(rt->width(r->m_start, r->m_stop - r->m_start, totalLogicalWidth, firstLine, &fallbackFonts, &glyphOverflow) + hyphenWidth);
             if (!fallbackFonts.isEmpty()) {
                 ASSERT(r->m_box->isText());
                 GlyphOverflowAndFallbackFontsMap::iterator it = textBoxDataMap.add(static_cast<InlineTextBox*>(r->m_box), make_pair(Vector<const SimpleFontData*>(), GlyphOverflow())).first;
@@ -353,37 +361,37 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
         } else if (!r->m_object->isRenderInline()) {
             RenderBox* renderBox = toRenderBox(r->m_object);
             renderBox->computeLogicalWidth();
-            r->m_box->setLogicalWidth(renderBox->width());
-            totWidth += renderBox->marginLeft() + renderBox->marginRight();
+            r->m_box->setLogicalWidth(logicalWidthForChild(renderBox));
+            totalLogicalWidth += marginStartForChild(renderBox) + marginEndForChild(renderBox);
         }
 
-        totWidth += r->m_box->logicalWidth();
+        totalLogicalWidth += r->m_box->logicalWidth();
     }
 
     // Armed with the total width of the line (without justification),
     // we now examine our text-align property in order to determine where to position the
     // objects horizontally.  The total width of the line can be increased if we end up
     // justifying text.
-    int x = logicalLeftOffsetForLine(height(), firstLine);
+    int logicalLeft = logicalLeftOffsetForLine(logicalHeight(), firstLine);
     switch (textAlign) {
         case LEFT:
         case WEBKIT_LEFT:
             // The direction of the block should determine what happens with wide lines.  In
             // particular with RTL blocks, wide lines should still spill out to the left.
-            if (style()->direction() == LTR) {
-                if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totWidth + availableWidth));
+            if (style()->isLeftToRightDirection()) {
+                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
+                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
             } else {
                 if (trailingSpaceRun)
                     trailingSpaceRun->m_box->setLogicalWidth(0);
-                else if (totWidth > availableWidth)
-                    x -= (totWidth - availableWidth);
+                else if (totalLogicalWidth > availableLogicalWidth)
+                    logicalLeft -= (totalLogicalWidth - availableLogicalWidth);
             }
             break;
         case JUSTIFY:
             if (numSpaces && !reachedEnd && !lineBox->endsWithBreak()) {
                 if (trailingSpaceRun) {
-                    totWidth -= trailingSpaceRun->m_box->logicalWidth();
+                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
                     trailingSpaceRun->m_box->setLogicalWidth(0);
                 }
                 break;
@@ -392,9 +400,9 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
         case TAAUTO:
             numSpaces = 0;
             // for right to left fall through to right aligned
-            if (style()->direction() == LTR) {
-                if (totWidth > availableWidth && trailingSpaceRun)
-                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totWidth + availableWidth));
+            if (style()->isLeftToRightDirection()) {
+                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun)
+                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
                 break;
             }
         case RIGHT:
@@ -402,33 +410,33 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
             // Wide lines spill out of the block based off direction.
             // So even if text-align is right, if direction is LTR, wide lines should overflow out of the right
             // side of the block.
-            if (style()->direction() == LTR) {
+            if (style()->isLeftToRightDirection()) {
                 if (trailingSpaceRun) {
-                    totWidth -= trailingSpaceRun->m_box->logicalWidth();
+                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
                     trailingSpaceRun->m_box->setLogicalWidth(0);
                 }
-                if (totWidth < availableWidth)
-                    x += availableWidth - totWidth;
+                if (totalLogicalWidth < availableLogicalWidth)
+                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
             } else {
-                if (totWidth > availableWidth && trailingSpaceRun) {
-                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totWidth + availableWidth));
-                    totWidth -= trailingSpaceRun->m_box->logicalWidth();
+                if (totalLogicalWidth > availableLogicalWidth && trailingSpaceRun) {
+                    trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceRun->m_box->logicalWidth() - totalLogicalWidth + availableLogicalWidth));
+                    totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
                 } else
-                    x += availableWidth - totWidth;
+                    logicalLeft += availableLogicalWidth - totalLogicalWidth;
             }
             break;
         case CENTER:
         case WEBKIT_CENTER:
             int trailingSpaceWidth = 0;
             if (trailingSpaceRun) {
-                totWidth -= trailingSpaceRun->m_box->logicalWidth();
-                trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableWidth - totWidth + 1) / 2);
+                totalLogicalWidth -= trailingSpaceRun->m_box->logicalWidth();
+                trailingSpaceWidth = min(trailingSpaceRun->m_box->logicalWidth(), (availableLogicalWidth - totalLogicalWidth + 1) / 2);
                 trailingSpaceRun->m_box->setLogicalWidth(max(0, trailingSpaceWidth));
             }
-            if (style()->direction() == LTR)
-                x += max((availableWidth - totWidth) / 2, 0);
+            if (style()->isLeftToRightDirection())
+                logicalLeft += max((availableLogicalWidth - totalLogicalWidth) / 2, 0);
             else
-                x += totWidth > availableWidth ? (availableWidth - totWidth) : (availableWidth - totWidth) / 2 - trailingSpaceWidth;
+                logicalLeft += totalLogicalWidth > availableLogicalWidth ? (availableLogicalWidth - totalLogicalWidth) : (availableLogicalWidth - totalLogicalWidth) / 2 - trailingSpaceWidth;
             break;
     }
 
@@ -451,9 +459,9 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
 
                 // Only justify text if whitespace is collapsed.
                 if (r->m_object->style()->collapseWhiteSpace()) {
-                    spaceAdd = (availableWidth - totWidth) * spaces / numSpaces;
+                    spaceAdd = (availableLogicalWidth - totalLogicalWidth) * spaces / numSpaces;
                     static_cast<InlineTextBox*>(r->m_box)->setSpaceAdd(spaceAdd);
-                    totWidth += spaceAdd;
+                    totalLogicalWidth += spaceAdd;
                 }
                 numSpaces -= spaces;
                 if (!numSpaces)
@@ -465,13 +473,13 @@ void RenderBlock::computeInlineDirectionPositionsForLine(RootInlineBox* lineBox,
     // The widths of all runs are now known.  We can now place every inline box (and
     // compute accurate widths for the inline flow boxes).
     needsWordSpacing = false;
-    lineBox->placeBoxesInInlineDirection(x, needsWordSpacing, textBoxDataMap);
+    lineBox->placeBoxesInInlineDirection(logicalLeft, needsWordSpacing, textBoxDataMap);
 }
 
 void RenderBlock::computeBlockDirectionPositionsForLine(RootInlineBox* lineBox, BidiRun* firstRun, GlyphOverflowAndFallbackFontsMap& textBoxDataMap)
 {
-    setLogicalHeight(lineBox->alignBoxesInBlockDirection(height(), textBoxDataMap));
-    lineBox->setBlockHeight(height());
+    setLogicalHeight(lineBox->alignBoxesInBlockDirection(logicalHeight(), textBoxDataMap));
+    lineBox->setBlockLogicalHeight(logicalHeight());
 
     // Now make sure we place replaced render objects correctly.
     for (BidiRun* r = firstRun; r; r = r->next()) {
@@ -482,7 +490,7 @@ void RenderBlock::computeBlockDirectionPositionsForLine(RootInlineBox* lineBox,
         // Align positioned boxes with the top of the line box.  This is
         // a reasonable approximation of an appropriate y position.
         if (r->m_object->isPositioned())
-            r->m_box->setY(height());
+            r->m_box->setLogicalTop(logicalHeight());
 
         // Position is used to properly position both replaced elements and
         // to update the static normal flow x/y of positioned elements.
@@ -507,14 +515,13 @@ static inline bool isCollapsibleSpace(UChar character, RenderText* renderer)
     return false;
 }
 
-void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, int& repaintBottom)
+void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintLogicalTop, int& repaintLogicalBottom)
 {
     bool useRepaintBounds = false;
     
     m_overflow.clear();
         
-    setLogicalHeight(borderTop() + paddingTop());
-    int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
+    setLogicalHeight(borderBefore() + paddingBefore());
 
     // Figure out if we should clear out our line boxes.
     // FIXME: Handle resize eventually!
@@ -582,7 +589,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                     o->setChildNeedsLayout(true, false);
                     
                 // If relayoutChildren is set and we have percentage padding, we also need to invalidate the child's pref widths.
-                if (relayoutChildren && (o->style()->paddingLeft().isPercent() || o->style()->paddingRight().isPercent()))
+                if (relayoutChildren && (o->style()->paddingStart().isPercent() || o->style()->paddingEnd().isPercent()))
                     o->setPreferredLogicalWidthsDirty(true, false);
             
                 if (o->isPositioned())
@@ -706,7 +713,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         bool firstLine = true;
         bool previousLineBrokeCleanly = true;
         RootInlineBox* startLine = determineStartPosition(firstLine, fullLayout, previousLineBrokeCleanly, resolver, floats, floatIndex,
-                                                          useRepaintBounds, repaintTop, repaintBottom);
+                                                          useRepaintBounds, repaintLogicalTop, repaintLogicalBottom);
 
         if (fullLayout && hasInlineChild && !selfNeedsLayout()) {
             setNeedsLayout(true, false);  // Mark ourselves as needing a full layout. This way we'll repaint like
@@ -729,21 +736,21 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         // if we determine that we're able to synchronize after handling all our dirty lines.
         InlineIterator cleanLineStart;
         BidiStatus cleanLineBidiStatus;
-        int endLineYPos = 0;
+        int endLineLogicalTop = 0;
         RootInlineBox* endLine = (fullLayout || !startLine) ? 
-                                 0 : determineEndPosition(startLine, cleanLineStart, cleanLineBidiStatus, endLineYPos);
+                                 0 : determineEndPosition(startLine, cleanLineStart, cleanLineBidiStatus, endLineLogicalTop);
 
         if (startLine) {
             if (!useRepaintBounds) {
                 useRepaintBounds = true;
-                repaintTop = height();
-                repaintBottom = height();
+                repaintLogicalTop = logicalHeight();
+                repaintLogicalBottom = logicalHeight();
             }
             RenderArena* arena = renderArena();
             RootInlineBox* box = startLine;
             while (box) {
-                repaintTop = min(repaintTop, box->topVisibleOverflow());
-                repaintBottom = max(repaintBottom, box->bottomVisibleOverflow());
+                repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(box));
+                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(box));
                 RootInlineBox* next = box->nextRootBox();
                 box->deleteLine(arena);
                 box = next;
@@ -777,7 +784,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
         while (!end.atEnd()) {
             // FIXME: Is this check necessary before the first iteration or can it be moved to the end?
-            if (checkForEndLineMatch && (endLineMatched = matchedEndLine(resolver, cleanLineStart, cleanLineBidiStatus, endLine, endLineYPos, repaintBottom, repaintTop)))
+            if (checkForEndLineMatch && (endLineMatched = matchedEndLine(resolver, cleanLineStart, cleanLineBidiStatus, endLine, endLineLogicalTop, repaintLogicalBottom, repaintLogicalTop)))
                 break;
 
             lineMidpointState.reset();
@@ -854,7 +861,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 // inline flow boxes.
 
                 RootInlineBox* lineBox = 0;
-                int oldHeight = height();
+                int oldLogicalHeight = logicalHeight();
                 if (resolver.runCount()) {
                     if (hyphenated)
                         resolver.logicallyLastRun()->m_hasHyphen = true;
@@ -902,30 +909,30 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                 if (lineBox) {
                     lineBox->setLineBreakInfo(end.obj, end.pos, resolver.status());
                     if (useRepaintBounds) {
-                        repaintTop = min(repaintTop, lineBox->topVisibleOverflow());
-                        repaintBottom = max(repaintBottom, lineBox->bottomVisibleOverflow());
+                        repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(lineBox));
+                        repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(lineBox));
                     }
                     
                     if (paginated) {
                         int adjustment = 0;
                         adjustLinePositionForPagination(lineBox, adjustment);
                         if (adjustment) {
-                            int oldLineWidth = availableLogicalWidthForLine(oldHeight, firstLine);
+                            int oldLineWidth = availableLogicalWidthForLine(oldLogicalHeight, firstLine);
                             lineBox->adjustPosition(0, adjustment);
                             if (useRepaintBounds) // This can only be a positive adjustment, so no need to update repaintTop.
-                                repaintBottom = max(repaintBottom, lineBox->bottomVisibleOverflow());
+                                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(lineBox));
                                 
-                            if (availableLogicalWidthForLine(oldHeight + adjustment, firstLine) != oldLineWidth) {
+                            if (availableLogicalWidthForLine(oldLogicalHeight + adjustment, firstLine) != oldLineWidth) {
                                 // We have to delete this line, remove all floats that got added, and let line layout re-run.
                                 lineBox->deleteLine(renderArena());
-                                removeFloatingObjectsBelow(lastFloatFromPreviousLine, oldHeight);
-                                setLogicalHeight(oldHeight + adjustment);
+                                removeFloatingObjectsBelow(lastFloatFromPreviousLine, oldLogicalHeight);
+                                setLogicalHeight(oldLogicalHeight + adjustment);
                                 resolver.setPosition(oldEnd);
                                 end = oldEnd;
                                 continue;
                             }
 
-                            setLogicalHeight(lineBox->blockHeight());
+                            setLogicalHeight(lineBox->blockLogicalHeight());
                         }
                     }
                 }
@@ -945,7 +952,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                     lastRootBox()->floats().append(f->m_renderer);
                     ASSERT(f->m_renderer == floats[floatIndex].object);
                     // If a float's geometry has changed, give up on syncing with clean lines.
-                    if (floats[floatIndex].rect != IntRect(f->m_left, f->m_top, f->m_width, f->m_bottom - f->m_top))
+                    if (floats[floatIndex].rect != f->frameRect())
                         checkForEndLineMatch = false;
                     floatIndex++;
                 }
@@ -959,7 +966,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
         if (endLine) {
             if (endLineMatched) {
                 // Attach all the remaining lines, and then adjust their y-positions as needed.
-                int delta = height() - endLineYPos;
+                int delta = logicalHeight() - endLineLogicalTop;
                 for (RootInlineBox* line = endLine; line; line = line->nextRootBox()) {
                     line->attachLine();
                     if (paginated) {
@@ -967,28 +974,27 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
                         adjustLinePositionForPagination(line, delta);
                     }
                     if (delta) {
-                        repaintTop = min(repaintTop, line->topVisibleOverflow() + min(delta, 0));
-                        repaintBottom = max(repaintBottom, line->bottomVisibleOverflow() + max(delta, 0));
+                        repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(line) + min(delta, 0));
+                        repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(line) + max(delta, 0));
                         line->adjustPosition(0, delta);
                     }
                     if (Vector<RenderBox*>* cleanLineFloats = line->floatsPtr()) {
                         Vector<RenderBox*>::iterator end = cleanLineFloats->end();
                         for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
-                            int floatTop = (*f)->y() - (*f)->marginTop();
                             insertFloatingObject(*f);
-                            setLogicalHeight(floatTop + delta);
+                            setLogicalHeight(logicalTopForChild(*f) - marginBeforeForChild(*f) + delta);
                             positionNewFloats();
                         }
                     }
                 }
-                setLogicalHeight(lastRootBox()->blockHeight());
+                setLogicalHeight(lastRootBox()->blockLogicalHeight());
             } else {
                 // Delete all the remaining lines.
                 RootInlineBox* line = endLine;
                 RenderArena* arena = renderArena();
                 while (line) {
-                    repaintTop = min(repaintTop, line->topVisibleOverflow());
-                    repaintBottom = max(repaintBottom, line->bottomVisibleOverflow());
+                    repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(line));
+                    repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(line));
                     RootInlineBox* next = line->nextRootBox();
                     line->deleteLine(arena);
                     line = next;
@@ -1000,15 +1006,15 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
             // This has to be done before adding in the bottom border/padding, or the float will
             // include the padding incorrectly. -dwh
             if (checkForFloatsFromLastLine) {
-                int bottomVisualOverflow = lastRootBox()->bottomVisualOverflow();
-                int bottomLayoutOverflow = lastRootBox()->bottomLayoutOverflow();
+                int bottomVisualOverflow = afterSideVisibleOverflowForLine(lastRootBox());
+                int bottomLayoutOverflow = afterSideLayoutOverflowForLine(lastRootBox());
                 TrailingFloatsRootInlineBox* trailingFloatsLineBox = new (renderArena()) TrailingFloatsRootInlineBox(this);
                 m_lineBoxes.appendLineBox(trailingFloatsLineBox);
                 trailingFloatsLineBox->setConstructed();
                 GlyphOverflowAndFallbackFontsMap textBoxDataMap;
-                trailingFloatsLineBox->alignBoxesInBlockDirection(height(), textBoxDataMap);
-                trailingFloatsLineBox->setBlockDirectionOverflowPositions(height(), bottomLayoutOverflow, height(), bottomVisualOverflow, 0);
-                trailingFloatsLineBox->setBlockHeight(height());
+                trailingFloatsLineBox->alignBoxesInBlockDirection(logicalHeight(), textBoxDataMap);
+                trailingFloatsLineBox->setBlockDirectionOverflowPositions(logicalHeight(), bottomLayoutOverflow, logicalHeight(), bottomVisualOverflow, 0);
+                trailingFloatsLineBox->setBlockLogicalHeight(logicalHeight());
             }
             if (lastFloat) {
                 for (FloatingObject* f = m_floatingObjects->last(); f != lastFloat; f = m_floatingObjects->prev()) {
@@ -1034,10 +1040,10 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
     }
 
     // Now add in the bottom border/padding.
-    setLogicalHeight(height() + toAdd);
+    setLogicalHeight(logicalHeight() + borderAfter() + paddingAfter() + scrollbarLogicalHeight());
 
     if (!firstLineBox() && hasLineIfEmpty())
-        setLogicalHeight(height() + lineHeight(true, true));
+        setLogicalHeight(logicalHeight() + lineHeight(true, style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
 
     // See if we have any lines that spill out of our block.  If we do, then we will possibly need to
     // truncate text.
@@ -1047,7 +1053,7 @@ void RenderBlock::layoutInlineChildren(bool relayoutChildren, int& repaintTop, i
 
 RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLayout, bool& previousLineBrokeCleanly, 
                                                    InlineBidiResolver& resolver, Vector<FloatWithRect>& floats, unsigned& numCleanFloats,
-                                                   bool& useRepaintBounds, int& repaintTop, int& repaintBottom)
+                                                   bool& useRepaintBounds, int& repaintLogicalTop, int& repaintLogicalBottom)
 {
     RootInlineBox* curr = 0;
     RootInlineBox* last = 0;
@@ -1072,8 +1078,8 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                     if (!useRepaintBounds)
                         useRepaintBounds = true;
                         
-                    repaintTop = min(repaintTop, curr->topVisibleOverflow() + min(paginationDelta, 0));
-                    repaintBottom = max(repaintBottom, curr->bottomVisibleOverflow() + max(paginationDelta, 0));
+                    repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(curr) + min(paginationDelta, 0));
+                    repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(curr) + max(paginationDelta, 0));
                     curr->adjustPosition(0, paginationDelta);
                 }                
             }
@@ -1092,9 +1098,11 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                         break;
                     }
                     if (floats[floatIndex].rect.size() != newSize) {
-                        int floatTop = floats[floatIndex].rect.y();
+                        int floatTop = style()->isHorizontalWritingMode() ? floats[floatIndex].rect.y() : floats[floatIndex].rect.x();
+                        int floatHeight = style()->isHorizontalWritingMode() ? max(floats[floatIndex].rect.height(), newSize.height()) 
+                                                                             : max(floats[floatIndex].rect.width(), newSize.width());
                         curr->markDirty();
-                        markLinesDirtyInVerticalRange(curr->blockHeight(), floatTop + max(floats[floatIndex].rect.height(), newSize.height()), curr);
+                        markLinesDirtyInBlockRange(curr->blockLogicalHeight(), floatTop + floatHeight, curr);
                         floats[floatIndex].rect.setSize(newSize);
                         dirtiedByFloat = true;
                     }
@@ -1144,7 +1152,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
 
     numCleanFloats = 0;
     if (!floats.isEmpty()) {
-        int savedHeight = height();
+        int savedLogicalHeight = logicalHeight();
         // Restore floats from clean lines.
         RootInlineBox* line = firstRootBox();
         while (line != curr) {
@@ -1152,7 +1160,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
                 Vector<RenderBox*>::iterator end = cleanLineFloats->end();
                 for (Vector<RenderBox*>::iterator f = cleanLineFloats->begin(); f != end; ++f) {
                     insertFloatingObject(*f);
-                    setLogicalHeight((*f)->y() - (*f)->marginTop());
+                    setLogicalHeight(logicalTopForChild(*f) - marginBeforeForChild(*f));
                     positionNewFloats();
                     ASSERT(floats[numCleanFloats].object == *f);
                     numCleanFloats++;
@@ -1160,7 +1168,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
             }
             line = line->nextRootBox();
         }
-        setLogicalHeight(savedHeight);
+        setLogicalHeight(savedLogicalHeight);
     }
 
     firstLine = !last;
@@ -1169,12 +1177,12 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
     RenderObject* startObj;
     int pos = 0;
     if (last) {
-        setLogicalHeight(last->blockHeight());
+        setLogicalHeight(last->blockLogicalHeight());
         startObj = last->lineBreakObj();
         pos = last->lineBreakPos();
         resolver.setStatus(last->lineBreakBidiStatus());
     } else {
-        bool ltr = style()->direction() == LTR
+        bool ltr = style()->isLeftToRightDirection()
     #if ENABLE(SVG)   
             || (style()->unicodeBidi() == UBNormal && isSVGText())
     #endif
@@ -1194,7 +1202,7 @@ RootInlineBox* RenderBlock::determineStartPosition(bool& firstLine, bool& fullLa
     return curr;
 }
 
-RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& yPos)
+RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, InlineIterator& cleanLineStart, BidiStatus& cleanLineBidiStatus, int& logicalTop)
 {
     RootInlineBox* last = 0;
     if (!startLine)
@@ -1214,7 +1222,7 @@ RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, Inlin
     RootInlineBox* prev = last->prevRootBox();
     cleanLineStart = InlineIterator(this, prev->lineBreakObj(), prev->lineBreakPos());
     cleanLineBidiStatus = prev->lineBreakBidiStatus();
-    yPos = prev->blockHeight();
+    logicalTop = prev->blockLogicalHeight();
 
     for (RootInlineBox* line = last; line; line = line->nextRootBox())
         line->extractLine(); // Disconnect all line boxes from their render objects while preserving
@@ -1223,27 +1231,28 @@ RootInlineBox* RenderBlock::determineEndPosition(RootInlineBox* startLine, Inlin
     return last;
 }
 
-bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const InlineIterator& endLineStart, const BidiStatus& endLineStatus, RootInlineBox*& endLine, int& endYPos, int& repaintBottom, int& repaintTop)
+bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const InlineIterator& endLineStart, const BidiStatus& endLineStatus, RootInlineBox*& endLine,
+                                 int& endLogicalTop, int& repaintLogicalBottom, int& repaintLogicalTop)
 {
     if (resolver.position() == endLineStart) {
         if (resolver.status() != endLineStatus)
             return false;
 
-        int delta = height() - endYPos;
+        int delta = logicalHeight() - endLogicalTop;
         if (!delta || !m_floatingObjects)
             return true;
 
         // See if any floats end in the range along which we want to shift the lines vertically.
-        int top = min(height(), endYPos);
+        int logicalTop = min(logicalHeight(), endLogicalTop);
 
         RootInlineBox* lastLine = endLine;
         while (RootInlineBox* nextLine = lastLine->nextRootBox())
             lastLine = nextLine;
 
-        int bottom = lastLine->blockHeight() + abs(delta);
+        int logicalBottom = lastLine->blockLogicalHeight() + abs(delta);
 
         for (FloatingObject* f = m_floatingObjects->first(); f; f = m_floatingObjects->next()) {
-            if (f->m_bottom >= top && f->m_bottom < bottom)
+            if (logicalBottomForFloat(f) >= logicalTop && logicalBottomForFloat(f) < logicalBottom)
                 return false;
         }
 
@@ -1261,23 +1270,23 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
                 return false; // ...but the bidi state doesn't match.
             RootInlineBox* result = line->nextRootBox();
 
-            // Set our yPos to be the block height of endLine.
+            // Set our logical top to be the block height of endLine.
             if (result)
-                endYPos = line->blockHeight();
+                endLogicalTop = line->blockLogicalHeight();
 
-            int delta = height() - endYPos;
+            int delta = logicalHeight() - endLogicalTop;
             if (delta && m_floatingObjects) {
                 // See if any floats end in the range along which we want to shift the lines vertically.
-                int top = min(height(), endYPos);
+                int logicalTop = min(logicalHeight(), endLogicalTop);
 
                 RootInlineBox* lastLine = endLine;
                 while (RootInlineBox* nextLine = lastLine->nextRootBox())
                     lastLine = nextLine;
 
-                int bottom = lastLine->blockHeight() + abs(delta);
+                int logicalBottom = lastLine->blockLogicalHeight() + abs(delta);
 
                 for (FloatingObject* f = m_floatingObjects->first(); f; f = m_floatingObjects->next()) {
-                    if (f->m_bottom >= top && f->m_bottom < bottom)
+                    if (logicalBottomForFloat(f) >= logicalTop && logicalBottomForFloat(f) < logicalBottom)
                         return false;
                 }
             }
@@ -1286,8 +1295,8 @@ bool RenderBlock::matchedEndLine(const InlineBidiResolver& resolver, const Inlin
             RootInlineBox* boxToDelete = endLine;
             RenderArena* arena = renderArena();
             while (boxToDelete && boxToDelete != result) {
-                repaintTop = min(repaintTop, boxToDelete->topVisibleOverflow());
-                repaintBottom = max(repaintBottom, boxToDelete->bottomVisibleOverflow());
+                repaintLogicalTop = min(repaintLogicalTop, beforeSideVisibleOverflowForLine(boxToDelete));
+                repaintLogicalBottom = max(repaintLogicalBottom, afterSideVisibleOverflowForLine(boxToDelete));
                 RootInlineBox* next = boxToDelete->nextRootBox();
                 boxToDelete->deleteLine(arena);
                 boxToDelete = next;
@@ -1337,7 +1346,7 @@ static bool inlineFlowRequiresLineBox(RenderInline* flow)
     // FIXME: Right now, we only allow line boxes for inlines that are truly empty.
     // We need to fix this, though, because at the very least, inlines containing only
     // ignorable whitespace should should also have line boxes. 
-    return !flow->firstChild() && flow->hasHorizontalBordersPaddingOrMargin();
+    return !flow->firstChild() && flow->hasInlineDirectionBordersPaddingOrMargin();
 }
 
 bool RenderBlock::requiresLineBox(const InlineIterator& it, bool isLineEmpty, bool previousLineBrokeCleanly)
@@ -1387,16 +1396,16 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEm
                 // A relative positioned inline encloses us.  In this case, we also have to determine our
                 // position as though we were an inline.  Set |staticX| and |staticY| on the relative positioned
                 // inline so that we can obtain the value later.
-                toRenderInline(c)->layer()->setStaticX(style()->direction() == LTR ? logicalLeftOffsetForLine(height(), false) : logicalRightOffsetForLine(height(), false));
+                toRenderInline(c)->layer()->setStaticX(style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(height(), false) : logicalRightOffsetForLine(height(), false));
                 toRenderInline(c)->layer()->setStaticY(height());
             }
     
             RenderBox* box = toRenderBox(object);
             if (box->style()->hasStaticX()) {
                 if (box->style()->isOriginalDisplayInlineType())
-                    box->layer()->setStaticX(style()->direction() == LTR ? logicalLeftOffsetForLine(height(), false) : width() - logicalRightOffsetForLine(height(), false));
+                    box->layer()->setStaticX(style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(height(), false) : width() - logicalRightOffsetForLine(height(), false));
                 else
-                    box->layer()->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
+                    box->layer()->setStaticX(style()->isLeftToRightDirection() ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
             }
     
             if (box->style()->hasStaticY())
@@ -1409,12 +1418,12 @@ void RenderBlock::skipTrailingWhitespace(InlineIterator& iterator, bool isLineEm
 int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstLine, bool isLineEmpty, bool previousLineBrokeCleanly,
                                        FloatingObject* lastFloatFromPreviousLine)
 {
-    int availableWidth = availableLogicalWidthForLine(height(), firstLine);
+    int availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
     while (!resolver.position().atEnd() && !requiresLineBox(resolver.position(), isLineEmpty, previousLineBrokeCleanly)) {
         RenderObject* object = resolver.position().obj;
         if (object->isFloating()) {
             positionNewFloatOnLine(insertFloatingObject(toRenderBox(object)), lastFloatFromPreviousLine);
-            availableWidth = availableLogicalWidthForLine(height(), firstLine);
+            availableWidth = availableLogicalWidthForLine(logicalHeight(), firstLine);
         } else if (object->isPositioned()) {
             // FIXME: The math here is actually not really right.  It's a best-guess approximation that
             // will work for the common cases
@@ -1423,16 +1432,16 @@ int RenderBlock::skipLeadingWhitespace(InlineBidiResolver& resolver, bool firstL
                 // A relative positioned inline encloses us.  In this case, we also have to determine our
                 // position as though we were an inline.  Set |staticX| and |staticY| on the relative positioned
                 // inline so that we can obtain the value later.
-                toRenderInline(c)->layer()->setStaticX(style()->direction() == LTR ? logicalLeftOffsetForLine(height(), firstLine) : logicalRightOffsetForLine(height(), firstLine));
+                toRenderInline(c)->layer()->setStaticX(style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(height(), firstLine) : logicalRightOffsetForLine(height(), firstLine));
                 toRenderInline(c)->layer()->setStaticY(height());
             }
     
             RenderBox* box = toRenderBox(object);
             if (box->style()->hasStaticX()) {
                 if (box->style()->isOriginalDisplayInlineType())
-                    box->layer()->setStaticX(style()->direction() == LTR ? logicalLeftOffsetForLine(height(), firstLine) : width() - logicalRightOffsetForLine(height(), firstLine));
+                    box->layer()->setStaticX(style()->isLeftToRightDirection() ? logicalLeftOffsetForLine(height(), firstLine) : width() - logicalRightOffsetForLine(height(), firstLine));
                 else
-                    box->layer()->setStaticX(style()->direction() == LTR ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
+                    box->layer()->setStaticX(style()->isLeftToRightDirection() ? borderLeft() + paddingLeft() : borderRight() + paddingRight());
             }
     
             if (box->style()->hasStaticY())
@@ -1465,22 +1474,22 @@ void RenderBlock::fitBelowFloats(int widthToFit, bool firstLine, int& availableW
 {
     ASSERT(widthToFit > availableWidth);
 
-    int floatBottom;
-    int lastFloatBottom = height();
+    int floatLogicalBottom;
+    int lastFloatLogicalBottom = logicalHeight();
     int newLineWidth = availableWidth;
     while (true) {
-        floatBottom = nextFloatBottomBelow(lastFloatBottom);
-        if (!floatBottom)
+        floatLogicalBottom = nextFloatLogicalBottomBelow(lastFloatLogicalBottom);
+        if (!floatLogicalBottom)
             break;
 
-        newLineWidth = availableLogicalWidthForLine(floatBottom, firstLine);
-        lastFloatBottom = floatBottom;
+        newLineWidth = availableLogicalWidthForLine(floatLogicalBottom, firstLine);
+        lastFloatLogicalBottom = floatLogicalBottom;
         if (newLineWidth >= widthToFit)
             break;
     }
 
     if (newLineWidth > availableWidth) {
-        setLogicalHeight(lastFloatBottom);
+        setLogicalHeight(lastFloatLogicalBottom);
         availableWidth = newLineWidth;
     }
 }
@@ -1571,7 +1580,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
     // Firefox and Opera will allow a table cell to grow to fit an image inside it under
     // very specific circumstances (in order to match common WinIE renderings). 
     // Not supporting the quirk has caused us to mis-render some real sites. (See Bugzilla 10517.) 
-    bool allowImagesToBreak = !document()->inQuirksMode() || !isTableCell() || !style()->width().isIntrinsicOrAuto();
+    bool allowImagesToBreak = !document()->inQuirksMode() || !isTableCell() || !style()->logicalWidth().isIntrinsicOrAuto();
 
     EWhiteSpace currWS = style()->whiteSpace();
     EWhiteSpace lastWS = currWS;
@@ -1621,9 +1630,9 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 // check if it fits in the current line.
                 // If it does, position it now, otherwise, position
                 // it after moving to next line (in newLine() func)
-                if (floatsFitOnLine && floatBox->width() + floatBox->marginLeft() + floatBox->marginRight() + w + tmpW <= width) {
+                if (floatsFitOnLine && logicalWidthForFloat(f) + w + tmpW <= width) {
                     positionNewFloatOnLine(f, lastFloatFromPreviousLine);
-                    width = availableLogicalWidthForLine(height(), firstLine);
+                    width = availableLogicalWidthForLine(logicalHeight(), firstLine);
                 } else
                     floatsFitOnLine = false;
             } else if (o->isPositioned()) {
@@ -1633,7 +1642,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 bool isInlineType = box->style()->isOriginalDisplayInlineType();
                 bool needToSetStaticX = box->style()->hasStaticX();
                 if (box->style()->hasStaticX() && !isInlineType) {
-                    box->layer()->setStaticX(o->parent()->style()->direction() == LTR ?
+                    box->layer()->setStaticX(o->parent()->style()->isLeftToRightDirection() ?
                                   borderLeft() + paddingLeft() :
                                   borderRight() + paddingRight());
                     needToSetStaticX = false;
@@ -1691,8 +1700,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                 }
             }
 
-            tmpW += flowBox->marginLeft() + flowBox->borderLeft() + flowBox->paddingLeft() +
-                    flowBox->marginRight() + flowBox->borderRight() + flowBox->paddingRight();
+            tmpW += flowBox->marginStart() + flowBox->borderStart() + flowBox->paddingStart() +
+                    flowBox->marginEnd() + flowBox->borderEnd() + flowBox->paddingEnd();
         } else if (o->isReplaced()) {
             RenderBox* replacedBox = toRenderBox(o);
 
@@ -1715,7 +1724,8 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             trailingSpaceObject = 0;
 
             // Optimize for a common case. If we can't find whitespace after the list
-            // item, then this is all moot. -dwh
+            // item, then this is all moot.
+            int replacedLogicalWidth = logicalWidthForChild(replacedBox) + marginStartForChild(replacedBox) + marginEndForChild(replacedBox) + inlineLogicalWidth(o);
             if (o->isListMarker()) {
                 if (style()->collapseWhiteSpace() && shouldSkipWhitespaceAfterStartObject(this, o, lineMidpointState)) {
                     // Like with inline flows, we start ignoring spaces to make sure that any 
@@ -1725,9 +1735,9 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                     ignoringSpaces = true;
                 }
                 if (toRenderListMarker(o)->isInside())
-                    tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
+                    tmpW += replacedLogicalWidth;
             } else
-                tmpW += replacedBox->width() + replacedBox->marginLeft() + replacedBox->marginRight() + inlineWidth(o);
+                tmpW += replacedLogicalWidth;
         } else if (o->isText()) {
             if (!pos)
                 appliedStartWidth = false;
@@ -1755,7 +1765,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             // space, then subtract its width.
             int wordTrailingSpaceWidth = f.typesettingFeatures() & Kerning ? f.width(TextRun(&space, 1)) + wordSpacing : 0;
 
-            int wrapW = tmpW + inlineWidth(o, !appliedStartWidth, true);
+            int wrapW = tmpW + inlineLogicalWidth(o, !appliedStartWidth, true);
             int charWidth = 0;
             bool breakNBSP = autoWrap && o->style()->nbspMode() == SPACE;
             // Auto-wrapping text should wrap in the middle of a word only if it could not wrap before the word,
@@ -1839,7 +1849,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
                         additionalTmpW = textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
                     tmpW += additionalTmpW;
                     if (!appliedStartWidth) {
-                        tmpW += inlineWidth(o, true, false);
+                        tmpW += inlineLogicalWidth(o, true, false);
                         appliedStartWidth = true;
                     }
                     
@@ -1984,7 +1994,7 @@ InlineIterator RenderBlock::findNextLineBreak(InlineBidiResolver& resolver, bool
             // IMPORTANT: pos is > length here!
             int additionalTmpW = ignoringSpaces ? 0 : textWidth(t, lastSpace, pos - lastSpace, f, w + tmpW, isFixedPitch, collapseWhiteSpace) + lastSpaceWordSpacing;
             tmpW += additionalTmpW;
-            tmpW += inlineWidth(o, !appliedStartWidth, true);
+            tmpW += inlineLogicalWidth(o, !appliedStartWidth, true);
 
             if (canHyphenate && w + tmpW > width) {
                 tryHyphenating(t, f, style->hyphenationLocale(), lastSpace, pos, w + tmpW - additionalTmpW, width, isFixedPitch, collapseWhiteSpace, lastSpaceWordSpacing, lBreak, nextBreakable, hyphenated);
@@ -2149,6 +2159,70 @@ void RenderBlock::addOverflowFromInlineChildren()
     }
 }
 
+int RenderBlock::beforeSideVisibleOverflowForLine(RootInlineBox* line) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return line->topVisibleOverflow();
+    case LeftToRightWritingMode:
+        return line->leftVisibleOverflow();
+    case RightToLeftWritingMode:
+        return line->rightVisibleOverflow();
+    case BottomToTopWritingMode:
+        return line->bottomVisibleOverflow();
+    }
+    ASSERT_NOT_REACHED();
+    return line->topVisibleOverflow();
+}
+
+int RenderBlock::afterSideVisibleOverflowForLine(RootInlineBox* line) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return line->bottomVisibleOverflow();
+    case LeftToRightWritingMode:
+        return line->rightVisibleOverflow();
+    case RightToLeftWritingMode:
+        return line->leftVisibleOverflow();
+    case BottomToTopWritingMode:
+        return line->topVisibleOverflow();
+    }
+    ASSERT_NOT_REACHED();
+    return line->bottomVisibleOverflow();
+}
+
+int RenderBlock::beforeSideLayoutOverflowForLine(RootInlineBox* line) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return line->topLayoutOverflow();
+    case LeftToRightWritingMode:
+        return line->leftLayoutOverflow();
+    case RightToLeftWritingMode:
+        return line->rightLayoutOverflow();
+    case BottomToTopWritingMode:
+        return line->bottomLayoutOverflow();
+    }
+    ASSERT_NOT_REACHED();
+    return line->topLayoutOverflow();
+}
+
+int RenderBlock::afterSideLayoutOverflowForLine(RootInlineBox* line) const
+{
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
+        return line->bottomLayoutOverflow();
+    case LeftToRightWritingMode:
+        return line->rightLayoutOverflow();
+    case RightToLeftWritingMode:
+        return line->leftLayoutOverflow();
+    case BottomToTopWritingMode:
+        return line->topLayoutOverflow();
+    }
+    ASSERT_NOT_REACHED();
+    return line->bottomLayoutOverflow();
+}
+
 void RenderBlock::deleteEllipsisLineBoxes()
 {
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox())
@@ -2170,7 +2244,7 @@ void RenderBlock::checkLinesForTextOverflow()
     // if the right edge of a line box exceeds that.  For RTL, we use the left edge of the padding box and
     // check the left edge of the line box to see if it is less
     // Include the scrollbar for overflow blocks, which means we want to use "contentWidth()"
-    bool ltr = style()->direction() == LTR;
+    bool ltr = style()->isLeftToRightDirection();
     for (RootInlineBox* curr = firstRootBox(); curr; curr = curr->nextRootBox()) {
         int blockRightEdge = logicalRightOffsetForLine(curr->y(), curr == firstRootBox());
         int blockLeftEdge = logicalLeftOffsetForLine(curr->y(), curr == firstRootBox());
diff --git a/WebCore/rendering/RenderBox.cpp b/WebCore/rendering/RenderBox.cpp
index ecb6ccc..ac40ee9 100644
--- a/WebCore/rendering/RenderBox.cpp
+++ b/WebCore/rendering/RenderBox.cpp
@@ -92,19 +92,14 @@ RenderBox::~RenderBox()
 
 int RenderBox::marginBefore() const
 {
-    return marginBeforeUsing(style());
-}
-
-int RenderBox::marginBeforeUsing(const RenderStyle* s) const
-{
-    switch (s->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
         return m_marginTop;
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return m_marginBottom;
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return m_marginLeft;
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return m_marginRight;
     }
     ASSERT_NOT_REACHED();
@@ -113,19 +108,14 @@ int RenderBox::marginBeforeUsing(const RenderStyle* s) const
 
 int RenderBox::marginAfter() const
 {
-    return marginAfterUsing(style());
-}
-
-int RenderBox::marginAfterUsing(const RenderStyle* s) const
-{
-    switch (s->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
         return m_marginBottom;
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return m_marginTop;
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return m_marginRight;
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return m_marginLeft;
     }
     ASSERT_NOT_REACHED();
@@ -134,62 +124,42 @@ int RenderBox::marginAfterUsing(const RenderStyle* s) const
 
 int RenderBox::marginStart() const
 {
-    return marginStartUsing(style());
-}
-
-int RenderBox::marginStartUsing(const RenderStyle* s) const
-{
-    if (s->isVerticalBlockFlow())
-        return s->direction() == LTR ? m_marginLeft : m_marginRight;
-    return s->direction() == LTR ? m_marginTop : m_marginBottom;
+    if (style()->isHorizontalWritingMode())
+        return style()->isLeftToRightDirection() ? m_marginLeft : m_marginRight;
+    return style()->isLeftToRightDirection() ? m_marginTop : m_marginBottom;
 }
 
 int RenderBox::marginEnd() const
 {
-    return marginEndUsing(style());
-}
-
-int RenderBox::marginEndUsing(const RenderStyle* s) const
-{
-    if (s->isVerticalBlockFlow())
-        return s->direction() == LTR ? m_marginRight : m_marginLeft;
-    return s->direction() == LTR ? m_marginBottom : m_marginTop;
+    if (style()->isHorizontalWritingMode())
+        return style()->isLeftToRightDirection() ? m_marginRight : m_marginLeft;
+    return style()->isLeftToRightDirection() ? m_marginBottom : m_marginTop;
 }
 
 void RenderBox::setMarginStart(int margin)
 {
-    setMarginStartUsing(style(), margin);
-}
-
-void RenderBox::setMarginEnd(int margin)
-{
-    setMarginEndUsing(style(), margin);
-}
-
-void RenderBox::setMarginStartUsing(const RenderStyle* s, int margin)
-{
-    if (s->isVerticalBlockFlow()) {
-        if (s->direction() == LTR)
+    if (style()->isHorizontalWritingMode()) {
+        if (style()->isLeftToRightDirection())
             m_marginLeft = margin;
         else
             m_marginRight = margin;
     } else {
-        if (s->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             m_marginTop = margin;
         else
             m_marginBottom = margin;
     }
 }
 
-void RenderBox::setMarginEndUsing(const RenderStyle* s, int margin)
+void RenderBox::setMarginEnd(int margin)
 {
-    if (s->isVerticalBlockFlow()) {
-        if (s->direction() == LTR)
+    if (style()->isHorizontalWritingMode()) {
+        if (style()->isLeftToRightDirection())
             m_marginRight = margin;
         else
             m_marginLeft = margin;
     } else {
-        if (s->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             m_marginBottom = margin;
         else
             m_marginTop = margin;
@@ -198,45 +168,35 @@ void RenderBox::setMarginEndUsing(const RenderStyle* s, int margin)
 
 void RenderBox::setMarginBefore(int margin)
 {
-    setMarginBeforeUsing(style(), margin);
-}
-
-void RenderBox::setMarginAfter(int margin)
-{
-    setMarginAfterUsing(style(), margin);
-}
-
-void RenderBox::setMarginBeforeUsing(const RenderStyle* s, int margin)
-{
-    switch (s->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
         m_marginTop = margin;
         break;
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         m_marginBottom = margin;
         break;
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         m_marginLeft = margin;
         break;
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         m_marginRight = margin;
         break;
     }
 }
 
-void RenderBox::setMarginAfterUsing(const RenderStyle* s, int margin)
+void RenderBox::setMarginAfter(int margin)
 {
-    switch (s->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (style()->writingMode()) {
+    case TopToBottomWritingMode:
         m_marginBottom = margin;
         break;
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         m_marginTop = margin;
         break;
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         m_marginRight = margin;
         break;
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         m_marginLeft = margin;
         break;
     }
@@ -270,8 +230,13 @@ void RenderBox::removeFloatingOrPositionedChildFromBlockLists()
                 outermostBlock = p;
         }
 
-        if (outermostBlock)
+        if (outermostBlock) {
+            RenderObject* parent = outermostBlock->parent();
+            if (parent && parent->isFlexibleBox())
+                outermostBlock = toRenderBlock(parent);
+
             outermostBlock->markAllDescendantsWithFloatsForLayout(this, false);
+        }
     }
 
     if (isPositioned()) {
@@ -347,11 +312,16 @@ void RenderBox::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle
     // Set the text color if we're the body.
     if (isBody())
         document()->setTextColor(style()->visitedDependentColor(CSSPropertyColor));
-    else if (oldStyle && isRoot() && oldStyle->blockFlow() != style()->blockFlow()) {
-        // Propagate the new block flow up to the RenderView.
+    else if (isRoot() && (!oldStyle || oldStyle->writingMode() != style()->writingMode() || oldStyle->direction() != style()->direction())) {
+        // Propagate the new block flow and direction up to the RenderView.
+        // FIXME: WinIE seems to propagate from the <body> as well.  We may want to consider doing that at some point.
         RenderView* viewRenderer = view();
-        viewRenderer->style()->setBlockFlow(style()->blockFlow());
-        viewRenderer->setNeedsLayoutAndPrefWidthsRecalc();
+        RenderStyle* viewStyle = viewRenderer->style();
+        if (viewStyle->writingMode() != style()->writingMode() || viewStyle->direction() != style()->direction()) {
+            viewStyle->setWritingMode(style()->writingMode());
+            viewStyle->setDirection(style()->direction());
+            viewRenderer->setNeedsLayoutAndPrefWidthsRecalc();
+        }
     }
 }
 
@@ -434,7 +404,7 @@ int RenderBox::scrollWidth() const
     if (hasOverflowClip())
         return layer()->scrollWidth();
     // For objects with visible overflow, this matches IE.
-    if (style()->direction() == LTR)
+    if (style()->isLeftToRightDirection())
         return max(clientWidth(), rightmostPosition(true, false) - borderLeft());
     return clientWidth() - min(0, leftmostPosition(true, false) - borderLeft());
 }
@@ -479,6 +449,24 @@ void RenderBox::absoluteQuads(Vector<FloatQuad>& quads)
     quads.append(localToAbsoluteQuad(FloatRect(0, 0, width(), height())));
 }
 
+IntRect RenderBox::applyLayerTransformToRect(const IntRect& rect) const
+{
+    if (layer() && layer()->hasTransform()) {
+        TransformationMatrix transform;
+        transform.makeIdentity();
+        transform.translate(rect.x(), rect.y());
+        layer()->updateTransform();
+        transform.multLeft(layer()->currentTransform());
+        return transform.mapRect(IntRect(0, 0, rect.width(), rect.height()));
+    }
+    return rect;
+}
+
+IntRect RenderBox::transformedFrameRect() const
+{
+    return applyLayerTransformToRect(frameRect());
+}
+
 IntRect RenderBox::absoluteContentBox() const
 {
     IntRect rect = contentBoxRect();
@@ -721,7 +709,7 @@ bool RenderBox::nodeAtPoint(const HitTestRequest& request, HitTestResult& result
     // Check our bounds next. For this purpose always assume that we can only be hit in the
     // foreground phase (which is true for replaced elements like images).
     IntRect boundsRect = IntRect(tx, ty, width(), height());
-    if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectFromPoint(xPos, yPos))) {
+    if (visibleToHitTesting() && action == HitTestForeground && boundsRect.intersects(result.rectForPoint(xPos, yPos))) {
         updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
         if (!result.addNodeToRectBasedTestResult(node(), xPos, yPos, boundsRect))
             return true;
@@ -833,7 +821,7 @@ void RenderBox::paintBoxDecorationsWithSize(PaintInfo& paintInfo, int tx, int ty
 
 void RenderBox::paintMask(PaintInfo& paintInfo, int tx, int ty)
 {
-    if (!paintInfo.shouldPaintWithinRoot(this) || style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask)
+    if (!paintInfo.shouldPaintWithinRoot(this) || style()->visibility() != VISIBLE || paintInfo.phase != PaintPhaseMask || paintInfo.context->paintingDisabled())
         return;
 
     int w = width();
@@ -856,6 +844,11 @@ void RenderBox::paintMaskImages(const PaintInfo& paintInfo, int tx, int ty, int
     bool allMaskImagesLoaded = true;
     
     if (!compositedMask) {
+        // If the context has a rotation, scale or skew, then use a transparency layer to avoid
+        // pixel cruft around the edge of the mask.
+        const AffineTransform& currentCTM = paintInfo.context->getCTM();
+        pushTransparencyLayer = !currentCTM.isIdentityOrTranslationOrFlipped();
+
         StyleImage* maskBoxImage = style()->maskBoxImage().image();
         const FillLayer* maskLayers = style()->maskLayers();
 
@@ -1141,7 +1134,7 @@ int RenderBox::perpendicularContainingBlockLogicalHeight() const
         // Rather than making the child be completely unconstrained, WinIE uses the viewport width and height
         // as a constraint.  We do that for now as well even though it's likely being unconstrained is what the spec
         // will decide.
-        return containingBlockStyle->isVerticalBlockFlow() ? view()->frameView()->visibleHeight() : view()->frameView()->visibleWidth();
+        return containingBlockStyle->isHorizontalWritingMode() ? view()->frameView()->visibleHeight() : view()->frameView()->visibleWidth();
     }
     
     // Use the content box logical height as specified by the style.
@@ -1507,11 +1500,11 @@ void RenderBox::computeLogicalWidth()
     bool stretching = (parent()->style()->boxAlign() == BSTRETCH);
     bool treatAsReplaced = shouldComputeSizeAsReplaced() && (!inVerticalBox || !stretching);
 
-    Length logicalWidthLength = (treatAsReplaced) ? Length(computeReplacedWidth(), Fixed) : style()->logicalWidth();
+    Length logicalWidthLength = (treatAsReplaced) ? Length(computeReplacedLogicalWidth(), Fixed) : style()->logicalWidth();
 
     RenderBlock* cb = containingBlock();
     int containerLogicalWidth = max(0, containingBlockLogicalWidthForContent());
-    bool hasPerpendicularContainingBlock = cb->style()->isVerticalBlockFlow() != style()->isVerticalBlockFlow();
+    bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
     int containerWidthInInlineDirection = containerLogicalWidth;
     if (hasPerpendicularContainingBlock)
         containerWidthInInlineDirection = perpendicularContainingBlockLogicalHeight();
@@ -1596,7 +1589,7 @@ void RenderBox::computeLogicalWidth()
 
     if (!hasPerpendicularContainingBlock && containerLogicalWidth && containerLogicalWidth != (logicalWidth() + marginStart() + marginEnd())
             && !isFloating() && !isInline() && !cb->isFlexibleBox())
-        setMarginEndUsing(cb->style(), containerLogicalWidth - logicalWidth() - marginStartUsing(cb->style()));
+        cb->setMarginEndForChild(this, containerLogicalWidth - logicalWidth() - cb->marginStartForChild(this));
 }
 
 int RenderBox::computeLogicalWidthUsing(LogicalWidthType widthType, int availableLogicalWidth)
@@ -1678,31 +1671,31 @@ void RenderBox::computeInlineDirectionMargins(RenderBlock* containingBlock, int
     // Case One: The object is being centered in the containing block's available logical width.
     if ((marginStartLength.isAuto() && marginEndLength.isAuto() && childWidth < containerWidth)
         || (!marginStartLength.isAuto() && !marginEndLength.isAuto() && containingBlock->style()->textAlign() == WEBKIT_CENTER)) {
-        setMarginStartUsing(containingBlockStyle, max(0, (containerWidth - childWidth) / 2));
-        setMarginEndUsing(containingBlockStyle, containerWidth - childWidth - marginStartUsing(containingBlockStyle));
+        containingBlock->setMarginStartForChild(this, max(0, (containerWidth - childWidth) / 2));
+        containingBlock->setMarginEndForChild(this, containerWidth - childWidth - containingBlock->marginStartForChild(this));
         return;
     } 
     
     // Case Two: The object is being pushed to the start of the containing block's available logical width.
     if (marginEndLength.isAuto() && childWidth < containerWidth) {
-        setMarginStartUsing(containingBlockStyle, marginStartLength.calcValue(containerWidth));
-        setMarginEndUsing(containingBlockStyle, containerWidth - childWidth - marginStartUsing(containingBlockStyle));
+        containingBlock->setMarginStartForChild(this, marginStartLength.calcValue(containerWidth));
+        containingBlock->setMarginEndForChild(this, containerWidth - childWidth - containingBlock->marginStartForChild(this));
         return;
     } 
     
     // Case Three: The object is being pushed to the end of the containing block's available logical width.
-    bool pushToEndFromTextAlign = !marginEndLength.isAuto() && ((containingBlockStyle->direction() == RTL && containingBlockStyle->textAlign() == WEBKIT_LEFT)
-        || (containingBlockStyle->direction() == LTR && containingBlockStyle->textAlign() == WEBKIT_RIGHT));
+    bool pushToEndFromTextAlign = !marginEndLength.isAuto() && ((!containingBlockStyle->isLeftToRightDirection() && containingBlockStyle->textAlign() == WEBKIT_LEFT)
+        || (containingBlockStyle->isLeftToRightDirection() && containingBlockStyle->textAlign() == WEBKIT_RIGHT));
     if ((marginStartLength.isAuto() && childWidth < containerWidth) || pushToEndFromTextAlign) {
-        setMarginEndUsing(containingBlockStyle, marginEndLength.calcValue(containerWidth));
-        setMarginStartUsing(containingBlockStyle, containerWidth - childWidth - marginEndUsing(containingBlockStyle));
+        containingBlock->setMarginEndForChild(this, marginEndLength.calcValue(containerWidth));
+        containingBlock->setMarginStartForChild(this, containerWidth - childWidth - containingBlock->marginEndForChild(this));
         return;
     } 
     
     // Case Four: Either no auto margins, or our width is >= the container width (css2.1, 10.3.3).  In that case
     // auto margins will just turn into 0.
-    setMarginStartUsing(containingBlockStyle, marginStartLength.calcMinValue(containerWidth));
-    setMarginEndUsing(containingBlockStyle, marginEndLength.calcMinValue(containerWidth));
+    containingBlock->setMarginStartForChild(this, marginStartLength.calcMinValue(containerWidth));
+    containingBlock->setMarginEndForChild(this, marginEndLength.calcMinValue(containerWidth));
 }
 
 void RenderBox::computeLogicalHeight()
@@ -1718,7 +1711,7 @@ void RenderBox::computeLogicalHeight()
         computePositionedLogicalHeight();
     } else {
         RenderBlock* cb = containingBlock();
-        bool hasPerpendicularContainingBlock = cb->style()->isVerticalBlockFlow() != style()->isVerticalBlockFlow();
+        bool hasPerpendicularContainingBlock = cb->style()->isHorizontalWritingMode() != style()->isHorizontalWritingMode();
     
         if (!hasPerpendicularContainingBlock)
             computeBlockDirectionMargins(cb);
@@ -1745,7 +1738,7 @@ void RenderBox::computeLogicalHeight()
                 && parent()->isFlexingChildren())
             h = Length(overrideSize() - borderAndPaddingLogicalHeight(), Fixed);
         else if (treatAsReplaced)
-            h = Length(computeReplacedHeight(), Fixed);
+            h = Length(computeReplacedLogicalHeight(), Fixed);
         else {
             h = style()->logicalHeight();
             checkMinMaxHeight = true;
@@ -1797,7 +1790,7 @@ void RenderBox::computeLogicalHeight()
     // height has nothing to be a percentage of, and it ends up being 0. That is bad.
     bool paginatedContentNeedsBaseHeight = document()->printing() && h.isPercent()
         && (isRoot() || (isBody() && document()->documentElement()->renderer()->style()->logicalHeight().isPercent()));
-    if (stretchesToViewHeight() || paginatedContentNeedsBaseHeight) {
+    if (stretchesToViewport() || paginatedContentNeedsBaseHeight) {
         // FIXME: Finish accounting for block flow here.
         // https://bugs.webkit.org/show_bug.cgi?id=46603
         int margins = collapsedMarginBefore() + collapsedMarginAfter();
@@ -1805,7 +1798,7 @@ void RenderBox::computeLogicalHeight()
         if (document()->printing())
             visHeight = static_cast<int>(view()->pageHeight());
         else  {
-            if (style()->isVerticalBlockFlow())
+            if (style()->isHorizontalWritingMode())
                 visHeight = view()->viewHeight();
             else
                 visHeight = view()->viewWidth();
@@ -1916,48 +1909,48 @@ int RenderBox::computePercentageLogicalHeight(const Length& height)
     return result;
 }
 
-int RenderBox::computeReplacedWidth(bool includeMaxWidth) const
+int RenderBox::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    int width = computeReplacedWidthUsing(style()->width());
-    int minW = computeReplacedWidthUsing(style()->minWidth());
-    int maxW = !includeMaxWidth || style()->maxWidth().isUndefined() ? width : computeReplacedWidthUsing(style()->maxWidth());
+    int logicalWidth = computeReplacedLogicalWidthUsing(style()->logicalWidth());
+    int minLogicalWidth = computeReplacedLogicalWidthUsing(style()->logicalMinWidth());
+    int maxLogicalWidth = !includeMaxWidth || style()->logicalMaxWidth().isUndefined() ? logicalWidth : computeReplacedLogicalWidthUsing(style()->logicalMaxWidth());
 
-    return max(minW, min(width, maxW));
+    return max(minLogicalWidth, min(logicalWidth, maxLogicalWidth));
 }
 
-int RenderBox::computeReplacedWidthUsing(Length width) const
+int RenderBox::computeReplacedLogicalWidthUsing(Length logicalWidth) const
 {
-    switch (width.type()) {
+    switch (logicalWidth.type()) {
         case Fixed:
-            return computeContentBoxLogicalWidth(width.value());
+            return computeContentBoxLogicalWidth(logicalWidth.value());
         case Percent: {
             // FIXME: containingBlockLogicalWidthForContent() is wrong if the replaced element's block-flow is perpendicular to the
             // containing block's block-flow.
             // https://bugs.webkit.org/show_bug.cgi?id=46496
             const int cw = isPositioned() ? containingBlockWidthForPositioned(toRenderBoxModelObject(container())) : containingBlockLogicalWidthForContent();
             if (cw > 0)
-                return computeContentBoxLogicalWidth(width.calcMinValue(cw));
+                return computeContentBoxLogicalWidth(logicalWidth.calcMinValue(cw));
         }
         // fall through
         default:
-            return intrinsicSize().width();
+            return intrinsicLogicalWidth();
      }
 }
 
-int RenderBox::computeReplacedHeight() const
+int RenderBox::computeReplacedLogicalHeight() const
 {
-    int height = computeReplacedHeightUsing(style()->height());
-    int minH = computeReplacedHeightUsing(style()->minHeight());
-    int maxH = style()->maxHeight().isUndefined() ? height : computeReplacedHeightUsing(style()->maxHeight());
+    int logicalHeight = computeReplacedLogicalHeightUsing(style()->logicalHeight());
+    int minLogicalHeight = computeReplacedLogicalHeightUsing(style()->logicalMinHeight());
+    int maxLogicalHeight = style()->logicalMaxHeight().isUndefined() ? logicalHeight : computeReplacedLogicalHeightUsing(style()->logicalMaxHeight());
 
-    return max(minH, min(height, maxH));
+    return max(minLogicalHeight, min(logicalHeight, maxLogicalHeight));
 }
 
-int RenderBox::computeReplacedHeightUsing(Length height) const
+int RenderBox::computeReplacedLogicalHeightUsing(Length logicalHeight) const
 {
-    switch (height.type()) {
+    switch (logicalHeight.type()) {
         case Fixed:
-            return computeContentBoxLogicalHeight(height.value());
+            return computeContentBoxLogicalHeight(logicalHeight.value());
         case Percent:
         {
             RenderObject* cb = isPositioned() ? container() : containingBlock();
@@ -1966,6 +1959,8 @@ int RenderBox::computeReplacedHeightUsing(Length height) const
                 toRenderBlock(cb)->addPercentHeightDescendant(const_cast<RenderBox*>(this));
             }
 
+            // FIXME: This calculation is not patched for block-flow yet.
+            // https://bugs.webkit.org/show_bug.cgi?id=46500
             if (cb->isPositioned() && cb->style()->height().isAuto() && !(cb->style()->top().isAuto() || cb->style()->bottom().isAuto())) {
                 ASSERT(cb->isRenderBlock());
                 RenderBlock* block = toRenderBlock(cb);
@@ -1973,25 +1968,30 @@ int RenderBox::computeReplacedHeightUsing(Length height) const
                 block->computeLogicalHeight();
                 int newHeight = block->computeContentBoxLogicalHeight(block->contentHeight());
                 block->setHeight(oldHeight);
-                return computeContentBoxLogicalHeight(height.calcValue(newHeight));
+                return computeContentBoxLogicalHeight(logicalHeight.calcValue(newHeight));
             }
             
+            // FIXME: availableLogicalHeight() is wrong if the replaced element's block-flow is perpendicular to the
+            // containing block's block-flow.
+            // https://bugs.webkit.org/show_bug.cgi?id=46496
             int availableHeight = isPositioned() ? containingBlockHeightForPositioned(toRenderBoxModelObject(cb)) : toRenderBox(cb)->availableLogicalHeight();
 
             // It is necessary to use the border-box to match WinIE's broken
             // box model.  This is essential for sizing inside
             // table cells using percentage heights.
-            if (cb->isTableCell() && (cb->style()->height().isAuto() || cb->style()->height().isPercent())) {
+            // FIXME: This needs to be made block-flow-aware.  If the cell and image are perpendicular block-flows, this isn't right.
+            // https://bugs.webkit.org/show_bug.cgi?id=46997
+            if (cb->isTableCell() && (cb->style()->logicalHeight().isAuto() || cb->style()->logicalHeight().isPercent())) {
                 // Don't let table cells squeeze percent-height replaced elements
                 // <http://bugs.webkit.org/show_bug.cgi?id=15359>
-                availableHeight = max(availableHeight, intrinsicSize().height());
-                return height.calcValue(availableHeight - borderAndPaddingHeight());
+                availableHeight = max(availableHeight, intrinsicLogicalHeight());
+                return logicalHeight.calcValue(availableHeight - borderAndPaddingLogicalHeight());
             }
 
-            return computeContentBoxLogicalHeight(height.calcValue(availableHeight));
+            return computeContentBoxLogicalHeight(logicalHeight.calcValue(availableHeight));
         }
         default:
-            return intrinsicSize().height();
+            return intrinsicLogicalHeight();
     }
 }
 
@@ -2006,7 +2006,7 @@ int RenderBox::availableLogicalHeightUsing(const Length& h) const
         return computeContentBoxLogicalHeight(h.value());
 
     if (isRenderView())
-        return style()->isVerticalBlockFlow() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
+        return style()->isHorizontalWritingMode() ? toRenderView(this)->frameView()->visibleHeight() : toRenderView(this)->frameView()->visibleWidth();
 
     // We need to stop here, since we don't want to increase the height of the table
     // artificially.  We're going to rely on this cell getting expanded to some new
@@ -2046,8 +2046,8 @@ void RenderBox::computeBlockDirectionMargins(RenderBlock* containingBlock)
     int cw = containingBlockLogicalWidthForContent();
 
     RenderStyle* containingBlockStyle = containingBlock->style();
-    setMarginBeforeUsing(containingBlockStyle, style()->marginBeforeUsing(containingBlockStyle).calcMinValue(cw));
-    setMarginAfterUsing(containingBlockStyle, style()->marginAfterUsing(containingBlockStyle).calcMinValue(cw));
+    containingBlock->setMarginBeforeForChild(this, style()->marginBeforeUsing(containingBlockStyle).calcMinValue(cw));
+    containingBlock->setMarginAfterForChild(this, style()->marginAfterUsing(containingBlockStyle).calcMinValue(cw));
 }
 
 int RenderBox::containingBlockWidthForPositioned(const RenderBoxModelObject* containingBlock) const
@@ -2069,7 +2069,7 @@ int RenderBox::containingBlockWidthForPositioned(const RenderBoxModelObject* con
 
     int fromLeft;
     int fromRight;
-    if (containingBlock->style()->direction() == LTR) {
+    if (containingBlock->style()->isLeftToRightDirection()) {
         fromLeft = first->logicalLeft() + first->borderLogicalLeft();
         fromRight = last->logicalLeft() + last->logicalWidth() - last->borderLogicalRight();
     } else {
@@ -2411,7 +2411,7 @@ void RenderBox::computePositionedLogicalWidthUsing(Length width, const RenderBox
     // positioned, inline because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
+    if (containerBlock->isRenderInline() && !containerBlock->style()->isLeftToRightDirection()) {
         const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
@@ -2684,7 +2684,7 @@ void RenderBox::computePositionedLogicalWidthReplaced()
     // NOTE: This value of width is FINAL in that the min/max width calculations
     // are dealt with in computeReplacedWidth().  This means that the steps to produce
     // correct max/min in the non-replaced version, are not necessary.
-    setWidth(computeReplacedWidth() + borderAndPaddingWidth());
+    setWidth(computeReplacedLogicalWidth() + borderAndPaddingWidth());
     const int availableSpace = containerWidth - width();
 
     /*-----------------------------------------------------------------------*\
@@ -2817,7 +2817,7 @@ void RenderBox::computePositionedLogicalWidthReplaced()
     // positioned, inline containing block because right now, it is using the xPos
     // of the first line box when really it should use the last line box.  When
     // this is fixed elsewhere, this block should be removed.
-    if (containerBlock->isRenderInline() && containerBlock->style()->direction() == RTL) {
+    if (containerBlock->isRenderInline() && !containerBlock->style()->isLeftToRightDirection()) {
         const RenderInline* flow = toRenderInline(containerBlock);
         InlineFlowBox* firstLine = flow->firstLineBox();
         InlineFlowBox* lastLine = flow->lastLineBox();
@@ -2857,7 +2857,7 @@ void RenderBox::computePositionedLogicalHeightReplaced()
     // NOTE: This value of height is FINAL in that the min/max height calculations
     // are dealt with in computeReplacedHeight().  This means that the steps to produce
     // correct max/min in the non-replaced version, are not necessary.
-    setHeight(computeReplacedHeight() + borderAndPaddingHeight());
+    setHeight(computeReplacedLogicalHeight() + borderAndPaddingHeight());
     const int availableSpace = containerHeight - height();
 
     /*-----------------------------------------------------------------------*\
@@ -2971,9 +2971,9 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
 
     // FIXME: What about border and padding?
     IntRect rect(x(), y(), caretWidth, height());
-    TextDirection direction = box ? box->direction() : style()->direction();
+    bool ltr = box ? box->isLeftToRightDirection() : style()->isLeftToRightDirection();
 
-    if ((!caretOffset) ^ (direction == LTR))
+    if ((!caretOffset) ^ ltr)
         rect.move(IntSize(width() - caretWidth, 0));
 
     if (box) {
@@ -3003,30 +3003,44 @@ IntRect RenderBox::localCaretRect(InlineBox* box, int caretOffset, int* extraWid
     return rect;
 }
 
-int RenderBox::lowestPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
+int RenderBox::topmostPosition(bool /*includeOverflowInterior*/, bool includeSelf, ApplyTransform applyTransform) const
+{
+    IntRect transformedRect = applyTransform == IncludeTransform && includeSelf ? transformedFrameRect() : frameRect();
+    if (!includeSelf || !transformedRect.width())
+        return 0;
+    int top = 0;
+    if (isRelPositioned())
+        top += relativePositionOffsetY();
+    return top;
+}
+
+int RenderBox::lowestPosition(bool /*includeOverflowInterior*/, bool includeSelf, ApplyTransform applyTransform) const
 {
-    if (!includeSelf || !width())
+    IntRect transformedRect = applyTransform == IncludeTransform && includeSelf ? transformedFrameRect() : frameRect();
+    if (!includeSelf || !transformedRect.width())
         return 0;
-    int bottom = height();
+    int bottom = transformedRect.height();
     if (isRelPositioned())
         bottom += relativePositionOffsetY();
     return bottom;
 }
 
-int RenderBox::rightmostPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
+int RenderBox::rightmostPosition(bool /*includeOverflowInterior*/, bool includeSelf, ApplyTransform applyTransform) const
 {
-    if (!includeSelf || !height())
+    IntRect transformedRect = applyTransform == IncludeTransform && includeSelf ? transformedFrameRect() : frameRect();
+    if (!includeSelf || !transformedRect.height())
         return 0;
-    int right = width();
+    int right = transformedRect.width();
     if (isRelPositioned())
         right += relativePositionOffsetX();
     return right;
 }
 
-int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSelf) const
+int RenderBox::leftmostPosition(bool /*includeOverflowInterior*/, bool includeSelf, ApplyTransform applyTransform) const
 {
-    if (!includeSelf || !height())
-        return width();
+    IntRect transformedRect = applyTransform == IncludeTransform && includeSelf ? transformedFrameRect() : frameRect();
+    if (!includeSelf || !transformedRect.height())
+        return transformedRect.width();
     int left = 0;
     if (isRelPositioned())
         left += relativePositionOffsetX();
@@ -3137,7 +3151,7 @@ bool RenderBox::shrinkToAvoidFloats() const
 
 bool RenderBox::avoidsFloats() const
 {
-    return isReplaced() || hasOverflowClip() || isHR() || isBlockFlowRoot();
+    return isReplaced() || hasOverflowClip() || isHR() || isWritingModeRoot();
 }
 
 void RenderBox::addShadowOverflow()
@@ -3215,19 +3229,18 @@ void RenderBox::clearLayoutOverflow()
     m_overflow->resetLayoutOverflow(borderBoxRect());
 }
 
-void RenderBox::markDescendantBlocksAndLinesForLayout(bool inLayout)
+int RenderBox::lineHeight(bool /*firstLine*/, LineDirectionMode direction, LinePositionMode /*linePositionMode*/) const
 {
-    if (!m_everHadLayout || isReplaced())
-        return;
-
-    setChildNeedsLayout(true, !inLayout);
+    if (isReplaced())
+        return direction == HorizontalLine ? m_marginTop + height() + m_marginBottom : m_marginRight + width() + m_marginLeft;
+    return 0;
+}
 
-    // Iterate over our children and mark them as needed.
-    for (RenderBox* child = firstChildBox(); child; child = child->nextSiblingBox()) {
-        if (child->isFloatingOrPositioned())
-            continue;
-        child->markDescendantBlocksAndLinesForLayout(inLayout);
-    }
+int RenderBox::baselinePosition(bool /*firstLine*/, LineDirectionMode direction, LinePositionMode /*linePositionMode*/) const
+{
+    if (isReplaced())
+        return direction == HorizontalLine ? m_marginTop + height() + m_marginBottom : m_marginRight + width() + m_marginLeft;
+    return 0;
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderBox.h b/WebCore/rendering/RenderBox.h
index 1b70fad..2e37657 100644
--- a/WebCore/rendering/RenderBox.h
+++ b/WebCore/rendering/RenderBox.h
@@ -50,41 +50,41 @@ public:
     void setWidth(int width) { m_frameRect.setWidth(width); }
     void setHeight(int height) { m_frameRect.setHeight(height); }
 
-    int logicalLeft() const { return style()->isVerticalBlockFlow() ? x() : y(); }
-    int logicalTop() const { return style()->isVerticalBlockFlow() ? y() : x(); }
-    int logicalWidth() const { return style()->isVerticalBlockFlow() ? width() : height(); }
-    int logicalHeight() const { return style()->isVerticalBlockFlow() ? height() : width(); }
+    int logicalLeft() const { return style()->isHorizontalWritingMode() ? x() : y(); }
+    int logicalTop() const { return style()->isHorizontalWritingMode() ? y() : x(); }
+    int logicalWidth() const { return style()->isHorizontalWritingMode() ? width() : height(); }
+    int logicalHeight() const { return style()->isHorizontalWritingMode() ? height() : width(); }
     void setLogicalLeft(int left)
     {
-        if (style()->isVerticalBlockFlow())
+        if (style()->isHorizontalWritingMode())
             setX(left);
         else
             setY(left);
     }
     void setLogicalTop(int top)
     {
-        if (style()->isVerticalBlockFlow())
+        if (style()->isHorizontalWritingMode())
             setY(top);
         else
             setX(top);
     }
     void setLogicalWidth(int size)
     {
-        if (style()->isVerticalBlockFlow())
+        if (style()->isHorizontalWritingMode())
             setWidth(size);
         else
             setHeight(size);
     }
     void setLogicalHeight(int size)
     {
-        if (style()->isVerticalBlockFlow())
+        if (style()->isHorizontalWritingMode())
             setHeight(size);
         else
             setWidth(size);
     }
     void setLogicalLocation(int left, int top)
     {
-        if (style()->isVerticalBlockFlow())
+        if (style()->isHorizontalWritingMode())
             setLocation(left, top);
         else
             setLocation(top, left);
@@ -103,6 +103,9 @@ public:
     IntRect frameRect() const { return m_frameRect; }
     void setFrameRect(const IntRect& rect) { m_frameRect = rect; }
 
+    IntRect transformedFrameRect() const;
+    IntRect applyLayerTransformToRect(const IntRect&) const;
+
     IntRect borderBoxRect() const { return IntRect(0, 0, width(), height()); }
     virtual IntRect borderBoundingBox() const { return borderBoxRect(); } 
     
@@ -127,19 +130,23 @@ public:
     int bottomVisibleOverflow() const { return hasOverflowClip() ? bottomVisualOverflow() : std::max(bottomLayoutOverflow(), bottomVisualOverflow()); }
     int leftVisibleOverflow() const { return hasOverflowClip() ? leftVisualOverflow() : std::min(leftLayoutOverflow(), leftVisualOverflow()); }
     int rightVisibleOverflow() const { return hasOverflowClip() ? rightVisualOverflow() :  std::max(rightLayoutOverflow(), rightVisualOverflow()); }
-    
+
     IntRect layoutOverflowRect() const { return m_overflow ? m_overflow->layoutOverflowRect() : borderBoxRect(); }
     int topLayoutOverflow() const { return m_overflow? m_overflow->topLayoutOverflow() : 0; }
     int bottomLayoutOverflow() const { return m_overflow ? m_overflow->bottomLayoutOverflow() : height(); }
     int leftLayoutOverflow() const { return m_overflow ? m_overflow->leftLayoutOverflow() : 0; }
     int rightLayoutOverflow() const { return m_overflow ? m_overflow->rightLayoutOverflow() : width(); }
+    int logicalLeftLayoutOverflow() const { return style()->isHorizontalWritingMode() ? leftLayoutOverflow() : topLayoutOverflow(); }
+    int logicalRightLayoutOverflow() const { return style()->isHorizontalWritingMode() ? rightLayoutOverflow() : bottomLayoutOverflow(); }
     
     IntRect visualOverflowRect() const { return m_overflow ? m_overflow->visualOverflowRect() : borderBoxRect(); }
     int topVisualOverflow() const { return m_overflow? m_overflow->topVisualOverflow() : 0; }
     int bottomVisualOverflow() const { return m_overflow ? m_overflow->bottomVisualOverflow() : height(); }
     int leftVisualOverflow() const { return m_overflow ? m_overflow->leftVisualOverflow() : 0; }
     int rightVisualOverflow() const { return m_overflow ? m_overflow->rightVisualOverflow() : width(); }
-
+    int logicalLeftVisualOverflow() const { return style()->isHorizontalWritingMode() ? leftVisualOverflow() : topVisualOverflow(); }
+    int logicalRightVisualOverflow() const { return style()->isHorizontalWritingMode() ? rightVisualOverflow() : bottomVisualOverflow(); }
+    
     void addLayoutOverflow(const IntRect&);
     void addVisualOverflow(const IntRect&);
     
@@ -150,8 +157,8 @@ public:
 
     int contentWidth() const { return clientWidth() - paddingLeft() - paddingRight(); }
     int contentHeight() const { return clientHeight() - paddingTop() - paddingBottom(); }
-    int contentLogicalWidth() const { return style()->isVerticalBlockFlow() ? contentWidth() : contentHeight(); }
-    int contentLogicalHeight() const { return style()->isVerticalBlockFlow() ? contentHeight() : contentWidth(); }
+    int contentLogicalWidth() const { return style()->isHorizontalWritingMode() ? contentWidth() : contentHeight(); }
+    int contentLogicalHeight() const { return style()->isHorizontalWritingMode() ? contentHeight() : contentWidth(); }
 
     // IE extensions. Used to calculate offsetWidth/Height.  Overridden by inlines (RenderFlow)
     // to return the remaining width on a given line (and the height of a single line).
@@ -181,6 +188,10 @@ public:
     virtual int marginBottom() const { return m_marginBottom; }
     virtual int marginLeft() const { return m_marginLeft; }
     virtual int marginRight() const { return m_marginRight; }
+    void setMarginTop(int margin) { m_marginTop = margin; }
+    void setMarginBottom(int margin) { m_marginBottom = margin; }
+    void setMarginLeft(int margin) { m_marginLeft = margin; }
+    void setMarginRight(int margin) { m_marginRight = margin; }
     virtual int marginBefore() const;
     virtual int marginAfter() const;
     virtual int marginStart() const;
@@ -189,7 +200,7 @@ public:
     void setMarginEnd(int);
     void setMarginBefore(int);
     void setMarginAfter(int);
-    
+
     // The following five functions are used to implement collapsing margins.
     // All objects know their maximal positive and negative margins.  The
     // formula for computing a collapsed margin is |maxPosMargin| - |maxNegmargin|.
@@ -198,24 +209,8 @@ public:
     // methods.
     enum MarginSign { PositiveMargin, NegativeMargin };
     virtual bool isSelfCollapsingBlock() const { return false; }
-    int collapsedMarginBefore() const
-    {
-        return maxMarginBefore(PositiveMargin) - maxMarginBefore(NegativeMargin);
-    }
-    int collapsedMarginAfter() const
-    { 
-        return maxMarginAfter(PositiveMargin) - maxMarginAfter(NegativeMargin);
-}
-    virtual int maxMarginBefore(MarginSign sign) const
-    { 
-        int beforeMargin = marginBefore();
-        return (sign == PositiveMargin) ? std::max(0, beforeMargin) : -std::min(0, beforeMargin);
-    }
-    virtual int maxMarginAfter(MarginSign sign) const
-    {
-        int afterMargin = marginAfter();
-        return (sign == PositiveMargin) ? std::max(0, afterMargin) : -std::min(0, afterMargin);
-    }
+    virtual int collapsedMarginBefore() const { return marginBefore(); }
+    virtual int collapsedMarginAfter() const { return marginAfter(); }
 
     virtual void absoluteRects(Vector<IntRect>&, int tx, int ty);
     virtual void absoluteQuads(Vector<FloatQuad>&);
@@ -267,9 +262,11 @@ public:
     void setInlineBoxWrapper(InlineBox* boxWrapper) { m_inlineBoxWrapper = boxWrapper; }
     void deleteLineBoxWrapper();
 
-    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+    enum ApplyTransform { IncludeTransform, ExcludeTransform };
+    virtual int topmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true,  ApplyTransform = IncludeTransform) const;
+    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
 
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual void computeRectForRepaint(RenderBoxModelObject* repaintContainer, IntRect&, bool fixed = false);
@@ -282,12 +279,14 @@ public:
     virtual void computeLogicalWidth();
     virtual void computeLogicalHeight();
 
-    bool stretchesToViewHeight() const
+    bool stretchesToViewport() const
     {
-        return document()->inQuirksMode() && style()->height().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody()) && !isBlockFlowRoot();
+        return document()->inQuirksMode() && style()->logicalHeight().isAuto() && !isFloatingOrPositioned() && (isRoot() || isBody()) && !isWritingModeRoot();
     }
 
     virtual IntSize intrinsicSize() const { return IntSize(); }
+    int intrinsicLogicalWidth() const { return style()->isHorizontalWritingMode() ? intrinsicSize().width() : intrinsicSize().height(); }
+    int intrinsicLogicalHeight() const { return style()->isHorizontalWritingMode() ? intrinsicSize().height() : intrinsicSize().width(); }
 
     // Whether or not the element shrinks to its intrinsic width (rather than filling the width
     // of a containing block).  HTML4 buttons, <select>s, <input>s, legends, and floating/compact elements do this.
@@ -296,11 +295,11 @@ public:
 
     int computeLogicalWidthUsing(LogicalWidthType, int availableLogicalWidth);
     int computeLogicalHeightUsing(const Length& height);
-    int computeReplacedWidthUsing(Length width) const;
-    int computeReplacedHeightUsing(Length height) const;
+    int computeReplacedLogicalWidthUsing(Length width) const;
+    int computeReplacedLogicalHeightUsing(Length height) const;
 
-    virtual int computeReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int computeReplacedHeight() const;
+    virtual int computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
+    virtual int computeReplacedLogicalHeight() const;
 
     int computePercentageLogicalHeight(const Length& height);
 
@@ -311,11 +310,12 @@ public:
     
     // There are a few cases where we need to refer specifically to the available physical width and available physical height.
     // Relative positioning is one of those cases, since left/top offsets are physical.
-    int availableWidth() const { return style()->isVerticalBlockFlow() ? availableLogicalWidth() : availableLogicalHeight(); }
-    int availableHeight() const { return style()->isVerticalBlockFlow() ? availableLogicalHeight() : availableLogicalWidth(); }
+    int availableWidth() const { return style()->isHorizontalWritingMode() ? availableLogicalWidth() : availableLogicalHeight(); }
+    int availableHeight() const { return style()->isHorizontalWritingMode() ? availableLogicalHeight() : availableLogicalWidth(); }
 
     virtual int verticalScrollbarWidth() const;
     int horizontalScrollbarHeight() const;
+    int scrollbarLogicalHeight() const { return style()->isHorizontalWritingMode() ? horizontalScrollbarHeight() : verticalScrollbarWidth(); }
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1, Node** stopNode = 0);
     bool canBeScrolledAndHasScrollableArea() const;
     virtual bool canBeProgramaticallyScrolled(bool) const;
@@ -367,9 +367,12 @@ public:
     bool shrinkToAvoidFloats() const;
     virtual bool avoidsFloats() const;
 
-    virtual void markDescendantBlocksAndLinesForLayout(bool inLayout = true);
+    virtual void markForPaginationRelayoutIfNeeded() { }
+
+    bool isWritingModeRoot() const { return !parent() || parent()->style()->writingMode() != style()->writingMode(); }
     
-    bool isBlockFlowRoot() const { return !parent() || parent()->style()->blockFlow() != style()->blockFlow(); }
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
 #ifdef ANDROID_LAYOUT
     int getVisibleWidth() const { return m_visibleWidth; }
@@ -426,16 +429,6 @@ private:
     // These include tables, positioned objects, floats and flexible boxes.
     virtual void computePreferredLogicalWidths() { setPreferredLogicalWidthsDirty(false); }
 
-    void setMarginStartUsing(const RenderStyle*, int);
-    void setMarginEndUsing(const RenderStyle*, int);
-    void setMarginBeforeUsing(const RenderStyle*, int);
-    void setMarginAfterUsing(const RenderStyle*, int);
-
-    int marginStartUsing(const RenderStyle*) const;
-    int marginEndUsing(const RenderStyle*) const;
-    int marginBeforeUsing(const RenderStyle*) const;
-    int marginAfterUsing(const RenderStyle*) const;
-
 private:
     // The width/height of the contents + borders + padding.  The x/y location is relative to our container (which is not always our parent).
     IntRect m_frameRect;
diff --git a/WebCore/rendering/RenderBoxModelObject.cpp b/WebCore/rendering/RenderBoxModelObject.cpp
index bbb9c2c..ec065a6 100644
--- a/WebCore/rendering/RenderBoxModelObject.cpp
+++ b/WebCore/rendering/RenderBoxModelObject.cpp
@@ -324,7 +324,7 @@ int RenderBoxModelObject::relativePositionOffsetX() const
     // call availableWidth on our containing block.
     if (!style()->left().isAuto()) {
         RenderBlock* cb = containingBlock();
-        if (!style()->right().isAuto() && containingBlock()->style()->direction() == RTL)
+        if (!style()->right().isAuto() && !containingBlock()->style()->isLeftToRightDirection())
             return -style()->right().calcValue(cb->availableWidth());
         return style()->left().calcValue(cb->availableWidth());
     }
@@ -348,13 +348,13 @@ int RenderBoxModelObject::relativePositionOffsetY() const
     if (!style()->top().isAuto()
         && (!containingBlock->style()->height().isAuto()
             || !style()->top().isPercent()
-            || containingBlock->stretchesToViewHeight()))
+            || containingBlock->stretchesToViewport()))
         return style()->top().calcValue(containingBlock->availableHeight());
 
     if (!style()->bottom().isAuto()
         && (!containingBlock->style()->height().isAuto()
             || !style()->bottom().isPercent()
-            || containingBlock->stretchesToViewHeight()))
+            || containingBlock->stretchesToViewport()))
         return -style()->bottom().calcValue(containingBlock->availableHeight());
 
     return 0;
@@ -855,23 +855,25 @@ int RenderBoxModelObject::verticalPosition(bool firstLine) const
         const Font& f = parent()->style(firstLine)->font();
         int fontsize = f.pixelSize();
 
+        LineDirectionMode lineDirection = parent()->style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine;
+
         if (va == SUB)
             vpos += fontsize / 5 + 1;
         else if (va == SUPER)
             vpos -= fontsize / 3 + 1;
         else if (va == TEXT_TOP)
-            vpos += baselinePosition(firstLine) - f.ascent();
+            vpos += baselinePosition(firstLine, lineDirection) - f.ascent();
         else if (va == MIDDLE)
-            vpos += -static_cast<int>(f.xHeight() / 2) - lineHeight(firstLine) / 2 + baselinePosition(firstLine);
+            vpos += -static_cast<int>(f.xHeight() / 2) - lineHeight(firstLine, lineDirection) / 2 + baselinePosition(firstLine, lineDirection);
         else if (va == TEXT_BOTTOM) {
             vpos += f.descent();
             // lineHeight - baselinePosition is always 0 for replaced elements (except inline blocks), so don't bother wasting time in that case.
             if (!isReplaced() || style()->display() == INLINE_BLOCK)
-                vpos -= (lineHeight(firstLine) - baselinePosition(firstLine));
+                vpos -= (lineHeight(firstLine, lineDirection) - baselinePosition(firstLine, lineDirection));
         } else if (va == BASELINE_MIDDLE)
-            vpos += -lineHeight(firstLine) / 2 + baselinePosition(firstLine);
+            vpos += -lineHeight(firstLine, lineDirection) / 2 + baselinePosition(firstLine, lineDirection);
         else if (va == LENGTH)
-            vpos -= style()->verticalAlignLength().calcValue(lineHeight(firstLine));
+            vpos -= style()->verticalAlignLength().calcValue(lineHeight(firstLine, lineDirection));
     }
 
     return vpos;
@@ -1061,7 +1063,7 @@ void RenderBoxModelObject::paintBorder(GraphicsContext* graphicsContext, int tx,
         graphicsContext->addRoundedRectClip(borderRect, topLeft, topRight, bottomLeft, bottomRight);
         graphicsContext->clipOutRoundedRect(innerBorderRect, innerTopLeftRadius, innerTopRightRadius, innerBottomLeftRadius, innerBottomRightRadius);
 
-        roundedPath = Path::createRoundedRectangle(borderRect, topLeft, topRight, bottomLeft, bottomRight);
+        roundedPath.addRoundedRect(borderRect, topLeft, topRight, bottomLeft, bottomRight);
         graphicsContext->addPath(roundedPath);
     }
 
@@ -1752,24 +1754,29 @@ void RenderBoxModelObject::paintBoxShadow(GraphicsContext* context, int tx, int
 
             context->save();
 
-            if (hasBorderRadius)
-                context->clip(Path::createRoundedRectangle(rect, topLeft, topRight, bottomLeft, bottomRight));
-            else
+            Path path;
+            if (hasBorderRadius) {
+                path.addRoundedRect(rect, topLeft, topRight, bottomLeft, bottomRight);
+                context->clip(path);
+                path.clear();
+            } else
                 context->clip(rect);
 
             IntSize extraOffset(2 * w + max(0, shadowOffset.width()) + shadowBlur - 2 * shadowSpread + 1, 0);
             context->translate(extraOffset.width(), extraOffset.height());
             shadowOffset -= extraOffset;
 
-            context->beginPath();
-            context->addPath(Path::createRectangle(outerRect));
+            path.addRect(outerRect);
 
             if (hasBorderRadius) {
                 if (shadowSpread > 0)
                     uniformlyExpandBorderRadii(-shadowSpread, topLeft, topRight, bottomLeft, bottomRight);
-                context->addPath(Path::createRoundedRectangle(holeRect, topLeft, topRight, bottomLeft, bottomRight));
+                path.addRoundedRect(holeRect, topLeft, topRight, bottomLeft, bottomRight);
             } else
-                context->addPath(Path::createRectangle(holeRect));
+                path.addRect(holeRect);
+
+            context->beginPath();
+            context->addPath(path);
 
             context->setFillRule(RULE_EVENODD);
             context->setFillColor(fillColor, s->colorSpace());
diff --git a/WebCore/rendering/RenderBoxModelObject.h b/WebCore/rendering/RenderBoxModelObject.h
index 83c9367..33d7ca2 100644
--- a/WebCore/rendering/RenderBoxModelObject.h
+++ b/WebCore/rendering/RenderBoxModelObject.h
@@ -33,6 +33,10 @@ const int PositionTop = -0x7fffffff;
 const int PositionBottom = 0x7fffffff;
 const int PositionUndefined = 0x80000000;
 
+// Modes for some of the line-related functions.
+enum LinePositionMode { PositionOnContainingLine, PositionOfInteriorLineBoxes };
+enum LineDirectionMode { HorizontalLine, VerticalLine };
+
 // This class is the base for all objects that adhere to the CSS box model as described
 // at http://www.w3.org/TR/CSS21/box.html
 
@@ -98,8 +102,8 @@ public:
     virtual int marginStart() const = 0;
     virtual int marginEnd() const = 0;
 
-    bool hasHorizontalBordersPaddingOrMargin() const { return hasHorizontalBordersOrPadding() || marginLeft() != 0 || marginRight() != 0; }
-    bool hasHorizontalBordersOrPadding() const { return borderLeft() != 0 || borderRight() != 0 || paddingLeft() != 0 || paddingRight() != 0; }
+    bool hasInlineDirectionBordersPaddingOrMargin() const { return hasInlineDirectionBordersOrPadding() || marginStart()|| marginEnd(); }
+    bool hasInlineDirectionBordersOrPadding() const { return borderStart() || borderEnd() || paddingStart()|| paddingEnd(); }
 
     virtual int containingBlockLogicalWidthForContent() const;
 
@@ -112,6 +116,10 @@ public:
 
     // The difference between this inline's baseline position and the line's baseline position.
     int verticalPosition(bool firstLine) const;
+    
+    // Overridden by subclasses to determine line height and baseline position.
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const = 0;
 
     // Called by RenderObject::destroy() (and RenderWidget::destroy()) and is the only way layers should ever be destroyed
     void destroyLayer();
diff --git a/WebCore/rendering/RenderButton.cpp b/WebCore/rendering/RenderButton.cpp
index 8357bd4..2642f23 100644
--- a/WebCore/rendering/RenderButton.cpp
+++ b/WebCore/rendering/RenderButton.cpp
@@ -45,6 +45,10 @@ RenderButton::RenderButton(Node* node)
 {
 }
 
+RenderButton::~RenderButton()
+{
+}
+
 void RenderButton::addChild(RenderObject* newChild, RenderObject* beforeChild)
 {
     if (!m_inner) {
diff --git a/WebCore/rendering/RenderButton.h b/WebCore/rendering/RenderButton.h
index 1fc5eb6..252edb4 100644
--- a/WebCore/rendering/RenderButton.h
+++ b/WebCore/rendering/RenderButton.h
@@ -34,7 +34,8 @@ class RenderTextFragment;
 // to date as the button changes.
 class RenderButton : public RenderFlexibleBox {
 public:
-    RenderButton(Node*);
+    explicit RenderButton(Node*);
+    virtual ~RenderButton();
 
     virtual const char* renderName() const { return "RenderButton"; }
     virtual bool isRenderButton() const { return true; }
diff --git a/WebCore/rendering/RenderCounter.cpp b/WebCore/rendering/RenderCounter.cpp
index 639221d..c357be1 100644
--- a/WebCore/rendering/RenderCounter.cpp
+++ b/WebCore/rendering/RenderCounter.cpp
@@ -35,7 +35,7 @@ namespace WebCore {
 
 using namespace HTMLNames;
 
-typedef HashMap<RefPtr<AtomicStringImpl>, CounterNode*> CounterMap;
+typedef HashMap<RefPtr<AtomicStringImpl>, RefPtr<CounterNode> > CounterMap;
 typedef HashMap<const RenderObject*, CounterMap*> CounterMaps;
 
 static CounterNode* makeCounterNode(RenderObject*, const AtomicString& identifier, bool alwaysCreateCounter);
@@ -235,10 +235,12 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
 {
     ASSERT(object);
 
-    if (object->m_hasCounterNodeMap)
-        if (CounterMap* nodeMap = counterMaps().get(object))
-            if (CounterNode* node = nodeMap->get(identifier.impl()))
+    if (object->m_hasCounterNodeMap) {
+        if (CounterMap* nodeMap = counterMaps().get(object)) {
+            if (CounterNode* node = nodeMap->get(identifier.impl()).get())
                 return node;
+        }
+    }
 
     bool isReset = false;
     int value = 0;
@@ -247,9 +249,9 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
 
     CounterNode* newParent = 0;
     CounterNode* newPreviousSibling = 0;
-    CounterNode* newNode = new CounterNode(object, isReset, value);
+    RefPtr<CounterNode> newNode = CounterNode::create(object, isReset, value);
     if (findPlaceForCounter(object, identifier, isReset, newParent, newPreviousSibling))
-        newParent->insertAfter(newNode, newPreviousSibling, identifier);
+        newParent->insertAfter(newNode.get(), newPreviousSibling, identifier);
     CounterMap* nodeMap;
     if (object->m_hasCounterNodeMap)
         nodeMap = counterMaps().get(object);
@@ -260,7 +262,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
     }
     nodeMap->set(identifier.impl(), newNode);
     if (newNode->parent() || !object->nextInPreOrder(object->parent()))
-        return newNode;
+        return newNode.get();
     // Checking if some nodes that were previously counter tree root nodes
     // should become children of this node now.
     CounterMaps& maps = counterMaps();
@@ -268,7 +270,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
     for (RenderObject* currentRenderer = object->nextInPreOrder(stayWithin); currentRenderer; currentRenderer = currentRenderer->nextInPreOrder(stayWithin)) {
         if (!currentRenderer->m_hasCounterNodeMap)
             continue;
-        CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl());
+        CounterNode* currentCounter = maps.get(currentRenderer)->get(identifier.impl()).get();
         if (!currentCounter)
             continue;
         if (currentCounter->parent()) {
@@ -282,7 +284,7 @@ static CounterNode* makeCounterNode(RenderObject* object, const AtomicString& id
         if (currentRenderer->lastChild())
             currentRenderer = currentRenderer->lastChild();
     }
-    return newNode;
+    return newNode.get();
 }
 
 RenderCounter::RenderCounter(Document* node, const CounterContent& counter)
@@ -292,6 +294,10 @@ RenderCounter::RenderCounter(Document* node, const CounterContent& counter)
 {
 }
 
+RenderCounter::~RenderCounter()
+{
+}
+
 const char* RenderCounter::renderName() const
 {
     return "RenderCounter";
@@ -345,9 +351,9 @@ void RenderCounter::invalidate(const AtomicString& identifier)
 static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier, CounterNode* node)
 {
     CounterNode* previous;
-    for (CounterNode* child = node->lastDescendant(); child && child != node; child = previous) {
+    for (RefPtr<CounterNode> child = node->lastDescendant(); child && child != node; child = previous) {
         previous = child->previousInPreOrder();
-        child->parent()->removeChild(child, identifier);
+        child->parent()->removeChild(child.get(), identifier);
         ASSERT(counterMaps().get(child->renderer())->get(identifier.impl()) == child);
         counterMaps().get(child->renderer())->remove(identifier.impl());
         if (!child->renderer()->documentBeingDestroyed()) {
@@ -355,7 +361,6 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
             if (children)
                 children->invalidateCounters(child->renderer(), identifier);
         }
-        delete child;
     }
     RenderObject* renderer = node->renderer();
     if (!renderer->documentBeingDestroyed()) {
@@ -364,7 +369,6 @@ static void destroyCounterNodeWithoutMapRemoval(const AtomicString& identifier,
     }
     if (CounterNode* parent = node->parent())
         parent->removeChild(node, identifier);
-    delete node;
 }
 
 void RenderCounter::destroyCounterNodes(RenderObject* renderer)
@@ -377,7 +381,7 @@ void RenderCounter::destroyCounterNodes(RenderObject* renderer)
     CounterMap::const_iterator end = map->end();
     for (CounterMap::const_iterator it = map->begin(); it != end; ++it) {
         AtomicString identifier(it->first.get());
-        destroyCounterNodeWithoutMapRemoval(identifier, it->second);
+        destroyCounterNodeWithoutMapRemoval(identifier, it->second.get());
     }
     maps.remove(mapsIterator);
     delete map;
@@ -392,7 +396,7 @@ void RenderCounter::destroyCounterNode(RenderObject* renderer, const AtomicStrin
     CounterMap::iterator mapIterator = map->find(identifier.impl());
     if (mapIterator == map->end())
         return;
-    destroyCounterNodeWithoutMapRemoval(identifier, mapIterator->second);
+    destroyCounterNodeWithoutMapRemoval(identifier, mapIterator->second.get());
     map->remove(mapIterator);
     // We do not delete "map" here even if empty because we expect to reuse
     // it soon. In order for a renderer to lose all its counters permanently,
@@ -422,21 +426,24 @@ static void updateCounters(RenderObject* renderer)
     CounterMap* counterMap = counterMaps().get(renderer);
     ASSERT(counterMap);
     for (CounterDirectiveMap::const_iterator it = directiveMap->begin(); it != end; ++it) {
-        CounterNode* node = counterMap->get(it->first.get());
+        RefPtr<CounterNode> node = counterMap->get(it->first.get());
         if (!node) {
             makeCounterNode(renderer, AtomicString(it->first.get()), false);
             continue;
         }
         CounterNode* newParent = 0;
         CounterNode* newPreviousSibling;
+        
         findPlaceForCounter(renderer, AtomicString(it->first.get()), node->hasResetType(), newParent, newPreviousSibling);
+        if (node != counterMap->get(it->first.get()))
+            continue;
         CounterNode* parent = node->parent();
         if (newParent == parent && newPreviousSibling == node->previousSibling())
             continue;
         if (parent)
-            parent->removeChild(node, it->first.get());
+            parent->removeChild(node.get(), it->first.get());
         if (newParent)
-            newParent->insertAfter(node, newPreviousSibling, it->first.get());
+            newParent->insertAfter(node.get(), newPreviousSibling, it->first.get());
     }
 }
 
diff --git a/WebCore/rendering/RenderCounter.h b/WebCore/rendering/RenderCounter.h
index 8d981df..9373193 100644
--- a/WebCore/rendering/RenderCounter.h
+++ b/WebCore/rendering/RenderCounter.h
@@ -32,6 +32,7 @@ class CounterNode;
 class RenderCounter : public RenderText {
 public:
     RenderCounter(Document*, const CounterContent&);
+    virtual ~RenderCounter();
 
     // Removes the reference to the CounterNode associated with this renderer
     // if its identifier matches the argument.
diff --git a/WebCore/rendering/RenderEmbeddedObject.cpp b/WebCore/rendering/RenderEmbeddedObject.cpp
index aa301e2..16613a5 100644
--- a/WebCore/rendering/RenderEmbeddedObject.cpp
+++ b/WebCore/rendering/RenderEmbeddedObject.cpp
@@ -206,7 +206,7 @@ bool RenderEmbeddedObject::getReplacementTextGeometry(int tx, int ty, FloatRect&
     float y = (contentRect.size().height() / 2 - replacementTextRect.size().height() / 2) + contentRect.location().y();
     replacementTextRect.setLocation(FloatPoint(x, y));
     
-    path = Path::createRoundedRectangle(replacementTextRect, FloatSize(replacementTextRoundedRectRadius, replacementTextRoundedRectRadius));
+    path.addRoundedRect(replacementTextRect, FloatSize(replacementTextRoundedRectRadius, replacementTextRoundedRectRadius));
 
     return true;
 }
diff --git a/WebCore/rendering/RenderFieldset.cpp b/WebCore/rendering/RenderFieldset.cpp
index d3b88c1..12386e9 100644
--- a/WebCore/rendering/RenderFieldset.cpp
+++ b/WebCore/rendering/RenderFieldset.cpp
@@ -71,34 +71,43 @@ RenderObject* RenderFieldset::layoutLegend(bool relayoutChildren)
             legend->setNeedsLayout(true);
         legend->layoutIfNeeded();
 
-        int xPos;
-        if (style()->direction() == RTL) {
+        int logicalLeft;
+        if (style()->isLeftToRightDirection()) {
             switch (legend->style()->textAlign()) {
-                case LEFT:
-                    xPos = borderLeft() + paddingLeft();
-                    break;
-                case CENTER:
-                    xPos = (width() - legend->width()) / 2;
-                    break;
-                default:
-                    xPos = width() - paddingRight() - borderRight() - legend->width() - legend->marginRight();
+            case CENTER:
+                logicalLeft = (logicalWidth() - logicalWidthForChild(legend)) / 2;
+                break;
+            case RIGHT:
+                logicalLeft = logicalWidth() - borderEnd() - paddingEnd() - logicalWidthForChild(legend);
+                break;
+            default:
+                logicalLeft = borderStart() + paddingStart() + marginStartForChild(legend);
+                break;
             }
         } else {
             switch (legend->style()->textAlign()) {
-                case RIGHT:
-                    xPos = width() - paddingRight() - borderRight() - legend->width();
-                    break;
-                case CENTER:
-                    xPos = (width() - legend->width()) / 2;
-                    break;
-                default:
-                    xPos = borderLeft() + paddingLeft() + legend->marginLeft();
+            case LEFT:
+                logicalLeft = borderStart() + paddingStart();
+                break;
+            case CENTER: {
+                // Make sure that the extra pixel goes to the end side in RTL (since it went to the end side
+                // in LTR).
+                int centeredWidth = logicalWidth() - logicalWidthForChild(legend);
+                logicalLeft = centeredWidth - centeredWidth / 2;
+                break;
+            }
+            default:
+                logicalLeft = logicalWidth() - borderStart() - paddingStart() - marginStartForChild(legend) - logicalWidthForChild(legend);
+                break;
             }
         }
-        int b = borderTop();
-        int h = legend->height();
-        legend->setLocation(xPos, max((b-h)/2, 0));
-        setHeight(max(b, h) + paddingTop());
+
+        setLogicalLeftForChild(legend, logicalLeft);
+
+        int b = borderBefore();
+        int h = logicalHeightForChild(legend);
+        setLogicalTopForChild(legend, max((b - h) / 2, 0));
+        setLogicalHeight(max(b, h) + paddingBefore());
     }
     return legend;
 }
@@ -129,10 +138,18 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
     if (!legend)
         return RenderBlock::paintBoxDecorations(paintInfo, tx, ty);
 
-    int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
-    int legendBottom = ty + legend->y() + legend->height();
-    h -= yOff;
-    ty += yOff;
+    // FIXME: We need to work with "rl" and "bt" block flow directions.  In those
+    // cases the legend is embedded in the right and bottom borders respectively.
+    // https://bugs.webkit.org/show_bug.cgi?id=47236
+    if (style()->isHorizontalWritingMode()) {
+        int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+        h -= yOff;
+        ty += yOff;
+    } else {
+        int xOff = (legend->x() > 0) ? 0 : (legend->width() - borderLeft()) / 2;
+        w -= xOff;
+        tx += xOff;
+    }
 
     paintBoxShadow(paintInfo.context, tx, ty, w, h, style(), Normal);
 
@@ -141,21 +158,24 @@ void RenderFieldset::paintBoxDecorations(PaintInfo& paintInfo, int tx, int ty)
 
     if (!style()->hasBorder())
         return;
-
-    // Save time by not saving and restoring the GraphicsContext in the straight border case
-    if (!style()->hasBorderRadius())
-        return paintBorderMinusLegend(paintInfo.context, tx, ty, w, h, style(), legend->x(), legend->width(), legendBottom);
     
-    // We have rounded borders, create a clipping region 
-    // around the legend and paint the border as normal
+    // Create a clipping region around the legend and paint the border as normal
     GraphicsContext* graphicsContext = paintInfo.context;
     graphicsContext->save();
 
-    int clipTop = ty;
-    int clipHeight = max(static_cast<int>(style()->borderTopWidth()), legend->height());
+    // FIXME: We need to work with "rl" and "bt" block flow directions.  In those
+    // cases the legend is embedded in the right and bottom borders respectively.
+    // https://bugs.webkit.org/show_bug.cgi?id=47236
+    if (style()->isHorizontalWritingMode()) {
+        int clipTop = ty;
+        int clipHeight = max(static_cast<int>(style()->borderTopWidth()), legend->height());
+        graphicsContext->clipOut(IntRect(tx + legend->x(), clipTop, legend->width(), clipHeight));
+    } else {
+        int clipLeft = tx;
+        int clipWidth = max(static_cast<int>(style()->borderLeftWidth()), legend->width());
+        graphicsContext->clipOut(IntRect(clipLeft, ty + legend->y(), clipWidth, legend->height()));
+    }
 
-    graphicsContext->clipOut(IntRect(tx + legend->x(), clipTop,
-                                       legend->width(), clipHeight));
     paintBorder(paintInfo.context, tx, ty, w, h, style(), true, true);
 
     graphicsContext->restore();
@@ -172,95 +192,20 @@ void RenderFieldset::paintMask(PaintInfo& paintInfo, int tx, int ty)
     if (!legend)
         return RenderBlock::paintMask(paintInfo, tx, ty);
 
-    int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
-    h -= yOff;
-    ty += yOff;
-
-    paintMaskImages(paintInfo, tx, ty, w, h);
-}
-        
-void RenderFieldset::paintBorderMinusLegend(GraphicsContext* graphicsContext, int tx, int ty, int w, int h,
-                                            const RenderStyle* style, int lx, int lw, int lb)
-{
-    const Color& tc = style->visitedDependentColor(CSSPropertyBorderTopColor);
-    const Color& bc = style->visitedDependentColor(CSSPropertyBorderBottomColor);
-
-    EBorderStyle ts = style->borderTopStyle();
-    EBorderStyle bs = style->borderBottomStyle();
-    EBorderStyle ls = style->borderLeftStyle();
-    EBorderStyle rs = style->borderRightStyle();
-
-    bool render_t = ts > BHIDDEN;
-    bool render_l = ls > BHIDDEN;
-    bool render_r = rs > BHIDDEN;
-    bool render_b = bs > BHIDDEN;
-
-    int borderLeftWidth = style->borderLeftWidth();
-    int borderRightWidth = style->borderRightWidth();
-
-    if (render_t) {
-        if (lx >= borderLeftWidth)
-            drawLineForBoxSide(graphicsContext, tx, ty, tx + min(lx, w), ty + style->borderTopWidth(), BSTop, tc, ts,
-                       (render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? borderLeftWidth : 0),
-                       (lx >= w && render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? borderRightWidth : 0));
-        if (lx + lw <=  w - borderRightWidth)
-            drawLineForBoxSide(graphicsContext, tx + max(0, lx + lw), ty, tx + w, ty + style->borderTopWidth(), BSTop, tc, ts,
-                       (lx + lw <= 0 && render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? borderLeftWidth : 0),
-                       (render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? borderRightWidth : 0));
+    // FIXME: We need to work with "rl" and "bt" block flow directions.  In those
+    // cases the legend is embedded in the right and bottom borders respectively.
+    // https://bugs.webkit.org/show_bug.cgi?id=47236
+    if (style()->isHorizontalWritingMode()) {
+        int yOff = (legend->y() > 0) ? 0 : (legend->height() - borderTop()) / 2;
+        h -= yOff;
+        ty += yOff;
+    } else {
+        int xOff = (legend->x() > 0) ? 0 : (legend->width() - borderLeft()) / 2;
+        w -= xOff;
+        tx += xOff;
     }
 
-    if (render_b)
-        drawLineForBoxSide(graphicsContext, tx, ty + h - style->borderBottomWidth(), tx + w, ty + h, BSBottom, bc, bs,
-                   (render_l && (ls == DOTTED || ls == DASHED || ls == DOUBLE) ? style->borderLeftWidth() : 0),
-                   (render_r && (rs == DOTTED || rs == DASHED || rs == DOUBLE) ? style->borderRightWidth() : 0));
-
-    if (render_l) {
-        const Color& lc = style->visitedDependentColor(CSSPropertyBorderLeftColor);
-        int startY = ty;
-
-        bool ignore_top =
-            (tc == lc) &&
-            (ls >= OUTSET) &&
-            (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET);
-
-        bool ignore_bottom =
-            (bc == lc) &&
-            (ls >= OUTSET) &&
-            (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET);
-
-        if (lx < borderLeftWidth && lx + lw > 0) {
-            // The legend intersects the border.
-            ignore_top = true;
-            startY = lb;
-        }
-
-        drawLineForBoxSide(graphicsContext, tx, startY, tx + borderLeftWidth, ty + h, BSLeft, lc, ls,
-                           ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
-    }
-
-    if (render_r) {
-        const Color& rc = style->visitedDependentColor(CSSPropertyBorderRightColor);
-        int startY = ty;
-
-        bool ignore_top =
-            (tc == rc) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (ts == DOTTED || ts == DASHED || ts == SOLID || ts == OUTSET);
-
-        bool ignore_bottom =
-            (bc == rc) &&
-            (rs >= DOTTED || rs == INSET) &&
-            (bs == DOTTED || bs == DASHED || bs == SOLID || bs == INSET);
-
-        if (lx < w && lx + lw > w - borderRightWidth) {
-            // The legend intersects the border.
-            ignore_top = true;
-            startY = lb;
-        }
-
-        drawLineForBoxSide(graphicsContext, tx + w - borderRightWidth, startY, tx + w, ty + h, BSRight, rc, rs,
-                   ignore_top ? 0 : style->borderTopWidth(), ignore_bottom ? 0 : style->borderBottomWidth());
-    }
+    paintMaskImages(paintInfo, tx, ty, w, h);
 }
 
 void RenderFieldset::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
diff --git a/WebCore/rendering/RenderFieldset.h b/WebCore/rendering/RenderFieldset.h
index bc8e8ae..bada78c 100644
--- a/WebCore/rendering/RenderFieldset.h
+++ b/WebCore/rendering/RenderFieldset.h
@@ -30,7 +30,7 @@ namespace WebCore {
 
 class RenderFieldset : public RenderBlock {
 public:
-    RenderFieldset(Node*);
+    explicit RenderFieldset(Node*);
 
     RenderBox* findLegend() const;
 
@@ -48,8 +48,6 @@ private:
 
     virtual void paintBoxDecorations(PaintInfo&, int tx, int ty);
     virtual void paintMask(PaintInfo&, int tx, int ty);
-
-    void paintBorderMinusLegend(GraphicsContext*, int tx, int ty, int w, int h, const RenderStyle*, int lx, int lw, int lb);
 };
 
 inline RenderFieldset* toRenderFieldset(RenderObject* object)
diff --git a/WebCore/rendering/RenderFileUploadControl.cpp b/WebCore/rendering/RenderFileUploadControl.cpp
index cdb0470..3da8530 100644
--- a/WebCore/rendering/RenderFileUploadControl.cpp
+++ b/WebCore/rendering/RenderFileUploadControl.cpp
@@ -124,8 +124,11 @@ void RenderFileUploadControl::chooseIconForFiles(FileChooser* chooser, const Vec
 
 void RenderFileUploadControl::click()
 {
+    // Requires a user gesture to open the file dialog.
+    if (!frame() || !frame()->loader()->isProcessingUserGesture())
+        return;
     if (Chrome* chromePointer = chrome())
-        chromePointer->runOpenPanel(node()->document()->frame(), m_fileChooser);
+        chromePointer->runOpenPanel(frame(), m_fileChooser);
 }
 
 Chrome* RenderFileUploadControl::chrome() const
@@ -213,14 +216,14 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
         const String& displayedFilename = fileTextValue();
         unsigned length = displayedFilename.length();
         const UChar* string = displayedFilename.characters();
-        TextRun textRun(string, length, false, 0, 0, style()->direction() == RTL, style()->unicodeBidi() == Override);
+        TextRun textRun(string, length, false, 0, 0, !style()->isLeftToRightDirection(), style()->unicodeBidi() == Override);
         
         // Determine where the filename should be placed
         int contentLeft = tx + borderLeft() + paddingLeft();
         int buttonAndIconWidth = m_button->renderBox()->width() + afterButtonSpacing
             + (m_fileChooser->icon() ? iconWidth + iconFilenameSpacing : 0);
         int textX;
-        if (style()->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             textX = contentLeft + buttonAndIconWidth;
         else
             textX = contentLeft + contentWidth() - buttonAndIconWidth - style()->font().width(textRun);
@@ -228,7 +231,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
         RenderButton* buttonRenderer = toRenderButton(m_button->renderer());
         int textY = buttonRenderer->absoluteBoundingBoxRect().y()
             + buttonRenderer->marginTop() + buttonRenderer->borderTop() + buttonRenderer->paddingTop()
-            + buttonRenderer->baselinePosition(true, false);
+            + buttonRenderer->baselinePosition(true, HorizontalLine, PositionOnContainingLine);
 
         paintInfo.context->setFillColor(style()->visitedDependentColor(CSSPropertyColor), style()->colorSpace());
         
@@ -239,7 +242,7 @@ void RenderFileUploadControl::paintObject(PaintInfo& paintInfo, int tx, int ty)
             // Determine where the icon should be placed
             int iconY = ty + borderTop() + paddingTop() + (contentHeight() - iconHeight) / 2;
             int iconX;
-            if (style()->direction() == LTR)
+            if (style()->isLeftToRightDirection())
                 iconX = contentLeft + m_button->renderBox()->width() + afterButtonSpacing;
             else
                 iconX = contentLeft + contentWidth() - m_button->renderBox()->width() - afterButtonSpacing - iconWidth;
diff --git a/WebCore/rendering/RenderFlexibleBox.cpp b/WebCore/rendering/RenderFlexibleBox.cpp
index 636c873..83ec721 100644
--- a/WebCore/rendering/RenderFlexibleBox.cpp
+++ b/WebCore/rendering/RenderFlexibleBox.cpp
@@ -44,7 +44,7 @@ public:
     FlexBoxIterator(RenderFlexibleBox* parent)
     {
         box = parent;
-        if (box->style()->boxOrient() == HORIZONTAL && box->style()->direction() == RTL)
+        if (box->style()->boxOrient() == HORIZONTAL && !box->style()->isLeftToRightDirection())
             forward = box->style()->boxDirection() != BNORMAL;
         else
             forward = box->style()->boxDirection() == BNORMAL;
@@ -266,12 +266,12 @@ void RenderFlexibleBox::layoutBlock(bool relayoutChildren, int /*pageHeight FIXM
         // bottom margin max values to 0.  This way we don't factor in the values
         // twice when we collapse with our previous vertically adjacent and
         // following vertically adjacent blocks.
-        int pos = maxPosMarginBefore();
-        int neg = maxNegMarginBefore();
-        if (maxPosMarginAfter() > pos)
-            pos = maxPosMarginAfter();
-        if (maxNegMarginAfter() > neg)
-            neg = maxNegMarginAfter();
+        int pos = maxPositiveMarginBefore();
+        int neg = maxNegativeMarginBefore();
+        if (maxPositiveMarginAfter() > pos)
+            pos = maxPositiveMarginAfter();
+        if (maxNegativeMarginAfter() > neg)
+            neg = maxNegativeMarginAfter();
         setMaxMarginBeforeValues(pos, neg);
         setMaxMarginAfterValues(0, 0);
     }
@@ -342,8 +342,6 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
     bool haveFlex = false;
     gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
 
-    bool paginated = view()->layoutState()->isPaginated();
-
     RenderBox* child;
 
     RenderBlock::startDelayUpdateScrollInfo();
@@ -374,11 +372,8 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             // Compute the child's vertical margins.
             child->computeBlockDirectionMargins(this);
     
-            if (!child->needsLayout() && paginated && view()->layoutState()->m_pageHeight) {
-                RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
-                if (childRenderBlock && view()->layoutState()->pageY(child->y()) != childRenderBlock->pageY())
-                    childRenderBlock->markForPaginationRelayout();
-            }
+            if (!child->needsLayout())
+                child->markForPaginationRelayoutIfNeeded();
 
             // Now do the layout.
             child->layoutIfNeeded();
@@ -407,7 +402,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
         }
         
         if (!iterator.first() && hasLineIfEmpty())
-            setHeight(height() + lineHeight(true, true));
+            setHeight(height() + lineHeight(true, style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
         
         setHeight(height() + toAdd);
         
@@ -425,7 +420,7 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 if (child->style()->hasStaticX()) {
-                    if (style()->direction() == LTR)
+                    if (style()->isLeftToRightDirection())
                         child->layer()->setStaticX(xPos);
                     else child->layer()->setStaticX(width() - xPos);
                 }
@@ -448,11 +443,8 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
             if (oldChildHeight != child->height())
                 child->setChildNeedsLayout(true, false);
                 
-            if (!child->needsLayout() && paginated && view()->layoutState()->m_pageHeight) {
-                RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
-                if (childRenderBlock && view()->layoutState()->pageY(child->y()) != childRenderBlock->pageY())
-                    childRenderBlock->markForPaginationRelayout();
-            }
+            if (!child->needsLayout())
+                child->markForPaginationRelayoutIfNeeded();
 
             child->layoutIfNeeded();
     
@@ -583,8 +575,8 @@ void RenderFlexibleBox::layoutHorizontalBox(bool relayoutChildren)
 
     RenderBlock::finishDelayUpdateScrollInfo();
 
-    if (remainingSpace > 0 && ((style()->direction() == LTR && style()->boxPack() != BSTART) ||
-                               (style()->direction() == RTL && style()->boxPack() != BEND))) {
+    if (remainingSpace > 0 && ((style()->isLeftToRightDirection() && style()->boxPack() != BSTART)
+        || (!style()->isLeftToRightDirection() && style()->boxPack() != BEND))) {
         // Children must be repositioned.
         int offset = 0;
         if (style()->boxPack() == BJUSTIFY) {
@@ -653,7 +645,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 {
     int xPos = borderLeft() + paddingLeft();
     int yPos = borderTop() + paddingTop();
-    if (style()->direction() == RTL)
+    if (!style()->isLeftToRightDirection())
         xPos = width() - paddingRight() - borderRight();
     int toAdd = borderBottom() + paddingBottom() + horizontalScrollbarHeight();
     bool heightSpecified = false;
@@ -667,8 +659,6 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
     bool haveFlex = false;
     gatherFlexChildrenInfo(iterator, relayoutChildren, highestFlexGroup, lowestFlexGroup, haveFlex);
 
-    bool paginated = view()->layoutState()->isPaginated();
-
     RenderBox* child;
 
     // We confine the line clamp ugliness to vertical flexible boxes (thus keeping it out of
@@ -696,7 +686,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             if (child->isPositioned()) {
                 child->containingBlock()->insertPositionedObject(child);
                 if (child->style()->hasStaticX()) {
-                    if (style()->direction() == LTR)
+                    if (style()->isLeftToRightDirection())
                         child->layer()->setStaticX(borderLeft()+paddingLeft());
                     else
                         child->layer()->setStaticX(borderRight()+paddingRight());
@@ -718,11 +708,8 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
             // Add in the child's marginTop to our height.
             setHeight(height() + child->marginTop());
     
-            if (!child->needsLayout() && paginated && view()->layoutState()->m_pageHeight) {
-                RenderBlock* childRenderBlock = child->isRenderBlock() ? toRenderBlock(child) : 0;
-                if (childRenderBlock && view()->layoutState()->pageY(child->y()) != childRenderBlock->pageY())
-                    childRenderBlock->markForPaginationRelayout();
-            }
+            if (!child->needsLayout())
+                child->markForPaginationRelayoutIfNeeded();
 
             // Now do a layout.
             child->layoutIfNeeded();
@@ -735,13 +722,13 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
                     childX += child->marginLeft() + max(0, (contentWidth() - (child->width() + child->marginLeft() + child->marginRight()))/2);
                     break;
                 case BEND:
-                    if (style()->direction() == RTL)
+                    if (!style()->isLeftToRightDirection())
                         childX += child->marginLeft();
                     else
                         childX += contentWidth() - child->marginRight() - child->width();
                     break;
                 default: // BSTART/BSTRETCH
-                    if (style()->direction() == LTR)
+                    if (style()->isLeftToRightDirection())
                         childX += child->marginLeft();
                     else
                         childX += contentWidth() - child->marginRight() - child->width();
@@ -758,7 +745,7 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
         yPos = height();
         
         if (!iterator.first() && hasLineIfEmpty())
-            setHeight(height() + lineHeight(true, true));
+            setHeight(height() + lineHeight(true, style()->isHorizontalWritingMode() ? HorizontalLine : VerticalLine, PositionOfInteriorLineBoxes));
     
         setHeight(height() + toAdd);
 
@@ -934,103 +921,102 @@ void RenderFlexibleBox::layoutVerticalBox(bool relayoutChildren)
 void RenderFlexibleBox::applyLineClamp(FlexBoxIterator& iterator, bool relayoutChildren)
 {
     int maxLineCount = 0;
-    RenderBox* child = iterator.first();
-    while (child) {
-        if (!child->isPositioned()) {
-            if (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent())) ||
-                (child->style()->height().isAuto() && child->isBlockFlow() && !child->needsLayout())) {
-                child->setChildNeedsLayout(true, false);
-                
-                // Dirty all the positioned objects.
-                if (child->isRenderBlock()) {
-                    toRenderBlock(child)->markPositionedObjectsForLayout();
-                    toRenderBlock(child)->clearTruncation();
-                }
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        if (child->isPositioned())
+            continue;
+
+        if (relayoutChildren || (child->isReplaced() && (child->style()->width().isPercent() || child->style()->height().isPercent()))
+            || (child->style()->height().isAuto() && child->isBlockFlow() && !child->needsLayout())) {
+            child->setChildNeedsLayout(true, false);
+
+            // Dirty all the positioned objects.
+            if (child->isRenderBlock()) {
+                toRenderBlock(child)->markPositionedObjectsForLayout();
+                toRenderBlock(child)->clearTruncation();
             }
-            child->layoutIfNeeded();
-            if (child->style()->height().isAuto() && child->isBlockFlow())
-                maxLineCount = max(maxLineCount, toRenderBlock(child)->lineCount());
         }
-        child = iterator.next();
+        child->layoutIfNeeded();
+        if (child->style()->height().isAuto() && child->isBlockFlow())
+            maxLineCount = max(maxLineCount, toRenderBlock(child)->lineCount());
     }
-    
-    // Get the # of lines and then alter all block flow children with auto height to use the
+
+    // Get the number of lines and then alter all block flow children with auto height to use the
     // specified height. We always try to leave room for at least one line.
     LineClampValue lineClamp = style()->lineClamp();
     int numVisibleLines = lineClamp.isPercentage() ? max(1, (maxLineCount + 1) * lineClamp.value() / 100) : lineClamp.value();
-    if (numVisibleLines < maxLineCount) {
-        for (child = iterator.first(); child; child = iterator.next()) {
-            if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
-                continue;
-            
-            RenderBlock* blockChild = toRenderBlock(child);
-            int lineCount = blockChild->lineCount();
-            if (lineCount <= numVisibleLines)
-                continue;
-            
-            int newHeight = blockChild->heightForLineCount(numVisibleLines);
-            if (newHeight == child->height())
-                continue;
-            
-            child->setChildNeedsLayout(true, false);
-            child->setOverrideSize(newHeight);
-            m_flexingChildren = true;
-            child->layoutIfNeeded();
-            m_flexingChildren = false;
-            child->setOverrideSize(-1);
-            
-            // FIXME: For now don't support RTL.
-            if (style()->direction() != LTR)
-                continue;
-            
-            // Get the last line
-            RootInlineBox* lastLine = blockChild->lineAtIndex(lineCount-1);
-            if (!lastLine)
-                continue;
-            
-            RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
-            if (!lastVisibleLine)
-                continue;
-            
-            const UChar ellipsisAndSpace[2] = { horizontalEllipsis, ' ' };
-            DEFINE_STATIC_LOCAL(AtomicString, ellipsisAndSpaceStr, (ellipsisAndSpace, 2));
-            DEFINE_STATIC_LOCAL(AtomicString, ellipsisStr, (&horizontalEllipsis, 1));
-            const Font& font = style(numVisibleLines == 1)->font();
-            
-            // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
-            int totalWidth;
-            InlineBox* anchorBox = lastLine->lastChild();
-            if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
-                totalWidth = anchorBox->logicalWidth() + font.width(TextRun(ellipsisAndSpace, 2));
-            else {
-                anchorBox = 0;
-                totalWidth = font.width(TextRun(&horizontalEllipsis, 1));
-            }
-            
-            // See if this width can be accommodated on the last visible line
-            RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
-            RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
-            
-            // FIXME: Directions of src/destBlock could be different from our direction and from one another.
-            if (srcBlock->style()->direction() != LTR)
-                continue;
-            if (destBlock->style()->direction() != LTR)
-                continue;
-            int ltr = true;
-            
-            int blockRightEdge = destBlock->logicalRightOffsetForLine(lastVisibleLine->y(), false);
-            int blockLeftEdge = destBlock->logicalLeftOffsetForLine(lastVisibleLine->y(), false);
-            
-            int blockEdge = ltr ? blockRightEdge : blockLeftEdge;
-            if (!lastVisibleLine->canAccommodateEllipsis(ltr, blockEdge,
-                                                         lastVisibleLine->x() + lastVisibleLine->logicalWidth(),
-                                                         totalWidth))
-                continue;
-            
-            // Let the truncation code kick in.
-            lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, ltr, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
-            destBlock->setHasMarkupTruncation(true);
+    if (numVisibleLines >= maxLineCount)
+        return;
+
+    for (RenderBox* child = iterator.first(); child; child = iterator.next()) {
+        if (child->isPositioned() || !child->style()->height().isAuto() || !child->isBlockFlow())
+            continue;
+        
+        RenderBlock* blockChild = toRenderBlock(child);
+        int lineCount = blockChild->lineCount();
+        if (lineCount <= numVisibleLines)
+            continue;
+        
+        int newHeight = blockChild->heightForLineCount(numVisibleLines);
+        if (newHeight == child->height())
+            continue;
+        
+        child->setChildNeedsLayout(true, false);
+        child->setOverrideSize(newHeight);
+        m_flexingChildren = true;
+        child->layoutIfNeeded();
+        m_flexingChildren = false;
+        child->setOverrideSize(-1);
+
+        // FIXME: For now don't support RTL.
+        if (style()->direction() != LTR)
+            continue;
+
+        // Get the last line
+        RootInlineBox* lastLine = blockChild->lineAtIndex(lineCount-1);
+        if (!lastLine)
+            continue;
+
+        RootInlineBox* lastVisibleLine = blockChild->lineAtIndex(numVisibleLines-1);
+        if (!lastVisibleLine)
+            continue;
+
+        const UChar ellipsisAndSpace[2] = { horizontalEllipsis, ' ' };
+        DEFINE_STATIC_LOCAL(AtomicString, ellipsisAndSpaceStr, (ellipsisAndSpace, 2));
+        DEFINE_STATIC_LOCAL(AtomicString, ellipsisStr, (&horizontalEllipsis, 1));
+        const Font& font = style(numVisibleLines == 1)->font();
+
+        // Get ellipsis width, and if the last child is an anchor, it will go after the ellipsis, so add in a space and the anchor width too 
+        int totalWidth;
+        InlineBox* anchorBox = lastLine->lastChild();
+        if (anchorBox && anchorBox->renderer()->node() && anchorBox->renderer()->node()->isLink())
+            totalWidth = anchorBox->logicalWidth() + font.width(TextRun(ellipsisAndSpace, 2));
+        else {
+            anchorBox = 0;
+            totalWidth = font.width(TextRun(&horizontalEllipsis, 1));
         }
+
+        // See if this width can be accommodated on the last visible line
+        RenderBlock* destBlock = toRenderBlock(lastVisibleLine->renderer());
+        RenderBlock* srcBlock = toRenderBlock(lastLine->renderer());
+        
+        // FIXME: Directions of src/destBlock could be different from our direction and from one another.
+        if (!srcBlock->style()->isLeftToRightDirection())
+            continue;
+
+        bool leftToRight = destBlock->style()->isLeftToRightDirection();
+        if (!leftToRight)
+            continue;
+
+        int blockRightEdge = destBlock->logicalRightOffsetForLine(lastVisibleLine->y(), false);
+        int blockLeftEdge = destBlock->logicalLeftOffsetForLine(lastVisibleLine->y(), false);
+
+        int blockEdge = leftToRight ? blockRightEdge : blockLeftEdge;
+        if (!lastVisibleLine->canAccommodateEllipsis(leftToRight, blockEdge, lastVisibleLine->x() + lastVisibleLine->logicalWidth(), totalWidth))
+            continue;
+
+        // Let the truncation code kick in.
+        lastVisibleLine->placeEllipsis(anchorBox ? ellipsisAndSpaceStr : ellipsisStr, leftToRight, blockLeftEdge, blockRightEdge, totalWidth, anchorBox);
+        destBlock->setHasMarkupTruncation(true);
     }
 }
 
diff --git a/WebCore/rendering/RenderForeignObject.cpp b/WebCore/rendering/RenderForeignObject.cpp
index 839e963..f9f6988 100644
--- a/WebCore/rendering/RenderForeignObject.cpp
+++ b/WebCore/rendering/RenderForeignObject.cpp
@@ -41,6 +41,10 @@ RenderForeignObject::RenderForeignObject(SVGForeignObjectElement* node)
 {
 }
 
+RenderForeignObject::~RenderForeignObject()
+{
+}
+
 void RenderForeignObject::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled())
diff --git a/WebCore/rendering/RenderForeignObject.h b/WebCore/rendering/RenderForeignObject.h
index 87423e6..bdf96ce 100644
--- a/WebCore/rendering/RenderForeignObject.h
+++ b/WebCore/rendering/RenderForeignObject.h
@@ -33,7 +33,8 @@ class SVGForeignObjectElement;
 
 class RenderForeignObject : public RenderSVGBlock {
 public:
-    RenderForeignObject(SVGForeignObjectElement*);
+    explicit RenderForeignObject(SVGForeignObjectElement*);
+    virtual ~RenderForeignObject();
 
     virtual const char* renderName() const { return "RenderForeignObject"; }
 
diff --git a/WebCore/rendering/RenderFrame.h b/WebCore/rendering/RenderFrame.h
index bdcaa4c..a7a859f 100644
--- a/WebCore/rendering/RenderFrame.h
+++ b/WebCore/rendering/RenderFrame.h
@@ -32,7 +32,7 @@ class HTMLFrameElement;
 
 class RenderFrame : public RenderFrameBase {
 public:
-    RenderFrame(HTMLFrameElement*);
+    explicit RenderFrame(HTMLFrameElement*);
 
     FrameEdgeInfo edgeInfo() const;
 
diff --git a/WebCore/rendering/RenderFrameBase.h b/WebCore/rendering/RenderFrameBase.h
index cd3cf0c..4fad560 100644
--- a/WebCore/rendering/RenderFrameBase.h
+++ b/WebCore/rendering/RenderFrameBase.h
@@ -33,7 +33,7 @@ namespace WebCore {
 // Base class for RenderFrame and RenderIFrame
 class RenderFrameBase : public RenderPart {
 protected:
-    RenderFrameBase(Element*);
+    explicit RenderFrameBase(Element*);
 
 public:
     void layoutWithFlattening(bool fixedWidth, bool fixedHeight);
diff --git a/WebCore/rendering/RenderHTMLCanvas.h b/WebCore/rendering/RenderHTMLCanvas.h
index 473dad5..2230b39 100644
--- a/WebCore/rendering/RenderHTMLCanvas.h
+++ b/WebCore/rendering/RenderHTMLCanvas.h
@@ -34,7 +34,7 @@ class HTMLCanvasElement;
 
 class RenderHTMLCanvas : public RenderReplaced {
 public:
-    RenderHTMLCanvas(HTMLCanvasElement*);
+    explicit RenderHTMLCanvas(HTMLCanvasElement*);
 
     virtual bool isCanvas() const { return true; }
     virtual bool requiresLayer() const;
diff --git a/WebCore/rendering/RenderIFrame.h b/WebCore/rendering/RenderIFrame.h
index 325e2b3..0bb3182 100644
--- a/WebCore/rendering/RenderIFrame.h
+++ b/WebCore/rendering/RenderIFrame.h
@@ -32,7 +32,7 @@ namespace WebCore {
 
 class RenderIFrame : public RenderFrameBase {
 public:
-    RenderIFrame(Element*);
+    explicit RenderIFrame(Element*);
 
 #if USE(ACCELERATED_COMPOSITING)
     bool requiresAcceleratedCompositing() const;
diff --git a/WebCore/rendering/RenderImage.cpp b/WebCore/rendering/RenderImage.cpp
index c8e31e6..e6f4dbe 100644
--- a/WebCore/rendering/RenderImage.cpp
+++ b/WebCore/rendering/RenderImage.cpp
@@ -131,6 +131,9 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 
     if (hasBoxDecorations() || hasMask())
         RenderReplaced::imageChanged(newImage, rect);
+    
+    if (!m_imageResource)
+        return;
 
     if (newImage != m_imageResource->imagePtr() || !newImage)
         return;
@@ -195,6 +198,9 @@ void RenderImage::imageChanged(WrappedImagePtr newImage, const IntRect* rect)
 
 void RenderImage::notifyFinished(CachedResource* newImage)
 {
+    if (!m_imageResource)
+        return;
+    
     if (documentBeingDestroyed())
         return;
 
@@ -327,6 +333,9 @@ void RenderImage::paintFocusRings(PaintInfo& paintInfo, const RenderStyle* style
     
     RefPtr<HTMLCollection> areas = mapElement->areas();
     unsigned numAreas = areas->length();
+
+    if (theme()->supportsFocusRing(style))
+        return; // The theme draws the focus ring.
     
     // FIXME: Clip the paths to the image bounding box.
     for (unsigned k = 0; k < numAreas; ++k) {
@@ -405,9 +414,9 @@ void RenderImage::updateAltText()
 #endif
 }
 
-bool RenderImage::isWidthSpecified() const
+bool RenderImage::isLogicalWidthSpecified() const
 {
-    switch (style()->width().type()) {
+    switch (style()->logicalWidth().type()) {
         case Fixed:
         case Percent:
             return true;
@@ -422,9 +431,9 @@ bool RenderImage::isWidthSpecified() const
     return false;
 }
 
-bool RenderImage::isHeightSpecified() const
+bool RenderImage::isLogicalHeightSpecified() const
 {
-    switch (style()->height().type()) {
+    switch (style()->logicalHeight().type()) {
         case Fixed:
         case Percent:
             return true;
@@ -439,7 +448,7 @@ bool RenderImage::isHeightSpecified() const
     return false;
 }
 
-int RenderImage::computeReplacedWidth(bool includeMaxWidth) const
+int RenderImage::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
     if (m_imageResource->imageHasRelativeWidth())
         if (RenderObject* cb = isPositioned() ? container() : containingBlock()) {
@@ -447,19 +456,21 @@ int RenderImage::computeReplacedWidth(bool includeMaxWidth) const
                 m_imageResource->setImageContainerSize(IntSize(toRenderBox(cb)->availableWidth(), toRenderBox(cb)->availableHeight()));
         }
 
-    int width;
-    if (isWidthSpecified())
-        width = computeReplacedWidthUsing(style()->width());
-    else if (m_imageResource->usesImageContainerSize())
-        width = m_imageResource->imageSize(style()->effectiveZoom()).width();
-    else if (m_imageResource->imageHasRelativeWidth())
-        width = 0; // If the image is relatively-sized, set the width to 0 until there is a set container size.
+    int logicalWidth;
+    if (isLogicalWidthSpecified())
+        logicalWidth = computeReplacedLogicalWidthUsing(style()->logicalWidth());
+    else if (m_imageResource->usesImageContainerSize()) {
+        IntSize size = m_imageResource->imageSize(style()->effectiveZoom());
+        logicalWidth = style()->isHorizontalWritingMode() ? size.width() : size.height();
+    } else if (m_imageResource->imageHasRelativeWidth())
+        logicalWidth = 0; // If the image is relatively-sized, set the width to 0 until there is a set container size.
     else
-        width = calcAspectRatioWidth();
+        logicalWidth = calcAspectRatioLogicalWidth();
 
-    int minW = computeReplacedWidthUsing(style()->minWidth());
-    int maxW = !includeMaxWidth || style()->maxWidth().isUndefined() ? width : computeReplacedWidthUsing(style()->maxWidth());
+    int minLogicalWidth = computeReplacedLogicalWidthUsing(style()->logicalMinWidth());
+    int maxLogicalWidth = !includeMaxWidth || style()->logicalMaxWidth().isUndefined() ? logicalWidth : computeReplacedLogicalWidthUsing(style()->logicalMaxWidth());
 
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     width = max(minW, min(width, maxW));
     // in SSR mode, we will fit the image to its container width
@@ -472,23 +483,28 @@ int RenderImage::computeReplacedWidth(bool includeMaxWidth) const
 #else
     return max(minW, min(width, maxW));
 #endif
+=======
+    return max(minLogicalWidth, min(logicalWidth, maxLogicalWidth));
+>>>>>>> webkit.org at r70209
 }
 
-int RenderImage::computeReplacedHeight() const
+int RenderImage::computeReplacedLogicalHeight() const
 {
-    int height;
-    if (isHeightSpecified())
-        height = computeReplacedHeightUsing(style()->height());
-    else if (m_imageResource->usesImageContainerSize())
-        height = m_imageResource->imageSize(style()->effectiveZoom()).height();
-    else if (m_imageResource->imageHasRelativeHeight())
-        height = 0; // If the image is relatively-sized, set the height to 0 until there is a set container size.
+    int logicalHeight;
+    if (isLogicalHeightSpecified())
+        logicalHeight = computeReplacedLogicalHeightUsing(style()->logicalHeight());
+    else if (m_imageResource->usesImageContainerSize()) {
+        IntSize size = m_imageResource->imageSize(style()->effectiveZoom());
+        logicalHeight = style()->isHorizontalWritingMode() ? size.height() : size.width();
+    } else if (m_imageResource->imageHasRelativeHeight())
+        logicalHeight = 0; // If the image is relatively-sized, set the height to 0 until there is a set container size.
     else
-        height = calcAspectRatioHeight();
+        logicalHeight = calcAspectRatioLogicalHeight();
 
-    int minH = computeReplacedHeightUsing(style()->minHeight());
-    int maxH = style()->maxHeight().isUndefined() ? height : computeReplacedHeightUsing(style()->maxHeight());
+    int minLogicalHeight = computeReplacedLogicalHeightUsing(style()->logicalMinHeight());
+    int maxLogicalHeight = style()->logicalMaxHeight().isUndefined() ? logicalHeight : computeReplacedLogicalHeightUsing(style()->logicalMaxHeight());
 
+<<<<<<< HEAD
 #ifdef ANDROID_LAYOUT
     height = max(minH, min(height, maxH));
     // in SSR mode, we will fit the image to its container width
@@ -511,26 +527,31 @@ int RenderImage::computeReplacedHeight() const
 #else
     return max(minH, min(height, maxH));
 #endif
+=======
+    return max(minLogicalHeight, min(logicalHeight, maxLogicalHeight));
+>>>>>>> webkit.org at r70209
 }
 
-int RenderImage::calcAspectRatioWidth() const
+int RenderImage::calcAspectRatioLogicalWidth() const
 {
-    IntSize size = intrinsicSize();
-    if (!size.height())
+    int intrinsicWidth = intrinsicLogicalWidth();
+    int intrinsicHeight = intrinsicLogicalHeight();
+    if (!intrinsicHeight)
         return 0;
     if (!m_imageResource->hasImage() || m_imageResource->errorOccurred())
-        return size.width(); // Don't bother scaling.
-    return RenderBox::computeReplacedHeight() * size.width() / size.height();
+        return intrinsicWidth; // Don't bother scaling.
+    return RenderBox::computeReplacedLogicalHeight() * intrinsicWidth / intrinsicHeight;
 }
 
-int RenderImage::calcAspectRatioHeight() const
+int RenderImage::calcAspectRatioLogicalHeight() const
 {
-    IntSize size = intrinsicSize();
-    if (!size.width())
+    int intrinsicWidth = intrinsicLogicalWidth();
+    int intrinsicHeight = intrinsicLogicalHeight();
+    if (!intrinsicWidth)
         return 0;
     if (!m_imageResource->hasImage() || m_imageResource->errorOccurred())
-        return size.height(); // Don't bother scaling.
-    return RenderBox::computeReplacedWidth() * size.height() / size.width();
+        return intrinsicHeight; // Don't bother scaling.
+    return RenderBox::computeReplacedLogicalWidth() * intrinsicHeight / intrinsicWidth;
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/RenderImage.h b/WebCore/rendering/RenderImage.h
index 022d792..308c863 100644
--- a/WebCore/rendering/RenderImage.h
+++ b/WebCore/rendering/RenderImage.h
@@ -58,8 +58,8 @@ protected:
     void paintFocusRings(PaintInfo&, const RenderStyle*);
     virtual void paint(PaintInfo&, int tx, int ty);
 
-    bool isWidthSpecified() const;
-    bool isHeightSpecified() const;
+    bool isLogicalWidthSpecified() const;
+    bool isLogicalHeightSpecified() const;
 
     virtual void intrinsicSizeChanged()
     {
@@ -80,11 +80,11 @@ private:
     virtual void notifyFinished(CachedResource*);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-    virtual int computeReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int computeReplacedHeight() const;
+    virtual int computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
+    virtual int computeReplacedLogicalHeight() const;
 
-    int calcAspectRatioWidth() const;
-    int calcAspectRatioHeight() const;
+    int calcAspectRatioLogicalWidth() const;
+    int calcAspectRatioLogicalHeight() const;
 
 private:
     // Text to display as long as the image isn't available.
diff --git a/WebCore/rendering/RenderInline.cpp b/WebCore/rendering/RenderInline.cpp
index b4bfe2f..4b28268 100644
--- a/WebCore/rendering/RenderInline.cpp
+++ b/WebCore/rendering/RenderInline.cpp
@@ -31,6 +31,7 @@
 #include "RenderArena.h"
 #include "RenderBlock.h"
 #include "RenderLayer.h"
+#include "RenderTheme.h"
 #include "RenderView.h"
 #include "TransformState.h"
 #include "VisiblePosition.h"
@@ -471,28 +472,28 @@ static int computeMargin(const RenderInline* renderer, const Length& margin)
 
 int RenderInline::marginLeft() const
 {
-    if (!style()->isVerticalBlockFlow())
+    if (!style()->isHorizontalWritingMode())
         return 0;
     return computeMargin(this, style()->marginLeft());
 }
 
 int RenderInline::marginRight() const
 {
-    if (!style()->isVerticalBlockFlow())
+    if (!style()->isHorizontalWritingMode())
         return 0;
     return computeMargin(this, style()->marginRight());
 }
 
 int RenderInline::marginTop() const
 {
-    if (style()->isVerticalBlockFlow())
+    if (style()->isHorizontalWritingMode())
         return 0;
     return computeMargin(this, style()->marginTop());
 }
 
 int RenderInline::marginBottom() const
 {
-    if (style()->isVerticalBlockFlow())
+    if (style()->isHorizontalWritingMode())
         return 0;
     return computeMargin(this, style()->marginBottom());
 }
@@ -878,7 +879,7 @@ InlineFlowBox* RenderInline::createAndAppendInlineFlowBox()
     return flowBox;
 }
 
-int RenderInline::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
+int RenderInline::lineHeight(bool firstLine, LineDirectionMode /*direction*/, LinePositionMode /*linePositionMode*/) const
 {
     if (firstLine && document()->usesFirstLineRules()) {
         RenderStyle* s = style(firstLine);
@@ -892,6 +893,12 @@ int RenderInline::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
     return m_lineHeight;
 }
 
+int RenderInline::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
+{
+    const Font& f = style(firstLine)->font();
+    return f.ascent() + (lineHeight(firstLine, direction, linePositionMode) - f.height()) / 2;
+}
+
 int RenderInline::verticalPositionFromCache(bool firstLine) const
 {
     if (firstLine) // We're only really a first-line style if the document actually uses first-line rules.
@@ -993,15 +1000,10 @@ void RenderInline::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     
     RenderStyle* styleToUse = style();
     if (styleToUse->outlineStyleIsAuto() || hasOutlineAnnotation()) {
-        int ow = styleToUse->outlineWidth();
-        Color oc = styleToUse->visitedDependentColor(CSSPropertyOutlineColor);
-
-        Vector<IntRect> focusRingRects;
-        addFocusRingRects(focusRingRects, tx, ty);
-        if (styleToUse->outlineStyleIsAuto())
-            graphicsContext->drawFocusRing(focusRingRects, ow, styleToUse->outlineOffset(), oc);
-        else
-            addPDFURLRect(graphicsContext, unionRect(focusRingRects));
+        if (!theme()->supportsFocusRing(styleToUse)) {
+            // Only paint the focus ring by hand if the theme isn't able to draw the focus ring.
+            paintFocusRing(graphicsContext, tx, ty, styleToUse);
+        }
     }
 
     if (styleToUse->outlineStyleIsAuto() || styleToUse->outlineStyle() == BNONE)
diff --git a/WebCore/rendering/RenderInline.h b/WebCore/rendering/RenderInline.h
index feb8b8f..1eb32ff 100644
--- a/WebCore/rendering/RenderInline.h
+++ b/WebCore/rendering/RenderInline.h
@@ -32,7 +32,7 @@ class Position;
 
 class RenderInline : public RenderBoxModelObject {
 public:
-    RenderInline(Node*);
+    explicit RenderInline(Node*);
 
     virtual void destroy();
 
@@ -133,7 +133,8 @@ private:
 
     virtual void dirtyLinesFromChangedChild(RenderObject* child) { m_lineBoxes.dirtyLinesFromChangedChild(this, child); }
 
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     
     virtual void childBecameNonInline(RenderObject* child);
 
diff --git a/WebCore/rendering/RenderLayer.cpp b/WebCore/rendering/RenderLayer.cpp
index 63233e5..a160381 100644
--- a/WebCore/rendering/RenderLayer.cpp
+++ b/WebCore/rendering/RenderLayer.cpp
@@ -978,7 +978,7 @@ void RenderLayer::beginTransparencyLayers(GraphicsContext* p, const RenderLayer*
         p->clip(clipRect);
         p->beginTransparencyLayer(renderer()->opacity());
 #ifdef REVEAL_TRANSPARENCY_LAYERS
-        p->setFillColor(Color(0.0f, 0.0f, 0.5f, 0.2f), DeviceColorSpace);
+        p->setFillColor(Color(0.0f, 0.0f, 0.5f, 0.2f), ColorSpaceDeviceRGB);
         p->fillRect(clipRect);
 #endif
     }
@@ -1986,7 +1986,7 @@ void RenderLayer::computeScrollDimensions(bool* needHBar, bool* needVBar)
     
     m_scrollDimensionsDirty = false;
     
-    bool ltr = renderer()->style()->direction() == LTR;
+    bool ltr = renderer()->style()->isLeftToRightDirection();
 
     int clientWidth = box->clientWidth();
     int clientHeight = box->clientHeight();
@@ -2234,9 +2234,9 @@ void RenderLayer::paintResizer(GraphicsContext* context, int tx, int ty, const I
         context->clip(absRect);
         IntRect largerCorner = absRect;
         largerCorner.setSize(IntSize(largerCorner.width() + 1, largerCorner.height() + 1));
-        context->setStrokeColor(Color(makeRGB(217, 217, 217)), DeviceColorSpace);
+        context->setStrokeColor(Color(makeRGB(217, 217, 217)), ColorSpaceDeviceRGB);
         context->setStrokeThickness(1.0f);
-        context->setFillColor(Color::transparent, DeviceColorSpace);
+        context->setFillColor(Color::transparent, ColorSpaceDeviceRGB);
         context->drawRect(largerCorner);
         context->restore();
     }
@@ -2811,7 +2811,7 @@ RenderLayer* RenderLayer::hitTestLayer(RenderLayer* rootLayer, RenderLayer* cont
     useTemporaryClipRects = compositor()->inCompositingMode();
 #endif
 
-    IntRect hitTestArea = result.rectFromPoint(hitTestPoint);
+    IntRect hitTestArea = result.rectForPoint(hitTestPoint);
 
     // Apply a transform if we have one.
     if (transform() && !appliedTransform) {
@@ -3094,7 +3094,7 @@ RenderLayer* RenderLayer::hitTestChildLayerColumns(RenderLayer* childLayer, Rend
         IntRect localClipRect(hitTestRect);
         localClipRect.intersect(colRect);
         
-        if (!localClipRect.isEmpty() && localClipRect.intersects(result.rectFromPoint(hitTestPoint))) {
+        if (!localClipRect.isEmpty() && localClipRect.intersects(result.rectForPoint(hitTestPoint))) {
             RenderLayer* hitLayer = 0;
             if (!columnIndex) {
                 // Apply a translation transform to change where the layer paints.
diff --git a/WebCore/rendering/RenderLayerBacking.cpp b/WebCore/rendering/RenderLayerBacking.cpp
index 536cdab..52a814c 100644
--- a/WebCore/rendering/RenderLayerBacking.cpp
+++ b/WebCore/rendering/RenderLayerBacking.cpp
@@ -43,7 +43,7 @@
 #include "HTMLIFrameElement.h"
 #include "HTMLMediaElement.h"
 #include "HTMLNames.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "KeyframeList.h"
 #include "PluginViewBase.h"
 #include "RenderBox.h"
@@ -1104,26 +1104,10 @@ void RenderLayerBacking::paintIntoLayer(RenderLayer* rootLayer, GraphicsContext*
     ASSERT(!m_owningLayer->m_usedTransparency);
 }
 
-#if ENABLE(INSPECTOR)
-static InspectorTimelineAgent* inspectorTimelineAgent(RenderObject* renderer)
-{
-    Frame* frame = renderer->frame();
-    if (!frame)
-        return 0;
-    Page* page = frame->page();
-    if (!page)
-        return 0;
-    return page->inspectorTimelineAgent();
-}
-#endif
-
 // Up-call from compositing layer drawing callback.
 void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& context, GraphicsLayerPaintingPhase paintingPhase, const IntRect& clip)
 {
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
-        timelineAgent->willPaint(clip);
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willPaint(m_owningLayer->renderer()->frame(), clip);
 
     // We have to use the same root as for hit testing, because both methods
     // can compute and cache clipRects.
@@ -1149,10 +1133,7 @@ void RenderLayerBacking::paintContents(const GraphicsLayer*, GraphicsContext& co
 
     paintIntoLayer(m_owningLayer, &context, dirtyRect, PaintBehaviorNormal, paintingPhase, renderer());
 
-#if ENABLE(INSPECTOR)
-    if (InspectorTimelineAgent* timelineAgent = inspectorTimelineAgent(m_owningLayer->renderer()))
-        timelineAgent->didPaint();
-#endif
+    InspectorInstrumentation::didPaint(cookie);
 }
 
 bool RenderLayerBacking::showDebugBorders() const
diff --git a/WebCore/rendering/RenderLayerCompositor.cpp b/WebCore/rendering/RenderLayerCompositor.cpp
index 835d21e..835d21e 100755..100644
--- a/WebCore/rendering/RenderLayerCompositor.cpp
+++ b/WebCore/rendering/RenderLayerCompositor.cpp
diff --git a/WebCore/rendering/RenderLayerCompositor.h b/WebCore/rendering/RenderLayerCompositor.h
index b4e3afe..b4e3afe 100755..100644
--- a/WebCore/rendering/RenderLayerCompositor.h
+++ b/WebCore/rendering/RenderLayerCompositor.h
diff --git a/WebCore/rendering/RenderLineBoxList.cpp b/WebCore/rendering/RenderLineBoxList.cpp
index 760d2ea..1e58e63 100644
--- a/WebCore/rendering/RenderLineBoxList.cpp
+++ b/WebCore/rendering/RenderLineBoxList.cpp
@@ -203,6 +203,10 @@ void RenderLineBoxList::paint(RenderBoxModelObject* renderer, PaintInfo& paintIn
             }
             if (bottomForPaginationCheck - topForPaginationCheck <= v->printRect().height()) {
                 if (ty + bottomForPaginationCheck > v->printRect().bottom()) {
+                    if (RootInlineBox* nextRootBox = curr->root()->nextRootBox())
+                        bottomForPaginationCheck = min(bottomForPaginationCheck, min(nextRootBox->topVisibleOverflow(), nextRootBox->lineTop()));
+                }
+                if (ty + bottomForPaginationCheck > v->printRect().bottom()) {
                     if (ty + topForPaginationCheck < v->truncatedAt())
                         v->setBestTruncatedAt(ty + topForPaginationCheck, renderer);
                     // If we were able to truncate, don't paint.
diff --git a/WebCore/rendering/RenderListBox.cpp b/WebCore/rendering/RenderListBox.cpp
index 39442e1..532c551 100644
--- a/WebCore/rendering/RenderListBox.cpp
+++ b/WebCore/rendering/RenderListBox.cpp
@@ -238,9 +238,9 @@ void RenderListBox::computeLogicalHeight()
     }
 }
 
-int RenderListBox::baselinePosition(bool, bool) const
+int RenderListBox::baselinePosition(bool firstLine, LineDirectionMode lineDirection, LinePositionMode linePositionMode) const
 {
-    return height() + marginTop() + marginBottom() - baselineAdjustment;
+    return RenderBox::baselinePosition(firstLine, lineDirection, linePositionMode) - baselineAdjustment;
 }
 
 IntRect RenderListBox::itemBoundingBoxRect(int tx, int ty, int index)
@@ -334,7 +334,7 @@ void RenderListBox::paintItemForeground(PaintInfo& paintInfo, int tx, int ty, in
 
     unsigned length = itemText.length();
     const UChar* string = itemText.characters();
-    TextRun textRun(string, length, 0, 0, 0, itemStyle->direction() == RTL, itemStyle->unicodeBidi() == Override, false, false);
+    TextRun textRun(string, length, 0, 0, 0, !itemStyle->isLeftToRightDirection(), itemStyle->unicodeBidi() == Override, false, false);
 
     // Draw the item text
     if (itemStyle->visibility() != HIDDEN)
diff --git a/WebCore/rendering/RenderListBox.h b/WebCore/rendering/RenderListBox.h
index c69f205..072fc91 100644
--- a/WebCore/rendering/RenderListBox.h
+++ b/WebCore/rendering/RenderListBox.h
@@ -71,7 +71,7 @@ private:
     virtual bool scroll(ScrollDirection, ScrollGranularity, float multiplier = 1, Node** stopNode = 0);
 
     virtual void computePreferredLogicalWidths();
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
     virtual void computeLogicalHeight();
 
     virtual void layout();
diff --git a/WebCore/rendering/RenderListItem.cpp b/WebCore/rendering/RenderListItem.cpp
index b414f38..1f600fe 100644
--- a/WebCore/rendering/RenderListItem.cpp
+++ b/WebCore/rendering/RenderListItem.cpp
@@ -102,7 +102,7 @@ static Node* enclosingList(const RenderListItem* listItem)
 
 static RenderListItem* previousListItem(Node* list, const RenderListItem* item)
 {
-    for (RenderObject* renderer = item->previousInPreOrder(); renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
+    for (RenderObject* renderer = item->previousInPreOrder(); renderer && renderer != list->renderer(); renderer = renderer->previousInPreOrder()) {
         if (!renderer->isListItem())
             continue;
         Node* otherList = enclosingList(toRenderListItem(renderer));
@@ -261,7 +261,7 @@ void RenderListItem::positionListMarker()
         // FIXME: Inline flows in the line box hierarchy that have self-painting layers should act as cutoff points
         // and really shouldn't keep propagating overflow up.  This won't really break anything other than repainting
         // not being as tight as it could be though.
-        if (style()->direction() == LTR) {
+        if (style()->isLeftToRightDirection()) {
             int leftLineOffset = logicalLeftOffsetForLine(yOffset, logicalLeftOffsetForLine(yOffset, false), false);
             markerXPos = leftLineOffset - xOffset - paddingLeft() - borderLeft() + m_marker->marginLeft();
             m_marker->inlineBoxWrapper()->adjustPosition(markerXPos - markerOldX, 0);
@@ -326,12 +326,12 @@ String RenderListItem::markerTextWithSuffix() const
     const String markerSuffix = m_marker->suffix();
     Vector<UChar> resultVector;
 
-    if (m_marker->style()->direction() == RTL)
+    if (!m_marker->style()->isLeftToRightDirection())
         resultVector.append(markerSuffix.characters(), markerSuffix.length());
 
     resultVector.append(markerText.characters(), markerText.length());
 
-    if (m_marker->style()->direction() == LTR)
+    if (m_marker->style()->isLeftToRightDirection())
         resultVector.append(markerSuffix.characters(), markerSuffix.length());
 
     return String::adopt(resultVector);
diff --git a/WebCore/rendering/RenderListItem.h b/WebCore/rendering/RenderListItem.h
index f7bd661..2fcb6c4 100644
--- a/WebCore/rendering/RenderListItem.h
+++ b/WebCore/rendering/RenderListItem.h
@@ -31,7 +31,7 @@ class RenderListMarker;
 
 class RenderListItem : public RenderBlock {
 public:
-    RenderListItem(Node*);
+    explicit RenderListItem(Node*);
 
     int value() const { if (!m_isValueUpToDate) updateValueNow(); return m_value; }
     void updateValue();
diff --git a/WebCore/rendering/RenderListMarker.cpp b/WebCore/rendering/RenderListMarker.cpp
index 18811df..ab5da61 100644
--- a/WebCore/rendering/RenderListMarker.cpp
+++ b/WebCore/rendering/RenderListMarker.cpp
@@ -504,7 +504,6 @@ static UChar listMarkerSuffix(EListStyleType type, int value)
     case Footnotes:
     case NoneListStyle:
     case Square:
-        ASSERT_NOT_REACHED();
         return ' ';
     case Afar:
     case Amharic:
@@ -1155,7 +1154,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
             context->drawEllipse(marker);
             return;
         case Circle:
-            context->setFillColor(Color::transparent, DeviceColorSpace);
+            context->setFillColor(Color::transparent, ColorSpaceDeviceRGB);
             context->drawEllipse(marker);
             return;
         case Square:
@@ -1257,7 +1256,7 @@ void RenderListMarker::paint(PaintInfo& paintInfo, int tx, int ty)
 
     const Font& font = style()->font();
     const UChar suffix = listMarkerSuffix(type, m_listItem->value());
-    if (style()->direction() == LTR) {
+    if (style()->isLeftToRightDirection()) {
         int width = font.width(textRun);
         context->drawText(style()->font(), textRun, marker.location());
         UChar suffixSpace[2] = { suffix, ' ' };
@@ -1444,7 +1443,7 @@ void RenderListMarker::updateMargins()
 
     if (isInside()) {
         if (isImage()) {
-            if (style()->direction() == LTR)
+            if (style()->isLeftToRightDirection())
                 marginRight = cMarkerPadding;
             else
                 marginLeft = cMarkerPadding;
@@ -1452,7 +1451,7 @@ void RenderListMarker::updateMargins()
             case Disc:
             case Circle:
             case Square:
-                if (style()->direction() == LTR) {
+                if (style()->isLeftToRightDirection()) {
                     marginLeft = -1;
                     marginRight = font.ascent() - minPreferredLogicalWidth() + 1;
                 } else {
@@ -1464,7 +1463,7 @@ void RenderListMarker::updateMargins()
                 break;
         }
     } else {
-        if (style()->direction() == LTR) {
+        if (style()->isLeftToRightDirection()) {
             if (isImage())
                 marginLeft = -minPreferredLogicalWidth() - cMarkerPadding;
             else {
@@ -1506,20 +1505,18 @@ void RenderListMarker::updateMargins()
     style()->setMarginRight(Length(marginRight, Fixed));
 }
 
-int RenderListMarker::lineHeight(bool, bool) const
+int RenderListMarker::lineHeight(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
     if (!isImage())
-        return m_listItem->lineHeight(false, true);
-    return height();
+        return m_listItem->lineHeight(firstLine, direction, PositionOfInteriorLineBoxes);
+    return RenderBox::lineHeight(firstLine, direction, linePositionMode);
 }
 
-int RenderListMarker::baselinePosition(bool, bool) const
+int RenderListMarker::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
-    if (!isImage()) {
-        const Font& font = style()->font();
-        return font.ascent() + (lineHeight(false) - font.height())/2;
-    }
-    return height();
+    if (!isImage())
+        return m_listItem->baselinePosition(firstLine, direction, PositionOfInteriorLineBoxes);
+    return RenderBox::baselinePosition(firstLine, direction, linePositionMode);
 }
 
 String RenderListMarker::suffix() const
@@ -1532,7 +1529,7 @@ String RenderListMarker::suffix() const
 
     // If the suffix is not ' ', an extra space is needed
     if (suffix != ' ') {
-        if (style()->direction() == LTR)
+        if (style()->isLeftToRightDirection())
             resultVector.append(' ');
         else
             resultVector.prepend(' ');
diff --git a/WebCore/rendering/RenderListMarker.h b/WebCore/rendering/RenderListMarker.h
index 1e55898..fe025c3 100644
--- a/WebCore/rendering/RenderListMarker.h
+++ b/WebCore/rendering/RenderListMarker.h
@@ -58,8 +58,8 @@ private:
 
     virtual InlineBox* createInlineBox();
 
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
+    virtual int lineHeight(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     bool isImage() const;
     bool isText() const { return !isImage(); }
diff --git a/WebCore/rendering/RenderMarquee.cpp b/WebCore/rendering/RenderMarquee.cpp
index bb917f8..90383d8 100644
--- a/WebCore/rendering/RenderMarquee.cpp
+++ b/WebCore/rendering/RenderMarquee.cpp
@@ -66,6 +66,10 @@ RenderMarquee::RenderMarquee(RenderLayer* l)
 {
 }
 
+RenderMarquee::~RenderMarquee()
+{
+}
+
 int RenderMarquee::marqueeSpeed() const
 {
     int result = m_layer->renderer()->style()->marqueeSpeed();
@@ -110,7 +114,7 @@ int RenderMarquee::computePosition(EMarqueeDirection dir, bool stopAtContentEdge
     ASSERT(box);
     RenderStyle* s = box->style();
     if (isHorizontal()) {
-        bool ltr = s->direction() == LTR;
+        bool ltr = s->isLeftToRightDirection();
         int clientWidth = box->clientWidth();
         int contentWidth = ltr ? box->rightmostPosition(true, false) : box->leftmostPosition(true, false);
         if (ltr)
diff --git a/WebCore/rendering/RenderMarquee.h b/WebCore/rendering/RenderMarquee.h
index 1651454..79998ed 100644
--- a/WebCore/rendering/RenderMarquee.h
+++ b/WebCore/rendering/RenderMarquee.h
@@ -55,7 +55,8 @@ class RenderLayer;
 // This class handles the auto-scrolling of layers with overflow: marquee.
 class RenderMarquee : public Noncopyable {
 public:
-    RenderMarquee(RenderLayer*);
+    explicit RenderMarquee(RenderLayer*);
+    virtual ~RenderMarquee();
 
     int speed() const { return m_speed; }
     int marqueeSpeed() const;
diff --git a/WebCore/rendering/RenderMedia.cpp b/WebCore/rendering/RenderMedia.cpp
index a589a2d..49a536c 100644
--- a/WebCore/rendering/RenderMedia.cpp
+++ b/WebCore/rendering/RenderMedia.cpp
@@ -34,6 +34,7 @@
 #include "MediaControlElements.h"
 #include "MouseEvent.h"
 #include "Page.h"
+#include "RenderLayer.h"
 #include "RenderTheme.h"
 #include <wtf/CurrentTime.h>
 #include <wtf/MathExtras.h>
@@ -599,31 +600,80 @@ void RenderMedia::forwardEvent(Event* event)
     }
 }
 
-int RenderMedia::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderMedia::topmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int bottom = RenderImage::lowestPosition(includeOverflowInterior, includeSelf);
+    int top = RenderImage::topmostPosition(includeOverflowInterior, includeSelf, applyTransform);
+    if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
+        return top;
+    
+    top = min(top,  m_controlsShadowRoot->renderBox()->transformedFrameRect().y() + m_controlsShadowRoot->renderBox()->topmostPosition(includeOverflowInterior, includeSelf, applyTransform));
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.y();
+    }
+
+    return top;
+}
+
+int RenderMedia::lowestPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
+{
+    int bottom = RenderImage::lowestPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return bottom;
     
-    return max(bottom,  m_controlsShadowRoot->renderBox()->y() + m_controlsShadowRoot->renderBox()->lowestPosition(includeOverflowInterior, includeSelf));
+    bottom = max(bottom,  m_controlsShadowRoot->renderBox()->transformedFrameRect().y() + m_controlsShadowRoot->renderBox()->lowestPosition(includeOverflowInterior, includeSelf, applyTransform));
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = topmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.height() + transformRect.y();
+    }
+
+    return bottom;
 }
 
-int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderMedia::rightmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int right = RenderImage::rightmostPosition(includeOverflowInterior, includeSelf);
+    int right = RenderImage::rightmostPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return right;
     
-    return max(right, m_controlsShadowRoot->renderBox()->x() + m_controlsShadowRoot->renderBox()->rightmostPosition(includeOverflowInterior, includeSelf));
+    right = max(right, m_controlsShadowRoot->renderBox()->transformedFrameRect().x() + m_controlsShadowRoot->renderBox()->rightmostPosition(includeOverflowInterior, includeSelf, applyTransform));
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int left = leftmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.width() + transformRect.x();
+    }
+
+    return right;
 }
 
-int RenderMedia::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderMedia::leftmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int left = RenderImage::leftmostPosition(includeOverflowInterior, includeSelf);
+    int left = RenderImage::leftmostPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!m_controlsShadowRoot || !m_controlsShadowRoot->renderer())
         return left;
     
-    return min(left, m_controlsShadowRoot->renderBox()->x() +  m_controlsShadowRoot->renderBox()->leftmostPosition(includeOverflowInterior, includeSelf));
+    left = min(left, m_controlsShadowRoot->renderBox()->transformedFrameRect().x() +  m_controlsShadowRoot->renderBox()->leftmostPosition(includeOverflowInterior, includeSelf, applyTransform));
+
+    if (applyTransform == IncludeTransform && includeSelf && layer() && layer()->hasTransform()) {
+        int top = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int bottom = lowestPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        int right = rightmostPosition(includeOverflowInterior, includeSelf, ExcludeTransform);
+        IntRect transformRect = applyLayerTransformToRect(IntRect(left, top, right - left, bottom - top));
+        return transformRect.x();
+    }
+
+    return left;
 }
 
 
diff --git a/WebCore/rendering/RenderMedia.h b/WebCore/rendering/RenderMedia.h
index 4c980b5..aa725ff 100644
--- a/WebCore/rendering/RenderMedia.h
+++ b/WebCore/rendering/RenderMedia.h
@@ -85,9 +85,10 @@ private:
     virtual bool isMedia() const { return true; }
     virtual bool isImage() const { return false; }
 
-    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
-    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true) const;
+    virtual int topmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int lowestPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int rightmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
+    virtual int leftmostPosition(bool includeOverflowInterior = true, bool includeSelf = true, ApplyTransform = IncludeTransform) const;
 
     void createControlsShadowRoot();
     void destroyControlsShadowRoot();
diff --git a/WebCore/rendering/RenderMediaControls.h b/WebCore/rendering/RenderMediaControls.h
index f05c549..9edeef1 100644
--- a/WebCore/rendering/RenderMediaControls.h
+++ b/WebCore/rendering/RenderMediaControls.h
@@ -26,6 +26,8 @@
 #ifndef RenderMediaControls_h
 #define RenderMediaControls_h
 
+#if ENABLE(VIDEO)
+
 #include "RenderObject.h"
 #include "MediaControlElements.h"
 
@@ -41,4 +43,6 @@ public:
 
 } // namespace WebCore
 
+#endif // ENABLE(VIDEO)
+
 #endif // RenderMediaControls_h
diff --git a/WebCore/rendering/RenderMediaControlsChromium.cpp b/WebCore/rendering/RenderMediaControlsChromium.cpp
index ab650da..f938a52 100644
--- a/WebCore/rendering/RenderMediaControlsChromium.cpp
+++ b/WebCore/rendering/RenderMediaControlsChromium.cpp
@@ -63,7 +63,7 @@ static bool hasSource(const HTMLMediaElement* mediaElement)
 static bool paintMediaButton(GraphicsContext* context, const IntRect& rect, Image* image)
 {
     IntRect imageRect = image->rect();
-    context->drawImage(image, DeviceColorSpace, rect);
+    context->drawImage(image, ColorSpaceDeviceRGB, rect);
     return true;
 }
 
@@ -120,9 +120,9 @@ static bool paintMediaSlider(RenderObject* object, const PaintInfo& paintInfo, c
     context->save();
     context->setShouldAntialias(true);
     context->setStrokeStyle(SolidStroke);
-    context->setStrokeColor(style->visitedDependentColor(CSSPropertyBorderLeftColor), DeviceColorSpace);
+    context->setStrokeColor(style->visitedDependentColor(CSSPropertyBorderLeftColor), ColorSpaceDeviceRGB);
     context->setStrokeThickness(style->borderLeftWidth());
-    context->setFillColor(style->visitedDependentColor(CSSPropertyBackgroundColor), DeviceColorSpace);
+    context->setFillColor(style->visitedDependentColor(CSSPropertyBackgroundColor), ColorSpaceDeviceRGB);
     context->drawRect(rect);
     context->restore();
 
@@ -189,13 +189,13 @@ static bool paintMediaVolumeSlider(RenderObject* object, const PaintInfo& paintI
     GraphicsContext* context = paintInfo.context;
     Color originalColor = context->strokeColor();
     if (originalColor != Color::white)
-        context->setStrokeColor(Color::white, DeviceColorSpace);
+        context->setStrokeColor(Color::white, ColorSpaceDeviceRGB);
 
     int x = rect.x() + rect.width() / 2;
     context->drawLine(IntPoint(x, rect.y()),  IntPoint(x, rect.y() + rect.height()));
 
     if (originalColor != Color::white)
-        context->setStrokeColor(originalColor, DeviceColorSpace);
+        context->setStrokeColor(originalColor, ColorSpaceDeviceRGB);
     return true;
 }
 
@@ -224,17 +224,17 @@ static bool paintMediaTimelineContainer(RenderObject* object, const PaintInfo& p
 
         // Draw the left border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderLeftWidth());
-        context->setStrokeColor(object->style()->visitedDependentColor(CSSPropertyBorderLeftColor).rgb(), DeviceColorSpace);
+        context->setStrokeColor(object->style()->visitedDependentColor(CSSPropertyBorderLeftColor).rgb(), ColorSpaceDeviceRGB);
         context->drawLine(IntPoint(rect.x() + 1, rect.y()),
                           IntPoint(rect.x() + 1, rect.y() + rect.height()));
 
         // Draw the right border using CSS defined width and color.
         context->setStrokeThickness(object->style()->borderRightWidth());
-        context->setStrokeColor(object->style()->visitedDependentColor(CSSPropertyBorderRightColor).rgb(), DeviceColorSpace);
+        context->setStrokeColor(object->style()->visitedDependentColor(CSSPropertyBorderRightColor).rgb(), ColorSpaceDeviceRGB);
         context->drawLine(IntPoint(rect.x() + rect.width() - 1, rect.y()),
                           IntPoint(rect.x() + rect.width() - 1, rect.y() + rect.height()));
 
-        context->setStrokeColor(originalColor, DeviceColorSpace);
+        context->setStrokeColor(originalColor, ColorSpaceDeviceRGB);
         context->setStrokeThickness(originalThickness);
         context->setStrokeStyle(originalStyle);
     }
diff --git a/WebCore/rendering/RenderMeter.cpp b/WebCore/rendering/RenderMeter.cpp
index 226d605..f60e350 100644
--- a/WebCore/rendering/RenderMeter.cpp
+++ b/WebCore/rendering/RenderMeter.cpp
@@ -105,7 +105,7 @@ IntRect RenderMeter::valuePartRect() const
     
     if (rect.height() <= rect.width()) {
         int width = static_cast<int>(rect.width()*valueRatio());
-        if (style()->direction() == RTL) {
+        if (!style()->isLeftToRightDirection()) {
             rect.setX(rect.x() + (rect.width() - width));
             rect.setWidth(width);
         } else
diff --git a/WebCore/rendering/RenderObject.cpp b/WebCore/rendering/RenderObject.cpp
index eb75ce2..9d2895f 100644
--- a/WebCore/rendering/RenderObject.cpp
+++ b/WebCore/rendering/RenderObject.cpp
@@ -1154,6 +1154,16 @@ void RenderObject::drawArcForBoxSide(GraphicsContext* graphicsContext, int x, in
     }
 }
 #endif
+    
+void RenderObject::paintFocusRing(GraphicsContext* context, int tx, int ty, RenderStyle* style)
+{
+    Vector<IntRect> focusRingRects;
+    addFocusRingRects(focusRingRects, tx, ty);
+    if (style->outlineStyleIsAuto())
+        context->drawFocusRing(focusRingRects, style->outlineWidth(), style->outlineOffset(), style->visitedDependentColor(CSSPropertyOutlineColor));
+    else
+        addPDFURLRect(context, unionRect(focusRingRects));
+}        
 
 void RenderObject::addPDFURLRect(GraphicsContext* context, const IntRect& rect)
 {
@@ -1184,12 +1194,7 @@ void RenderObject::paintOutline(GraphicsContext* graphicsContext, int tx, int ty
     if (styleToUse->outlineStyleIsAuto() || hasOutlineAnnotation()) {
         if (!theme()->supportsFocusRing(styleToUse)) {
             // Only paint the focus ring by hand if the theme isn't able to draw the focus ring.
-            Vector<IntRect> focusRingRects;
-            addFocusRingRects(focusRingRects, tx, ty);
-            if (styleToUse->outlineStyleIsAuto())
-                graphicsContext->drawFocusRing(focusRingRects, ow, offset, oc);
-            else
-                addPDFURLRect(graphicsContext, unionRect(focusRingRects));
+            paintFocusRing(graphicsContext, tx, ty, styleToUse);
         }
     }
 
@@ -2227,7 +2232,7 @@ void RenderObject::updateDragState(bool dragOn)
 {
     bool valueChanged = (dragOn != m_isDragging);
     m_isDragging = dragOn;
-    if (valueChanged && style()->affectedByDragRules())
+    if (valueChanged && style()->affectedByDragRules() && node())
         node()->setNeedsStyleRecalc();
     for (RenderObject* curr = firstChild(); curr; curr = curr->nextSibling())
         curr->updateDragState(dragOn);
@@ -2275,17 +2280,6 @@ bool RenderObject::nodeAtPoint(const HitTestRequest&, HitTestResult&, int /*x*/,
     return false;
 }
 
-int RenderObject::lineHeight(bool firstLine, bool /*isRootLineBox*/) const
-{
-    return style(firstLine)->computedLineHeight();
-}
-
-int RenderObject::baselinePosition(bool firstLine, bool isRootLineBox) const
-{
-    const Font& f = style(firstLine)->font();
-    return f.ascent() + (lineHeight(firstLine, isRootLineBox) - f.height()) / 2;
-}
-
 void RenderObject::scheduleRelayout()
 {
     if (isRenderView()) {
diff --git a/WebCore/rendering/RenderObject.h b/WebCore/rendering/RenderObject.h
index 70b0da5..9c29ce1 100644
--- a/WebCore/rendering/RenderObject.h
+++ b/WebCore/rendering/RenderObject.h
@@ -291,7 +291,9 @@ public:
 
     bool isHTMLMarquee() const;
 
+    inline bool isBeforeContent() const;
     inline bool isAfterContent() const;
+    static inline bool isBeforeContent(const RenderObject* obj) { return obj && obj->isBeforeContent(); }
     static inline bool isAfterContent(const RenderObject* obj) { return obj && obj->isAfterContent(); }
 
     bool childrenInline() const { return m_childrenInline; }
@@ -314,8 +316,9 @@ public:
     virtual bool isSVGContainer() const { return false; }
     virtual bool isSVGGradientStop() const { return false; }
     virtual bool isSVGHiddenContainer() const { return false; }
-    virtual bool isRenderPath() const { return false; }
+    virtual bool isSVGPath() const { return false; }
     virtual bool isSVGText() const { return false; }
+    virtual bool isSVGTextPath() const { return false; }
     virtual bool isSVGInline() const { return false; }
     virtual bool isSVGInlineText() const { return false; }
     virtual bool isSVGImage() const { return false; }
@@ -482,11 +485,6 @@ public:
     void updateFillImages(const FillLayer*, const FillLayer*);
     void updateImage(StyleImage*, StyleImage*);
 
-    // for discussion of lineHeight see CSS2 spec
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-    // for the vertical-align property of inline elements
-    // the offset of baseline from the top of the object.
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
     virtual void paint(PaintInfo&, int tx, int ty);
 
     // Recursive function that computes the size and position of this object and all its descendants.
@@ -748,6 +746,7 @@ protected:
     // Overrides should call the superclass at the start
     virtual void styleDidChange(StyleDifference, const RenderStyle* oldStyle);
 
+    void paintFocusRing(GraphicsContext*, int tx, int ty, RenderStyle*);
     void paintOutline(GraphicsContext*, int tx, int ty, int w, int h);
     void addPDFURLRect(GraphicsContext*, const IntRect&);
 
@@ -860,6 +859,16 @@ inline bool RenderObject::documentBeingDestroyed() const
     return !document()->renderer();
 }
 
+inline bool RenderObject::isBeforeContent() const
+{
+    if (style()->styleType() != BEFORE)
+        return false;
+    // Text nodes don't have their own styles, so ignore the style on a text node.
+    if (isText() && !isBR())
+        return false;
+    return true;
+}
+
 inline bool RenderObject::isAfterContent() const
 {
     if (style()->styleType() != AFTER)
diff --git a/WebCore/rendering/RenderObjectChildList.cpp b/WebCore/rendering/RenderObjectChildList.cpp
index 96ec800..c7c8e44 100644
--- a/WebCore/rendering/RenderObjectChildList.cpp
+++ b/WebCore/rendering/RenderObjectChildList.cpp
@@ -461,7 +461,10 @@ void RenderObjectChildList::updateBeforeAfterContent(RenderObject* owner, Pseudo
                 generatedContentContainer->setStyle(pseudoElementStyle);
                 owner->addChild(generatedContentContainer, insertBefore);
             }
-            generatedContentContainer->addChild(renderer);
+            if (generatedContentContainer->isChildAllowed(renderer, pseudoElementStyle))
+                generatedContentContainer->addChild(renderer);
+            else
+                renderer->destroy();
         }
     }
 }
diff --git a/WebCore/rendering/RenderProgress.cpp b/WebCore/rendering/RenderProgress.cpp
index d6e2dc7..d2e9424 100644
--- a/WebCore/rendering/RenderProgress.cpp
+++ b/WebCore/rendering/RenderProgress.cpp
@@ -137,7 +137,7 @@ void RenderProgress::updateAnimationState()
 IntRect RenderProgress::valuePartRect() const
 {
     IntRect rect(borderLeft() + paddingLeft(), borderTop() + paddingTop(), lround((width() - borderLeft() - paddingLeft() - borderRight() - paddingRight()) * position()), height()  - borderTop() - paddingTop() - borderBottom() - paddingBottom());
-    if (style()->direction() == RTL)
+    if (!style()->isLeftToRightDirection())
         rect.setX(width() - borderRight() - paddingRight() - rect.width());
     return rect;
 }
diff --git a/WebCore/rendering/RenderReplaced.cpp b/WebCore/rendering/RenderReplaced.cpp
index d3b449c..a087038 100644
--- a/WebCore/rendering/RenderReplaced.cpp
+++ b/WebCore/rendering/RenderReplaced.cpp
@@ -57,13 +57,6 @@ RenderReplaced::~RenderReplaced()
 {
 }
 
-void RenderReplaced::setStyle(PassRefPtr<RenderStyle> newStyle)
-{
-    if (newStyle->blockFlow() != TopToBottomBlockFlow)
-        newStyle->setBlockFlow(TopToBottomBlockFlow);
-    RenderBox::setStyle(newStyle);
-}
-
 void RenderReplaced::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBox::styleDidChange(diff, oldStyle);
@@ -88,8 +81,7 @@ void RenderReplaced::layout()
     m_overflow.clear();
     addShadowOverflow();
     
-    repainter.repaintAfterLayout();    
-
+    repainter.repaintAfterLayout();
     setNeedsLayout(false);
 }
  
@@ -207,54 +199,54 @@ static inline bool lengthIsSpecified(Length length)
     return lengthType == Fixed || lengthType == Percent;
 }
 
-int RenderReplaced::computeReplacedWidth(bool includeMaxWidth) const
+int RenderReplaced::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    int width;
+    int logicalWidth;
     if (lengthIsSpecified(style()->width()))
-        width = computeReplacedWidthUsing(style()->width());
+        logicalWidth = computeReplacedLogicalWidthUsing(style()->logicalWidth());
     else if (m_hasIntrinsicSize)
-        width = calcAspectRatioWidth();
+        logicalWidth = calcAspectRatioLogicalWidth();
     else
-        width = intrinsicSize().width();
+        logicalWidth = intrinsicLogicalWidth();
 
-    int minW = computeReplacedWidthUsing(style()->minWidth());
-    int maxW = !includeMaxWidth || style()->maxWidth().isUndefined() ? width : computeReplacedWidthUsing(style()->maxWidth());
+    int minLogicalWidth = computeReplacedLogicalWidthUsing(style()->logicalMinWidth());
+    int maxLogicalWidth = !includeMaxWidth || style()->logicalMaxWidth().isUndefined() ? logicalWidth : computeReplacedLogicalWidthUsing(style()->logicalMaxWidth());
 
-    return max(minW, min(width, maxW));
+    return max(minLogicalWidth, min(logicalWidth, maxLogicalWidth));
 }
 
-int RenderReplaced::computeReplacedHeight() const
+int RenderReplaced::computeReplacedLogicalHeight() const
 {
-    int height;
-    if (lengthIsSpecified(style()->height()))
-        height = computeReplacedHeightUsing(style()->height());
+    int logicalHeight;
+    if (lengthIsSpecified(style()->logicalHeight()))
+        logicalHeight = computeReplacedLogicalHeightUsing(style()->logicalHeight());
     else if (m_hasIntrinsicSize)
-        height = calcAspectRatioHeight();
+        logicalHeight = calcAspectRatioLogicalHeight();
     else
-        height = intrinsicSize().height();
+        logicalHeight = intrinsicLogicalHeight();
 
-    int minH = computeReplacedHeightUsing(style()->minHeight());
-    int maxH = style()->maxHeight().isUndefined() ? height : computeReplacedHeightUsing(style()->maxHeight());
+    int minLogicalHeight = computeReplacedLogicalHeightUsing(style()->logicalMinHeight());
+    int maxLogicalHeight = style()->logicalMaxHeight().isUndefined() ? logicalHeight : computeReplacedLogicalHeightUsing(style()->logicalMaxHeight());
 
-    return max(minH, min(height, maxH));
+    return max(minLogicalHeight, min(logicalHeight, maxLogicalHeight));
 }
 
-int RenderReplaced::calcAspectRatioWidth() const
+int RenderReplaced::calcAspectRatioLogicalWidth() const
 {
-    int intrinsicWidth = intrinsicSize().width();
-    int intrinsicHeight = intrinsicSize().height();
+    int intrinsicWidth = intrinsicLogicalWidth();
+    int intrinsicHeight = intrinsicLogicalHeight();
     if (!intrinsicHeight)
         return 0;
-    return RenderBox::computeReplacedHeight() * intrinsicWidth / intrinsicHeight;
+    return RenderBox::computeReplacedLogicalHeight() * intrinsicWidth / intrinsicHeight;
 }
 
-int RenderReplaced::calcAspectRatioHeight() const
+int RenderReplaced::calcAspectRatioLogicalHeight() const
 {
-    int intrinsicWidth = intrinsicSize().width();
-    int intrinsicHeight = intrinsicSize().height();
+    int intrinsicWidth = intrinsicLogicalWidth();
+    int intrinsicHeight = intrinsicLogicalHeight();
     if (!intrinsicWidth)
         return 0;
-    return RenderBox::computeReplacedWidth() * intrinsicHeight / intrinsicWidth;
+    return RenderBox::computeReplacedLogicalWidth() * intrinsicHeight / intrinsicWidth;
 }
 
 void RenderReplaced::computePreferredLogicalWidths()
@@ -262,7 +254,7 @@ void RenderReplaced::computePreferredLogicalWidths()
     ASSERT(preferredLogicalWidthsDirty());
 
     int borderAndPadding = borderAndPaddingWidth();
-    m_maxPreferredLogicalWidth = computeReplacedWidth(false) + borderAndPadding;
+    m_maxPreferredLogicalWidth = computeReplacedLogicalWidth(false) + borderAndPadding;
 
     if (style()->maxWidth().isFixed() && style()->maxWidth().value() != undefinedLength)
         m_maxPreferredLogicalWidth = min(m_maxPreferredLogicalWidth, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : 0));
@@ -277,16 +269,6 @@ void RenderReplaced::computePreferredLogicalWidths()
     setPreferredLogicalWidthsDirty(false);
 }
 
-int RenderReplaced::lineHeight(bool, bool) const
-{
-    return height() + marginTop() + marginBottom();
-}
-
-int RenderReplaced::baselinePosition(bool, bool) const
-{
-    return height() + marginTop() + marginBottom();
-}
-
 unsigned RenderReplaced::caretMaxRenderedOffset() const
 {
     return 1; 
diff --git a/WebCore/rendering/RenderReplaced.h b/WebCore/rendering/RenderReplaced.h
index 872f6d0..fbc5151 100644
--- a/WebCore/rendering/RenderReplaced.h
+++ b/WebCore/rendering/RenderReplaced.h
@@ -32,15 +32,13 @@ public:
     RenderReplaced(Node*, const IntSize& intrinsicSize);
     virtual ~RenderReplaced();
 
-    virtual void setStyle(PassRefPtr<RenderStyle>);
-
 protected:
     virtual void layout();
 
     virtual IntSize intrinsicSize() const;
 
-    virtual int computeReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int computeReplacedHeight() const;
+    virtual int computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
+    virtual int computeReplacedLogicalHeight() const;
     virtual int minimumReplacedHeight() const { return 0; }
 
     virtual void setSelectionState(SelectionState);
@@ -62,13 +60,10 @@ private:
 
     virtual bool canHaveChildren() const { return false; }
 
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox = false) const;
-
     virtual void computePreferredLogicalWidths();
 
-    int calcAspectRatioWidth() const;
-    int calcAspectRatioHeight() const;
+    int calcAspectRatioLogicalWidth() const;
+    int calcAspectRatioLogicalHeight() const;
 
     virtual void paintReplaced(PaintInfo&, int /*tx*/, int /*ty*/) { }
 
diff --git a/WebCore/rendering/RenderRuby.cpp b/WebCore/rendering/RenderRuby.cpp
index 2f543d5..7e19a79 100644
--- a/WebCore/rendering/RenderRuby.cpp
+++ b/WebCore/rendering/RenderRuby.cpp
@@ -44,8 +44,8 @@ static RenderRubyRun* lastRubyRun(const RenderObject* ruby)
     RenderObject* child = ruby->lastChild();
     if (child && ruby->isAfterContent(child))
         child = child->previousSibling();
-    ASSERT(!child || child->isRubyRun());
-    return static_cast<RenderRubyRun*>(child);
+    ASSERT(!child || child->isRubyRun() || child->isBeforeContent());
+    return child && child->isRubyRun() ? static_cast<RenderRubyRun*>(child) : 0;
 }
 
 static inline RenderRubyRun* findRubyRunParent(RenderObject* child)
@@ -75,15 +75,25 @@ bool RenderRubyAsInline::isChildAllowed(RenderObject* child, RenderStyle*) const
 
 void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    // Note: ':after' content is handled implicitly below
+    // Insert :before and :after content outside of ruby runs.
+    if (child->isBeforeContent() || child->isAfterContent()) {
+        RenderInline::addChild(child, beforeChild);
+        return;
+    }
 
+    // If the child is a ruby run, just add it normally.
     if (child->isRubyRun()) {
         RenderInline::addChild(child, beforeChild);
         return;
     }
 
-    if (beforeChild && !isAfterContent(beforeChild) && !beforeChild->isRubyRun()) {
-        if (RenderRubyRun* run = findRubyRunParent(beforeChild)) {
+    if (beforeChild && !isAfterContent(beforeChild)) {
+        // insert child into run
+        ASSERT(!beforeChild->isRubyRun());
+        RenderObject* run = beforeChild;
+        while (run && !run->isRubyRun())
+            run = run->parent();
+        if (run) {
             run->addChild(child, beforeChild);
             return;
         }
@@ -104,15 +114,15 @@ void RenderRubyAsInline::addChild(RenderObject* child, RenderObject* beforeChild
 
 void RenderRubyAsInline::removeChild(RenderObject* child)
 {
-    // If the child's parent is *this, i.e. a ruby run or ':after' content,
+    // If the child's parent is *this (a ruby run or :before or :after content),
     // just use the normal remove method.
-    if (child->parent() == this) {
-        ASSERT(child->isRubyRun() || child->isAfterContent());
+    if (child->isRubyRun() || child->isBeforeContent() || child->isAfterContent()) {
         RenderInline::removeChild(child);
         return;
     }
 
-    // Find the containing run
+    // Otherwise find the containing run and remove it from there.
+    ASSERT(child->parent() != this);
     RenderRubyRun* run = findRubyRunParent(child);
     ASSERT(run);
     run->removeChild(child);
@@ -139,9 +149,13 @@ bool RenderRubyAsBlock::isChildAllowed(RenderObject* child, RenderStyle*) const
 
 void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
 {
-    // Note: ':after' content is handled implicitely below
+    // Insert :before and :after content outside of ruby runs.
+    if (child->isBeforeContent() || child->isAfterContent()) {
+        RenderBlock::addChild(child, beforeChild);
+        return;
+    }
 
-    // if child is a ruby run, just add it normally
+    // If the child is a ruby run, just add it normally.
     if (child->isRubyRun()) {
         RenderBlock::addChild(child, beforeChild);
         return;
@@ -157,7 +171,7 @@ void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
             run->addChild(child, beforeChild);
             return;
         }
-        ASSERT(false); // beforeChild should always have a run as parent!
+        ASSERT_NOT_REACHED(); // beforeChild should always have a run as parent!
         // Emergency fallback: fall through and just append.
     }
 
@@ -174,14 +188,15 @@ void RenderRubyAsBlock::addChild(RenderObject* child, RenderObject* beforeChild)
 
 void RenderRubyAsBlock::removeChild(RenderObject* child)
 {
-    // If the child's parent is *this, just use the normal remove method.
-    if (child->parent() == this) {
-        // This should happen only during destruction of the whole ruby element, though.
+    // If the child's parent is *this (a ruby run or :before or :after content),
+    // just use the normal remove method.
+    if (child->isRubyRun() || child->isBeforeContent() || child->isAfterContent()) {
         RenderBlock::removeChild(child);
         return;
     }
 
-    // Find the containing run
+    // Otherwise find the containing run and remove it from there.
+    ASSERT(child->parent() != this);
     RenderRubyRun* run = findRubyRunParent(child);
     ASSERT(run);
     run->removeChild(child);
diff --git a/WebCore/rendering/RenderSVGAllInOne.cpp b/WebCore/rendering/RenderSVGAllInOne.cpp
index 9c30d88..7002747 100644
--- a/WebCore/rendering/RenderSVGAllInOne.cpp
+++ b/WebCore/rendering/RenderSVGAllInOne.cpp
@@ -30,8 +30,6 @@
 #include "RenderSVGGradientStop.cpp"
 #include "RenderSVGHiddenContainer.cpp"
 #include "RenderSVGImage.cpp"
-#include "RenderSVGInline.cpp"
-#include "RenderSVGInlineText.cpp"
 #include "RenderSVGModelObject.cpp"
 #include "RenderSVGResource.cpp"
 #include "RenderSVGResourceClipper.cpp"
@@ -47,24 +45,32 @@
 #include "RenderSVGResourceSolidColor.cpp"
 #include "RenderSVGRoot.cpp"
 #include "RenderSVGShadowTreeRootContainer.cpp"
-#include "RenderSVGTSpan.cpp"
-#include "RenderSVGText.cpp"
-#include "RenderSVGTextPath.cpp"
 #include "RenderSVGTransformableContainer.cpp"
 #include "RenderSVGViewportContainer.cpp"
-#include "SVGCharacterData.cpp"
-#include "SVGCharacterLayoutInfo.cpp"
 #include "SVGImageBufferTools.cpp"
-#include "SVGInlineFlowBox.cpp"
-#include "SVGInlineTextBox.cpp"
 #include "SVGMarkerLayoutInfo.cpp"
 #include "SVGRenderSupport.cpp"
 #include "SVGRenderTreeAsText.cpp"
 #include "SVGResources.cpp"
 #include "SVGResourcesCache.cpp"
 #include "SVGResourcesCycleSolver.cpp"
-#include "SVGRootInlineBox.cpp"
 #include "SVGShadowTreeElements.cpp"
-#include "SVGTextChunkLayoutInfo.cpp"
-#include "SVGTextLayoutUtilities.cpp"
-#include "SVGTextQuery.cpp"
+
+// FIXME: As soon as all SVG renderers live in rendering/svg, this file should be moved there as well, removing the need for the svg/ includes below.
+#include "svg/RenderSVGInline.cpp"
+#include "svg/RenderSVGInlineText.cpp"
+#include "svg/RenderSVGTSpan.cpp"
+#include "svg/RenderSVGText.cpp"
+#include "svg/RenderSVGTextPath.cpp"
+#include "svg/SVGInlineFlowBox.cpp"
+#include "svg/SVGInlineTextBox.cpp"
+#include "svg/SVGRootInlineBox.cpp"
+#include "svg/SVGTextChunk.cpp"
+#include "svg/SVGTextChunkBuilder.cpp"
+#include "svg/SVGTextLayoutAttributes.cpp"
+#include "svg/SVGTextLayoutAttributesBuilder.cpp"
+#include "svg/SVGTextLayoutEngine.cpp"
+#include "svg/SVGTextLayoutEngineBaseline.cpp"
+#include "svg/SVGTextLayoutEngineSpacing.cpp"
+#include "svg/SVGTextMetrics.cpp"
+#include "svg/SVGTextQuery.cpp"
diff --git a/WebCore/rendering/RenderSVGBlock.h b/WebCore/rendering/RenderSVGBlock.h
index c1379da..a9dd5db 100644
--- a/WebCore/rendering/RenderSVGBlock.h
+++ b/WebCore/rendering/RenderSVGBlock.h
@@ -31,7 +31,7 @@ class SVGElement;
 
 class RenderSVGBlock : public RenderBlock {
 public:
-    RenderSVGBlock(SVGElement*);
+    explicit RenderSVGBlock(SVGElement*);
 
 private:
     virtual void setStyle(PassRefPtr<RenderStyle>);
diff --git a/WebCore/rendering/RenderSVGContainer.cpp b/WebCore/rendering/RenderSVGContainer.cpp
index b5974ca..0761562 100644
--- a/WebCore/rendering/RenderSVGContainer.cpp
+++ b/WebCore/rendering/RenderSVGContainer.cpp
@@ -43,6 +43,10 @@ RenderSVGContainer::RenderSVGContainer(SVGStyledElement* node)
 {
 }
 
+RenderSVGContainer::~RenderSVGContainer()
+{
+}
+
 void RenderSVGContainer::layout()
 {
     ASSERT(needsLayout());
diff --git a/WebCore/rendering/RenderSVGContainer.h b/WebCore/rendering/RenderSVGContainer.h
index b0c952f..5bdbf32 100644
--- a/WebCore/rendering/RenderSVGContainer.h
+++ b/WebCore/rendering/RenderSVGContainer.h
@@ -33,7 +33,8 @@ class SVGElement;
 
 class RenderSVGContainer : public RenderSVGModelObject {
 public:
-    RenderSVGContainer(SVGStyledElement*);
+    explicit RenderSVGContainer(SVGStyledElement*);
+    virtual ~RenderSVGContainer();
 
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
diff --git a/WebCore/rendering/RenderSVGGradientStop.cpp b/WebCore/rendering/RenderSVGGradientStop.cpp
index ebf7385..a5e5808 100644
--- a/WebCore/rendering/RenderSVGGradientStop.cpp
+++ b/WebCore/rendering/RenderSVGGradientStop.cpp
@@ -72,7 +72,7 @@ void RenderSVGGradientStop::layout()
 
 SVGGradientElement* RenderSVGGradientStop::gradientElement() const
 {
-    Node* parentNode = node()->parent();
+    ContainerNode* parentNode = node()->parent();
     if (parentNode->hasTagName(linearGradientTag) || parentNode->hasTagName(radialGradientTag))
         return static_cast<SVGGradientElement*>(parentNode);
     return 0;
diff --git a/WebCore/rendering/RenderSVGHiddenContainer.cpp b/WebCore/rendering/RenderSVGHiddenContainer.cpp
index ee1d214..fb14ffe 100644
--- a/WebCore/rendering/RenderSVGHiddenContainer.cpp
+++ b/WebCore/rendering/RenderSVGHiddenContainer.cpp
@@ -25,7 +25,7 @@
 #if ENABLE(SVG)
 #include "RenderSVGHiddenContainer.h"
 
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "SVGStyledElement.h"
 
 namespace WebCore {
diff --git a/WebCore/rendering/RenderSVGHiddenContainer.h b/WebCore/rendering/RenderSVGHiddenContainer.h
index 97800d4..c591a88 100644
--- a/WebCore/rendering/RenderSVGHiddenContainer.h
+++ b/WebCore/rendering/RenderSVGHiddenContainer.h
@@ -34,7 +34,7 @@ namespace WebCore {
     // <defs>, <linearGradient>, <radialGradient> are all good examples
     class RenderSVGHiddenContainer : public RenderSVGContainer {
     public:
-        RenderSVGHiddenContainer(SVGStyledElement*);
+        explicit RenderSVGHiddenContainer(SVGStyledElement*);
 
         virtual const char* renderName() const { return "RenderSVGHiddenContainer"; }
 
diff --git a/WebCore/rendering/RenderSVGImage.cpp b/WebCore/rendering/RenderSVGImage.cpp
index a89a738..a569759 100644
--- a/WebCore/rendering/RenderSVGImage.cpp
+++ b/WebCore/rendering/RenderSVGImage.cpp
@@ -47,6 +47,7 @@ namespace WebCore {
 
 RenderSVGImage::RenderSVGImage(SVGImageElement* impl)
     : RenderSVGModelObject(impl)
+    , m_updateCachedRepaintRect(true)
     , m_needsTransformUpdate(true)
     , m_imageResource(RenderImageResource::create())
 {
@@ -62,36 +63,45 @@ void RenderSVGImage::layout()
 {
     ASSERT(needsLayout());
 
-    LayoutRepainter repainter(*this, checkForRepaintDuringLayout());
+    LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
     SVGImageElement* image = static_cast<SVGImageElement*>(node());
 
-    bool updateCachedBoundariesInParents = false;
+    bool transformOrBoundariesUpdate = m_needsTransformUpdate || m_updateCachedRepaintRect;
     if (m_needsTransformUpdate) {
         m_localTransform = image->animatedLocalTransform();
         m_needsTransformUpdate = false;
-        updateCachedBoundariesInParents = true;
     }
 
-    // FIXME: Optimize caching the repaint rects.
-    FloatRect oldBoundaries = m_localBounds;
-    m_localBounds = FloatRect(image->x().value(image), image->y().value(image), image->width().value(image), image->height().value(image));
-    m_cachedLocalRepaintRect = FloatRect();
-
-    if (!updateCachedBoundariesInParents)
-        updateCachedBoundariesInParents = oldBoundaries != m_localBounds;
+    if (m_updateCachedRepaintRect) {
+        m_repaintBoundingBox = m_objectBoundingBox;
+        SVGRenderSupport::intersectRepaintRectWithResources(this, m_repaintBoundingBox);
+        m_updateCachedRepaintRect = false;
+    }
 
     // Invalidate all resources of this client if our layout changed.
     if (m_everHadLayout && selfNeedsLayout())
         SVGResourcesCache::clientLayoutChanged(this);
 
     // If our bounds changed, notify the parents.
-    if (updateCachedBoundariesInParents)
+    if (transformOrBoundariesUpdate)
         RenderSVGModelObject::setNeedsBoundariesUpdate();
 
     repainter.repaintAfterLayout();
     setNeedsLayout(false);
 }
 
+void RenderSVGImage::updateFromElement()
+{
+    SVGImageElement* image = static_cast<SVGImageElement*>(node());
+
+    FloatRect oldBoundaries = m_objectBoundingBox;
+    m_objectBoundingBox = FloatRect(image->x().value(image), image->y().value(image), image->width().value(image), image->height().value(image));
+    if (m_objectBoundingBox != oldBoundaries) {
+        m_updateCachedRepaintRect = true;
+        setNeedsLayout(true);
+    }
+}
+
 void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled() || style()->visibility() == HIDDEN || !m_imageResource->hasImage())
@@ -112,14 +122,14 @@ void RenderSVGImage::paint(PaintInfo& paintInfo, int, int)
 
             if (SVGRenderSupport::prepareToRenderSVGContent(this, childPaintInfo)) {
                 Image* image = m_imageResource->image();
-                FloatRect destRect = m_localBounds;
+                FloatRect destRect = m_objectBoundingBox;
                 FloatRect srcRect(0, 0, image->width(), image->height());
 
                 SVGImageElement* imageElement = static_cast<SVGImageElement*>(node());
                 if (imageElement->preserveAspectRatio().align() != SVGPreserveAspectRatio::SVG_PRESERVEASPECTRATIO_NONE)
                     imageElement->preserveAspectRatio().transformRect(destRect, srcRect);
 
-                childPaintInfo.context->drawImage(image, DeviceColorSpace, destRect, srcRect);
+                childPaintInfo.context->drawImage(image, ColorSpaceDeviceRGB, destRect, srcRect);
             }
 
             SVGRenderSupport::finishRenderSVGContent(this, childPaintInfo, savedInfo.context);
@@ -148,7 +158,7 @@ bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest& request, HitTestResu
             return false;
 
         if (hitRules.canHitFill) {
-            if (m_localBounds.contains(localPoint)) {
+            if (m_objectBoundingBox.contains(localPoint)) {
                 updateHitTestResult(result, roundedIntPoint(localPoint));
                 return true;
             }
@@ -158,18 +168,6 @@ bool RenderSVGImage::nodeAtFloatPoint(const HitTestRequest& request, HitTestResu
     return false;
 }
 
-FloatRect RenderSVGImage::repaintRectInLocalCoordinates() const
-{
-    // If we already have a cached repaint rect, return that
-    if (!m_cachedLocalRepaintRect.isEmpty())
-        return m_cachedLocalRepaintRect;
-
-    m_cachedLocalRepaintRect = m_localBounds;
-    SVGRenderSupport::intersectRepaintRectWithResources(this, m_cachedLocalRepaintRect);
-
-    return m_cachedLocalRepaintRect;
-}
-
 void RenderSVGImage::imageChanged(WrappedImagePtr, const IntRect*)
 {
     // The image resource defaults to nullImage until the resource arrives.
diff --git a/WebCore/rendering/RenderSVGImage.h b/WebCore/rendering/RenderSVGImage.h
index da94568..485d6ab 100644
--- a/WebCore/rendering/RenderSVGImage.h
+++ b/WebCore/rendering/RenderSVGImage.h
@@ -42,6 +42,7 @@ public:
     virtual ~RenderSVGImage();
 
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
+    virtual void updateFromElement();
 
     RenderImageResource* imageResource() { return m_imageResource.get(); }
     const RenderImageResource* imageResource() const { return m_imageResource.get(); }
@@ -52,9 +53,9 @@ private:
 
     virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
 
-    virtual FloatRect objectBoundingBox() const { return m_localBounds; }
-    virtual FloatRect strokeBoundingBox() const { return m_localBounds; }
-    virtual FloatRect repaintRectInLocalCoordinates() const;
+    virtual FloatRect objectBoundingBox() const { return m_objectBoundingBox; }
+    virtual FloatRect strokeBoundingBox() const { return m_objectBoundingBox; }
+    virtual FloatRect repaintRectInLocalCoordinates() const { return m_repaintBoundingBox; }
 
     virtual void addFocusRingRects(Vector<IntRect>&, int tx, int ty);
 
@@ -69,10 +70,11 @@ private:
 
     virtual AffineTransform localTransform() const { return m_localTransform; }
 
+    bool m_updateCachedRepaintRect : 1;
     bool m_needsTransformUpdate : 1;
     AffineTransform m_localTransform;
-    FloatRect m_localBounds;
-    mutable FloatRect m_cachedLocalRepaintRect;
+    FloatRect m_objectBoundingBox;
+    FloatRect m_repaintBoundingBox;
     OwnPtr<RenderImageResource> m_imageResource;
 };
 
diff --git a/WebCore/rendering/RenderSVGInlineText.cpp b/WebCore/rendering/RenderSVGInlineText.cpp
deleted file mode 100644
index f5ea5fc..0000000
--- a/WebCore/rendering/RenderSVGInlineText.cpp
+++ /dev/null
@@ -1,111 +0,0 @@
-/*
- * This file is part of the WebKit project.
- *
- * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
- *           (C) 2006 Apple Computer Inc.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *           (C) 2008 Rob Buis <buis@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "RenderSVGInlineText.h"
-
-#include "FloatConversion.h"
-#include "FloatQuad.h"
-#include "RenderBlock.h"
-#include "RenderSVGRoot.h"
-#include "SVGInlineTextBox.h"
-#include "SVGRootInlineBox.h"
-#include "VisiblePosition.h"
-
-namespace WebCore {
-
-RenderSVGInlineText::RenderSVGInlineText(Node* n, PassRefPtr<StringImpl> str) 
-    : RenderText(n, str)
-{
-}
-
-void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
-{
-    RenderText::styleDidChange(diff, oldStyle);
-    
-    // FIXME: Should optimize this.
-    // SVG text is always transformed.
-    if (RefPtr<StringImpl> textToTransform = originalText())
-        setText(textToTransform.release(), true);
-}
-
-InlineTextBox* RenderSVGInlineText::createTextBox()
-{
-    InlineTextBox* box = new (renderArena()) SVGInlineTextBox(this);
-    box->setHasVirtualLogicalHeight();
-    return box;
-}
-
-IntRect RenderSVGInlineText::localCaretRect(InlineBox*, int, int*)
-{
-    return IntRect();
-}
-
-IntRect RenderSVGInlineText::linesBoundingBox() const
-{
-    IntRect boundingBox;
-    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
-        boundingBox.unite(box->calculateBoundaries());
-    return boundingBox;
-}
-
-bool RenderSVGInlineText::characterStartsNewTextChunk(int position) const
-{
-    ASSERT(m_attributes.xValues().size() == textLength());
-    ASSERT(m_attributes.yValues().size() == textLength());
-    ASSERT(position >= 0);
-    ASSERT(position < static_cast<int>(textLength()));
-
-    int currentPosition = 0;
-    unsigned size = m_attributes.characterDataValues().size();
-    for (unsigned i = 0; i < size; ++i) {
-        const SVGTextLayoutAttributes::CharacterData& data = m_attributes.characterDataValues().at(i);
-
-        // We found the desired character.
-        if (currentPosition == position) {
-            if (isVerticalWritingMode(style()->svgStyle()))
-                return m_attributes.yValues().at(position) != SVGTextLayoutAttributes::emptyValue();
-
-            return m_attributes.xValues().at(position) != SVGTextLayoutAttributes::emptyValue();
-        }
-
-        currentPosition += data.spansCharacters;
-        if (currentPosition > position)
-            break;
-    }
-
-    // The desired position is available in the x/y list, but not in the character data values list.
-    // That means the previous character data described a single glyph, consisting of multiple unicode characters.
-    // The consequence is that the desired character does not define a new absolute x/y position, even if present in the x/y test.
-    // This code is tested by svg/W3C-SVG-1.1/text-text-06-t.svg (and described in detail, why this influences chunk detection).
-    ASSERT(currentPosition > position);
-    return false;
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGModelObject.h b/WebCore/rendering/RenderSVGModelObject.h
index 9de217c..fb8f89f 100644
--- a/WebCore/rendering/RenderSVGModelObject.h
+++ b/WebCore/rendering/RenderSVGModelObject.h
@@ -47,7 +47,7 @@ class SVGStyledElement;
 
 class RenderSVGModelObject : public RenderObject {
 public:
-    RenderSVGModelObject(SVGStyledElement*);
+    explicit RenderSVGModelObject(SVGStyledElement*);
 
     virtual bool requiresLayer() const { return false; }
 
diff --git a/WebCore/rendering/RenderSVGResource.cpp b/WebCore/rendering/RenderSVGResource.cpp
index 0c943e5..f4c65d5 100644
--- a/WebCore/rendering/RenderSVGResource.cpp
+++ b/WebCore/rendering/RenderSVGResource.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *               2007 Rob Buis <buis@kde.org>
- *               2008 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2007 Rob Buis <buis@kde.org>
+ * Copyright (C) 2008 Dirk Schulze <krit@webkit.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -33,124 +33,102 @@
 
 namespace WebCore {
 
-inline void RenderSVGResource::adjustColorForPseudoRules(const RenderStyle* style, bool useFillPaint, Color& color)
-{
-    if (style->insideLink() != InsideVisitedLink)
-        return;
-
-    RenderStyle* visitedStyle = style->getCachedPseudoStyle(VISITED_LINK);
-    SVGPaint* visitedPaint = useFillPaint ? visitedStyle->svgStyle()->fillPaint() : visitedStyle->svgStyle()->strokePaint();
-    if (visitedPaint->paintType() == SVGPaint::SVG_PAINTTYPE_URI)
-        return;
-        
-    Color visitedColor;
-    if (visitedPaint->paintType() == SVGPaint::SVG_PAINTTYPE_CURRENTCOLOR)
-        visitedColor = visitedStyle->color();
-    else
-        visitedColor = visitedPaint->color();
-
-    if (visitedColor.isValid())
-        color = Color(visitedColor.red(), visitedColor.green(), visitedColor.blue(), color.alpha());
-}
-
-// FIXME: This method and strokePaintingResource() should be refactored, to share even more code
-RenderSVGResource* RenderSVGResource::fillPaintingResource(RenderObject* object, const RenderStyle* style)
+static inline RenderSVGResource* requestPaintingResource(RenderSVGResourceMode mode, RenderObject* object, const RenderStyle* style, Color& fallbackColor)
 {
     ASSERT(object);
     ASSERT(style);
 
+    // If we have no style at all, ignore it.
     const SVGRenderStyle* svgStyle = style->svgStyle();
-    if (!svgStyle || !svgStyle->hasFill())
+    if (!svgStyle)
         return 0;
 
-    SVGPaint* fillPaint = svgStyle->fillPaint();
-    ASSERT(fillPaint);
-
-    RenderSVGResource* fillPaintingResource = 0;
-
-    SVGPaint::SVGPaintType paintType = fillPaint->paintType();
-    if (paintType == SVGPaint::SVG_PAINTTYPE_URI || paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR) {
-        if (SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object))
-            fillPaintingResource = resources->fill();
-    }
-
-    if (paintType != SVGPaint::SVG_PAINTTYPE_URI && !fillPaintingResource) {
-        RenderSVGResourceSolidColor* solidResource = sharedSolidPaintingResource();
-        fillPaintingResource = solidResource;
-
-        Color fillColor;
-        if (fillPaint->paintType() == SVGPaint::SVG_PAINTTYPE_CURRENTCOLOR)
-            fillColor = style->visitedDependentColor(CSSPropertyColor);
-        else
-            fillColor = fillPaint->color();
-
-        adjustColorForPseudoRules(style, true /* useFillPaint */, fillColor);
-
-        // FIXME: Ideally invalid colors would never get set on the RenderStyle and this could turn into an ASSERT
-        if (fillColor.isValid())
-            solidResource->setColor(fillColor);
-        else
-            fillPaintingResource = 0;
+    // If we have no fill/stroke, return 0.
+    if (mode == ApplyToFillMode) {
+        if (!svgStyle->hasFill())
+            return 0;
+    } else {
+        if (!svgStyle->hasStroke())
+            return 0;
     }
 
-    if (!fillPaintingResource) {
-        // default value (black), see bug 11017
-        RenderSVGResourceSolidColor* solidResource = sharedSolidPaintingResource();
-        solidResource->setColor(Color::black);
-        fillPaintingResource = solidResource;
-    }
+    SVGPaint* paint = mode == ApplyToFillMode ? svgStyle->fillPaint() : svgStyle->strokePaint();
+    ASSERT(paint);
 
-    return fillPaintingResource;
-}
-
-RenderSVGResource* RenderSVGResource::strokePaintingResource(RenderObject* object, const RenderStyle* style)
-{
-    ASSERT(object);
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    if (!svgStyle || !svgStyle->hasStroke())
+    SVGPaint::SVGPaintType paintType = paint->paintType();
+    if (paintType == SVGPaint::SVG_PAINTTYPE_NONE)
         return 0;
 
-    SVGPaint* strokePaint = svgStyle->strokePaint();
-    ASSERT(strokePaint);
+    Color color;
+    if (paintType == SVGPaint::SVG_PAINTTYPE_RGBCOLOR
+        || paintType == SVGPaint::SVG_PAINTTYPE_RGBCOLOR_ICCCOLOR
+        || paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR
+        || paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR_ICCCOLOR)
+        color = paint->color();
+    else if (paintType == SVGPaint::SVG_PAINTTYPE_CURRENTCOLOR || paintType == SVGPaint::SVG_PAINTTYPE_URI_CURRENTCOLOR)
+        color = style->visitedDependentColor(CSSPropertyColor);
+
+    if (style->insideLink() == InsideVisitedLink) {
+        RenderStyle* visitedStyle = style->getCachedPseudoStyle(VISITED_LINK);
+        ASSERT(visitedStyle);
+
+        if (SVGPaint* visitedPaint = mode == ApplyToFillMode ? visitedStyle->svgStyle()->fillPaint() : visitedStyle->svgStyle()->strokePaint()) {
+            // For SVG_PAINTTYPE_CURRENTCOLOR, 'color' already contains the 'visitedColor'.
+            if (visitedPaint->paintType() < SVGPaint::SVG_PAINTTYPE_URI_NONE && visitedPaint->paintType() != SVGPaint::SVG_PAINTTYPE_CURRENTCOLOR) {
+                const Color& visitedColor = visitedPaint->color();
+                if (visitedColor.isValid())
+                    color = Color(visitedColor.red(), visitedColor.green(), visitedColor.blue(), color.alpha());
+            }
+        }
+    }
 
-    RenderSVGResource* strokePaintingResource = 0;
-    FloatRect objectBoundingBox = object->objectBoundingBox();
+    // If the primary resource is just a color, return immediately.
+    RenderSVGResourceSolidColor* colorResource = RenderSVGResource::sharedSolidPaintingResource();
+    if (paintType < SVGPaint::SVG_PAINTTYPE_URI_NONE) {
+        // If an invalid fill color is specified, fallback to fill/stroke="none".
+        if (!color.isValid())
+            return 0;
 
-    SVGPaint::SVGPaintType paintType = strokePaint->paintType();
-    if (!objectBoundingBox.isEmpty() && (paintType == SVGPaint::SVG_PAINTTYPE_URI || paintType == SVGPaint::SVG_PAINTTYPE_URI_RGBCOLOR)) {
-        if (SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object))
-            strokePaintingResource = resources->stroke();
+        colorResource->setColor(color);
+        return colorResource;
     }
 
-    if (paintType != SVGPaint::SVG_PAINTTYPE_URI && !strokePaintingResource) {
-        RenderSVGResourceSolidColor* solidResource = sharedSolidPaintingResource();
-        strokePaintingResource = solidResource;
+    // If no resources are associated with the given renderer, return the color resource.
+    SVGResources* resources = SVGResourcesCache::cachedResourcesForRenderObject(object);
+    if (!resources) {
+        // If a paint server is specified, and no or an invalid fallback color is given, default to fill/stroke="black".
+        if (!color.isValid())
+            color = Color::black;
 
-        Color strokeColor;
-        if (strokePaint->paintType() == SVGPaint::SVG_PAINTTYPE_CURRENTCOLOR)
-            strokeColor = style->visitedDependentColor(CSSPropertyColor);
-        else
-            strokeColor = strokePaint->color();
+        colorResource->setColor(color);
+        return colorResource;
+    }
 
-        adjustColorForPseudoRules(style, false /* useFillPaint */, strokeColor);
+    // If the requested resource is not available, return the color resource.
+    RenderSVGResource* uriResource = mode == ApplyToFillMode ? resources->fill() : resources->stroke();
+    if (!uriResource) {
+        // If a paint server is specified, and no or an invalid fallback color is given, default to fill/stroke="black".
+        if (!color.isValid())
+            color = Color::black;
 
-        // FIXME: Ideally invalid colors would never get set on the RenderStyle and this could turn into an ASSERT
-        if (strokeColor.isValid())
-            solidResource->setColor(strokeColor);
-        else
-            strokePaintingResource = 0;
+        colorResource->setColor(color);
+        return colorResource;
     }
 
-    if (!strokePaintingResource) {
-        // default value (black), see bug 11017
-        RenderSVGResourceSolidColor* solidResource = sharedSolidPaintingResource();
-        solidResource->setColor(Color::black);
-        strokePaintingResource = solidResource;
-    }
+    // The paint server resource exists, though it may be invalid (pattern with width/height=0). Pass the fallback color to our caller
+    // so it can use the solid color painting resource, if applyResource() on the URI resource failed.
+    fallbackColor = color;
+    return uriResource;
+}
+
+RenderSVGResource* RenderSVGResource::fillPaintingResource(RenderObject* object, const RenderStyle* style, Color& fallbackColor)
+{
+    return requestPaintingResource(ApplyToFillMode, object, style, fallbackColor);
+}
 
-    return strokePaintingResource;
+RenderSVGResource* RenderSVGResource::strokePaintingResource(RenderObject* object, const RenderStyle* style, Color& fallbackColor)
+{
+    return requestPaintingResource(ApplyToStrokeMode, object, style, fallbackColor);
 }
 
 RenderSVGResourceSolidColor* RenderSVGResource::sharedSolidPaintingResource()
diff --git a/WebCore/rendering/RenderSVGResource.h b/WebCore/rendering/RenderSVGResource.h
index a70ce52..0230e98 100644
--- a/WebCore/rendering/RenderSVGResource.h
+++ b/WebCore/rendering/RenderSVGResource.h
@@ -75,15 +75,12 @@ public:
         return 0;
     }
 
-    // Helper utilities used in the render tree to access resources used for painting shapes/text (gradients & patterns only)
-    static RenderSVGResource* fillPaintingResource(RenderObject*, const RenderStyle*);
-    static RenderSVGResource* strokePaintingResource(RenderObject*, const RenderStyle*);
+    // Helper utilities used in the render tree to access resources used for painting shapes/text (gradients & patterns & solid colors only)
+    static RenderSVGResource* fillPaintingResource(RenderObject*, const RenderStyle*, Color& fallbackColor);
+    static RenderSVGResource* strokePaintingResource(RenderObject*, const RenderStyle*, Color& fallbackColor);
     static RenderSVGResourceSolidColor* sharedSolidPaintingResource();
 
     static void markForLayoutAndParentResourceInvalidation(RenderObject*, bool needsLayout = true);
-
-private:
-    static void adjustColorForPseudoRules(const RenderStyle*, bool useFillPaint, Color&);
 };
 
 }
diff --git a/WebCore/rendering/RenderSVGResourceClipper.cpp b/WebCore/rendering/RenderSVGResourceClipper.cpp
index ef44a79..e7b9fbb 100644
--- a/WebCore/rendering/RenderSVGResourceClipper.cpp
+++ b/WebCore/rendering/RenderSVGResourceClipper.cpp
@@ -136,7 +136,7 @@ bool RenderSVGResourceClipper::pathOnlyClipping(GraphicsContext* context, const
             return false;
         // Fallback to masking, if there is more than one clipping path.
         if (clipPath.isEmpty()) {
-            clipPath = styled->toClipPath();
+            styled->toClipPath(clipPath);
             clipRule = svgStyle->clipRule();
         } else
             return false;
@@ -178,7 +178,7 @@ bool RenderSVGResourceClipper::applyClippingToContext(RenderObject* object, cons
     FloatRect clampedAbsoluteTargetRect = SVGImageBufferTools::clampedAbsoluteTargetRectForRenderer(object, absoluteTargetRect);
 
     if (shouldCreateClipData && !clampedAbsoluteTargetRect.isEmpty()) {
-        if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, clipperData->clipMaskImage, DeviceRGB))
+        if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, clipperData->clipMaskImage, ColorSpaceDeviceRGB))
             return false;
 
         GraphicsContext* maskContext = clipperData->clipMaskImage->context();
@@ -247,7 +247,7 @@ bool RenderSVGResourceClipper::drawContentIntoMaskImage(ClipperData* clipperData
         }
 
         // Only shapes, paths and texts are allowed for clipping.
-        if (!renderer->isRenderPath() && !renderer->isSVGText())
+        if (!renderer->isSVGPath() && !renderer->isSVGText())
             continue;
 
         // Save the old RenderStyle of the current object for restoring after drawing
@@ -289,7 +289,7 @@ void RenderSVGResourceClipper::calculateClipContentRepaintRect()
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isRenderPath() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGPath() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
             continue;
         RenderStyle* style = renderer->style();
         if (!style || style->display() == NONE || style->visibility() != VISIBLE)
@@ -315,7 +315,7 @@ bool RenderSVGResourceClipper::hitTestClipContent(const FloatRect& objectBoundin
         RenderObject* renderer = childNode->renderer();
         if (!childNode->isSVGElement() || !static_cast<SVGElement*>(childNode)->isStyled() || !renderer)
             continue;
-        if (!renderer->isRenderPath() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
+        if (!renderer->isSVGPath() && !renderer->isSVGText() && !renderer->isSVGShadowTreeRootContainer())
             continue;
         IntPoint hitPoint;
         HitTestResult result(hitPoint);
diff --git a/WebCore/rendering/RenderSVGResourceContainer.cpp b/WebCore/rendering/RenderSVGResourceContainer.cpp
index 41ab91f..fb30efd 100644
--- a/WebCore/rendering/RenderSVGResourceContainer.cpp
+++ b/WebCore/rendering/RenderSVGResourceContainer.cpp
@@ -179,7 +179,7 @@ void RenderSVGResourceContainer::registerResource()
 // FIXME: This does not belong here.
 AffineTransform RenderSVGResourceContainer::transformOnNonScalingStroke(RenderObject* object, const AffineTransform& resourceTransform)
 {
-    if (!object->isRenderPath())
+    if (!object->isSVGPath())
         return resourceTransform;
 
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(object->node());
diff --git a/WebCore/rendering/RenderSVGResourceFilter.cpp b/WebCore/rendering/RenderSVGResourceFilter.cpp
index 4dccad6..3203ddf 100644
--- a/WebCore/rendering/RenderSVGResourceFilter.cpp
+++ b/WebCore/rendering/RenderSVGResourceFilter.cpp
@@ -39,6 +39,7 @@
 #include "SVGFilter.h"
 #include "SVGFilterElement.h"
 #include "SVGFilterPrimitiveStandardAttributes.h"
+#include "SVGImageBufferTools.h"
 #include "SVGStyledElement.h"
 #include "SVGUnitTypes.h"
 #include <wtf/Vector.h>
@@ -150,70 +151,93 @@ bool RenderSVGResourceFilter::applyResource(RenderObject* object, RenderStyle*,
     }
 
     OwnPtr<FilterData> filterData(new FilterData);
+    FloatRect targetBoundingBox = object->objectBoundingBox();
+
+    SVGFilterElement* filterElement = static_cast<SVGFilterElement*>(node());
+    filterData->boundaries = filterElement->filterBoundingBox(targetBoundingBox);
+    if (filterData->boundaries.isEmpty())
+        return false;
+
+    // Determine absolute transformation matrix for filter. 
+    AffineTransform absoluteTransform;
+    SVGImageBufferTools::calculateTransformationToOutermostSVGCoordinateSystem(object, absoluteTransform);
+    if (!absoluteTransform.isInvertible())
+        return false;
+
+    // Eliminate shear of the absolute transformation matrix, to be able to produce unsheared tile images for feTile.
+    filterData->shearFreeAbsoluteTransform = AffineTransform(absoluteTransform.xScale(), 0, 0, absoluteTransform.yScale(), absoluteTransform.e(), absoluteTransform.f());
+
+    // Determine absolute boundaries of the filter and the drawing region.
+    FloatRect absoluteFilterBoundaries = filterData->shearFreeAbsoluteTransform.mapRect(filterData->boundaries);
+    FloatRect drawingRegion = object->strokeBoundingBox();
+    drawingRegion.intersect(filterData->boundaries);
+    FloatRect absoluteDrawingRegion = filterData->shearFreeAbsoluteTransform.mapRect(drawingRegion);
+
+    // Create the SVGFilter object.
+    bool primitiveBoundingBoxMode = filterElement->primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
+    filterData->filter = SVGFilter::create(filterData->shearFreeAbsoluteTransform, absoluteDrawingRegion, targetBoundingBox, filterData->boundaries, primitiveBoundingBoxMode);
+
+    // Create all relevant filter primitives.
     filterData->builder = buildPrimitives();
     if (!filterData->builder)
         return false;
 
-    FloatRect paintRect = object->strokeBoundingBox();
-
     // Calculate the scale factor for the use of filterRes.
     // Also see http://www.w3.org/TR/SVG/filters.html#FilterEffectsRegion
-    SVGFilterElement* filterElement = static_cast<SVGFilterElement*>(node());
-    filterData->boundaries = filterElement->filterBoundingBox(object->objectBoundingBox());
-    if (filterData->boundaries.isEmpty())
-        return false;
-
-    FloatSize scale(1.0f, 1.0f);
+    FloatSize scale(1, 1);
     if (filterElement->hasAttribute(SVGNames::filterResAttr)) {
-        scale.setWidth(filterElement->filterResX() / filterData->boundaries.width());
-        scale.setHeight(filterElement->filterResY() / filterData->boundaries.height());
+        scale.setWidth(filterElement->filterResX() / absoluteFilterBoundaries.width());
+        scale.setHeight(filterElement->filterResY() / absoluteFilterBoundaries.height());
     }
 
     if (scale.isEmpty())
         return false;
 
-    // clip sourceImage to filterRegion
-    FloatRect clippedSourceRect = paintRect;
-    clippedSourceRect.intersect(filterData->boundaries);
-
-    // scale filter size to filterRes
-    FloatRect tempSourceRect = clippedSourceRect;
-
-    // scale to big sourceImage size to kMaxFilterSize
+    // Determine scale factor for filter. The size of intermediate ImageBuffers shouldn't be bigger than kMaxFilterSize.
+    FloatRect tempSourceRect = absoluteDrawingRegion;
     tempSourceRect.scale(scale.width(), scale.height());
     fitsInMaximumImageSize(tempSourceRect.size(), scale);
 
-    // prepare Filters
-    bool primitiveBoundingBoxMode = filterElement->primitiveUnits() == SVGUnitTypes::SVG_UNIT_TYPE_OBJECTBOUNDINGBOX;
-    filterData->filter = SVGFilter::create(paintRect, filterData->boundaries, primitiveBoundingBoxMode);
+    // Set the scale level in SVGFilter.
     filterData->filter->setFilterResolution(scale);
 
     FilterEffect* lastEffect = filterData->builder->lastEffect();
     if (!lastEffect)
         return false;
-    
+
+    // Determine the filter primitive subregions of every effect.
     lastEffect->determineFilterPrimitiveSubregion(filterData->filter.get());
-    // At least one FilterEffect has a too big image size,
-    // recalculate the effect sizes with new scale factors.
     if (!fitsInMaximumImageSize(filterData->filter->maxImageSize(), scale)) {
+        // At least one FilterEffect has a too big image size,
+        // recalculate the effect sizes with new scale factor.
         filterData->filter->setFilterResolution(scale);
         lastEffect->determineFilterPrimitiveSubregion(filterData->filter.get());
     }
 
-    clippedSourceRect.scale(scale.width(), scale.height());
-
-    // Draw the content of the current element and it's childs to a imageBuffer to get the SourceGraphic.
-    // The size of the SourceGraphic is clipped to the size of the filterRegion.
-    IntRect bufferRect = enclosingIntRect(clippedSourceRect);
-    OwnPtr<ImageBuffer> sourceGraphic(ImageBuffer::create(bufferRect.size(), LinearRGB));
-    
-    if (!sourceGraphic.get())
+    // If the drawingRegion is empty, we have something like <g filter=".."/>.
+    // Even if the target objectBoundingBox() is empty, we still have to draw the last effect result image in postApplyResource.
+    if (drawingRegion.isEmpty()) {
+        ASSERT(!m_filter.contains(object));
+        filterData->savedContext = context;
+        m_filter.set(object, filterData.leakPtr());
         return false;
+    }
 
+    absoluteDrawingRegion.scale(scale.width(), scale.height());
+
+    OwnPtr<ImageBuffer> sourceGraphic;
+    if (!SVGImageBufferTools::createImageBuffer(absoluteDrawingRegion, absoluteDrawingRegion, sourceGraphic, ColorSpaceLinearRGB))
+        return false;
+    
     GraphicsContext* sourceGraphicContext = sourceGraphic->context();
-    sourceGraphicContext->translate(-clippedSourceRect.x(), -clippedSourceRect.y());
-    sourceGraphicContext->scale(scale);
-    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), paintRect.size()));
+    ASSERT(sourceGraphicContext);
+  
+    sourceGraphicContext->translate(-absoluteDrawingRegion.x(), -absoluteDrawingRegion.y());
+    if (scale.width() != 1 || scale.height() != 1)
+        sourceGraphicContext->scale(scale);
+
+    sourceGraphicContext->concatCTM(filterData->shearFreeAbsoluteTransform);
+    sourceGraphicContext->clearRect(FloatRect(FloatPoint(), absoluteDrawingRegion.size()));
     filterData->sourceGraphicBuffer = sourceGraphic.release();
     filterData->savedContext = context;
 
@@ -248,7 +272,8 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
         context = filterData->savedContext;
         filterData->savedContext = 0;
 #if !PLATFORM(CG)
-        filterData->sourceGraphicBuffer->transformColorSpace(DeviceRGB, LinearRGB);
+        if (filterData->sourceGraphicBuffer)
+            filterData->sourceGraphicBuffer->transformColorSpace(ColorSpaceDeviceRGB, ColorSpaceLinearRGB);
 #endif
     }
 
@@ -264,16 +289,23 @@ void RenderSVGResourceFilter::postApplyResource(RenderObject* object, GraphicsCo
 #if !PLATFORM(CG)
             ImageBuffer* resultImage = lastEffect->resultImage();
             if (resultImage)
-                resultImage->transformColorSpace(LinearRGB, DeviceRGB);
+                resultImage->transformColorSpace(ColorSpaceLinearRGB, ColorSpaceDeviceRGB);
 #endif
             filterData->builded = true;
         }
 
         ImageBuffer* resultImage = lastEffect->resultImage();
-        if (resultImage)
-            context->drawImageBuffer(resultImage, object->style()->colorSpace(), lastEffect->filterPrimitiveSubregion());
-    }
+        if (resultImage) {
+            context->concatCTM(filterData->shearFreeAbsoluteTransform.inverse());
 
+            context->scale(FloatSize(1 / filterData->filter->filterResolution().width(), 1 / filterData->filter->filterResolution().height()));
+            context->clip(lastEffect->maxEffectRect());
+            context->drawImageBuffer(resultImage, object->style()->colorSpace(), lastEffect->absolutePaintRect());
+            context->scale(filterData->filter->filterResolution());
+
+            context->concatCTM(filterData->shearFreeAbsoluteTransform);
+        }
+    }
     filterData->sourceGraphicBuffer.clear();
 }
 
diff --git a/WebCore/rendering/RenderSVGResourceFilter.h b/WebCore/rendering/RenderSVGResourceFilter.h
index 314c94d..c64f5c6 100644
--- a/WebCore/rendering/RenderSVGResourceFilter.h
+++ b/WebCore/rendering/RenderSVGResourceFilter.h
@@ -42,7 +42,8 @@ namespace WebCore {
 
 struct FilterData {
     FilterData()
-        : builded(false)
+        : savedContext(0)
+        , builded(false)
     {
     }
 
@@ -50,6 +51,7 @@ struct FilterData {
     RefPtr<SVGFilterBuilder> builder;
     OwnPtr<ImageBuffer> sourceGraphicBuffer;
     GraphicsContext* savedContext;
+    AffineTransform shearFreeAbsoluteTransform;
     FloatRect boundaries;
     FloatSize scale;
     bool builded;
diff --git a/WebCore/rendering/RenderSVGResourceFilterPrimitive.h b/WebCore/rendering/RenderSVGResourceFilterPrimitive.h
index 4b23737..b054203 100644
--- a/WebCore/rendering/RenderSVGResourceFilterPrimitive.h
+++ b/WebCore/rendering/RenderSVGResourceFilterPrimitive.h
@@ -36,7 +36,7 @@ namespace WebCore {
 
 class RenderSVGResourceFilterPrimitive : public RenderSVGHiddenContainer {
 public:
-    RenderSVGResourceFilterPrimitive(SVGFilterPrimitiveStandardAttributes* filterPrimitiveElement);
+    explicit RenderSVGResourceFilterPrimitive(SVGFilterPrimitiveStandardAttributes* filterPrimitiveElement);
 
 private:
     virtual const char* renderName() const { return "RenderSVGResourceFilterPrimitive"; }
diff --git a/WebCore/rendering/RenderSVGResourceGradient.cpp b/WebCore/rendering/RenderSVGResourceGradient.cpp
index 1c33de4..a757147 100644
--- a/WebCore/rendering/RenderSVGResourceGradient.cpp
+++ b/WebCore/rendering/RenderSVGResourceGradient.cpp
@@ -1,7 +1,7 @@
 /*
  * Copyright (C) 2006 Nikolas Zimmermann <zimmermann@kde.org>
- *               2008 Eric Seidel <eric@webkit.org>
- *               2008 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2008 Eric Seidel <eric@webkit.org>
+ * Copyright (C) 2008 Dirk Schulze <krit@webkit.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -28,6 +28,7 @@
 
 #include "GradientAttributes.h"
 #include "GraphicsContext.h"
+#include "RenderSVGText.h"
 #include "SVGImageBufferTools.h"
 #include "SVGRenderSupport.h"
 #include <wtf/UnusedParam.h>
@@ -36,6 +37,7 @@ namespace WebCore {
 
 RenderSVGResourceGradient::RenderSVGResourceGradient(SVGGradientElement* node)
     : RenderSVGResourceContainer(node)
+    , m_shouldCollectGradientAttributes(true)
 #if PLATFORM(CG)
     , m_savedContext(0)
 #endif
@@ -58,6 +60,7 @@ void RenderSVGResourceGradient::removeAllClientsFromCache(bool markForInvalidati
         m_gradient.clear();
     }
 
+    m_shouldCollectGradientAttributes = true;
     markAllClientsForInvalidation(markForInvalidation ? RepaintInvalidation : ParentOnlyInvalidation);
 }
 
@@ -75,9 +78,9 @@ void RenderSVGResourceGradient::removeClientFromCache(RenderObject* client, bool
 static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& context,
                                                            GraphicsContext*& savedContext,
                                                            OwnPtr<ImageBuffer>& imageBuffer,
-                                                           const RenderObject* object)
+                                                           RenderObject* object)
 {
-    const RenderObject* textRootBlock = SVGRenderSupport::findTextRootObject(object);
+    RenderObject* textRootBlock = RenderSVGText::locateRenderSVGTextAncestor(object);
     ASSERT(textRootBlock);
 
     AffineTransform absoluteTransform;
@@ -89,7 +92,7 @@ static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& con
         return false;
 
     OwnPtr<ImageBuffer> maskImage;
-    if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, maskImage, DeviceRGB))
+    if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, maskImage, ColorSpaceDeviceRGB))
         return false;
 
     GraphicsContext* maskImageContext = maskImage->context();
@@ -108,10 +111,11 @@ static inline bool createMaskAndSwapContextForTextGradient(GraphicsContext*& con
 static inline AffineTransform clipToTextMask(GraphicsContext* context,
                                              OwnPtr<ImageBuffer>& imageBuffer,
                                              FloatRect& targetRect,
-                                             const RenderObject* object,
-                                             GradientData* gradientData)
+                                             RenderObject* object,
+                                             bool boundingBoxMode,
+                                             const AffineTransform& gradientTransform)
 {
-    const RenderObject* textRootBlock = SVGRenderSupport::findTextRootObject(object);
+    RenderObject* textRootBlock = RenderSVGText::locateRenderSVGTextAncestor(object);
     ASSERT(textRootBlock);
 
     targetRect = textRootBlock->repaintRectInLocalCoordinates();
@@ -125,12 +129,12 @@ static inline AffineTransform clipToTextMask(GraphicsContext* context,
     SVGImageBufferTools::clipToImageBuffer(context, absoluteTransform, clampedAbsoluteTargetRect, imageBuffer);
 
     AffineTransform matrix;
-    if (gradientData->boundingBoxMode) {
+    if (boundingBoxMode) {
         FloatRect maskBoundingBox = textRootBlock->objectBoundingBox();
         matrix.translate(maskBoundingBox.x(), maskBoundingBox.y());
         matrix.scaleNonUniform(maskBoundingBox.width(), maskBoundingBox.height());
     }
-    matrix.multLeft(gradientData->transform);
+    matrix.multLeft(gradientTransform);
     return matrix;
 }
 #endif
@@ -150,13 +154,22 @@ bool RenderSVGResourceGradient::applyResource(RenderObject* object, RenderStyle*
     if (!gradientElement)
         return false;
 
-    gradientElement->updateAnimatedSVGAttribute(anyQName());
+    if (m_shouldCollectGradientAttributes) {
+        gradientElement->updateAnimatedSVGAttribute(anyQName());
+        collectGradientAttributes(gradientElement);
+        m_shouldCollectGradientAttributes = false;
+    }
+
+    // Spec: When the geometry of the applicable element has no width or height and objectBoundingBox is specified,
+    // then the given effect (e.g. a gradient or a filter) will be ignored.
+    FloatRect objectBoundingBox = object->objectBoundingBox();
+    if (boundingBoxMode() && objectBoundingBox.isEmpty())
+        return false;
 
     if (!m_gradient.contains(object))
         m_gradient.set(object, new GradientData);
 
     GradientData* gradientData = m_gradient.get(object);
-
     bool isPaintingText = resourceMode & ApplyToTextMode;
 
     // Create gradient object
@@ -167,16 +180,18 @@ bool RenderSVGResourceGradient::applyResource(RenderObject* object, RenderStyle*
         // resource, so don't apply it here. For non-CG platforms, we want the text bounding
         // box applied to the gradient space transform now, so the gradient shader can use it.
 #if PLATFORM(CG)
-        if (gradientData->boundingBoxMode && !isPaintingText) {
+        if (boundingBoxMode() && !objectBoundingBox.isEmpty() && !isPaintingText) {
 #else
-        if (gradientData->boundingBoxMode) {
+        if (boundingBoxMode() && !objectBoundingBox.isEmpty()) {
 #endif
-            FloatRect objectBoundingBox = object->objectBoundingBox();
             gradientData->userspaceTransform.translate(objectBoundingBox.x(), objectBoundingBox.y());
             gradientData->userspaceTransform.scaleNonUniform(objectBoundingBox.width(), objectBoundingBox.height());
         }
 
-        gradientData->userspaceTransform.multLeft(gradientData->transform);
+        AffineTransform gradientTransform;
+        calculateGradientTransform(gradientTransform);
+
+        gradientData->userspaceTransform.multLeft(gradientTransform);
         gradientData->gradient->setGradientSpaceTransform(gradientData->userspaceTransform);
     }
 
@@ -230,8 +245,11 @@ void RenderSVGResourceGradient::postApplyResource(RenderObject* object, Graphics
             context = m_savedContext;
             m_savedContext = 0;
 
+            AffineTransform gradientTransform;
+            calculateGradientTransform(gradientTransform);
+
             FloatRect targetRect;
-            gradientData->gradient->setGradientSpaceTransform(clipToTextMask(context, m_imageBuffer, targetRect, object, gradientData));
+            gradientData->gradient->setGradientSpaceTransform(clipToTextMask(context, m_imageBuffer, targetRect, object, boundingBoxMode(), gradientTransform));
             context->setFillGradient(gradientData->gradient);
 
             context->fillRect(targetRect);
diff --git a/WebCore/rendering/RenderSVGResourceGradient.h b/WebCore/rendering/RenderSVGResourceGradient.h
index 4de4272..bc0b864 100644
--- a/WebCore/rendering/RenderSVGResourceGradient.h
+++ b/WebCore/rendering/RenderSVGResourceGradient.h
@@ -37,10 +37,7 @@ namespace WebCore {
 
 struct GradientData {
     RefPtr<Gradient> gradient;
-
-    bool boundingBoxMode;
     AffineTransform userspaceTransform;
-    AffineTransform transform;
 };
 
 class GraphicsContext;
@@ -59,9 +56,14 @@ public:
 
 protected:
     void addStops(GradientData*, const Vector<Gradient::ColorStop>&) const;
+
+    virtual bool boundingBoxMode() const = 0;
+    virtual void calculateGradientTransform(AffineTransform&) = 0;
+    virtual void collectGradientAttributes(SVGGradientElement*) = 0;
     virtual void buildGradient(GradientData*, SVGGradientElement*) const = 0;
 
 private:
+    bool m_shouldCollectGradientAttributes : 1;
     HashMap<RenderObject*, GradientData*> m_gradient;
 
 #if PLATFORM(CG)
diff --git a/WebCore/rendering/RenderSVGResourceLinearGradient.cpp b/WebCore/rendering/RenderSVGResourceLinearGradient.cpp
index e34e524..ce8d69e 100644
--- a/WebCore/rendering/RenderSVGResourceLinearGradient.cpp
+++ b/WebCore/rendering/RenderSVGResourceLinearGradient.cpp
@@ -40,25 +40,26 @@ RenderSVGResourceLinearGradient::~RenderSVGResourceLinearGradient()
 {
 }
 
+void RenderSVGResourceLinearGradient::collectGradientAttributes(SVGGradientElement* gradientElement)
+{
+    m_attributes = LinearGradientAttributes();
+    static_cast<SVGLinearGradientElement*>(gradientElement)->collectGradientAttributes(m_attributes);
+}
+
 void RenderSVGResourceLinearGradient::buildGradient(GradientData* gradientData, SVGGradientElement* gradientElement) const
 {
     SVGLinearGradientElement* linearGradientElement = static_cast<SVGLinearGradientElement*>(gradientElement);
-    LinearGradientAttributes attributes = linearGradientElement->collectGradientProperties();
 
     // Determine gradient start/end points
     FloatPoint startPoint;
     FloatPoint endPoint;
-    linearGradientElement->calculateStartEndPoints(attributes, startPoint, endPoint);
+    linearGradientElement->calculateStartEndPoints(m_attributes, startPoint, endPoint);
 
     gradientData->gradient = Gradient::create(startPoint, endPoint);
-    gradientData->gradient->setSpreadMethod(attributes.spreadMethod());
-
-    // Record current gradient transform
-    gradientData->transform = attributes.gradientTransform();
-    gradientData->boundingBoxMode = attributes.boundingBoxMode();
+    gradientData->gradient->setSpreadMethod(m_attributes.spreadMethod());
 
     // Add stops
-    addStops(gradientData, attributes.stops());
+    addStops(gradientData, m_attributes.stops());
 }
 
 }
diff --git a/WebCore/rendering/RenderSVGResourceLinearGradient.h b/WebCore/rendering/RenderSVGResourceLinearGradient.h
index c1f84c2..9e4530d 100644
--- a/WebCore/rendering/RenderSVGResourceLinearGradient.h
+++ b/WebCore/rendering/RenderSVGResourceLinearGradient.h
@@ -23,6 +23,7 @@
 #define RenderSVGResourceLinearGradient_h
 
 #if ENABLE(SVG)
+#include "LinearGradientAttributes.h"
 #include "RenderSVGResourceGradient.h"
 
 namespace WebCore {
@@ -39,7 +40,13 @@ public:
     virtual RenderSVGResourceType resourceType() const { return s_resourceType; }
     static RenderSVGResourceType s_resourceType;
 
+    virtual bool boundingBoxMode() const { return m_attributes.boundingBoxMode(); }
+    virtual void calculateGradientTransform(AffineTransform& transform) { transform = m_attributes.gradientTransform(); }
+    virtual void collectGradientAttributes(SVGGradientElement*);
     virtual void buildGradient(GradientData*, SVGGradientElement*) const;
+
+private:
+    LinearGradientAttributes m_attributes;
 };
 
 }
diff --git a/WebCore/rendering/RenderSVGResourceMasker.cpp b/WebCore/rendering/RenderSVGResourceMasker.cpp
index 3e81929..10133b2 100644
--- a/WebCore/rendering/RenderSVGResourceMasker.cpp
+++ b/WebCore/rendering/RenderSVGResourceMasker.cpp
@@ -107,7 +107,7 @@ bool RenderSVGResourceMasker::applyResource(RenderObject* object, RenderStyle*,
         if (!maskElement)
             return false;
 
-        if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, maskerData->maskImage, LinearRGB))
+        if (!SVGImageBufferTools::createImageBuffer(absoluteTargetRect, clampedAbsoluteTargetRect, maskerData->maskImage, ColorSpaceLinearRGB))
             return false;
 
         GraphicsContext* maskImageContext = maskerData->maskImage->context();
@@ -156,7 +156,7 @@ void RenderSVGResourceMasker::drawContentIntoMaskImage(MaskerData* maskerData, c
     maskImageContext->restore();
 
 #if !PLATFORM(CG)
-    maskerData->maskImage->transformColorSpace(DeviceRGB, LinearRGB);
+    maskerData->maskImage->transformColorSpace(ColorSpaceDeviceRGB, ColorSpaceLinearRGB);
 #endif
 
     // Create the luminance mask.
diff --git a/WebCore/rendering/RenderSVGResourcePattern.cpp b/WebCore/rendering/RenderSVGResourcePattern.cpp
index ccbdaca..d2e4563 100644
--- a/WebCore/rendering/RenderSVGResourcePattern.cpp
+++ b/WebCore/rendering/RenderSVGResourcePattern.cpp
@@ -37,6 +37,7 @@ RenderSVGResourceType RenderSVGResourcePattern::s_resourceType = PatternResource
 
 RenderSVGResourcePattern::RenderSVGResourcePattern(SVGPatternElement* node)
     : RenderSVGResourceContainer(node)
+    , m_shouldCollectPatternAttributes(true)
 {
 }
 
@@ -56,6 +57,7 @@ void RenderSVGResourcePattern::removeAllClientsFromCache(bool markForInvalidatio
         m_pattern.clear();
     }
 
+    m_shouldCollectPatternAttributes = true;
     markAllClientsForInvalidation(markForInvalidation ? RepaintInvalidation : ParentOnlyInvalidation);
 }
 
@@ -84,22 +86,34 @@ bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle*
     if (!patternElement)
         return false;
 
-    patternElement->updateAnimatedSVGAttribute(anyQName());
+    if (m_shouldCollectPatternAttributes) {
+        patternElement->updateAnimatedSVGAttribute(anyQName());
+
+        m_attributes = PatternAttributes();
+        patternElement->collectPatternAttributes(m_attributes);
+        m_shouldCollectPatternAttributes = false;
+    }
+
+    // Spec: When the geometry of the applicable element has no width or height and objectBoundingBox is specified,
+    // then the given effect (e.g. a gradient or a filter) will be ignored.
+    FloatRect objectBoundingBox = object->objectBoundingBox();
+    if (m_attributes.boundingBoxMode() && objectBoundingBox.isEmpty())
+        return false;
 
     if (!m_pattern.contains(object))
         m_pattern.set(object, new PatternData);
 
     PatternData* patternData = m_pattern.get(object);
     if (!patternData->pattern) {
-        PatternAttributes attributes = patternElement->collectPatternProperties();
-
         // If we couldn't determine the pattern content element root, stop here.
-        if (!attributes.patternContentElement())
+        if (!m_attributes.patternContentElement())
             return false;
 
         // Compute all necessary transformations to build the tile image & the pattern.
         FloatRect tileBoundaries;
-        AffineTransform tileImageTransform = buildTileImageTransform(object, attributes, patternElement, tileBoundaries);
+        AffineTransform tileImageTransform;
+        if (!buildTileImageTransform(object, m_attributes, patternElement, tileBoundaries, tileImageTransform))
+            return false;
 
         AffineTransform absoluteTransform;
         SVGImageBufferTools::calculateTransformationToOutermostSVGCoordinateSystem(object, absoluteTransform);
@@ -107,7 +121,7 @@ bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle*
         FloatRect absoluteTileBoundaries = absoluteTransform.mapRect(tileBoundaries);
 
         // Build tile image.
-        OwnPtr<ImageBuffer> tileImage = createTileImage(object, attributes, tileBoundaries, absoluteTileBoundaries, tileImageTransform);
+        OwnPtr<ImageBuffer> tileImage = createTileImage(object, m_attributes, tileBoundaries, absoluteTileBoundaries, tileImageTransform);
         if (!tileImage)
             return false;
 
@@ -124,7 +138,7 @@ bool RenderSVGResourcePattern::applyResource(RenderObject* object, RenderStyle*
         patternData->transform.translate(tileBoundaries.x(), tileBoundaries.y());
         patternData->transform.scale(tileBoundaries.width() / absoluteTileBoundaries.width(), tileBoundaries.height() / absoluteTileBoundaries.height());
 
-        AffineTransform patternTransform = attributes.patternTransform();
+        AffineTransform patternTransform = m_attributes.patternTransform();
         if (!patternTransform.isIdentity())
             patternData->transform.multiply(patternTransform);
 
@@ -201,19 +215,21 @@ static inline FloatRect calculatePatternBoundaries(const PatternAttributes& attr
                      attributes.height().value(patternElement));
 }
 
-AffineTransform RenderSVGResourcePattern::buildTileImageTransform(RenderObject* renderer,
-                                                                  const PatternAttributes& attributes,
-                                                                  const SVGPatternElement* patternElement,
-                                                                  FloatRect& patternBoundaries) const
+bool RenderSVGResourcePattern::buildTileImageTransform(RenderObject* renderer,
+                                                       const PatternAttributes& attributes,
+                                                       const SVGPatternElement* patternElement,
+                                                       FloatRect& patternBoundaries,
+                                                       AffineTransform& tileImageTransform) const
 {
     ASSERT(renderer);
     ASSERT(patternElement);
 
-    FloatRect objectBoundingBox = renderer->objectBoundingBox();    
+    FloatRect objectBoundingBox = renderer->objectBoundingBox();
     patternBoundaries = calculatePatternBoundaries(attributes, objectBoundingBox, patternElement); 
+    if (patternBoundaries.width() <= 0 || patternBoundaries.height() <= 0)
+        return false;
 
     AffineTransform viewBoxCTM = patternElement->viewBoxToViewTransform(patternElement->viewBox(), patternElement->preserveAspectRatio(), patternBoundaries.width(), patternBoundaries.height());
-    AffineTransform tileImageTransform;
 
     // Apply viewBox/objectBoundingBox transformations.
     if (!viewBoxCTM.isIdentity())
@@ -223,7 +239,7 @@ AffineTransform RenderSVGResourcePattern::buildTileImageTransform(RenderObject*
         tileImageTransform.scale(objectBoundingBox.width(), objectBoundingBox.height());
     }
 
-    return tileImageTransform;
+    return true;
 }
 
 PassOwnPtr<ImageBuffer> RenderSVGResourcePattern::createTileImage(RenderObject* object,
@@ -246,7 +262,7 @@ PassOwnPtr<ImageBuffer> RenderSVGResourcePattern::createTileImage(RenderObject*
 
     OwnPtr<ImageBuffer> tileImage;
 
-    if (!SVGImageBufferTools::createImageBuffer(absoluteTileBoundaries, clampedAbsoluteTileBoundaries, tileImage, DeviceRGB))
+    if (!SVGImageBufferTools::createImageBuffer(absoluteTileBoundaries, clampedAbsoluteTileBoundaries, tileImage, ColorSpaceDeviceRGB))
         return PassOwnPtr<ImageBuffer>();
 
     GraphicsContext* tileImageContext = tileImage->context();
diff --git a/WebCore/rendering/RenderSVGResourcePattern.h b/WebCore/rendering/RenderSVGResourcePattern.h
index 9a067c2..ba4aec4 100644
--- a/WebCore/rendering/RenderSVGResourcePattern.h
+++ b/WebCore/rendering/RenderSVGResourcePattern.h
@@ -27,6 +27,7 @@
 #include "FloatRect.h"
 #include "ImageBuffer.h"
 #include "Pattern.h"
+#include "PatternAttributes.h"
 #include "RenderSVGResourceContainer.h"
 #include "SVGPatternElement.h"
 #include "SVGUnitTypes.h"
@@ -41,8 +42,6 @@ struct PatternData {
     AffineTransform transform;
 };
 
-struct PatternAttributes;
-
 class RenderSVGResourcePattern : public RenderSVGResourceContainer {
 public:
     RenderSVGResourcePattern(SVGPatternElement*);
@@ -61,11 +60,13 @@ public:
     static RenderSVGResourceType s_resourceType;
 
 private:
-    AffineTransform buildTileImageTransform(RenderObject*, const PatternAttributes&, const SVGPatternElement*, FloatRect& patternBoundaries) const;
+    bool buildTileImageTransform(RenderObject*, const PatternAttributes&, const SVGPatternElement*, FloatRect& patternBoundaries, AffineTransform& tileImageTransform) const;
 
     PassOwnPtr<ImageBuffer> createTileImage(RenderObject*, const PatternAttributes&, const FloatRect& tileBoundaries,
                                             const FloatRect& absoluteTileBoundaries, const AffineTransform& tileImageTransform) const;
 
+    bool m_shouldCollectPatternAttributes : 1;
+    PatternAttributes m_attributes;
     HashMap<RenderObject*, PatternData*> m_pattern;
 };
 
diff --git a/WebCore/rendering/RenderSVGResourceRadialGradient.cpp b/WebCore/rendering/RenderSVGResourceRadialGradient.cpp
index a8904c8..300afcb 100644
--- a/WebCore/rendering/RenderSVGResourceRadialGradient.cpp
+++ b/WebCore/rendering/RenderSVGResourceRadialGradient.cpp
@@ -40,30 +40,31 @@ RenderSVGResourceRadialGradient::~RenderSVGResourceRadialGradient()
 {
 }
 
+void RenderSVGResourceRadialGradient::collectGradientAttributes(SVGGradientElement* gradientElement)
+{
+    m_attributes = RadialGradientAttributes();
+    static_cast<SVGRadialGradientElement*>(gradientElement)->collectGradientAttributes(m_attributes);
+}
+
 void RenderSVGResourceRadialGradient::buildGradient(GradientData* gradientData, SVGGradientElement* gradientElement) const
 {
     SVGRadialGradientElement* radialGradientElement = static_cast<SVGRadialGradientElement*>(gradientElement);
-    RadialGradientAttributes attributes = radialGradientElement->collectGradientProperties();
 
     // Determine gradient focal/center points and radius
     FloatPoint focalPoint;
     FloatPoint centerPoint;
     float radius;
-    radialGradientElement->calculateFocalCenterPointsAndRadius(attributes, focalPoint, centerPoint, radius);
+    radialGradientElement->calculateFocalCenterPointsAndRadius(m_attributes, focalPoint, centerPoint, radius);
 
     gradientData->gradient = Gradient::create(focalPoint,
-                                              0.0f, // SVG does not support a "focus radius"
+                                              0, // SVG does not support a "focus radius"
                                               centerPoint,
                                               radius);
 
-    gradientData->gradient->setSpreadMethod(attributes.spreadMethod());
-
-    // Record current gradient transform
-    gradientData->transform = attributes.gradientTransform();
-    gradientData->boundingBoxMode = attributes.boundingBoxMode();
+    gradientData->gradient->setSpreadMethod(m_attributes.spreadMethod());
 
     // Add stops
-    addStops(gradientData, attributes.stops());
+    addStops(gradientData, m_attributes.stops());
 }
 
 }
diff --git a/WebCore/rendering/RenderSVGResourceRadialGradient.h b/WebCore/rendering/RenderSVGResourceRadialGradient.h
index 0583f99..6492ee3 100644
--- a/WebCore/rendering/RenderSVGResourceRadialGradient.h
+++ b/WebCore/rendering/RenderSVGResourceRadialGradient.h
@@ -23,6 +23,7 @@
 #define RenderSVGResourceRadialGradient_h
 
 #if ENABLE(SVG)
+#include "RadialGradientAttributes.h"
 #include "RenderSVGResourceGradient.h"
 
 namespace WebCore {
@@ -39,7 +40,13 @@ public:
     virtual RenderSVGResourceType resourceType() const { return s_resourceType; }
     static RenderSVGResourceType s_resourceType;
 
+    virtual bool boundingBoxMode() const { return m_attributes.boundingBoxMode(); }
+    virtual void calculateGradientTransform(AffineTransform& transform) { transform = m_attributes.gradientTransform(); }
+    virtual void collectGradientAttributes(SVGGradientElement*);
     virtual void buildGradient(GradientData*, SVGGradientElement*) const;
+
+private:
+    RadialGradientAttributes m_attributes;
 };
 
 }
diff --git a/WebCore/rendering/RenderSVGResourceSolidColor.cpp b/WebCore/rendering/RenderSVGResourceSolidColor.cpp
index 51ad658..8228c80 100644
--- a/WebCore/rendering/RenderSVGResourceSolidColor.cpp
+++ b/WebCore/rendering/RenderSVGResourceSolidColor.cpp
@@ -52,7 +52,7 @@ bool RenderSVGResourceSolidColor::applyResource(RenderObject* object, RenderStyl
     ASSERT(resourceMode != ApplyToDefaultMode);
 
     const SVGRenderStyle* svgStyle = style ? style->svgStyle() : 0;
-    ColorSpace colorSpace = style ? style->colorSpace() : DeviceColorSpace;
+    ColorSpace colorSpace = style ? style->colorSpace() : ColorSpaceDeviceRGB;
 
     if (resourceMode & ApplyToFillMode) {
         context->setAlpha(svgStyle ? svgStyle->fillOpacity() : 1.0f);
@@ -90,7 +90,7 @@ void RenderSVGResourceSolidColor::postApplyResource(RenderObject*, GraphicsConte
 #if PLATFORM(SKIA) && !PLATFORM(ANDROID)
     // FIXME: Move this into the GraphicsContext
     // WebKit implicitly expects us to reset the path.
-    // For example in fillAndStrokePath() of RenderPath.cpp the path is 
+    // For example in fillAndStrokePath() of RenderSVGPath.cpp the path is
     // added back to the context after filling. This is because internally it
     // calls CGContextFillPath() which closes the path.
     context->beginPath();
diff --git a/WebCore/rendering/RenderSVGRoot.cpp b/WebCore/rendering/RenderSVGRoot.cpp
index 82b10d5..215aac7 100644
--- a/WebCore/rendering/RenderSVGRoot.cpp
+++ b/WebCore/rendering/RenderSVGRoot.cpp
@@ -53,14 +53,8 @@ RenderSVGRoot::RenderSVGRoot(SVGStyledElement* node)
     setReplaced(true);
 }
 
-int RenderSVGRoot::lineHeight(bool, bool) const
+RenderSVGRoot::~RenderSVGRoot()
 {
-    return height() + marginTop() + marginBottom();
-}
-
-int RenderSVGRoot::baselinePosition(bool, bool) const
-{
-    return height() + marginTop() + marginBottom();
 }
 
 void RenderSVGRoot::computePreferredLogicalWidths()
@@ -68,7 +62,7 @@ void RenderSVGRoot::computePreferredLogicalWidths()
     ASSERT(preferredLogicalWidthsDirty());
 
     int borderAndPadding = borderAndPaddingWidth();
-    int width = computeReplacedWidth(false) + borderAndPadding;
+    int width = computeReplacedLogicalWidth(false) + borderAndPadding;
 
     if (style()->maxWidth().isFixed() && style()->maxWidth().value() != undefinedLength)
         width = min(width, style()->maxWidth().value() + (style()->boxSizing() == CONTENT_BOX ? borderAndPadding : 0));
@@ -82,10 +76,10 @@ void RenderSVGRoot::computePreferredLogicalWidths()
     setPreferredLogicalWidthsDirty(false);
 }
 
-int RenderSVGRoot::computeReplacedWidth(bool includeMaxWidth) const
+int RenderSVGRoot::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    int replacedWidth = RenderBox::computeReplacedWidth(includeMaxWidth);
-    if (!style()->width().isPercent())
+    int replacedWidth = RenderBox::computeReplacedLogicalWidth(includeMaxWidth);
+    if (!style()->logicalWidth().isPercent())
         return replacedWidth;
 
     // FIXME: Investigate in size rounding issues
@@ -93,10 +87,10 @@ int RenderSVGRoot::computeReplacedWidth(bool includeMaxWidth) const
     return static_cast<int>(roundf(replacedWidth * svg->currentScale()));
 }
 
-int RenderSVGRoot::computeReplacedHeight() const
+int RenderSVGRoot::computeReplacedLogicalHeight() const
 {
-    int replacedHeight = RenderBox::computeReplacedHeight();
-    if (!style()->height().isPercent())
+    int replacedHeight = RenderBox::computeReplacedLogicalHeight();
+    if (!style()->logicalHeight().isPercent())
         return replacedHeight;
 
     // FIXME: Investigate in size rounding issues
diff --git a/WebCore/rendering/RenderSVGRoot.h b/WebCore/rendering/RenderSVGRoot.h
index 3c29b87..1b6aa22 100644
--- a/WebCore/rendering/RenderSVGRoot.h
+++ b/WebCore/rendering/RenderSVGRoot.h
@@ -35,7 +35,8 @@ class AffineTransform;
 
 class RenderSVGRoot : public RenderBox {
 public:
-    RenderSVGRoot(SVGStyledElement*);
+    explicit RenderSVGRoot(SVGStyledElement*);
+    virtual ~RenderSVGRoot();
 
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
@@ -51,11 +52,9 @@ private:
     virtual bool isSVGRoot() const { return true; }
     virtual const char* renderName() const { return "RenderSVGRoot"; }
 
-    virtual int lineHeight(bool b, bool isRootLineBox = false) const;
-    virtual int baselinePosition(bool b, bool isRootLineBox = false) const;
     virtual void computePreferredLogicalWidths();
-    virtual int computeReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int computeReplacedHeight() const;
+    virtual int computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
+    virtual int computeReplacedLogicalHeight() const;
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
 
diff --git a/WebCore/rendering/RenderSVGTransformableContainer.h b/WebCore/rendering/RenderSVGTransformableContainer.h
index b63b91c..b49a403 100644
--- a/WebCore/rendering/RenderSVGTransformableContainer.h
+++ b/WebCore/rendering/RenderSVGTransformableContainer.h
@@ -29,7 +29,7 @@ namespace WebCore {
     class SVGStyledTransformableElement;
     class RenderSVGTransformableContainer : public RenderSVGContainer {
     public:
-        RenderSVGTransformableContainer(SVGStyledTransformableElement*);
+        explicit RenderSVGTransformableContainer(SVGStyledTransformableElement*);
 
         virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
         virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
diff --git a/WebCore/rendering/RenderSVGViewportContainer.h b/WebCore/rendering/RenderSVGViewportContainer.h
index 7b5702b..63c336c 100644
--- a/WebCore/rendering/RenderSVGViewportContainer.h
+++ b/WebCore/rendering/RenderSVGViewportContainer.h
@@ -32,7 +32,7 @@ namespace WebCore {
 // thus we inherit from RenderSVGContainer instead of RenderSVGTransformableContainer
 class RenderSVGViewportContainer : public RenderSVGContainer {
 public:
-    RenderSVGViewportContainer(SVGStyledElement*);
+    explicit RenderSVGViewportContainer(SVGStyledElement*);
 
 private:
     virtual bool isSVGContainer() const { return true; }
diff --git a/WebCore/rendering/RenderScrollbarTheme.cpp b/WebCore/rendering/RenderScrollbarTheme.cpp
index 19143cc..e32d87a 100644
--- a/WebCore/rendering/RenderScrollbarTheme.cpp
+++ b/WebCore/rendering/RenderScrollbarTheme.cpp
@@ -109,7 +109,7 @@ IntRect RenderScrollbarTheme::constrainTrackRectToTrackPieces(Scrollbar* scrollb
 void RenderScrollbarTheme::paintScrollCorner(ScrollView*, GraphicsContext* context, const IntRect& cornerRect)
 {
     // FIXME: Implement.
-    context->fillRect(cornerRect, Color::white, DeviceColorSpace);
+    context->fillRect(cornerRect, Color::white, ColorSpaceDeviceRGB);
 }
 
 void RenderScrollbarTheme::paintScrollbarBackground(GraphicsContext* context, Scrollbar* scrollbar)
diff --git a/WebCore/rendering/RenderSlider.cpp b/WebCore/rendering/RenderSlider.cpp
index 33df244..35d72f4 100644
--- a/WebCore/rendering/RenderSlider.cpp
+++ b/WebCore/rendering/RenderSlider.cpp
@@ -159,7 +159,7 @@ RenderSlider::~RenderSlider()
         m_thumb->detach();
 }
 
-int RenderSlider::baselinePosition(bool, bool) const
+int RenderSlider::baselinePosition(bool /*firstLine*/, LineDirectionMode, LinePositionMode) const
 {
     return height() + marginTop();
 }
diff --git a/WebCore/rendering/RenderSlider.h b/WebCore/rendering/RenderSlider.h
index d214e41..fa743de 100644
--- a/WebCore/rendering/RenderSlider.h
+++ b/WebCore/rendering/RenderSlider.h
@@ -42,7 +42,7 @@ namespace WebCore {
         virtual const char* renderName() const { return "RenderSlider"; }
         virtual bool isSlider() const { return true; }
 
-        virtual int baselinePosition(bool, bool) const;
+        virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
         virtual void computePreferredLogicalWidths();
         virtual void layout();
         virtual void updateFromElement();
diff --git a/WebCore/rendering/RenderTable.cpp b/WebCore/rendering/RenderTable.cpp
index ca33036..117a6ae 100644
--- a/WebCore/rendering/RenderTable.cpp
+++ b/WebCore/rendering/RenderTable.cpp
@@ -71,6 +71,10 @@ RenderTable::RenderTable(Node* node)
 #endif
 }
 
+RenderTable::~RenderTable()
+{
+}
+
 void RenderTable::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
 {
     RenderBlock::styleDidChange(diff, oldStyle);
@@ -791,7 +795,7 @@ int RenderTable::calcBorderLeft() const
         if (tb.style() > BHIDDEN)
             borderWidth = tb.width();
 
-        int leftmostColumn = style()->direction() == RTL ? numEffCols() - 1 : 0;
+        int leftmostColumn = !style()->isLeftToRightDirection() ? numEffCols() - 1 : 0;
         RenderTableCol* colGroup = colElement(leftmostColumn);
         if (colGroup) {
             const BorderValue& gb = style()->borderLeft();
@@ -850,7 +854,7 @@ int RenderTable::calcBorderRight() const
         if (tb.style() > BHIDDEN)
             borderWidth = tb.width();
 
-        int rightmostColumn = style()->direction() == RTL ? 0 : numEffCols() - 1;
+        int rightmostColumn = !style()->isLeftToRightDirection() ? 0 : numEffCols() - 1;
         RenderTableCol* colGroup = colElement(rightmostColumn);
         if (colGroup) {
             const BorderValue& gb = style()->borderRight();
@@ -1186,7 +1190,7 @@ bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
     ty += y();
 
     // Check kids first.
-    if (!hasOverflowClip() || overflowClipRect(tx, ty).intersects(result.rectFromPoint(xPos, yPos))) {
+    if (!hasOverflowClip() || overflowClipRect(tx, ty).intersects(result.rectForPoint(xPos, yPos))) {
         for (RenderObject* child = lastChild(); child; child = child->previousSibling()) {
             if (child->isBox() && !toRenderBox(child)->hasSelfPaintingLayer() && (child->isTableSection() || child == m_caption) &&
                 child->nodeAtPoint(request, result, xPos, yPos, tx, ty, action)) {
@@ -1198,7 +1202,7 @@ bool RenderTable::nodeAtPoint(const HitTestRequest& request, HitTestResult& resu
 
     // Check our bounds next.
     IntRect boundsRect = IntRect(tx, ty, width(), height());
-    if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && boundsRect.intersects(result.rectFromPoint(xPos, yPos))) {
+    if (visibleToHitTesting() && (action == HitTestBlockBackground || action == HitTestChildBlockBackground) && boundsRect.intersects(result.rectForPoint(xPos, yPos))) {
         updateHitTestResult(result, IntPoint(xPos - tx, yPos - ty));
         if (!result.addNodeToRectBasedTestResult(node(), xPos, yPos, boundsRect))
             return true;
diff --git a/WebCore/rendering/RenderTable.h b/WebCore/rendering/RenderTable.h
index 58d4915..beb48f4 100644
--- a/WebCore/rendering/RenderTable.h
+++ b/WebCore/rendering/RenderTable.h
@@ -38,7 +38,8 @@ class TableLayout;
 
 class RenderTable : public RenderBlock {
 public:
-    RenderTable(Node*);
+    explicit RenderTable(Node*);
+    virtual ~RenderTable();
 
     int getColumnPos(int col) const { return m_columnPos[col]; }
 
diff --git a/WebCore/rendering/RenderTableCell.cpp b/WebCore/rendering/RenderTableCell.cpp
index 06f4726..88cdd5e 100644
--- a/WebCore/rendering/RenderTableCell.cpp
+++ b/WebCore/rendering/RenderTableCell.cpp
@@ -174,34 +174,34 @@ void RenderTableCell::layout()
 int RenderTableCell::paddingTop(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingTop();
-    if (!includeIntrinsicPadding || !style()->isVerticalBlockFlow())
+    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
         return result;
-    return result + (style()->blockFlow() == TopToBottomBlockFlow ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
+    return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
 }
 
 int RenderTableCell::paddingBottom(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingBottom();
-    if (!includeIntrinsicPadding || !style()->isVerticalBlockFlow())
+    if (!includeIntrinsicPadding || !style()->isHorizontalWritingMode())
         return result;
-    return result + (style()->blockFlow() == TopToBottomBlockFlow ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
+    return result + (style()->writingMode() == TopToBottomWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
 int RenderTableCell::paddingLeft(bool includeIntrinsicPadding) const
 {
     int result = RenderBlock::paddingLeft();
-    if (!includeIntrinsicPadding || style()->isVerticalBlockFlow())
+    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
         return result;
-    return result + (style()->blockFlow() == LeftToRightBlockFlow ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
+    return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingBefore() : intrinsicPaddingAfter());
     
 }
 
 int RenderTableCell::paddingRight(bool includeIntrinsicPadding) const
 {   
     int result = RenderBlock::paddingRight();
-    if (!includeIntrinsicPadding || style()->isVerticalBlockFlow())
+    if (!includeIntrinsicPadding || style()->isHorizontalWritingMode())
         return result;
-    return result + (style()->blockFlow() == LeftToRightBlockFlow ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
+    return result + (style()->writingMode() == LeftToRightWritingMode ? intrinsicPaddingAfter() : intrinsicPaddingBefore());
 }
 
 int RenderTableCell::paddingBefore(bool includeIntrinsicPadding) const
@@ -246,7 +246,7 @@ IntRect RenderTableCell::clippedOverflowRectForRepaint(RenderBoxModelObject* rep
     if (!table()->collapseBorders() || table()->needsSectionRecalc())
         return RenderBlock::clippedOverflowRectForRepaint(repaintContainer);
 
-    bool rtl = table()->style()->direction() == RTL;
+    bool rtl = !table()->style()->isLeftToRightDirection();
     int outlineSize = style()->outlineSize();
     int left = max(borderHalfLeft(true), outlineSize);
     int right = max(borderHalfRight(true), outlineSize);
@@ -300,10 +300,11 @@ void RenderTableCell::computeRectForRepaint(RenderBoxModelObject* repaintContain
     RenderBlock::computeRectForRepaint(repaintContainer, r, fixed);
 }
 
-int RenderTableCell::baselinePosition(bool firstLine, bool isRootLineBox) const
+int RenderTableCell::baselinePosition(bool firstLine, LineDirectionMode lineDirection, LinePositionMode linePositionMode) const
 {
-    if (isRootLineBox)
-        return RenderBox::baselinePosition(firstLine, isRootLineBox);
+    // FIXME: This function still needs to be patched for writing-mode.
+    if (linePositionMode == PositionOfInteriorLineBoxes)
+        return RenderBlock::baselinePosition(firstLine, lineDirection, linePositionMode);
 
     // <http://www.w3.org/TR/2007/CR-CSS21-20070719/tables.html#height-layout>: The baseline of a cell is the baseline of
     // the first in-flow line box in the cell, or the first in-flow table-row in the cell, whichever comes first. If there
@@ -723,7 +724,7 @@ int RenderTableCell::borderAfter() const
 
 int RenderTableCell::borderHalfLeft(bool outer) const
 {
-    CollapsedBorderValue border = collapsedLeftBorder(table()->style()->direction() == RTL);
+    CollapsedBorderValue border = collapsedLeftBorder(!table()->style()->isLeftToRightDirection());
     if (border.exists())
         return (border.width() + (outer ? 0 : 1)) / 2; // Give the extra pixel to top and left.
     return 0;
@@ -731,7 +732,7 @@ int RenderTableCell::borderHalfLeft(bool outer) const
     
 int RenderTableCell::borderHalfRight(bool outer) const
 {
-    CollapsedBorderValue border = collapsedRightBorder(table()->style()->direction() == RTL);
+    CollapsedBorderValue border = collapsedRightBorder(!table()->style()->isLeftToRightDirection());
     if (border.exists())
         return (border.width() + (outer ? 1 : 0)) / 2;
     return 0;
@@ -843,7 +844,7 @@ static void addBorderStyle(RenderTableCell::CollapsedBorderStyles& borderStyles,
 
 void RenderTableCell::collectBorderStyles(CollapsedBorderStyles& borderStyles) const
 {
-    bool rtl = table()->style()->direction() == RTL;
+    bool rtl = !table()->style()->isLeftToRightDirection();
     addBorderStyle(borderStyles, collapsedLeftBorder(rtl));
     addBorderStyle(borderStyles, collapsedRightBorder(rtl));
     addBorderStyle(borderStyles, collapsedTopBorder());
@@ -870,7 +871,7 @@ void RenderTableCell::paintCollapsedBorder(GraphicsContext* graphicsContext, int
     if (!table()->currentBorderStyle())
         return;
     
-    bool rtl = table()->style()->direction() == RTL;
+    bool rtl = !table()->style()->isLeftToRightDirection();
     CollapsedBorderValue leftVal = collapsedLeftBorder(rtl);
     CollapsedBorderValue rightVal = collapsedRightBorder(rtl);
     CollapsedBorderValue topVal = collapsedTopBorder();
diff --git a/WebCore/rendering/RenderTableCell.h b/WebCore/rendering/RenderTableCell.h
index 79376e9..31879d6 100644
--- a/WebCore/rendering/RenderTableCell.h
+++ b/WebCore/rendering/RenderTableCell.h
@@ -31,7 +31,7 @@ namespace WebCore {
 
 class RenderTableCell : public RenderBlock {
 public:
-    RenderTableCell(Node*);
+    explicit RenderTableCell(Node*);
 
     // FIXME: need to implement cellIndex
     int cellIndex() const { return 0; }
@@ -88,7 +88,7 @@ public:
 
     void paintBackgroundsBehindCell(PaintInfo&, int tx, int ty, RenderObject* backgroundObject);
 
-    virtual int baselinePosition(bool firstLine = false, bool isRootLineBox = false) const;
+    virtual int baselinePosition(bool firstLine = false, LineDirectionMode = HorizontalLine, LinePositionMode = PositionOnContainingLine) const;
 
     void setIntrinsicPaddingBefore(int p) { m_intrinsicPaddingBefore = p; }
     void setIntrinsicPaddingAfter(int p) { m_intrinsicPaddingAfter = p; }
diff --git a/WebCore/rendering/RenderTableCol.h b/WebCore/rendering/RenderTableCol.h
index c5f9afc..8255937 100644
--- a/WebCore/rendering/RenderTableCol.h
+++ b/WebCore/rendering/RenderTableCol.h
@@ -34,7 +34,7 @@ class RenderTable;
 
 class RenderTableCol : public RenderBox {
 public:
-    RenderTableCol(Node*);
+    explicit RenderTableCol(Node*);
 
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
@@ -50,7 +50,6 @@ private:
 
     virtual const char* renderName() const { return "RenderTableCol"; }
     virtual bool isTableCol() const { return true; }
-    virtual int lineHeight(bool) const { return 0; }
     virtual void updateFromElement();
 
     virtual bool isChildAllowed(RenderObject*, RenderStyle*) const;
diff --git a/WebCore/rendering/RenderTableRow.h b/WebCore/rendering/RenderTableRow.h
index 588252b..20aa424 100644
--- a/WebCore/rendering/RenderTableRow.h
+++ b/WebCore/rendering/RenderTableRow.h
@@ -31,7 +31,7 @@ namespace WebCore {
 
 class RenderTableRow : public RenderBox {
 public:
-    RenderTableRow(Node*);
+    explicit RenderTableRow(Node*);
 
     const RenderObjectChildList* children() const { return &m_children; }
     RenderObjectChildList* children() { return &m_children; }
@@ -50,7 +50,6 @@ private:
     virtual void destroy();
 
     virtual void addChild(RenderObject* child, RenderObject* beforeChild = 0);
-    virtual int lineHeight(bool, bool) const { return 0; }
     virtual void layout();
     virtual IntRect clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
diff --git a/WebCore/rendering/RenderTableSection.cpp b/WebCore/rendering/RenderTableSection.cpp
index 37f2025..e9aa3cb 100644
--- a/WebCore/rendering/RenderTableSection.cpp
+++ b/WebCore/rendering/RenderTableSection.cpp
@@ -692,7 +692,7 @@ int RenderTableSection::layoutRows(int toAdd)
             
             IntRect oldCellRect(cell->x(), cell->y() , cell->width(), cell->height());
             
-            if (style()->direction() == RTL)
+            if (!style()->isLeftToRightDirection())
                 cell->setLocation(table()->columnPositions()[nEffCols] - table()->columnPositions()[table()->colToEffCol(cell->col() + cell->colSpan())] + hspacing, m_rowPos[rindx]);
             else
                 cell->setLocation(table()->columnPositions()[c] + hspacing, m_rowPos[rindx]);
@@ -748,9 +748,27 @@ int RenderTableSection::layoutRows(int toAdd)
     return height();
 }
 
-int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderTableSection::topmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int bottom = RenderBox::lowestPosition(includeOverflowInterior, includeSelf);
+    int top = RenderBox::topmostPosition(includeOverflowInterior, includeSelf, applyTransform);
+    if (!includeOverflowInterior && hasOverflowClip())
+        return top;
+
+    for (RenderObject* row = firstChild(); row; row = row->nextSibling()) {
+        for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
+            if (curr->isTableCell()) {
+                RenderTableCell* cell = toRenderTableCell(curr);
+                top = min(top, cell->transformedFrameRect().y() + cell->topmostPosition(false));
+            }
+        }
+    }
+    
+    return top;
+}
+
+int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
+{
+    int bottom = RenderBox::lowestPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!includeOverflowInterior && hasOverflowClip())
         return bottom;
 
@@ -758,7 +776,7 @@ int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includ
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
                 RenderTableCell* cell = toRenderTableCell(curr);
-                bottom = max(bottom, cell->y() + cell->lowestPosition(false));
+                bottom = max(bottom, cell->transformedFrameRect().y() + cell->lowestPosition(false));
             }
         }
     }
@@ -766,9 +784,9 @@ int RenderTableSection::lowestPosition(bool includeOverflowInterior, bool includ
     return bottom;
 }
 
-int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int right = RenderBox::rightmostPosition(includeOverflowInterior, includeSelf);
+    int right = RenderBox::rightmostPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!includeOverflowInterior && hasOverflowClip())
         return right;
 
@@ -776,7 +794,7 @@ int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool inc
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
                 RenderTableCell* cell = toRenderTableCell(curr);
-                right = max(right, cell->x() + cell->rightmostPosition(false));
+                right = max(right, cell->transformedFrameRect().x() + cell->rightmostPosition(false));
             }
         }
     }
@@ -784,9 +802,9 @@ int RenderTableSection::rightmostPosition(bool includeOverflowInterior, bool inc
     return right;
 }
 
-int RenderTableSection::leftmostPosition(bool includeOverflowInterior, bool includeSelf) const
+int RenderTableSection::leftmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform applyTransform) const
 {
-    int left = RenderBox::leftmostPosition(includeOverflowInterior, includeSelf);
+    int left = RenderBox::leftmostPosition(includeOverflowInterior, includeSelf, applyTransform);
     if (!includeOverflowInterior && hasOverflowClip())
         return left;
     
@@ -794,7 +812,7 @@ int RenderTableSection::leftmostPosition(bool includeOverflowInterior, bool incl
         for (RenderObject* curr = row->firstChild(); curr; curr = curr->nextSibling()) {
             if (curr->isTableCell()) {
                 RenderTableCell* cell = toRenderTableCell(curr);
-                left = min(left, cell->x() + cell->leftmostPosition(false));
+                left = min(left, cell->transformedFrameRect().x() + cell->leftmostPosition(false));
             }
         }
     }
@@ -998,7 +1016,7 @@ int RenderTableSection::calcOuterBorderRight(bool rtl) const
 
 void RenderTableSection::recalcOuterBorder()
 {
-    bool rtl = table()->style()->direction() == RTL;
+    bool rtl = !table()->style()->isLeftToRightDirection();
     m_outerBorderTop = calcOuterBorderTop();
     m_outerBorderBottom = calcOuterBorderBottom();
     m_outerBorderLeft = calcOuterBorderLeft(rtl);
@@ -1136,9 +1154,9 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
         if (startrow == m_rowPos.size() || (startrow > 0 && (m_rowPos[startrow] >  top)))
           --startrow;
 
-        int bottom = relativeY + h + os - 1;
+        int bottom = relativeY + h + os;
         endrow = std::lower_bound(m_rowPos.begin(), m_rowPos.end(), bottom) - m_rowPos.begin();
-        if ((endrow == m_rowPos.size()) || (endrow > 0 && m_rowPos[endrow - 1] == bottom))
+        if (endrow == m_rowPos.size())
           --endrow;
 
         if (!endrow && ty + m_rowPos[0] - table()->outerBorderTop() <= y + h + os)
@@ -1147,7 +1165,7 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
     unsigned startcol = 0;
     unsigned endcol = totalCols;
     // FIXME: Implement RTL.
-    if (!m_hasOverflowingCell && style()->direction() == LTR) {
+    if (!m_hasOverflowingCell && style()->isLeftToRightDirection()) {
         int relativeX = x - tx;
         int left = relativeX - os;
         Vector<int>& columnPos = table()->columnPositions();
@@ -1155,9 +1173,9 @@ void RenderTableSection::paintObject(PaintInfo& paintInfo, int tx, int ty)
         if ((startcol == columnPos.size()) || (startcol > 0 && (columnPos[startcol] > left)))
             --startcol;
 
-        int right = relativeX + w + os - 1;
+        int right = relativeX + w + os;
         endcol = std::lower_bound(columnPos.begin(), columnPos.end(), right) - columnPos.begin();
-        if (endcol == columnPos.size() || (endcol > 0 && (columnPos[endcol - 1] == right)))
+        if (endcol == columnPos.size())
             --endcol;
 
         if (!endcol && tx + table()->columnPositions()[0] - table()->outerBorderLeft() <= y + w + os)
@@ -1305,7 +1323,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
     tx += x();
     ty += y();
 
-    if (hasOverflowClip() && !overflowClipRect(tx, ty).intersects(result.rectFromPoint(xPos, yPos)))
+    if (hasOverflowClip() && !overflowClipRect(tx, ty).intersects(result.rectForPoint(xPos, yPos)))
         return false;
 
     if (m_hasOverflowingCell) {
@@ -1332,7 +1350,7 @@ bool RenderTableSection::nodeAtPoint(const HitTestRequest& request, HitTestResul
         --leftrow;
 
     Vector<int>& columnPos = table()->columnPositions();
-    bool rtl = style()->direction() == RTL;
+    bool rtl = !style()->isLeftToRightDirection();
     int relativeX = xPos - tx;
     if (rtl)
         relativeX = columnPos[columnPos.size() - 1] - relativeX;
diff --git a/WebCore/rendering/RenderTableSection.h b/WebCore/rendering/RenderTableSection.h
index 6d2f752..fce1e0f 100644
--- a/WebCore/rendering/RenderTableSection.h
+++ b/WebCore/rendering/RenderTableSection.h
@@ -136,9 +136,10 @@ private:
 
     virtual void removeChild(RenderObject* oldChild);
 
-    virtual int lowestPosition(bool includeOverflowInterior, bool includeSelf) const;
-    virtual int rightmostPosition(bool includeOverflowInterior, bool includeSelf) const;
-    virtual int leftmostPosition(bool includeOverflowInterior, bool includeSelf) const;
+    virtual int topmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform = IncludeTransform) const;
+    virtual int lowestPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform = IncludeTransform) const;
+    virtual int rightmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform = IncludeTransform) const;
+    virtual int leftmostPosition(bool includeOverflowInterior, bool includeSelf, ApplyTransform = IncludeTransform) const;
 
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual void paintCell(RenderTableCell*, PaintInfo&, int tx, int ty);
@@ -148,8 +149,6 @@ private:
 
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
 
-    virtual int lineHeight(bool, bool) const { return 0; }
-
     bool ensureRows(int);
     void clearGrid();
 
diff --git a/WebCore/rendering/RenderText.cpp b/WebCore/rendering/RenderText.cpp
index fada8b4..510d830 100644
--- a/WebCore/rendering/RenderText.cpp
+++ b/WebCore/rendering/RenderText.cpp
@@ -511,7 +511,7 @@ IntRect RenderText::localCaretRect(InlineBox* inlineBox, int caretOffset, int* e
     switch (cbStyle->textAlign()) {
     case TAAUTO:
     case JUSTIFY:
-        rightAligned = cbStyle->direction() == RTL;
+        rightAligned = !cbStyle->isLeftToRightDirection();
         break;
     case RIGHT:
     case WEBKIT_RIGHT:
@@ -1084,35 +1084,6 @@ void RenderText::setTextInternal(PassRefPtr<StringImpl> text)
     }
     ASSERT(m_text);
 
-#if ENABLE(SVG)
-    if (isSVGInlineText()) {
-        if (style() && style()->whiteSpace() == PRE) {
-            // Spec: When xml:space="preserve", the SVG user agent will do the following using a
-            // copy of the original character data content. It will convert all newline and tab
-            // characters into space characters. Then, it will draw all space characters, including
-            // leading, trailing and multiple contiguous space characters.
-
-            m_text.replace('\n', ' ');
-
-            // If xml:space="preserve" is set, white-space is set to "pre", which
-            // preserves leading, trailing & contiguous space character for us.
-       } else {
-            // Spec: When xml:space="default", the SVG user agent will do the following using a
-            // copy of the original character data content. First, it will remove all newline
-            // characters. Then it will convert all tab characters into space characters.
-            // Then, it will strip off all leading and trailing space characters.
-            // Then, all contiguous space characters will be consolidated.    
-
-           m_text.replace('\n', StringImpl::empty());
-
-           // If xml:space="default" is set, white-space is set to "nowrap", which handles
-           // leading, trailing & contiguous space character removal for us.
-        }
-
-        m_text.replace('\t', ' ');
-    }
-#endif
-
     if (style()) {
         transformText(m_text);
 
@@ -1168,12 +1139,6 @@ String RenderText::textWithoutTranscoding() const
     return text;
 }
 
-int RenderText::lineHeight(bool firstLine, bool) const
-{
-    // Always use the interior line height of the parent (e.g., if our parent is an inline block).
-    return parent()->lineHeight(firstLine, true);
-}
-
 void RenderText::dirtyLineBoxes(bool fullLayout)
 {
     if (fullLayout)
@@ -1224,7 +1189,7 @@ void RenderText::positionLineBox(InlineBox* box)
         return;
     }
 
-    m_containsReversedText |= s->direction() == RTL;
+    m_containsReversedText |= !s->isLeftToRightDirection();
 }
 
 unsigned RenderText::width(unsigned from, unsigned len, int xPos, bool firstLine, HashSet<const SimpleFontData*>* fallbackFonts, GlyphOverflow* glyphOverflow) const
diff --git a/WebCore/rendering/RenderText.h b/WebCore/rendering/RenderText.h
index e3a6997..964a1d3 100644
--- a/WebCore/rendering/RenderText.h
+++ b/WebCore/rendering/RenderText.h
@@ -74,8 +74,6 @@ public:
     virtual unsigned width(unsigned from, unsigned len, const Font&, int xPos, HashSet<const SimpleFontData*>* fallbackFonts = 0, GlyphOverflow* = 0) const;
     virtual unsigned width(unsigned from, unsigned len, int xPos, bool firstLine = false, HashSet<const SimpleFontData*>* fallbackFonts = 0, GlyphOverflow* = 0) const;
 
-    virtual int lineHeight(bool firstLine, bool isRootLineBox = false) const;
-
     virtual int minPreferredLogicalWidth() const;
     virtual int maxPreferredLogicalWidth() const;
 
diff --git a/WebCore/rendering/RenderTextControl.cpp b/WebCore/rendering/RenderTextControl.cpp
index f48081b..4855bab 100644
--- a/WebCore/rendering/RenderTextControl.cpp
+++ b/WebCore/rendering/RenderTextControl.cpp
@@ -262,10 +262,12 @@ void RenderTextControl::setSelectionRange(int start, int end)
         frame->selection()->setSelection(newSelection);
 }
 
-VisibleSelection RenderTextControl::selection(int start, int end) const
+PassRefPtr<Range> RenderTextControl::selection(int start, int end) const
 {
-    return VisibleSelection(VisiblePosition(m_innerText.get(), start, VP_DEFAULT_AFFINITY),
-                            VisiblePosition(m_innerText.get(), end, VP_DEFAULT_AFFINITY));
+    if (!m_innerText)
+        return 0;
+
+    return Range::create(document(), m_innerText, start, m_innerText, end);
 }
 
 VisiblePosition RenderTextControl::visiblePositionForIndex(int index)
@@ -407,7 +409,7 @@ void RenderTextControl::computeLogicalHeight()
               m_innerText->renderBox()->paddingTop() + m_innerText->renderBox()->paddingBottom() +
               m_innerText->renderBox()->marginTop() + m_innerText->renderBox()->marginBottom());
 
-    adjustControlHeightBasedOnLineHeight(m_innerText->renderer()->lineHeight(true, true));
+    adjustControlHeightBasedOnLineHeight(m_innerText->renderBox()->lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes));
     setHeight(height() + borderAndPaddingHeight());
 
     // We are able to have a horizontal scrollbar if the overflow style is scroll, or if its auto and there's no word wrap.
diff --git a/WebCore/rendering/RenderTextControl.h b/WebCore/rendering/RenderTextControl.h
index a33f11d..84d7b0b 100644
--- a/WebCore/rendering/RenderTextControl.h
+++ b/WebCore/rendering/RenderTextControl.h
@@ -46,7 +46,7 @@ public:
     void setSelectionEnd(int);
     void select();
     void setSelectionRange(int start, int end);
-    VisibleSelection selection(int start, int end) const;
+    PassRefPtr<Range> selection(int start, int end) const;
 
     virtual void subtreeHasChanged();
     String text();
diff --git a/WebCore/rendering/RenderTextControlMultiLine.cpp b/WebCore/rendering/RenderTextControlMultiLine.cpp
index d3fe3f6..2c93164 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.cpp
+++ b/WebCore/rendering/RenderTextControlMultiLine.cpp
@@ -102,9 +102,9 @@ void RenderTextControlMultiLine::adjustControlHeightBasedOnLineHeight(int lineHe
     setHeight(height() + lineHeight * static_cast<HTMLTextAreaElement*>(node())->rows());
 }
 
-int RenderTextControlMultiLine::baselinePosition(bool, bool) const
+int RenderTextControlMultiLine::baselinePosition(bool firstLine, LineDirectionMode direction, LinePositionMode linePositionMode) const
 {
-    return height() + marginTop() + marginBottom();
+    return RenderBox::baselinePosition(firstLine, direction, linePositionMode);
 }
 
 void RenderTextControlMultiLine::updateFromElement()
diff --git a/WebCore/rendering/RenderTextControlMultiLine.h b/WebCore/rendering/RenderTextControlMultiLine.h
index fbca308..e061e89 100644
--- a/WebCore/rendering/RenderTextControlMultiLine.h
+++ b/WebCore/rendering/RenderTextControlMultiLine.h
@@ -43,7 +43,7 @@ private:
     virtual float getAvgCharWidth(AtomicString family);
     virtual int preferredContentWidth(float charWidth) const;
     virtual void adjustControlHeightBasedOnLineHeight(int lineHeight);
-    virtual int baselinePosition(bool firstLine, bool isRootLineBox) const;
+    virtual int baselinePosition(bool firstLine, LineDirectionMode, LinePositionMode = PositionOnContainingLine) const;
 
     virtual void updateFromElement();
     virtual void cacheSelection(int start, int end);
diff --git a/WebCore/rendering/RenderTextControlSingleLine.cpp b/WebCore/rendering/RenderTextControlSingleLine.cpp
index 7edbe7f..ea03c61 100644
--- a/WebCore/rendering/RenderTextControlSingleLine.cpp
+++ b/WebCore/rendering/RenderTextControlSingleLine.cpp
@@ -372,7 +372,7 @@ void RenderTextControlSingleLine::forwardEvent(Event* event)
     if (event->type() == eventNames().blurEvent) {
         if (innerTextRenderer) {
             if (RenderLayer* innerLayer = innerTextRenderer->layer())
-                innerLayer->scrollToOffset(style()->direction() == RTL ? innerLayer->scrollWidth() : 0, 0);
+                innerLayer->scrollToOffset(!style()->isLeftToRightDirection() ? innerLayer->scrollWidth() : 0, 0);
         }
 
         capsLockStateMayHaveChanged();
@@ -687,11 +687,18 @@ void RenderTextControlSingleLine::updateFromElement()
     } else {
         if (!inputElement()->suggestedValue().isNull())
             setInnerTextValue(inputElement()->suggestedValue());
-        else if (!node()->isHTMLElement() || !static_cast<HTMLInputElement*>(node())->formControlValueMatchesRenderer())
-            // For HTMLInputElement, update the renderer value only if the
-            // formControlValueMatchesRenderer() flag is false. It protects an
-            // unacceptable renderer value from being overwritten with the DOM value.
-            setInnerTextValue(inputElement()->value());
+        else {
+            bool shouldUpdateValue = true;
+            if (node()->isHTMLElement()) {
+                // For HTMLInputElement, update the renderer value if the element
+                // supports placeholder or the formControlValueMatchesRenderer()
+                // flag is false. It protects an unacceptable renderer value from
+                // being overwritten with the DOM value.
+                shouldUpdateValue = static_cast<HTMLTextFormControlElement*>(node())->supportsPlaceholder() || !static_cast<HTMLInputElement*>(node())->formControlValueMatchesRenderer();
+            }
+            if (shouldUpdateValue)
+                setInnerTextValue(inputElement()->value());
+        }
     }
 
     if (m_searchPopupIsVisible)
@@ -723,7 +730,7 @@ PassRefPtr<RenderStyle> RenderTextControlSingleLine::createInnerTextStyle(const
     textBlockStyle->setOverflowY(OHIDDEN);
 
     // Do not allow line-height to be smaller than our default.
-    if (textBlockStyle->font().lineSpacing() > lineHeight(true, true))
+    if (textBlockStyle->font().lineSpacing() > lineHeight(true, HorizontalLine, PositionOfInteriorLineBoxes))
         textBlockStyle->setLineHeight(Length(-100.0f, Percent));
 
     WebCore::EDisplay display = (m_innerBlock || inputElement()->hasSpinButton() ? INLINE_BLOCK : BLOCK);
diff --git a/WebCore/rendering/RenderTextFragment.cpp b/WebCore/rendering/RenderTextFragment.cpp
index b14308d..705c095 100644
--- a/WebCore/rendering/RenderTextFragment.cpp
+++ b/WebCore/rendering/RenderTextFragment.cpp
@@ -44,6 +44,10 @@ RenderTextFragment::RenderTextFragment(Node* node, StringImpl* str)
 {
 }
 
+RenderTextFragment::~RenderTextFragment()
+{
+}
+
 PassRefPtr<StringImpl> RenderTextFragment::originalText() const
 {
     Node* e = node();
diff --git a/WebCore/rendering/RenderTextFragment.h b/WebCore/rendering/RenderTextFragment.h
index e023042..abb3fa4 100644
--- a/WebCore/rendering/RenderTextFragment.h
+++ b/WebCore/rendering/RenderTextFragment.h
@@ -35,6 +35,7 @@ class RenderTextFragment : public RenderText {
 public:
     RenderTextFragment(Node*, StringImpl*, int startOffset, int length);
     RenderTextFragment(Node*, StringImpl*);
+    virtual ~RenderTextFragment();
 
     virtual bool isTextFragment() const { return true; }
 
diff --git a/WebCore/rendering/RenderThemeMac.mm b/WebCore/rendering/RenderThemeMac.mm
index 7982834..b632d9a 100644
--- a/WebCore/rendering/RenderThemeMac.mm
+++ b/WebCore/rendering/RenderThemeMac.mm
@@ -905,7 +905,7 @@ NSLevelIndicatorCell* RenderThemeMac::levelIndicatorFor(const RenderMeter* rende
     }
 
     [cell setLevelIndicatorStyle:levelIndicatorStyleFor(style->appearance())];
-    [cell setBaseWritingDirection:style->direction() == LTR ? NSWritingDirectionLeftToRight : NSWritingDirectionRightToLeft];
+    [cell setBaseWritingDirection:style->isLeftToRightDirection() ? NSWritingDirectionLeftToRight : NSWritingDirectionRightToLeft];
     [cell setMinValue:element->min()];
     [cell setMaxValue:element->max()];
     RetainPtr<NSNumber> valueObject = [NSNumber numberWithDouble:value];
@@ -959,12 +959,12 @@ bool RenderThemeMac::paintProgressBar(RenderObject* renderObject, const PaintInf
 
     paintInfo.context->save();
 
-    if (renderProgress->style()->direction() == RTL) {
+    if (!renderProgress->style()->isLeftToRightDirection()) {
         paintInfo.context->translate(2 * rect.x() + rect.width(), 0);
         paintInfo.context->scale(FloatSize(-1, 1));
     }
     
-    paintInfo.context->drawImageBuffer(imageBuffer.get(), DeviceColorSpace, rect.location());
+    paintInfo.context->drawImageBuffer(imageBuffer.get(), ColorSpaceDeviceRGB, rect.location());
 
     paintInfo.context->restore();
     return false;
@@ -1141,11 +1141,11 @@ bool RenderThemeMac::paintMenuListButton(RenderObject* o, const PaintInfo& paint
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f); // Deliberately ignores zoom since it looks nicer if it stays thin.
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeSafari.cpp b/WebCore/rendering/RenderThemeSafari.cpp
index 07b8eb8..8d66ba7 100644
--- a/WebCore/rendering/RenderThemeSafari.cpp
+++ b/WebCore/rendering/RenderThemeSafari.cpp
@@ -830,8 +830,8 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const PaintInfo& pa
 
     paintInfo.context->save();
 
-    paintInfo.context->setFillColor(o->style()->visitedDependentColor(CSSPropertyColor), DeviceColorSpace);
-    paintInfo.context->setStrokeColor(NoStroke, DeviceColorSpace);
+    paintInfo.context->setFillColor(o->style()->visitedDependentColor(CSSPropertyColor), ColorSpaceDeviceRGB);
+    paintInfo.context->setStrokeColor(NoStroke, ColorSpaceDeviceRGB);
 
     FloatPoint arrow[3];
     arrow[0] = FloatPoint(leftEdge, centerY - arrowHeight / 2.0f);
@@ -851,11 +851,11 @@ bool RenderThemeSafari::paintMenuListButton(RenderObject* o, const PaintInfo& pa
     // Draw the separator to the left of the arrows
     paintInfo.context->setStrokeThickness(1.0f);
     paintInfo.context->setStrokeStyle(SolidStroke);
-    paintInfo.context->setStrokeColor(leftSeparatorColor, DeviceColorSpace);
+    paintInfo.context->setStrokeColor(leftSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator, bounds.bottom()));
 
-    paintInfo.context->setStrokeColor(rightSeparatorColor, DeviceColorSpace);
+    paintInfo.context->setStrokeColor(rightSeparatorColor, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.y()),
                                 IntPoint(leftEdgeOfSeparator + separatorSpace, bounds.bottom()));
 
diff --git a/WebCore/rendering/RenderThemeWin.cpp b/WebCore/rendering/RenderThemeWin.cpp
index b4fb8eb..f0f8268 100644
--- a/WebCore/rendering/RenderThemeWin.cpp
+++ b/WebCore/rendering/RenderThemeWin.cpp
@@ -92,6 +92,21 @@
 #define PBS_DISABLED    4
 #define PBS_DEFAULTED   5
 
+// Spin button parts
+#define SPNP_UP         1
+#define SPNP_DOWN       2
+
+// Spin button states
+#define DNS_NORMAL      1
+#define DNS_HOT         2
+#define DNS_PRESSED     3
+#define DNS_DISABLED    4
+#define UPS_NORMAL      1
+#define UPS_HOT         2
+#define UPS_PRESSED     3
+#define UPS_DISABLED    4
+
+
 SOFT_LINK_LIBRARY(uxtheme)
 SOFT_LINK(uxtheme, OpenThemeData, HANDLE, WINAPI, (HWND hwnd, LPCWSTR pszClassList), (hwnd, pszClassList))
 SOFT_LINK(uxtheme, CloseThemeData, HRESULT, WINAPI, (HANDLE hTheme), (hTheme))
@@ -154,6 +169,7 @@ RenderThemeWin::RenderThemeWin()
     , m_textFieldTheme(0)
     , m_menuListTheme(0)
     , m_sliderTheme(0)
+    , m_spinButtonTheme(0)
 {
     haveTheme = uxthemeLibrary() && IsThemeActive();
 }
@@ -194,6 +210,13 @@ HANDLE RenderThemeWin::sliderTheme() const
     return m_sliderTheme;
 }
 
+HANDLE RenderThemeWin::spinButtonTheme() const
+{
+    if (haveTheme && !m_spinButtonTheme)
+        m_spinButtonTheme = OpenThemeData(0, L"Spin");
+    return m_spinButtonTheme;
+}
+
 void RenderThemeWin::close()
 {
     // This method will need to be called when the OS theme changes to flush our cached themes.
@@ -205,7 +228,9 @@ void RenderThemeWin::close()
         CloseThemeData(m_menuListTheme);
     if (m_sliderTheme)
         CloseThemeData(m_sliderTheme);
-    m_buttonTheme = m_textFieldTheme = m_menuListTheme = m_sliderTheme = 0;
+    if (m_spinButtonTheme)
+        CloseThemeData(m_spinButtonTheme);
+    m_buttonTheme = m_textFieldTheme = m_menuListTheme = m_sliderTheme = m_spinButtonTheme = 0;
 
     haveTheme = uxthemeLibrary() && IsThemeActive();
 }
@@ -368,7 +393,7 @@ bool RenderThemeWin::supportsFocusRing(const RenderStyle* style) const
     return supportsFocus(style->appearance());
 }
 
-unsigned RenderThemeWin::determineClassicState(RenderObject* o)
+unsigned RenderThemeWin::determineClassicState(RenderObject* o, ControlSubPart subPart)
 {
     unsigned state = 0;
     switch (o->style()->appearance()) {
@@ -397,6 +422,18 @@ unsigned RenderThemeWin::determineClassicState(RenderObject* o)
                 state |= DFCS_INACTIVE;
             else if (isPressed(o))
                 state |= DFCS_PUSHED;
+            break;
+        case InnerSpinButtonPart: {
+            bool isUpButton = subPart == SpinButtonUp;
+            state = isUpButton ? DFCS_SCROLLUP : DFCS_SCROLLDOWN;
+            if (!isEnabled(o) || isReadOnlyControl(o))
+                state |= DFCS_INACTIVE;
+            else if (isPressed(o) && isUpButton == isSpinUpButtonPartPressed(o))
+                state |= DFCS_PUSHED;
+            else if (isHovered(o) && isUpButton == isSpinUpButtonPartHovered(o))
+                state |= DFCS_HOT;
+            break;
+        }
         default:
             break;
     }
@@ -452,7 +489,20 @@ unsigned RenderThemeWin::determineButtonState(RenderObject* o)
     return result;
 }
 
-ThemeData RenderThemeWin::getClassicThemeData(RenderObject* o)
+unsigned RenderThemeWin::determineSpinButtonState(RenderObject* o, ControlSubPart subPart)
+{
+    bool isUpButton = subPart == SpinButtonUp;
+    unsigned result = isUpButton ? UPS_NORMAL : DNS_NORMAL;
+    if (!isEnabled(o) || isReadOnlyControl(o))
+        result = isUpButton ? UPS_DISABLED : DNS_DISABLED;
+    else if (isPressed(o) && isUpButton == isSpinUpButtonPartPressed(o))
+        result = isUpButton ? UPS_PRESSED : DNS_PRESSED;
+    else if (isHovered(o) && isUpButton == isSpinUpButtonPartHovered(o))
+        result = isUpButton ? UPS_HOT : DNS_HOT;
+    return result;
+}
+
+ThemeData RenderThemeWin::getClassicThemeData(RenderObject* o, ControlSubPart subPart)
 {
     ThemeData result;
     switch (o->style()->appearance()) {
@@ -490,16 +540,20 @@ ThemeData RenderThemeWin::getClassicThemeData(RenderObject* o)
             result.m_part = TKP_THUMBRIGHT;
             result.m_state = determineSliderThumbState(o);
             break;
+        case InnerSpinButtonPart:
+            result.m_part = DFC_SCROLL;
+            result.m_state = determineClassicState(o, subPart);
+            break;
         default:
             break;
     }
     return result;
 }
 
-ThemeData RenderThemeWin::getThemeData(RenderObject* o)
+ThemeData RenderThemeWin::getThemeData(RenderObject* o, ControlSubPart subPart)
 {
     if (!haveTheme)
-        return getClassicThemeData(o);
+        return getClassicThemeData(o, subPart);
 
     ThemeData result;
     switch (o->style()->appearance()) {
@@ -549,6 +603,10 @@ ThemeData RenderThemeWin::getThemeData(RenderObject* o)
             result.m_part = TKP_THUMBRIGHT;
             result.m_state = determineSliderThumbState(o);
             break;
+        case InnerSpinButtonPart:
+            result.m_part = subPart == SpinButtonUp ? SPNP_UP : SPNP_DOWN;
+            result.m_state = determineSpinButtonState(o, subPart);
+            break;
     }
 
     return result;
@@ -618,6 +676,31 @@ bool RenderThemeWin::paintButton(RenderObject* o, const PaintInfo& i, const IntR
     return false;
 }
 
+void RenderThemeWin::adjustInnerSpinButtonStyle(CSSStyleSelector* selector, RenderStyle* style, Element* e) const
+{
+    int width = ::GetSystemMetrics(SM_CXVSCROLL);
+    if (width <= 0)
+        width = 17; // Vista's default.
+    style->setWidth(Length(width, Fixed));
+    style->setMinWidth(Length(width, Fixed));
+}
+
+bool RenderThemeWin::paintInnerSpinButton(RenderObject* o, const PaintInfo& i, const IntRect& r)
+{
+    // We split the specified rectangle into two vertically. We can't draw a
+    // spin button of which height is less than 2px.
+    if (r.height() < 2)
+        return false;
+    IntRect upRect(r);
+    upRect.setHeight(r.height() / 2);
+    IntRect downRect(r);
+    downRect.setY(upRect.bottom());
+    downRect.setHeight(r.height() - upRect.height());
+    drawControl(i.context, o, spinButtonTheme(), getThemeData(o, SpinButtonUp), upRect);
+    drawControl(i.context, o, spinButtonTheme(), getThemeData(o, SpinButtonDown), downRect);
+    return false;
+}
+
 void RenderThemeWin::setCheckboxSize(RenderStyle* style) const
 {
     // If the width and height are both specified, then we have nothing to do.
diff --git a/WebCore/rendering/RenderThemeWin.h b/WebCore/rendering/RenderThemeWin.h
index 1efb117..c05d2ee 100644
--- a/WebCore/rendering/RenderThemeWin.h
+++ b/WebCore/rendering/RenderThemeWin.h
@@ -77,6 +77,9 @@ public:
 
     virtual bool paintButton(RenderObject*, const PaintInfo&, const IntRect&);
 
+    virtual void adjustInnerSpinButtonStyle(CSSStyleSelector*, RenderStyle*, Element*) const;
+    virtual bool paintInnerSpinButton(RenderObject*, const PaintInfo&, const IntRect&);
+
     virtual bool paintTextField(RenderObject*, const PaintInfo&, const IntRect&);
 
     virtual bool paintTextArea(RenderObject* o, const PaintInfo& i, const IntRect& r)
@@ -139,6 +142,12 @@ public:
 #endif
 
 private:
+    enum ControlSubPart {
+        None,
+        SpinButtonDown,
+        SpinButtonUp,
+    };
+
     RenderThemeWin();
     ~RenderThemeWin();
 
@@ -146,24 +155,27 @@ private:
     void close();
 
     unsigned determineState(RenderObject*);
-    unsigned determineClassicState(RenderObject*);
+    unsigned determineClassicState(RenderObject*, ControlSubPart = None);
     unsigned determineSliderThumbState(RenderObject*);
     unsigned determineButtonState(RenderObject*);
+    unsigned determineSpinButtonState(RenderObject*, ControlSubPart = None);
 
     bool supportsFocus(ControlPart) const;
 
-    ThemeData getThemeData(RenderObject*);
-    ThemeData getClassicThemeData(RenderObject* o);
+    ThemeData getThemeData(RenderObject*, ControlSubPart = None);
+    ThemeData getClassicThemeData(RenderObject* o, ControlSubPart = None);
 
     HANDLE buttonTheme() const;
     HANDLE textFieldTheme() const;
     HANDLE menuListTheme() const;
     HANDLE sliderTheme() const;
+    HANDLE spinButtonTheme() const;
 
     mutable HANDLE m_buttonTheme;
     mutable HANDLE m_textFieldTheme;
     mutable HANDLE m_menuListTheme;
     mutable HANDLE m_sliderTheme;
+    mutable HANDLE m_spinButtonTheme;
 };
 
 };
diff --git a/WebCore/rendering/RenderThemeWinCE.cpp b/WebCore/rendering/RenderThemeWinCE.cpp
index 66cda11..27b8783 100644
--- a/WebCore/rendering/RenderThemeWinCE.cpp
+++ b/WebCore/rendering/RenderThemeWinCE.cpp
@@ -378,12 +378,12 @@ bool RenderThemeWinCE::paintSearchFieldCancelButton(RenderObject* o, const Paint
     IntRect cancelBounds(IntPoint(x, y), cancelSize);
     paintInfo.context->save();
     paintInfo.context->addRoundedRectClip(cancelBounds, cancelRadius, cancelRadius, cancelRadius, cancelRadius);
-    paintInfo.context->fillRect(cancelBounds, buttonColor, DeviceColorSpace);
+    paintInfo.context->fillRect(cancelBounds, buttonColor, ColorSpaceDeviceRGB);
 
     // Draw the 'x'
     IntSize xSize(3, 3);
     IntRect xBounds(cancelBounds.location() + IntSize(3, 3), xSize);
-    paintInfo.context->setStrokeColor(Color::white, DeviceColorSpace);
+    paintInfo.context->setStrokeColor(Color::white, ColorSpaceDeviceRGB);
     paintInfo.context->drawLine(xBounds.location(),  xBounds.location() + xBounds.size());
     paintInfo.context->drawLine(IntPoint(xBounds.right(), xBounds.y()),  IntPoint(xBounds.x(), xBounds.bottom()));
 
@@ -490,8 +490,8 @@ bool RenderThemeWinCE::paintSliderTrack(RenderObject* o, const PaintInfo& i, con
     bool rc = RenderTheme::paintSliderTrack(o, i, r);
     IntPoint left = IntPoint(r.x() + 2, (r.y() + r.bottom()) / 2);
     i.context->save();
-    i.context->setStrokeColor(Color::gray, DeviceColorSpace);
-    i.context->setFillColor(Color::gray, DeviceColorSpace);
+    i.context->setStrokeColor(Color::gray, ColorSpaceDeviceRGB);
+    i.context->setFillColor(Color::gray, ColorSpaceDeviceRGB);
     i.context->fillRect(r);
 #if ENABLE(VIDEO)
     HTMLMediaElement* mediaElement = mediaElementParent(o->node());
@@ -502,7 +502,7 @@ bool RenderThemeWinCE::paintSliderTrack(RenderObject* o, const PaintInfo& i, con
         left = right;
     }
 #endif
-    i.context->setStrokeColor(Color::black, DeviceColorSpace);
+    i.context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
     i.context->drawLine(left, IntPoint(r.right() - 2, left.y()));
     i.context->restore();
     return rc;
@@ -512,8 +512,8 @@ bool RenderThemeWinCE::paintSliderThumb(RenderObject* o, const PaintInfo& i, con
 {
     bool rc = RenderTheme::paintSliderThumb(o, i, r);
     i.context->save();
-    i.context->setStrokeColor(Color::black, DeviceColorSpace);
-    i.context->setFillColor(Color::black, DeviceColorSpace);
+    i.context->setStrokeColor(Color::black, ColorSpaceDeviceRGB);
+    i.context->setFillColor(Color::black, ColorSpaceDeviceRGB);
 #if ENABLE(VIDEO)
     HTMLMediaElement* mediaElement = mediaElementParent(o->node());
     if (mediaElement) {
diff --git a/WebCore/rendering/RenderTreeAsText.cpp b/WebCore/rendering/RenderTreeAsText.cpp
index ab6247b..ec36b7e 100644
--- a/WebCore/rendering/RenderTreeAsText.cpp
+++ b/WebCore/rendering/RenderTreeAsText.cpp
@@ -50,11 +50,11 @@
 #include <wtf/Vector.h>
 
 #if ENABLE(SVG)
-#include "RenderPath.h"
 #include "RenderSVGContainer.h"
 #include "RenderSVGGradientStop.h"
 #include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
 #include "SVGRenderTreeAsText.h"
@@ -440,8 +440,8 @@ static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBo
     if (o.containingBlock()->isTableCell())
         y -= toRenderTableCell(o.containingBlock())->intrinsicPaddingBefore();
     ts << "text run at (" << run.m_x << "," << y << ") width " << run.m_logicalWidth;
-    if (run.direction() == RTL || run.m_dirOverride) {
-        ts << (run.direction() == RTL ? " RTL" : " LTR");
+    if (!run.isLeftToRightDirection() || run.m_dirOverride) {
+        ts << (!run.isLeftToRightDirection() ? " RTL" : " LTR");
         if (run.m_dirOverride)
             ts << " override";
     }
@@ -453,8 +453,8 @@ static void writeTextRun(TextStream& ts, const RenderText& o, const InlineTextBo
 void write(TextStream& ts, const RenderObject& o, int indent, RenderAsTextBehavior behavior)
 {
 #if ENABLE(SVG)
-    if (o.isRenderPath()) {
-        write(ts, *toRenderPath(&o), indent);
+    if (o.isSVGPath()) {
+        write(ts, *toRenderSVGPath(&o), indent);
         return;
     }
     if (o.isSVGGradientStop()) {
diff --git a/WebCore/rendering/RenderVideo.cpp b/WebCore/rendering/RenderVideo.cpp
index 470499a..32ba91b 100644
--- a/WebCore/rendering/RenderVideo.cpp
+++ b/WebCore/rendering/RenderVideo.cpp
@@ -246,14 +246,14 @@ void RenderVideo::updatePlayer()
     mediaPlayer->setVisible(true);
 }
 
-int RenderVideo::computeReplacedWidth(bool includeMaxWidth) const
+int RenderVideo::computeReplacedLogicalWidth(bool includeMaxWidth) const
 {
-    return RenderReplaced::computeReplacedWidth(includeMaxWidth);
+    return RenderReplaced::computeReplacedLogicalWidth(includeMaxWidth);
 }
 
-int RenderVideo::computeReplacedHeight() const
+int RenderVideo::computeReplacedLogicalHeight() const
 {
-    return RenderReplaced::computeReplacedHeight();
+    return RenderReplaced::computeReplacedLogicalHeight();
 }
 
 int RenderVideo::minimumReplacedHeight() const 
diff --git a/WebCore/rendering/RenderVideo.h b/WebCore/rendering/RenderVideo.h
index 24f473d..9091490 100644
--- a/WebCore/rendering/RenderVideo.h
+++ b/WebCore/rendering/RenderVideo.h
@@ -70,8 +70,8 @@ private:
 
     virtual void layout();
 
-    virtual int computeReplacedWidth(bool includeMaxWidth = true) const;
-    virtual int computeReplacedHeight() const;
+    virtual int computeReplacedLogicalWidth(bool includeMaxWidth = true) const;
+    virtual int computeReplacedLogicalHeight() const;
     virtual int minimumReplacedHeight() const;
 
     void updatePlayer();
diff --git a/WebCore/rendering/RenderView.cpp b/WebCore/rendering/RenderView.cpp
index 1ae1589..260a081 100644
--- a/WebCore/rendering/RenderView.cpp
+++ b/WebCore/rendering/RenderView.cpp
@@ -54,6 +54,7 @@ RenderView::RenderView(Node* node, FrameView* view)
     , m_selectionEndPos(-1)
     , m_maximalOutlineSize(0)
     , m_pageHeight(0)
+    , m_pageHeightChanged(false)
     , m_layoutState(0)
     , m_layoutStateDisableCount(0)
 {
@@ -127,6 +128,8 @@ void RenderView::layout()
     // FIXME: May be better to push a clip and avoid issuing offscreen repaints.
     state.m_clipped = false;
     state.m_pageHeight = m_pageHeight;
+    state.m_pageHeightChanged = m_pageHeightChanged;
+    m_pageHeightChanged = false;
     m_layoutState = &state;
 
     if (needsLayout())
diff --git a/WebCore/rendering/RenderView.h b/WebCore/rendering/RenderView.h
index b03312f..8f64766 100644
--- a/WebCore/rendering/RenderView.h
+++ b/WebCore/rendering/RenderView.h
@@ -54,8 +54,8 @@ public:
     // The same as the FrameView's layoutHeight/layoutWidth but with null check guards.
     int viewHeight() const;
     int viewWidth() const;
-    int viewLogicalWidth() const { return style()->isVerticalBlockFlow() ? viewWidth() : viewHeight(); }
-    int viewLogicalHeight() const { return style()->isVerticalBlockFlow() ? viewHeight() : viewWidth(); }
+    int viewLogicalWidth() const { return style()->isHorizontalWritingMode() ? viewWidth() : viewHeight(); }
+    int viewLogicalHeight() const { return style()->isHorizontalWritingMode() ? viewHeight() : viewWidth(); }
 
     float zoomFactor() const;
 
@@ -138,7 +138,7 @@ public:
     {
         if (m_pageHeight != height) {
             m_pageHeight = height;
-            markDescendantBlocksAndLinesForLayout();
+            m_pageHeightChanged = true;
         }
     }
 
@@ -181,11 +181,11 @@ public: // used by layout function
     int docWidth() const;
 
     // These functions may only be accessed by LayoutStateMaintainer.
-    bool pushLayoutState(RenderBox* renderer, const IntSize& offset, int pageHeight = 0, ColumnInfo* colInfo = 0)
+    bool pushLayoutState(RenderBox* renderer, const IntSize& offset, int pageHeight = 0, bool pageHeightChanged = false, ColumnInfo* colInfo = 0)
     {
         // We push LayoutState even if layoutState is disabled because it stores layoutDelta too.
         if (!doingFullRepaint() || renderer->hasColumns() || m_layoutState->isPaginated()) {
-            m_layoutState = new (renderArena()) LayoutState(m_layoutState, renderer, offset, pageHeight, colInfo);
+            m_layoutState = new (renderArena()) LayoutState(m_layoutState, renderer, offset, pageHeight, pageHeightChanged, colInfo);
             return true;
         }
         return false;
@@ -233,6 +233,7 @@ protected:
     
 private:
     unsigned m_pageHeight;
+    bool m_pageHeightChanged;
     LayoutState* m_layoutState;
     unsigned m_layoutStateDisableCount;
 #if USE(ACCELERATED_COMPOSITING)
@@ -260,14 +261,14 @@ void toRenderView(const RenderView*);
 class LayoutStateMaintainer : public Noncopyable {
 public:
     // ctor to push now
-    LayoutStateMaintainer(RenderView* view, RenderBox* root, IntSize offset, bool disableState = false, int pageHeight = 0, ColumnInfo* colInfo = 0)
+    LayoutStateMaintainer(RenderView* view, RenderBox* root, IntSize offset, bool disableState = false, int pageHeight = 0, bool pageHeightChanged = false, ColumnInfo* colInfo = 0)
         : m_view(view)
         , m_disabled(disableState)
         , m_didStart(false)
         , m_didEnd(false)
         , m_didCreateLayoutState(false)
     {
-        push(root, offset, pageHeight, colInfo);
+        push(root, offset, pageHeight, pageHeightChanged, colInfo);
     }
     
     // ctor to maybe push later
@@ -285,11 +286,11 @@ public:
         ASSERT(m_didStart == m_didEnd);   // if this fires, it means that someone did a push(), but forgot to pop().
     }
 
-    void push(RenderBox* root, IntSize offset, int pageHeight = 0, ColumnInfo* colInfo = 0)
+    void push(RenderBox* root, IntSize offset, int pageHeight = 0, bool pageHeightChanged = false, ColumnInfo* colInfo = 0)
     {
         ASSERT(!m_didStart);
         // We push state even if disabled, because we still need to store layoutDelta
-        m_didCreateLayoutState = m_view->pushLayoutState(root, offset, pageHeight, colInfo);
+        m_didCreateLayoutState = m_view->pushLayoutState(root, offset, pageHeight, pageHeightChanged, colInfo);
         if (m_disabled && m_didCreateLayoutState)
             m_view->disableLayoutState();
         m_didStart = true;
diff --git a/WebCore/rendering/RenderWordBreak.h b/WebCore/rendering/RenderWordBreak.h
index acd8179..db31eec 100644
--- a/WebCore/rendering/RenderWordBreak.h
+++ b/WebCore/rendering/RenderWordBreak.h
@@ -35,7 +35,7 @@ class HTMLElement;
 
 class RenderWordBreak : public RenderText {
 public:
-    RenderWordBreak(HTMLElement*);
+    explicit RenderWordBreak(HTMLElement*);
 
     virtual const char* renderName() const;
     virtual bool isWordBreak() const;
diff --git a/WebCore/rendering/RenderingAllInOne.cpp b/WebCore/rendering/RenderingAllInOne.cpp
new file mode 100644
index 0000000..7a3a705
--- /dev/null
+++ b/WebCore/rendering/RenderingAllInOne.cpp
@@ -0,0 +1,112 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "AutoTableLayout.cpp"
+#include "BidiRun.cpp"
+#include "CounterNode.cpp"
+#include "EllipsisBox.cpp"
+#include "FixedTableLayout.cpp"
+#include "HitTestResult.cpp"
+#include "InlineBox.cpp"
+#include "InlineFlowBox.cpp"
+#include "InlineTextBox.cpp"
+#include "LayoutState.cpp"
+#include "MediaControlElements.cpp"
+#include "PointerEventsHitRules.cpp"
+#include "RenderApplet.cpp"
+#include "RenderArena.cpp"
+#include "RenderBR.cpp"
+#include "RenderBlock.cpp"
+#include "RenderBlockLineLayout.cpp"
+#include "RenderBox.cpp"
+#include "RenderBoxModelObject.cpp"
+#include "RenderButton.cpp"
+#include "RenderCounter.cpp"
+#include "RenderDataGrid.cpp"
+#include "RenderEmbeddedObject.cpp"
+#include "RenderFieldset.cpp"
+#include "RenderFileUploadControl.cpp"
+#include "RenderFlexibleBox.cpp"
+#include "RenderForeignObject.cpp"
+#include "RenderFrame.cpp"
+#include "RenderFrameBase.cpp"
+#include "RenderFrameSet.cpp"
+#include "RenderHTMLCanvas.cpp"
+#include "RenderIFrame.cpp"
+#include "RenderImage.cpp"
+#include "RenderImageResource.cpp"
+#include "RenderImageResourceStyleImage.cpp"
+#include "RenderIndicator.cpp"
+#include "RenderInline.cpp"
+#include "RenderLayer.cpp"
+#include "RenderLayerCompositor.cpp"
+#include "RenderLineBoxList.cpp"
+#include "RenderListBox.cpp"
+#include "RenderListItem.cpp"
+#include "RenderListMarker.cpp"
+#include "RenderMarquee.cpp"
+#include "RenderMedia.cpp"
+#include "RenderMediaControls.cpp"
+#include "RenderMenuList.cpp"
+#include "RenderMeter.cpp"
+#include "RenderObject.cpp"
+#include "RenderObjectChildList.cpp"
+#include "RenderPart.cpp"
+#include "RenderProgress.cpp"
+#include "RenderReplaced.cpp"
+#include "RenderReplica.cpp"
+#include "RenderRuby.cpp"
+#include "RenderRubyBase.cpp"
+#include "RenderRubyRun.cpp"
+#include "RenderRubyText.cpp"
+#include "RenderScrollbar.cpp"
+#include "RenderScrollbarPart.cpp"
+#include "RenderScrollbarTheme.cpp"
+#include "RenderSlider.cpp"
+#include "RenderTable.cpp"
+#include "RenderTableCell.cpp"
+#include "RenderTableCol.cpp"
+#include "RenderTableRow.cpp"
+#include "RenderTableSection.cpp"
+#include "RenderText.cpp"
+#include "RenderTextControl.cpp"
+#include "RenderTextControlMultiLine.cpp"
+#include "RenderTextControlSingleLine.cpp"
+#include "RenderTextFragment.cpp"
+#include "RenderTheme.cpp"
+#include "RenderThemeWin.cpp"
+#include "RenderTreeAsText.cpp"
+#include "RenderVideo.cpp"
+#include "RenderView.cpp"
+#include "RenderWidget.cpp"
+#include "RenderWordBreak.cpp"
+#include "RootInlineBox.cpp"
+#include "ScrollBehavior.cpp"
+#include "ShadowElement.cpp"
+#include "TextControlInnerElements.cpp"
+#include "TransformState.cpp"
+#include "break_lines.cpp"
diff --git a/WebCore/rendering/RootInlineBox.cpp b/WebCore/rendering/RootInlineBox.cpp
index 52586c5..c7fcaeb 100644
--- a/WebCore/rendering/RootInlineBox.cpp
+++ b/WebCore/rendering/RootInlineBox.cpp
@@ -46,8 +46,9 @@ RootInlineBox::RootInlineBox(RenderBlock* block)
     , m_lineTop(0)
     , m_lineBottom(0)
     , m_paginationStrut(0)
+    , m_blockLogicalHeight(0)
 {
-    setIsVertical(!block->style()->isVerticalBlockFlow());
+    setIsVertical(!block->style()->isHorizontalWritingMode());
 }
 
 
@@ -199,7 +200,7 @@ void RootInlineBox::adjustPosition(int dx, int dy)
     InlineFlowBox::adjustPosition(dx, dy);
     m_lineTop += dy;
     m_lineBottom += dy;
-    m_blockHeight += dy;
+    m_blockLogicalHeight += dy;
 }
 
 void RootInlineBox::childRemoved(InlineBox* box)
@@ -240,10 +241,12 @@ int RootInlineBox::alignBoxesInBlockDirection(int heightOfBlock, GlyphOverflowAn
     placeBoxesInBlockDirection(heightOfBlock, maxHeight, maxAscent, noQuirksMode, lineTop, lineBottom);
     computeBlockDirectionOverflow(lineTop, lineBottom, noQuirksMode, textBoxDataMap);
     setLineTopBottomPositions(lineTop, lineBottom);
-    
-    heightOfBlock += maxHeight;
-    
-    return heightOfBlock;
+
+    // Detect integer overflow.
+    if (heightOfBlock > numeric_limits<int>::max() - maxHeight)
+        return numeric_limits<int>::max();
+
+    return heightOfBlock + maxHeight;
 }
 
 GapRects RootInlineBox::fillLineSelectionGap(int selTop, int selHeight, RenderBlock* rootBlock, int blockX, int blockY, int tx, int ty,
diff --git a/WebCore/rendering/RootInlineBox.h b/WebCore/rendering/RootInlineBox.h
index 8c75072..4a0b485 100644
--- a/WebCore/rendering/RootInlineBox.h
+++ b/WebCore/rendering/RootInlineBox.h
@@ -69,8 +69,8 @@ public:
     unsigned lineBreakPos() const { return m_lineBreakPos; }
     void setLineBreakPos(unsigned p) { m_lineBreakPos = p; }
 
-    int blockHeight() const { return m_blockHeight; }
-    void setBlockHeight(int h) { m_blockHeight = h; }
+    int blockLogicalHeight() const { return m_blockLogicalHeight; }
+    void setBlockLogicalHeight(int h) { m_blockLogicalHeight = h; }
 
     bool endsWithBreak() const { return m_endsWithBreak; }
     void setEndsWithBreak(bool b) { m_endsWithBreak = b; }
@@ -88,6 +88,9 @@ public:
 
     virtual void clearTruncation();
 
+    virtual int baselinePosition() const { return boxModelObject()->baselinePosition(m_firstLine, m_isVertical ? VerticalLine : HorizontalLine, PositionOfInteriorLineBoxes); }
+    virtual int lineHeight() const { return boxModelObject()->lineHeight(m_firstLine, m_isVertical ? VerticalLine : HorizontalLine, PositionOfInteriorLineBoxes); }
+
 #if PLATFORM(MAC)
     void addHighlightOverflow();
     void paintCustomHighlight(PaintInfo&, int tx, int ty, const AtomicString& highlightType);
@@ -143,8 +146,8 @@ private:
     // good for as long as the line has not been marked dirty.
     OwnPtr<Vector<RenderBox*> > m_floats;
 
-    // The height of the block at the end of this line.  This is where the next line starts.
-    int m_blockHeight;
+    // The logical height of the block at the end of this line.  This is where the next line starts.
+    int m_blockLogicalHeight;
 
     WTF::Unicode::Direction m_lineBreakBidiStatusEor : 5;
     WTF::Unicode::Direction m_lineBreakBidiStatusLastStrong : 5;
diff --git a/WebCore/rendering/SVGCharacterData.h b/WebCore/rendering/SVGCharacterData.h
deleted file mode 100644
index 5143042..0000000
--- a/WebCore/rendering/SVGCharacterData.h
+++ /dev/null
@@ -1,96 +0,0 @@
-/*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef SVGCharacterData_h
-#define SVGCharacterData_h
-
-#if ENABLE(SVG)
-#include <wtf/HashMap.h>
-#include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
-
-namespace WebCore {
-
-class AffineTransform;
-class RenderObject;
-
-// Holds extra data, when the character is laid out on a path
-struct SVGCharOnPath : RefCounted<SVGCharOnPath> {
-    static PassRefPtr<SVGCharOnPath> create() { return adoptRef(new SVGCharOnPath); }
-
-    float xScale;
-    float yScale;
-
-    float xShift;
-    float yShift;
-
-    float orientationAngle;
-
-    bool hidden : 1;
-
-private:
-    SVGCharOnPath()
-        : xScale(1.0f)
-        , yScale(1.0f)
-        , xShift(0.0f)
-        , yShift(0.0f)
-        , orientationAngle(0.0f)
-        , hidden(false)
-    {
-    }
-};
-
-struct SVGChar {
-    SVGChar()
-        : x(0.0f)
-        , y(0.0f)
-        , angle(0.0f)
-        , orientationShiftX(0.0f)
-        , orientationShiftY(0.0f)
-        , drawnSeperated(false)
-        , newTextChunk(false)
-    {
-    }
-
-    float x;
-    float y;
-    float angle;
-
-    float orientationShiftX;
-    float orientationShiftY;
-
-    RefPtr<SVGCharOnPath> pathData;
-
-    // Determines wheter this char needs to be drawn seperated
-    bool drawnSeperated : 1;
-
-    // Determines wheter this char starts a new chunk
-    bool newTextChunk : 1;
-
-    // Helper methods
-    bool isHidden() const;
-    AffineTransform characterTransform() const;
-};
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // SVGCharacterData_h
diff --git a/WebCore/rendering/SVGCharacterLayoutInfo.cpp b/WebCore/rendering/SVGCharacterLayoutInfo.cpp
deleted file mode 100644
index 71ff1aa..0000000
--- a/WebCore/rendering/SVGCharacterLayoutInfo.cpp
+++ /dev/null
@@ -1,519 +0,0 @@
-/*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "SVGCharacterLayoutInfo.h"
-
-#if ENABLE(SVG)
-#include "InlineFlowBox.h"
-#include "InlineTextBox.h"
-#include "RenderSVGTextPath.h"
-#include "SVGCharacterData.h"
-#include "SVGLengthList.h"
-#include "SVGNumberList.h"
-#include "SVGTextPositioningElement.h"
-
-#include <float.h>
-
-namespace WebCore {
-
-// Helper function
-static float calculateBaselineShift(RenderObject* item)
-{
-    ASSERT(item);
-    ASSERT(item->style());
-    ASSERT(item->node());
-    ASSERT(item->node()->isSVGElement());
-
-    const Font& font = item->style()->font();
-    const SVGRenderStyle* svgStyle = item->style()->svgStyle();
-
-    float baselineShift = 0.0f;
-    if (svgStyle->baselineShift() == BS_LENGTH) {
-        SVGLength baselineShiftValueLength = svgStyle->baselineShiftValue();
-        if (baselineShiftValueLength.unitType() == LengthTypePercentage)
-            baselineShift = baselineShiftValueLength.valueAsPercentage() * font.pixelSize();
-        else 
-            baselineShift = baselineShiftValueLength.value(static_cast<SVGElement*>(item->node()));
-    } else {
-        float baselineAscent = font.ascent() + font.descent();
-
-        switch (svgStyle->baselineShift()) {
-        case BS_BASELINE:
-            break;
-        case BS_SUB:
-            baselineShift = -baselineAscent / 2.0f;
-            break;
-        case BS_SUPER:
-            baselineShift = baselineAscent / 2.0f;
-            break;
-        default:
-            ASSERT_NOT_REACHED();
-        }
-    }
-
-    return baselineShift;
-}
-
-SVGCharacterLayoutInfo::SVGCharacterLayoutInfo()
-    : curx(0.0f)
-    , cury(0.0f)
-    , angle(0.0f)
-    , dx(0.0f)
-    , dy(0.0f)
-    , shiftx(0.0f)
-    , shifty(0.0f)
-    , pathExtraAdvance(0.0f)
-    , pathTextLength(0.0f)
-    , pathChunkLength(0.0f)
-    , nextDrawnSeperated(false)
-    , xStackChanged(false)
-    , yStackChanged(false)
-    , dxStackChanged(false)
-    , dyStackChanged(false)
-    , angleStackChanged(false)
-    , baselineShiftStackChanged(false)
-    , pathLayout(false)
-    , currentOffset(0.0f)
-    , startOffset(0.0f)
-    , layoutPathLength(0.0f)
-{
-}
-
-bool SVGCharacterLayoutInfo::xValueAvailable() const
-{
-    return xStack.isEmpty() ? false : xStack.last().position() < xStack.last().size();
-}
-
-bool SVGCharacterLayoutInfo::yValueAvailable() const
-{
-    return yStack.isEmpty() ? false : yStack.last().position() < yStack.last().size();
-}
-
-bool SVGCharacterLayoutInfo::dxValueAvailable() const
-{
-    return dxStack.isEmpty() ? false : dxStack.last().position() < dxStack.last().size();
-}
-
-bool SVGCharacterLayoutInfo::dyValueAvailable() const
-{
-    return dyStack.isEmpty() ? false : dyStack.last().position() < dyStack.last().size();
-}
-
-bool SVGCharacterLayoutInfo::angleValueAvailable() const
-{
-    return angleStack.isEmpty() ? false : angleStack.last().position() < angleStack.last().size();
-}
-
-bool SVGCharacterLayoutInfo::baselineShiftValueAvailable() const
-{
-    return !baselineShiftStack.isEmpty();
-}
-
-float SVGCharacterLayoutInfo::xValueNext() const
-{
-    ASSERT(!xStack.isEmpty());
-    return xStack.last().valueAtCurrentPosition();
-}
-
-float SVGCharacterLayoutInfo::yValueNext() const
-{
-    ASSERT(!yStack.isEmpty());
-    return yStack.last().valueAtCurrentPosition();
-}
-
-float SVGCharacterLayoutInfo::dxValueNext() const
-{
-    ASSERT(!dxStack.isEmpty());
-    return dxStack.last().valueAtCurrentPosition();
-}
-
-float SVGCharacterLayoutInfo::dyValueNext() const
-{
-    ASSERT(!dyStack.isEmpty());
-    return dyStack.last().valueAtCurrentPosition();
-}
-
-float SVGCharacterLayoutInfo::angleValueNext() const
-{
-    ASSERT(!angleStack.isEmpty());
-    return angleStack.last().valueAtCurrentPosition();
-}
-
-float SVGCharacterLayoutInfo::baselineShiftValueNext() const
-{
-    ASSERT(!baselineShiftStack.isEmpty());
-    return baselineShiftStack.last();
-}
-
-
-bool SVGCharacterLayoutInfo::isInitialLayout() const
-{
-    return xStack.isEmpty()
-        && yStack.isEmpty()
-        && dxStack.isEmpty()
-        && dyStack.isEmpty()
-        && angleStack.isEmpty()
-        && baselineShiftStack.isEmpty()
-        && curx == 0.0f
-        && cury == 0.0f;
-}
-
-void SVGCharacterLayoutInfo::processedSingleCharacter()
-{
-    xStackWalk();
-    yStackWalk();
-    dxStackWalk();
-    dyStackWalk();
-    angleStackWalk();
-    baselineShiftStackWalk();
-}
-
-void SVGCharacterLayoutInfo::processedChunk(float savedShiftX, float savedShiftY)
-{
-    // baseline-shift doesn't span across ancestors, unlike dx/dy.
-    curx += savedShiftX - shiftx;
-    cury += savedShiftY - shifty;
-
-    if (inPathLayout()) {
-        shiftx = savedShiftX;
-        shifty = savedShiftY;
-    }
-
-    // rotation also doesn't span
-    angle = 0.0f;
-
-    if (xStackChanged) {
-        ASSERT(!xStack.isEmpty());
-        xStack.removeLast();
-        xStackChanged = false;
-    }
-
-    if (yStackChanged) {
-        ASSERT(!yStack.isEmpty());
-        yStack.removeLast();
-        yStackChanged = false;
-    }
-
-    if (dxStackChanged) {
-        ASSERT(!dxStack.isEmpty());
-        dxStack.removeLast();
-        dxStackChanged = false;
-    }
-
-    if (dyStackChanged) {
-        ASSERT(!dyStack.isEmpty());
-        dyStack.removeLast();
-        dyStackChanged = false;
-    }
-
-    if (angleStackChanged) {
-        ASSERT(!angleStack.isEmpty());
-        angleStack.removeLast();
-        angleStackChanged = false;
-    }
-
-    if (baselineShiftStackChanged) {
-        ASSERT(!baselineShiftStack.isEmpty());
-        baselineShiftStack.removeLast();
-        baselineShiftStackChanged = false;
-    }
-}
-
-bool SVGCharacterLayoutInfo::nextPathLayoutPointAndAngle(float glyphAdvance, float extraAdvance, float newOffset)
-{
-    if (layoutPathLength <= 0.0f)
-        return false;
-
-    if (newOffset != FLT_MIN)
-        currentOffset = startOffset + newOffset;
-
-    // Respect translation along path (extraAdvance is orthogonal to the path)
-    currentOffset += extraAdvance;
-
-    float offset = currentOffset + glyphAdvance / 2.0f;
-    currentOffset += glyphAdvance + pathExtraAdvance;
-
-    if (offset < 0.0f || offset > layoutPathLength)
-        return false;
-
-    bool ok = false; 
-    FloatPoint point = layoutPath.pointAtLength(offset, ok);
-    ASSERT(ok);
-
-    curx = point.x();
-    cury = point.y();
-
-    angle = layoutPath.normalAngleAtLength(offset, ok);
-    ASSERT(ok);
-
-    return true;
-}
-
-bool SVGCharacterLayoutInfo::inPathLayout() const
-{
-    return pathLayout;
-}
-
-void SVGCharacterLayoutInfo::setInPathLayout(bool value)
-{
-    pathLayout = value;
-
-    pathExtraAdvance = 0.0f;
-    pathTextLength = 0.0f;
-    pathChunkLength = 0.0f;
-}
-
-void SVGCharacterLayoutInfo::addLayoutInformation(InlineFlowBox* flowBox, float textAnchorStartOffset)
-{
-    bool wasInitialLayout = isInitialLayout();
-
-    RenderSVGTextPath* textPath = toRenderSVGTextPath(flowBox->renderer());
-    Path path = textPath->layoutPath();
-
-    float baselineShift = calculateBaselineShift(textPath);
-
-    layoutPath = path;
-    layoutPathLength = path.length();
-
-    if (layoutPathLength <= 0.0f)
-        return;
-
-    startOffset = textPath->startOffset();
-
-    if (textPath->startOffset() >= 0.0f && textPath->startOffset() <= 1.0f)
-        startOffset *= layoutPathLength;
-
-    startOffset += textAnchorStartOffset;
-    currentOffset = startOffset;
-
-    // Only baseline-shift is handled through the normal layout system
-    addStackContent(BaselineShiftStack, baselineShift);
-
-    if (wasInitialLayout) {
-        xStackChanged = false;
-        yStackChanged = false;
-        dxStackChanged = false;
-        dyStackChanged = false;
-        angleStackChanged = false;
-        baselineShiftStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::addLayoutInformation(SVGTextPositioningElement* element)
-{
-    bool wasInitialLayout = isInitialLayout();
-    float baselineShift = calculateBaselineShift(element->renderer());
-
-    addStackContent(XStack, element->x(), element);
-    addStackContent(YStack, element->y(), element);
-    addStackContent(DxStack, element->dx(), element);
-    addStackContent(DyStack, element->dy(), element);
-    addStackContent(AngleStack, element->rotate());
-    addStackContent(BaselineShiftStack, baselineShift);
-
-    if (wasInitialLayout) {
-        xStackChanged = false;
-        yStackChanged = false;
-        dxStackChanged = false;
-        dyStackChanged = false;
-        angleStackChanged = false;
-        baselineShiftStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::addStackContent(StackType type, SVGNumberList* list)
-{
-    unsigned length = list->numberOfItems();
-    if (!length)
-        return;
-
-    PositionedFloatVector newLayoutInfo;
-
-    // TODO: Convert more efficiently!
-    ExceptionCode ec = 0;
-    for (unsigned i = 0; i < length; ++i) {
-        float value = list->getItem(i, ec);
-        ASSERT(!ec);
-
-        newLayoutInfo.append(value);
-    }
-
-    addStackContent(type, newLayoutInfo);
-}
-
-void SVGCharacterLayoutInfo::addStackContent(StackType type, SVGLengthList* list, const SVGElement* context)
-{
-    unsigned length = list->numberOfItems();
-    if (!length)
-        return;
-
-    PositionedFloatVector newLayoutInfo;
-
-    ExceptionCode ec = 0;
-    for (unsigned i = 0; i < length; ++i) {
-        float value = list->getItem(i, ec).value(context);
-        ASSERT(!ec);
-
-        newLayoutInfo.append(value);
-    }
-
-    addStackContent(type, newLayoutInfo);
-}
-
-void SVGCharacterLayoutInfo::addStackContent(StackType type, const PositionedFloatVector& list)
-{
-    switch (type) {
-    case XStack:
-        xStackChanged = true;
-        xStack.append(list);
-        break;
-    case YStack:
-        yStackChanged = true;
-        yStack.append(list);
-        break;
-    case DxStack:
-        dxStackChanged = true;
-        dxStack.append(list);
-        break;
-    case DyStack:
-        dyStackChanged = true;
-        dyStack.append(list);
-        break;
-    case AngleStack:
-        angleStackChanged = true;
-        angleStack.append(list);
-        break; 
-    default:
-        ASSERT_NOT_REACHED();
-    }
-}
-
-void SVGCharacterLayoutInfo::addStackContent(StackType type, float value)
-{
-    if (value == 0.0f)
-        return;
-
-    switch (type) {
-    case BaselineShiftStack:
-        baselineShiftStackChanged = true;
-        baselineShiftStack.append(value);
-        break;
-    default:
-        ASSERT_NOT_REACHED();
-    }
-}
-
-void SVGCharacterLayoutInfo::xStackWalk()
-{
-    unsigned i = 1;
-
-    while (!xStack.isEmpty()) {
-        PositionedFloatVector& cur = xStack.last();
-        if (i + cur.position() < cur.size()) {
-            cur.advance(i);
-            break;
-        }
-
-        i += cur.position();
-        xStack.removeLast();
-        xStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::yStackWalk()
-{
-    unsigned i = 1;
-
-    while (!yStack.isEmpty()) {
-        PositionedFloatVector& cur = yStack.last();
-        if (i + cur.position() < cur.size()) {
-            cur.advance(i);
-            break;
-        }
-
-        i += cur.position();
-        yStack.removeLast();
-        yStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::dxStackWalk()
-{
-    unsigned i = 1;
-
-    while (!dxStack.isEmpty()) {
-        PositionedFloatVector& cur = dxStack.last();
-        if (i + cur.position() < cur.size()) {
-            cur.advance(i);
-            break;
-        }
-
-        i += cur.position();
-        dxStack.removeLast();
-        dxStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::dyStackWalk()
-{
-    unsigned i = 1;
-
-    while (!dyStack.isEmpty()) {
-        PositionedFloatVector& cur = dyStack.last();
-        if (i + cur.position() < cur.size()) {
-            cur.advance(i);
-            break;
-        }
-
-        i += cur.position();
-        dyStack.removeLast();
-        dyStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::angleStackWalk()
-{
-    unsigned i = 1;
-
-    while (!angleStack.isEmpty()) {
-        PositionedFloatVector& cur = angleStack.last();
-        if (i + cur.position() < cur.size()) {
-            cur.advance(i);
-            break;
-        }
-
-        i += cur.position();
-        angleStack.removeLast();
-        angleStackChanged = false;
-    }
-}
-
-void SVGCharacterLayoutInfo::baselineShiftStackWalk()
-{
-    if (!baselineShiftStack.isEmpty()) {
-        baselineShiftStack.removeLast();
-        baselineShiftStackChanged = false;
-    }
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGCharacterLayoutInfo.h b/WebCore/rendering/SVGCharacterLayoutInfo.h
deleted file mode 100644
index 7549283..0000000
--- a/WebCore/rendering/SVGCharacterLayoutInfo.h
+++ /dev/null
@@ -1,173 +0,0 @@
-/*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef SVGCharacterLayoutInfo_h
-#define SVGCharacterLayoutInfo_h
-
-#if ENABLE(SVG)
-#include "Path.h"
-#include <wtf/Assertions.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class InlineFlowBox;
-class SVGElement;
-class SVGLengthList;
-class SVGNumberList;
-class SVGTextPositioningElement;
-
-template<class Type>
-class PositionedVector : public Vector<Type> {
-public:
-    PositionedVector<Type>()
-        : m_position(0)
-    {
-    }
-
-    unsigned position() const
-    {
-        return m_position;
-    }
-
-    void advance(unsigned position)
-    {
-        m_position += position;
-        ASSERT(m_position < Vector<Type>::size());
-    }
-
-    Type valueAtCurrentPosition() const
-    {
-        ASSERT(m_position < Vector<Type>::size());
-        return Vector<Type>::at(m_position);
-    }
-
-private:
-    unsigned m_position;
-};
-
-class PositionedFloatVector : public PositionedVector<float> { };
-struct SVGChar;
-
-struct SVGCharacterLayoutInfo {
-    SVGCharacterLayoutInfo();
-
-    enum StackType { XStack, YStack, DxStack, DyStack, AngleStack, BaselineShiftStack };
-
-    bool xValueAvailable() const;
-    bool yValueAvailable() const;
-    bool dxValueAvailable() const;
-    bool dyValueAvailable() const;
-    bool angleValueAvailable() const;
-    bool baselineShiftValueAvailable() const;
-
-    float xValueNext() const;
-    float yValueNext() const;
-    float dxValueNext() const;
-    float dyValueNext() const;
-    float angleValueNext() const;
-    float baselineShiftValueNext() const;
-
-    void processedChunk(float savedShiftX, float savedShiftY);
-    void processedSingleCharacter();
-
-    bool nextPathLayoutPointAndAngle(float glyphAdvance, float extraAdvance, float newOffset);
-
-    // Used for text-on-path.
-    void addLayoutInformation(InlineFlowBox*, float textAnchorOffset = 0.0f);
-
-    bool inPathLayout() const;
-    void setInPathLayout(bool value);
-
-    // Used for anything else.
-    void addLayoutInformation(SVGTextPositioningElement*);
-
-    // Global position
-    float curx;
-    float cury;
-
-    // Global rotation
-    float angle;
-
-    // Accumulated dx/dy values
-    float dx;
-    float dy;
-
-    // Accumulated baseline-shift values
-    float shiftx;
-    float shifty;
-
-    // Path specific advance values to handle lengthAdjust
-    float pathExtraAdvance;
-    float pathTextLength;
-    float pathChunkLength;
-
-    // Result vector
-    Vector<SVGChar> svgChars;
-    bool nextDrawnSeperated : 1;
-
-private:
-    // Used for baseline-shift.
-    void addStackContent(StackType, float);
-
-    // Used for angle.
-    void addStackContent(StackType, SVGNumberList*);
-
-    // Used for x/y/dx/dy.    
-    void addStackContent(StackType, SVGLengthList*, const SVGElement*);
-
-    void addStackContent(StackType, const PositionedFloatVector&);
-
-    void xStackWalk();
-    void yStackWalk();
-    void dxStackWalk();
-    void dyStackWalk();
-    void angleStackWalk();
-    void baselineShiftStackWalk();
-
-    bool isInitialLayout() const;
-
-private:
-    bool xStackChanged : 1;
-    bool yStackChanged : 1;
-    bool dxStackChanged : 1;
-    bool dyStackChanged : 1;
-    bool angleStackChanged : 1;
-    bool baselineShiftStackChanged : 1;
-
-    // text on path layout
-    bool pathLayout : 1;
-    float currentOffset;
-    float startOffset;
-    float layoutPathLength;
-    Path layoutPath;
-
-    Vector<PositionedFloatVector> xStack;
-    Vector<PositionedFloatVector> yStack;
-    Vector<PositionedFloatVector> dxStack;
-    Vector<PositionedFloatVector> dyStack;
-    Vector<PositionedFloatVector> angleStack;
-    Vector<float> baselineShiftStack;
-};
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // SVGCharacterLayoutInfo_h
diff --git a/WebCore/rendering/SVGImageBufferTools.cpp b/WebCore/rendering/SVGImageBufferTools.cpp
index 709bf10..903aa21 100644
--- a/WebCore/rendering/SVGImageBufferTools.cpp
+++ b/WebCore/rendering/SVGImageBufferTools.cpp
@@ -50,7 +50,7 @@ void SVGImageBufferTools::calculateTransformationToOutermostSVGCoordinateSystem(
     }
 }
 
-bool SVGImageBufferTools::createImageBuffer(const FloatRect& absoluteTargetRect, const FloatRect& clampedAbsoluteTargetRect, OwnPtr<ImageBuffer>& imageBuffer, ImageColorSpace colorSpace)
+bool SVGImageBufferTools::createImageBuffer(const FloatRect& absoluteTargetRect, const FloatRect& clampedAbsoluteTargetRect, OwnPtr<ImageBuffer>& imageBuffer, ColorSpace colorSpace)
 {
     IntSize imageSize(roundedImageBufferSize(clampedAbsoluteTargetRect.size()));
     IntSize unclampedImageSize(SVGImageBufferTools::roundedImageBufferSize(absoluteTargetRect.size()));
diff --git a/WebCore/rendering/SVGImageBufferTools.h b/WebCore/rendering/SVGImageBufferTools.h
index 8894aae..9bcc7a4 100644
--- a/WebCore/rendering/SVGImageBufferTools.h
+++ b/WebCore/rendering/SVGImageBufferTools.h
@@ -34,7 +34,7 @@ class RenderObject;
 
 class SVGImageBufferTools : public Noncopyable {
 public:
-    static bool createImageBuffer(const FloatRect& absoluteTargetRect, const FloatRect& clampedAbsoluteTargetRect, OwnPtr<ImageBuffer>&, ImageColorSpace);
+    static bool createImageBuffer(const FloatRect& absoluteTargetRect, const FloatRect& clampedAbsoluteTargetRect, OwnPtr<ImageBuffer>&, ColorSpace);
     static void renderSubtreeToImageBuffer(ImageBuffer*, RenderObject*, const AffineTransform&);
     static void clipToImageBuffer(GraphicsContext*, const AffineTransform& absoluteTransform, const FloatRect& clampedAbsoluteTargetRect, OwnPtr<ImageBuffer>&);
 
diff --git a/WebCore/rendering/SVGInlineFlowBox.cpp b/WebCore/rendering/SVGInlineFlowBox.cpp
deleted file mode 100644
index 4008938..0000000
--- a/WebCore/rendering/SVGInlineFlowBox.cpp
+++ /dev/null
@@ -1,63 +0,0 @@
-/*
- * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
- *           (C) 2006 Apple Computer Inc.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "SVGInlineFlowBox.h"
-
-#if ENABLE(SVG)
-#include "GraphicsContext.h"
-#include "SVGRenderSupport.h"
-
-namespace WebCore {
-
-void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int)
-{
-    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
-    ASSERT(!paintInfo.context->paintingDisabled());
-
-    RenderObject* boxRenderer = renderer();
-    ASSERT(boxRenderer);
-
-    PaintInfo childPaintInfo(paintInfo);
-    childPaintInfo.context->save();
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
-        for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
-            child->paint(childPaintInfo, 0, 0);
-    }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
-    childPaintInfo.context->restore();
-}
-
-IntRect SVGInlineFlowBox::calculateBoundaries() const
-{
-    IntRect childRect;
-    for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
-        childRect.unite(child->calculateBoundaries());
-    return childRect;
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGInlineTextBox.cpp b/WebCore/rendering/SVGInlineTextBox.cpp
deleted file mode 100644
index c367598..0000000
--- a/WebCore/rendering/SVGInlineTextBox.cpp
+++ /dev/null
@@ -1,889 +0,0 @@
-/**
- * Copyright (C) 2007 Rob Buis <buis@kde.org>
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "SVGInlineTextBox.h"
-
-#if ENABLE(SVG)
-#include "FloatConversion.h"
-#include "GraphicsContext.h"
-#include "InlineFlowBox.h"
-#include "RenderBlock.h"
-#include "RenderSVGResource.h"
-#include "SVGRootInlineBox.h"
-#include "SVGTextLayoutUtilities.h"
-
-#include <float.h>
-
-using namespace std;
-
-namespace WebCore {
-
-SVGInlineTextBox::SVGInlineTextBox(RenderObject* object)
-    : InlineTextBox(object)
-    , m_logicalHeight(0)
-    , m_paintingResource(0)
-    , m_paintingResourceMode(ApplyToDefaultMode)
-{
-}
-
-SVGRootInlineBox* SVGInlineTextBox::svgRootInlineBox() const
-{
-    // Find associated root inline box
-    InlineFlowBox* parentBox = parent();
-
-    while (parentBox && !parentBox->isRootInlineBox())
-        parentBox = parentBox->parent();
-
-    ASSERT(parentBox);
-    ASSERT(parentBox->isRootInlineBox());
-
-    if (!parentBox->isSVGRootInlineBox())
-        return 0;
-
-    return static_cast<SVGRootInlineBox*>(parentBox);
-}
-
-void SVGInlineTextBox::measureCharacter(RenderStyle* style, int position, int& charsConsumed, String& glyphName, String& unicodeString, float& glyphWidth, float& glyphHeight) const
-{
-    ASSERT(style);
-
-    int offset = direction() == RTL ? end() - position : start() + position;
-    int extraCharsAvailable = len() - position - 1;
-    const UChar* characters = textRenderer()->characters();
-
-    const Font& font = style->font();
-    glyphWidth = font.floatWidth(svgTextRunForInlineTextBox(characters + offset, 1, style, this), extraCharsAvailable, charsConsumed, glyphName);
-    glyphHeight = font.height();
-
-    // The unicodeString / glyphName pair is needed for kerning calculations.
-    unicodeString = String(characters + offset, charsConsumed);
-}
-
-int SVGInlineTextBox::offsetForPosition(int xCoordinate, bool includePartialGlyphs) const
-{
-    ASSERT(!m_currentChunkPart.isValid());
-    float x = xCoordinate;
-
-    RenderText* textRenderer = this->textRenderer();
-    ASSERT(textRenderer);
-
-    RenderStyle* style = textRenderer->style();
-    ASSERT(style);
-
-    RenderBlock* containingBlock = textRenderer->containingBlock();
-    ASSERT(containingBlock);
-
-    // Move incoming relative x position to absolute position, as the character origins stored in the chunk parts use absolute coordinates
-    x += containingBlock->x();
-
-    // Figure out which text chunk part is hit
-    SVGTextChunkPart hitPart;
-
-    const Vector<SVGTextChunkPart>::const_iterator end = m_svgTextChunkParts.end();
-    for (Vector<SVGTextChunkPart>::const_iterator it = m_svgTextChunkParts.begin(); it != end; ++it) {
-        const SVGTextChunkPart& part = *it;
-
-        // Check whether we're past the hit part.
-        if (x < part.firstCharacter->x)
-            break;
-
-        hitPart = part;
-    }
-
-    // If we did not hit anything, just exit.
-    if (!hitPart.isValid())
-        return 0;
-
-    // Before calling Font::offsetForPosition(), subtract the start position of the first character
-    // in the hit text chunk part, to pass in coordinates, which are relative to the text chunk part, as
-    // constructTextRun() only builds a TextRun for the current chunk part, not the whole inline text box.
-    x -= hitPart.firstCharacter->x;
-
-    m_currentChunkPart = hitPart;
-    TextRun textRun(constructTextRun(style));
-    m_currentChunkPart = SVGTextChunkPart();
-
-    // Eventually handle lengthAdjust="spacingAndGlyphs".
-    // FIXME: Need to revisit the whole offsetForPosition concept for vertical text selection.
-    if (!m_chunkTransformation.isIdentity())
-        textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(m_chunkTransformation.a()));
-
-    return hitPart.offset + style->font().offsetForPosition(textRun, x, includePartialGlyphs);
-}
-
-int SVGInlineTextBox::positionForOffset(int) const
-{
-    // SVG doesn't use the offset <-> position selection system. 
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-FloatRect SVGInlineTextBox::selectionRectForTextChunkPart(const SVGTextChunkPart& part, int partStartPos, int partEndPos, RenderStyle* style)
-{
-    // Map startPos/endPos positions into chunk part
-    mapStartEndPositionsIntoChunkPartCoordinates(partStartPos, partEndPos, part);
-
-    if (partStartPos >= partEndPos)
-        return FloatRect();
-
-    // Set current chunk part, so constructTextRun() works properly.
-    m_currentChunkPart = part;
-
-    const Font& font = style->font();
-    Vector<SVGChar>::const_iterator character = part.firstCharacter;
-    FloatPoint textOrigin(character->x, character->y - font.ascent());
-
-    FloatRect partRect(font.selectionRectForText(constructTextRun(style), textOrigin, part.height, partStartPos, partEndPos));
-    m_currentChunkPart = SVGTextChunkPart();
-
-    return character->characterTransform().mapRect(partRect);
-}
-
-IntRect SVGInlineTextBox::selectionRect(int, int, int startPos, int endPos)
-{
-    ASSERT(!m_currentChunkPart.isValid());
-
-    int boxStart = start();
-    startPos = max(startPos - boxStart, 0);
-    endPos = min(endPos - boxStart, static_cast<int>(len()));
-
-    if (startPos >= endPos)
-        return IntRect();
-
-    RenderText* text = textRenderer();
-    ASSERT(text);
-
-    RenderStyle* style = text->style();
-    ASSERT(style);
-
-    FloatRect selectionRect;
-
-    // Figure out which text chunk part is hit
-    const Vector<SVGTextChunkPart>::const_iterator end = m_svgTextChunkParts.end();
-    for (Vector<SVGTextChunkPart>::const_iterator it = m_svgTextChunkParts.begin(); it != end; ++it)
-        selectionRect.unite(selectionRectForTextChunkPart(*it, startPos, endPos, style));
-
-    // Resepect possible chunk transformation
-    if (m_chunkTransformation.isIdentity())
-        return enclosingIntRect(selectionRect);
-
-    return enclosingIntRect(m_chunkTransformation.mapRect(selectionRect));
-}
-
-void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
-{
-    ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
-    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
-    ASSERT(truncation() == cNoTruncation);
-
-    if (renderer()->style()->visibility() != VISIBLE)
-        return;
-
-    // Note: We're explicitely not supporting composition & custom underlines and custom highlighters - unlike InlineTextBox.
-    // If we ever need that for SVG, it's very easy to refactor and reuse the code.
-
-    RenderObject* parentRenderer = parent()->renderer();
-    ASSERT(parentRenderer);
-
-    RenderStyle* style = parentRenderer->style();
-    ASSERT(style);
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    ASSERT(svgStyle);
-
-    bool hasFill = svgStyle->hasFill();
-    bool hasStroke = svgStyle->hasStroke();
-    bool paintSelectedTextOnly = paintInfo.phase == PaintPhaseSelection;
-
-    // Determine whether or not we're selected.
-    bool isPrinting = parentRenderer->document()->printing();
-    bool hasSelection = !isPrinting && selectionState() != RenderObject::SelectionNone;
-    if (!hasSelection && paintSelectedTextOnly)
-        return;
-
-    RenderStyle* selectionStyle = style;
-    if (hasSelection) {
-        selectionStyle = parentRenderer->getCachedPseudoStyle(SELECTION);
-        if (selectionStyle) {
-            const SVGRenderStyle* svgSelectionStyle = selectionStyle->svgStyle();
-            ASSERT(svgSelectionStyle);
-
-            if (!hasFill)
-                hasFill = svgSelectionStyle->hasFill();
-            if (!hasStroke)
-                hasStroke = svgSelectionStyle->hasStroke();
-        } else
-            selectionStyle = style;
-    }
-
-    // Compute text match marker rects. It needs to traverse all text chunk parts to figure
-    // out the union selection rect of all text chunk parts that contribute to the selection.
-    computeTextMatchMarkerRect(style);
-    ASSERT(!m_currentChunkPart.isValid());
-
-    const Vector<SVGTextChunkPart>::const_iterator end = m_svgTextChunkParts.end();
-    for (Vector<SVGTextChunkPart>::const_iterator it = m_svgTextChunkParts.begin(); it != end; ++it) {
-        ASSERT(!m_paintingResource);
-
-        // constructTextRun() uses the current chunk part to figure out what text to render.
-        m_currentChunkPart = *it;
-        paintInfo.context->save();
-
-        // Prepare context and draw text
-        if (!m_chunkTransformation.isIdentity())
-            paintInfo.context->concatCTM(m_chunkTransformation);
-
-        Vector<SVGChar>::const_iterator firstCharacter = m_currentChunkPart.firstCharacter;
-        AffineTransform characterTransform = firstCharacter->characterTransform();
-        if (!characterTransform.isIdentity())
-            paintInfo.context->concatCTM(characterTransform);
-
-        FloatPoint textOrigin(firstCharacter->x, firstCharacter->y);
-
-        // Draw background once (not in both fill/stroke phases)
-        if (!isPrinting && !paintSelectedTextOnly && hasSelection)
-            paintSelection(paintInfo.context, textOrigin, style);
-
-        // Spec: All text decorations except line-through should be drawn before the text is filled and stroked; thus, the text is rendered on top of these decorations.
-        int decorations = style->textDecorationsInEffect();
-        if (decorations & UNDERLINE)
-            paintDecoration(paintInfo.context, textOrigin, UNDERLINE, hasSelection);
-        if (decorations & OVERLINE)
-            paintDecoration(paintInfo.context, textOrigin, OVERLINE, hasSelection);
-
-        // Fill text
-        if (hasFill) {
-            m_paintingResourceMode = ApplyToFillMode | ApplyToTextMode;
-            paintText(paintInfo.context, textOrigin, style, selectionStyle, hasSelection, paintSelectedTextOnly);
-        }
-
-        // Stroke text
-        if (hasStroke) {
-            m_paintingResourceMode = ApplyToStrokeMode | ApplyToTextMode;
-            paintText(paintInfo.context, textOrigin, style, selectionStyle, hasSelection, paintSelectedTextOnly);
-        }
-
-        // Spec: Line-through should be drawn after the text is filled and stroked; thus, the line-through is rendered on top of the text.
-        if (decorations & LINE_THROUGH)
-            paintDecoration(paintInfo.context, textOrigin, LINE_THROUGH, hasSelection);
-
-        m_paintingResourceMode = ApplyToDefaultMode;
-        paintInfo.context->restore();
-    }
-
-    m_currentChunkPart = SVGTextChunkPart();
-    ASSERT(!m_paintingResource);
-}
-
-bool SVGInlineTextBox::acquirePaintingResource(GraphicsContext*& context, RenderObject* renderer, RenderStyle* style)
-{
-    ASSERT(renderer);
-    ASSERT(style);
-    ASSERT(m_paintingResourceMode != ApplyToDefaultMode);
-
-    if (m_paintingResourceMode & ApplyToFillMode)
-        m_paintingResource = RenderSVGResource::fillPaintingResource(renderer, style);
-    else if (m_paintingResourceMode & ApplyToStrokeMode)
-        m_paintingResource = RenderSVGResource::strokePaintingResource(renderer, style);
-    else {
-        // We're either called for stroking or filling.
-        ASSERT_NOT_REACHED();
-    }
-
-    if (!m_paintingResource)
-        return false;
-
-    m_paintingResource->applyResource(renderer, style, context, m_paintingResourceMode);
-    return true;
-}
-
-void SVGInlineTextBox::releasePaintingResource(GraphicsContext*& context)
-{
-    ASSERT(m_paintingResource);
-
-    RenderObject* parentRenderer = parent()->renderer();
-    ASSERT(parentRenderer);
-
-    m_paintingResource->postApplyResource(parentRenderer, context, m_paintingResourceMode);
-    m_paintingResource = 0;
-}
-
-bool SVGInlineTextBox::prepareGraphicsContextForTextPainting(GraphicsContext*& context, TextRun& textRun, RenderStyle* style)
-{
-    bool acquiredResource = acquirePaintingResource(context, parent()->renderer(), style);
-
-#if ENABLE(SVG_FONTS)
-    // SVG Fonts need access to the painting resource used to draw the current text chunk.
-    if (acquiredResource)
-        textRun.setActivePaintingResource(m_paintingResource);
-#endif
-
-    return acquiredResource;
-}
-
-void SVGInlineTextBox::restoreGraphicsContextAfterTextPainting(GraphicsContext*& context, TextRun& textRun)
-{
-    releasePaintingResource(context);
-
-#if ENABLE(SVG_FONTS)
-    textRun.setActivePaintingResource(0);
-#endif
-}
-
-TextRun SVGInlineTextBox::constructTextRun(RenderStyle* style) const
-{
-    ASSERT(m_currentChunkPart.isValid());
-    return svgTextRunForInlineTextBox(textRenderer()->text()->characters() + start() + m_currentChunkPart.offset, m_currentChunkPart.length, style, this);
-}
-
-void SVGInlineTextBox::mapStartEndPositionsIntoChunkPartCoordinates(int& startPos, int& endPos, const SVGTextChunkPart& part) const
-{
-    if (startPos >= endPos)
-        return;
-
-    // Take <text x="10 50 100">ABC</text> as example. We're called three times from paint(), because all absolute positioned
-    // characters are drawn on their own. For each of them we want to find out whehter it's selected. startPos=0, endPos=1
-    // could mean A, B or C is hit, depending on which chunk part is processed at the moment. With the offset & length values
-    // of each chunk part we can easily find out which one is meant to be selected. Bail out for the other chunk parts.
-    // If starPos is behind the current chunk or the endPos ends before this text chunk part, we're not meant to be selected.
-    if (startPos >= part.offset + part.length || endPos <= part.offset) {
-        startPos = 0;
-        endPos = -1;
-        return;
-    }
-
-    // The current processed chunk part is hit. When painting the selection, constructTextRun() builds
-    // a TextRun object whose startPos is 0 and endPos is chunk part length. The code below maps the incoming
-    // startPos/endPos range into a [0, part length] coordinate system, relative to the current chunk part.
-    if (startPos < part.offset)
-        startPos = 0;
-    else
-        startPos -= part.offset;
-
-    if (endPos > part.offset + part.length)
-        endPos = part.length;
-    else {
-        ASSERT(endPos >= part.offset);
-        endPos -= part.offset;
-    }
-
-    ASSERT(startPos < endPos);
-}
-
-void SVGInlineTextBox::selectionStartEnd(int& startPos, int& endPos)
-{
-    InlineTextBox::selectionStartEnd(startPos, endPos);
-
-    if (!m_currentChunkPart.isValid())
-        return;
-
-    mapStartEndPositionsIntoChunkPartCoordinates(startPos, endPos, m_currentChunkPart);
-}
-
-void SVGInlineTextBox::computeTextMatchMarkerRect(RenderStyle* style)
-{
-    ASSERT(!m_currentChunkPart.isValid());
-    Node* node = renderer()->node();
-    if (!node || !node->inDocument())
-        return;
-
-    Document* document = renderer()->document();
-    Vector<DocumentMarker> markers = document->markers()->markersForNode(renderer()->node());
-
-    Vector<DocumentMarker>::iterator markerEnd = markers.end();
-    for (Vector<DocumentMarker>::iterator markerIt = markers.begin(); markerIt != markerEnd; ++markerIt) {
-        const DocumentMarker& marker = *markerIt;
-
-        // SVG is only interessted in the TextMatch marker, for now.
-        if (marker.type != DocumentMarker::TextMatch)
-            continue;
-
-        FloatRect markerRect;
-        int partStartPos = max(marker.startOffset - start(), static_cast<unsigned>(0));
-        int partEndPos = min(marker.endOffset - start(), static_cast<unsigned>(len()));
-
-        // Iterate over all text chunk parts, to see which ones have to be highlighted
-        const Vector<SVGTextChunkPart>::const_iterator end = m_svgTextChunkParts.end();
-        for (Vector<SVGTextChunkPart>::const_iterator it = m_svgTextChunkParts.begin(); it != end; ++it)
-            markerRect.unite(selectionRectForTextChunkPart(*it, partStartPos, partEndPos, style));
-
-        if (!m_chunkTransformation.isIdentity())
-            markerRect = m_chunkTransformation.mapRect(markerRect);
-
-        document->markers()->setRenderedRectForMarker(node, marker, renderer()->localToAbsoluteQuad(markerRect).enclosingBoundingBox());
-    }
-}
-
-static inline float positionOffsetForDecoration(ETextDecoration decoration, const Font& font, float thickness)
-{
-    // FIXME: For SVG Fonts we need to use the attributes defined in the <font-face> if specified.
-    // Compatible with Batik/Opera.
-    if (decoration == UNDERLINE)
-        return font.ascent() + thickness * 1.5f;
-    if (decoration == OVERLINE)
-        return thickness;
-    if (decoration == LINE_THROUGH)
-        return font.ascent() * 5.0f / 8.0f;
-
-    ASSERT_NOT_REACHED();
-    return 0.0f;
-}
-
-static inline float thicknessForDecoration(ETextDecoration, const Font& font)
-{
-    // FIXME: For SVG Fonts we need to use the attributes defined in the <font-face> if specified.
-    // Compatible with Batik/Opera
-    return font.size() / 20.0f;
-}
- 
-static inline RenderObject* findRenderObjectDefininingTextDecoration(InlineFlowBox* parentBox, ETextDecoration decoration)
-{
-    // Lookup render object which has text-decoration set.
-    RenderObject* renderer = 0;
-    while (parentBox) {
-        renderer = parentBox->renderer();
-
-        // Explicitely check textDecoration() not textDecorationsInEffect(), which is inherited to
-        // children, as we want to lookup the render object whose style defined the text-decoration.
-        if (renderer->style() && renderer->style()->textDecoration() & decoration)
-            break;
-
-        parentBox = parentBox->parent();
-    }
-
-    ASSERT(renderer);
-    return renderer;
-}
-
-void SVGInlineTextBox::paintDecoration(GraphicsContext* context, const FloatPoint& textOrigin, ETextDecoration decoration, bool hasSelection)
-{
-    // Find out which render style defined the text-decoration, as its fill/stroke properties have to be used for drawing instead of ours.
-    RenderObject* decorationRenderer = findRenderObjectDefininingTextDecoration(parent(), decoration);
-    RenderStyle* decorationStyle = decorationRenderer->style();
-    ASSERT(decorationStyle);
-
-    const SVGRenderStyle* svgDecorationStyle = decorationStyle->svgStyle();
-    ASSERT(svgDecorationStyle);
-
-    bool hasDecorationFill = svgDecorationStyle->hasFill();
-    bool hasDecorationStroke = svgDecorationStyle->hasStroke();
-
-    if (hasSelection) {
-        if (RenderStyle* pseudoStyle = decorationRenderer->getCachedPseudoStyle(SELECTION)) {
-            decorationStyle = pseudoStyle;
-
-            svgDecorationStyle = decorationStyle->svgStyle();
-            ASSERT(svgDecorationStyle);
-
-            if (!hasDecorationFill)
-                hasDecorationFill = svgDecorationStyle->hasFill();
-            if (!hasDecorationStroke)
-                hasDecorationStroke = svgDecorationStyle->hasStroke();
-        }
-    }
-
-    if (decorationStyle->visibility() == HIDDEN)
-        return;
-
-    if (hasDecorationFill) {
-        m_paintingResourceMode = ApplyToFillMode;
-        paintDecorationWithStyle(context, textOrigin, decorationRenderer, decoration);
-    }
-
-    if (hasDecorationStroke) {
-        m_paintingResourceMode = ApplyToStrokeMode;
-        paintDecorationWithStyle(context, textOrigin, decorationRenderer, decoration);
-    }
-}
-
-void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, const FloatPoint& textOrigin, RenderObject* decorationRenderer, ETextDecoration decoration)
-{
-    ASSERT(!m_paintingResource);
-    ASSERT(m_paintingResourceMode != ApplyToDefaultMode);
-    ASSERT(m_currentChunkPart.isValid());
-
-    RenderStyle* decorationStyle = decorationRenderer->style();
-    ASSERT(decorationStyle);
-
-    const Font& font = decorationStyle->font();
-
-    // The initial y value refers to overline position.
-    float thickness = thicknessForDecoration(decoration, font);
-    float x = textOrigin.x();
-    float y = textOrigin.y() - font.ascent() + positionOffsetForDecoration(decoration, font, thickness);
-
-    context->save();
-    context->beginPath();
-    context->addPath(Path::createRectangle(FloatRect(x, y, m_currentChunkPart.width, thickness)));
-
-    if (acquirePaintingResource(context, decorationRenderer, decorationStyle))
-        releasePaintingResource(context);
-
-    context->restore();
-}
-
-void SVGInlineTextBox::paintSelection(GraphicsContext* context, const FloatPoint& textOrigin, RenderStyle* style)
-{
-    // See if we have a selection to paint at all.
-    int startPos, endPos;
-    selectionStartEnd(startPos, endPos);
-    if (startPos >= endPos)
-        return;
-
-    Color backgroundColor = renderer()->selectionBackgroundColor();
-    if (!backgroundColor.isValid() || !backgroundColor.alpha())
-        return;
-
-    const Font& font = style->font();
-
-    FloatPoint selectionOrigin = textOrigin;
-    selectionOrigin.move(0, -font.ascent());
-
-    context->save();
-    context->setFillColor(backgroundColor, style->colorSpace());
-    context->fillRect(font.selectionRectForText(constructTextRun(style), selectionOrigin, m_currentChunkPart.height, startPos, endPos), backgroundColor, style->colorSpace());
-    context->restore();
-}
-
-void SVGInlineTextBox::paintTextWithShadows(GraphicsContext* context, const FloatPoint& textOrigin, RenderStyle* style, TextRun& textRun, int startPos, int endPos)
-{
-    const Font& font = style->font();
-    const ShadowData* shadow = style->textShadow();
-
-    FloatRect shadowRect(FloatPoint(textOrigin.x(), textOrigin.y() - font.ascent()), FloatSize(m_currentChunkPart.width, m_currentChunkPart.height));
-    do {
-        if (!prepareGraphicsContextForTextPainting(context, textRun, style))
-            break;
-
-        FloatSize extraOffset;
-        if (shadow)
-            extraOffset = applyShadowToGraphicsContext(context, shadow, shadowRect, false /* stroked */, true /* opaque */);
-
-        font.drawText(context, textRun, textOrigin + extraOffset, startPos, endPos);
-        restoreGraphicsContextAfterTextPainting(context, textRun);
-
-        if (!shadow)
-            break;
-
-        if (shadow->next())
-            context->restore();
-        else
-            context->clearShadow();
-
-        shadow = shadow->next();
-    } while (shadow);
-}
-
-void SVGInlineTextBox::paintText(GraphicsContext* context, const FloatPoint& textOrigin, RenderStyle* style, RenderStyle* selectionStyle, bool hasSelection, bool paintSelectedTextOnly)
-{
-    ASSERT(style);
-    ASSERT(selectionStyle);
-    ASSERT(m_currentChunkPart.isValid());
-
-    int startPos = 0;
-    int endPos = 0;
-    selectionStartEnd(startPos, endPos);
-
-    // Fast path if there is no selection, just draw the whole chunk part using the regular style
-    TextRun textRun(constructTextRun(style));
-    if (!hasSelection || startPos >= endPos) {
-        paintTextWithShadows(context, textOrigin, style, textRun, 0, m_currentChunkPart.length);
-        return;
-    }
-
-    // Eventually draw text using regular style until the start position of the selection
-    if (startPos > 0 && !paintSelectedTextOnly)
-        paintTextWithShadows(context, textOrigin, style, textRun, 0, startPos);
-
-    // Draw text using selection style from the start to the end position of the selection
-    if (style != selectionStyle)
-        SVGResourcesCache::clientStyleChanged(parent()->renderer(), StyleDifferenceRepaint, selectionStyle);
-
-    TextRun selectionTextRun(constructTextRun(selectionStyle));
-    paintTextWithShadows(context, textOrigin, selectionStyle, textRun, startPos, endPos);
-
-    if (style != selectionStyle)
-        SVGResourcesCache::clientStyleChanged(parent()->renderer(), StyleDifferenceRepaint, style);
-
-    // Eventually draw text using regular style from the end position of the selection to the end of the current chunk part
-    if (endPos < m_currentChunkPart.length && !paintSelectedTextOnly)
-        paintTextWithShadows(context, textOrigin, style, textRun, endPos, m_currentChunkPart.length);
-}
-
-void SVGInlineTextBox::buildLayoutInformation(SVGCharacterLayoutInfo& info, SVGLastGlyphInfo& lastGlyph)
-{
-    RenderText* textRenderer = this->textRenderer();
-    ASSERT(textRenderer);
-
-    RenderStyle* style = textRenderer->style();
-    ASSERT(style);
-
-    RenderObject* parentRenderer = parent()->renderer();
-    ASSERT(parentRenderer);
-    ASSERT(parentRenderer->node());
-    ASSERT(parentRenderer->node()->isSVGElement());
-    SVGElement* lengthContext = static_cast<SVGElement*>(parentRenderer->node());
-
-    const Font& font = style->font();
-    const UChar* characters = textRenderer->characters();
-
-    TextDirection textDirection = direction();
-    unsigned startPosition = start();
-    unsigned endPosition = end();
-    unsigned length = len();
-
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-    bool isVerticalText = isVerticalWritingMode(svgStyle);
-
-    int charsConsumed = 0;
-    for (unsigned i = 0; i < length; i += charsConsumed) {
-        SVGChar svgChar;
-
-        if (info.inPathLayout())
-            svgChar.pathData = SVGCharOnPath::create();
-
-        float glyphWidth = 0.0f;
-        float glyphHeight = 0.0f;
-        String glyphName;
-        String unicodeString;
-        measureCharacter(style, i, charsConsumed, glyphName, unicodeString, glyphWidth, glyphHeight);
-
-        bool assignedX = false;
-        bool assignedY = false;
-
-        if (info.xValueAvailable() && (!info.inPathLayout() || (info.inPathLayout() && !isVerticalText))) {
-            if (!isVerticalText)
-                svgChar.newTextChunk = true;
-
-            assignedX = true;
-            svgChar.drawnSeperated = true;
-            info.curx = info.xValueNext();
-        }
-
-        if (info.yValueAvailable() && (!info.inPathLayout() || (info.inPathLayout() && isVerticalText))) {
-            if (isVerticalText)
-                svgChar.newTextChunk = true;
-
-            assignedY = true;
-            svgChar.drawnSeperated = true;
-            info.cury = info.yValueNext();
-        }
-
-        float dx = 0.0f;
-        float dy = 0.0f;
-
-        // Apply x-axis shift
-        if (info.dxValueAvailable()) {
-            svgChar.drawnSeperated = true;
-
-            dx = info.dxValueNext();
-            info.dx += dx;
-
-            if (!info.inPathLayout())
-                info.curx += dx;
-        }
-
-        // Apply y-axis shift
-        if (info.dyValueAvailable()) {
-            svgChar.drawnSeperated = true;
-
-            dy = info.dyValueNext();
-            info.dy += dy;
-
-            if (!info.inPathLayout())
-                info.cury += dy;
-        }
-
-        // Take letter & word spacing and kerning into account
-        float spacing = font.letterSpacing() + calculateCSSKerning(lengthContext, style);
-
-        const UChar* currentCharacter = characters + (textDirection == RTL ? endPosition - i : startPosition + i);
-        const UChar* lastCharacter = 0;
-
-        if (textDirection == RTL) {
-            if (i < endPosition)
-                lastCharacter = characters + endPosition - i +  1;
-        } else {
-            if (i > 0)
-                lastCharacter = characters + startPosition + i - 1;
-        }
-
-        // FIXME: SVG Kerning doesn't get applied on texts on path.
-        bool appliedSVGKerning = applySVGKerning(info, style, lastGlyph, unicodeString, glyphName, isVerticalText);
-        if (info.nextDrawnSeperated || spacing != 0.0f || appliedSVGKerning) {
-            info.nextDrawnSeperated = false;
-            svgChar.drawnSeperated = true;
-        }
-
-        if (currentCharacter && Font::treatAsSpace(*currentCharacter) && lastCharacter && !Font::treatAsSpace(*lastCharacter)) {
-            spacing += font.wordSpacing();
-
-            if (spacing != 0.0f && !info.inPathLayout())
-                info.nextDrawnSeperated = true;
-        }
-
-        float orientationAngle = glyphOrientationToAngle(svgStyle, isVerticalText, *currentCharacter);
-
-        float xOrientationShift = 0.0f;
-        float yOrientationShift = 0.0f;
-        float glyphAdvance = applyGlyphAdvanceAndShiftRespectingOrientation(isVerticalText, orientationAngle, glyphWidth, glyphHeight,
-                                                                            font, svgChar, xOrientationShift, yOrientationShift);
-
-        // Handle textPath layout mode
-        if (info.inPathLayout()) {
-            float extraAdvance = isVerticalText ? dy : dx;
-            float newOffset = FLT_MIN;
-
-            if (assignedX && !isVerticalText)
-                newOffset = info.curx;
-            else if (assignedY && isVerticalText)
-                newOffset = info.cury;
-
-            float correctedGlyphAdvance = glyphAdvance;
-
-            // Handle lengthAdjust="spacingAndGlyphs" by specifying per-character scale operations
-            if (info.pathTextLength && info.pathChunkLength) { 
-                if (isVerticalText) {
-                    svgChar.pathData->yScale = info.pathChunkLength / info.pathTextLength;
-                    spacing *= svgChar.pathData->yScale;
-                    correctedGlyphAdvance *= svgChar.pathData->yScale;
-                } else {
-                    svgChar.pathData->xScale = info.pathChunkLength / info.pathTextLength;
-                    spacing *= svgChar.pathData->xScale;
-                    correctedGlyphAdvance *= svgChar.pathData->xScale;
-                }
-            }
-
-            // Handle letter & word spacing on text path
-            float pathExtraAdvance = info.pathExtraAdvance;
-            info.pathExtraAdvance += spacing;
-
-            svgChar.pathData->hidden = !info.nextPathLayoutPointAndAngle(correctedGlyphAdvance, extraAdvance, newOffset);
-            svgChar.drawnSeperated = true;
-
-            info.pathExtraAdvance = pathExtraAdvance;
-        }
-
-        // Apply rotation
-        if (info.angleValueAvailable())
-            info.angle = info.angleValueNext();
-
-        // Apply baseline-shift
-        if (info.baselineShiftValueAvailable()) {
-            svgChar.drawnSeperated = true;
-            float shift = info.baselineShiftValueNext();
-
-            if (isVerticalText)
-                info.shiftx += shift;
-            else
-                info.shifty -= shift;
-        }
-
-        // Take dominant-baseline / alignment-baseline into account
-        yOrientationShift += alignmentBaselineToShift(isVerticalText, textRenderer, font);
-
-        svgChar.x = info.curx;
-        svgChar.y = info.cury;
-        svgChar.angle = info.angle;
-
-        // For text paths any shift (dx/dy/baseline-shift) has to be applied after the rotation
-        if (!info.inPathLayout()) {
-            svgChar.x += info.shiftx + xOrientationShift;
-            svgChar.y += info.shifty + yOrientationShift;
-
-            if (orientationAngle != 0.0f)
-                svgChar.angle += orientationAngle;
-
-            if (svgChar.angle != 0.0f)
-                svgChar.drawnSeperated = true;
-        } else {
-            svgChar.pathData->orientationAngle = orientationAngle;
-
-            if (isVerticalText)
-                svgChar.angle -= 90.0f;
-
-            svgChar.pathData->xShift = info.shiftx + xOrientationShift;
-            svgChar.pathData->yShift = info.shifty + yOrientationShift;
-
-            // Translate to glyph midpoint
-            if (isVerticalText) {
-                svgChar.pathData->xShift += info.dx;
-                svgChar.pathData->yShift -= glyphAdvance / 2.0f;
-            } else {
-                svgChar.pathData->xShift -= glyphAdvance / 2.0f;
-                svgChar.pathData->yShift += info.dy;
-            }
-        }
-
-        // Advance to new position
-        if (isVerticalText) {
-            svgChar.drawnSeperated = true;
-            info.cury += glyphAdvance + spacing;
-        } else
-            info.curx += glyphAdvance + spacing;
-
-        // Advance to next character group
-        for (int k = 0; k < charsConsumed; ++k) {
-            info.svgChars.append(svgChar);
-            info.processedSingleCharacter();
-            svgChar.drawnSeperated = false;
-            svgChar.newTextChunk = false;
-        }
-    }
-}
-
-FloatRect SVGInlineTextBox::calculateGlyphBoundaries(RenderStyle* style, int position, const SVGChar& character) const
-{
-    int charsConsumed = 0;
-    String glyphName;
-    String unicodeString;
-    float glyphWidth = 0.0f;
-    float glyphHeight = 0.0f;
-    measureCharacter(style, position, charsConsumed, glyphName, unicodeString, glyphWidth, glyphHeight);
-
-    FloatRect glyphRect(character.x, character.y - style->font().ascent(), glyphWidth, glyphHeight);
-    glyphRect = character.characterTransform().mapRect(glyphRect);
-    if (m_chunkTransformation.isIdentity())
-        return glyphRect;
-
-    return m_chunkTransformation.mapRect(glyphRect);
-}
-
-IntRect SVGInlineTextBox::calculateBoundaries() const
-{
-    FloatRect textRect;
-    int baseline = baselinePosition(true);
-
-    const Vector<SVGTextChunkPart>::const_iterator end = m_svgTextChunkParts.end();
-    for (Vector<SVGTextChunkPart>::const_iterator it = m_svgTextChunkParts.begin(); it != end; ++it)
-        textRect.unite(it->firstCharacter->characterTransform().mapRect(FloatRect(it->firstCharacter->x, it->firstCharacter->y - baseline, it->width, it->height)));
-
-    if (m_chunkTransformation.isIdentity())
-        return enclosingIntRect(textRect);
-
-    return enclosingIntRect(m_chunkTransformation.mapRect(textRect));
-}
-
-} // namespace WebCore
-
-#endif
diff --git a/WebCore/rendering/SVGRenderSupport.cpp b/WebCore/rendering/SVGRenderSupport.cpp
index 644ff70..608cf4d 100644
--- a/WebCore/rendering/SVGRenderSupport.cpp
+++ b/WebCore/rendering/SVGRenderSupport.cpp
@@ -32,7 +32,7 @@
 #include "ImageBuffer.h"
 #include "NodeRenderStyle.h"
 #include "RenderLayer.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceFilter.h"
@@ -220,9 +220,9 @@ void SVGRenderSupport::layoutChildren(RenderObject* start, bool selfNeedsLayout)
             // When selfNeedsLayout is false and the layout size changed, we have to check whether this child uses relative lengths
             if (SVGElement* element = child->node()->isSVGElement() ? static_cast<SVGElement*>(child->node()) : 0) {
                 if (element->isStyled() && static_cast<SVGStyledElement*>(element)->hasRelativeLengths()) {
-                    // When the layout size changed and when using relative values tell the RenderPath to update its Path object
-                    if (child->isRenderPath())
-                        toRenderPath(child)->setNeedsPathUpdate();
+                    // When the layout size changed and when using relative values tell the RenderSVGPath to update its Path object
+                    if (child->isSVGPath())
+                        toRenderSVGPath(child)->setNeedsPathUpdate();
 
                     needsLayout = true;
                 }
@@ -347,16 +347,6 @@ void SVGRenderSupport::applyStrokeStyleToContext(GraphicsContext* context, const
     }
 }
 
-const RenderObject* SVGRenderSupport::findTextRootObject(const RenderObject* start)
-{
-    while (start && !start->isSVGText())
-        start = start->parent();
-    ASSERT(start);
-    ASSERT(start->isSVGText());
-
-    return start;
-}
-
 }
 
 #endif
diff --git a/WebCore/rendering/SVGRenderSupport.h b/WebCore/rendering/SVGRenderSupport.h
index 54622d2..7814863 100644
--- a/WebCore/rendering/SVGRenderSupport.h
+++ b/WebCore/rendering/SVGRenderSupport.h
@@ -70,7 +70,6 @@ public:
     static void applyStrokeStyleToContext(GraphicsContext*, const RenderStyle*, const RenderObject*);
 
     // FIXME: These methods do not belong here.
-    static const RenderObject* findTextRootObject(const RenderObject* start);
     static const RenderSVGRoot* findTreeRootObject(const RenderObject* start);
 
 private:
diff --git a/WebCore/rendering/SVGRenderTreeAsText.cpp b/WebCore/rendering/SVGRenderTreeAsText.cpp
index 4e26f52..b7f7f95 100644
--- a/WebCore/rendering/SVGRenderTreeAsText.cpp
+++ b/WebCore/rendering/SVGRenderTreeAsText.cpp
@@ -40,11 +40,11 @@
 #include "PatternAttributes.h"
 #include "RadialGradientAttributes.h"
 #include "RenderImage.h"
-#include "RenderPath.h"
 #include "RenderSVGContainer.h"
 #include "RenderSVGGradientStop.h"
 #include "RenderSVGImage.h"
 #include "RenderSVGInlineText.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResourceClipper.h"
 #include "RenderSVGResourceFilter.h"
 #include "RenderSVGResourceGradient.h"
@@ -57,15 +57,21 @@
 #include "RenderSVGRoot.h"
 #include "RenderSVGText.h"
 #include "RenderTreeAsText.h"
-#include "SVGCharacterLayoutInfo.h"
+#include "SVGCircleElement.h"
+#include "SVGEllipseElement.h"
 #include "SVGInlineTextBox.h"
+#include "SVGLineElement.h"
 #include "SVGLinearGradientElement.h"
+#include "SVGPathElement.h"
+#include "SVGPathParserFactory.h"
 #include "SVGPatternElement.h"
+#include "SVGPointList.h"
+#include "SVGPolyElement.h"
 #include "SVGRadialGradientElement.h"
+#include "SVGRectElement.h"
 #include "SVGRootInlineBox.h"
 #include "SVGStopElement.h"
 #include "SVGStyledElement.h"
-#include "SVGTextLayoutUtilities.h"
 
 #include <math.h>
 
@@ -316,12 +322,13 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
         writeNameValuePair(ts, "transform", object.localTransform());
     writeIfNotDefault(ts, "image rendering", svgStyle->imageRendering(), SVGRenderStyle::initialImageRendering());
     writeIfNotDefault(ts, "opacity", style->opacity(), RenderStyle::initialOpacity());
-    if (object.isRenderPath()) {
-        const RenderPath& path = static_cast<const RenderPath&>(object);
+    if (object.isSVGPath()) {
+        const RenderSVGPath& path = static_cast<const RenderSVGPath&>(object);
         ASSERT(path.node());
         ASSERT(path.node()->isSVGElement());
 
-        if (RenderSVGResource* strokePaintingResource = RenderSVGResource::strokePaintingResource(const_cast<RenderPath*>(&path), path.style())) {
+        Color fallbackColor;
+        if (RenderSVGResource* strokePaintingResource = RenderSVGResource::strokePaintingResource(const_cast<RenderSVGPath*>(&path), path.style(), fallbackColor)) {
             TextStreamSeparator s(" ");
             ts << " [stroke={" << s;
             writeSVGPaintingResource(ts, strokePaintingResource);
@@ -348,7 +355,7 @@ static void writeStyle(TextStream& ts, const RenderObject& object)
             ts << "}]";
         }
 
-        if (RenderSVGResource* fillPaintingResource = RenderSVGResource::fillPaintingResource(const_cast<RenderPath*>(&path), path.style())) {
+        if (RenderSVGResource* fillPaintingResource = RenderSVGResource::fillPaintingResource(const_cast<RenderSVGPath*>(&path), path.style(), fallbackColor)) {
             TextStreamSeparator s(" ");
             ts << " [fill={" << s;
             writeSVGPaintingResource(ts, fillPaintingResource);
@@ -372,10 +379,46 @@ static TextStream& writePositionAndStyle(TextStream& ts, const RenderObject& obj
     return ts;
 }
 
-static TextStream& operator<<(TextStream& ts, const RenderPath& path)
+static TextStream& operator<<(TextStream& ts, const RenderSVGPath& path)
 {
     writePositionAndStyle(ts, path);
-    writeNameAndQuotedValue(ts, "data", path.path().debugString());
+
+    ASSERT(path.node()->isSVGElement());
+    SVGElement* svgElement = static_cast<SVGElement*>(path.node());
+
+    if (svgElement->hasTagName(SVGNames::rectTag)) {
+        SVGRectElement* element = static_cast<SVGRectElement*>(svgElement);
+        writeNameValuePair(ts, "x", element->x().value(element));
+        writeNameValuePair(ts, "y", element->y().value(element));
+        writeNameValuePair(ts, "width", element->width().value(element));
+        writeNameValuePair(ts, "height", element->height().value(element));
+    } else if (svgElement->hasTagName(SVGNames::lineTag)) {
+        SVGLineElement* element = static_cast<SVGLineElement*>(svgElement);
+        writeNameValuePair(ts, "x1", element->x1().value(element));
+        writeNameValuePair(ts, "y1", element->y1().value(element));
+        writeNameValuePair(ts, "x2", element->x2().value(element));
+        writeNameValuePair(ts, "y2", element->y2().value(element));
+    } else if (svgElement->hasTagName(SVGNames::ellipseTag)) {
+        SVGEllipseElement* element = static_cast<SVGEllipseElement*>(svgElement);
+        writeNameValuePair(ts, "cx", element->cx().value(element));
+        writeNameValuePair(ts, "cy", element->cy().value(element));
+        writeNameValuePair(ts, "rx", element->rx().value(element));
+        writeNameValuePair(ts, "ry", element->ry().value(element));
+    } else if (svgElement->hasTagName(SVGNames::circleTag)) {
+        SVGCircleElement* element = static_cast<SVGCircleElement*>(svgElement);
+        writeNameValuePair(ts, "cx", element->cx().value(element));
+        writeNameValuePair(ts, "cy", element->cy().value(element));
+        writeNameValuePair(ts, "r", element->r().value(element));
+    } else if (svgElement->hasTagName(SVGNames::polygonTag) || svgElement->hasTagName(SVGNames::polylineTag)) {
+        SVGPolyElement* element = static_cast<SVGPolyElement*>(svgElement);
+        writeNameAndQuotedValue(ts, "points", element->points()->valueAsString());
+    } else if (svgElement->hasTagName(SVGNames::pathTag)) {
+        SVGPathElement* element = static_cast<SVGPathElement*>(svgElement);
+        String pathString;
+        SVGPathParserFactory::self()->buildStringFromSVGPathSegList(element->pathSegList(), pathString, UnalteredParsing);
+        writeNameAndQuotedValue(ts, "data", pathString);
+    } else
+        ASSERT_NOT_REACHED();
     return ts;
 }
 
@@ -387,116 +430,72 @@ static TextStream& operator<<(TextStream& ts, const RenderSVGRoot& root)
 static void writeRenderSVGTextBox(TextStream& ts, const RenderBlock& text)
 {
     SVGRootInlineBox* box = static_cast<SVGRootInlineBox*>(text.firstRootBox());
-
     if (!box)
         return;
 
-    Vector<SVGTextChunk>& chunks = const_cast<Vector<SVGTextChunk>& >(box->svgTextChunks());
-    ts << " at (" << text.x() << "," << text.y() << ") size " << box->logicalWidth() << "x" << box->logicalHeight() << " contains " << chunks.size() << " chunk(s)";
+    ts << " at (" << text.x() << "," << text.y() << ") size " << box->logicalWidth() << "x" << box->logicalHeight();
+    
+    // FIXME: Remove this hack, once the new text layout engine is completly landed. We want to preserve the old layout test results for now.
+    ts << " contains 1 chunk(s)";
 
     if (text.parent() && (text.parent()->style()->visitedDependentColor(CSSPropertyColor) != text.style()->visitedDependentColor(CSSPropertyColor)))
         writeNameValuePair(ts, "color", text.style()->visitedDependentColor(CSSPropertyColor).name());
 }
 
-static inline bool containsInlineTextBox(SVGTextChunk& chunk, SVGInlineTextBox* box)
-{
-    Vector<SVGInlineBoxCharacterRange>::iterator boxIt = chunk.boxes.begin();
-    Vector<SVGInlineBoxCharacterRange>::iterator boxEnd = chunk.boxes.end();
-
-    bool found = false;
-    for (; boxIt != boxEnd; ++boxIt) {
-        SVGInlineBoxCharacterRange& range = *boxIt;
-
-        if (box == static_cast<SVGInlineTextBox*>(range.box)) {
-            found = true;
-            break;
-        }
-    }
-
-    return found;
-}
-
 static inline void writeSVGInlineTextBox(TextStream& ts, SVGInlineTextBox* textBox, int indent)
 {
-    SVGRootInlineBox* rootBox = textBox->svgRootInlineBox();
-    if (!rootBox)
+    Vector<SVGTextFragment>& fragments = textBox->textFragments();
+    if (fragments.isEmpty())
         return;
 
-    Vector<SVGTextChunk>& chunks = const_cast<Vector<SVGTextChunk>& >(rootBox->svgTextChunks());
-
-    Vector<SVGTextChunk>::iterator it = chunks.begin();
-    Vector<SVGTextChunk>::iterator end = chunks.end();
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(textBox->textRenderer());
+    ASSERT(textRenderer);
 
-    // Write text chunks
-    unsigned int i = 1;
-    for (; it != end; ++it) {
-        SVGTextChunk& cur = *it;
-
-        // Write inline box character ranges
-        Vector<SVGInlineBoxCharacterRange>::iterator boxIt = cur.boxes.begin();
-        Vector<SVGInlineBoxCharacterRange>::iterator boxEnd = cur.boxes.end();
-
-        if (!containsInlineTextBox(cur, textBox)) {
-            i++;
-            continue;
-        }
+    const SVGRenderStyle* svgStyle = textRenderer->style()->svgStyle();
+    String text = textBox->textRenderer()->text();
 
+    unsigned fragmentsSize = fragments.size();
+    for (unsigned i = 0; i < fragmentsSize; ++i) {
+        SVGTextFragment& fragment = fragments.at(i);
         writeIndent(ts, indent + 1);
 
-        unsigned int j = 1;
-        ts << "chunk " << i << " ";
+        unsigned startOffset = fragment.positionListOffset;
+        unsigned endOffset = fragment.positionListOffset + fragment.length;
 
-        if (cur.anchor == TA_MIDDLE) {
+        // FIXME: Remove this hack, once the new text layout engine is completly landed. We want to preserve the old layout test results for now.
+        ts << "chunk 1 ";
+        ETextAnchor anchor = svgStyle->textAnchor();
+        bool isVerticalText = svgStyle->isVerticalWritingMode();
+        if (anchor == TA_MIDDLE) {
             ts << "(middle anchor";
-            if (cur.isVerticalText)
+            if (isVerticalText)
                 ts << ", vertical";
             ts << ") ";
-        } else if (cur.anchor == TA_END) {
+        } else if (anchor == TA_END) {
             ts << "(end anchor";
-            if (cur.isVerticalText)
+            if (isVerticalText)
                 ts << ", vertical";
             ts << ") ";
-        } else if (cur.isVerticalText)
+        } else if (isVerticalText)
             ts << "(vertical) ";
+        startOffset -= textBox->start();
+        endOffset -= textBox->start();
+        // </hack>
+
+        ts << "text run " << i + 1 << " at (" << fragment.x << "," << fragment.y << ")";
+        ts << " startOffset " << startOffset << " endOffset " << endOffset;
+        if (isVerticalText)
+            ts << " height " << fragment.height;
+        else
+            ts << " width " << fragment.width;
 
-        unsigned int totalOffset = 0;
-
-        for (; boxIt != boxEnd; ++boxIt) {
-            SVGInlineBoxCharacterRange& range = *boxIt;
-
-            unsigned int offset = range.endOffset - range.startOffset;
-            ASSERT(cur.start + totalOffset <= cur.end);
-    
-            totalOffset += offset;
-      
-            if (textBox != static_cast<SVGInlineTextBox*>(range.box)) {
-                j++;
-                continue;
-            }
-  
-            FloatPoint topLeft = topLeftPositionOfCharacterRange(cur.start + totalOffset - offset, cur.start + totalOffset);
-
-            ts << "text run " << j << " at (" << topLeft.x() << "," << topLeft.y() << ") ";
-            ts << "startOffset " << range.startOffset << " endOffset " << range.endOffset;
-
-            if (cur.isVerticalText)
-                ts << " height " << cummulatedHeightOfInlineBoxCharacterRange(range);
-            else
-                ts << " width " << cummulatedWidthOfInlineBoxCharacterRange(range);
-
-            if (textBox->direction() == RTL || textBox->m_dirOverride) {
-                ts << (textBox->direction() == RTL ? " RTL" : " LTR");
-
-                if (textBox->m_dirOverride)
-                    ts << " override";
-            }
-
-            ts << ": " << quoteAndEscapeNonPrintables(String(textBox->textRenderer()->text()).substring(textBox->start() + range.startOffset, offset)) << "\n";
-
-            j++;
+        if (!textBox->isLeftToRightDirection() || textBox->m_dirOverride) {
+            ts << (textBox->isLeftToRightDirection() ? " LTR" : " RTL");
+            if (textBox->m_dirOverride)
+                ts << " override";
         }
 
-        i++;
+        ts << ": " << quoteAndEscapeNonPrintables(text.substring(fragment.positionListOffset, fragment.length)) << "\n";
     }
 }
 
@@ -582,7 +581,9 @@ void writeSVGResourceContainer(TextStream& ts, const RenderObject& object, int i
 
         // Dump final results that are used for rendering. No use in asking SVGPatternElement for its patternUnits(), as it may
         // link to other patterns using xlink:href, we need to build the full inheritance chain, aka. collectPatternProperties()
-        PatternAttributes attributes = static_cast<SVGPatternElement*>(pattern->node())->collectPatternProperties();
+        PatternAttributes attributes;
+        static_cast<SVGPatternElement*>(pattern->node())->collectPatternAttributes(attributes);
+
         writeNameValuePair(ts, "patternUnits", boundingBoxModeString(attributes.boundingBoxMode()));
         writeNameValuePair(ts, "patternContentUnits", boundingBoxModeString(attributes.boundingBoxModeContent()));
 
@@ -597,7 +598,8 @@ void writeSVGResourceContainer(TextStream& ts, const RenderObject& object, int i
         // link to other gradients using xlink:href, we need to build the full inheritance chain, aka. collectGradientProperties()
         SVGLinearGradientElement* linearGradientElement = static_cast<SVGLinearGradientElement*>(gradient->node());
 
-        LinearGradientAttributes attributes = linearGradientElement->collectGradientProperties();
+        LinearGradientAttributes attributes;
+        linearGradientElement->collectGradientAttributes(attributes);
         writeCommonGradientProperties(ts, attributes.spreadMethod(), attributes.gradientTransform(), attributes.boundingBoxMode());
 
         FloatPoint startPoint;
@@ -612,7 +614,8 @@ void writeSVGResourceContainer(TextStream& ts, const RenderObject& object, int i
         // link to other gradients using xlink:href, we need to build the full inheritance chain, aka. collectGradientProperties()
         SVGRadialGradientElement* radialGradientElement = static_cast<SVGRadialGradientElement*>(gradient->node());
 
-        RadialGradientAttributes attributes = radialGradientElement->collectGradientProperties();
+        RadialGradientAttributes attributes;
+        radialGradientElement->collectGradientAttributes(attributes);
         writeCommonGradientProperties(ts, attributes.spreadMethod(), attributes.gradientTransform(), attributes.boundingBoxMode());
 
         FloatPoint focalPoint;
@@ -672,7 +675,7 @@ void writeSVGImage(TextStream& ts, const RenderSVGImage& image, int indent)
     writeResources(ts, image, indent);
 }
 
-void write(TextStream& ts, const RenderPath& path, int indent)
+void write(TextStream& ts, const RenderSVGPath& path, int indent)
 {
     writeStandardPrefix(ts, path, indent);
     ts << path << "\n";
diff --git a/WebCore/rendering/SVGRenderTreeAsText.h b/WebCore/rendering/SVGRenderTreeAsText.h
index e279cfe..4e9ba5d 100644
--- a/WebCore/rendering/SVGRenderTreeAsText.h
+++ b/WebCore/rendering/SVGRenderTreeAsText.h
@@ -39,16 +39,16 @@ namespace WebCore {
     class RenderBlock;
     class RenderImage;
     class RenderObject;
-    class RenderPath;
     class RenderSVGGradientStop;
     class RenderSVGImage;
+    class RenderSVGPath;
     class RenderSVGRoot;
     class RenderText;
     class AffineTransform;
     class SVGUnitTypes;
 
 // functions used by the main RenderTreeAsText code
-void write(TextStream&, const RenderPath&, int indent);
+void write(TextStream&, const RenderSVGPath&, int indent);
 void write(TextStream&, const RenderSVGRoot&, int indent);
 void writeSVGGradientStop(TextStream&, const RenderSVGGradientStop&, int indent);
 void writeSVGResourceContainer(TextStream&, const RenderObject&, int indent);
diff --git a/WebCore/rendering/SVGResources.cpp b/WebCore/rendering/SVGResources.cpp
index 799301b..f796f3b 100644
--- a/WebCore/rendering/SVGResources.cpp
+++ b/WebCore/rendering/SVGResources.cpp
@@ -160,11 +160,17 @@ static inline RenderSVGResourceContainer* paintingResourceFromSVGPaint(Document*
         return 0;
 
     id = SVGURIReference::getTarget(paint->uri());
-    if (RenderSVGResourceContainer* container = getRenderSVGResourceContainerById(document, id))
-        return container;
+    RenderSVGResourceContainer* container = getRenderSVGResourceContainerById(document, id);
+    if (!container) {
+        hasPendingResource = true;
+        return 0;
+    }
+
+    RenderSVGResourceType resourceType = container->resourceType();
+    if (resourceType != PatternResourceType && resourceType != LinearGradientResourceType && resourceType != RadialGradientResourceType)
+        return 0;
 
-    hasPendingResource = true;
-    return 0;
+    return container;
 }
 
 static inline void registerPendingResource(SVGDocumentExtensions* extensions, const AtomicString& id, SVGElement* element)
@@ -445,6 +451,8 @@ bool SVGResources::setClipper(RenderSVGResourceClipper* clipper)
     if (!clipper)
         return false;
 
+    ASSERT(clipper->resourceType() == ClipperResourceType);
+
     if (!m_clipperFilterMaskerData)
         m_clipperFilterMaskerData = ClipperFilterMaskerData::create();
 
@@ -465,6 +473,8 @@ bool SVGResources::setFilter(RenderSVGResourceFilter* filter)
     if (!filter)
         return false;
 
+    ASSERT(filter->resourceType() == FilterResourceType);
+
     if (!m_clipperFilterMaskerData)
         m_clipperFilterMaskerData = ClipperFilterMaskerData::create();
 
@@ -485,6 +495,8 @@ bool SVGResources::setMarkerStart(RenderSVGResourceMarker* markerStart)
     if (!markerStart)
         return false;
 
+    ASSERT(markerStart->resourceType() == MarkerResourceType);
+
     if (!m_markerData)
         m_markerData = MarkerData::create();
 
@@ -504,6 +516,8 @@ bool SVGResources::setMarkerMid(RenderSVGResourceMarker* markerMid)
     if (!markerMid)
         return false;
 
+    ASSERT(markerMid->resourceType() == MarkerResourceType);
+
     if (!m_markerData)
         m_markerData = MarkerData::create();
 
@@ -523,6 +537,8 @@ bool SVGResources::setMarkerEnd(RenderSVGResourceMarker* markerEnd)
     if (!markerEnd)
         return false;
 
+    ASSERT(markerEnd->resourceType() == MarkerResourceType);
+
     if (!m_markerData)
         m_markerData = MarkerData::create();
 
@@ -542,6 +558,8 @@ bool SVGResources::setMasker(RenderSVGResourceMasker* masker)
     if (!masker)
         return false;
 
+    ASSERT(masker->resourceType() == MaskerResourceType);
+
     if (!m_clipperFilterMaskerData)
         m_clipperFilterMaskerData = ClipperFilterMaskerData::create();
 
@@ -561,6 +579,10 @@ bool SVGResources::setFill(RenderSVGResourceContainer* fill)
     if (!fill)
         return false;
 
+    ASSERT(fill->resourceType() == PatternResourceType
+           || fill->resourceType() == LinearGradientResourceType
+           || fill->resourceType() == RadialGradientResourceType);
+
     if (!m_fillStrokeData)
         m_fillStrokeData = FillStrokeData::create();
 
@@ -580,6 +602,10 @@ bool SVGResources::setStroke(RenderSVGResourceContainer* stroke)
     if (!stroke)
         return false;
 
+    ASSERT(stroke->resourceType() == PatternResourceType
+           || stroke->resourceType() == LinearGradientResourceType
+           || stroke->resourceType() == RadialGradientResourceType);
+
     if (!m_fillStrokeData)
         m_fillStrokeData = FillStrokeData::create();
 
diff --git a/WebCore/rendering/SVGRootInlineBox.cpp b/WebCore/rendering/SVGRootInlineBox.cpp
deleted file mode 100644
index 715003f..0000000
--- a/WebCore/rendering/SVGRootInlineBox.cpp
+++ /dev/null
@@ -1,364 +0,0 @@
-/*
- * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
- *           (C) 2006 Apple Computer Inc.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "SVGRootInlineBox.h"
-
-#if ENABLE(SVG)
-#include "GraphicsContext.h"
-#include "RenderBlock.h"
-#include "SVGInlineFlowBox.h"
-#include "SVGInlineTextBox.h"
-#include "SVGRenderSupport.h"
-#include "SVGTextLayoutUtilities.h"
-#include "SVGTextPositioningElement.h"
-
-// Text chunk part propagation can be traced by setting this variable > 0.
-#define DEBUG_CHUNK_PART_PROPAGATION 0
-
-namespace WebCore {
-
-void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
-{
-    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
-    ASSERT(!paintInfo.context->paintingDisabled());
-
-    RenderObject* boxRenderer = renderer();
-    ASSERT(boxRenderer);
-
-    PaintInfo childPaintInfo(paintInfo);
-    childPaintInfo.context->save();
-
-    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
-        for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
-            child->paint(childPaintInfo, 0, 0);
-    }
-
-    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
-    childPaintInfo.context->restore();
-}
-
-void SVGRootInlineBox::computePerCharacterLayoutInformation()
-{
-    // Clean up any previous layout information
-    m_svgChars.clear();
-    m_svgTextChunks.clear();
-
-    // Build layout information for all contained render objects
-    SVGCharacterLayoutInfo charInfo;
-    buildLayoutInformation(this, charInfo);
-    m_svgChars = charInfo.svgChars;
-
-    // Now all layout information are available for every character
-    // contained in any of our child inline/flow boxes. Build list
-    // of text chunks now, to be able to apply text-anchor shifts.
-    SVGTextChunkLayoutInfo chunkInfo;
-    chunkInfo.buildTextChunks(m_svgChars.begin(), m_svgChars.end(), this);
-
-    // Layout all text chunks
-    // text-anchor needs to be applied to individual chunks.
-    chunkInfo.layoutTextChunks();
-    m_svgTextChunks = chunkInfo.textChunks();
-
-    // Propagate text chunk part information to all SVGInlineTextBoxes, see SVGTextChunkLayoutInfo.h for details
-    propagateTextChunkPartInformation();
-
-    // Layout all child boxes.
-    layoutChildBoxes(this);
-
-    // Resize our root box and our RenderSVGText parent block
-    layoutRootBox();
-}
-
-void SVGRootInlineBox::buildLayoutInformation(InlineFlowBox* start, SVGCharacterLayoutInfo& info)
-{
-    if (start->isRootInlineBox()) {
-        ASSERT(start->renderer()->node()->hasTagName(SVGNames::textTag));
-
-        SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(start->renderer()->node());
-        ASSERT(positioningElement);
-        ASSERT(positioningElement->parentNode());
-
-        info.addLayoutInformation(positioningElement);
-    }
-
-    SVGLastGlyphInfo lastGlyph;
-    
-    for (InlineBox* curr = start->firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isText())
-            static_cast<SVGInlineTextBox*>(curr)->buildLayoutInformation(info, lastGlyph);
-        else {
-            ASSERT(curr->isInlineFlowBox());
-            InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(curr);
-
-            // Skip generated content.
-            if (!flowBox->renderer()->node())
-                continue;
-
-            bool isAnchor = flowBox->renderer()->node()->hasTagName(SVGNames::aTag);
-            bool isTextPath = flowBox->renderer()->node()->hasTagName(SVGNames::textPathTag);
-
-            if (!isTextPath && !isAnchor) {
-                SVGTextPositioningElement* positioningElement = static_cast<SVGTextPositioningElement*>(flowBox->renderer()->node());
-                ASSERT(positioningElement);
-                ASSERT(positioningElement->parentNode());
-
-                info.addLayoutInformation(positioningElement);
-            } else if (!isAnchor) {
-                info.setInPathLayout(true);
-
-                // Handle text-anchor/textLength on path, which is special.
-                SVGTextContentElement* textContent = 0;
-                Node* node = flowBox->renderer()->node();
-                if (node && node->isSVGElement())
-                    textContent = static_cast<SVGTextContentElement*>(node);
-                ASSERT(textContent);
-
-                ELengthAdjust lengthAdjust = (ELengthAdjust) textContent->lengthAdjust();
-                ETextAnchor anchor = flowBox->renderer()->style()->svgStyle()->textAnchor();
-                float textAnchorStartOffset = 0.0f;
-
-                // Initialize sub-layout. We need to create text chunks from the textPath
-                // children using our standard layout code, to be able to measure the
-                // text length using our normal methods and not textPath specific hacks.
-                Vector<SVGTextChunk> tempChunks;
-
-                SVGCharacterLayoutInfo tempCharInfo;
-                buildLayoutInformation(flowBox, tempCharInfo);
-
-                SVGTextChunkLayoutInfo tempChunkInfo;
-                tempChunkInfo.buildTextChunks(tempCharInfo.svgChars.begin(), tempCharInfo.svgChars.end(), flowBox);
-                tempChunks = tempChunkInfo.textChunks();
-
-                Vector<SVGTextChunk>::iterator it = tempChunks.begin();
-                Vector<SVGTextChunk>::iterator end = tempChunks.end();
-
-                float computedLength = 0.0f;
- 
-                for (; it != end; ++it) {
-                    SVGTextChunk& chunk = *it;
-
-                    // Apply text-length calculation
-                    info.pathExtraAdvance += calculateTextLengthCorrectionForTextChunk(chunk, lengthAdjust, computedLength);
-
-                    if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS) {
-                        info.pathTextLength += computedLength;
-                        info.pathChunkLength += chunk.textLength;
-                    }
-
-                    // Calculate text-anchor start offset
-                    if (anchor == TA_START)
-                        continue;
-
-                    textAnchorStartOffset += calculateTextAnchorShiftForTextChunk(chunk, anchor);
-                }
-
-                info.addLayoutInformation(flowBox, textAnchorStartOffset);
-            }
-
-            float shiftxSaved = info.shiftx;
-            float shiftySaved = info.shifty;
-
-            buildLayoutInformation(flowBox, info);
-            info.processedChunk(shiftxSaved, shiftySaved);
-
-            if (isTextPath)
-                info.setInPathLayout(false);
-        }
-    }
-}
-
-void SVGRootInlineBox::layoutChildBoxes(InlineFlowBox* start)
-{
-    for (InlineBox* child = start->firstChild(); child; child = child->nextOnLine()) {
-        if (child->renderer()->isText()) {
-            SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(child);
-            IntRect boxRect = textBox->calculateBoundaries();
-            textBox->setX(boxRect.x());
-            textBox->setY(boxRect.y());
-            textBox->setLogicalWidth(boxRect.width());
-            textBox->setLogicalHeight(boxRect.height());
-        } else {
-            ASSERT(child->isInlineFlowBox());
-   
-            // Skip generated content.
-            if (!child->renderer()->node())
-                continue;
-
-            SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
-            layoutChildBoxes(flowBox);
-
-            IntRect boxRect = flowBox->calculateBoundaries();
-            flowBox->setX(boxRect.x());
-            flowBox->setY(boxRect.y());
-            flowBox->setLogicalWidth(boxRect.width());
-            flowBox->setLogicalHeight(boxRect.height());
-        }
-    }
-}
-
-void SVGRootInlineBox::layoutRootBox()
-{
-    RenderBlock* parentBlock = block();
-    ASSERT(parentBlock);
-
-    IntRect childRect;
-    for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
-        // Skip generated content.
-        if (!child->renderer()->node())
-            continue;
-        childRect.unite(child->calculateBoundaries());
-    }
-
-    int xBlock = childRect.x();
-    int yBlock = childRect.y();
-    int widthBlock = childRect.width();
-    int heightBlock = childRect.height();
-
-    // Finally, assign the root block position, now that all content is laid out.
-    parentBlock->setLocation(xBlock, yBlock);
-    parentBlock->setWidth(widthBlock);
-    parentBlock->setHeight(heightBlock);
-
-    // Position all children relative to the parent block.
-    for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
-        // Skip generated content.
-        if (!child->renderer()->node())
-            continue;
-        child->adjustPosition(-xBlock, -yBlock);
-    }
-
-    // Position ourselves.
-    setX(0);
-    setY(0);
-    setLogicalWidth(widthBlock);
-    setLogicalHeight(heightBlock);
-    setBlockHeight(heightBlock);
-    setLineTopBottomPositions(0, heightBlock);
-}
-
-void SVGRootInlineBox::propagateTextChunkPartInformation()
-{
-#if DEBUG_CHUNK_PART_PROPAGATION > 0
-    ListHashSet<SVGInlineTextBox*> boxes;
-#endif
-
-    // Loop through all text chunks
-    const Vector<SVGTextChunk>::const_iterator end = m_svgTextChunks.end();
-    for (Vector<SVGTextChunk>::const_iterator it = m_svgTextChunks.begin(); it != end; ++it) {
-        const SVGTextChunk& chunk = *it;
-        int processedChunkCharacters = 0;
-
-        // Loop through all ranges contained in this chunk
-        const Vector<SVGInlineBoxCharacterRange>::const_iterator boxEnd = chunk.boxes.end();
-        for (Vector<SVGInlineBoxCharacterRange>::const_iterator boxIt = chunk.boxes.begin(); boxIt != boxEnd; ++boxIt) {
-            const SVGInlineBoxCharacterRange& range = *boxIt;
-            ASSERT(range.box->isSVGInlineTextBox());
-
-            // Access style & font information of this text box
-            SVGInlineTextBox* rangeTextBox = static_cast<SVGInlineTextBox*>(range.box);
-            rangeTextBox->setChunkTransformation(chunk.ctm);
-
-            RenderText* text = rangeTextBox->textRenderer();
-            ASSERT(text);
-
-            RenderStyle* style = text->style();
-            ASSERT(style);
-
-            const Font& font = style->font();
- 
-            // Figure out first and last character of this range in this chunk
-            int rangeLength = range.endOffset - range.startOffset;
-            Vector<SVGChar>::iterator itCharBegin = chunk.start + processedChunkCharacters;
-            Vector<SVGChar>::iterator itCharEnd = chunk.start + processedChunkCharacters + rangeLength;
-            ASSERT(itCharEnd <= chunk.end);
-
-            // Loop through all characters in range 
-            int processedRangeCharacters = 0;
-            for (Vector<SVGChar>::iterator itChar = itCharBegin; itChar != itCharEnd; ++itChar) {
-                if (itChar->isHidden()) {
-                    ++processedRangeCharacters;
-                    continue;
-                }
-
-                // Determine how many characters - starting from the current - can be drawn at once.
-                Vector<SVGChar>::iterator itSearch = itChar + 1;
-                while (itSearch != itCharEnd) {
-                    if (itSearch->drawnSeperated || itSearch->isHidden())
-                        break;
-
-                    ++itSearch;
-                }
-
-                // Calculate text chunk part information for this chunk sub-range
-                const UChar* partStart = text->characters() + rangeTextBox->start() + range.startOffset + processedRangeCharacters;
-
-                SVGTextChunkPart part;
-                part.firstCharacter = itChar;
-                part.length = itSearch - itChar;
-                part.width = font.floatWidth(svgTextRunForInlineTextBox(partStart, part.length, style, rangeTextBox));
-                part.height = font.height();
-                part.offset = range.startOffset + processedRangeCharacters;
-                rangeTextBox->addChunkPartInformation(part);
-                processedRangeCharacters += part.length;
-
-                // Skip processed characters
-                itChar = itSearch - 1;
-            }
-
-            ASSERT(processedRangeCharacters == rangeLength);
-            processedChunkCharacters += rangeLength;
-
-#if DEBUG_CHUNK_PART_PROPAGATION > 0
-            boxes.add(rangeTextBox);
-#endif
-        }
-    }
-
-#if DEBUG_CHUNK_PART_PROPAGATION > 0
-    {
-        fprintf(stderr, "Propagated text chunk part information:\n");
-
-        ListHashSet<SVGInlineTextBox*>::const_iterator it = boxes.begin();
-        const ListHashSet<SVGInlineTextBox*>::const_iterator end = boxes.end();
-
-        for (; it != end; ++it) {
-            const SVGInlineTextBox* box = *it;
-            const Vector<SVGTextChunkPart>& parts = box->svgTextChunkParts();
-
-            fprintf(stderr, " Box %p contains %i text chunk parts:\n", box, static_cast<int>(parts.size()));
-            Vector<SVGTextChunkPart>::const_iterator partIt = parts.begin();
-            const Vector<SVGTextChunkPart>::const_iterator partEnd = parts.end();
-            for (; partIt != partEnd; ++partIt) {
-                const SVGTextChunkPart& part = *partIt;
-                fprintf(stderr, "   -> firstCharacter x=%lf, y=%lf, offset=%i, length=%i, width=%lf, height=%lf, textRenderer=%p\n"
-                              , part.firstCharacter->x, part.firstCharacter->y, part.offset, part.length, part.width, part.height, box->textRenderer());
-            }
-        }
-    }
-#endif
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGTextChunkLayoutInfo.cpp b/WebCore/rendering/SVGTextChunkLayoutInfo.cpp
deleted file mode 100644
index a7a6d87..0000000
--- a/WebCore/rendering/SVGTextChunkLayoutInfo.cpp
+++ /dev/null
@@ -1,493 +0,0 @@
-/*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#include "config.h"
-#include "SVGTextChunkLayoutInfo.h"
-
-#if ENABLE(SVG)
-#include "InlineFlowBox.h"
-#include "SVGInlineTextBox.h"
-#include "SVGRenderStyle.h"
-
-// Text chunk creation is complex and the whole process
-// can easily be traced by setting this variable > 0.
-#define DEBUG_CHUNK_BUILDING 0
-
-namespace WebCore {
-
-static float cummulatedWidthOrHeightOfTextChunk(SVGTextChunk& chunk, bool calcWidthOnly)
-{
-    float length = 0.0f;
-    Vector<SVGChar>::iterator charIt = chunk.start;
-
-    Vector<SVGInlineBoxCharacterRange>::iterator it = chunk.boxes.begin();
-    Vector<SVGInlineBoxCharacterRange>::iterator end = chunk.boxes.end();
-
-    for (; it != end; ++it) {
-        SVGInlineBoxCharacterRange& range = *it;
-
-        SVGInlineTextBox* box = static_cast<SVGInlineTextBox*>(range.box);
-        RenderStyle* style = box->renderer()->style();
-
-        for (int i = range.startOffset; i < range.endOffset; ++i) {
-            ASSERT(charIt <= chunk.end);
-
-            // Determine how many characters - starting from the current - can be measured at once.
-            // Important for non-absolute positioned non-latin1 text (ie. Arabic) where ie. the width
-            // of a string is not the sum of the boundaries of all contained glyphs.
-            Vector<SVGChar>::iterator itSearch = charIt + 1;
-            Vector<SVGChar>::iterator endSearch = charIt + range.endOffset - i;
-            while (itSearch != endSearch) {
-                // No need to check for 'isHidden()' here as this function is not called for text paths.
-                if (itSearch->drawnSeperated)
-                    break;
-
-                itSearch++;
-            }
-
-            unsigned int positionOffset = itSearch - charIt;
-
-            // Calculate width/height of subrange
-            SVGInlineBoxCharacterRange subRange;
-            subRange.box = range.box;
-            subRange.startOffset = i;
-            subRange.endOffset = i + positionOffset;
-
-            if (calcWidthOnly)
-                length += cummulatedWidthOfInlineBoxCharacterRange(subRange);
-            else
-                length += cummulatedHeightOfInlineBoxCharacterRange(subRange);
-
-            // Calculate gap between the previous & current range
-            // <text x="10 50 70">ABCD</text> - we need to take the gaps between A & B into account
-            // so add "40" as width, and analogous for B & C, add "20" as width.
-            if (itSearch > chunk.start && itSearch < chunk.end) {
-                SVGChar& lastCharacter = *(itSearch - 1);
-                SVGChar& currentCharacter = *itSearch;
-
-                int charsConsumed = 0;
-                float glyphWidth = 0.0f;
-                float glyphHeight = 0.0f;
-                String glyphName;
-                String unicodeString;
-                box->measureCharacter(style, i + positionOffset - 1, charsConsumed, glyphName, unicodeString, glyphWidth, glyphHeight);
-
-                if (calcWidthOnly)
-                    length += currentCharacter.x - lastCharacter.x - glyphWidth;
-                else
-                    length += currentCharacter.y - lastCharacter.y - glyphHeight;
-            }
-
-            // Advance processed characters
-            i += positionOffset - 1;
-            charIt = itSearch;
-        }
-    }
-
-    ASSERT(charIt == chunk.end);
-    return length;
-}
-
-static float cummulatedWidthOfTextChunk(SVGTextChunk& chunk)
-{
-    return cummulatedWidthOrHeightOfTextChunk(chunk, true);
-}
-
-static float cummulatedHeightOfTextChunk(SVGTextChunk& chunk)
-{
-    return cummulatedWidthOrHeightOfTextChunk(chunk, false);
-}
-
-float calculateTextAnchorShiftForTextChunk(SVGTextChunk& chunk, ETextAnchor anchor)
-{
-    float shift = 0.0f;
-
-    if (chunk.isVerticalText)
-        shift = cummulatedHeightOfTextChunk(chunk);
-    else
-        shift = cummulatedWidthOfTextChunk(chunk);
-
-    if (anchor == TA_MIDDLE)
-        shift *= -0.5f;
-    else
-        shift *= -1.0f;
-
-    return shift;
-}
-
-static void applyTextAnchorToTextChunk(SVGTextChunk& chunk)
-{
-    // This method is not called for chunks containing chars aligned on a path.
-    // -> all characters are visible, no need to check for "isHidden()" anywhere.
-
-    if (chunk.anchor == TA_START)
-        return;
-
-    float shift = calculateTextAnchorShiftForTextChunk(chunk, chunk.anchor);
-
-    // Apply correction to chunk
-    Vector<SVGChar>::iterator chunkIt = chunk.start;
-    for (; chunkIt != chunk.end; ++chunkIt) {
-        SVGChar& curChar = *chunkIt;
-
-        if (chunk.isVerticalText)
-            curChar.y += shift;
-        else
-            curChar.x += shift;
-    }
-
-    // Move inline boxes
-    Vector<SVGInlineBoxCharacterRange>::iterator boxIt = chunk.boxes.begin();
-    Vector<SVGInlineBoxCharacterRange>::iterator boxEnd = chunk.boxes.end();
-
-    for (; boxIt != boxEnd; ++boxIt) {
-        SVGInlineBoxCharacterRange& range = *boxIt;
-
-        InlineBox* curBox = range.box;
-        ASSERT(curBox->isSVGInlineTextBox());
-
-        // Move target box
-        if (chunk.isVerticalText)
-            curBox->setY(curBox->y() + static_cast<int>(shift));
-        else
-            curBox->setX(curBox->x() + static_cast<int>(shift));
-    }
-}
-
-float calculateTextLengthCorrectionForTextChunk(SVGTextChunk& chunk, ELengthAdjust lengthAdjust, float& computedLength)
-{
-    if (chunk.textLength <= 0.0f)
-        return 0.0f;
-
-    computedLength = 0.0f;
-
-    float computedWidth = cummulatedWidthOfTextChunk(chunk);
-    float computedHeight = cummulatedHeightOfTextChunk(chunk);
-    if ((computedWidth <= 0.0f && !chunk.isVerticalText)
-        || (computedHeight <= 0.0f && chunk.isVerticalText))
-        return 0.0f;
-
-    computedLength = chunk.isVerticalText ? computedHeight : computedWidth;
-    if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS) {
-        if (chunk.isVerticalText)    
-            chunk.ctm.scaleNonUniform(1.0f, chunk.textLength / computedLength);
-        else
-            chunk.ctm.scaleNonUniform(chunk.textLength / computedLength, 1.0f);
-
-        return 0.0f;
-    }
-
-    return (chunk.textLength - computedLength) / float(chunk.end - chunk.start);
-}
-
-static void applyTextLengthCorrectionToTextChunk(SVGTextChunk& chunk)
-{
-    // This method is not called for chunks containing chars aligned on a path.
-    // -> all characters are visible, no need to check for "isHidden()" anywhere.
-
-    // lengthAdjust="spacingAndGlyphs" is handled by setting a scale factor for the whole chunk
-    float textLength = 0.0f;
-    float spacingToApply = calculateTextLengthCorrectionForTextChunk(chunk, chunk.lengthAdjust, textLength);
-
-    if (!chunk.ctm.isIdentity() && chunk.lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS) {
-        SVGChar& firstChar = *(chunk.start);
-
-        // Assure we apply the chunk scaling in the right origin
-        AffineTransform newChunkCtm(chunk.ctm);
-        newChunkCtm.translateRight(firstChar.x, firstChar.y);
-        newChunkCtm.translate(-firstChar.x, -firstChar.y);
-
-        chunk.ctm = newChunkCtm;
-    }
-
-    // Apply correction to chunk 
-    if (spacingToApply != 0.0f) {
-        Vector<SVGChar>::iterator chunkIt = chunk.start;
-        for (; chunkIt != chunk.end; ++chunkIt) {
-            SVGChar& curChar = *chunkIt;
-            curChar.drawnSeperated = true;
-
-            if (chunk.isVerticalText)
-                curChar.y += (chunkIt - chunk.start) * spacingToApply;
-            else
-                curChar.x += (chunkIt - chunk.start) * spacingToApply;
-        }
-    }
-}
-
-void SVGTextChunkLayoutInfo::startTextChunk()
-{
-    m_chunk.boxes.clear();
-    m_chunk.boxes.append(SVGInlineBoxCharacterRange());
-
-    m_chunk.start = m_charsIt;
-    m_assignChunkProperties = true;
-}
-
-void SVGTextChunkLayoutInfo::closeTextChunk()
-{
-    ASSERT(!m_chunk.boxes.last().isOpen());
-    ASSERT(m_chunk.boxes.last().isClosed());
-
-    m_chunk.end = m_charsIt;
-    ASSERT(m_chunk.end >= m_chunk.start);
-
-    m_svgTextChunks.append(m_chunk);
-}
-
-void SVGTextChunkLayoutInfo::buildTextChunks(Vector<SVGChar>::iterator begin, Vector<SVGChar>::iterator end, InlineFlowBox* start)
-{
-    m_charsBegin = begin;
-    m_charsEnd = end;
-
-    m_charsIt = begin;
-    m_chunk = SVGTextChunk(begin);
-
-    recursiveBuildTextChunks(start);
-    ASSERT(m_charsIt == m_charsEnd);
-}
-
-void SVGTextChunkLayoutInfo::recursiveBuildTextChunks(InlineFlowBox* start)
-{
-#if DEBUG_CHUNK_BUILDING > 1
-    fprintf(stderr, " -> buildTextChunks(start=%p)\n", start);
-#endif
-
-    for (InlineBox* curr = start->firstChild(); curr; curr = curr->nextOnLine()) {
-        if (curr->renderer()->isText()) {
-            InlineTextBox* textBox = static_cast<InlineTextBox*>(curr);
-
-            unsigned length = textBox->len();
-            ASSERT(length > 0);
-
-#if DEBUG_CHUNK_BUILDING > 1
-            fprintf(stderr, " -> Handle inline text box (%p) with %i characters (start: %i, end: %i), handlingTextPath=%i\n",
-                            textBox, length, textBox->start(), textBox->end(), (int) m_handlingTextPath);
-#endif
-
-            RenderText* text = textBox->textRenderer();
-            ASSERT(text);
-            ASSERT(text->node());
-
-            SVGTextContentElement* textContent = 0;
-            Node* node = text->node()->parent();
-            while (node && node->isSVGElement() && !textContent) {
-                if (static_cast<SVGElement*>(node)->isTextContent())
-                    textContent = static_cast<SVGTextContentElement*>(node);
-                else
-                    node = node->parentNode();
-            }
-            ASSERT(textContent);
-
-            // Start new character range for the first chunk
-            bool isFirstCharacter = m_svgTextChunks.isEmpty() && m_chunk.start == m_charsIt && m_chunk.start == m_chunk.end;
-            if (isFirstCharacter) {
-                ASSERT(m_chunk.boxes.isEmpty());
-                m_chunk.boxes.append(SVGInlineBoxCharacterRange());
-            } else
-                ASSERT(!m_chunk.boxes.isEmpty());
-
-            // Walk string to find out new chunk positions, if existent
-            for (unsigned i = 0; i < length; ++i) {
-                ASSERT(m_charsIt != m_charsEnd);
-
-                SVGInlineBoxCharacterRange& range = m_chunk.boxes.last();
-                if (range.isOpen()) {
-                    range.box = curr;
-                    range.startOffset = !i ? 0 : i - 1;
-
-#if DEBUG_CHUNK_BUILDING > 1
-                    fprintf(stderr, " | -> Range is open! box=%p, startOffset=%i\n", range.box, range.startOffset);
-#endif
-                }
-
-                // If a new (or the first) chunk has been started, record it's text-anchor and writing mode.
-                if (m_assignChunkProperties) {
-                    m_assignChunkProperties = false;
-
-                    m_chunk.isVerticalText = isVerticalWritingMode(text->style()->svgStyle());
-                    m_chunk.isTextPath = m_handlingTextPath;
-                    m_chunk.anchor = text->style()->svgStyle()->textAnchor();
-                    m_chunk.textLength = textContent->textLength().value(textContent);
-                    m_chunk.lengthAdjust = (ELengthAdjust) textContent->lengthAdjust();
-
-#if DEBUG_CHUNK_BUILDING > 1
-                    fprintf(stderr, " | -> Assign chunk properties, isVerticalText=%i, anchor=%i\n", m_chunk.isVerticalText, m_chunk.anchor);
-#endif
-                }
-
-                if (i > 0 && !isFirstCharacter && m_charsIt->newTextChunk) {
-                    // Close mid chunk & character range
-                    ASSERT(!range.isOpen());
-                    ASSERT(!range.isClosed());
-
-                    range.endOffset = i;
-                    closeTextChunk();
-
-#if DEBUG_CHUNK_BUILDING > 1
-                    fprintf(stderr, " | -> Close mid-text chunk, at endOffset: %i and starting new mid chunk!\n", range.endOffset);
-#endif
-    
-                    // Prepare for next chunk, if we're not at the end
-                    startTextChunk();
-                    if (i + 1 == length) {
-#if DEBUG_CHUNK_BUILDING > 1
-                        fprintf(stderr, " | -> Record last chunk of inline text box!\n");
-#endif
-
-                        startTextChunk();
-                        SVGInlineBoxCharacterRange& range = m_chunk.boxes.last();
-
-                        m_assignChunkProperties = false;
-                        m_chunk.isVerticalText = isVerticalWritingMode(text->style()->svgStyle());
-                        m_chunk.isTextPath = m_handlingTextPath;
-                        m_chunk.anchor = text->style()->svgStyle()->textAnchor();
-                        m_chunk.textLength = textContent->textLength().value(textContent);
-                        m_chunk.lengthAdjust = (ELengthAdjust) textContent->lengthAdjust();
-
-                        range.box = curr;
-                        range.startOffset = i;
-
-                        ASSERT(!range.isOpen());
-                        ASSERT(!range.isClosed());
-                    }
-                }
-
-                // This should only hold true for the first character of the first chunk
-                if (isFirstCharacter)
-                    isFirstCharacter = false;
-    
-                ++m_charsIt;
-            }
-
-#if DEBUG_CHUNK_BUILDING > 1    
-            fprintf(stderr, " -> Finished inline text box!\n");
-#endif
-
-            SVGInlineBoxCharacterRange& range = m_chunk.boxes.last();
-            if (!range.isOpen() && !range.isClosed()) {
-#if DEBUG_CHUNK_BUILDING > 1
-                fprintf(stderr, " -> Last range not closed - closing with endOffset: %i\n", length);
-#endif
-
-                // Current text chunk is not yet closed. Finish the current range, but don't start a new chunk.
-                range.endOffset = length;
-
-                if (m_charsIt != m_charsEnd) {
-#if DEBUG_CHUNK_BUILDING > 1
-                    fprintf(stderr, " -> Not at last character yet!\n");
-#endif
-
-                    // If we're not at the end of the last box to be processed, and if the next
-                    // character starts a new chunk, then close the current chunk and start a new one.
-                    if (m_charsIt->newTextChunk) {
-#if DEBUG_CHUNK_BUILDING > 1
-                        fprintf(stderr, " -> Next character starts new chunk! Closing current chunk, and starting a new one...\n");
-#endif
-
-                        closeTextChunk();
-                        startTextChunk();
-                    } else {
-                        // Just start a new character range
-                        m_chunk.boxes.append(SVGInlineBoxCharacterRange());
-
-#if DEBUG_CHUNK_BUILDING > 1
-                        fprintf(stderr, " -> Next character does NOT start a new chunk! Starting new character range...\n");
-#endif
-                    }
-                } else {
-#if DEBUG_CHUNK_BUILDING > 1
-                    fprintf(stderr, " -> Closing final chunk! Finished processing!\n");
-#endif
-
-                    // Close final chunk, once we're at the end of the last box
-                    closeTextChunk();
-                }
-            }
-        } else {
-            ASSERT(curr->isInlineFlowBox());
-            InlineFlowBox* flowBox = static_cast<InlineFlowBox*>(curr);
-
-            // Skip generated content.
-            if (!flowBox->renderer()->node())
-                continue;
-
-            bool isTextPath = flowBox->renderer()->node()->hasTagName(SVGNames::textPathTag);
-
-#if DEBUG_CHUNK_BUILDING > 1
-            fprintf(stderr, " -> Handle inline flow box (%p), isTextPath=%i\n", flowBox, (int) isTextPath);
-#endif
-
-            if (isTextPath)
-                m_handlingTextPath = true;
-
-            recursiveBuildTextChunks(flowBox);
-
-            if (isTextPath)
-                m_handlingTextPath = false;
-        }
-    }
-
-#if DEBUG_CHUNK_BUILDING > 1
-    fprintf(stderr, " <- buildTextChunks(start=%p)\n", start);
-#endif
-}
-
-void SVGTextChunkLayoutInfo::layoutTextChunks()
-{
-    Vector<SVGTextChunk>::iterator it = m_svgTextChunks.begin();
-    Vector<SVGTextChunk>::iterator end = m_svgTextChunks.end();
-
-    for (; it != end; ++it) {
-        SVGTextChunk& chunk = *it;
-
-#if DEBUG_CHUNK_BUILDING > 0
-        {
-            fprintf(stderr, "Handle TEXT CHUNK! anchor=%i, textLength=%f, lengthAdjust=%i, isVerticalText=%i, isTextPath=%i start=%p, end=%p -> dist: %i\n",
-                    (int) chunk.anchor, chunk.textLength, (int) chunk.lengthAdjust, (int) chunk.isVerticalText,
-                    (int) chunk.isTextPath, chunk.start, chunk.end, (unsigned int) (chunk.end - chunk.start));
-
-            Vector<SVGInlineBoxCharacterRange>::iterator boxIt = chunk.boxes.begin();
-            Vector<SVGInlineBoxCharacterRange>::iterator boxEnd = chunk.boxes.end();
-
-            unsigned int i = 0;
-            for (; boxIt != boxEnd; ++boxIt) {
-                SVGInlineBoxCharacterRange& range = *boxIt;
-                ++i;
-                fprintf(stderr, " -> RANGE %i STARTOFFSET: %i, ENDOFFSET: %i, BOX: %p\n", i, range.startOffset, range.endOffset, range.box);
-            }
-        }
-#endif
-
-        if (chunk.isTextPath)
-            continue;
-
-        // text-path & textLength, with lengthAdjust="spacing" is already handled for textPath layouts.
-        applyTextLengthCorrectionToTextChunk(chunk);
- 
-        // text-anchor is already handled for textPath layouts.
-        applyTextAnchorToTextChunk(chunk);
-    }
-}
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGTextChunkLayoutInfo.h b/WebCore/rendering/SVGTextChunkLayoutInfo.h
deleted file mode 100644
index e06dd1a..0000000
--- a/WebCore/rendering/SVGTextChunkLayoutInfo.h
+++ /dev/null
@@ -1,198 +0,0 @@
-/*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- *
- */
-
-#ifndef SVGTextChunkLayoutInfo_h
-#define SVGTextChunkLayoutInfo_h
-
-#if ENABLE(SVG)
-#include "AffineTransform.h"
-#include "SVGCharacterData.h"
-#include "SVGRenderStyle.h"
-#include "SVGTextContentElement.h"
-
-#include <wtf/Assertions.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-class InlineBox;
-class InlineFlowBox;
-class SVGInlineTextBox;
-
-// A SVGTextChunk directly corresponds to the definition of a "text chunk" per SVG 1.1 specification
-// For example, each absolute positioned character starts a text chunk (much more to respect, see spec).
-// Each SVGTextChunk contains a Vector of SVGInlineBoxCharacterRange, describing how many boxes are spanned
-// by this chunk. Following two examples should clarify the code a bit:
-//
-// 1. <text x="10 20 30">ABC</text> - one InlineTextBox is created, three SVGTextChunks each with one SVGInlineBoxCharaterRange
-// [SVGTextChunk 1]
-//    [SVGInlineBoxCharacterRange 1, startOffset=0, endOffset=1, box=0x1]
-// [SVGTextChunk 2]
-//    [SVGInlineBoxCharacterRange 1, startOffset=1, endOffset=2, box=0x1]
-// [SVGTextChunk 3]
-//    [SVGInlineBoxCharacterRange 1, startOffset=2, endOffset=3, box=0x1]
-//
-// 2. <text x="10">A<tspan>B</tspan>C</text> - three InlineTextBoxs are created, one SVGTextChunk, with three SVGInlineBoxCharacterRanges
-// [SVGTextChunk 1]
-//    [SVGInlineBoxCharacterRange 1, startOffset=0, endOffset=1, box=0x1]
-//    [SVGInlineBoxCharacterRange 2, startOffset=0, endOffset=1, box=0x2]
-//    [SVGInlineBoxCharacterRange 3, startOffset=0, endOffset=1, box=0x3]
-//
-// High level overview of the SVG text layout code:
-// Step #1) - Build Vector of SVGChar objects starting from root <text> diving into children
-// Step #2) - Build Vector of SVGTextChunk objects, containing offsets into the InlineTextBoxes and SVGChar vectors
-// Step #3) - Apply chunk post processing (text-anchor / textLength support, which operate on text chunks!)
-// Step #4) - Propagate information, how many chunk "parts" are associated with each SVGInlineTextBox (see below)
-// Step #5) - Layout all InlineBoxes, only by measuring their context rect (x/y/width/height defined through SVGChars and transformations)
-// Step #6) - Layout SVGRootInlineBox, it's parent RenderSVGText block and fixup child positions, to be relative to the root box
-//
-// When painting a range of characters, we have to determine how many can be drawn in a row. Each absolute postioned
-// character is drawn individually. After step #2) we know all text chunks, and how they span across the SVGInlineTextBoxes.
-// In step #4) we build a list of text chunk "parts" and store it in each SVGInlineTextBox. A chunk "part" is a part of a
-// text chunk that lives in a SVGInlineTextBox (consists of a length, width, height and a monotonic offset from the chunk begin)
-// The SVGTextChunkPart object describes this information.
-// When painting we can follow the regular InlineBox flow, we start painting the SVGRootInlineBox, which just asks its children
-// to paint. They can paint on their own because all position information are known. Previously we used to draw _all_ characters
-// from the SVGRootInlineBox, which violates the whole concept of the multiple InlineBoxes, and made text selection very hard to
-// implement.
-
-struct SVGTextChunkPart {
-    SVGTextChunkPart()
-        : offset(-1)
-        , length(-1)
-        , width(0)
-        , height(0)
-    {
-    }
-
-    bool isValid() const
-    {
-        return offset != -1
-            && length != -1
-            && width
-            && height;
-    }
-
-    // First character of this text chunk part, defining the origin to be drawn
-    Vector<SVGChar>::const_iterator firstCharacter;
-
-    // Start offset in textRenderer()->characters() buffer.
-    int offset;
-
-    // length/width/height of chunk part
-    int length;
-    float width;
-    float height;
-};
-
-struct SVGInlineBoxCharacterRange {
-    SVGInlineBoxCharacterRange()
-        : startOffset(INT_MIN)
-        , endOffset(INT_MIN)
-        , box(0)
-    {
-    }
-
-    bool isOpen() const { return (startOffset == endOffset) && (endOffset == INT_MIN); }
-    bool isClosed() const { return startOffset != INT_MIN && endOffset != INT_MIN; }
-
-    int startOffset;
-    int endOffset;
-
-    InlineBox* box;
-};
-
-struct SVGChar;
-
-// Convenience typedef
-typedef SVGTextContentElement::SVGLengthAdjustType ELengthAdjust;
-
-struct SVGTextChunk {
-    SVGTextChunk(Vector<SVGChar>::iterator it)
-        : anchor(TA_START)
-        , textLength(0.0f)
-        , lengthAdjust(SVGTextContentElement::LENGTHADJUST_SPACING)
-        , isVerticalText(false)
-        , isTextPath(false)
-        , start(it)
-        , end(it)
-    {
-    }
-
-    // text-anchor support
-    ETextAnchor anchor;
-
-    // textLength & lengthAdjust support
-    float textLength;
-    ELengthAdjust lengthAdjust;
-    AffineTransform ctm;
-
-    // status flags
-    bool isVerticalText : 1;
-    bool isTextPath : 1;
-
-    // main chunk data
-    Vector<SVGChar>::iterator start;
-    Vector<SVGChar>::iterator end;
-
-    Vector<SVGInlineBoxCharacterRange> boxes;
-};
-
-struct SVGTextChunkLayoutInfo {
-    SVGTextChunkLayoutInfo()
-        : m_assignChunkProperties(true)
-        , m_handlingTextPath(false)
-        , m_charsIt(0)
-        , m_charsBegin(0)
-        , m_charsEnd(0)
-        , m_chunk(0)
-    {
-    }
-
-    const Vector<SVGTextChunk>& textChunks() const { return m_svgTextChunks; }
-
-    void buildTextChunks(Vector<SVGChar>::iterator charsBegin, Vector<SVGChar>::iterator charsEnd, InlineFlowBox* start);
-    void layoutTextChunks();
-
-private:
-    void startTextChunk();
-    void closeTextChunk();
-    void recursiveBuildTextChunks(InlineFlowBox* start);
-
-    bool m_assignChunkProperties : 1;
-    bool m_handlingTextPath : 1;
-
-    Vector<SVGChar>::iterator m_charsIt;
-    Vector<SVGChar>::iterator m_charsBegin;
-    Vector<SVGChar>::iterator m_charsEnd;
-
-    Vector<SVGTextChunk> m_svgTextChunks;
-    SVGTextChunk m_chunk;
-};
-
-// Helper functions
-float calculateTextAnchorShiftForTextChunk(SVGTextChunk&, ETextAnchor);
-float calculateTextLengthCorrectionForTextChunk(SVGTextChunk&, ELengthAdjust, float& computedLength);
-
-} // namespace WebCore
-
-#endif // ENABLE(SVG)
-#endif // SVGTextChunkLayoutInfo_h
diff --git a/WebCore/rendering/SVGTextLayoutUtilities.cpp b/WebCore/rendering/SVGTextLayoutUtilities.cpp
deleted file mode 100644
index 2debf28..0000000
--- a/WebCore/rendering/SVGTextLayoutUtilities.cpp
+++ /dev/null
@@ -1,375 +0,0 @@
-/*
-    Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
-    Copyright (C) Research In Motion Limited 2010. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "SVGTextLayoutUtilities.h"
-
-#if ENABLE(SVG)
-#include "FloatPoint.h"
-#include "InlineTextBox.h"
-#include "RenderObject.h"
-#include "SVGCharacterData.h"
-#include "SVGCharacterLayoutInfo.h"
-#include "SVGFontElement.h"
-#include "SVGRenderStyle.h"
-#include "SVGTextChunkLayoutInfo.h"
-#include "TextRun.h"
-#include "UnicodeRange.h"
-
-#include <float.h>
-
-namespace WebCore {
-
-bool isVerticalWritingMode(const SVGRenderStyle* style)
-{
-    return style->writingMode() == WM_TBRL || style->writingMode() == WM_TB; 
-}
-
-static inline EAlignmentBaseline dominantBaselineToShift(bool isVerticalText, const RenderObject* text, const Font& font)
-{
-    ASSERT(text);
-
-    const SVGRenderStyle* style = text->style() ? text->style()->svgStyle() : 0;
-    ASSERT(style);
-
-    const SVGRenderStyle* parentStyle = text->parent() && text->parent()->style() ? text->parent()->style()->svgStyle() : 0;
-
-    EDominantBaseline baseline = style->dominantBaseline();
-    if (baseline == DB_AUTO) {
-        if (isVerticalText)
-            baseline = DB_CENTRAL;
-        else
-            baseline = DB_ALPHABETIC;
-    }
-
-    switch (baseline) {
-    case DB_USE_SCRIPT:
-        // TODO: The dominant-baseline and the baseline-table components are set by
-        //       determining the predominant script of the character data content.
-        return AB_ALPHABETIC;
-    case DB_NO_CHANGE:
-        {
-            if (parentStyle)
-                return dominantBaselineToShift(isVerticalText, text->parent(), font);
-
-            ASSERT_NOT_REACHED();
-            return AB_AUTO;
-        }
-    case DB_RESET_SIZE:
-        {
-            if (parentStyle)
-                return dominantBaselineToShift(isVerticalText, text->parent(), font);
-
-            ASSERT_NOT_REACHED();
-            return AB_AUTO;    
-        }
-    case DB_IDEOGRAPHIC:
-        return AB_IDEOGRAPHIC;
-    case DB_ALPHABETIC:
-        return AB_ALPHABETIC;
-    case DB_HANGING:
-        return AB_HANGING;
-    case DB_MATHEMATICAL:
-        return AB_MATHEMATICAL;
-    case DB_CENTRAL:
-        return AB_CENTRAL;
-    case DB_MIDDLE:
-        return AB_MIDDLE;
-    case DB_TEXT_AFTER_EDGE:
-        return AB_TEXT_AFTER_EDGE;
-    case DB_TEXT_BEFORE_EDGE:
-        return AB_TEXT_BEFORE_EDGE;
-    default:
-        ASSERT_NOT_REACHED();
-        return AB_AUTO;
-    }
-}
-
-float alignmentBaselineToShift(bool isVerticalText, const RenderObject* text, const Font& font)
-{
-    ASSERT(text);
-
-    const SVGRenderStyle* style = text->style() ? text->style()->svgStyle() : 0;
-    ASSERT(style);
-
-    const SVGRenderStyle* parentStyle = text->parent() && text->parent()->style() ? text->parent()->style()->svgStyle() : 0;
-
-    EAlignmentBaseline baseline = style->alignmentBaseline();
-    if (baseline == AB_AUTO) {
-        if (parentStyle && style->dominantBaseline() == DB_AUTO)
-            baseline = dominantBaselineToShift(isVerticalText, text->parent(), font);
-        else
-            baseline = dominantBaselineToShift(isVerticalText, text, font);
-
-        ASSERT(baseline != AB_AUTO);    
-    }
-
-    // Note: http://wiki.apache.org/xmlgraphics-fop/LineLayout/AlignmentHandling
-    switch (baseline) {
-    case AB_BASELINE:
-        {
-            if (parentStyle)
-                return dominantBaselineToShift(isVerticalText, text->parent(), font);
-
-            return 0.0f;
-        }
-    case AB_BEFORE_EDGE:
-    case AB_TEXT_BEFORE_EDGE:
-        return font.ascent();
-    case AB_MIDDLE:
-        return font.xHeight() / 2.0f;
-    case AB_CENTRAL:
-        // Not needed, we're taking this into account already for vertical text!
-        // return (font.ascent() - font.descent()) / 2.0f;
-        return 0.0f;
-    case AB_AFTER_EDGE:
-    case AB_TEXT_AFTER_EDGE:
-    case AB_IDEOGRAPHIC:
-        return font.descent();
-    case AB_ALPHABETIC:
-        return 0.0f;
-    case AB_HANGING:
-        return font.ascent() * 8.0f / 10.0f;
-    case AB_MATHEMATICAL:
-        return font.ascent() / 2.0f;
-    default:
-        ASSERT_NOT_REACHED();
-        return 0.0f;
-    }
-}
-
-float glyphOrientationToAngle(const SVGRenderStyle* svgStyle, bool isVerticalText, const UChar& character)
-{
-    switch (isVerticalText ? svgStyle->glyphOrientationVertical() : svgStyle->glyphOrientationHorizontal()) {
-    case GO_AUTO:
-        {
-            // Spec: Fullwidth ideographic and fullwidth Latin text will be set with a glyph-orientation of 0-degrees.
-            // Text which is not fullwidth will be set with a glyph-orientation of 90-degrees.
-            unsigned int unicodeRange = findCharUnicodeRange(character);
-            if (unicodeRange == cRangeSetLatin || unicodeRange == cRangeArabic)
-                return 90.0f;
-
-            return 0.0f;
-        }
-    case GO_90DEG:
-        return 90.0f;
-    case GO_180DEG:
-        return 180.0f;
-    case GO_270DEG:
-        return 270.0f;
-    case GO_0DEG:
-    default:
-        return 0.0f;
-    }
-}
-
-static inline bool glyphOrientationIsMultiplyOf180Degrees(float orientationAngle)
-{
-    return fabsf(fmodf(orientationAngle, 180.0f)) == 0.0f;
-}
-
-float applyGlyphAdvanceAndShiftRespectingOrientation(bool isVerticalText, float orientationAngle, float glyphWidth, float glyphHeight, const Font& font, SVGChar& svgChar, float& xOrientationShift, float& yOrientationShift)
-{
-    bool orientationIsMultiplyOf180Degrees = glyphOrientationIsMultiplyOf180Degrees(orientationAngle);
-
-    // The function is based on spec requirements:
-    //
-    // Spec: If the 'glyph-orientation-horizontal' results in an orientation angle that is not a multiple of
-    // of 180 degrees, then the current text position is incremented according to the vertical metrics of the glyph.
-    //
-    // Spec: If if the 'glyph-orientation-vertical' results in an orientation angle that is not a multiple of
-    // 180 degrees,then the current text position is incremented according to the horizontal metrics of the glyph.
-
-    // vertical orientation handling
-    if (isVerticalText) {
-        if (orientationAngle == 0.0f) {
-            xOrientationShift = -glyphWidth / 2.0f;
-            yOrientationShift = font.ascent();
-        } else if (orientationAngle == 90.0f) {
-            xOrientationShift = -glyphHeight;
-            yOrientationShift = font.descent();
-            svgChar.orientationShiftY = -font.ascent();
-        } else if (orientationAngle == 270.0f) {
-            xOrientationShift = glyphHeight;
-            yOrientationShift = font.descent();
-            svgChar.orientationShiftX = -glyphWidth;
-            svgChar.orientationShiftY = -font.ascent();
-        } else if (orientationAngle == 180.0f) {
-            yOrientationShift = font.ascent();
-            svgChar.orientationShiftX = -glyphWidth / 2.0f;
-            svgChar.orientationShiftY = font.ascent() - font.descent();
-        }
-
-        // vertical advance calculation
-        if (orientationAngle != 0.0f && !orientationIsMultiplyOf180Degrees)
-            return glyphWidth;
-
-        return glyphHeight; 
-    }
-
-    // horizontal orientation handling
-    if (orientationAngle == 90.0f) {
-        xOrientationShift = glyphWidth / 2.0f;
-        yOrientationShift = -font.descent();
-        svgChar.orientationShiftX = -glyphWidth / 2.0f - font.descent(); 
-        svgChar.orientationShiftY = font.descent();
-    } else if (orientationAngle == 270.0f) {
-        xOrientationShift = -glyphWidth / 2.0f;
-        yOrientationShift = -font.descent();
-        svgChar.orientationShiftX = -glyphWidth / 2.0f + font.descent();
-        svgChar.orientationShiftY = glyphHeight;
-    } else if (orientationAngle == 180.0f) {
-        xOrientationShift = glyphWidth / 2.0f;
-        svgChar.orientationShiftX = -glyphWidth / 2.0f;
-        svgChar.orientationShiftY = font.ascent() - font.descent();
-    }
-
-    // horizontal advance calculation
-    if (orientationAngle != 0.0f && !orientationIsMultiplyOf180Degrees)
-        return glyphHeight;
-
-    return glyphWidth;
-}
-
-FloatPoint topLeftPositionOfCharacterRange(Vector<SVGChar>::iterator it, Vector<SVGChar>::iterator end)
-{
-    float lowX = FLT_MAX, lowY = FLT_MAX;
-    for (; it != end; ++it) {
-        if (it->isHidden())
-            continue;
-
-        float x = (*it).x;
-        float y = (*it).y;
-
-        if (x < lowX)
-            lowX = x;
-
-        if (y < lowY)
-            lowY = y;
-    }
-
-    return FloatPoint(lowX, lowY);
-}
-
-float cummulatedWidthOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange& range)
-{
-    ASSERT(!range.isOpen());
-    ASSERT(range.isClosed());
-    ASSERT(range.box->isSVGInlineTextBox());
-
-    InlineTextBox* textBox = static_cast<InlineTextBox*>(range.box);
-    RenderText* text = textBox->textRenderer();
-    RenderStyle* style = text->style();
-    return style->font().floatWidth(svgTextRunForInlineTextBox(text->characters() + textBox->start() + range.startOffset, range.endOffset - range.startOffset, style, textBox));
-}
-
-float cummulatedHeightOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange& range)
-{
-    ASSERT(!range.isOpen());
-    ASSERT(range.isClosed());
-    ASSERT(range.box->isSVGInlineTextBox());
-
-    InlineTextBox* textBox = static_cast<InlineTextBox*>(range.box);
-    return (range.endOffset - range.startOffset) * textBox->textRenderer()->style()->font().height();
-}
-
-TextRun svgTextRunForInlineTextBox(const UChar* characters, int length, const RenderStyle* style, const InlineTextBox* textBox)
-{
-    ASSERT(textBox);
-    ASSERT(style);
-
-    TextRun run(characters
-                , length
-                , false /* allowTabs */
-                , 0 /* xPos, only relevant with allowTabs=true */
-                , 0 /* padding, only relevant for justified text, not relevant for SVG */
-                , textBox->direction() == RTL
-                , textBox->m_dirOverride || style->visuallyOrdered() /* directionalOverride */);
-
-#if ENABLE(SVG_FONTS)
-    run.setReferencingRenderObject(textBox->textRenderer()->parent());
-#endif
-
-    // Disable any word/character rounding.
-    run.disableRoundingHacks();
-
-    // We handle letter & word spacing ourselves.
-    run.disableSpacing();
-    return run;
-}
-
-float calculateCSSKerning(SVGElement* context, const RenderStyle* style)
-{
-    const Font& font = style->font();
-    const SVGRenderStyle* svgStyle = style->svgStyle();
-
-    SVGLength kerningLength = svgStyle->kerning();
-    if (kerningLength.unitType() == LengthTypePercentage)
-        return kerningLength.valueAsPercentage() * font.pixelSize();
-
-    return kerningLength.value(context);
-}
-
-bool applySVGKerning(SVGCharacterLayoutInfo& info, const RenderStyle* style, SVGLastGlyphInfo& lastGlyph, const String& unicodeString, const String& glyphName, bool isVerticalText)
-{
-#if ENABLE(SVG_FONTS)
-    float kerning = 0.0f;
-
-    const Font& font = style->font();
-    if (!font.isSVGFont()) {
-        lastGlyph.isValid = false;
-        return false;
-    }
-
-    SVGFontElement* svgFont = font.svgFont();
-    ASSERT(svgFont);
-
-    if (lastGlyph.isValid) {
-        if (isVerticalText)
-            kerning = svgFont->verticalKerningForPairOfStringsAndGlyphs(lastGlyph.unicode, lastGlyph.glyphName, unicodeString, glyphName);
-        else
-            kerning = svgFont->horizontalKerningForPairOfStringsAndGlyphs(lastGlyph.unicode, lastGlyph.glyphName, unicodeString, glyphName);
-    }
-
-    lastGlyph.unicode = unicodeString;
-    lastGlyph.glyphName = glyphName;
-    lastGlyph.isValid = true;
-    kerning *= style->font().size() / style->font().primaryFont()->unitsPerEm();
-
-    if (kerning != 0.0f) {
-        if (isVerticalText)
-            info.cury -= kerning;
-        else
-            info.curx -= kerning;
-        return true;
-    }
-#else
-    UNUSED_PARAM(info);
-    UNUSED_PARAM(item);
-    UNUSED_PARAM(lastGlyph);
-    UNUSED_PARAM(unicodeString);
-    UNUSED_PARAM(glyphName);
-#endif
-    return false;
-}
-
-}
-
-#endif
diff --git a/WebCore/rendering/SVGTextLayoutUtilities.h b/WebCore/rendering/SVGTextLayoutUtilities.h
deleted file mode 100644
index 459d682..0000000
--- a/WebCore/rendering/SVGTextLayoutUtilities.h
+++ /dev/null
@@ -1,70 +0,0 @@
-/*
-    Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
-    Copyright (C) Research In Motion Limited 2010. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#ifndef SVGTextLayoutUtilities_h
-#define SVGTextLayoutUtilities_h
-
-#if ENABLE(SVG)
-#include <wtf/Vector.h>
-#include <wtf/text/WTFString.h>
-
-namespace WebCore {
-
-class FloatPoint;
-class Font;
-class InlineTextBox;
-class RenderObject;
-class RenderStyle;
-class SVGElement;
-class SVGRenderStyle;
-class TextRun;
-
-struct SVGChar;
-struct SVGCharacterLayoutInfo;
-struct SVGInlineBoxCharacterRange;
-
-struct SVGLastGlyphInfo {
-    SVGLastGlyphInfo()
-        : isValid(false)
-    {
-    }
-
-    bool isValid;
-    String unicode;
-    String glyphName;
-};
-
-bool isVerticalWritingMode(const SVGRenderStyle*);
-float alignmentBaselineToShift(bool isVerticalText, const RenderObject* text, const Font&);
-float glyphOrientationToAngle(const SVGRenderStyle*, bool isVerticalText, const UChar&);
-float applyGlyphAdvanceAndShiftRespectingOrientation(bool isVerticalText, float orientationAngle, float glyphWidth, float glyphHeight, const Font&,
-                                                     SVGChar&, float& xOrientationShift, float& yOrientationShift);
-FloatPoint topLeftPositionOfCharacterRange(Vector<SVGChar>::iterator start, Vector<SVGChar>::iterator end);
-float cummulatedWidthOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange&);
-float cummulatedHeightOfInlineBoxCharacterRange(SVGInlineBoxCharacterRange&);
-TextRun svgTextRunForInlineTextBox(const UChar*, int length, const RenderStyle*, const InlineTextBox*);
-
-float calculateCSSKerning(SVGElement* context, const RenderStyle*);
-bool applySVGKerning(SVGCharacterLayoutInfo&, const RenderStyle*, SVGLastGlyphInfo&, const String& unicodeString, const String& glyphName, bool isVerticalText);
-
-}
-
-#endif
-#endif
diff --git a/WebCore/rendering/SVGTextQuery.cpp b/WebCore/rendering/SVGTextQuery.cpp
deleted file mode 100644
index 35ca690..0000000
--- a/WebCore/rendering/SVGTextQuery.cpp
+++ /dev/null
@@ -1,467 +0,0 @@
-/*
-    Copyright (C) Research In Motion Limited 2010. All rights reserved.
-
-    This library is free software; you can redistribute it and/or
-    modify it under the terms of the GNU Library General Public
-    License as published by the Free Software Foundation; either
-    version 2 of the License, or (at your option) any later version.
-
-    This library is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
-    Library General Public License for more details.
-
-    You should have received a copy of the GNU Library General Public License
-    along with this library; see the file COPYING.LIB.  If not, write to
-    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
-    Boston, MA 02110-1301, USA.
-*/
-
-#include "config.h"
-#include "SVGTextQuery.h"
-
-#if ENABLE(SVG)
-#include "FloatConversion.h"
-#include "InlineFlowBox.h"
-#include "RenderBlock.h"
-#include "RenderInline.h"
-#include "SVGInlineTextBox.h"
-#include "VisiblePosition.h"
-
-namespace WebCore {
-
-// Base structure for callback user data
-struct SVGTextQuery::Data {
-    Data()
-        : processedChunkCharacters(0)
-    {
-    }
-
-    unsigned processedChunkCharacters;
-};
-
-static inline InlineFlowBox* flowBoxForRenderer(RenderObject* renderer)
-{
-    if (!renderer)
-        return 0;
-
-    if (renderer->isRenderBlock()) {
-        // If we're given a block element, it has to be a RenderSVGText.
-        ASSERT(renderer->isSVGText());
-        RenderBlock* renderBlock = toRenderBlock(renderer);
-
-        // RenderSVGText only ever contains a single line box.
-        InlineFlowBox* flowBox = renderBlock->firstLineBox();
-        ASSERT(flowBox == renderBlock->lastLineBox());
-        return flowBox;
-    }
-
-    if (renderer->isRenderInline()) {
-        // We're given a RenderSVGInline or objects that derive from it (RenderSVGTSpan / RenderSVGTextPath)
-        RenderInline* renderInline = toRenderInline(renderer);
-
-        // RenderSVGInline only ever contains a single line box.
-        InlineFlowBox* flowBox = renderInline->firstLineBox();
-        ASSERT(flowBox == renderInline->lastLineBox());
-        return flowBox;
-    }
-
-    ASSERT_NOT_REACHED();
-    return 0;
-}
-
-static inline float mapLengthThroughChunkTransformation(const SVGInlineTextBox* textBox, bool isVerticalText, float length)
-{
-    const AffineTransform& transform = textBox->chunkTransformation();
-    if (transform.isIdentity())
-        return length;
-        
-    return narrowPrecisionToFloat(static_cast<double>(length) * (isVerticalText ? transform.d() : transform.a()));
-}
-
-SVGTextQuery::SVGTextQuery(RenderObject* renderer)
-{
-    collectTextBoxesInFlowBox(flowBoxForRenderer(renderer));
-}
-
-void SVGTextQuery::collectTextBoxesInFlowBox(InlineFlowBox* flowBox)
-{
-    if (!flowBox)
-        return;
-
-    for (InlineBox* child = flowBox->firstChild(); child; child = child->nextOnLine()) {
-        if (child->isInlineFlowBox()) {
-            // Skip generated content.
-            if (!child->renderer()->node())
-                continue;
-
-            collectTextBoxesInFlowBox(static_cast<InlineFlowBox*>(child));
-            continue;
-        }
-
-        ASSERT(child->isSVGInlineTextBox());
-        m_textBoxes.append(static_cast<SVGInlineTextBox*>(child));
-    }
-}
-
-bool SVGTextQuery::executeQuery(Data* queryData, ProcessTextChunkPartCallback chunkPartCallback) const
-{
-    ASSERT(!m_textBoxes.isEmpty());
-    bool finished = false;
-
-    // Loop over all text boxes
-    const Vector<SVGInlineTextBox*>::const_iterator end = m_textBoxes.end();
-    for (Vector<SVGInlineTextBox*>::const_iterator it = m_textBoxes.begin(); it != end; ++it) {
-        const SVGInlineTextBox* textBox = *it;
-        const Vector<SVGTextChunkPart>& parts = textBox->svgTextChunkParts();
-
-        int processedCharacters = 0;
-
-        // Loop over all text chunk parts in this text box, firing a callback for each chunk part.
-        const Vector<SVGTextChunkPart>::const_iterator partEnd = parts.end();
-        for (Vector<SVGTextChunkPart>::const_iterator partIt = parts.begin(); partIt != partEnd; ++partIt) {
-            if ((this->*chunkPartCallback)(queryData, textBox, *partIt)) {
-                finished = true;
-                break;
-            }
-
-            processedCharacters += partIt->length;
-        }
-
-        if (finished)
-            break;
-
-        queryData->processedChunkCharacters += processedCharacters;
-    }
-
-    return finished;
-}
-
-bool SVGTextQuery::mapStartAndLengthIntoChunkPartCoordinates(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part, int& startPosition, int& endPosition) const
-{
-    // Reuse the same logic used for text selection & painting, to map our query start/length into start/endPositions of the current text chunk part.
-    startPosition -= queryData->processedChunkCharacters;
-    endPosition -= queryData->processedChunkCharacters;
-    textBox->mapStartEndPositionsIntoChunkPartCoordinates(startPosition, endPosition, part);
-
-    // If startPosition < endPosition, then the position we're supposed to measure lies in this chunk part.
-    return startPosition < endPosition;
-}
-
-float SVGTextQuery::measureCharacterRange(const SVGInlineTextBox* textBox, RenderStyle* style, bool isVerticalText, int startPosition, int length) const
-{
-    // FIXME: Vertical writing mode needs to be handled more accurate.
-    if (isVerticalText)
-        return length * style->font().height();
-
-    const UChar* startCharacter = textBox->textRenderer()->characters() + textBox->start() + startPosition;
-    return style->font().floatWidth(svgTextRunForInlineTextBox(startCharacter, length, style, textBox));
-}
-
-// numberOfCharacters() implementation
-struct NumberOfCharactersData : SVGTextQuery::Data {
-    NumberOfCharactersData()
-        : characters(0)
-    {
-    }
-
-    unsigned characters;
-};
-
-bool SVGTextQuery::numberOfCharactersCallback(Data* queryData, const SVGInlineTextBox*, const SVGTextChunkPart& part) const
-{
-    NumberOfCharactersData* data = static_cast<NumberOfCharactersData*>(queryData);
-    data->characters += part.length;
-    return false;
-}
-
-unsigned SVGTextQuery::numberOfCharacters() const
-{
-    if (m_textBoxes.isEmpty())
-        return 0;
-
-    NumberOfCharactersData data;
-    executeQuery(&data, &SVGTextQuery::numberOfCharactersCallback);
-    return data.characters;
-}
-
-// textLength() implementation
-struct TextLengthData : SVGTextQuery::Data {
-    TextLengthData()
-        : textLength(0.0f)
-    {
-    }
-
-    float textLength;
-};
-
-bool SVGTextQuery::textLengthCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    TextLengthData* data = static_cast<TextLengthData*>(queryData);
-
-    RenderStyle* style = textBox->textRenderer()->style();
-    ASSERT(style);
-
-    bool isVerticalText = isVerticalWritingMode(style->svgStyle());
-    float partLength = isVerticalText ? part.height : part.width;
-
-    data->textLength += mapLengthThroughChunkTransformation(textBox, isVerticalText, partLength);
-    return false;
-}
-
-float SVGTextQuery::textLength() const
-{
-    if (m_textBoxes.isEmpty())
-        return 0.0f;
-
-    TextLengthData data;
-    executeQuery(&data, &SVGTextQuery::textLengthCallback);
-    return data.textLength;
-}
-
-// subStringLength() implementation
-struct SubStringLengthData : SVGTextQuery::Data {
-    SubStringLengthData(unsigned queryStartPosition, unsigned queryLength)
-        : startPosition(queryStartPosition)
-        , length(queryLength)
-        , subStringLength(0.0f)
-    {
-    }
-
-    unsigned startPosition;
-    unsigned length;
-
-    float subStringLength;
-};
-
-bool SVGTextQuery::subStringLengthCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    SubStringLengthData* data = static_cast<SubStringLengthData*>(queryData);
-
-    int startPosition = data->startPosition;
-    int endPosition = startPosition + data->length;
-    if (!mapStartAndLengthIntoChunkPartCoordinates(queryData, textBox, part, startPosition, endPosition))
-        return false;
-
-    RenderStyle* style = textBox->textRenderer()->style();
-    ASSERT(style);
-
-    bool isVerticalText = isVerticalWritingMode(style->svgStyle());
-    float partLength = measureCharacterRange(textBox, style, isVerticalWritingMode(style->svgStyle()), part.offset + startPosition, endPosition - startPosition);
-
-    data->subStringLength += mapLengthThroughChunkTransformation(textBox, isVerticalText, partLength);
-    return false;
-}
-
-float SVGTextQuery::subStringLength(unsigned startPosition, unsigned length) const
-{
-    if (m_textBoxes.isEmpty())
-        return 0.0f;
-
-    SubStringLengthData data(startPosition, length);
-    executeQuery(&data, &SVGTextQuery::subStringLengthCallback);
-    return data.subStringLength;
-}
-
-// startPositionOfCharacter() implementation
-struct StartPositionOfCharacterData : SVGTextQuery::Data {
-    StartPositionOfCharacterData(unsigned queryPosition)
-        : position(queryPosition)
-    {
-    }
-
-    unsigned position;
-    FloatPoint startPosition;
-};
-
-bool SVGTextQuery::startPositionOfCharacterCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    StartPositionOfCharacterData* data = static_cast<StartPositionOfCharacterData*>(queryData);
-
-    int startPosition = data->position;
-    int endPosition = startPosition + 1;
-    if (!mapStartAndLengthIntoChunkPartCoordinates(queryData, textBox, part, startPosition, endPosition))
-        return false;
-
-    const SVGChar& character = *(part.firstCharacter + startPosition);
-    data->startPosition = textBox->chunkTransformation().mapPoint(FloatPoint(character.x, character.y));
-    return true;
-}
-
-FloatPoint SVGTextQuery::startPositionOfCharacter(unsigned position) const
-{
-    if (m_textBoxes.isEmpty())
-        return FloatPoint();
-
-    StartPositionOfCharacterData data(position);
-    executeQuery(&data, &SVGTextQuery::startPositionOfCharacterCallback);
-    return data.startPosition;
-}
-
-// endPositionOfCharacter() implementation
-struct EndPositionOfCharacterData : SVGTextQuery::Data {
-    EndPositionOfCharacterData(unsigned queryPosition)
-        : position(queryPosition)
-    {
-    }
-
-    unsigned position;
-    FloatPoint endPosition;
-};
-
-bool SVGTextQuery::endPositionOfCharacterCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    EndPositionOfCharacterData* data = static_cast<EndPositionOfCharacterData*>(queryData);
-
-    int startPosition = data->position;
-    int endPosition = startPosition + 1;
-    if (!mapStartAndLengthIntoChunkPartCoordinates(queryData, textBox, part, startPosition, endPosition))
-        return false;
-
-    const SVGChar& character = *(part.firstCharacter + startPosition);
-    data->endPosition = FloatPoint(character.x, character.y);
-
-    RenderStyle* style = textBox->textRenderer()->style();
-    ASSERT(style);
-
-    bool isVerticalText = isVerticalWritingMode(style->svgStyle());
-    float glyphAdvance = measureCharacterRange(textBox, style, isVerticalText, part.offset + startPosition, 1);
-
-    if (isVerticalText)
-        data->endPosition.move(0.0f, glyphAdvance);
-    else
-        data->endPosition.move(glyphAdvance, 0.0f);
-
-    data->endPosition = textBox->chunkTransformation().mapPoint(data->endPosition);
-    return true;
-}
-
-FloatPoint SVGTextQuery::endPositionOfCharacter(unsigned position) const
-{
-    if (m_textBoxes.isEmpty())
-        return FloatPoint();
-
-    EndPositionOfCharacterData data(position);
-    executeQuery(&data, &SVGTextQuery::endPositionOfCharacterCallback);
-    return data.endPosition;
-}
-
-// rotationOfCharacter() implementation
-struct RotationOfCharacterData : SVGTextQuery::Data {
-    RotationOfCharacterData(unsigned queryPosition)
-        : position(queryPosition)
-        , rotation(0.0f)
-    {
-    }
-
-    unsigned position;
-    float rotation;
-};
-
-bool SVGTextQuery::rotationOfCharacterCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    RotationOfCharacterData* data = static_cast<RotationOfCharacterData*>(queryData);
-
-    int startPosition = data->position;
-    int endPosition = startPosition + 1;
-    if (!mapStartAndLengthIntoChunkPartCoordinates(queryData, textBox, part, startPosition, endPosition))
-        return false;
-
-    const SVGChar& character = *(part.firstCharacter + startPosition);
-    data->rotation = character.angle;
-    return true;
-}
-
-float SVGTextQuery::rotationOfCharacter(unsigned position) const
-{
-    if (m_textBoxes.isEmpty())
-        return 0.0f;
-
-    RotationOfCharacterData data(position);
-    executeQuery(&data, &SVGTextQuery::rotationOfCharacterCallback);
-    return data.rotation;
-}
-
-// extentOfCharacter() implementation
-struct ExtentOfCharacterData : SVGTextQuery::Data {
-    ExtentOfCharacterData(unsigned queryPosition)
-        : position(queryPosition)
-    {
-    }
-
-    unsigned position;
-    FloatRect extent;
-};
-
-bool SVGTextQuery::extentOfCharacterCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    ExtentOfCharacterData* data = static_cast<ExtentOfCharacterData*>(queryData);
-
-    int startPosition = data->position;
-    int endPosition = startPosition + 1;
-    if (!mapStartAndLengthIntoChunkPartCoordinates(queryData, textBox, part, startPosition, endPosition))
-        return false;
- 
-    RenderStyle* style = textBox->textRenderer()->style();
-    ASSERT(style);
-
-    const SVGChar& character = *(part.firstCharacter + startPosition);
-    data->extent = textBox->calculateGlyphBoundaries(style, part.offset + startPosition, character);
-    return true;
-}
-
-FloatRect SVGTextQuery::extentOfCharacter(unsigned position) const
-{
-    if (m_textBoxes.isEmpty())
-        return FloatRect();
-
-    ExtentOfCharacterData data(position);
-    executeQuery(&data, &SVGTextQuery::extentOfCharacterCallback);
-    return data.extent;
-}
-
-// characterNumberAtPosition() implementation
-struct CharacterNumberAtPositionData : SVGTextQuery::Data {
-    CharacterNumberAtPositionData(const FloatPoint& queryPosition)
-        : characterNumber(0)
-        , position(queryPosition)
-    {
-    }
-
-    unsigned characterNumber;
-    FloatPoint position;
-};
-
-bool SVGTextQuery::characterNumberAtPositionCallback(Data* queryData, const SVGInlineTextBox* textBox, const SVGTextChunkPart& part) const
-{
-    CharacterNumberAtPositionData* data = static_cast<CharacterNumberAtPositionData*>(queryData);
-
-    RenderStyle* style = textBox->textRenderer()->style();
-    ASSERT(style);
-
-    for (int i = 0; i < part.length; ++i) {
-        FloatRect extent(textBox->calculateGlyphBoundaries(style, part.offset + i, *(part.firstCharacter + i)));
-        if (extent.contains(data->position))
-            return true;
-
-        ++data->characterNumber;
-    }
-
-    return false;
-}
-
-int SVGTextQuery::characterNumberAtPosition(const FloatPoint& position) const
-{
-    if (m_textBoxes.isEmpty())
-        return -1;
-
-    CharacterNumberAtPositionData data(position);
-    if (!executeQuery(&data, &SVGTextQuery::characterNumberAtPositionCallback))
-        return -1;
-
-    return data.characterNumber;
-}
-
-}
-
-#endif
diff --git a/WebCore/rendering/TextControlInnerElements.cpp b/WebCore/rendering/TextControlInnerElements.cpp
index e5228f0..5d5b8b3 100644
--- a/WebCore/rendering/TextControlInnerElements.cpp
+++ b/WebCore/rendering/TextControlInnerElements.cpp
@@ -479,7 +479,7 @@ void InputFieldSpeechButtonElement::setRecognitionResult(int, const String& resu
     // here, we take a temporary reference.
     RefPtr<HTMLInputElement> holdRef(input);
     input->setValue(result);
-    input->dispatchFormControlChangeEvent();
+    input->dispatchWebkitSpeechChangeEvent();
     renderer()->repaint();
 }
 
diff --git a/WebCore/rendering/style/RenderStyle.cpp b/WebCore/rendering/style/RenderStyle.cpp
index 623a298..b56bb1e 100644
--- a/WebCore/rendering/style/RenderStyle.cpp
+++ b/WebCore/rendering/style/RenderStyle.cpp
@@ -297,8 +297,12 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
     changedContextSensitiveProperties = ContextSensitivePropertyNone;
 
 #if ENABLE(SVG)
-    if (m_svgStyle != other->m_svgStyle)
-        return m_svgStyle->diff(other->m_svgStyle.get());
+    StyleDifference svgChange = StyleDifferenceEqual;
+    if (m_svgStyle != other->m_svgStyle) {
+        svgChange = m_svgStyle->diff(other->m_svgStyle.get());
+        if (svgChange == StyleDifferenceLayout)
+            return svgChange;
+    }
 #endif
 
     if (m_box->width() != other->m_box->width() ||
@@ -442,7 +446,7 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
         return StyleDifferenceLayout;
 
     // Check block flow direction.
-    if (inherited_flags._blockFlow != other->inherited_flags._blockFlow)
+    if (inherited_flags.m_writingMode != other->inherited_flags.m_writingMode)
         return StyleDifferenceLayout;
 
     // Overflow returns a layout hint.
@@ -475,6 +479,15 @@ StyleDifference RenderStyle::diff(const RenderStyle* other, unsigned& changedCon
 
     if ((visibility() == COLLAPSE) != (other->visibility() == COLLAPSE))
         return StyleDifferenceLayout;
+                    
+#if ENABLE(SVG)
+    // SVGRenderStyle::diff() might have returned StyleDifferenceRepaint, eg. if fill changes.
+    // If eg. the font-size changed at the same time, we're not allowed to return StyleDifferenceRepaint,
+    // but have to return StyleDifferenceLayout, that's why  this if branch comes after all branches
+    // that are relevant for SVG and might return StyleDifferenceLayout.
+    if (svgChange != StyleDifferenceEqual)
+        return svgChange;
+#endif
 
     // Make sure these left/top/right/bottom checks stay below all layout checks and above
     // all visible checks.
@@ -922,52 +935,52 @@ void RenderStyle::setBlendedFontSize(int size)
     font().update(currentFontSelector);
 }
 
-void RenderStyle::getBoxShadowExtent(int &top, int &right, int &bottom, int &left) const
+void RenderStyle::getShadowExtent(const ShadowData* shadow, int &top, int &right, int &bottom, int &left) const
 {
     top = 0;
     right = 0;
     bottom = 0;
     left = 0;
 
-    for (const ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next()) {
-        if (boxShadow->style() == Inset)
+    for ( ; shadow; shadow = shadow->next()) {
+        if (shadow->style() == Inset)
             continue;
-        int blurAndSpread = boxShadow->blur() + boxShadow->spread();
+        int blurAndSpread = shadow->blur() + shadow->spread();
 
-        top = min(top, boxShadow->y() - blurAndSpread);
-        right = max(right, boxShadow->x() + blurAndSpread);
-        bottom = max(bottom, boxShadow->y() + blurAndSpread);
-        left = min(left, boxShadow->x() - blurAndSpread);
+        top = min(top, shadow->y() - blurAndSpread);
+        right = max(right, shadow->x() + blurAndSpread);
+        bottom = max(bottom, shadow->y() + blurAndSpread);
+        left = min(left, shadow->x() - blurAndSpread);
     }
 }
 
-void RenderStyle::getBoxShadowHorizontalExtent(int &left, int &right) const
+void RenderStyle::getShadowHorizontalExtent(const ShadowData* shadow, int &left, int &right) const
 {
     left = 0;
     right = 0;
 
-    for (const ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next()) {
-        if (boxShadow->style() == Inset)
+    for ( ; shadow; shadow = shadow->next()) {
+        if (shadow->style() == Inset)
             continue;
-        int blurAndSpread = boxShadow->blur() + boxShadow->spread();
+        int blurAndSpread = shadow->blur() + shadow->spread();
 
-        left = min(left, boxShadow->x() - blurAndSpread);
-        right = max(right, boxShadow->x() + blurAndSpread);
+        left = min(left, shadow->x() - blurAndSpread);
+        right = max(right, shadow->x() + blurAndSpread);
     }
 }
 
-void RenderStyle::getBoxShadowVerticalExtent(int &top, int &bottom) const
+void RenderStyle::getShadowVerticalExtent(const ShadowData* shadow, int &top, int &bottom) const
 {
     top = 0;
     bottom = 0;
 
-    for (const ShadowData* boxShadow = this->boxShadow(); boxShadow; boxShadow = boxShadow->next()) {
-        if (boxShadow->style() == Inset)
+    for ( ; shadow; shadow = shadow->next()) {
+        if (shadow->style() == Inset)
             continue;
-        int blurAndSpread = boxShadow->blur() + boxShadow->spread();
+        int blurAndSpread = shadow->blur() + shadow->spread();
 
-        top = min(top, boxShadow->y() - blurAndSpread);
-        bottom = max(bottom, boxShadow->y() + blurAndSpread);
+        top = min(top, shadow->y() - blurAndSpread);
+        bottom = max(bottom, shadow->y() + blurAndSpread);
     }
 }
 
@@ -1066,56 +1079,56 @@ const Color RenderStyle::visitedDependentColor(int colorProperty) const
 
 Length RenderStyle::logicalWidth() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return width();
     return height();
 }
 
 Length RenderStyle::logicalHeight() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return height();
     return width();
 }
 
 Length RenderStyle::logicalMinWidth() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return minWidth();
     return minHeight();
 }
 
 Length RenderStyle::logicalMaxWidth() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return maxWidth();
     return maxHeight();
 }
 
 Length RenderStyle::logicalMinHeight() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return minHeight();
     return minWidth();
 }
 
 Length RenderStyle::logicalMaxHeight() const
 {
-    if (isVerticalBlockFlow())
+    if (isHorizontalWritingMode())
         return maxHeight();
     return maxWidth();
 }
 
 unsigned short RenderStyle::borderBeforeWidth() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return borderTopWidth();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return borderBottomWidth();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return borderLeftWidth();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return borderRightWidth();
     }
     ASSERT_NOT_REACHED();
@@ -1124,14 +1137,14 @@ unsigned short RenderStyle::borderBeforeWidth() const
 
 unsigned short RenderStyle::borderAfterWidth() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return borderBottomWidth();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return borderTopWidth();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return borderRightWidth();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return borderLeftWidth();
     }
     ASSERT_NOT_REACHED();
@@ -1140,28 +1153,28 @@ unsigned short RenderStyle::borderAfterWidth() const
 
 unsigned short RenderStyle::borderStartWidth() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? borderLeftWidth() : borderRightWidth();
-    return direction() == LTR ? borderTopWidth() : borderBottomWidth();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? borderLeftWidth() : borderRightWidth();
+    return isLeftToRightDirection() ? borderTopWidth() : borderBottomWidth();
 }
 
 unsigned short RenderStyle::borderEndWidth() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? borderRightWidth() : borderLeftWidth();
-    return direction() == LTR ? borderBottomWidth() : borderTopWidth();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? borderRightWidth() : borderLeftWidth();
+    return isLeftToRightDirection() ? borderBottomWidth() : borderTopWidth();
 }
     
 Length RenderStyle::marginBefore() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return marginTop();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return marginBottom();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return marginLeft();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return marginRight();
     }
     ASSERT_NOT_REACHED();
@@ -1170,14 +1183,14 @@ Length RenderStyle::marginBefore() const
 
 Length RenderStyle::marginAfter() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return marginBottom();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return marginTop();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return marginRight();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return marginLeft();
     }
     ASSERT_NOT_REACHED();
@@ -1186,14 +1199,14 @@ Length RenderStyle::marginAfter() const
 
 Length RenderStyle::marginBeforeUsing(const RenderStyle* otherStyle) const
 {
-    switch (otherStyle->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (otherStyle->writingMode()) {
+    case TopToBottomWritingMode:
         return marginTop();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return marginBottom();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return marginLeft();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return marginRight();
     }
     ASSERT_NOT_REACHED();
@@ -1202,14 +1215,14 @@ Length RenderStyle::marginBeforeUsing(const RenderStyle* otherStyle) const
 
 Length RenderStyle::marginAfterUsing(const RenderStyle* otherStyle) const
 {
-    switch (otherStyle->blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (otherStyle->writingMode()) {
+    case TopToBottomWritingMode:
         return marginBottom();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return marginTop();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return marginRight();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return marginLeft();
     }
     ASSERT_NOT_REACHED();
@@ -1218,42 +1231,42 @@ Length RenderStyle::marginAfterUsing(const RenderStyle* otherStyle) const
 
 Length RenderStyle::marginStart() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? marginLeft() : marginRight();
-    return direction() == LTR ? marginTop() : marginBottom();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? marginLeft() : marginRight();
+    return isLeftToRightDirection() ? marginTop() : marginBottom();
 }
 
 Length RenderStyle::marginEnd() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? marginRight() : marginLeft();
-    return direction() == LTR ? marginBottom() : marginTop();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? marginRight() : marginLeft();
+    return isLeftToRightDirection() ? marginBottom() : marginTop();
 }
     
 Length RenderStyle::marginStartUsing(const RenderStyle* otherStyle) const
 {
-    if (otherStyle->isVerticalBlockFlow())
-        return otherStyle->direction() == LTR ? marginLeft() : marginRight();
-    return otherStyle->direction() == LTR ? marginTop() : marginBottom();
+    if (otherStyle->isHorizontalWritingMode())
+        return otherStyle->isLeftToRightDirection() ? marginLeft() : marginRight();
+    return otherStyle->isLeftToRightDirection() ? marginTop() : marginBottom();
 }
 
 Length RenderStyle::marginEndUsing(const RenderStyle* otherStyle) const
 {
-    if (otherStyle->isVerticalBlockFlow())
-        return otherStyle->direction() == LTR ? marginRight() : marginLeft();
-    return otherStyle->direction() == LTR ? marginBottom() : marginTop();
+    if (otherStyle->isHorizontalWritingMode())
+        return otherStyle->isLeftToRightDirection() ? marginRight() : marginLeft();
+    return otherStyle->isLeftToRightDirection() ? marginBottom() : marginTop();
 }
 
 Length RenderStyle::paddingBefore() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return paddingTop();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return paddingBottom();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return paddingLeft();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return paddingRight();
     }
     ASSERT_NOT_REACHED();
@@ -1262,14 +1275,14 @@ Length RenderStyle::paddingBefore() const
 
 Length RenderStyle::paddingAfter() const
 {
-    switch (blockFlow()) {
-    case TopToBottomBlockFlow:
+    switch (writingMode()) {
+    case TopToBottomWritingMode:
         return paddingBottom();
-    case BottomToTopBlockFlow:
+    case BottomToTopWritingMode:
         return paddingTop();
-    case LeftToRightBlockFlow:
+    case LeftToRightWritingMode:
         return paddingRight();
-    case RightToLeftBlockFlow:
+    case RightToLeftWritingMode:
         return paddingLeft();
     }
     ASSERT_NOT_REACHED();
@@ -1278,16 +1291,16 @@ Length RenderStyle::paddingAfter() const
 
 Length RenderStyle::paddingStart() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? paddingLeft() : paddingRight();
-    return direction() == LTR ? paddingTop() : paddingBottom();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? paddingLeft() : paddingRight();
+    return isLeftToRightDirection() ? paddingTop() : paddingBottom();
 }
 
 Length RenderStyle::paddingEnd() const
 {
-    if (isVerticalBlockFlow())
-        return direction() == LTR ? paddingRight() : paddingLeft();
-    return direction() == LTR ? paddingBottom() : paddingTop();
+    if (isHorizontalWritingMode())
+        return isLeftToRightDirection() ? paddingRight() : paddingLeft();
+    return isLeftToRightDirection() ? paddingBottom() : paddingTop();
 }
 
 } // namespace WebCore
diff --git a/WebCore/rendering/style/RenderStyle.h b/WebCore/rendering/style/RenderStyle.h
index 6ecbd56..587b473 100644
--- a/WebCore/rendering/style/RenderStyle.h
+++ b/WebCore/rendering/style/RenderStyle.h
@@ -29,7 +29,6 @@
 #include "AnimationList.h"
 #include "BorderData.h"
 #include "BorderValue.h"
-#include "CSSHelper.h"
 #include "CSSImageGeneratorValue.h"
 #include "CSSPrimitiveValue.h"
 #include "CSSPropertyNames.h"
@@ -179,7 +178,7 @@ protected:
                    (_force_backgrounds_to_white == other._force_backgrounds_to_white) &&
                    (_pointerEvents == other._pointerEvents) &&
                    (_insideLink == other._insideLink) &&
-                   (_blockFlow == other._blockFlow);
+                   (m_writingMode == other.m_writingMode);
         }
 
         bool operator!=(const InheritedFlags& other) const { return !(*this == other); }
@@ -207,7 +206,7 @@ protected:
         // 43 bits
 
         // CSS Text Layout Module Level 3: Vertical writing support
-        unsigned _blockFlow : 2; // EBlockFlowDirection
+        unsigned m_writingMode : 2; // WritingMode
         // 45 bits
     } inherited_flags;
 
@@ -284,7 +283,7 @@ protected:
         inherited_flags._force_backgrounds_to_white = false;
         inherited_flags._pointerEvents = initialPointerEvents();
         inherited_flags._insideLink = NotInsideLink;
-        inherited_flags._blockFlow = initialBlockFlow();
+        inherited_flags.m_writingMode = initialWritingMode();
 
         noninherited_flags._effectiveDisplay = noninherited_flags._originalDisplay = initialDisplay();
         noninherited_flags._overflowX = initialOverflowX();
@@ -307,10 +306,10 @@ protected:
     }
 
 private:
-    RenderStyle();
+    ALWAYS_INLINE RenderStyle();
     // used to create the default style.
-    RenderStyle(bool);
-    RenderStyle(const RenderStyle&);
+    ALWAYS_INLINE RenderStyle(bool);
+    ALWAYS_INLINE RenderStyle(const RenderStyle&);
 
 public:
     static PassRefPtr<RenderStyle> create();
@@ -476,6 +475,8 @@ public:
     float effectiveZoom() const { return rareInheritedData->m_effectiveZoom; }
 
     TextDirection direction() const { return static_cast<TextDirection>(inherited_flags._direction); }
+    bool isLeftToRightDirection() const { return direction() == LTR; }
+
     Length lineHeight() const { return inherited->line_height; }
     int computedLineHeight() const
     {
@@ -636,6 +637,11 @@ public:
     }
 
     const ShadowData* textShadow() const { return rareInheritedData->textShadow; }
+    void getTextShadowExtent(int& top, int& right, int& bottom, int& left) const { getShadowExtent(textShadow(), top, right, bottom, left); }
+    void getTextShadowHorizontalExtent(int& left, int& right) const { getShadowHorizontalExtent(textShadow(), left, right); }
+    void getTextShadowVerticalExtent(int& top, int& bottom) const { getShadowVerticalExtent(textShadow(), top, bottom); }
+    void getTextShadowInlineDirectionExtent(int& logicalLeft, int& logicalRight) { getShadowInlineDirectionExtent(textShadow(), logicalLeft, logicalRight); }
+
     float textStrokeWidth() const { return rareInheritedData->textStrokeWidth; }
     ColorSpace colorSpace() const { return static_cast<ColorSpace>(rareInheritedData->colorSpace); }
     float opacity() const { return rareNonInheritedData->opacity; }
@@ -650,9 +656,10 @@ public:
     EBoxAlignment boxPack() const { return static_cast<EBoxAlignment>(rareNonInheritedData->flexibleBox->pack); }
 
     const ShadowData* boxShadow() const { return rareNonInheritedData->m_boxShadow.get(); }
-    void getBoxShadowExtent(int &top, int &right, int &bottom, int &left) const;
-    void getBoxShadowHorizontalExtent(int &left, int &right) const;
-    void getBoxShadowVerticalExtent(int &top, int &bottom) const;
+    void getBoxShadowExtent(int& top, int& right, int& bottom, int& left) const { getShadowExtent(boxShadow(), top, right, bottom, left); }
+    void getBoxShadowHorizontalExtent(int& left, int& right) const { getShadowHorizontalExtent(boxShadow(), left, right); }
+    void getBoxShadowVerticalExtent(int& top, int& bottom) const { getShadowVerticalExtent(boxShadow(), top, bottom); }
+    void getBoxShadowInlineDirectionExtent(int& logicalLeft, int& logicalRight) { getShadowInlineDirectionExtent(boxShadow(), logicalLeft, logicalRight); }
 
     StyleReflection* boxReflect() const { return rareNonInheritedData->m_boxReflect.get(); }
     EBoxSizing boxSizing() const { return m_box->boxSizing(); }
@@ -742,9 +749,11 @@ public:
     bool textSizeAdjust() const { return rareInheritedData->textSizeAdjust; }
     ETextSecurity textSecurity() const { return static_cast<ETextSecurity>(rareInheritedData->textSecurity); }
 
-    EBlockFlowDirection blockFlow() const { return static_cast<EBlockFlowDirection>(inherited_flags._blockFlow); }
-    bool isVerticalBlockFlow() const { return blockFlow() == TopToBottomBlockFlow || blockFlow() == BottomToTopBlockFlow; }
+    WritingMode writingMode() const { return static_cast<WritingMode>(inherited_flags.m_writingMode); }
+    bool isHorizontalWritingMode() const { return writingMode() == TopToBottomWritingMode || writingMode() == BottomToTopWritingMode; }
+    bool isFlippedLinesWritingMode() const { return writingMode() == LeftToRightWritingMode || writingMode() == BottomToTopWritingMode; }
 
+<<<<<<< HEAD
 #ifdef ANDROID_CSS_RING
     // called when building nav cache to determine if the ring data is unchanged
     const void* ringData() const { return reinterpret_cast<const void*>(rareInheritedData.get()); }
@@ -762,6 +771,10 @@ public:
     Color tapHighlightColor() const { return rareInheritedData->tapHighlightColor; }
 #endif
 
+=======
+    ESpeak speak() { return static_cast<ESpeak>(rareInheritedData->speak); }
+        
+>>>>>>> webkit.org at r70209
 // attribute setter methods
 
     void setDisplay(EDisplay v) { noninherited_flags._effectiveDisplay = v; }
@@ -1054,6 +1067,7 @@ public:
     void setTransformOriginX(Length l) { SET_VAR(rareNonInheritedData.access()->m_transform, m_x, l); }
     void setTransformOriginY(Length l) { SET_VAR(rareNonInheritedData.access()->m_transform, m_y, l); }
     void setTransformOriginZ(float f) { SET_VAR(rareNonInheritedData.access()->m_transform, m_z, f); }
+    void setSpeak(ESpeak s) { SET_VAR(rareInheritedData, speak, s); }
     // End CSS3 Setters
 
     // Apple-specific property setters
@@ -1156,7 +1170,7 @@ public:
                originalDisplay() == INLINE_BOX || originalDisplay() == INLINE_TABLE;
     }
 
-    void setBlockFlow(EBlockFlowDirection v) { inherited_flags._blockFlow = v; }
+    void setWritingMode(WritingMode v) { inherited_flags.m_writingMode = v; }
 
     // To tell if this style matched attribute selectors. This makes it impossible to share.
     bool affectedByAttributeSelectors() const { return m_affectedByAttributeSelectors; }
@@ -1197,7 +1211,7 @@ public:
     static ECaptionSide initialCaptionSide() { return CAPTOP; }
     static EClear initialClear() { return CNONE; }
     static TextDirection initialDirection() { return LTR; }
-    static EBlockFlowDirection initialBlockFlow() { return TopToBottomBlockFlow; }
+    static WritingMode initialWritingMode() { return TopToBottomWritingMode; }
     static EDisplay initialDisplay() { return INLINE; }
     static EEmptyCell initialEmptyCells() { return SHOW; }
     static EFloat initialFloating() { return FNONE; }
@@ -1262,6 +1276,7 @@ public:
     static EKHTMLLineBreak initialKHTMLLineBreak() { return LBNORMAL; }
     static EMatchNearestMailBlockquoteColor initialMatchNearestMailBlockquoteColor() { return BCNORMAL; }
     static const AtomicString& initialHighlight() { return nullAtom; }
+    static ESpeak initialSpeak() { return SpeakNormal; }
     static Hyphens initialHyphens() { return HyphensManual; }
     static const AtomicString& initialHyphenationString() { return nullAtom; }
     static const AtomicString& initialHyphenationLocale() { return nullAtom; }
@@ -1309,6 +1324,14 @@ public:
 #endif
 
 private:
+    void getShadowExtent(const ShadowData*, int& top, int& right, int& bottom, int& left) const;
+    void getShadowHorizontalExtent(const ShadowData*, int& left, int& right) const;
+    void getShadowVerticalExtent(const ShadowData*, int& top, int& bottom) const;
+    void getShadowInlineDirectionExtent(const ShadowData* shadow, int& logicalLeft, int& logicalRight) const
+    {
+        return isHorizontalWritingMode() ? getShadowHorizontalExtent(shadow, logicalLeft, logicalRight) : getShadowVerticalExtent(shadow, logicalLeft, logicalRight);
+    }
+
     // Color accessors are all private to make sure callers use visitedDependentColor instead to access them.
     const Color& borderLeftColor() const { return surround->border.left().color(); }
     const Color& borderRightColor() const { return surround->border.right().color(); }
diff --git a/WebCore/rendering/style/RenderStyleConstants.h b/WebCore/rendering/style/RenderStyleConstants.h
index 94d30d5..0112c03 100644
--- a/WebCore/rendering/style/RenderStyleConstants.h
+++ b/WebCore/rendering/style/RenderStyleConstants.h
@@ -129,8 +129,8 @@ enum EUnicodeBidi {
 };
 
 // CSS Text Layout Module Level 3: Vertical writing support
-enum EBlockFlowDirection {
-    TopToBottomBlockFlow, RightToLeftBlockFlow, LeftToRightBlockFlow, BottomToTopBlockFlow
+enum WritingMode {
+    TopToBottomWritingMode, RightToLeftWritingMode, LeftToRightWritingMode, BottomToTopWritingMode
 };
 
 enum EFillAttachment {
@@ -415,6 +415,8 @@ enum ELineClampType { LineClampLineCount, LineClampPercentage };
 
 enum Hyphens { HyphensNone, HyphensManual, HyphensAuto };
 
+enum ESpeak { SpeakNone, SpeakNormal, SpeakSpellOut, SpeakDigits, SpeakLiteralPunctuation, SpeakNoPunctuation };
+    
 } // namespace WebCore
 
 #endif // RenderStyleConstants_h
diff --git a/WebCore/rendering/style/SVGRenderStyle.cpp b/WebCore/rendering/style/SVGRenderStyle.cpp
index 7d1ad3b..28f80f2 100644
--- a/WebCore/rendering/style/SVGRenderStyle.cpp
+++ b/WebCore/rendering/style/SVGRenderStyle.cpp
@@ -138,7 +138,7 @@ StyleDifference SVGRenderStyle::diff(const SVGRenderStyle* other) const
     if (resources != other->resources)
         return StyleDifferenceLayout;
 
-    // If markers change, we need a relayout, as marker boundaries are cached in RenderPath.
+    // If markers change, we need a relayout, as marker boundaries are cached in RenderSVGPath.
     if (inheritedResources != other->inheritedResources)
         return StyleDifferenceLayout;
 
@@ -190,7 +190,7 @@ StyleDifference SVGRenderStyle::diff(const SVGRenderStyle* other) const
             return StyleDifferenceRepaint;
     }
 
-    // If fill changes, we just need to repaint. Fill boundaries are not influenced by this, only by the Path, that RenderPath contains.
+    // If fill changes, we just need to repaint. Fill boundaries are not influenced by this, only by the Path, that RenderSVGPath contains.
     if (fill != other->fill)
         return StyleDifferenceRepaint;
 
diff --git a/WebCore/rendering/style/SVGRenderStyle.h b/WebCore/rendering/style/SVGRenderStyle.h
index d57e4cf..8f0be39 100644
--- a/WebCore/rendering/style/SVGRenderStyle.h
+++ b/WebCore/rendering/style/SVGRenderStyle.h
@@ -67,7 +67,7 @@ public:
     static LineJoin initialJoinStyle() { return MiterJoin; }
     static EShapeRendering initialShapeRendering() { return SR_AUTO; }
     static ETextAnchor initialTextAnchor() { return TA_START; }
-    static EWritingMode initialWritingMode() { return WM_LRTB; }
+    static SVGWritingMode initialWritingMode() { return WM_LRTB; }
     static EGlyphOrientation initialGlyphOrientationHorizontal() { return GO_0DEG; }
     static EGlyphOrientation initialGlyphOrientationVertical() { return GO_AUTO; }
     static float initialFillOpacity() { return 1.0f; }
@@ -132,7 +132,7 @@ public:
     void setJoinStyle(LineJoin val) { svg_inherited_flags._joinStyle = val; }
     void setShapeRendering(EShapeRendering val) { svg_inherited_flags._shapeRendering = val; }
     void setTextAnchor(ETextAnchor val) { svg_inherited_flags._textAnchor = val; }
-    void setWritingMode(EWritingMode val) { svg_inherited_flags._writingMode = val; }
+    void setWritingMode(SVGWritingMode val) { svg_inherited_flags._writingMode = val; }
     void setGlyphOrientationHorizontal(EGlyphOrientation val) { svg_inherited_flags._glyphOrientationHorizontal = val; }
     void setGlyphOrientationVertical(EGlyphOrientation val) { svg_inherited_flags._glyphOrientationVertical = val; }
     
@@ -281,7 +281,7 @@ public:
     LineJoin joinStyle() const { return (LineJoin) svg_inherited_flags._joinStyle; }
     EShapeRendering shapeRendering() const { return (EShapeRendering) svg_inherited_flags._shapeRendering; }
     ETextAnchor textAnchor() const { return (ETextAnchor) svg_inherited_flags._textAnchor; }
-    EWritingMode writingMode() const { return (EWritingMode) svg_inherited_flags._writingMode; }
+    SVGWritingMode writingMode() const { return (SVGWritingMode) svg_inherited_flags._writingMode; }
     EGlyphOrientation glyphOrientationHorizontal() const { return (EGlyphOrientation) svg_inherited_flags._glyphOrientationHorizontal; }
     EGlyphOrientation glyphOrientationVertical() const { return (EGlyphOrientation) svg_inherited_flags._glyphOrientationVertical; }
     float fillOpacity() const { return fill->opacity; }
@@ -314,6 +314,7 @@ public:
     bool hasMarkers() const { return !markerStartResource().isEmpty() || !markerMidResource().isEmpty() || !markerEndResource().isEmpty(); }
     bool hasStroke() const { return strokePaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE; }
     bool hasFill() const { return fillPaint()->paintType() != SVGPaint::SVG_PAINTTYPE_NONE; }
+    bool isVerticalWritingMode() const { return writingMode() == WM_TBRL || writingMode() == WM_TB; }
 
 protected:
     // inherit
@@ -350,7 +351,7 @@ protected:
         unsigned _textAnchor : 2; // ETextAnchor
         unsigned _colorInterpolation : 2; // EColorInterpolation
         unsigned _colorInterpolationFilters : 2; // EColorInterpolation
-        unsigned _writingMode : 3; // EWritingMode
+        unsigned _writingMode : 3; // SVGWritingMode
         unsigned _glyphOrientationHorizontal : 3; // EGlyphOrientation
         unsigned _glyphOrientationVertical : 3; // EGlyphOrientation
     } svg_inherited_flags;
diff --git a/WebCore/rendering/style/SVGRenderStyleDefs.h b/WebCore/rendering/style/SVGRenderStyleDefs.h
index 339bb77..de058a2 100644
--- a/WebCore/rendering/style/SVGRenderStyleDefs.h
+++ b/WebCore/rendering/style/SVGRenderStyleDefs.h
@@ -64,7 +64,7 @@ namespace WebCore {
         SR_AUTO, SR_OPTIMIZESPEED, SR_CRISPEDGES, SR_GEOMETRICPRECISION
     };
 
-    enum EWritingMode {
+    enum SVGWritingMode {
         WM_LRTB, WM_LR, WM_RLTB, WM_RL, WM_TBRL, WM_TB
     };
 
diff --git a/WebKit/win/WebIconFetcher.h b/WebCore/rendering/style/StyleAllInOne.cpp
index 694aebf..25b539f 100644
--- a/WebKit/win/WebIconFetcher.h
+++ b/WebCore/rendering/style/StyleAllInOne.cpp
@@ -1,52 +1,49 @@
-/*

- * Copyright (C) 2008 Apple Inc. All Rights Reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in the

- *    documentation and/or other materials provided with the distribution.

- *

- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

- */

-

-#ifndef WebIconFetcher_h

-#define WebIconFetcher_h

-

-#include "WebKit.h"

-#include <WebCore/IconFetcher.h>

-

-class WebIconFetcher : public IWebIconFetcher {

-public:

-    static WebIconFetcher* fetchApplicationIcon(WebCore::Frame*, IWebIconFetcherDelegate*);

-

-    // IUnknown

-    virtual HRESULT STDMETHODCALLTYPE QueryInterface(REFIID riid, void** ppvObject);

-    virtual ULONG STDMETHODCALLTYPE AddRef();

-    virtual ULONG STDMETHODCALLTYPE Release();

-

-    // IWebIconFetcher

-    virtual HRESULT STDMETHODCALLTYPE cancel();

-

-private:

-    WebIconFetcher(PassRefPtr<WebCore::IconFetcher>);

-    ~WebIconFetcher();

-

-    ULONG m_refCount;

-    RefPtr<WebCore::IconFetcher> m_iconFetcher;

-};

-

-#endif // WebIconFetcher_h

+/*
+ * Copyright (C) 2010 Apple Inc. All Rights Reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+ * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+ * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+ * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+ * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+ */
+
+// This all-in-one cpp file cuts down on template bloat to allow us to build our Windows release build.
+
+#include "ContentData.cpp"
+#include "CounterDirectives.cpp"
+#include "FillLayer.cpp"
+#include "KeyframeList.cpp"
+#include "NinePieceImage.cpp"
+#include "RenderStyle.cpp"
+#include "SVGRenderStyle.cpp"
+#include "SVGRenderStyleDefs.cpp"
+#include "ShadowData.cpp"
+#include "StyleBackgroundData.cpp"
+#include "StyleBoxData.cpp"
+#include "StyleCachedImage.cpp"
+#include "StyleFlexibleBoxData.cpp"
+#include "StyleGeneratedImage.cpp"
+#include "StyleInheritedData.cpp"
+#include "StyleMarqueeData.cpp"
+#include "StyleMultiColData.cpp"
+#include "StyleRareInheritedData.cpp"
+#include "StyleRareNonInheritedData.cpp"
+#include "StyleSurroundData.cpp"
+#include "StyleTransformData.cpp"
+#include "StyleVisualData.cpp"
diff --git a/WebCore/rendering/style/StyleRareInheritedData.cpp b/WebCore/rendering/style/StyleRareInheritedData.cpp
index 42f2030..af2b555 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.cpp
+++ b/WebCore/rendering/style/StyleRareInheritedData.cpp
@@ -57,7 +57,8 @@ StyleRareInheritedData::StyleRareInheritedData()
     , textSizeAdjust(RenderStyle::initialTextSizeAdjust())
     , resize(RenderStyle::initialResize())
     , userSelect(RenderStyle::initialUserSelect())
-    , colorSpace(DeviceColorSpace)
+    , colorSpace(ColorSpaceDeviceRGB)
+    , speak(SpeakNormal)
     , hyphens(HyphensManual)
 {
 }
@@ -98,6 +99,7 @@ StyleRareInheritedData::StyleRareInheritedData(const StyleRareInheritedData& o)
     , resize(o.resize)
     , userSelect(o.userSelect)
     , colorSpace(o.colorSpace)
+    , speak(o.speak)
     , hyphens(o.hyphens)
     , hyphenationString(o.hyphenationString)
     , hyphenationLocale(o.hyphenationLocale)
@@ -154,6 +156,7 @@ bool StyleRareInheritedData::operator==(const StyleRareInheritedData& o) const
         && resize == o.resize
         && userSelect == o.userSelect
         && colorSpace == o.colorSpace
+        && speak == o.speak
         && hyphens == o.hyphens
         && hyphenationString == o.hyphenationString
         && hyphenationLocale == o.hyphenationLocale;
diff --git a/WebCore/rendering/style/StyleRareInheritedData.h b/WebCore/rendering/style/StyleRareInheritedData.h
index ba914d4..4ebbf88 100644
--- a/WebCore/rendering/style/StyleRareInheritedData.h
+++ b/WebCore/rendering/style/StyleRareInheritedData.h
@@ -91,6 +91,7 @@ public:
     unsigned resize : 2; // EResize
     unsigned userSelect : 1;  // EUserSelect
     unsigned colorSpace : 1; // ColorSpace
+    unsigned speak : 3; // ESpeak
     unsigned hyphens : 2; // Hyphens
 
     AtomicString hyphenationString;
diff --git a/WebCore/rendering/RenderSVGInline.cpp b/WebCore/rendering/svg/RenderSVGInline.cpp
index 5d12a61..4d0c533 100644
--- a/WebCore/rendering/RenderSVGInline.cpp
+++ b/WebCore/rendering/svg/RenderSVGInline.cpp
@@ -1,8 +1,7 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
  * Copyright (C) 2006 Apple Inc. All rights reserved.
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -27,6 +26,7 @@
 #include "RenderSVGInline.h"
 
 #include "RenderSVGResource.h"
+#include "RenderSVGText.h"
 #include "SVGInlineFlowBox.h"
 
 namespace WebCore {
@@ -45,7 +45,7 @@ InlineFlowBox* RenderSVGInline::createInlineFlowBox()
 
 FloatRect RenderSVGInline::objectBoundingBox() const
 {
-    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
+    if (const RenderObject* object = RenderSVGText::locateRenderSVGTextAncestor(this))
         return object->objectBoundingBox();
 
     return FloatRect();
@@ -53,7 +53,7 @@ FloatRect RenderSVGInline::objectBoundingBox() const
 
 FloatRect RenderSVGInline::strokeBoundingBox() const
 {
-    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
+    if (const RenderObject* object = RenderSVGText::locateRenderSVGTextAncestor(this))
         return object->strokeBoundingBox();
 
     return FloatRect();
@@ -61,7 +61,7 @@ FloatRect RenderSVGInline::strokeBoundingBox() const
 
 FloatRect RenderSVGInline::repaintRectInLocalCoordinates() const
 {
-    if (const RenderObject* object = SVGRenderSupport::findTextRootObject(this))
+    if (const RenderObject* object = RenderSVGText::locateRenderSVGTextAncestor(this))
         return object->repaintRectInLocalCoordinates();
 
     return FloatRect();
@@ -84,7 +84,7 @@ void RenderSVGInline::mapLocalToContainer(RenderBoxModelObject* repaintContainer
 
 void RenderSVGInline::absoluteQuads(Vector<FloatQuad>& quads)
 {
-    const RenderObject* object = SVGRenderSupport::findTextRootObject(this);
+    RenderObject* object = RenderSVGText::locateRenderSVGTextAncestor(this);
     if (!object)
         return;
 
diff --git a/WebCore/rendering/RenderSVGInline.h b/WebCore/rendering/svg/RenderSVGInline.h
index 92b6fe7..d7b7e66 100644
--- a/WebCore/rendering/RenderSVGInline.h
+++ b/WebCore/rendering/svg/RenderSVGInline.h
@@ -33,7 +33,7 @@ namespace WebCore {
 
 class RenderSVGInline : public RenderInline {
 public:
-    RenderSVGInline(Node*);
+    explicit RenderSVGInline(Node*);
 
     virtual const char* renderName() const { return "RenderSVGInline"; }
     virtual bool requiresLayer() const { return false; }
diff --git a/WebCore/rendering/svg/RenderSVGInlineText.cpp b/WebCore/rendering/svg/RenderSVGInlineText.cpp
new file mode 100644
index 0000000..49727ee
--- /dev/null
+++ b/WebCore/rendering/svg/RenderSVGInlineText.cpp
@@ -0,0 +1,196 @@
+/*
+ * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
+ * Copyright (C) 2006 Apple Computer Inc.
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Rob Buis <buis@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "RenderSVGInlineText.h"
+
+#include "FloatConversion.h"
+#include "FloatQuad.h"
+#include "RenderBlock.h"
+#include "RenderSVGRoot.h"
+#include "RenderSVGText.h"
+#include "SVGInlineTextBox.h"
+#include "SVGRootInlineBox.h"
+#include "VisiblePosition.h"
+
+namespace WebCore {
+
+static PassRefPtr<StringImpl> applySVGWhitespaceRules(PassRefPtr<StringImpl> string, bool preserveWhiteSpace)
+{
+    if (preserveWhiteSpace) {
+        // Spec: When xml:space="preserve", the SVG user agent will do the following using a
+        // copy of the original character data content. It will convert all newline and tab
+        // characters into space characters. Then, it will draw all space characters, including
+        // leading, trailing and multiple contiguous space characters.
+        RefPtr<StringImpl> newString = string->replace('\t', ' ');
+        newString = newString->replace('\n', ' ');
+        newString = newString->replace('\r', ' ');
+        return newString.release();
+    }
+
+    // Spec: When xml:space="default", the SVG user agent will do the following using a
+    // copy of the original character data content. First, it will remove all newline
+    // characters. Then it will convert all tab characters into space characters.
+    // Then, it will strip off all leading and trailing space characters.
+    // Then, all contiguous space characters will be consolidated.
+    RefPtr<StringImpl> newString = string->replace('\n', StringImpl::empty());
+    newString = newString->replace('\r', StringImpl::empty());
+    newString = newString->replace('\t', ' ');
+    return newString.release();
+}
+
+RenderSVGInlineText::RenderSVGInlineText(Node* n, PassRefPtr<StringImpl> string)
+    : RenderText(n, applySVGWhitespaceRules(string, false))
+{
+}
+
+void RenderSVGInlineText::styleDidChange(StyleDifference diff, const RenderStyle* oldStyle)
+{
+    RenderText::styleDidChange(diff, oldStyle);
+
+    if (diff == StyleDifferenceLayout) {
+        // The text metrics may be influenced by style changes.
+        if (RenderSVGText* textRenderer = RenderSVGText::locateRenderSVGTextAncestor(this))
+            textRenderer->setNeedsPositioningValuesUpdate();
+    }
+
+    const RenderStyle* newStyle = style();
+    if (!newStyle || newStyle->whiteSpace() != PRE)
+        return;
+
+    if (!oldStyle || oldStyle->whiteSpace() != PRE)
+        setText(applySVGWhitespaceRules(originalText(), true), true);
+}
+
+InlineTextBox* RenderSVGInlineText::createTextBox()
+{
+    InlineTextBox* box = new (renderArena()) SVGInlineTextBox(this);
+    box->setHasVirtualLogicalHeight();
+    return box;
+}
+
+IntRect RenderSVGInlineText::localCaretRect(InlineBox*, int, int*)
+{
+    return IntRect();
+}
+
+IntRect RenderSVGInlineText::linesBoundingBox() const
+{
+    IntRect boundingBox;
+    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox())
+        boundingBox.unite(box->calculateBoundaries());
+    return boundingBox;
+}
+
+bool RenderSVGInlineText::characterStartsNewTextChunk(int position) const
+{
+    ASSERT(m_attributes.xValues().size() == textLength());
+    ASSERT(m_attributes.yValues().size() == textLength());
+    ASSERT(position >= 0);
+    ASSERT(position < static_cast<int>(textLength()));
+
+    // Each <textPath> element starts a new text chunk, regardless of any x/y values.
+    if (!position && parent()->isSVGTextPath() && !previousSibling())
+        return true;
+
+    int currentPosition = 0;
+    unsigned size = m_attributes.textMetricsValues().size();
+    for (unsigned i = 0; i < size; ++i) {
+        const SVGTextMetrics& metrics = m_attributes.textMetricsValues().at(i);
+
+        // We found the desired character.
+        if (currentPosition == position) {
+            return m_attributes.xValues().at(position) != SVGTextLayoutAttributes::emptyValue()
+                || m_attributes.yValues().at(position) != SVGTextLayoutAttributes::emptyValue();
+        }
+
+        currentPosition += metrics.length();
+        if (currentPosition > position)
+            break;
+    }
+
+    // The desired position is available in the x/y list, but not in the character data values list.
+    // That means the previous character data described a single glyph, consisting of multiple unicode characters.
+    // The consequence is that the desired character does not define a new absolute x/y position, even if present in the x/y test.
+    // This code is tested by svg/W3C-SVG-1.1/text-text-06-t.svg (and described in detail, why this influences chunk detection).
+    return false;
+}
+
+VisiblePosition RenderSVGInlineText::positionForPoint(const IntPoint& point)
+{
+    if (!firstTextBox() || !textLength())
+        return createVisiblePosition(0, DOWNSTREAM);
+
+    RenderStyle* style = this->style();
+    ASSERT(style);
+    int baseline = style->font().ascent();
+
+    RenderBlock* containingBlock = this->containingBlock();
+    ASSERT(containingBlock);
+
+    // Map local point to absolute point, as the character origins stored in the text fragments use absolute coordinates.
+    FloatPoint absolutePoint(point);
+    absolutePoint.move(containingBlock->x(), containingBlock->y());
+
+    float closestDistance = std::numeric_limits<float>::max();
+    float closestDistancePosition = 0;
+    const SVGTextFragment* closestDistanceFragment = 0;
+    SVGInlineTextBox* closestDistanceBox = 0;
+
+    for (InlineTextBox* box = firstTextBox(); box; box = box->nextTextBox()) {
+        ASSERT(box->isSVGInlineTextBox());
+        SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(box);
+        Vector<SVGTextFragment>& fragments = textBox->textFragments();
+
+        unsigned textFragmentsSize = fragments.size();
+        for (unsigned i = 0; i < textFragmentsSize; ++i) {
+            const SVGTextFragment& fragment = fragments.at(i);
+            FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height);
+            if (!fragment.transform.isIdentity())
+                fragmentRect = fragment.transform.mapRect(fragmentRect);
+
+            float distance = powf(fragmentRect.x() - absolutePoint.x(), 2) +
+                             powf(fragmentRect.y() + fragmentRect.height() / 2 - absolutePoint.y(), 2);
+
+            if (distance < closestDistance) {
+                closestDistance = distance;
+                closestDistanceBox = textBox;
+                closestDistanceFragment = &fragment;
+                closestDistancePosition = fragmentRect.x();
+            }
+        }
+    }
+
+    if (!closestDistanceFragment)
+        return createVisiblePosition(0, DOWNSTREAM);
+
+    int offset = closestDistanceBox->offsetForPositionInFragment(*closestDistanceFragment, absolutePoint.x() - closestDistancePosition, true);
+    return createVisiblePosition(offset + closestDistanceBox->start(), offset > 0 ? VP_UPSTREAM_IF_POSSIBLE : DOWNSTREAM);
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGInlineText.h b/WebCore/rendering/svg/RenderSVGInlineText.h
index f606918..926ec43 100644
--- a/WebCore/rendering/RenderSVGInlineText.h
+++ b/WebCore/rendering/svg/RenderSVGInlineText.h
@@ -31,11 +31,16 @@
 
 namespace WebCore {
 
+class SVGInlineTextBox;
+
 class RenderSVGInlineText : public RenderText {
 public:
     RenderSVGInlineText(Node*, PassRefPtr<StringImpl>);
 
     bool characterStartsNewTextChunk(int position) const;
+
+    SVGTextLayoutAttributes& layoutAttributes() { return m_attributes; }
+    const SVGTextLayoutAttributes& layoutAttributes() const { return m_attributes; }
     void storeLayoutAttributes(const SVGTextLayoutAttributes& attributes) { m_attributes = attributes; }
 
 private:
@@ -50,6 +55,7 @@ private:
     virtual bool requiresLayer() const { return false; }
     virtual bool isSVGInlineText() const { return true; }
 
+    virtual VisiblePosition positionForPoint(const IntPoint&);
     virtual IntRect localCaretRect(InlineBox*, int caretOffset, int* extraWidthToEndOfLine = 0);
     virtual IntRect linesBoundingBox() const;
     virtual InlineTextBox* createTextBox();
@@ -57,8 +63,22 @@ private:
     SVGTextLayoutAttributes m_attributes;
 };
 
+inline RenderSVGInlineText* toRenderSVGInlineText(RenderObject* object)
+{
+    ASSERT(!object || object->isSVGInlineText());
+    return static_cast<RenderSVGInlineText*>(object);
 }
 
-#endif // ENABLE(SVG)
+inline const RenderSVGInlineText* toRenderSVGInlineText(const RenderObject* object)
+{
+    ASSERT(!object || object->isSVGInlineText());
+    return static_cast<const RenderSVGInlineText*>(object);
+}
 
-#endif // !RenderSVGInlineText_h
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGInlineText(const RenderSVGInlineText*);
+
+}
+
+#endif // ENABLE(SVG)
+#endif // RenderSVGInlineText_h
diff --git a/WebCore/rendering/RenderPath.cpp b/WebCore/rendering/svg/RenderSVGPath.cpp
index cbe1900..483303f 100644
--- a/WebCore/rendering/RenderPath.cpp
+++ b/WebCore/rendering/svg/RenderSVGPath.cpp
@@ -26,7 +26,7 @@
 #include "config.h"
 
 #if ENABLE(SVG)
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 
 #include "FloatPoint.h"
 #include "FloatQuad.h"
@@ -35,6 +35,7 @@
 #include "PointerEventsHitRules.h"
 #include "RenderSVGContainer.h"
 #include "RenderSVGResourceMarker.h"
+#include "RenderSVGResourceSolidColor.h"
 #include "SVGRenderSupport.h"
 #include "SVGResources.h"
 #include "SVGStyledTransformableElement.h"
@@ -65,7 +66,7 @@ private:
     RenderStyle* m_style;
 };
 
-RenderPath::RenderPath(SVGStyledTransformableElement* node)
+RenderSVGPath::RenderSVGPath(SVGStyledTransformableElement* node)
     : RenderSVGModelObject(node)
     , m_needsBoundariesUpdate(false) // default is false, the cached rects are empty from the beginning
     , m_needsPathUpdate(true) // default is true, so we grab a Path object once from SVGStyledTransformableElement
@@ -73,30 +74,36 @@ RenderPath::RenderPath(SVGStyledTransformableElement* node)
 {
 }
 
-bool RenderPath::fillContains(const FloatPoint& point, bool requiresFill, WindRule fillRule)
+RenderSVGPath::~RenderSVGPath()
+{
+}
+
+bool RenderSVGPath::fillContains(const FloatPoint& point, bool requiresFill, WindRule fillRule)
 {
     if (!m_fillBoundingBox.contains(point))
         return false;
 
-    if (requiresFill && !RenderSVGResource::fillPaintingResource(this, style()))
+    Color fallbackColor;
+    if (requiresFill && !RenderSVGResource::fillPaintingResource(this, style(), fallbackColor))
         return false;
 
     return m_path.contains(point, fillRule);
 }
 
-bool RenderPath::strokeContains(const FloatPoint& point, bool requiresStroke)
+bool RenderSVGPath::strokeContains(const FloatPoint& point, bool requiresStroke)
 {
     if (!m_strokeAndMarkerBoundingBox.contains(point))
         return false;
 
-    if (requiresStroke && !RenderSVGResource::strokePaintingResource(this, style()))
+    Color fallbackColor;
+    if (requiresStroke && !RenderSVGResource::strokePaintingResource(this, style(), fallbackColor))
         return false;
 
     BoundingRectStrokeStyleApplier strokeStyle(this, style());
     return m_path.strokeContains(&strokeStyle, point);
 }
 
-void RenderPath::layout()
+void RenderSVGPath::layout()
 {
     LayoutRepainter repainter(*this, checkForRepaintDuringLayout() && selfNeedsLayout());
     SVGStyledTransformableElement* element = static_cast<SVGStyledTransformableElement*>(node());
@@ -105,7 +112,8 @@ void RenderPath::layout()
 
     bool needsPathUpdate = m_needsPathUpdate;
     if (needsPathUpdate) {
-        m_path = element->toPathData();
+        m_path.clear();
+        element->toPathData(m_path);
         m_needsPathUpdate = false;
         updateCachedBoundariesInParents = true;
     }
@@ -138,18 +146,26 @@ void RenderPath::layout()
     setNeedsLayout(false);
 }
 
-void RenderPath::fillAndStrokePath(GraphicsContext* context)
+void RenderSVGPath::fillAndStrokePath(GraphicsContext* context)
 {
     context->beginPath();
     RenderStyle* style = this->style();
 
-    if (RenderSVGResource* fillPaintingResource = RenderSVGResource::fillPaintingResource(this, style)) {
+    Color fallbackColor;
+    if (RenderSVGResource* fillPaintingResource = RenderSVGResource::fillPaintingResource(this, style, fallbackColor)) {
         context->addPath(m_path);
         if (fillPaintingResource->applyResource(this, style, context, ApplyToFillMode))
             fillPaintingResource->postApplyResource(this, context, ApplyToFillMode);
+        else if (fallbackColor.isValid()) {
+            RenderSVGResourceSolidColor* fallbackResource = RenderSVGResource::sharedSolidPaintingResource();
+            fallbackResource->setColor(fallbackColor);
+            if (fallbackResource->applyResource(this, style, context, ApplyToFillMode))
+                fallbackResource->postApplyResource(this, context, ApplyToFillMode);
+        }
     }
 
-    RenderSVGResource* strokePaintingResource = RenderSVGResource::strokePaintingResource(this, style);
+    fallbackColor = Color();
+    RenderSVGResource* strokePaintingResource = RenderSVGResource::strokePaintingResource(this, style, fallbackColor);
     if (!strokePaintingResource)
         return;
 
@@ -172,12 +188,18 @@ void RenderPath::fillAndStrokePath(GraphicsContext* context)
 
     if (strokePaintingResource->applyResource(this, style, context, ApplyToStrokeMode))
         strokePaintingResource->postApplyResource(this, context, ApplyToStrokeMode);
+    else if (fallbackColor.isValid()) {
+        RenderSVGResourceSolidColor* fallbackResource = RenderSVGResource::sharedSolidPaintingResource();
+        fallbackResource->setColor(fallbackColor);
+        if (fallbackResource->applyResource(this, style, context, ApplyToStrokeMode))
+            fallbackResource->postApplyResource(this, context, ApplyToStrokeMode);
+    }
 
     if (restoreContext)
         context->restore();
 }
 
-void RenderPath::paint(PaintInfo& paintInfo, int, int)
+void RenderSVGPath::paint(PaintInfo& paintInfo, int, int)
 {
     if (paintInfo.context->paintingDisabled() || style()->visibility() == HIDDEN || m_path.isEmpty())
         return;
@@ -219,14 +241,14 @@ void RenderPath::paint(PaintInfo& paintInfo, int, int)
 
 // This method is called from inside paintOutline() since we call paintOutline()
 // while transformed to our coord system, return local coords
-void RenderPath::addFocusRingRects(Vector<IntRect>& rects, int, int) 
+void RenderSVGPath::addFocusRingRects(Vector<IntRect>& rects, int, int) 
 {
     IntRect rect = enclosingIntRect(repaintRectInLocalCoordinates());
     if (!rect.isEmpty())
         rects.append(rect);
 }
 
-bool RenderPath::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
+bool RenderSVGPath::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult& result, const FloatPoint& pointInParent, HitTestAction hitTestAction)
 {
     // We only draw in the forground phase, so we only hit-test then.
     if (hitTestAction != HitTestForeground)
@@ -253,7 +275,7 @@ bool RenderPath::nodeAtFloatPoint(const HitTestRequest& request, HitTestResult&
     return false;
 }
 
-FloatRect RenderPath::calculateMarkerBoundsIfNeeded()
+FloatRect RenderSVGPath::calculateMarkerBoundsIfNeeded()
 {
     SVGElement* svgElement = static_cast<SVGElement*>(node());
     ASSERT(svgElement && svgElement->document());
@@ -280,7 +302,7 @@ FloatRect RenderPath::calculateMarkerBoundsIfNeeded()
     return m_markerLayoutInfo.calculateBoundaries(markerStart, markerMid, markerEnd, svgStyle->strokeWidth().value(svgElement), m_path);
 }
 
-void RenderPath::updateCachedBoundaries()
+void RenderSVGPath::updateCachedBoundaries()
 {
     if (m_path.isEmpty()) {
         m_fillBoundingBox = FloatRect();
diff --git a/WebCore/rendering/RenderPath.h b/WebCore/rendering/svg/RenderSVGPath.h
index 1d35a01..41b0e51 100644
--- a/WebCore/rendering/RenderPath.h
+++ b/WebCore/rendering/svg/RenderSVGPath.h
@@ -21,8 +21,8 @@
     Boston, MA 02110-1301, USA.
 */
 
-#ifndef RenderPath_h
-#define RenderPath_h
+#ifndef RenderSVGPath_h
+#define RenderSVGPath_h
 
 #if ENABLE(SVG)
 #include "AffineTransform.h"
@@ -36,9 +36,10 @@ class FloatPoint;
 class RenderSVGContainer;
 class SVGStyledTransformableElement;
 
-class RenderPath : public RenderSVGModelObject {
+class RenderSVGPath : public RenderSVGModelObject {
 public:
-    RenderPath(SVGStyledTransformableElement*);
+    explicit RenderSVGPath(SVGStyledTransformableElement*);
+    virtual ~RenderSVGPath();
 
     const Path& path() const { return m_path; }
     void setNeedsPathUpdate() { m_needsPathUpdate = true; }
@@ -55,8 +56,8 @@ private:
     virtual FloatRect repaintRectInLocalCoordinates() const { return m_repaintBoundingBox; }
     virtual const AffineTransform& localToParentTransform() const { return m_localTransform; }
 
-    virtual bool isRenderPath() const { return true; }
-    virtual const char* renderName() const { return "RenderPath"; }
+    virtual bool isSVGPath() const { return true; }
+    virtual const char* renderName() const { return "RenderSVGPath"; }
 
     virtual void layout();
     virtual void paint(PaintInfo&, int parentX, int parentY);
@@ -83,20 +84,20 @@ private:
     AffineTransform m_localTransform;
 };
 
-inline RenderPath* toRenderPath(RenderObject* object)
+inline RenderSVGPath* toRenderSVGPath(RenderObject* object)
 {
-    ASSERT(!object || object->isRenderPath());
-    return static_cast<RenderPath*>(object);
+    ASSERT(!object || object->isSVGPath());
+    return static_cast<RenderSVGPath*>(object);
 }
 
-inline const RenderPath* toRenderPath(const RenderObject* object)
+inline const RenderSVGPath* toRenderSVGPath(const RenderObject* object)
 {
-    ASSERT(!object || object->isRenderPath());
-    return static_cast<const RenderPath*>(object);
+    ASSERT(!object || object->isSVGPath());
+    return static_cast<const RenderSVGPath*>(object);
 }
 
 // This will catch anyone doing an unnecessary cast.
-void toRenderPath(const RenderPath*);
+void toRenderSVGPath(const RenderSVGPath*);
 
 }
 
diff --git a/WebCore/rendering/RenderSVGTSpan.cpp b/WebCore/rendering/svg/RenderSVGTSpan.cpp
index 90ff36c..90ff36c 100644
--- a/WebCore/rendering/RenderSVGTSpan.cpp
+++ b/WebCore/rendering/svg/RenderSVGTSpan.cpp
diff --git a/WebCore/rendering/RenderSVGTSpan.h b/WebCore/rendering/svg/RenderSVGTSpan.h
index 931bd8c..97e0eb0 100644
--- a/WebCore/rendering/RenderSVGTSpan.h
+++ b/WebCore/rendering/svg/RenderSVGTSpan.h
@@ -29,7 +29,7 @@
 namespace WebCore {
 class RenderSVGTSpan : public RenderSVGInline {
 public:
-    RenderSVGTSpan(Node*);
+    explicit RenderSVGTSpan(Node*);
     virtual const char* renderName() const { return "RenderSVGTSpan"; }
 };
 }
diff --git a/WebCore/rendering/RenderSVGText.cpp b/WebCore/rendering/svg/RenderSVGText.cpp
index 92091af..01a92b0 100644
--- a/WebCore/rendering/RenderSVGText.cpp
+++ b/WebCore/rendering/svg/RenderSVGText.cpp
@@ -1,12 +1,11 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
- *               2006 Alexander Kellett <lypanov@kde.org>
- *               2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
- *               2007 Nikolas Zimmermann <zimmermann@kde.org>
- *               2008 Rob Buis <buis@kde.org>
- *               2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) 2006 Alexander Kellett <lypanov@kde.org>
+ * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2008 Rob Buis <buis@kde.org>
+ * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -42,20 +41,42 @@
 #include "SVGRenderSupport.h"
 #include "SVGRootInlineBox.h"
 #include "SVGTextElement.h"
-#include "SVGTextLayoutBuilder.h"
+#include "SVGTextLayoutAttributesBuilder.h"
 #include "SVGTransformList.h"
 #include "SVGURIReference.h"
 #include "SimpleFontData.h"
 #include "TransformState.h"
+#include "VisiblePosition.h"
 
 namespace WebCore {
 
 RenderSVGText::RenderSVGText(SVGTextElement* node) 
     : RenderSVGBlock(node)
+    , m_needsPositioningValuesUpdate(true)
     , m_needsTransformUpdate(true)
 {
 }
 
+RenderSVGText* RenderSVGText::locateRenderSVGTextAncestor(RenderObject* start)
+{
+    ASSERT(start);
+    while (start && !start->isSVGText())
+        start = start->parent();
+    if (!start || !start->isSVGText())
+        return 0;
+    return toRenderSVGText(start);
+}
+
+const RenderSVGText* RenderSVGText::locateRenderSVGTextAncestor(const RenderObject* start)
+{
+    ASSERT(start);
+    while (start && !start->isSVGText())
+        start = start->parent();
+    if (!start || !start->isSVGText())
+        return 0;
+    return toRenderSVGText(start);
+}
+
 IntRect RenderSVGText::clippedOverflowRectForRepaint(RenderBoxModelObject* repaintContainer)
 {
     return SVGRenderSupport::clippedOverflowRectForRepaint(this, repaintContainer);
@@ -84,8 +105,13 @@ void RenderSVGText::layout()
         updateCachedBoundariesInParents = true;
     }
 
-    SVGTextLayoutBuilder layoutBuilder;
-    layoutBuilder.buildLayoutAttributesForTextSubtree(this);
+    if (m_needsPositioningValuesUpdate) {
+        // Perform SVG text layout phase one (see SVGTextLayoutAttributesBuilder for details).
+        SVGTextLayoutAttributesBuilder layoutAttributesBuilder;
+        layoutAttributesBuilder.buildLayoutAttributesForTextSubtree(this);
+        m_needsPositioningValuesUpdate = false;
+        updateCachedBoundariesInParents = true;
+    }
 
     // Reduced version of RenderBlock::layoutBlock(), which only takes care of SVG text.
     // All if branches that could cause early exit in RenderBlocks layoutBlock() method are turned into assertions.
@@ -153,6 +179,23 @@ bool RenderSVGText::nodeAtPoint(const HitTestRequest&, HitTestResult&, int, int,
     return false;
 }
 
+VisiblePosition RenderSVGText::positionForPoint(const IntPoint& pointInContents)
+{
+    RootInlineBox* rootBox = firstRootBox();
+    if (!rootBox)
+        return createVisiblePosition(0, DOWNSTREAM);
+
+    ASSERT(rootBox->isSVGRootInlineBox());
+    ASSERT(!rootBox->nextRootBox());
+    ASSERT(childrenInline());
+
+    InlineBox* closestBox = static_cast<SVGRootInlineBox*>(rootBox)->closestLeafChildForPosition(pointInContents);
+    if (!closestBox)
+        return createVisiblePosition(0, DOWNSTREAM);
+
+    return closestBox->renderer()->positionForPoint(IntPoint(pointInContents.x(), closestBox->m_y));
+}
+
 void RenderSVGText::absoluteQuads(Vector<FloatQuad>& quads)
 {
     quads.append(localToAbsoluteQuad(strokeBoundingBox()));
diff --git a/WebCore/rendering/RenderSVGText.h b/WebCore/rendering/svg/RenderSVGText.h
index be19419..deae78c 100644
--- a/WebCore/rendering/RenderSVGText.h
+++ b/WebCore/rendering/svg/RenderSVGText.h
@@ -1,8 +1,7 @@
 /*
- * This file is part of the WebKit project.
- *
  * Copyright (C) 2006 Apple Computer, Inc.
- *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -37,9 +36,13 @@ class RenderSVGText : public RenderSVGBlock {
 public:
     RenderSVGText(SVGTextElement* node);
 
+    void setNeedsPositioningValuesUpdate() { m_needsPositioningValuesUpdate = true; }
     virtual void setNeedsTransformUpdate() { m_needsTransformUpdate = true; }
     virtual FloatRect repaintRectInLocalCoordinates() const;
 
+    static RenderSVGText* locateRenderSVGTextAncestor(RenderObject*);
+    static const RenderSVGText* locateRenderSVGTextAncestor(const RenderObject*);
+
 private:
     virtual const char* renderName() const { return "RenderSVGText"; }
     virtual bool isSVGText() const { return true; }
@@ -47,6 +50,7 @@ private:
     virtual void paint(PaintInfo&, int tx, int ty);
     virtual bool nodeAtPoint(const HitTestRequest&, HitTestResult&, int x, int y, int tx, int ty, HitTestAction);
     virtual bool nodeAtFloatPoint(const HitTestRequest&, HitTestResult&, const FloatPoint& pointInParent, HitTestAction);
+    virtual VisiblePosition positionForPoint(const IntPoint&);
 
     virtual bool requiresLayer() const { return false; }
     virtual void layout();
@@ -68,10 +72,26 @@ private:
     virtual RenderBlock* firstLineBlock() const;
     virtual void updateFirstLetter();
 
+    bool m_needsPositioningValuesUpdate : 1;
     bool m_needsTransformUpdate : 1;
     AffineTransform m_localTransform;
 };
 
+inline RenderSVGText* toRenderSVGText(RenderObject* object)
+{
+    ASSERT(!object || object->isSVGText());
+    return static_cast<RenderSVGText*>(object);
+}
+
+inline const RenderSVGText* toRenderSVGText(const RenderObject* object)
+{
+    ASSERT(!object || object->isSVGText());
+    return static_cast<const RenderSVGText*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGText(const RenderSVGText*);
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/rendering/RenderSVGTextPath.cpp b/WebCore/rendering/svg/RenderSVGTextPath.cpp
index 5d977f9..64ebc6d 100644
--- a/WebCore/rendering/RenderSVGTextPath.cpp
+++ b/WebCore/rendering/svg/RenderSVGTextPath.cpp
@@ -53,7 +53,8 @@ Path RenderSVGTextPath::layoutPath() const
     
     SVGPathElement* pathElement = static_cast<SVGPathElement*>(targetElement);
     
-    Path pathData = pathElement->toPathData();
+    Path pathData;
+    pathElement->toPathData(pathData);
     // Spec:  The transform attribute on the referenced 'path' element represents a
     // supplemental transformation relative to the current user coordinate system for
     // the current 'text' element, including any adjustments to the current user coordinate
diff --git a/WebCore/rendering/RenderSVGTextPath.h b/WebCore/rendering/svg/RenderSVGTextPath.h
index 8e6ff42..a71edf5 100644
--- a/WebCore/rendering/RenderSVGTextPath.h
+++ b/WebCore/rendering/svg/RenderSVGTextPath.h
@@ -29,34 +29,36 @@
 
 namespace WebCore {
 
-    class RenderSVGTextPath : public RenderSVGInline {
-    public:
-        RenderSVGTextPath(Node*);
+class RenderSVGTextPath : public RenderSVGInline {
+public:
+    RenderSVGTextPath(Node*);
 
-        Path layoutPath() const;
-        float startOffset() const;
-        bool exactAlignment() const;
-        bool stretchMethod() const;
+    Path layoutPath() const;
+    float startOffset() const;
+    bool exactAlignment() const;
+    bool stretchMethod() const;
 
-    private:
-        virtual const char* renderName() const { return "RenderSVGTextPath"; }
+    virtual bool isSVGTextPath() const { return true; }
 
-        float m_startOffset;
+private:
+    virtual const char* renderName() const { return "RenderSVGTextPath"; }
 
-        bool m_exactAlignment : 1;
-        bool m_stretchMethod : 1;
+    float m_startOffset;
 
-        Path m_layoutPath;
-    };
+    bool m_exactAlignment : 1;
+    bool m_stretchMethod : 1;
 
-    inline RenderSVGTextPath* toRenderSVGTextPath(RenderObject* object)
-    { 
-        ASSERT(!object || !strcmp(object->renderName(), "RenderSVGTextPath"));
-        return static_cast<RenderSVGTextPath*>(object);
-    }
+    Path m_layoutPath;
+};
 
-    // This will catch anyone doing an unnecessary cast.
-    void toRenderSVGTextPath(const RenderSVGTextPath*);
+inline RenderSVGTextPath* toRenderSVGTextPath(RenderObject* object)
+{ 
+    ASSERT(!object || !strcmp(object->renderName(), "RenderSVGTextPath"));
+    return static_cast<RenderSVGTextPath*>(object);
+}
+
+// This will catch anyone doing an unnecessary cast.
+void toRenderSVGTextPath(const RenderSVGTextPath*);
 
 }
 
diff --git a/WebCore/rendering/svg/SVGInlineFlowBox.cpp b/WebCore/rendering/svg/SVGInlineFlowBox.cpp
new file mode 100644
index 0000000..b35c7e2
--- /dev/null
+++ b/WebCore/rendering/svg/SVGInlineFlowBox.cpp
@@ -0,0 +1,143 @@
+/*
+ * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
+ *           (C) 2006 Apple Computer Inc.
+ *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SVGInlineFlowBox.h"
+
+#if ENABLE(SVG)
+#include "GraphicsContext.h"
+#include "RenderSVGInlineText.h"
+#include "SVGInlineTextBox.h"
+#include "SVGRenderSupport.h"
+
+using namespace std;
+
+namespace WebCore {
+
+void SVGInlineFlowBox::paintSelectionBackground(PaintInfo& paintInfo)
+{
+    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
+    ASSERT(!paintInfo.context->paintingDisabled());
+
+    PaintInfo childPaintInfo(paintInfo);
+    for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+        if (child->isSVGInlineTextBox())
+            static_cast<SVGInlineTextBox*>(child)->paintSelectionBackground(childPaintInfo);
+        else if (child->isSVGInlineFlowBox())
+            static_cast<SVGInlineFlowBox*>(child)->paintSelectionBackground(childPaintInfo);
+    }
+}
+
+void SVGInlineFlowBox::paint(PaintInfo& paintInfo, int, int)
+{
+    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
+    ASSERT(!paintInfo.context->paintingDisabled());
+
+    RenderObject* boxRenderer = renderer();
+    ASSERT(boxRenderer);
+
+    PaintInfo childPaintInfo(paintInfo);
+    childPaintInfo.context->save();
+
+    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+        for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+            if (child->isSVGInlineTextBox())
+                computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
+
+            child->paint(childPaintInfo, 0, 0);
+        }
+    }
+
+    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
+    childPaintInfo.context->restore();
+}
+
+IntRect SVGInlineFlowBox::calculateBoundaries() const
+{
+    IntRect childRect;
+    for (InlineBox* child = firstChild(); child; child = child->nextOnLine())
+        childRect.unite(child->calculateBoundaries());
+    return childRect;
+}
+
+void SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(RenderSVGInlineText* textRenderer)
+{
+    ASSERT(textRenderer);
+
+    Node* node = textRenderer->node();
+    if (!node || !node->inDocument())
+        return;
+
+    RenderStyle* style = textRenderer->style();
+    ASSERT(style);
+
+    Document* document = textRenderer->document();
+    Vector<DocumentMarker> markers = document->markers()->markersForNode(textRenderer->node());
+
+    Vector<DocumentMarker>::iterator markerEnd = markers.end();
+    for (Vector<DocumentMarker>::iterator markerIt = markers.begin(); markerIt != markerEnd; ++markerIt) {
+        const DocumentMarker& marker = *markerIt;
+
+        // SVG is only interessted in the TextMatch marker, for now.
+        if (marker.type != DocumentMarker::TextMatch)
+            continue;
+
+        FloatRect markerRect;
+        for (InlineTextBox* box = textRenderer->firstTextBox(); box; box = box->nextTextBox()) {
+            ASSERT(box->isSVGInlineTextBox());
+            SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(box);
+
+            int markerStartPosition = max<int>(marker.startOffset - textBox->start(), 0);
+            int markerEndPosition = min<int>(marker.endOffset - textBox->start(), textBox->len());
+
+            if (markerStartPosition >= markerEndPosition)
+                continue;
+
+            int fragmentStartPosition = 0;
+            int fragmentEndPosition = 0;
+
+            const Vector<SVGTextFragment>& fragments = textBox->textFragments();
+            unsigned textFragmentsSize = fragments.size();
+            for (unsigned i = 0; i < textFragmentsSize; ++i) {
+                const SVGTextFragment& fragment = fragments.at(i);
+
+                fragmentStartPosition = markerStartPosition;
+                fragmentEndPosition = markerEndPosition;
+                if (!textBox->mapStartEndPositionsIntoFragmentCoordinates(fragment, fragmentStartPosition, fragmentEndPosition))
+                    continue;
+
+                FloatRect fragmentRect = textBox->selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style);
+                if (!fragment.transform.isIdentity())
+                    fragmentRect = fragment.transform.mapRect(fragmentRect);
+
+                markerRect.unite(fragmentRect);
+            }
+        }
+
+        document->markers()->setRenderedRectForMarker(node, marker, textRenderer->localToAbsoluteQuad(markerRect).enclosingBoundingBox());
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGInlineFlowBox.h b/WebCore/rendering/svg/SVGInlineFlowBox.h
index 80600f7..2358f2d 100644
--- a/WebCore/rendering/SVGInlineFlowBox.h
+++ b/WebCore/rendering/svg/SVGInlineFlowBox.h
@@ -29,6 +29,8 @@
 
 namespace WebCore {
 
+class RenderSVGInlineText;
+
 class SVGInlineFlowBox : public InlineFlowBox {
 public:
     SVGInlineFlowBox(RenderObject* obj)
@@ -37,13 +39,16 @@ public:
     {
     }
 
+    virtual bool isSVGInlineFlowBox() const { return true; }
     virtual int virtualLogicalHeight() const { return m_logicalHeight; }
     void setLogicalHeight(int h) { m_logicalHeight = h; }
 
+    void paintSelectionBackground(PaintInfo&);
     virtual void paint(PaintInfo&, int tx, int ty);
 
     virtual IntRect calculateBoundaries() const;
-    void layoutFlowBox();
+
+    static void computeTextMatchMarkerRectForRenderer(RenderSVGInlineText*);
 
 private:
     int m_logicalHeight;
diff --git a/WebCore/rendering/svg/SVGInlineTextBox.cpp b/WebCore/rendering/svg/SVGInlineTextBox.cpp
new file mode 100644
index 0000000..0458af5
--- /dev/null
+++ b/WebCore/rendering/svg/SVGInlineTextBox.cpp
@@ -0,0 +1,610 @@
+/**
+ * Copyright (C) 2007 Rob Buis <buis@kde.org>
+ *           (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SVGInlineTextBox.h"
+
+#if ENABLE(SVG)
+#include "FloatConversion.h"
+#include "GraphicsContext.h"
+#include "InlineFlowBox.h"
+#include "RenderBlock.h"
+#include "RenderSVGInlineText.h"
+#include "RenderSVGResource.h"
+#include "RenderSVGResourceSolidColor.h"
+#include "SVGRootInlineBox.h"
+
+using namespace std;
+
+namespace WebCore {
+
+SVGInlineTextBox::SVGInlineTextBox(RenderObject* object)
+    : InlineTextBox(object)
+    , m_logicalHeight(0)
+    , m_paintingResourceMode(ApplyToDefaultMode)
+    , m_startsNewTextChunk(false)
+    , m_paintingResource(0)
+{
+}
+
+int SVGInlineTextBox::offsetForPosition(int, bool) const
+{
+    // SVG doesn't use the standard offset <-> position selection system, as it's not suitable for SVGs complex needs.
+    // vertical text selection, inline boxes spanning multiple lines (contrary to HTML, etc.)
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+int SVGInlineTextBox::offsetForPositionInFragment(const SVGTextFragment& fragment, float position, bool includePartialGlyphs) const
+{
+    RenderText* textRenderer = this->textRenderer();
+    ASSERT(textRenderer);
+
+    RenderStyle* style = textRenderer->style();
+    ASSERT(style);
+
+    TextRun textRun(constructTextRun(style, fragment));
+
+    // Eventually handle lengthAdjust="spacingAndGlyphs".
+    // FIXME: Handle vertical text.
+    if (!fragment.transform.isIdentity())
+        textRun.setHorizontalGlyphStretch(narrowPrecisionToFloat(fragment.transform.xScale()));
+
+    return fragment.positionListOffset - start() + style->font().offsetForPosition(textRun, position, includePartialGlyphs);
+}
+
+int SVGInlineTextBox::positionForOffset(int) const
+{
+    // SVG doesn't use the offset <-> position selection system. 
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+FloatRect SVGInlineTextBox::selectionRectForTextFragment(const SVGTextFragment& fragment, int startPosition, int endPosition, RenderStyle* style)
+{
+    ASSERT(startPosition < endPosition);
+
+    const Font& font = style->font();
+    FloatPoint textOrigin(fragment.x, fragment.y - font.ascent());
+    return font.selectionRectForText(constructTextRun(style, fragment), textOrigin, fragment.height, startPosition, endPosition);
+}
+
+IntRect SVGInlineTextBox::selectionRect(int, int, int startPosition, int endPosition)
+{
+    int boxStart = start();
+    startPosition = max(startPosition - boxStart, 0);
+    endPosition = min(endPosition - boxStart, static_cast<int>(len()));
+    if (startPosition >= endPosition)
+        return IntRect();
+
+    RenderText* text = textRenderer();
+    ASSERT(text);
+
+    RenderStyle* style = text->style();
+    ASSERT(style);
+
+    FloatRect selectionRect;
+    int fragmentStartPosition = 0;
+    int fragmentEndPosition = 0;
+
+    unsigned textFragmentsSize = m_textFragments.size();
+    for (unsigned i = 0; i < textFragmentsSize; ++i) {
+        const SVGTextFragment& fragment = m_textFragments.at(i);
+
+        fragmentStartPosition = startPosition;
+        fragmentEndPosition = endPosition;
+        if (!mapStartEndPositionsIntoFragmentCoordinates(fragment, fragmentStartPosition, fragmentEndPosition))
+            continue;
+
+        FloatRect fragmentRect = selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style);
+        if (!fragment.transform.isIdentity())
+            fragmentRect = fragment.transform.mapRect(fragmentRect);
+
+        selectionRect.unite(fragmentRect);
+    }
+
+    return enclosingIntRect(selectionRect);
+}
+
+void SVGInlineTextBox::paintSelectionBackground(PaintInfo& paintInfo)
+{
+    ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
+    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
+    ASSERT(truncation() == cNoTruncation);
+
+    if (renderer()->style()->visibility() != VISIBLE)
+        return;
+
+    RenderObject* parentRenderer = parent()->renderer();
+    ASSERT(parentRenderer);
+    ASSERT(!parentRenderer->document()->printing());
+
+    // Determine whether or not we're selected.
+    bool paintSelectedTextOnly = paintInfo.phase == PaintPhaseSelection;
+    bool hasSelection = selectionState() != RenderObject::SelectionNone;
+    if (!hasSelection || paintSelectedTextOnly)
+        return;
+
+    Color backgroundColor = renderer()->selectionBackgroundColor();
+    if (!backgroundColor.isValid() || !backgroundColor.alpha())
+        return;
+
+    RenderStyle* style = parentRenderer->style();
+    ASSERT(style);
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    bool hasFill = svgStyle->hasFill();
+    bool hasStroke = svgStyle->hasStroke();
+
+    RenderStyle* selectionStyle = style;
+    if (hasSelection) {
+        selectionStyle = parentRenderer->getCachedPseudoStyle(SELECTION);
+        if (selectionStyle) {
+            const SVGRenderStyle* svgSelectionStyle = selectionStyle->svgStyle();
+            ASSERT(svgSelectionStyle);
+
+            if (!hasFill)
+                hasFill = svgSelectionStyle->hasFill();
+            if (!hasStroke)
+                hasStroke = svgSelectionStyle->hasStroke();
+        } else
+            selectionStyle = style;
+    }
+
+    int startPosition, endPosition;
+    selectionStartEnd(startPosition, endPosition);
+
+    int fragmentStartPosition = 0;
+    int fragmentEndPosition = 0;
+    unsigned textFragmentsSize = m_textFragments.size();
+    for (unsigned i = 0; i < textFragmentsSize; ++i) {
+        SVGTextFragment& fragment = m_textFragments.at(i);
+        ASSERT(!m_paintingResource);
+
+        fragmentStartPosition = startPosition;
+        fragmentEndPosition = endPosition;
+        if (!mapStartEndPositionsIntoFragmentCoordinates(fragment, fragmentStartPosition, fragmentEndPosition))
+            continue;
+
+        paintInfo.context->save();
+
+        if (!fragment.transform.isIdentity())
+            paintInfo.context->concatCTM(fragment.transform);
+
+        paintInfo.context->setFillColor(backgroundColor, style->colorSpace());
+        paintInfo.context->fillRect(selectionRectForTextFragment(fragment, fragmentStartPosition, fragmentEndPosition, style), backgroundColor, style->colorSpace());
+
+        m_paintingResourceMode = ApplyToDefaultMode;
+        paintInfo.context->restore();
+    }
+
+    ASSERT(!m_paintingResource);
+}
+
+void SVGInlineTextBox::paint(PaintInfo& paintInfo, int, int)
+{
+    ASSERT(paintInfo.shouldPaintWithinRoot(renderer()));
+    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
+    ASSERT(truncation() == cNoTruncation);
+
+    if (renderer()->style()->visibility() != VISIBLE)
+        return;
+
+    // Note: We're explicitely not supporting composition & custom underlines and custom highlighters - unlike InlineTextBox.
+    // If we ever need that for SVG, it's very easy to refactor and reuse the code.
+
+    RenderObject* parentRenderer = parent()->renderer();
+    ASSERT(parentRenderer);
+
+    bool paintSelectedTextOnly = paintInfo.phase == PaintPhaseSelection;
+    bool hasSelection = !parentRenderer->document()->printing() && selectionState() != RenderObject::SelectionNone;
+    if (!hasSelection && paintSelectedTextOnly)
+        return;
+
+    RenderStyle* style = parentRenderer->style();
+    ASSERT(style);
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    bool hasFill = svgStyle->hasFill();
+    bool hasStroke = svgStyle->hasStroke();
+
+    RenderStyle* selectionStyle = style;
+    if (hasSelection) {
+        selectionStyle = parentRenderer->getCachedPseudoStyle(SELECTION);
+        if (selectionStyle) {
+            const SVGRenderStyle* svgSelectionStyle = selectionStyle->svgStyle();
+            ASSERT(svgSelectionStyle);
+
+            if (!hasFill)
+                hasFill = svgSelectionStyle->hasFill();
+            if (!hasStroke)
+                hasStroke = svgSelectionStyle->hasStroke();
+        } else
+            selectionStyle = style;
+    }
+
+    unsigned textFragmentsSize = m_textFragments.size();
+    for (unsigned i = 0; i < textFragmentsSize; ++i) {
+        SVGTextFragment& fragment = m_textFragments.at(i);
+        ASSERT(!m_paintingResource);
+
+        paintInfo.context->save();
+
+        if (!fragment.transform.isIdentity())
+            paintInfo.context->concatCTM(fragment.transform);
+
+        // Spec: All text decorations except line-through should be drawn before the text is filled and stroked; thus, the text is rendered on top of these decorations.
+        int decorations = style->textDecorationsInEffect();
+        if (decorations & UNDERLINE)
+            paintDecoration(paintInfo.context, UNDERLINE, fragment);
+        if (decorations & OVERLINE)
+            paintDecoration(paintInfo.context, OVERLINE, fragment);
+
+        // Fill text
+        if (hasFill) {
+            m_paintingResourceMode = ApplyToFillMode | ApplyToTextMode;
+            paintText(paintInfo.context, style, selectionStyle, fragment, hasSelection, paintSelectedTextOnly);
+        }
+
+        // Stroke text
+        if (hasStroke) {
+            m_paintingResourceMode = ApplyToStrokeMode | ApplyToTextMode;
+            paintText(paintInfo.context, style, selectionStyle, fragment, hasSelection, paintSelectedTextOnly);
+        }
+
+        // Spec: Line-through should be drawn after the text is filled and stroked; thus, the line-through is rendered on top of the text.
+        if (decorations & LINE_THROUGH)
+            paintDecoration(paintInfo.context, LINE_THROUGH, fragment);
+
+        m_paintingResourceMode = ApplyToDefaultMode;
+        paintInfo.context->restore();
+    }
+
+    ASSERT(!m_paintingResource);
+}
+
+bool SVGInlineTextBox::acquirePaintingResource(GraphicsContext*& context, RenderObject* renderer, RenderStyle* style)
+{
+    ASSERT(renderer);
+    ASSERT(style);
+    ASSERT(m_paintingResourceMode != ApplyToDefaultMode);
+
+    Color fallbackColor;
+    if (m_paintingResourceMode & ApplyToFillMode)
+        m_paintingResource = RenderSVGResource::fillPaintingResource(renderer, style, fallbackColor);
+    else if (m_paintingResourceMode & ApplyToStrokeMode)
+        m_paintingResource = RenderSVGResource::strokePaintingResource(renderer, style, fallbackColor);
+    else {
+        // We're either called for stroking or filling.
+        ASSERT_NOT_REACHED();
+    }
+
+    if (!m_paintingResource)
+        return false;
+
+    if (!m_paintingResource->applyResource(renderer, style, context, m_paintingResourceMode)) {
+        if (fallbackColor.isValid()) {
+            RenderSVGResourceSolidColor* fallbackResource = RenderSVGResource::sharedSolidPaintingResource();
+            fallbackResource->setColor(fallbackColor);
+
+            m_paintingResource = fallbackResource;
+            m_paintingResource->applyResource(renderer, style, context, m_paintingResourceMode);
+        }
+    }
+
+    return true;
+}
+
+void SVGInlineTextBox::releasePaintingResource(GraphicsContext*& context)
+{
+    ASSERT(m_paintingResource);
+
+    RenderObject* parentRenderer = parent()->renderer();
+    ASSERT(parentRenderer);
+
+    m_paintingResource->postApplyResource(parentRenderer, context, m_paintingResourceMode);
+    m_paintingResource = 0;
+}
+
+bool SVGInlineTextBox::prepareGraphicsContextForTextPainting(GraphicsContext*& context, TextRun& textRun, RenderStyle* style)
+{
+    bool acquiredResource = acquirePaintingResource(context, parent()->renderer(), style);
+
+#if ENABLE(SVG_FONTS)
+    // SVG Fonts need access to the painting resource used to draw the current text chunk.
+    if (acquiredResource)
+        textRun.setActivePaintingResource(m_paintingResource);
+#endif
+
+    return acquiredResource;
+}
+
+void SVGInlineTextBox::restoreGraphicsContextAfterTextPainting(GraphicsContext*& context, TextRun& textRun)
+{
+    releasePaintingResource(context);
+
+#if ENABLE(SVG_FONTS)
+    textRun.setActivePaintingResource(0);
+#endif
+}
+
+TextRun SVGInlineTextBox::constructTextRun(RenderStyle* style, const SVGTextFragment& fragment) const
+{
+    ASSERT(style);
+    ASSERT(textRenderer());
+
+    RenderText* text = textRenderer();
+    ASSERT(text);
+
+    TextRun run(text->characters() + fragment.positionListOffset
+                , fragment.length
+                , false /* allowTabs */
+                , 0 /* xPos, only relevant with allowTabs=true */
+                , 0 /* padding, only relevant for justified text, not relevant for SVG */
+                , direction() == RTL
+                , m_dirOverride || style->visuallyOrdered() /* directionalOverride */);
+
+#if ENABLE(SVG_FONTS)
+    RenderObject* parentRenderer = parent()->renderer();
+    ASSERT(parentRenderer);
+
+    run.setReferencingRenderObject(parentRenderer);
+#endif
+
+    // Disable any word/character rounding.
+    run.disableRoundingHacks();
+
+    // We handle letter & word spacing ourselves.
+    run.disableSpacing();
+    return run;
+}
+
+bool SVGInlineTextBox::mapStartEndPositionsIntoFragmentCoordinates(const SVGTextFragment& fragment, int& startPosition, int& endPosition) const
+{
+    if (startPosition >= endPosition)
+        return false;
+
+    int offset = static_cast<int>(fragment.positionListOffset) - start();
+    int length = static_cast<int>(fragment.length);
+
+    if (startPosition >= offset + length || endPosition <= offset)
+        return false;
+
+    if (startPosition < offset)
+        startPosition = 0;
+    else
+        startPosition -= offset;
+
+    if (endPosition > offset + length)
+        endPosition = length;
+    else {
+        ASSERT(endPosition >= offset);
+        endPosition -= offset;
+    }
+
+    ASSERT(startPosition < endPosition);
+    return true;
+}
+
+static inline float positionOffsetForDecoration(ETextDecoration decoration, const Font& font, float thickness)
+{
+    // FIXME: For SVG Fonts we need to use the attributes defined in the <font-face> if specified.
+    // Compatible with Batik/Opera.
+    if (decoration == UNDERLINE)
+        return font.ascent() + thickness * 1.5f;
+    if (decoration == OVERLINE)
+        return thickness;
+    if (decoration == LINE_THROUGH)
+        return font.ascent() * 5.0f / 8.0f;
+
+    ASSERT_NOT_REACHED();
+    return 0.0f;
+}
+
+static inline float thicknessForDecoration(ETextDecoration, const Font& font)
+{
+    // FIXME: For SVG Fonts we need to use the attributes defined in the <font-face> if specified.
+    // Compatible with Batik/Opera
+    return font.size() / 20.0f;
+}
+
+static inline RenderObject* findRenderObjectDefininingTextDecoration(InlineFlowBox* parentBox)
+{
+    // Lookup first render object in parent hierarchy which has text-decoration set.
+    RenderObject* renderer = 0;
+    while (parentBox) {
+        renderer = parentBox->renderer();
+
+        if (renderer->style() && renderer->style()->textDecoration() != TDNONE)
+            break;
+
+        parentBox = parentBox->parent();
+    }
+
+    ASSERT(renderer);
+    return renderer;
+}
+
+void SVGInlineTextBox::paintDecoration(GraphicsContext* context, ETextDecoration decoration, const SVGTextFragment& fragment)
+{
+    if (textRenderer()->style()->textDecorationsInEffect() == TDNONE)
+        return;
+
+    // Find out which render style defined the text-decoration, as its fill/stroke properties have to be used for drawing instead of ours.
+    RenderObject* decorationRenderer = findRenderObjectDefininingTextDecoration(parent());
+    RenderStyle* decorationStyle = decorationRenderer->style();
+    ASSERT(decorationStyle);
+
+    if (decorationStyle->visibility() == HIDDEN)
+        return;
+
+    const SVGRenderStyle* svgDecorationStyle = decorationStyle->svgStyle();
+    ASSERT(svgDecorationStyle);
+
+    bool hasDecorationFill = svgDecorationStyle->hasFill();
+    bool hasDecorationStroke = svgDecorationStyle->hasStroke();
+
+    if (hasDecorationFill) {
+        m_paintingResourceMode = ApplyToFillMode;
+        paintDecorationWithStyle(context, decoration, fragment, decorationRenderer);
+    }
+
+    if (hasDecorationStroke) {
+        m_paintingResourceMode = ApplyToStrokeMode;
+        paintDecorationWithStyle(context, decoration, fragment, decorationRenderer);
+    }
+}
+
+void SVGInlineTextBox::paintDecorationWithStyle(GraphicsContext* context, ETextDecoration decoration, const SVGTextFragment& fragment, RenderObject* decorationRenderer)
+{
+    ASSERT(!m_paintingResource);
+    ASSERT(m_paintingResourceMode != ApplyToDefaultMode);
+
+    RenderStyle* decorationStyle = decorationRenderer->style();
+    ASSERT(decorationStyle);
+
+    const Font& font = decorationStyle->font();
+
+    // The initial y value refers to overline position.
+    float thickness = thicknessForDecoration(decoration, font);
+
+    if (fragment.width <= 0 && thickness <= 0)
+        return;
+
+    float y = fragment.y - font.ascent() + positionOffsetForDecoration(decoration, font, thickness);
+
+    Path path;
+    path.addRect(FloatRect(fragment.x, y, fragment.width, thickness));
+
+    context->save();
+    context->beginPath();
+    context->addPath(path);
+
+    if (acquirePaintingResource(context, decorationRenderer, decorationStyle))
+        releasePaintingResource(context);
+
+    context->restore();
+}
+
+void SVGInlineTextBox::paintTextWithShadows(GraphicsContext* context, RenderStyle* style, TextRun& textRun, const SVGTextFragment& fragment, int startPosition, int endPosition)
+{
+    const Font& font = style->font();
+    const ShadowData* shadow = style->textShadow();
+
+    FloatPoint textOrigin(fragment.x, fragment.y);
+    FloatRect shadowRect(FloatPoint(textOrigin.x(), textOrigin.y() - font.ascent()), FloatSize(fragment.width, fragment.height));
+
+    do {
+        if (!prepareGraphicsContextForTextPainting(context, textRun, style))
+            break;
+
+        FloatSize extraOffset;
+        if (shadow)
+            extraOffset = applyShadowToGraphicsContext(context, shadow, shadowRect, false /* stroked */, true /* opaque */);
+
+        font.drawText(context, textRun, textOrigin + extraOffset, startPosition, endPosition);
+        restoreGraphicsContextAfterTextPainting(context, textRun);
+
+        if (!shadow)
+            break;
+
+        if (shadow->next())
+            context->restore();
+        else
+            context->clearShadow();
+
+        shadow = shadow->next();
+    } while (shadow);
+}
+
+void SVGInlineTextBox::paintText(GraphicsContext* context, RenderStyle* style, RenderStyle* selectionStyle, const SVGTextFragment& fragment, bool hasSelection, bool paintSelectedTextOnly)
+{
+    ASSERT(style);
+    ASSERT(selectionStyle);
+
+    int startPosition = 0;
+    int endPosition = 0;
+    if (hasSelection) {
+        selectionStartEnd(startPosition, endPosition);
+        hasSelection = mapStartEndPositionsIntoFragmentCoordinates(fragment, startPosition, endPosition);
+    }
+
+    // Fast path if there is no selection, just draw the whole chunk part using the regular style
+    TextRun textRun(constructTextRun(style, fragment));
+    if (!hasSelection || startPosition >= endPosition) {
+        paintTextWithShadows(context, style, textRun, fragment, 0, fragment.length);
+        return;
+    }
+
+    // Eventually draw text using regular style until the start position of the selection
+    if (startPosition > 0 && !paintSelectedTextOnly)
+        paintTextWithShadows(context, style, textRun, fragment, 0, startPosition);
+
+    // Draw text using selection style from the start to the end position of the selection
+    if (style != selectionStyle)
+        SVGResourcesCache::clientStyleChanged(parent()->renderer(), StyleDifferenceRepaint, selectionStyle);
+
+    TextRun selectionTextRun(constructTextRun(selectionStyle, fragment));
+    paintTextWithShadows(context, selectionStyle, textRun, fragment, startPosition, endPosition);
+
+    if (style != selectionStyle)
+        SVGResourcesCache::clientStyleChanged(parent()->renderer(), StyleDifferenceRepaint, style);
+
+    // Eventually draw text using regular style from the end position of the selection to the end of the current chunk part
+    if (endPosition < static_cast<int>(fragment.length) && !paintSelectedTextOnly)
+        paintTextWithShadows(context, style, textRun, fragment, endPosition, fragment.length);
+}
+
+IntRect SVGInlineTextBox::calculateBoundaries() const
+{
+    FloatRect textRect;
+
+    RenderText* textRenderer = this->textRenderer();
+    ASSERT(textRenderer);
+
+    RenderStyle* style = textRenderer->style();
+    ASSERT(style);
+
+    int baseline = baselinePosition();
+    int heightDifference = baseline - style->font().ascent();
+
+    unsigned textFragmentsSize = m_textFragments.size();
+    for (unsigned i = 0; i < textFragmentsSize; ++i) {
+        const SVGTextFragment& fragment = m_textFragments.at(i);
+        FloatRect fragmentRect(fragment.x, fragment.y - baseline, fragment.width, fragment.height + heightDifference);
+
+        if (!fragment.transform.isIdentity())
+            fragmentRect = fragment.transform.mapRect(fragmentRect);
+
+        textRect.unite(fragmentRect);
+    }
+
+    return enclosingIntRect(textRect);
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/rendering/SVGInlineTextBox.h b/WebCore/rendering/svg/SVGInlineTextBox.h
index 24957cf..8e82dda 100644
--- a/WebCore/rendering/SVGInlineTextBox.h
+++ b/WebCore/rendering/svg/SVGInlineTextBox.h
@@ -25,17 +25,13 @@
 
 #if ENABLE(SVG)
 #include "InlineTextBox.h"
-#include "SVGTextChunkLayoutInfo.h"
-#include "SVGTextLayoutUtilities.h"
+#include "SVGTextLayoutEngine.h"
 
 namespace WebCore {
 
 class RenderSVGResource;
 class SVGRootInlineBox;
 
-struct SVGCharacterLayoutInfo;
-struct SVGLastGlyphInfo;
-
 class SVGInlineTextBox : public InlineTextBox {
 public:
     SVGInlineTextBox(RenderObject*);
@@ -50,30 +46,26 @@ public:
     virtual int offsetForPosition(int x, bool includePartialGlyphs = true) const;
     virtual int positionForOffset(int offset) const;
 
+    void paintSelectionBackground(PaintInfo&);
     virtual void paint(PaintInfo&, int tx, int ty);
-    virtual IntRect selectionRect(int absx, int absy, int startPos, int endPos);
-
-    virtual void selectionStartEnd(int& startPos, int& endPos);
-    void mapStartEndPositionsIntoChunkPartCoordinates(int& startPos, int& endPos, const SVGTextChunkPart&) const;
+    virtual IntRect selectionRect(int absx, int absy, int startPosition, int endPosition);
 
-    SVGRootInlineBox* svgRootInlineBox() const;
+    bool mapStartEndPositionsIntoFragmentCoordinates(const SVGTextFragment&, int& startPosition, int& endPosition) const;
 
-    // Helper functions shared with SVGRootInlineBox     
-    void measureCharacter(RenderStyle*, int position, int& charsConsumed, String& glyphName, String& unicodeString, float& glyphWidth, float& glyphHeight) const;
-    FloatRect calculateGlyphBoundaries(RenderStyle*, int position, const SVGChar&) const;
+    virtual IntRect calculateBoundaries() const;
 
-    void buildLayoutInformation(SVGCharacterLayoutInfo&, SVGLastGlyphInfo&);
+    void clearTextFragments() { m_textFragments.clear(); }
+    Vector<SVGTextFragment>& textFragments() { return m_textFragments; }
+    const Vector<SVGTextFragment>& textFragments() const { return m_textFragments; }
 
-    const AffineTransform& chunkTransformation() const { return m_chunkTransformation; }
-    void setChunkTransformation(const AffineTransform& transform) { m_chunkTransformation = transform; }
-    void addChunkPartInformation(const SVGTextChunkPart& part) { m_svgTextChunkParts.append(part); }
-    const Vector<SVGTextChunkPart>& svgTextChunkParts() const { return m_svgTextChunkParts; }
+    bool startsNewTextChunk() const { return m_startsNewTextChunk; }
+    void setStartsNewTextChunk(bool newTextChunk) { m_startsNewTextChunk = newTextChunk; }
 
-    virtual IntRect calculateBoundaries() const;
+    int offsetForPositionInFragment(const SVGTextFragment&, float position, bool includePartialGlyphs) const;
+    FloatRect selectionRectForTextFragment(const SVGTextFragment&, int fragmentStartPosition, int fragmentEndPosition, RenderStyle*);
 
 private:
-    TextRun constructTextRun(RenderStyle*) const;
-    AffineTransform buildChunkTransformation(SVGChar& firstCharacter) const;
+    TextRun constructTextRun(RenderStyle*, const SVGTextFragment&) const;
 
     bool acquirePaintingResource(GraphicsContext*&, RenderObject*, RenderStyle*);
     void releasePaintingResource(GraphicsContext*&);
@@ -81,22 +73,17 @@ private:
     bool prepareGraphicsContextForTextPainting(GraphicsContext*&, TextRun&, RenderStyle*);
     void restoreGraphicsContextAfterTextPainting(GraphicsContext*&, TextRun&);
 
-    void computeTextMatchMarkerRect(RenderStyle*);
-    void paintDecoration(GraphicsContext*, const FloatPoint& textOrigin, ETextDecoration, bool hasSelection);
-    void paintDecorationWithStyle(GraphicsContext*, const FloatPoint& textOrigin, RenderObject*, ETextDecoration);
-    void paintSelection(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*);
-    void paintText(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*, RenderStyle* selectionStyle, bool hasSelection, bool paintSelectedTextOnly);
-    void paintTextWithShadows(GraphicsContext*, const FloatPoint& textOrigin, RenderStyle*, TextRun&, int startPos, int endPos);
-
-    FloatRect selectionRectForTextChunkPart(const SVGTextChunkPart&, int partStartPos, int partEndPos, RenderStyle*);
+    void paintDecoration(GraphicsContext*, ETextDecoration, const SVGTextFragment&);
+    void paintDecorationWithStyle(GraphicsContext*, ETextDecoration, const SVGTextFragment&, RenderObject* decorationRenderer);
+    void paintTextWithShadows(GraphicsContext*, RenderStyle*, TextRun&, const SVGTextFragment&, int startPosition, int endPosition);
+    void paintText(GraphicsContext*, RenderStyle*, RenderStyle* selectionStyle, const SVGTextFragment&, bool hasSelection, bool paintSelectedTextOnly);
 
 private:
     int m_logicalHeight;
-    AffineTransform m_chunkTransformation;
-    Vector<SVGTextChunkPart> m_svgTextChunkParts;
-    mutable SVGTextChunkPart m_currentChunkPart;
-    RenderSVGResource* m_paintingResource;
     int m_paintingResourceMode;
+    bool m_startsNewTextChunk : 1;
+    RenderSVGResource* m_paintingResource;
+    Vector<SVGTextFragment> m_textFragments;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/svg/SVGRootInlineBox.cpp b/WebCore/rendering/svg/SVGRootInlineBox.cpp
new file mode 100644
index 0000000..7109e1f
--- /dev/null
+++ b/WebCore/rendering/svg/SVGRootInlineBox.cpp
@@ -0,0 +1,221 @@
+/*
+ * Copyright (C) 2006 Oliver Hunt <ojh16@student.canterbury.ac.nz>
+ * Copyright (C) 2006 Apple Computer Inc.
+ * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+
+#include "config.h"
+#include "SVGRootInlineBox.h"
+
+#if ENABLE(SVG)
+#include "GraphicsContext.h"
+#include "RenderBlock.h"
+#include "RenderSVGInlineText.h"
+#include "SVGInlineFlowBox.h"
+#include "SVGInlineTextBox.h"
+#include "SVGRenderSupport.h"
+#include "SVGTextPositioningElement.h"
+
+namespace WebCore {
+
+void SVGRootInlineBox::paint(PaintInfo& paintInfo, int, int)
+{
+    ASSERT(paintInfo.phase == PaintPhaseForeground || paintInfo.phase == PaintPhaseSelection);
+    ASSERT(!paintInfo.context->paintingDisabled());
+
+    RenderObject* boxRenderer = renderer();
+    ASSERT(boxRenderer);
+
+    bool isPrinting = renderer()->document()->printing();
+    bool hasSelection = !isPrinting && selectionState() != RenderObject::SelectionNone;
+
+    PaintInfo childPaintInfo(paintInfo);
+    if (hasSelection) {
+        for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+            if (child->isSVGInlineTextBox())
+                static_cast<SVGInlineTextBox*>(child)->paintSelectionBackground(childPaintInfo);
+            else if (child->isSVGInlineFlowBox())
+                static_cast<SVGInlineFlowBox*>(child)->paintSelectionBackground(childPaintInfo);
+        }
+    }
+
+    childPaintInfo.context->save();
+
+    if (SVGRenderSupport::prepareToRenderSVGContent(boxRenderer, childPaintInfo)) {
+        for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+            if (child->isSVGInlineTextBox())
+                SVGInlineFlowBox::computeTextMatchMarkerRectForRenderer(toRenderSVGInlineText(static_cast<SVGInlineTextBox*>(child)->textRenderer()));
+
+            child->paint(childPaintInfo, 0, 0);
+        }
+    }
+
+    SVGRenderSupport::finishRenderSVGContent(boxRenderer, childPaintInfo, paintInfo.context);
+    childPaintInfo.context->restore();
+}
+
+void SVGRootInlineBox::computePerCharacterLayoutInformation()
+{
+    // Perform SVG text layout phase two (see SVGTextLayoutEngine for details).
+    SVGTextLayoutEngine characterLayout;
+    layoutCharactersInTextBoxes(this, characterLayout);
+
+    // Perform SVG text layout phase three (see SVGTextChunkBuilder for details).
+    characterLayout.finishLayout();
+
+    // Perform SVG text layout phase four
+    // Position & resize all SVGInlineText/FlowBoxes in the inline box tree, resize the root box as well as the RenderSVGText parent block.
+    layoutChildBoxes(this);
+    layoutRootBox();
+}
+
+void SVGRootInlineBox::layoutCharactersInTextBoxes(InlineFlowBox* start, SVGTextLayoutEngine& characterLayout)
+{
+    for (InlineBox* child = start->firstChild(); child; child = child->nextOnLine()) {
+        if (child->isSVGInlineTextBox()) {
+            ASSERT(child->renderer());
+            ASSERT(child->renderer()->isSVGInlineText());
+
+            SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(child);
+            characterLayout.layoutInlineTextBox(textBox);
+        } else {
+            ASSERT(child->isInlineFlowBox());
+
+            // Skip generated content.
+            Node* node = child->renderer()->node();
+            if (!node)
+                continue;
+
+            SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
+            bool isTextPath = node->hasTagName(SVGNames::textPathTag);
+            if (isTextPath) {
+                // Build text chunks for all <textPath> children, using the line layout algorithm.
+                // This is needeed as text-anchor is just an additional startOffset for text paths.
+                SVGTextLayoutEngine lineLayout;
+                layoutCharactersInTextBoxes(flowBox, lineLayout);
+                characterLayout.beginTextPathLayout(child->renderer(), lineLayout);
+            }
+
+            layoutCharactersInTextBoxes(flowBox, characterLayout);
+
+            if (isTextPath)
+                characterLayout.endTextPathLayout();
+        }
+    }
+}
+
+void SVGRootInlineBox::layoutChildBoxes(InlineFlowBox* start)
+{
+    for (InlineBox* child = start->firstChild(); child; child = child->nextOnLine()) {
+        if (child->isSVGInlineTextBox()) {
+            ASSERT(child->renderer());
+            ASSERT(child->renderer()->isSVGInlineText());
+
+            SVGInlineTextBox* textBox = static_cast<SVGInlineTextBox*>(child);
+            IntRect boxRect = textBox->calculateBoundaries();
+            textBox->setX(boxRect.x());
+            textBox->setY(boxRect.y());
+            textBox->setLogicalWidth(boxRect.width());
+            textBox->setLogicalHeight(boxRect.height());
+        } else {
+            ASSERT(child->isInlineFlowBox());
+
+            // Skip generated content.
+            if (!child->renderer()->node())
+                continue;
+
+            SVGInlineFlowBox* flowBox = static_cast<SVGInlineFlowBox*>(child);
+            layoutChildBoxes(flowBox);
+
+            IntRect boxRect = flowBox->calculateBoundaries();
+            flowBox->setX(boxRect.x());
+            flowBox->setY(boxRect.y());
+            flowBox->setLogicalWidth(boxRect.width());
+            flowBox->setLogicalHeight(boxRect.height());
+        }
+    }
+}
+
+void SVGRootInlineBox::layoutRootBox()
+{
+    RenderBlock* parentBlock = block();
+    ASSERT(parentBlock);
+
+    IntRect childRect;
+    for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+        // Skip generated content.
+        if (!child->renderer()->node())
+            continue;
+        childRect.unite(child->calculateBoundaries());
+    }
+
+    int xBlock = childRect.x();
+    int yBlock = childRect.y();
+    int widthBlock = childRect.width();
+    int heightBlock = childRect.height();
+
+    // Finally, assign the root block position, now that all content is laid out.
+    parentBlock->setLocation(xBlock, yBlock);
+    parentBlock->setWidth(widthBlock);
+    parentBlock->setHeight(heightBlock);
+
+    // Position all children relative to the parent block.
+    for (InlineBox* child = firstChild(); child; child = child->nextOnLine()) {
+        // Skip generated content.
+        if (!child->renderer()->node())
+            continue;
+        child->adjustPosition(-xBlock, -yBlock);
+    }
+
+    // Position ourselves.
+    setX(0);
+    setY(0);
+    setLogicalWidth(widthBlock);
+    setLogicalHeight(heightBlock);
+    setBlockLogicalHeight(heightBlock);
+    setLineTopBottomPositions(0, heightBlock);
+}
+
+InlineBox* SVGRootInlineBox::closestLeafChildForPosition(const IntPoint& point)
+{
+    InlineBox* firstLeaf = firstLeafChild();
+    InlineBox* lastLeaf = lastLeafChild();
+    if (firstLeaf == lastLeaf)
+        return firstLeaf;
+
+    // FIXME: Check for vertical text!
+    InlineBox* closestLeaf = 0;
+    for (InlineBox* leaf = firstLeaf; leaf; leaf = leaf->nextLeafChild()) {
+        if (point.y() < leaf->m_y)
+            continue;
+        if (point.y() > leaf->m_y + leaf->virtualLogicalHeight())
+            continue;
+
+        closestLeaf = leaf;
+        if (point.x() < leaf->m_x + leaf->m_logicalWidth)
+            return leaf;
+    }
+
+    return closestLeaf ? closestLeaf : lastLeaf;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGRootInlineBox.h b/WebCore/rendering/svg/SVGRootInlineBox.h
index 77e7fcb..418c289 100644
--- a/WebCore/rendering/SVGRootInlineBox.h
+++ b/WebCore/rendering/svg/SVGRootInlineBox.h
@@ -26,10 +26,8 @@
 
 #if ENABLE(SVG)
 #include "RootInlineBox.h"
-#include "SVGCharacterData.h"
-#include "SVGCharacterLayoutInfo.h"
 #include "SVGRenderSupport.h"
-#include "SVGTextChunkLayoutInfo.h"
+#include "SVGTextLayoutEngine.h"
 
 namespace WebCore {
 
@@ -55,20 +53,15 @@ public:
     virtual FloatRect objectBoundingBox() const { return FloatRect(); }
     virtual FloatRect repaintRectInLocalCoordinates() const { return FloatRect(); }
 
-    // Used by SVGRenderTreeAsText
-    const Vector<SVGTextChunk>& svgTextChunks() const { return m_svgTextChunks; }
+    InlineBox* closestLeafChildForPosition(const IntPoint&);
 
 private:
-    void propagateTextChunkPartInformation();
-    void buildLayoutInformation(InlineFlowBox* start, SVGCharacterLayoutInfo&);
-
+    void layoutCharactersInTextBoxes(InlineFlowBox*, SVGTextLayoutEngine&);
+    void layoutChildBoxes(InlineFlowBox*);
     void layoutRootBox();
-    void layoutChildBoxes(InlineFlowBox* start);
 
 private:
     int m_logicalHeight;
-    Vector<SVGChar> m_svgChars;
-    Vector<SVGTextChunk> m_svgTextChunks;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/svg/SVGTextChunk.cpp b/WebCore/rendering/svg/SVGTextChunk.cpp
new file mode 100644
index 0000000..5dea6ad
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextChunk.cpp
@@ -0,0 +1,93 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextChunk.h"
+
+#include "SVGInlineTextBox.h"
+#include "SVGTextFragment.h"
+
+namespace WebCore {
+
+SVGTextChunk::SVGTextChunk(bool isVerticalText, ETextAnchor textAnchor, SVGTextContentElement::SVGLengthAdjustType lengthAdjust, float desiredTextLength)
+    : m_isVerticalText(isVerticalText)
+    , m_textAnchor(textAnchor)
+    , m_lengthAdjust(lengthAdjust)
+    , m_desiredTextLength(desiredTextLength)
+{
+}
+
+void SVGTextChunk::calculateLength(float& length, unsigned& characters) const
+{
+    SVGTextFragment* lastFragment = 0;
+
+    unsigned boxCount = m_boxes.size();
+    for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+        SVGInlineTextBox* textBox = m_boxes.at(boxPosition);
+        Vector<SVGTextFragment>& fragments = textBox->textFragments();
+
+        unsigned size = fragments.size();
+        if (!size)
+            continue;
+
+        for (unsigned i = 0; i < size; ++i) {
+            SVGTextFragment& fragment = fragments.at(i);
+            characters += fragment.length;
+
+            if (m_isVerticalText)
+                length += fragment.height;
+            else
+                length += fragment.width;
+
+            if (!lastFragment) {
+                lastFragment = &fragment;
+                continue;
+            }
+
+            // Resepect gap between chunks.
+            if (m_isVerticalText)
+                 length += fragment.y - (lastFragment->y + lastFragment->height);
+            else
+                 length += fragment.x - (lastFragment->x + lastFragment->width);
+
+            lastFragment = &fragment;
+        }
+    }
+}
+
+float SVGTextChunk::calculateTextAnchorShift(float length) const
+{
+    switch (m_textAnchor) {
+    case TA_START:
+        return 0;
+    case TA_MIDDLE:
+        return -length / 2;
+    case TA_END:
+        return -length;
+    };
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextChunk.h b/WebCore/rendering/svg/SVGTextChunk.h
new file mode 100644
index 0000000..ebe6d81
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextChunk.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextChunk_h
+#define SVGTextChunk_h
+
+#if ENABLE(SVG)
+#include "SVGRenderStyleDefs.h"
+#include "SVGTextContentElement.h"
+
+namespace WebCore {
+
+class SVGInlineTextBox;
+
+// A SVGTextChunk describes a range of SVGTextFragments, see the SVG spec definition of a "text chunk".
+class SVGTextChunk {
+public:
+    SVGTextChunk(bool isVerticalText, ETextAnchor, SVGTextContentElement::SVGLengthAdjustType, float desiredTextLength);
+
+    void calculateLength(float& length, unsigned& characters) const;
+    float calculateTextAnchorShift(float length) const;
+
+    bool isVerticalText() const { return m_isVerticalText; }
+    ETextAnchor textAnchor() const { return m_textAnchor; }
+    SVGTextContentElement::SVGLengthAdjustType lengthAdjust() const { return m_lengthAdjust; }
+    float desiredTextLength() const { return m_desiredTextLength; }
+
+    Vector<SVGInlineTextBox*>& boxes() { return m_boxes; }
+    const Vector<SVGInlineTextBox*>& boxes() const { return m_boxes; }
+
+    bool hasDesiredTextLength() const { return m_lengthAdjust != SVGTextContentElement::LENGTHADJUST_UNKNOWN && m_desiredTextLength > 0; } 
+    bool hasTextAnchor() const { return m_textAnchor != TA_START; }
+
+private:
+    // Contains all SVGInlineTextBoxes this chunk spans.
+    Vector<SVGInlineTextBox*> m_boxes;
+
+    // writing-mode specific property.
+    bool m_isVerticalText;
+
+    // text-anchor specific properties.
+    ETextAnchor m_textAnchor;
+
+    // textLength/lengthAdjust specific properties.
+    SVGTextContentElement::SVGLengthAdjustType m_lengthAdjust;
+    float m_desiredTextLength;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextChunkBuilder.cpp b/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
new file mode 100644
index 0000000..bbbae6c
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextChunkBuilder.cpp
@@ -0,0 +1,232 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextChunkBuilder.h"
+
+#include "RenderSVGInlineText.h"
+#include "SVGElement.h"
+#include "SVGInlineTextBox.h"
+
+namespace WebCore {
+
+SVGTextChunkBuilder::SVGTextChunkBuilder()
+{
+}
+
+void SVGTextChunkBuilder::transformationForTextBox(SVGInlineTextBox* textBox, AffineTransform& transform) const
+{
+    DEFINE_STATIC_LOCAL(const AffineTransform, s_identityTransform, ());
+    if (!m_textBoxTransformations.contains(textBox)) {
+        transform = s_identityTransform;
+        return;
+    }
+
+    transform = m_textBoxTransformations.get(textBox);
+}
+
+void SVGTextChunkBuilder::buildTextChunks(Vector<SVGInlineTextBox*>& lineLayoutBoxes)
+{
+    if (lineLayoutBoxes.isEmpty())
+        return;
+
+    bool foundStart = false;
+    unsigned lastChunkStartPosition = 0;
+    unsigned boxPosition = 0;
+    unsigned boxCount = lineLayoutBoxes.size();
+    for (; boxPosition < boxCount; ++boxPosition) {
+        SVGInlineTextBox* textBox = lineLayoutBoxes.at(boxPosition);
+        if (!textBox->startsNewTextChunk())
+            continue;
+
+        if (!foundStart) {
+            lastChunkStartPosition = boxPosition;
+            foundStart = true;
+        } else {
+            ASSERT(boxPosition > lastChunkStartPosition);
+            addTextChunk(lineLayoutBoxes, lastChunkStartPosition, boxPosition - lastChunkStartPosition);
+            lastChunkStartPosition = boxPosition;
+        }
+    }
+
+    if (!foundStart)
+        return;
+
+    if (boxPosition - lastChunkStartPosition > 0)
+        addTextChunk(lineLayoutBoxes, lastChunkStartPosition, boxPosition - lastChunkStartPosition);
+}
+
+void SVGTextChunkBuilder::layoutTextChunks(Vector<SVGInlineTextBox*>& lineLayoutBoxes)
+{
+    buildTextChunks(lineLayoutBoxes);
+    if (m_textChunks.isEmpty())
+        return;
+
+    unsigned chunkCount = m_textChunks.size();
+    for (unsigned i = 0; i < chunkCount; ++i)
+        processTextChunk(m_textChunks.at(i));
+
+    m_textChunks.clear();
+}
+
+void SVGTextChunkBuilder::addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxes, unsigned boxStart, unsigned boxCount)
+{
+    SVGInlineTextBox* textBox = lineLayoutBoxes.at(boxStart);
+    ASSERT(textBox);
+
+    RenderSVGInlineText* textRenderer = toRenderSVGInlineText(textBox->textRenderer());
+    ASSERT(textRenderer);
+
+    const RenderStyle* style = textRenderer->style();
+    ASSERT(style);
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    SVGTextContentElement::SVGLengthAdjustType lengthAdjust = SVGTextContentElement::LENGTHADJUST_UNKNOWN;
+    float desiredTextLength = 0;
+
+    if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textRenderer->parent())) {
+        lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
+        desiredTextLength = textContentElement->textLength().value(textContentElement);
+    }
+
+    SVGTextChunk chunk(svgStyle->isVerticalWritingMode(), svgStyle->textAnchor(), lengthAdjust, desiredTextLength);
+
+    Vector<SVGInlineTextBox*>& boxes = chunk.boxes();
+    for (unsigned i = boxStart; i < boxStart + boxCount; ++i)
+        boxes.append(lineLayoutBoxes.at(i));
+
+    m_textChunks.append(chunk);
+}
+
+void SVGTextChunkBuilder::processTextChunk(const SVGTextChunk& chunk)
+{
+    bool processTextLength = chunk.hasDesiredTextLength();
+    bool processTextAnchor = chunk.hasTextAnchor();
+    if (!processTextAnchor && !processTextLength)
+        return;
+
+    const Vector<SVGInlineTextBox*>& boxes = chunk.boxes();
+    unsigned boxCount = boxes.size();
+    if (!boxCount)
+        return;
+
+    // Calculate absolute length of whole text chunk (starting from text box 'start', spanning 'length' text boxes).
+    float chunkLength = 0;
+    unsigned chunkCharacters = 0;
+    chunk.calculateLength(chunkLength, chunkCharacters);
+
+    bool isVerticalText = chunk.isVerticalText();
+    if (processTextLength) {
+        if (chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+            float textLengthShift = (chunk.desiredTextLength() - chunkLength) / chunkCharacters;
+            unsigned atCharacter = 0;
+            for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+                Vector<SVGTextFragment>& fragments = boxes.at(boxPosition)->textFragments();
+                if (fragments.isEmpty())
+                    continue;    
+                processTextLengthSpacingCorrection(isVerticalText, textLengthShift, fragments, atCharacter);
+            }
+        } else {
+            ASSERT(chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACINGANDGLYPHS);
+            float scale = chunk.desiredTextLength() / chunkLength;
+            AffineTransform spacingAndGlyphsTransform;
+
+            bool foundFirstFragment = false;
+            for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+                SVGInlineTextBox* textBox = boxes.at(boxPosition);
+                Vector<SVGTextFragment>& fragments = textBox->textFragments();
+                if (fragments.isEmpty())
+                    continue;
+    
+                if (!foundFirstFragment) {
+                    foundFirstFragment = true;
+                    buildSpacingAndGlyphsTransform(isVerticalText, scale, fragments.first(), spacingAndGlyphsTransform);
+                }
+
+                m_textBoxTransformations.set(textBox, spacingAndGlyphsTransform);
+            }
+        }
+    }
+
+    if (!processTextAnchor)
+        return;
+
+    // If we previously applied a lengthAdjust="spacing" correction, we have to recalculate the chunk length, to be able to apply the text-anchor shift.
+    if (processTextLength && chunk.lengthAdjust() == SVGTextContentElement::LENGTHADJUST_SPACING) {
+        chunkLength = 0;
+        chunkCharacters = 0;
+        chunk.calculateLength(chunkLength, chunkCharacters);
+    }
+
+    float textAnchorShift = chunk.calculateTextAnchorShift(chunkLength);
+    for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+        Vector<SVGTextFragment>& fragments = boxes.at(boxPosition)->textFragments();
+        if (fragments.isEmpty())
+            continue;
+        processTextAnchorCorrection(isVerticalText, textAnchorShift, fragments);
+    }
+}
+
+void SVGTextChunkBuilder::processTextLengthSpacingCorrection(bool isVerticalText, float textLengthShift, Vector<SVGTextFragment>& fragments, unsigned& atCharacter)
+{
+    unsigned fragmentCount = fragments.size();
+    for (unsigned i = 0; i < fragmentCount; ++i) {
+        SVGTextFragment& fragment = fragments.at(i);
+
+        if (isVerticalText)
+            fragment.y += textLengthShift * atCharacter;
+        else
+            fragment.x += textLengthShift * atCharacter;
+
+        atCharacter += fragment.length;
+    }
+}
+
+void SVGTextChunkBuilder::processTextAnchorCorrection(bool isVerticalText, float textAnchorShift, Vector<SVGTextFragment>& fragments)
+{
+    unsigned fragmentCount = fragments.size();
+    for (unsigned i = 0; i < fragmentCount; ++i) {
+        SVGTextFragment& fragment = fragments.at(i);
+
+        if (isVerticalText)
+            fragment.y += textAnchorShift;
+        else
+            fragment.x += textAnchorShift;
+    }
+}
+
+void SVGTextChunkBuilder::buildSpacingAndGlyphsTransform(bool isVerticalText, float scale, const SVGTextFragment& fragment, AffineTransform& spacingAndGlyphsTransform)
+{
+    spacingAndGlyphsTransform.translate(fragment.x, fragment.y);
+
+    if (isVerticalText)
+        spacingAndGlyphsTransform.scaleNonUniform(1, scale);
+    else
+        spacingAndGlyphsTransform.scaleNonUniform(scale, 1);
+
+    spacingAndGlyphsTransform.translate(-fragment.x, -fragment.y);
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextChunkBuilder.h b/WebCore/rendering/svg/SVGTextChunkBuilder.h
new file mode 100644
index 0000000..36342e7
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextChunkBuilder.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextChunkBuilder_h
+#define SVGTextChunkBuilder_h
+
+#if ENABLE(SVG)
+#include "SVGTextChunk.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class SVGInlineTextBox;
+struct SVGTextFragment;
+
+// SVGTextChunkBuilder performs the third layout phase for SVG text.
+//
+// Phase one built the layout information from the SVG DOM stored in the RenderSVGInlineText objects (SVGTextLayoutAttributes).
+// Phase two performed the actual per-character layout, computing the final positions for each character, stored in the SVGInlineTextBox objects (SVGTextFragment).
+// Phase three performs all modifications that have to be applied to each individual text chunk (text-anchor & textLength).
+
+class SVGTextChunkBuilder : public Noncopyable {
+public:
+    SVGTextChunkBuilder();
+
+    const Vector<SVGTextChunk>& textChunks() const { return m_textChunks; }
+    void transformationForTextBox(SVGInlineTextBox*, AffineTransform&) const;
+
+    void buildTextChunks(Vector<SVGInlineTextBox*>& lineLayoutBoxes);
+    void layoutTextChunks(Vector<SVGInlineTextBox*>& lineLayoutBoxes);
+
+private:
+    void addTextChunk(Vector<SVGInlineTextBox*>& lineLayoutBoxes, unsigned boxPosition, unsigned boxCount);
+    void processTextChunk(const SVGTextChunk&);
+
+    void processTextLengthSpacingCorrection(bool isVerticalText, float textLengthShift, Vector<SVGTextFragment>&, unsigned& atCharacter);
+    void processTextAnchorCorrection(bool isVerticalText, float textAnchorShift, Vector<SVGTextFragment>&);
+    void buildSpacingAndGlyphsTransform(bool isVerticalText, float scale, const SVGTextFragment&, AffineTransform&);
+
+private:
+    Vector<SVGTextChunk> m_textChunks;
+    HashMap<SVGInlineTextBox*, AffineTransform> m_textBoxTransformations;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextFragment.h b/WebCore/rendering/svg/SVGTextFragment.h
new file mode 100644
index 0000000..2e520da
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextFragment.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextFragment_h
+#define SVGTextFragment_h
+
+#if ENABLE(SVG)
+#include "AffineTransform.h"
+
+namespace WebCore {
+
+// A SVGTextFragment describes a text fragment of a RenderSVGInlineText which can be rendered at once.
+struct SVGTextFragment {
+    SVGTextFragment()
+        : positionListOffset(0)
+        , length(0)
+        , x(0)
+        , y(0)
+        , width(0)
+        , height(0)
+    {
+    }
+
+    // The first rendered character starts at RenderSVGInlineText::characters() + positionListOffset.
+    unsigned positionListOffset;
+    unsigned length;
+
+    float x;
+    float y;
+    float width;
+    float height;
+
+    // Includes rotation/glyph-orientation-(horizontal|vertical) transforms, lengthAdjust="spacingAndGlyphs" (for textPath only),
+    // as well as orientation related shifts (see SVGTextLayoutEngine, which builds this transformation).
+    AffineTransform transform;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp b/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
index 3283b35..3037b77 100644
--- a/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
+++ b/WebCore/rendering/svg/SVGTextLayoutAttributes.cpp
@@ -31,13 +31,13 @@ SVGTextLayoutAttributes::SVGTextLayoutAttributes()
 {
 }
 
-void SVGTextLayoutAttributes::fillWithEmptyValues(unsigned length)
+void SVGTextLayoutAttributes::reserveCapacity(unsigned length)
 {
-    m_xValues.fill(emptyValue(), length);
-    m_yValues.fill(emptyValue(), length);
-    m_dxValues.fill(emptyValue(), length);
-    m_dyValues.fill(emptyValue(), length);
-    m_rotateValues.fill(emptyValue(), length);
+    m_xValues.reserveCapacity(length);
+    m_yValues.reserveCapacity(length);
+    m_dxValues.reserveCapacity(length);
+    m_dyValues.reserveCapacity(length);
+    m_rotateValues.reserveCapacity(length);
 }
 
 float SVGTextLayoutAttributes::emptyValue()
@@ -46,7 +46,7 @@ float SVGTextLayoutAttributes::emptyValue()
     return s_emptyValue;
 }
 
-static inline void dumpLayoutVector(Vector<float>& values)
+static inline void dumpLayoutVector(const Vector<float>& values)
 {
     if (values.isEmpty()) {
         fprintf(stderr, "empty");
@@ -63,7 +63,7 @@ static inline void dumpLayoutVector(Vector<float>& values)
     }
 }
 
-void SVGTextLayoutAttributes::dump()
+void SVGTextLayoutAttributes::dump() const
 {
     fprintf(stderr, "x values: ");
     dumpLayoutVector(m_xValues);
@@ -86,11 +86,11 @@ void SVGTextLayoutAttributes::dump()
     fprintf(stderr, "\n");
 
     fprintf(stderr, "character data values:\n");
-    Vector<CharacterData>::iterator end = m_characterDataValues.end();
-    for (Vector<CharacterData>::iterator it = m_characterDataValues.begin(); it != end; ++it) {
-        CharacterData& data = *it;
-        fprintf(stderr, "| {spansCharacters=%i, glyphName='%s', unicodeString='%s', width=%lf, height=%lf}\n",
-                data.spansCharacters, data.glyphName.utf8().data(), data.unicodeString.utf8().data(), data.width, data.height);
+    unsigned textMetricsSize = m_textMetricsValues.size();
+    for (unsigned i = 0; i < textMetricsSize; ++i) {
+        const SVGTextMetrics& metrics = m_textMetricsValues.at(i);
+        fprintf(stderr, "| {length=%i, glyphName='%s', unicodeString='%s', width=%lf, height=%lf}\n",
+                metrics.length(), metrics.glyph().name.utf8().data(), metrics.glyph().unicodeString.utf8().data(), metrics.width(), metrics.height());
     }
     fprintf(stderr, "\n");
 }
diff --git a/WebCore/rendering/svg/SVGTextLayoutAttributes.h b/WebCore/rendering/svg/SVGTextLayoutAttributes.h
index d88b356..d08d5b7 100644
--- a/WebCore/rendering/svg/SVGTextLayoutAttributes.h
+++ b/WebCore/rendering/svg/SVGTextLayoutAttributes.h
@@ -21,6 +21,7 @@
 #define SVGTextLayoutAttributes_h
 
 #if ENABLE(SVG)
+#include "SVGTextMetrics.h"
 #include <wtf/Vector.h>
 #include <wtf/text/WTFString.h>
 
@@ -30,8 +31,10 @@ class SVGTextLayoutAttributes {
 public:
     SVGTextLayoutAttributes();
 
-    void fillWithEmptyValues(unsigned length);
-    void dump();
+    void reserveCapacity(unsigned length);
+    void dump() const;
+
+    static float emptyValue();
 
     Vector<float>& xValues() { return m_xValues; }
     const Vector<float>& xValues() const { return m_xValues; }
@@ -48,31 +51,8 @@ public:
     Vector<float>& rotateValues() { return m_rotateValues; }
     const Vector<float>& rotateValues() const { return m_rotateValues; }
 
-    static float emptyValue();
-
-    struct CharacterData {
-        CharacterData()
-            : spansCharacters(0)
-            , width(0)
-            , height(0)
-        {
-        }
-
-        // When multiple unicode characters map to a single glyph (eg. 'ffi' ligature)
-        // 'spansCharacters' contains the number of characters this glyph spans.
-        int spansCharacters;
-        
-        // The 'glyphName' / 'unicodeString' pair is needed for kerning calculations.
-        String glyphName;
-        String unicodeString;
-
-        // 'width' and 'height' hold the size of this glyph/character.
-        float width;
-        float height;
-    };
-
-    Vector<CharacterData>& characterDataValues() { return m_characterDataValues; }
-    const Vector<CharacterData>& characterDataValues() const { return m_characterDataValues; }
+    Vector<SVGTextMetrics>& textMetricsValues() { return m_textMetricsValues; }
+    const Vector<SVGTextMetrics>& textMetricsValues() const { return m_textMetricsValues; }
 
 private:
     Vector<float> m_xValues;
@@ -80,7 +60,7 @@ private:
     Vector<float> m_dxValues;
     Vector<float> m_dyValues;
     Vector<float> m_rotateValues;
-    Vector<CharacterData> m_characterDataValues;
+    Vector<SVGTextMetrics> m_textMetricsValues;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp b/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
new file mode 100644
index 0000000..c3f4b6a
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.cpp
@@ -0,0 +1,317 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextLayoutAttributesBuilder.h"
+
+#include "RenderSVGInlineText.h"
+#include "RenderSVGText.h"
+#include "SVGTextPositioningElement.h"
+
+// Set to a value > 0 to dump the text layout attributes
+#define DUMP_TEXT_LAYOUT_ATTRIBUTES 0
+
+namespace WebCore {
+
+SVGTextLayoutAttributesBuilder::SVGTextLayoutAttributesBuilder()
+{
+}
+
+void SVGTextLayoutAttributesBuilder::buildLayoutAttributesForTextSubtree(RenderSVGText* textRoot)
+{
+    ASSERT(textRoot);
+    m_scopes.clear();
+
+    // Build list of x/y/dx/dy/rotate values for each subtree element that may define these values (tspan/textPath etc).
+    unsigned atCharacter = 0;
+    UChar lastCharacter = '\0';
+    buildLayoutScopes(textRoot, atCharacter, lastCharacter);
+
+    if (!atCharacter)
+        return;
+
+    // Build list of x/y/dx/dy/rotate values for the outermost <text> element.
+    buildOutermostLayoutScope(textRoot, atCharacter);
+
+    // Propagate layout attributes to each RenderSVGInlineText object.
+    atCharacter = 0;
+    lastCharacter = '\0';
+    propagateLayoutAttributes(textRoot, atCharacter, lastCharacter);
+}
+
+static inline void extractFloatValuesFromSVGLengthList(SVGElement* lengthContext, SVGLengthList* list, Vector<float>& floatValues, unsigned textContentLength)
+{
+    ASSERT(lengthContext);
+    ASSERT(list);
+
+    unsigned length = list->numberOfItems();
+    if (length > textContentLength)
+        length = textContentLength;
+    floatValues.reserveCapacity(length);
+
+    ExceptionCode ec = 0;
+    for (unsigned i = 0; i < length; ++i) {
+        SVGLength length = list->getItem(i, ec);
+        ASSERT(!ec);
+        floatValues.append(length.value(lengthContext));
+    }
+}
+
+static inline void extractFloatValuesFromSVGNumberList(SVGNumberList* list, Vector<float>& floatValues, unsigned textContentLength)
+{
+    ASSERT(list);
+
+    unsigned length = list->numberOfItems();
+    if (length > textContentLength)
+        length = textContentLength;
+    floatValues.reserveCapacity(length);
+
+    ExceptionCode ec = 0;
+    for (unsigned i = 0; i < length; ++i) {
+        float length = list->getItem(i, ec);
+        ASSERT(!ec);
+        floatValues.append(length);
+    }
+}
+
+void SVGTextLayoutAttributesBuilder::buildLayoutScope(LayoutScope& scope, RenderObject* renderer, unsigned textContentStart, unsigned textContentLength) const
+{
+    ASSERT(renderer);
+    ASSERT(renderer->style());
+
+    scope.textContentStart = textContentStart;
+    scope.textContentLength = textContentLength;
+
+    SVGTextPositioningElement* element = SVGTextPositioningElement::elementFromRenderer(renderer);
+    if (!element)
+        return;
+
+    SVGTextLayoutAttributes& attributes = scope.attributes;
+    extractFloatValuesFromSVGLengthList(element, element->x(), attributes.xValues(), textContentLength);
+    extractFloatValuesFromSVGLengthList(element, element->y(), attributes.yValues(), textContentLength);
+    extractFloatValuesFromSVGLengthList(element, element->dx(), attributes.dxValues(), textContentLength);
+    extractFloatValuesFromSVGLengthList(element, element->dy(), attributes.dyValues(), textContentLength);
+    extractFloatValuesFromSVGNumberList(element->rotate(), attributes.rotateValues(), textContentLength);
+
+    // The last rotation value spans the whole scope.
+    Vector<float>& rotateValues = attributes.rotateValues();
+    if (rotateValues.isEmpty())
+        return;
+
+    unsigned rotateValuesSize = rotateValues.size();
+    if (rotateValuesSize == textContentLength)
+        return;
+
+    float lastRotation = rotateValues.last();
+
+    rotateValues.resize(textContentLength);
+    for (unsigned i = rotateValuesSize; i < textContentLength; ++i)
+        rotateValues.at(i) = lastRotation;
+}
+
+static inline bool characterIsSpace(const UChar& character)
+{
+    return character == ' ';
+}
+
+static inline bool characterIsSpaceOrNull(const UChar& character)
+{
+    return character == ' ' || character == '\0';
+}
+
+static inline bool shouldPreserveAllWhiteSpace(RenderStyle* style)
+{
+    ASSERT(style);
+    return style->whiteSpace() == PRE;
+}
+ 
+void SVGTextLayoutAttributesBuilder::buildLayoutScopes(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter)
+{
+    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
+        if (child->isSVGInlineText()) {
+            RenderSVGInlineText* text = toRenderSVGInlineText(child);
+
+            if (!shouldPreserveAllWhiteSpace(text->style())) {
+                const UChar* characters = text->characters();
+                unsigned textLength = text->textLength();    
+                for (unsigned textPosition = 0; textPosition < textLength; ++textPosition) {
+                    const UChar& currentCharacter = characters[textPosition];
+                    if (characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter))
+                        continue;
+
+                    lastCharacter = currentCharacter;
+                    ++atCharacter;
+                }
+            } else
+                atCharacter += text->textLength();
+
+            continue;
+        }
+
+        if (!child->isSVGInline())
+            continue;
+
+        unsigned textContentStart = atCharacter;
+        buildLayoutScopes(child, atCharacter, lastCharacter);
+
+        LayoutScope scope;
+        buildLayoutScope(scope, child, textContentStart, atCharacter - textContentStart);
+        m_scopes.append(scope);
+    }
+}
+
+void SVGTextLayoutAttributesBuilder::buildOutermostLayoutScope(RenderSVGText* textRoot, unsigned textLength)
+{
+    LayoutScope scope;
+    buildLayoutScope(scope, textRoot, 0, textLength);
+
+    // Handle <text> x/y default attributes.
+    Vector<float>& xValues = scope.attributes.xValues();
+    if (xValues.isEmpty())
+        xValues.append(0);
+
+    Vector<float>& yValues = scope.attributes.yValues();
+    if (yValues.isEmpty())
+        yValues.append(0);
+
+    m_scopes.prepend(scope);
+}
+
+void SVGTextLayoutAttributesBuilder::propagateLayoutAttributes(RenderObject* start, unsigned& atCharacter, UChar& lastCharacter) const
+{
+    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
+        if (child->isSVGInlineText()) {
+            RenderSVGInlineText* text = toRenderSVGInlineText(child);
+            const UChar* characters = text->characters();
+            unsigned textLength = text->textLength();
+            bool preserveWhiteSpace = shouldPreserveAllWhiteSpace(text->style());
+
+            SVGTextLayoutAttributes attributes;
+            attributes.reserveCapacity(textLength);
+    
+            unsigned valueListPosition = atCharacter;
+            unsigned metricsLength = 1;
+            for (unsigned textPosition = 0; textPosition < textLength; textPosition += metricsLength) {
+                const UChar& currentCharacter = characters[textPosition];
+
+                SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, textPosition, 1);
+                metricsLength = metrics.length();
+
+                if (!preserveWhiteSpace && characterIsSpace(currentCharacter) && characterIsSpaceOrNull(lastCharacter)) {
+                    assignEmptyLayoutAttributesForCharacter(attributes);
+                    attributes.textMetricsValues().append(SVGTextMetrics::emptyMetrics());
+                    continue;
+                }
+
+                assignLayoutAttributesForCharacter(attributes, metrics, valueListPosition);
+
+                if (metricsLength > 1) {
+                    for (unsigned i = 0; i < metricsLength - 1; ++i)
+                        assignEmptyLayoutAttributesForCharacter(attributes);
+                }
+
+                lastCharacter = currentCharacter;
+                valueListPosition += metricsLength;
+            }
+
+#if DUMP_TEXT_LAYOUT_ATTRIBUTES > 0
+            fprintf(stderr, "\nDumping layout attributes for RenderSVGInlineText, renderer=%p, node=%p (atCharacter: %i)\n", text, text->node(), atCharacter);
+            attributes.dump();
+#endif
+
+            text->storeLayoutAttributes(attributes);
+            atCharacter = valueListPosition;
+            continue;
+        }
+
+        if (!child->isSVGInline())
+            continue;
+
+        propagateLayoutAttributes(child, atCharacter, lastCharacter);
+    }
+}
+
+float SVGTextLayoutAttributesBuilder::nextLayoutValue(LayoutValueType type, unsigned atCharacter) const
+{
+    for (int i = m_scopes.size() - 1; i >= 0; --i) {
+        const LayoutScope& scope = m_scopes.at(i);
+        if (scope.textContentStart > atCharacter || scope.textContentStart + scope.textContentLength < atCharacter)
+            continue;
+
+        const Vector<float>* valuesPointer = 0;
+        switch (type) {
+        case XValueAttribute:
+            valuesPointer = &scope.attributes.xValues();
+            break;
+        case YValueAttribute:
+            valuesPointer = &scope.attributes.yValues();
+            break;
+        case DxValueAttribute:
+            valuesPointer = &scope.attributes.dxValues();
+            break;
+        case DyValueAttribute:
+            valuesPointer = &scope.attributes.dyValues();
+            break;
+        case RotateValueAttribute:
+            valuesPointer = &scope.attributes.rotateValues();
+            break;
+        default:
+            ASSERT_NOT_REACHED();
+        }
+
+        ASSERT(valuesPointer);
+        const Vector<float>& values = *valuesPointer;
+        if (values.isEmpty())
+            continue;
+
+        unsigned position = atCharacter - scope.textContentStart;
+        if (position >= values.size())
+            continue;
+
+        return values.at(position);
+    }
+
+    return SVGTextLayoutAttributes::emptyValue();
+}
+
+void SVGTextLayoutAttributesBuilder::assignLayoutAttributesForCharacter(SVGTextLayoutAttributes& attributes, SVGTextMetrics& metrics, unsigned valueListPosition) const
+{
+    attributes.xValues().append(nextLayoutValue(XValueAttribute, valueListPosition));
+    attributes.yValues().append(nextLayoutValue(YValueAttribute, valueListPosition));
+    attributes.dxValues().append(nextLayoutValue(DxValueAttribute, valueListPosition));
+    attributes.dyValues().append(nextLayoutValue(DyValueAttribute, valueListPosition));
+    attributes.rotateValues().append(nextLayoutValue(RotateValueAttribute, valueListPosition));
+    attributes.textMetricsValues().append(metrics);
+}
+
+void SVGTextLayoutAttributesBuilder::assignEmptyLayoutAttributesForCharacter(SVGTextLayoutAttributes& attributes) const
+{
+    attributes.xValues().append(SVGTextLayoutAttributes::emptyValue());
+    attributes.yValues().append(SVGTextLayoutAttributes::emptyValue());
+    attributes.dxValues().append(SVGTextLayoutAttributes::emptyValue());
+    attributes.dyValues().append(SVGTextLayoutAttributes::emptyValue());
+    attributes.rotateValues().append(SVGTextLayoutAttributes::emptyValue());
+    // This doesn't add an empty value to textMetricsValues() on purpose!
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextLayoutBuilder.h b/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
index 6df7fa1..f29ac64 100644
--- a/WebCore/rendering/svg/SVGTextLayoutBuilder.h
+++ b/WebCore/rendering/svg/SVGTextLayoutAttributesBuilder.h
@@ -17,8 +17,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef SVGTextLayoutBuilder_h
-#define SVGTextLayoutBuilder_h
+#ifndef SVGTextLayoutAttributesBuilder_h
+#define SVGTextLayoutAttributesBuilder_h
 
 #if ENABLE(SVG)
 #include "SVGTextLayoutAttributes.h"
@@ -27,38 +27,54 @@
 namespace WebCore {
 
 class RenderObject;
-class RenderSVGInlineText;
 class RenderSVGText;
 
-class SVGTextLayoutBuilder : public Noncopyable {
+// SVGTextLayoutAttributesBuilder performs the first layout phase for SVG text.
+//
+// It extracts the x/y/dx/dy/rotate values from the SVGTextPositioningElements in the DOM,
+// measures all characters in the RenderSVGText subtree and extracts kerning/ligature information.
+// These values are propagated to the corresponding RenderSVGInlineText renderers.
+// The first layout phase only extracts the relevant information needed in RenderBlockLineLayout
+// to create the InlineBox tree based on text chunk boundaries & BiDi information.
+// The second layout phase is carried out by SVGTextLayoutEngine.
+
+class SVGTextLayoutAttributesBuilder : public Noncopyable {
 public:
-    SVGTextLayoutBuilder();
+    SVGTextLayoutAttributesBuilder();
     void buildLayoutAttributesForTextSubtree(RenderSVGText*);
 
 private:
     struct LayoutScope {
         LayoutScope()
-            : isVerticalWritingMode(false)
-            , textContentStart(0)
+            : textContentStart(0)
             , textContentLength(0)
         {
         }
 
-        bool isVerticalWritingMode;
         unsigned textContentStart;
         unsigned textContentLength;
         SVGTextLayoutAttributes attributes;
     };
 
-    void buildLayoutScopes(RenderObject*, unsigned& atCharacter);
-    void buildLayoutScope(LayoutScope&, RenderObject*, unsigned textContentStart, unsigned textContentLength);
-    void buildLayoutAttributesFromScopes();
-    void propagateLayoutAttributes(RenderObject*, unsigned& atCharacter);
-    void measureCharacters(RenderSVGInlineText*, SVGTextLayoutAttributes&);
+    void buildLayoutScope(LayoutScope&, RenderObject*, unsigned textContentStart, unsigned textContentLength) const;
+    void buildLayoutScopes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter);
+    void buildOutermostLayoutScope(RenderSVGText*, unsigned textLength);
+    void propagateLayoutAttributes(RenderObject*, unsigned& atCharacter, UChar& lastCharacter) const;
+
+    enum LayoutValueType {
+        XValueAttribute,
+        YValueAttribute,
+        DxValueAttribute,
+        DyValueAttribute,
+        RotateValueAttribute
+    };
+
+    float nextLayoutValue(LayoutValueType, unsigned atCharacter) const;
+    void assignLayoutAttributesForCharacter(SVGTextLayoutAttributes&, SVGTextMetrics&, unsigned valueListPosition) const;
+    void assignEmptyLayoutAttributesForCharacter(SVGTextLayoutAttributes&) const;
 
 private:
     Vector<LayoutScope> m_scopes;
-    SVGTextLayoutAttributes m_attributes;
 };
 
 } // namespace WebCore
diff --git a/WebCore/rendering/svg/SVGTextLayoutBuilder.cpp b/WebCore/rendering/svg/SVGTextLayoutBuilder.cpp
deleted file mode 100644
index 0b3a752..0000000
--- a/WebCore/rendering/svg/SVGTextLayoutBuilder.cpp
+++ /dev/null
@@ -1,304 +0,0 @@
-/*
- * Copyright (C) Research In Motion Limited 2010. All rights reserved.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Library General Public
- * License as published by the Free Software Foundation; either
- * version 2 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Library General Public License for more details.
- *
- * You should have received a copy of the GNU Library General Public License
- * along with this library; see the file COPYING.LIB.  If not, write to
- * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- * Boston, MA 02110-1301, USA.
- */
-
-#include "config.h"
-
-#if ENABLE(SVG)
-#include "SVGTextLayoutBuilder.h"
-
-#include "RenderSVGInlineText.h"
-#include "RenderSVGText.h"
-#include "SVGTextLayoutUtilities.h"
-#include "SVGTextPositioningElement.h"
-
-// Set to a value > 0 to dump the layout vectors
-#define DUMP_LAYOUT_VECTORS 0
-
-namespace WebCore {
-
-SVGTextLayoutBuilder::SVGTextLayoutBuilder()
-{
-}
-
-void SVGTextLayoutBuilder::buildLayoutAttributesForTextSubtree(RenderSVGText* textRoot)
-{
-    ASSERT(textRoot);
-    m_scopes.clear();
-
-    // Build layout scopes.
-    unsigned atCharacter = 0;
-    buildLayoutScopes(textRoot, atCharacter);
-
-    if (!atCharacter)
-        return;
-
-    // Add outermost scope, after text length is known.
-    LayoutScope scope;
-    buildLayoutScope(scope, textRoot, 0, atCharacter);
-    m_scopes.prepend(scope);
-
-    // Build layout information respecting scope of attribute values.
-    buildLayoutAttributesFromScopes();
-
-    atCharacter = 0;
-    propagateLayoutAttributes(textRoot, atCharacter);
-}
-
-static inline void copyToDestinationVector(Vector<float>& destination, unsigned destinationStartOffset, Vector<float>& source, unsigned sourceStartOffset, unsigned length)
-{
-    ASSERT(destinationStartOffset + length <= destination.size());
-
-    Vector<float>::iterator sourceBegin = source.begin() + sourceStartOffset;
-    std::copy(sourceBegin, sourceBegin + length, destination.begin() + destinationStartOffset);
-}
-
-static inline void copyToDestinationVectorIfSourceRangeIsNotEmpty(Vector<float>& destination, unsigned destinationStartOffset, Vector<float>& source, unsigned sourceStartOffset, unsigned length)
-{
-    bool rangeEmpty = true;
-
-    unsigned size = sourceStartOffset + length;
-    for (unsigned i = sourceStartOffset; i < size; ++i) {
-        if (source.at(i) == SVGTextLayoutAttributes::emptyValue())
-            continue;
-        rangeEmpty = false;
-        break;
-    }
-
-    if (rangeEmpty)
-        return;
-
-    destination.resize(length);
-    copyToDestinationVector(destination, destinationStartOffset, source, sourceStartOffset, length);
-}
-
-void SVGTextLayoutBuilder::propagateLayoutAttributes(RenderObject* start, unsigned& atCharacter)
-{
-    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
-        if (!child->isSVGInlineText()) {
-            if (child->isSVGInline())
-                propagateLayoutAttributes(child, atCharacter);
-            continue;
-        }
-
-        RenderSVGInlineText* text = static_cast<RenderSVGInlineText*>(child);
-        unsigned textLength = text->textLength();
-
-        // Build layout attributes for a single RenderSVGInlineText renderer.
-        SVGTextLayoutAttributes attributes;
-
-        // The x value list should always be as large as the text length.
-        // Any values that are empty will be filled in by the actual text layout process later,
-        // as we need to be able to query the x/y position for every character through SVG DOM.
-        attributes.xValues().resize(textLength);
-        copyToDestinationVector(attributes.xValues(), 0, m_attributes.xValues(), atCharacter, textLength);
-
-        // Same for the y value list.
-        attributes.yValues().resize(textLength);
-        copyToDestinationVector(attributes.yValues(), 0, m_attributes.yValues(), atCharacter, textLength);
-
-        // The dx/dy/rotate value lists may be empty.
-        copyToDestinationVectorIfSourceRangeIsNotEmpty(attributes.dxValues(), 0, m_attributes.dxValues(), atCharacter, textLength);
-        copyToDestinationVectorIfSourceRangeIsNotEmpty(attributes.dyValues(), 0, m_attributes.dyValues(), atCharacter, textLength);
-        copyToDestinationVectorIfSourceRangeIsNotEmpty(attributes.rotateValues(), 0, m_attributes.rotateValues(), atCharacter, textLength);
-
-        // Build CharacterData, which will be used to detect ligatures, holds kerning pairs (glyph name, unicode string) and character metrics.
-        measureCharacters(text, attributes);
-
-#if DUMP_LAYOUT_VECTORS > 0
-        fprintf(stderr, "Dumping layout vector for RenderSVGInlineText, renderer=%p, node=%p\n", text, text->node());
-        attributes.dump();
-#endif
-
-        text->storeLayoutAttributes(attributes);
-        atCharacter += text->textLength();
-    }
-}
-
-void SVGTextLayoutBuilder::buildLayoutScopes(RenderObject* start, unsigned& atCharacter)
-{
-    for (RenderObject* child = start->firstChild(); child; child = child->nextSibling()) { 
-        if (child->isSVGInlineText()) {
-            atCharacter += toRenderText(child)->textLength();
-            continue;
-        }
-
-        if (!child->isSVGInline())
-            continue;
-
-        unsigned textContentStart = atCharacter;
-        buildLayoutScopes(child, atCharacter);
-
-        LayoutScope scope;
-        buildLayoutScope(scope, child, textContentStart, atCharacter - textContentStart);
-        m_scopes.append(scope);
-    }
-}
-
-static inline void fillDestinationVectorWithLastSourceValue(Vector<float>& destination, unsigned destinationStartOffset, Vector<float>& source, unsigned length)
-{
-    if (source.isEmpty())
-        return;
-
-    float lastValue = source.last();
-
-    unsigned rotateValuesSize = source.size();
-    for (unsigned i = rotateValuesSize; i < length; ++i) {
-        ASSERT(i + destinationStartOffset < destination.size());
-        destination.at(i + destinationStartOffset) = lastValue;
-    }
-}
-
-void SVGTextLayoutBuilder::buildLayoutAttributesFromScopes()
-{
-    ASSERT(!m_scopes.isEmpty());
-
-    unsigned totalLength = m_scopes.first().textContentLength;
-    if (!totalLength)
-        return;
-
-    m_attributes.fillWithEmptyValues(totalLength);
-
-    // Build final list of x/y/dx/dy/rotate values for each character stores in the <text> subtree.
-    for (unsigned atScope = 0; atScope < m_scopes.size(); ++atScope) {
-        LayoutScope& scope = m_scopes.at(atScope);
-        SVGTextLayoutAttributes& attributes = scope.attributes;
-
-        copyToDestinationVector(m_attributes.xValues(), scope.textContentStart, attributes.xValues(), 0, attributes.xValues().size());
-        copyToDestinationVector(m_attributes.yValues(), scope.textContentStart, attributes.yValues(), 0, attributes.yValues().size());
-        copyToDestinationVector(m_attributes.dxValues(), scope.textContentStart, attributes.dxValues(), 0, attributes.dxValues().size());
-        copyToDestinationVector(m_attributes.dyValues(), scope.textContentStart, attributes.dyValues(), 0, attributes.dyValues().size());
-        copyToDestinationVector(m_attributes.rotateValues(), scope.textContentStart, attributes.rotateValues(), 0, attributes.rotateValues().size());
-
-        // In horizontal (vertical) writing modes, the last y (x) value in the scope is the default y (x) value for all following characters, unless explicitely overriden.
-        if (scope.isVerticalWritingMode)
-            fillDestinationVectorWithLastSourceValue(m_attributes.xValues(), scope.textContentStart, attributes.xValues(), scope.textContentLength);
-        else
-            fillDestinationVectorWithLastSourceValue(m_attributes.yValues(), scope.textContentStart, attributes.yValues(), scope.textContentLength);
-
-        // The last rotation value in the scope is the default rotation for all following character, unless explicitely overriden.
-        fillDestinationVectorWithLastSourceValue(m_attributes.rotateValues(), scope.textContentStart, attributes.rotateValues(), scope.textContentLength);
-    }
-}
-
-void SVGTextLayoutBuilder::measureCharacters(RenderSVGInlineText* text, SVGTextLayoutAttributes& attributes)
-{
-    ASSERT(text);
-    ASSERT(text->style());
-    const Font& font = text->style()->font();
-    const UChar* characters = text->characters();
-    int length = text->textLength();
-
-    TextRun run(0, 0);
-    run.disableSpacing();
-    run.disableRoundingHacks();
-
-    int charsConsumed = 0;
-    for (int position = 0; position < length; position += charsConsumed) {
-        run.setText(characters + position, 1);
-        int extraCharsAvailable = length - position - 1;
-
-        SVGTextLayoutAttributes::CharacterData characterData;
-        characterData.width = font.floatWidth(run, extraCharsAvailable, characterData.spansCharacters, characterData.glyphName);
-        characterData.height = font.height();
-        characterData.unicodeString = String(characters + position, characterData.spansCharacters);
-        attributes.characterDataValues().append(characterData);
-
-        charsConsumed = characterData.spansCharacters;
-    }
-}
-
-static inline void extractFloatValuesFromSVGLengthList(SVGElement* lengthContext, SVGLengthList* list, Vector<float>& floatValues, int textContentLength)
-{
-    ASSERT(lengthContext);
-    ASSERT(list);
-    ASSERT(textContentLength >= 0);
-
-    ExceptionCode ec = 0;
-    int length = list->numberOfItems();
-    if (length > textContentLength)
-        length = textContentLength;
-
-    for (int i = 0; i < length; ++i) {
-        SVGLength length(list->getItem(i, ec));
-        ASSERT(!ec);
-        floatValues.append(length.value(lengthContext));
-    }
-}
-
-static inline void extractFloatValuesFromSVGNumberList(SVGNumberList* list, Vector<float>& floatValues, int textContentLength)
-{
-    ASSERT(list);
-    ASSERT(textContentLength >= 0);
-
-    ExceptionCode ec = 0;
-    int length = list->numberOfItems();
-    if (length > textContentLength)
-        length = textContentLength;
-
-    for (int i = 0; i < length; ++i) {
-        float length(list->getItem(i, ec));
-        ASSERT(!ec);
-        floatValues.append(length);
-    }
-}
-
-static inline SVGTextPositioningElement* svgTextPositioningElementForInlineRenderer(RenderObject* renderer)
-{
-    ASSERT(renderer);
-    ASSERT(renderer->isSVGText() || renderer->isSVGInline());
-
-    Node* node = renderer->node();
-    ASSERT(node);
-    ASSERT(node->isSVGElement());
-
-    if (!node->hasTagName(SVGNames::textTag)
-     && !node->hasTagName(SVGNames::tspanTag)
-#if ENABLE(SVG_FONTS)
-     && !node->hasTagName(SVGNames::altGlyphTag)
-#endif
-     && !node->hasTagName(SVGNames::trefTag))
-        return 0;
-
-    return static_cast<SVGTextPositioningElement*>(node);
-}
-
-void SVGTextLayoutBuilder::buildLayoutScope(LayoutScope& scope, RenderObject* renderer, unsigned textContentStart, unsigned textContentLength)
-{
-    ASSERT(renderer);
-    ASSERT(renderer->style());
-
-    scope.isVerticalWritingMode = isVerticalWritingMode(renderer->style()->svgStyle());
-    scope.textContentStart = textContentStart;
-    scope.textContentLength = textContentLength;
-
-    SVGTextPositioningElement* element = svgTextPositioningElementForInlineRenderer(renderer);
-    if (!element)
-        return;
-
-    SVGTextLayoutAttributes& attributes = scope.attributes;
-    extractFloatValuesFromSVGLengthList(element, element->x(), attributes.xValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->y(), attributes.yValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->dx(), attributes.dxValues(), textContentLength);
-    extractFloatValuesFromSVGLengthList(element, element->dy(), attributes.dyValues(), textContentLength);
-    extractFloatValuesFromSVGNumberList(element->rotate(), attributes.rotateValues(), textContentLength);
-}
-
-}
-
-#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextLayoutEngine.cpp b/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
new file mode 100644
index 0000000..7eefad6
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutEngine.cpp
@@ -0,0 +1,579 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextLayoutEngine.h"
+
+#include "RenderSVGInlineText.h"
+#include "RenderSVGTextPath.h"
+#include "SVGElement.h"
+#include "SVGInlineTextBox.h"
+#include "SVGTextLayoutEngineBaseline.h"
+#include "SVGTextLayoutEngineSpacing.h"
+
+// Set to a value > 0 to dump the text fragments
+#define DUMP_TEXT_FRAGMENTS 0
+
+namespace WebCore {
+
+SVGTextLayoutEngine::SVGTextLayoutEngine()
+    : m_x(0)
+    , m_y(0)
+    , m_dx(0)
+    , m_dy(0)
+    , m_isVerticalText(false)
+    , m_inPathLayout(false)
+    , m_textPathLength(0)
+    , m_textPathCurrentOffset(0)
+    , m_textPathSpacing(0)
+    , m_textPathScaling(1)
+{
+}
+
+void SVGTextLayoutEngine::updateCharacerPositionIfNeeded(float& x, float& y)
+{
+    if (m_inPathLayout)
+        return;
+
+    // Replace characters x/y position, with the current text position plus any
+    // relative adjustments, if it doesn't specify an absolute position itself.
+    if (x == SVGTextLayoutAttributes::emptyValue()) 
+        x = m_x + m_dx;
+
+    if (y == SVGTextLayoutAttributes::emptyValue())
+        y = m_y + m_dy;
+
+    m_dx = 0;
+    m_dy = 0;
+}
+
+void SVGTextLayoutEngine::updateCurrentTextPosition(float x, float y, float glyphAdvance)
+{
+    // Update current text position after processing the character.
+    if (m_isVerticalText) {
+        m_x = x;
+        m_y = y + glyphAdvance;
+    } else {
+        m_x = x + glyphAdvance;
+        m_y = y;
+    }
+}
+
+void SVGTextLayoutEngine::updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned positionListOffset)
+{
+    // Update relative positioning information.
+    if (dxValues.isEmpty() && dyValues.isEmpty())
+        return;
+
+    float dx = 0;
+    if (!dxValues.isEmpty()) {
+        float& dxCurrent = dxValues.at(positionListOffset);
+        if (dxCurrent != SVGTextLayoutAttributes::emptyValue())
+            dx = dxCurrent;
+    }
+
+    float dy = 0;
+    if (!dyValues.isEmpty()) {
+        float& dyCurrent = dyValues.at(positionListOffset);
+        if (dyCurrent != SVGTextLayoutAttributes::emptyValue())
+            dy = dyCurrent;
+    }
+
+    if (m_inPathLayout) {
+        if (m_isVerticalText) {
+            m_dx += dx;
+            m_dy = dy;
+        } else {
+            m_dx = dx;
+            m_dy += dy;
+        }
+
+        return;
+    }
+
+    m_dx = dx;
+    m_dy = dy;
+}
+
+void SVGTextLayoutEngine::recordTextFragment(SVGInlineTextBox* textBox, RenderSVGInlineText* text, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics)
+{
+    ASSERT(!m_currentTextFragment.length);
+
+    // Figure out length of fragment.
+    m_currentTextFragment.length = positionListOffset - m_currentTextFragment.positionListOffset;
+
+    // Figure out fragment metrics.
+    if (m_currentTextFragment.length == 1) {
+        // Fast path, can rely on already computed per-character metrics.
+        m_currentTextFragment.width = lastCharacterMetrics.width();
+        m_currentTextFragment.height = lastCharacterMetrics.height();
+    } else {
+        // Need to measure the whole range (range metrics != sum of character metrics)
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(text, m_currentTextFragment.positionListOffset, m_currentTextFragment.length);
+        m_currentTextFragment.width = metrics.width();
+        m_currentTextFragment.height = metrics.height();
+    }
+
+    textBox->textFragments().append(m_currentTextFragment);
+    m_currentTextFragment = SVGTextFragment();
+}
+
+bool SVGTextLayoutEngine::parentDefinesTextLength(RenderObject* parent) const
+{
+    RenderObject* currentParent = parent;
+    while (currentParent) {
+        SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(currentParent);
+        if (textContentElement) {
+            SVGTextContentElement::SVGLengthAdjustType lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
+            if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACING && textContentElement->textLength().value(textContentElement) > 0)
+                return true;
+        }
+
+        if (currentParent->isSVGText())
+            return false;
+
+        currentParent = currentParent->parent();
+    }
+
+    ASSERT_NOT_REACHED();
+    return false;
+}
+
+void SVGTextLayoutEngine::beginTextPathLayout(RenderObject* object, SVGTextLayoutEngine& lineLayout)
+{
+    ASSERT(object);
+
+    m_inPathLayout = true;
+    RenderSVGTextPath* textPath = toRenderSVGTextPath(object);
+
+    m_textPath = textPath->layoutPath();
+    m_textPathStartOffset = textPath->startOffset();
+    m_textPathLength = m_textPath.length();
+    if (m_textPathStartOffset > 0 && m_textPathStartOffset <= 1)
+        m_textPathStartOffset *= m_textPathLength;
+
+    float totalLength = 0;
+    unsigned totalCharacters = 0;
+
+    lineLayout.m_chunkLayoutBuilder.buildTextChunks(lineLayout.m_lineLayoutBoxes);
+    const Vector<SVGTextChunk>& textChunks = lineLayout.m_chunkLayoutBuilder.textChunks();
+
+    unsigned size = textChunks.size();
+    for (unsigned i = 0; i < size; ++i) {
+        const SVGTextChunk& chunk = textChunks.at(i);
+
+        float length = 0;
+        unsigned characters = 0;
+        chunk.calculateLength(length, characters);
+
+        // Handle text-anchor as additional start offset for text paths.
+        m_textPathStartOffset += chunk.calculateTextAnchorShift(length);
+
+        totalLength += length;
+        totalCharacters += characters;
+    }
+
+    m_textPathCurrentOffset = m_textPathStartOffset;
+
+    // Eventually handle textLength adjustments.
+    SVGTextContentElement::SVGLengthAdjustType lengthAdjust = SVGTextContentElement::LENGTHADJUST_UNKNOWN;
+    float desiredTextLength = 0;
+
+    if (SVGTextContentElement* textContentElement = SVGTextContentElement::elementFromRenderer(textPath)) {
+        lengthAdjust = static_cast<SVGTextContentElement::SVGLengthAdjustType>(textContentElement->lengthAdjust());
+        desiredTextLength = textContentElement->textLength().value(textContentElement);
+    }
+
+    if (!desiredTextLength)
+        return;
+
+    if (lengthAdjust == SVGTextContentElement::LENGTHADJUST_SPACING)
+        m_textPathSpacing = (desiredTextLength - totalLength) / totalCharacters;
+    else
+        m_textPathScaling = desiredTextLength / totalLength;
+}
+
+void SVGTextLayoutEngine::endTextPathLayout()
+{
+    m_inPathLayout = false;
+    m_textPath = Path();
+    m_textPathLength = 0;
+    m_textPathStartOffset = 0;
+    m_textPathCurrentOffset = 0;
+    m_textPathSpacing = 0;
+    m_textPathScaling = 1;
+}
+
+void SVGTextLayoutEngine::layoutInlineTextBox(SVGInlineTextBox* textBox)
+{
+    ASSERT(textBox);
+
+    RenderSVGInlineText* text = toRenderSVGInlineText(textBox->textRenderer());
+    ASSERT(text);
+    ASSERT(text->parent());
+    ASSERT(text->parent()->node());
+    ASSERT(text->parent()->node()->isSVGElement());
+
+    const RenderStyle* style = text->style();
+    ASSERT(style);
+
+    textBox->clearTextFragments();
+    m_isVerticalText = style->svgStyle()->isVerticalWritingMode();
+    layoutTextOnLineOrPath(textBox, text, style);
+
+    if (m_inPathLayout) {
+        m_pathLayoutBoxes.append(textBox);
+        return;
+    }
+
+    m_lineLayoutBoxes.append(textBox);
+}
+
+void SVGTextLayoutEngine::finishLayout()
+{
+    // After all text fragments are stored in their correpsonding SVGInlineTextBoxes, we can layout individual text chunks.
+    // Chunk layouting is only performed for line layout boxes, not for path layout, where it has already been done.
+    m_chunkLayoutBuilder.layoutTextChunks(m_lineLayoutBoxes);
+
+    // Finalize transform matrices, after the chunk layout corrections have been applied, and all fragment x/y positions are finalized.
+    if (!m_lineLayoutBoxes.isEmpty()) {
+#if DUMP_TEXT_FRAGMENTS > 0
+        fprintf(stderr, "Line layout: ");
+#endif
+
+        finalizeTransformMatrices(m_lineLayoutBoxes);
+    }
+
+    if (!m_pathLayoutBoxes.isEmpty()) {
+#if DUMP_TEXT_FRAGMENTS > 0
+        fprintf(stderr, "Path layout: ");
+#endif
+        finalizeTransformMatrices(m_pathLayoutBoxes);
+    }
+}
+
+void SVGTextLayoutEngine::finalizeTransformMatrices(Vector<SVGInlineTextBox*>& boxes)
+{
+    unsigned boxCount = boxes.size();
+
+#if DUMP_TEXT_FRAGMENTS > 0
+    fprintf(stderr, "Dumping all text fragments in text sub tree, %i boxes\n", boxCount);
+
+    for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+        SVGInlineTextBox* textBox = boxes.at(boxPosition);
+        Vector<SVGTextFragment>& fragments = textBox->textFragments();
+        fprintf(stderr, "-> Box %i: Dumping text fragments for SVGInlineTextBox, textBox=%p, textRenderer=%p\n", boxPosition, textBox, textBox->textRenderer());
+        fprintf(stderr, "        textBox properties, start=%i, len=%i\n", textBox->start(), textBox->len());
+        fprintf(stderr, "   textRenderer properties, textLength=%i\n", textBox->textRenderer()->textLength());
+
+        const UChar* characters = textBox->textRenderer()->characters();
+
+        unsigned fragmentCount = fragments.size();
+        for (unsigned i = 0; i < fragmentCount; ++i) {
+            SVGTextFragment& fragment = fragments.at(i);
+            String fragmentString(characters + fragment.positionListOffset, fragment.length);
+            fprintf(stderr, "    -> Fragment %i, x=%lf, y=%lf, width=%lf, height=%lf, positionListOffset=%i, length=%i, characters='%s'\n"
+                          , i, fragment.x, fragment.y, fragment.width, fragment.height, fragment.positionListOffset, fragment.length, fragmentString.utf8().data());
+        }
+    }
+#endif
+
+
+    if (!boxCount)
+        return;
+
+    AffineTransform textBoxTransformation;
+    for (unsigned boxPosition = 0; boxPosition < boxCount; ++boxPosition) {
+        SVGInlineTextBox* textBox = boxes.at(boxPosition);
+        Vector<SVGTextFragment>& fragments = textBox->textFragments();
+
+        unsigned fragmentCount = fragments.size();
+        for (unsigned i = 0; i < fragmentCount; ++i) {
+            SVGTextFragment& fragment = fragments.at(i);
+            AffineTransform& transform = fragment.transform;
+            if (!transform.isIdentity()) {
+                transform.translateRight(fragment.x, fragment.y);
+                transform.translate(-fragment.x, -fragment.y);
+            }
+
+            m_chunkLayoutBuilder.transformationForTextBox(textBox, textBoxTransformation);
+            if (textBoxTransformation.isIdentity())
+                continue;
+
+            if (transform.isIdentity())
+                transform = textBoxTransformation;
+            else
+                transform.multiply(textBoxTransformation);
+        }
+    }
+
+    boxes.clear();
+}
+
+void SVGTextLayoutEngine::layoutTextOnLineOrPath(SVGInlineTextBox* textBox, RenderSVGInlineText* text, const RenderStyle* style)
+{
+    SVGElement* lengthContext = static_cast<SVGElement*>(text->parent()->node());
+    
+    RenderObject* textParent = text->parent();
+    bool definesTextLength = textParent ? parentDefinesTextLength(textParent) : false;
+
+    const SVGRenderStyle* svgStyle = style->svgStyle();
+    ASSERT(svgStyle);
+
+    SVGTextLayoutAttributes& attributes = text->layoutAttributes();
+    Vector<float>& xValues = attributes.xValues();
+    Vector<float>& yValues = attributes.yValues();
+    Vector<float>& dxValues = attributes.dxValues();
+    Vector<float>& dyValues = attributes.dyValues();
+    Vector<float>& rotateValues = attributes.rotateValues();
+    Vector<SVGTextMetrics>& textMetricsValues = attributes.textMetricsValues();
+
+    unsigned boxStart = textBox->start();
+    unsigned boxLength = textBox->len();
+    unsigned textMetricsSize = textMetricsValues.size();
+    ASSERT(textMetricsSize <= xValues.size());
+    ASSERT(textMetricsSize <= yValues.size());
+    ASSERT(xValues.size() == yValues.size());
+
+    if (boxLength > textMetricsSize)
+        textMetricsSize = boxLength; 
+
+    unsigned positionListOffset = 0;
+    unsigned metricsListOffset = 0;
+    const UChar* characters = text->characters();
+
+    const Font& font = style->font();
+    SVGTextLayoutEngineSpacing spacingLayout(font);
+    SVGTextLayoutEngineBaseline baselineLayout(font);
+
+    bool didStartTextFragment = false;
+    bool applySpacingToNextCharacter = false;
+
+    float lastAngle = 0;
+    float baselineShift = baselineLayout.calculateBaselineShift(svgStyle, lengthContext);
+    baselineShift -= baselineLayout.calculateAlignmentBaselineShift(m_isVerticalText, text);
+
+    // Main layout algorithm.
+    unsigned positionListSize = xValues.size();
+    for (; metricsListOffset < textMetricsSize && positionListOffset < positionListSize; ++metricsListOffset) {
+        SVGTextMetrics& metrics = textMetricsValues.at(metricsListOffset);
+        // Advance to text box start location.
+        if (positionListOffset < boxStart) {
+            positionListOffset += metrics.length();
+            continue;
+        }
+
+        // Stop if we've finished processing this text box.
+        if (positionListOffset >= boxStart + boxLength)
+            break;
+ 
+        float x = xValues.at(positionListOffset);
+        float y = yValues.at(positionListOffset);
+
+        // When we've advanced to the box start offset, determine using the original x/y values,
+        // wheter this character starts a new text chunk, before doing any further processing.
+        if (positionListOffset == boxStart)
+            textBox->setStartsNewTextChunk(text->characterStartsNewTextChunk(boxStart));
+
+        if (metrics == SVGTextMetrics::emptyMetrics()) {
+            positionListOffset += metrics.length();
+            continue;
+        }
+
+        const UChar* currentCharacter = characters + positionListOffset;
+        float angle = 0;
+        if (!rotateValues.isEmpty()) {
+            float newAngle = rotateValues.at(positionListOffset);
+            if (newAngle != SVGTextLayoutAttributes::emptyValue())
+                angle = newAngle;
+        }
+
+        // Calculate glyph orientation angle.
+        float orientationAngle = baselineLayout.calculateGlyphOrientationAngle(m_isVerticalText, svgStyle, *currentCharacter);
+
+        // Calculate glyph advance & x/y orientation shifts.
+        float xOrientationShift = 0;
+        float yOrientationShift = 0;
+        float glyphAdvance = baselineLayout.calculateGlyphAdvanceAndOrientation(m_isVerticalText, metrics, orientationAngle, xOrientationShift, yOrientationShift);
+
+        // Assign current text position to x/y values, if needed.
+        updateCharacerPositionIfNeeded(x, y);
+
+        // Apply dx/dy value adjustments to current text position, if needed.
+        updateRelativePositionAdjustmentsIfNeeded(dxValues, dyValues, positionListOffset);
+
+        // Calculate SVG Fonts kerning, if needed.
+        float kerning = spacingLayout.calculateSVGKerning(m_isVerticalText, metrics.glyph());
+
+        // Calculate CSS 'kerning', 'letter-spacing' and 'word-spacing' for next character, if needed.
+        float spacing = spacingLayout.calculateCSSKerningAndSpacing(svgStyle, lengthContext, currentCharacter);
+
+        float textPathOffset = 0;
+        if (m_inPathLayout) {
+            float scaledGlyphAdvance = glyphAdvance * m_textPathScaling;
+            if (m_isVerticalText) {
+                // If there's an absolute y position available, it marks the beginning of a new position along the path.
+                if (y != SVGTextLayoutAttributes::emptyValue())
+                    m_textPathCurrentOffset = y + m_textPathStartOffset;
+
+                m_textPathCurrentOffset += m_dy - kerning;
+                m_dy = 0;
+
+                // Apply dx/dy correction and setup translations that move to the glyph midpoint.
+                xOrientationShift += m_dx + baselineShift;
+                yOrientationShift -= scaledGlyphAdvance / 2;
+            } else {
+                // If there's an absolute x position available, it marks the beginning of a new position along the path.
+                if (x != SVGTextLayoutAttributes::emptyValue())
+                    m_textPathCurrentOffset = x + m_textPathStartOffset;
+
+                m_textPathCurrentOffset += m_dx - kerning;
+                m_dx = 0;
+
+                // Apply dx/dy correction and setup translations that move to the glyph midpoint.
+                xOrientationShift -= scaledGlyphAdvance / 2;
+                yOrientationShift += m_dy - baselineShift;
+            }
+
+            // Calculate current offset along path.
+            textPathOffset = m_textPathCurrentOffset + scaledGlyphAdvance / 2;
+
+            // Move to next character.
+            m_textPathCurrentOffset += scaledGlyphAdvance + m_textPathSpacing + spacing * m_textPathScaling;
+
+            // Skip character, if we're before the path.
+            if (textPathOffset < 0) {
+                positionListOffset += metrics.length();
+                continue;
+            }
+
+            // Stop processing, if the next character lies behind the path.
+            if (textPathOffset > m_textPathLength)
+                break;
+
+            bool ok = false;
+            FloatPoint point = m_textPath.pointAtLength(textPathOffset, ok);
+            ASSERT(ok);
+
+            x = point.x();
+            y = point.y();
+            angle = m_textPath.normalAngleAtLength(textPathOffset, ok);
+            ASSERT(ok);
+
+            // For vertical text on path, the actual angle has to be rotated 90 degrees anti-clockwise, not the orientation angle!
+            if (m_isVerticalText)
+                angle -= 90;
+        } else {
+            // Apply all previously calculated shift values.
+            if (m_isVerticalText) {
+                x += baselineShift;
+                y -= kerning;
+            } else {
+                x -= kerning;
+                y -= baselineShift;
+            }
+
+            x += m_dx;
+            y += m_dy;
+        }
+
+        // Determine wheter we have to start a new fragment.
+        bool shouldStartNewFragment = false;
+
+        if (m_dx || m_dy)
+            shouldStartNewFragment = true;
+
+        if (!shouldStartNewFragment && (m_isVerticalText || m_inPathLayout))
+            shouldStartNewFragment = true;
+
+        if (!shouldStartNewFragment && (angle || angle != lastAngle || orientationAngle))
+            shouldStartNewFragment = true;
+
+        if (!shouldStartNewFragment && (kerning || applySpacingToNextCharacter || definesTextLength))
+            shouldStartNewFragment = true;
+
+        // If we already started a fragment, close it now.
+        if (didStartTextFragment && shouldStartNewFragment) {
+            applySpacingToNextCharacter = false;
+            recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+        }
+
+        // Eventually start a new fragment, if not yet done.
+        if (!didStartTextFragment || shouldStartNewFragment) {
+            ASSERT(!m_currentTextFragment.positionListOffset);
+            ASSERT(!m_currentTextFragment.length);
+
+            didStartTextFragment = true;
+            m_currentTextFragment.positionListOffset = positionListOffset;
+            m_currentTextFragment.x = x;
+            m_currentTextFragment.y = y;
+
+            // Build fragment transformation.
+            if (angle)
+                m_currentTextFragment.transform.rotate(angle);
+
+            if (xOrientationShift || yOrientationShift)
+                m_currentTextFragment.transform.translate(xOrientationShift, yOrientationShift);
+
+            if (orientationAngle)
+                m_currentTextFragment.transform.rotate(orientationAngle);
+
+            if (m_inPathLayout && m_textPathScaling != 1) {
+                if (m_isVerticalText)
+                    m_currentTextFragment.transform.scaleNonUniform(1, m_textPathScaling);
+                else
+                    m_currentTextFragment.transform.scaleNonUniform(m_textPathScaling, 1);
+            }
+        }
+
+        // Update current text position, after processing of the current character finished.
+        if (m_inPathLayout)
+            updateCurrentTextPosition(x, y, glyphAdvance);
+        else {
+            // Apply CSS 'kerning', 'letter-spacing' and 'word-spacing' to next character, if needed.
+            if (spacing)
+                applySpacingToNextCharacter = true;
+
+            float xNew = x - m_dx;
+            float yNew = y - m_dy;
+
+            if (m_isVerticalText)
+                xNew -= baselineShift;
+            else
+                yNew += baselineShift;
+
+            updateCurrentTextPosition(xNew, yNew, glyphAdvance + spacing);
+        }
+
+        positionListOffset += metrics.length();
+        lastAngle = angle;
+    }
+
+    if (!didStartTextFragment)
+        return;
+
+    // Close last open fragment, if needed.
+    recordTextFragment(textBox, text, positionListOffset, textMetricsValues.at(metricsListOffset - 1));
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextLayoutEngine.h b/WebCore/rendering/svg/SVGTextLayoutEngine.h
new file mode 100644
index 0000000..ad058d8
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutEngine.h
@@ -0,0 +1,94 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextLayoutEngine_h
+#define SVGTextLayoutEngine_h
+
+#if ENABLE(SVG)
+#include "Path.h"
+#include "SVGTextChunkBuilder.h"
+#include "SVGTextFragment.h"
+#include "SVGTextMetrics.h"
+#include <wtf/Vector.h>
+
+namespace WebCore {
+
+class RenderObject;
+class RenderStyle;
+class RenderSVGInlineText;
+class SVGElement;
+class SVGInlineTextBox;
+class SVGRenderStyle;
+
+// SVGTextLayoutEngine performs the second layout phase for SVG text.
+//
+// The InlineBox tree was created, containing the text chunk information, necessary to apply
+// certain SVG specific text layout properties (text-length adjustments and text-anchor).
+// The second layout phase uses the SVGTextLayoutAttributes stored in the individual
+// RenderSVGInlineText renderers to compute the final positions for each character
+// which are stored in the SVGInlineTextBox objects.
+
+class SVGTextLayoutEngine : public Noncopyable {
+public:
+    SVGTextLayoutEngine();
+    SVGTextChunkBuilder& chunkLayoutBuilder() { return m_chunkLayoutBuilder; }
+
+    void beginTextPathLayout(RenderObject*, SVGTextLayoutEngine& lineLayout);
+    void endTextPathLayout();
+
+    void layoutInlineTextBox(SVGInlineTextBox*);
+    void finishLayout();
+
+private:
+    void updateCharacerPositionIfNeeded(float& x, float& y);
+    void updateCurrentTextPosition(float x, float y, float glyphAdvance);
+    void updateRelativePositionAdjustmentsIfNeeded(Vector<float>& dxValues, Vector<float>& dyValues, unsigned valueListPosition);
+
+    void recordTextFragment(SVGInlineTextBox*, RenderSVGInlineText*, unsigned positionListOffset, const SVGTextMetrics& lastCharacterMetrics);
+    bool parentDefinesTextLength(RenderObject*) const;
+
+    void layoutTextOnLineOrPath(SVGInlineTextBox*, RenderSVGInlineText*, const RenderStyle*);
+    void finalizeTransformMatrices(Vector<SVGInlineTextBox*>&);
+
+private:
+    Vector<SVGInlineTextBox*> m_lineLayoutBoxes;
+    Vector<SVGInlineTextBox*> m_pathLayoutBoxes;
+    SVGTextChunkBuilder m_chunkLayoutBuilder;
+
+    SVGTextFragment m_currentTextFragment;
+    float m_x;
+    float m_y;
+    float m_dx;
+    float m_dy;
+    bool m_isVerticalText;
+    bool m_inPathLayout;
+
+    // Text on path layout
+    Path m_textPath;
+    float m_textPathLength;
+    float m_textPathStartOffset;
+    float m_textPathCurrentOffset;
+    float m_textPathSpacing;
+    float m_textPathScaling;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp b/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp
new file mode 100644
index 0000000..7060ac6
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.cpp
@@ -0,0 +1,234 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextLayoutEngineBaseline.h"
+
+#include "Font.h"
+#include "RenderObject.h"
+#include "SVGRenderStyle.h"
+#include "SVGTextMetrics.h"
+#include "UnicodeRange.h"
+
+namespace WebCore {
+
+SVGTextLayoutEngineBaseline::SVGTextLayoutEngineBaseline(const Font& font)
+    : m_font(font)
+{
+}
+
+float SVGTextLayoutEngineBaseline::calculateBaselineShift(const SVGRenderStyle* style, SVGElement* lengthContext) const
+{
+    if (style->baselineShift() == BS_LENGTH) {
+        SVGLength baselineShiftValueLength = style->baselineShiftValue();
+        if (baselineShiftValueLength.unitType() == LengthTypePercentage)
+            return baselineShiftValueLength.valueAsPercentage() * m_font.pixelSize();
+
+        return baselineShiftValueLength.value(lengthContext);
+    }
+
+    switch (style->baselineShift()) {
+    case BS_BASELINE:
+        return 0;
+    case BS_SUB:
+        return -m_font.height() / 2;
+    case BS_SUPER:
+        return m_font.height() / 2;
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+EAlignmentBaseline SVGTextLayoutEngineBaseline::dominantBaselineToAlignmentBaseline(bool isVerticalText, const RenderObject* textRenderer) const
+{
+    ASSERT(textRenderer);
+    ASSERT(textRenderer->style());
+    ASSERT(textRenderer->parent());
+    ASSERT(textRenderer->parent()->style());
+
+    const SVGRenderStyle* style = textRenderer->style()->svgStyle();
+    ASSERT(style);
+
+    EDominantBaseline baseline = style->dominantBaseline();
+    if (baseline == DB_AUTO) {
+        if (isVerticalText)
+            baseline = DB_CENTRAL;
+        else
+            baseline = DB_ALPHABETIC;
+    }
+
+    switch (baseline) {
+    case DB_USE_SCRIPT:
+        // FIXME: The dominant-baseline and the baseline-table components are set by determining the predominant script of the character data content.
+        return AB_ALPHABETIC;
+    case DB_NO_CHANGE:
+        return dominantBaselineToAlignmentBaseline(isVerticalText, textRenderer->parent());
+    case DB_RESET_SIZE:
+        return dominantBaselineToAlignmentBaseline(isVerticalText, textRenderer->parent());
+    case DB_IDEOGRAPHIC:
+        return AB_IDEOGRAPHIC;
+    case DB_ALPHABETIC:
+        return AB_ALPHABETIC;
+    case DB_HANGING:
+        return AB_HANGING;
+    case DB_MATHEMATICAL:
+        return AB_MATHEMATICAL;
+    case DB_CENTRAL:
+        return AB_CENTRAL;
+    case DB_MIDDLE:
+        return AB_MIDDLE;
+    case DB_TEXT_AFTER_EDGE:
+        return AB_TEXT_AFTER_EDGE;
+    case DB_TEXT_BEFORE_EDGE:
+        return AB_TEXT_BEFORE_EDGE;
+    default:
+        ASSERT_NOT_REACHED();
+        return AB_AUTO;
+    }
+}
+
+float SVGTextLayoutEngineBaseline::calculateAlignmentBaselineShift(bool isVerticalText, const RenderObject* textRenderer) const
+{
+    ASSERT(textRenderer);
+    ASSERT(textRenderer->style());
+    ASSERT(textRenderer->style()->svgStyle());
+    ASSERT(textRenderer->parent());
+
+    const RenderObject* textRendererParent = textRenderer->parent();
+    ASSERT(textRendererParent);
+
+    EAlignmentBaseline baseline = textRenderer->style()->svgStyle()->alignmentBaseline();
+    if (baseline == AB_AUTO) {
+        baseline = dominantBaselineToAlignmentBaseline(isVerticalText, textRendererParent);
+        ASSERT(baseline != AB_AUTO);
+    }
+
+    // Note: http://wiki.apache.org/xmlgraphics-fop/LineLayout/AlignmentHandling
+    switch (baseline) {
+    case AB_BASELINE:
+        return dominantBaselineToAlignmentBaseline(isVerticalText, textRendererParent);
+    case AB_BEFORE_EDGE:
+    case AB_TEXT_BEFORE_EDGE:
+        return m_font.ascent();
+    case AB_MIDDLE:
+        return m_font.xHeight() / 2;
+    case AB_CENTRAL:
+        return (m_font.ascent() - m_font.descent()) / 2;
+    case AB_AFTER_EDGE:
+    case AB_TEXT_AFTER_EDGE:
+    case AB_IDEOGRAPHIC:
+        return m_font.descent();
+    case AB_ALPHABETIC:
+        return 0;
+    case AB_HANGING:
+        return m_font.ascent() * 8 / 10.f;
+    case AB_MATHEMATICAL:
+        return m_font.ascent() / 2;
+    default:
+        ASSERT_NOT_REACHED();
+        return 0;
+    }
+}
+
+float SVGTextLayoutEngineBaseline::calculateGlyphOrientationAngle(bool isVerticalText, const SVGRenderStyle* style, const UChar& character) const
+{
+    ASSERT(style);
+
+    switch (isVerticalText ? style->glyphOrientationVertical() : style->glyphOrientationHorizontal()) {
+    case GO_AUTO:
+    {
+        // Spec: Fullwidth ideographic and fullwidth Latin text will be set with a glyph-orientation of 0-degrees.
+        // Text which is not fullwidth will be set with a glyph-orientation of 90-degrees.
+        unsigned int unicodeRange = findCharUnicodeRange(character);
+        if (unicodeRange == cRangeSetLatin || unicodeRange == cRangeArabic)
+            return 90;
+
+        return 0;
+    }
+    case GO_90DEG:
+        return 90;
+    case GO_180DEG:
+        return 180;
+    case GO_270DEG:
+        return 270;
+    case GO_0DEG:
+    default:
+        return 0;
+    }
+}
+
+static inline bool glyphOrientationIsMultiplyOf180Degrees(float orientationAngle)
+{
+    return !fabsf(fmodf(orientationAngle, 180));
+}
+
+float SVGTextLayoutEngineBaseline::calculateGlyphAdvanceAndOrientation(bool isVerticalText, SVGTextMetrics& metrics, float angle, float& xOrientationShift, float& yOrientationShift) const
+{
+    bool orientationIsMultiplyOf180Degrees = glyphOrientationIsMultiplyOf180Degrees(angle);
+
+    // The function is based on spec requirements:
+    //
+    // Spec: If the 'glyph-orientation-horizontal' results in an orientation angle that is not a multiple of
+    // of 180 degrees, then the current text position is incremented according to the vertical metrics of the glyph.
+    //
+    // Spec: If if the 'glyph-orientation-vertical' results in an orientation angle that is not a multiple of
+    // 180 degrees, then the current text position is incremented according to the horizontal metrics of the glyph.
+
+    // Vertical orientation handling.
+    if (isVerticalText) {
+        float ascentMinusDescent = m_font.ascent() - m_font.descent();
+        if (!angle) {
+            xOrientationShift = (ascentMinusDescent - metrics.width()) / 2;
+            yOrientationShift = m_font.ascent();
+        } else if (angle == 180)
+            xOrientationShift = (ascentMinusDescent + metrics.width()) / 2;
+        else if (angle == 270) {
+            yOrientationShift = metrics.width();
+            xOrientationShift = ascentMinusDescent;
+        }
+
+        // Vertical advance calculation.
+        if (angle && !orientationIsMultiplyOf180Degrees)
+            return metrics.width();
+
+        return metrics.height();
+    }
+
+    // Horizontal orientation handling.
+    if (angle == 90)
+        yOrientationShift = -metrics.width();
+    else if (angle == 180) {
+        xOrientationShift = metrics.width();
+        yOrientationShift = -m_font.ascent();
+    } else if (angle == 270)
+        xOrientationShift = metrics.width();
+
+    // Horizontal advance calculation.
+    if (angle && !orientationIsMultiplyOf180Degrees)
+        return metrics.height();
+
+    return metrics.width();
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h b/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h
new file mode 100644
index 0000000..d753b39
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutEngineBaseline.h
@@ -0,0 +1,54 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextLayoutEngineBaseline_h
+#define SVGTextLayoutEngineBaseline_h
+
+#if ENABLE(SVG)
+#include "SVGRenderStyleDefs.h"
+#include <wtf/Noncopyable.h>
+
+namespace WebCore {
+
+class Font;
+class RenderObject;
+class SVGElement;
+class SVGRenderStyle;
+class SVGTextMetrics;
+
+// Helper class used by SVGTextLayoutEngine to handle 'alignment-baseline' / 'dominant-baseline' and 'baseline-shift'.
+class SVGTextLayoutEngineBaseline : public Noncopyable {
+public:
+    SVGTextLayoutEngineBaseline(const Font&);
+
+    float calculateBaselineShift(const SVGRenderStyle*, SVGElement* lengthContext) const;
+    float calculateAlignmentBaselineShift(bool isVerticalText, const RenderObject* textRenderer) const;
+    float calculateGlyphOrientationAngle(bool isVerticalText, const SVGRenderStyle*, const UChar& character) const;
+    float calculateGlyphAdvanceAndOrientation(bool isVerticalText, SVGTextMetrics&, float angle, float& xOrientationShift, float& yOrientationShift) const;
+
+private:
+    EAlignmentBaseline dominantBaselineToAlignmentBaseline(bool isVerticalText, const RenderObject* textRenderer) const;
+
+    const Font& m_font;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp b/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp
new file mode 100644
index 0000000..6c54b67
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.cpp
@@ -0,0 +1,96 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextLayoutEngineSpacing.h"
+
+#include "Font.h"
+#include "SVGRenderStyle.h"
+
+#if ENABLE(SVG_FONTS)
+#include "SVGFontElement.h"
+#endif
+
+namespace WebCore {
+
+SVGTextLayoutEngineSpacing::SVGTextLayoutEngineSpacing(const Font& font)
+    : m_font(font)
+    , m_lastCharacter(0)
+{
+}
+
+float SVGTextLayoutEngineSpacing::calculateSVGKerning(bool isVerticalText, const SVGTextMetrics::Glyph& currentGlyph)
+{
+#if ENABLE(SVG_FONTS)
+    if (!m_font.isSVGFont()) {
+        m_lastGlyph.isValid = false;
+        return 0;
+    }
+
+    SVGFontElement* svgFont = m_font.svgFont();
+    ASSERT(svgFont);
+
+    float kerning = 0;
+    if (m_lastGlyph.isValid) {
+        if (isVerticalText)
+            kerning = svgFont->verticalKerningForPairOfStringsAndGlyphs(m_lastGlyph.unicodeString, m_lastGlyph.name, currentGlyph.unicodeString, currentGlyph.name);
+        else
+            kerning = svgFont->horizontalKerningForPairOfStringsAndGlyphs(m_lastGlyph.unicodeString, m_lastGlyph.name, currentGlyph.unicodeString, currentGlyph.name);
+    }
+
+    m_lastGlyph = currentGlyph;
+    m_lastGlyph.isValid = true;
+    kerning *= m_font.size() / m_font.primaryFont()->unitsPerEm();
+    return kerning;
+#else
+    UNUSED_PARAM(isVerticalText);
+    UNUSED_PARAM(currentGlyph);
+    return false;
+#endif
+}
+
+float SVGTextLayoutEngineSpacing::calculateCSSKerningAndSpacing(const SVGRenderStyle* style, SVGElement* lengthContext, const UChar* currentCharacter)
+{
+    float kerning = 0;
+    SVGLength kerningLength = style->kerning();
+    if (kerningLength.unitType() == LengthTypePercentage)
+        kerning = kerningLength.valueAsPercentage() * m_font.pixelSize();
+    else
+        kerning = kerningLength.value(lengthContext);
+
+    const UChar* lastCharacter = m_lastCharacter;
+    m_lastCharacter = currentCharacter;
+
+    if (!kerning && !m_font.letterSpacing() && !m_font.wordSpacing())
+        return 0;
+
+    float spacing = m_font.letterSpacing() + kerning;
+    if (currentCharacter && lastCharacter && m_font.wordSpacing()) {
+        if (Font::treatAsSpace(*currentCharacter) && !Font::treatAsSpace(*lastCharacter))
+            spacing += m_font.wordSpacing();
+    }
+
+    return spacing;
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/SVGCharacterData.cpp b/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h
index 394a303..0a6d736 100644
--- a/WebCore/rendering/SVGCharacterData.cpp
+++ b/WebCore/rendering/svg/SVGTextLayoutEngineSpacing.h
@@ -1,5 +1,4 @@
 /*
- * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
  * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
@@ -16,40 +15,38 @@
  * along with this library; see the file COPYING.LIB.  If not, write to
  * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
  * Boston, MA 02110-1301, USA.
- *
  */
 
-#include "config.h"
-#include "SVGCharacterData.h"
+#ifndef SVGTextLayoutEngineSpacing_h
+#define SVGTextLayoutEngineSpacing_h
 
 #if ENABLE(SVG)
-#include "AffineTransform.h"
+#include "SVGTextMetrics.h"
 
 namespace WebCore {
 
-bool SVGChar::isHidden() const
-{
-    return pathData && pathData->hidden;
-}
+class Font;
+class SVGRenderStyle;
+class SVGElement;
 
-AffineTransform SVGChar::characterTransform() const
-{
-    AffineTransform ctm;
+// Helper class used by SVGTextLayoutEngine to handle 'kerning' / 'letter-spacing' and 'word-spacing'.
+class SVGTextLayoutEngineSpacing : public Noncopyable {
+public:
+    SVGTextLayoutEngineSpacing(const Font&);
 
-    // Rotate character around angle, and possibly scale.
-    ctm.translate(x, y);
-    ctm.rotate(angle);
+    float calculateSVGKerning(bool isVerticalText, const SVGTextMetrics::Glyph& currentGlyph);
+    float calculateCSSKerningAndSpacing(const SVGRenderStyle*, SVGElement* lengthContext, const UChar* currentCharacter);
 
-    if (pathData) {
-        ctm.scaleNonUniform(pathData->xScale, pathData->yScale);
-        ctm.translate(pathData->xShift, pathData->yShift);
-        ctm.rotate(pathData->orientationAngle);
-    }
+private:
+    const Font& m_font;
+    const UChar* m_lastCharacter;
 
-    ctm.translate(orientationShiftX - x, orientationShiftY - y);
-    return ctm;
-}
+#if ENABLE(SVG_FONTS)
+    SVGTextMetrics::Glyph m_lastGlyph;
+#endif
+};
 
 } // namespace WebCore
 
 #endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextMetrics.cpp b/WebCore/rendering/svg/SVGTextMetrics.cpp
new file mode 100644
index 0000000..58d0ad9
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextMetrics.cpp
@@ -0,0 +1,115 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#include "config.h"
+
+#if ENABLE(SVG)
+#include "SVGTextMetrics.h"
+
+#include "RenderSVGInlineText.h"
+
+namespace WebCore {
+
+SVGTextMetrics::SVGTextMetrics()
+    : m_width(0)
+    , m_height(0)
+    , m_length(0)
+{
+}
+
+SVGTextMetrics::SVGTextMetrics(const Font& font, const TextRun& run, unsigned position, unsigned textLength)
+    : m_width(0)
+    , m_height(0)
+    , m_length(0)
+{
+    int extraCharsAvailable = textLength - (position + run.length());
+    int length = 0;
+
+    m_width = font.floatWidth(run, extraCharsAvailable, length, m_glyph.name);
+    m_height = font.height();
+    m_glyph.unicodeString = String(run.characters(), length);
+    m_glyph.isValid = true;
+
+    ASSERT(length >= 0);
+    m_length = static_cast<unsigned>(length);
+}
+
+bool SVGTextMetrics::operator==(const SVGTextMetrics& other)
+{
+    return m_width == other.m_width
+        && m_height == other.m_height
+        && m_length == other.m_length
+        && m_glyph == other.m_glyph;
+}
+
+SVGTextMetrics SVGTextMetrics::emptyMetrics()
+{
+    DEFINE_STATIC_LOCAL(SVGTextMetrics, s_emptyMetrics, ());
+    s_emptyMetrics.m_length = 1;
+    return s_emptyMetrics;
+}
+
+static TextRun constructTextRun(RenderSVGInlineText* text, const UChar* characters, unsigned position, unsigned length)
+{
+    TextRun run(characters + position, length);
+
+#if ENABLE(SVG_FONTS)
+    ASSERT(text->parent());
+    run.setReferencingRenderObject(text->parent());
+#endif
+
+    // Disable any word/character rounding.
+    run.disableRoundingHacks();
+
+    // We handle letter & word spacing ourselves.
+    run.disableSpacing();
+    return run;
+}
+
+SVGTextMetrics SVGTextMetrics::measureCharacterRange(RenderSVGInlineText* text, unsigned position, unsigned length)
+{
+    ASSERT(text);
+    ASSERT(text->style());
+
+    TextRun run(constructTextRun(text, text->characters(), position, length));
+    return SVGTextMetrics(text->style()->font(), run, position, text->textLength());
+}
+
+void SVGTextMetrics::measureAllCharactersIndividually(RenderSVGInlineText* text, Vector<SVGTextMetrics>& allMetrics)
+{
+    ASSERT(text);
+    ASSERT(text->style());
+
+    const Font& font = text->style()->font();
+    const UChar* characters = text->characters();
+    unsigned length = text->textLength();
+
+    TextRun run(constructTextRun(text, 0, 0, 0));
+    for (unsigned position = 0; position < length; ) {
+        run.setText(characters + position, 1);
+
+        SVGTextMetrics metrics(font, run, position, text->textLength());
+        allMetrics.append(metrics);
+        position += metrics.length();
+    }
+}
+
+}
+
+#endif // ENABLE(SVG)
diff --git a/WebCore/rendering/svg/SVGTextMetrics.h b/WebCore/rendering/svg/SVGTextMetrics.h
new file mode 100644
index 0000000..ba18589
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextMetrics.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ */
+
+#ifndef SVGTextMetrics_h
+#define SVGTextMetrics_h
+
+#if ENABLE(SVG)
+#include <wtf/text/WTFString.h>
+
+namespace WebCore {
+
+class Font;
+class RenderSVGInlineText;
+class TextRun;
+
+class SVGTextMetrics {
+public:
+    static SVGTextMetrics emptyMetrics();
+    static SVGTextMetrics measureCharacterRange(RenderSVGInlineText*, unsigned position, unsigned length);
+    static void measureAllCharactersIndividually(RenderSVGInlineText*, Vector<SVGTextMetrics>&);
+
+    bool operator==(const SVGTextMetrics&);
+
+    float width() const { return m_width; }
+    float height() const { return m_height; }
+    unsigned length() const { return m_length; }
+
+    struct Glyph {
+        Glyph()
+            : isValid(false)
+        {
+        }
+
+        bool operator==(const Glyph& other)
+        {
+            return isValid == other.isValid
+                && name == other.name
+                && unicodeString == other.unicodeString;
+        }
+
+        bool isValid;
+        String name;
+        String unicodeString;
+    };
+
+    // Only useful when measuring individual characters, to lookup ligatures.
+    const Glyph& glyph() const { return m_glyph; }
+
+private:
+    SVGTextMetrics();
+    SVGTextMetrics(const Font&, const TextRun&, unsigned position, unsigned textLength);
+
+    float m_width;
+    float m_height;
+    unsigned m_length;
+    Glyph m_glyph;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(SVG)
+#endif
diff --git a/WebCore/rendering/svg/SVGTextQuery.cpp b/WebCore/rendering/svg/SVGTextQuery.cpp
new file mode 100644
index 0000000..fcc7924
--- /dev/null
+++ b/WebCore/rendering/svg/SVGTextQuery.cpp
@@ -0,0 +1,562 @@
+/*
+    Copyright (C) Research In Motion Limited 2010. All rights reserved.
+
+    This library is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This library is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+
+#include "config.h"
+#include "SVGTextQuery.h"
+
+#if ENABLE(SVG)
+#include "FloatConversion.h"
+#include "InlineFlowBox.h"
+#include "RenderBlock.h"
+#include "RenderInline.h"
+#include "RenderSVGInlineText.h"
+#include "SVGInlineTextBox.h"
+#include "SVGTextMetrics.h"
+#include "VisiblePosition.h"
+
+#include <wtf/MathExtras.h>
+
+namespace WebCore {
+
+// Base structure for callback user data
+struct SVGTextQuery::Data {
+    Data()
+        : isVerticalText(false)
+        , processedCharacters(0)
+        , textRenderer(0)
+        , textBox(0)
+    {
+    }
+
+    bool isVerticalText;
+    unsigned processedCharacters;
+    RenderSVGInlineText* textRenderer;
+    const SVGInlineTextBox* textBox;
+};
+
+static inline InlineFlowBox* flowBoxForRenderer(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+
+    if (renderer->isRenderBlock()) {
+        // If we're given a block element, it has to be a RenderSVGText.
+        ASSERT(renderer->isSVGText());
+        RenderBlock* renderBlock = toRenderBlock(renderer);
+
+        // RenderSVGText only ever contains a single line box.
+        InlineFlowBox* flowBox = renderBlock->firstLineBox();
+        ASSERT(flowBox == renderBlock->lastLineBox());
+        return flowBox;
+    }
+
+    if (renderer->isRenderInline()) {
+        // We're given a RenderSVGInline or objects that derive from it (RenderSVGTSpan / RenderSVGTextPath)
+        RenderInline* renderInline = toRenderInline(renderer);
+
+        // RenderSVGInline only ever contains a single line box.
+        InlineFlowBox* flowBox = renderInline->firstLineBox();
+        ASSERT(flowBox == renderInline->lastLineBox());
+        return flowBox;
+    }
+
+    ASSERT_NOT_REACHED();
+    return 0;
+}
+
+static inline float mapLengthThroughFragmentTransformation(const SVGTextFragment& fragment, bool isVerticalText, float length)
+{
+    if (fragment.transform.isIdentity())
+        return length;
+
+    if (isVerticalText)
+        return narrowPrecisionToFloat(static_cast<double>(length) * fragment.transform.yScale());
+
+    return narrowPrecisionToFloat(static_cast<double>(length) * fragment.transform.xScale());
+}
+
+SVGTextQuery::SVGTextQuery(RenderObject* renderer)
+{
+    collectTextBoxesInFlowBox(flowBoxForRenderer(renderer));
+}
+
+void SVGTextQuery::collectTextBoxesInFlowBox(InlineFlowBox* flowBox)
+{
+    if (!flowBox)
+        return;
+
+    for (InlineBox* child = flowBox->firstChild(); child; child = child->nextOnLine()) {
+        if (child->isInlineFlowBox()) {
+            // Skip generated content.
+            if (!child->renderer()->node())
+                continue;
+
+            collectTextBoxesInFlowBox(static_cast<InlineFlowBox*>(child));
+            continue;
+        }
+
+        ASSERT(child->isSVGInlineTextBox());
+        m_textBoxes.append(static_cast<SVGInlineTextBox*>(child));
+    }
+}
+
+bool SVGTextQuery::executeQuery(Data* queryData, ProcessTextFragmentCallback fragmentCallback) const
+{
+    ASSERT(!m_textBoxes.isEmpty());
+
+    unsigned processedCharacters = 0;
+    unsigned textBoxCount = m_textBoxes.size();
+
+    // Loop over all text boxes
+    for (unsigned textBoxPosition = 0; textBoxPosition < textBoxCount; ++textBoxPosition) {
+        queryData->textBox = m_textBoxes.at(textBoxPosition);
+        queryData->textRenderer = toRenderSVGInlineText(queryData->textBox->textRenderer());
+        ASSERT(queryData->textRenderer);
+        ASSERT(queryData->textRenderer->style());
+        ASSERT(queryData->textRenderer->style()->svgStyle());
+
+        queryData->isVerticalText = queryData->textRenderer->style()->svgStyle()->isVerticalWritingMode();
+        const Vector<SVGTextFragment>& fragments = queryData->textBox->textFragments();
+    
+        // Loop over all text fragments in this text box, firing a callback for each.
+        unsigned fragmentCount = fragments.size();
+        for (unsigned i = 0; i < fragmentCount; ++i) {
+            const SVGTextFragment& fragment = fragments.at(i);
+            if ((this->*fragmentCallback)(queryData, fragment))
+                return true;
+
+            processedCharacters += fragment.length;
+        }
+
+        queryData->processedCharacters = processedCharacters;
+    }
+
+    return false;
+}
+
+bool SVGTextQuery::mapStartEndPositionsIntoFragmentCoordinates(Data* queryData, const SVGTextFragment& fragment, int& startPosition, int& endPosition) const
+{
+    // Reuse the same logic used for text selection & painting, to map our query start/length into start/endPositions of the current text fragment.
+    startPosition -= queryData->processedCharacters;
+    endPosition -= queryData->processedCharacters;
+
+    if (startPosition >= endPosition || startPosition < 0 || endPosition < 0)
+        return false;
+
+    modifyStartEndPositionsRespectingLigatures(queryData, startPosition, endPosition);
+    if (!queryData->textBox->mapStartEndPositionsIntoFragmentCoordinates(fragment, startPosition, endPosition))
+        return false;
+
+    ASSERT(startPosition < endPosition);
+    return true;
+}
+
+void SVGTextQuery::modifyStartEndPositionsRespectingLigatures(Data* queryData, int& startPosition, int& endPosition) const
+{
+    const SVGTextLayoutAttributes& layoutAttributes = queryData->textRenderer->layoutAttributes();
+    const Vector<float>& xValues = layoutAttributes.xValues();
+    const Vector<SVGTextMetrics>& textMetricsValues = layoutAttributes.textMetricsValues();
+
+    unsigned boxStart = queryData->textBox->start();
+    unsigned boxLength = queryData->textBox->len();
+
+    unsigned textMetricsOffset = 0;
+    unsigned textMetricsSize = textMetricsValues.size();
+
+    unsigned positionOffset = 0;
+    unsigned positionSize = xValues.size();
+
+    bool alterStartPosition = true;
+    bool alterEndPosition = true;
+
+    int lastPositionOffset = -1;
+    for (; textMetricsOffset < textMetricsSize && positionOffset < positionSize; ++textMetricsOffset) {
+        const SVGTextMetrics& metrics = textMetricsValues.at(textMetricsOffset);
+
+        // Advance to text box start location.
+        if (positionOffset < boxStart) {
+            positionOffset += metrics.length();
+            continue;
+        }
+
+        // Stop if we've finished processing this text box.
+        if (positionOffset >= boxStart + boxLength)
+            break;
+
+        // If the start position maps to a character in the metrics list, we don't need to modify it.
+        if (startPosition == static_cast<int>(positionOffset))
+            alterStartPosition = false;
+
+        // If the start position maps to a character in the metrics list, we don't need to modify it.
+        if (endPosition == static_cast<int>(positionOffset))
+            alterEndPosition = false;
+
+        // Detect ligatures.
+        if (lastPositionOffset != -1 && lastPositionOffset - positionOffset > 1) {
+            if (alterStartPosition && startPosition > lastPositionOffset && startPosition < static_cast<int>(positionOffset)) {
+                startPosition = lastPositionOffset;
+                alterStartPosition = false;
+            }
+
+            if (alterEndPosition && endPosition > lastPositionOffset && endPosition < static_cast<int>(positionOffset)) {
+                endPosition = positionOffset;
+                alterEndPosition = false;
+            }
+        }
+
+        if (!alterStartPosition && !alterEndPosition)
+            break;
+
+        lastPositionOffset = positionOffset;
+        positionOffset += metrics.length();
+    }
+
+    if (!alterStartPosition && !alterEndPosition)
+        return;
+
+    if (lastPositionOffset != -1 && lastPositionOffset - positionOffset > 1) {
+        if (alterStartPosition && startPosition > lastPositionOffset && startPosition < static_cast<int>(positionOffset)) {
+            startPosition = lastPositionOffset;
+            alterStartPosition = false;
+        }
+
+        if (alterEndPosition && endPosition > lastPositionOffset && endPosition < static_cast<int>(positionOffset)) {
+            endPosition = positionOffset;
+            alterEndPosition = false;
+        }
+    }
+}
+
+// numberOfCharacters() implementation
+bool SVGTextQuery::numberOfCharactersCallback(Data*, const SVGTextFragment&) const
+{
+    // no-op
+    return false;
+}
+
+unsigned SVGTextQuery::numberOfCharacters() const
+{
+    if (m_textBoxes.isEmpty())
+        return 0;
+
+    Data data;
+    executeQuery(&data, &SVGTextQuery::numberOfCharactersCallback);
+    return data.processedCharacters;
+}
+
+// textLength() implementation
+struct TextLengthData : SVGTextQuery::Data {
+    TextLengthData()
+        : textLength(0)
+    {
+    }
+
+    float textLength;
+};
+
+bool SVGTextQuery::textLengthCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    TextLengthData* data = static_cast<TextLengthData*>(queryData);
+
+    float fragmentLength = queryData->isVerticalText ? fragment.height : fragment.width;
+    data->textLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
+    return false;
+}
+
+float SVGTextQuery::textLength() const
+{
+    if (m_textBoxes.isEmpty())
+        return 0;
+
+    TextLengthData data;
+    executeQuery(&data, &SVGTextQuery::textLengthCallback);
+    return data.textLength;
+}
+
+// subStringLength() implementation
+struct SubStringLengthData : SVGTextQuery::Data {
+    SubStringLengthData(unsigned queryStartPosition, unsigned queryLength)
+        : startPosition(queryStartPosition)
+        , length(queryLength)
+        , subStringLength(0)
+    {
+    }
+
+    unsigned startPosition;
+    unsigned length;
+
+    float subStringLength;
+};
+
+bool SVGTextQuery::subStringLengthCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    SubStringLengthData* data = static_cast<SubStringLengthData*>(queryData);
+
+    int startPosition = data->startPosition;
+    int endPosition = startPosition + data->length;
+    if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+        return false;
+
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, endPosition - startPosition);
+    float fragmentLength = queryData->isVerticalText ? metrics.height() : metrics.width();
+
+    data->subStringLength += mapLengthThroughFragmentTransformation(fragment, queryData->isVerticalText, fragmentLength);
+    return false;
+}
+
+float SVGTextQuery::subStringLength(unsigned startPosition, unsigned length) const
+{
+    if (m_textBoxes.isEmpty())
+        return 0;
+
+    SubStringLengthData data(startPosition, length);
+    executeQuery(&data, &SVGTextQuery::subStringLengthCallback);
+    return data.subStringLength;
+}
+
+// startPositionOfCharacter() implementation
+struct StartPositionOfCharacterData : SVGTextQuery::Data {
+    StartPositionOfCharacterData(unsigned queryPosition)
+        : position(queryPosition)
+    {
+    }
+
+    unsigned position;
+    FloatPoint startPosition;
+};
+
+bool SVGTextQuery::startPositionOfCharacterCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    StartPositionOfCharacterData* data = static_cast<StartPositionOfCharacterData*>(queryData);
+
+    int startPosition = data->position;
+    int endPosition = startPosition + 1;
+    if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+        return false;
+
+    data->startPosition = FloatPoint(fragment.x, fragment.y);
+
+    if (startPosition) {
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        if (queryData->isVerticalText)
+            data->startPosition.move(0, metrics.height());
+        else
+            data->startPosition.move(metrics.width(), 0);
+    }
+
+    if (fragment.transform.isIdentity())
+        return true;
+
+    data->startPosition = fragment.transform.mapPoint(data->startPosition);
+    return true;
+}
+
+FloatPoint SVGTextQuery::startPositionOfCharacter(unsigned position) const
+{
+    if (m_textBoxes.isEmpty())
+        return FloatPoint();
+
+    StartPositionOfCharacterData data(position);
+    executeQuery(&data, &SVGTextQuery::startPositionOfCharacterCallback);
+    return data.startPosition;
+}
+
+// endPositionOfCharacter() implementation
+struct EndPositionOfCharacterData : SVGTextQuery::Data {
+    EndPositionOfCharacterData(unsigned queryPosition)
+        : position(queryPosition)
+    {
+    }
+
+    unsigned position;
+    FloatPoint endPosition;
+};
+
+bool SVGTextQuery::endPositionOfCharacterCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    EndPositionOfCharacterData* data = static_cast<EndPositionOfCharacterData*>(queryData);
+
+    int startPosition = data->position;
+    int endPosition = startPosition + 1;
+    if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+        return false;
+
+    data->endPosition = FloatPoint(fragment.x, fragment.y);
+
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition + 1);
+    if (queryData->isVerticalText)
+        data->endPosition.move(0, metrics.height());
+    else
+        data->endPosition.move(metrics.width(), 0);
+
+    if (fragment.transform.isIdentity())
+        return true;
+
+    data->endPosition = fragment.transform.mapPoint(data->endPosition);
+    return true;
+}
+
+FloatPoint SVGTextQuery::endPositionOfCharacter(unsigned position) const
+{
+    if (m_textBoxes.isEmpty())
+        return FloatPoint();
+
+    EndPositionOfCharacterData data(position);
+    executeQuery(&data, &SVGTextQuery::endPositionOfCharacterCallback);
+    return data.endPosition;
+}
+
+// rotationOfCharacter() implementation
+struct RotationOfCharacterData : SVGTextQuery::Data {
+    RotationOfCharacterData(unsigned queryPosition)
+        : position(queryPosition)
+        , rotation(0)
+    {
+    }
+
+    unsigned position;
+    float rotation;
+};
+
+bool SVGTextQuery::rotationOfCharacterCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    RotationOfCharacterData* data = static_cast<RotationOfCharacterData*>(queryData);
+
+    int startPosition = data->position;
+    int endPosition = startPosition + 1;
+    if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+        return false;
+
+    AffineTransform newTransform(fragment.transform);
+    newTransform.scale(1 / fragment.transform.xScale(), 1 / fragment.transform.yScale());
+    data->rotation = narrowPrecisionToFloat(rad2deg(atan2(newTransform.b(), newTransform.a())));
+    return true;
+}
+
+float SVGTextQuery::rotationOfCharacter(unsigned position) const
+{
+    if (m_textBoxes.isEmpty())
+        return 0;
+
+    RotationOfCharacterData data(position);
+    executeQuery(&data, &SVGTextQuery::rotationOfCharacterCallback);
+    return data.rotation;
+}
+
+// extentOfCharacter() implementation
+struct ExtentOfCharacterData : SVGTextQuery::Data {
+    ExtentOfCharacterData(unsigned queryPosition)
+        : position(queryPosition)
+    {
+    }
+
+    unsigned position;
+    FloatRect extent;
+};
+
+static inline void calculateGlyphBoundaries(SVGTextQuery::Data* queryData, const SVGTextFragment& fragment, int startPosition, FloatRect& extent)
+{
+    extent.setLocation(FloatPoint(fragment.x, fragment.y - queryData->textRenderer->style()->font().ascent()));
+
+    if (startPosition) {
+        SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset, startPosition);
+        if (queryData->isVerticalText)
+            extent.move(0, metrics.height());
+        else
+            extent.move(metrics.width(), 0);
+    }
+
+    SVGTextMetrics metrics = SVGTextMetrics::measureCharacterRange(queryData->textRenderer, fragment.positionListOffset + startPosition, 1);
+    extent.setSize(FloatSize(metrics.width(), metrics.height()));
+
+    if (fragment.transform.isIdentity())
+        return;
+
+    extent = fragment.transform.mapRect(extent);
+}
+
+bool SVGTextQuery::extentOfCharacterCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    ExtentOfCharacterData* data = static_cast<ExtentOfCharacterData*>(queryData);
+
+    int startPosition = data->position;
+    int endPosition = startPosition + 1;
+    if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+        return false;
+
+    calculateGlyphBoundaries(queryData, fragment, startPosition, data->extent);
+    return true;
+}
+
+FloatRect SVGTextQuery::extentOfCharacter(unsigned position) const
+{
+    if (m_textBoxes.isEmpty())
+        return FloatRect();
+
+    ExtentOfCharacterData data(position);
+    executeQuery(&data, &SVGTextQuery::extentOfCharacterCallback);
+    return data.extent;
+}
+
+// characterNumberAtPosition() implementation
+struct CharacterNumberAtPositionData : SVGTextQuery::Data {
+    CharacterNumberAtPositionData(const FloatPoint& queryPosition)
+        : position(queryPosition)
+    {
+    }
+
+    FloatPoint position;
+};
+
+bool SVGTextQuery::characterNumberAtPositionCallback(Data* queryData, const SVGTextFragment& fragment) const
+{
+    CharacterNumberAtPositionData* data = static_cast<CharacterNumberAtPositionData*>(queryData);
+
+    FloatRect extent;
+    for (unsigned i = 0; i < fragment.length; ++i) {
+        int startPosition = data->processedCharacters + i;
+        int endPosition = startPosition + 1;
+        if (!mapStartEndPositionsIntoFragmentCoordinates(queryData, fragment, startPosition, endPosition))
+            continue;
+
+        calculateGlyphBoundaries(queryData, fragment, startPosition, extent);
+        if (extent.contains(data->position)) {
+            data->processedCharacters += i;
+            return true;
+        }
+    }
+
+    return false;
+}
+
+int SVGTextQuery::characterNumberAtPosition(const FloatPoint& position) const
+{
+    if (m_textBoxes.isEmpty())
+        return -1;
+
+    CharacterNumberAtPositionData data(position);
+    if (!executeQuery(&data, &SVGTextQuery::characterNumberAtPositionCallback))
+        return -1;
+
+    return data.processedCharacters;
+}
+
+}
+
+#endif
diff --git a/WebCore/rendering/SVGTextQuery.h b/WebCore/rendering/svg/SVGTextQuery.h
index f19c72e..9a671f4 100644
--- a/WebCore/rendering/SVGTextQuery.h
+++ b/WebCore/rendering/svg/SVGTextQuery.h
@@ -22,15 +22,14 @@
 
 #if ENABLE(SVG)
 #include "FloatRect.h"
+#include "SVGTextFragment.h"
 #include <wtf/Vector.h>
 
 namespace WebCore {
 
 class InlineFlowBox;
 class RenderObject;
-class RenderStyle;
 class SVGInlineTextBox;
-struct SVGTextChunkPart;
 
 class SVGTextQuery {
 public:
@@ -49,22 +48,22 @@ public:
     struct Data;
 
 private:
-    typedef bool (SVGTextQuery::*ProcessTextChunkPartCallback)(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool executeQuery(Data*, ProcessTextChunkPartCallback) const;
+    typedef bool (SVGTextQuery::*ProcessTextFragmentCallback)(Data*, const SVGTextFragment&) const;
+    bool executeQuery(Data*, ProcessTextFragmentCallback) const;
 
     void collectTextBoxesInFlowBox(InlineFlowBox*);
-    float measureCharacterRange(const SVGInlineTextBox*, RenderStyle*, bool isVerticalText, int startPosition, int length) const;
-    bool mapStartAndLengthIntoChunkPartCoordinates(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&, int& startPosition, int& endPosition) const;
+    bool mapStartEndPositionsIntoFragmentCoordinates(Data*, const SVGTextFragment&, int& startPosition, int& endPosition) const;
+    void modifyStartEndPositionsRespectingLigatures(Data*, int& startPosition, int& endPosition) const;
 
 private:
-    bool numberOfCharactersCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool textLengthCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool subStringLengthCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool startPositionOfCharacterCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool endPositionOfCharacterCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool rotationOfCharacterCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool extentOfCharacterCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
-    bool characterNumberAtPositionCallback(Data*, const SVGInlineTextBox*, const SVGTextChunkPart&) const;
+    bool numberOfCharactersCallback(Data*, const SVGTextFragment&) const;
+    bool textLengthCallback(Data*, const SVGTextFragment&) const;
+    bool subStringLengthCallback(Data*, const SVGTextFragment&) const;
+    bool startPositionOfCharacterCallback(Data*, const SVGTextFragment&) const;
+    bool endPositionOfCharacterCallback(Data*, const SVGTextFragment&) const;
+    bool rotationOfCharacterCallback(Data*, const SVGTextFragment&) const;
+    bool extentOfCharacterCallback(Data*, const SVGTextFragment&) const;
+    bool characterNumberAtPositionCallback(Data*, const SVGTextFragment&) const;
 
 private:
     Vector<SVGInlineTextBox*> m_textBoxes;
diff --git a/WebCore/storage/IDBAny.cpp b/WebCore/storage/IDBAny.cpp
index 45b166d..3a049c0 100644
--- a/WebCore/storage/IDBAny.cpp
+++ b/WebCore/storage/IDBAny.cpp
@@ -70,6 +70,12 @@ PassRefPtr<IDBDatabase> IDBAny::idbDatabase()
     return m_idbDatabase;
 }
 
+PassRefPtr<IDBFactory> IDBAny::idbFactory()
+{
+    ASSERT(m_type == IDBFactoryType);
+    return m_idbFactory;
+}
+
 PassRefPtr<IDBIndex> IDBAny::idbIndex()
 {
     ASSERT(m_type == IDBIndexType);
@@ -88,10 +94,10 @@ PassRefPtr<IDBObjectStore> IDBAny::idbObjectStore()
     return m_idbObjectStore;
 }
 
-PassRefPtr<IDBFactory> IDBAny::idbFactory()
+PassRefPtr<IDBTransaction> IDBAny::idbTransaction()
 {
-    ASSERT(m_type == IDBFactoryType);
-    return m_idbFactory;
+    ASSERT(m_type == IDBTransactionType);
+    return m_idbTransaction;
 }
 
 PassRefPtr<SerializedScriptValue> IDBAny::serializedScriptValue()
@@ -120,6 +126,13 @@ void IDBAny::set(PassRefPtr<IDBDatabase> value)
     m_idbDatabase = value;
 }
 
+void IDBAny::set(PassRefPtr<IDBFactory> value)
+{
+    ASSERT(m_type == UndefinedType);
+    m_type = IDBFactoryType;
+    m_idbFactory = value;
+}
+
 void IDBAny::set(PassRefPtr<IDBIndex> value)
 {
     ASSERT(m_type == UndefinedType);
@@ -134,18 +147,18 @@ void IDBAny::set(PassRefPtr<IDBKey> value)
     m_idbKey = value;
 }
 
-void IDBAny::set(PassRefPtr<IDBObjectStore> value)
+void IDBAny::set(PassRefPtr<IDBTransaction> value)
 {
     ASSERT(m_type == UndefinedType);
-    m_type = IDBObjectStoreType;
-    m_idbObjectStore = value;
+    m_type = IDBTransactionType;
+    m_idbTransaction = value;
 }
 
-void IDBAny::set(PassRefPtr<IDBFactory> value)
+void IDBAny::set(PassRefPtr<IDBObjectStore> value)
 {
     ASSERT(m_type == UndefinedType);
-    m_type = IDBFactoryType;
-    m_idbFactory = value;
+    m_type = IDBObjectStoreType;
+    m_idbObjectStore = value;
 }
 
 void IDBAny::set(PassRefPtr<SerializedScriptValue> value)
diff --git a/WebCore/storage/IDBAny.h b/WebCore/storage/IDBAny.h
index 9066e13..8e3f83e 100644
--- a/WebCore/storage/IDBAny.h
+++ b/WebCore/storage/IDBAny.h
@@ -36,10 +36,11 @@ namespace WebCore {
 
 class IDBCursor;
 class IDBDatabase;
+class IDBFactory;
 class IDBIndex;
 class IDBKey;
 class IDBObjectStore;
-class IDBFactory;
+class IDBTransaction;
 class SerializedScriptValue;
 
 class IDBAny : public RefCounted<IDBAny> {
@@ -71,6 +72,7 @@ public:
         IDBIndexType,
         IDBKeyType,
         IDBObjectStoreType,
+        IDBTransactionType,
         SerializedScriptValueType
     };
 
@@ -82,6 +84,7 @@ public:
     PassRefPtr<IDBIndex> idbIndex();
     PassRefPtr<IDBKey> idbKey();
     PassRefPtr<IDBObjectStore> idbObjectStore();
+    PassRefPtr<IDBTransaction> idbTransaction();
     PassRefPtr<SerializedScriptValue> serializedScriptValue();
 
     // Set can only be called once.
@@ -92,6 +95,7 @@ public:
     void set(PassRefPtr<IDBIndex>);
     void set(PassRefPtr<IDBKey>);
     void set(PassRefPtr<IDBObjectStore>);
+    void set(PassRefPtr<IDBTransaction>);
     void set(PassRefPtr<SerializedScriptValue>);
 
 private:
@@ -106,6 +110,7 @@ private:
     RefPtr<IDBIndex> m_idbIndex;
     RefPtr<IDBKey> m_idbKey;
     RefPtr<IDBObjectStore> m_idbObjectStore;
+    RefPtr<IDBTransaction> m_idbTransaction;
     RefPtr<SerializedScriptValue> m_serializedScriptValue;
 };
 
diff --git a/WebCore/storage/IDBCallbacks.h b/WebCore/storage/IDBCallbacks.h
index bc48477..e62c085 100644
--- a/WebCore/storage/IDBCallbacks.h
+++ b/WebCore/storage/IDBCallbacks.h
@@ -35,14 +35,16 @@
 #include "IDBIndexBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreBackendInterface.h"
+#include "IDBTransactionBackendInterface.h"
 #include "SerializedScriptValue.h"
-#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
 
 #if ENABLE(INDEXED_DATABASE)
 
 namespace WebCore {
 
-class IDBCallbacks : public RefCounted<IDBCallbacks> {
+// FIXME: All child classes need to be made threadsafe.
+class IDBCallbacks : public ThreadSafeShared<IDBCallbacks> {
 public:
     virtual ~IDBCallbacks() { }
 
@@ -53,6 +55,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<IDBKey>) = 0;
     virtual void onSuccess(PassRefPtr<IDBObjectStoreBackendInterface>) = 0;
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>) = 0;
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>) = 0;
 };
 
diff --git a/WebCore/storage/IDBCompleteEvent.cpp b/WebCore/storage/IDBCompleteEvent.cpp
new file mode 100644
index 0000000..f0ad9fc
--- /dev/null
+++ b/WebCore/storage/IDBCompleteEvent.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBCompleteEvent.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "EventNames.h"
+#include "IDBAny.h"
+
+namespace WebCore {
+
+PassRefPtr<IDBCompleteEvent> IDBCompleteEvent::create()
+{
+    return adoptRef(new IDBCompleteEvent());
+}
+
+IDBCompleteEvent::IDBCompleteEvent()
+    : IDBEvent(eventNames().completeEvent, 0) // FIXME: set the source to the transaction
+{
+}
+
+IDBCompleteEvent::~IDBCompleteEvent()
+{
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/platform/text/StringBuilder.h b/WebCore/storage/IDBCompleteEvent.h
index 72adfa7..c407096 100644
--- a/WebCore/platform/text/StringBuilder.h
+++ b/WebCore/storage/IDBCompleteEvent.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -26,44 +26,32 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef StringBuilder_h
-#define StringBuilder_h
+#ifndef IDBCompleteEvent_h
+#define IDBCompleteEvent_h
 
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBEvent.h"
 #include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
 
 namespace WebCore {
 
-enum ConcatMode {
-    ConcatUnaltered,
-    ConcatAddingSpacesBetweenIndividualStrings
-};
-
-class StringBuilder {
+class IDBCompleteEvent : public IDBEvent {
 public:
-    StringBuilder() : m_totalLength(UINT_MAX) {}
-
-    void setNonNull()
-    {
-        if (m_totalLength == UINT_MAX)
-            m_totalLength = 0;
-    }
+    static PassRefPtr<IDBCompleteEvent> create();
+    // FIXME: Need to allow creation of these events from JS.
+    virtual ~IDBCompleteEvent();
 
-    void append(const String&);
-    void append(UChar);
-    void append(char);
-    
-    void clear();
-    unsigned length() const;
-
-    String toString(ConcatMode mode = ConcatUnaltered) const;
+    virtual bool isIDBCompleteEvent() const { return true; }
 
 private:
-    bool isNull() const { return m_totalLength == UINT_MAX; }
-
-    unsigned m_totalLength;
-    Vector<String, 16> m_strings;
+    IDBCompleteEvent();
 };
 
-}
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
 
-#endif
+#endif // IDBCompleteEvent_h
diff --git a/WebCore/storage/IDBCursor.cpp b/WebCore/storage/IDBCursor.cpp
index c1c077b..1aaff9d 100644
--- a/WebCore/storage/IDBCursor.cpp
+++ b/WebCore/storage/IDBCursor.cpp
@@ -33,15 +33,20 @@
 #include "IDBCursorBackendInterface.h"
 #include "IDBKey.h"
 #include "IDBRequest.h"
+#include "IDBTransactionBackendInterface.h"
 #include "ScriptExecutionContext.h"
 #include "SerializedScriptValue.h"
 
 namespace WebCore {
 
-IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request)
+IDBCursor::IDBCursor(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransactionBackendInterface* transaction)
     : m_backend(backend)
     , m_request(request)
+    , m_transaction(transaction)
 {
+    ASSERT(m_backend);
+    ASSERT(m_request);
+    ASSERT(m_transaction);
 }
 
 IDBCursor::~IDBCursor()
@@ -63,26 +68,31 @@ PassRefPtr<IDBAny> IDBCursor::value() const
     return m_backend->value();
 }
 
-PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value)
+PassRefPtr<IDBRequest> IDBCursor::update(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->update(value, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->update(value, request, ec);
+    if (ec)
+        return 0;
     return request.release();
 }
 
-void IDBCursor::continueFunction(PassRefPtr<IDBKey> key)
+void IDBCursor::continueFunction(PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     // FIXME: We're not using the context from when continue was called, which means the callback
     //        will be on the original context openCursor was called on. Is this right?
-    if (m_request->resetReadyState())
-        m_backend->continueFunction(key, m_request);
-    // FIXME: Else throw?
+    if (m_request->resetReadyState(m_transaction.get()))
+        m_backend->continueFunction(key, m_request, ec);
+    else
+        ASSERT_NOT_REACHED();
 }
 
-PassRefPtr<IDBRequest> IDBCursor::remove(ScriptExecutionContext* context)
+PassRefPtr<IDBRequest> IDBCursor::remove(ScriptExecutionContext* context, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->remove(request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->remove(request, ec);
+    if (ec)
+        return 0;
     return request.release();
 }
 
diff --git a/WebCore/storage/IDBCursor.h b/WebCore/storage/IDBCursor.h
index 0c438c4..6f3a940 100644
--- a/WebCore/storage/IDBCursor.h
+++ b/WebCore/storage/IDBCursor.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "ExceptionCode.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -41,6 +42,7 @@ class IDBKey;
 class IDBRequest;
 class ScriptExecutionContext;
 class SerializedScriptValue;
+class IDBTransactionBackendInterface;
 
 class IDBCursor : public RefCounted<IDBCursor> {
 public:
@@ -50,25 +52,29 @@ public:
         PREV = 2,
         PREV_NO_DUPLICATE = 3,
     };
-    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request)
+    static PassRefPtr<IDBCursor> create(PassRefPtr<IDBCursorBackendInterface> backend, IDBRequest* request, IDBTransactionBackendInterface* transaction)
     {
-        return adoptRef(new IDBCursor(backend, request));
+        return adoptRef(new IDBCursor(backend, request, transaction));
     }
     ~IDBCursor();
 
+    // FIXME: Try to modify the code generator so this is unneeded.
+    void continueFunction(ExceptionCode& ec) { continueFunction(0, ec); }
+
     // Implement the IDL
     unsigned short direction() const;
     PassRefPtr<IDBKey> key() const;
     PassRefPtr<IDBAny> value() const;
-    PassRefPtr<IDBRequest> update(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>);
-    void continueFunction(PassRefPtr<IDBKey> = 0);
-    PassRefPtr<IDBRequest> remove(ScriptExecutionContext*);
+    PassRefPtr<IDBRequest> update(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, ExceptionCode&);
+    void continueFunction(PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> remove(ScriptExecutionContext*, ExceptionCode&);
 
 private:
-    explicit IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*);
+    explicit IDBCursor(PassRefPtr<IDBCursorBackendInterface>, IDBRequest*, IDBTransactionBackendInterface*);
 
     RefPtr<IDBCursorBackendInterface> m_backend;
     RefPtr<IDBRequest> m_request;
+    RefPtr<IDBTransactionBackendInterface> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBCursor.idl b/WebCore/storage/IDBCursor.idl
index 232842b..0cef3f9 100644
--- a/WebCore/storage/IDBCursor.idl
+++ b/WebCore/storage/IDBCursor.idl
@@ -37,8 +37,11 @@ module storage {
         readonly attribute IDBKey key;
         readonly attribute IDBAny value;
 
-        [CallWith=ScriptExecutionContext] IDBRequest update(in SerializedScriptValue value);
-        [ImplementationFunction=continueFunction] void continue(in [Optional] IDBKey key);
-        [CallWith=ScriptExecutionContext] IDBRequest remove();
+        [CallWith=ScriptExecutionContext] IDBRequest update(in SerializedScriptValue value)
+            raises (IDBDatabaseException);
+        [ImplementationFunction=continueFunction] void continue(in [Optional] IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest remove()
+            raises (IDBDatabaseException);
     };
 }
diff --git a/WebCore/storage/IDBCursorBackendImpl.cpp b/WebCore/storage/IDBCursorBackendImpl.cpp
index 13df5f0..40b46c6 100644
--- a/WebCore/storage/IDBCursorBackendImpl.cpp
+++ b/WebCore/storage/IDBCursorBackendImpl.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "CrossThreadTask.h"
 #include "IDBCallbacks.h"
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseError.h"
@@ -43,22 +44,24 @@
 
 namespace WebCore {
 
-IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBObjectStoreBackendImpl> idbObjectStore, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query)
+IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBObjectStoreBackendImpl> idbObjectStore, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, IDBTransactionBackendInterface* transaction)
     : m_idbObjectStore(idbObjectStore)
     , m_keyRange(keyRange)
     , m_direction(direction)
     , m_query(query)
     , m_isSerializedScriptValueCursor(true)
+    , m_transaction(transaction)
 {
     loadCurrentRow();
 }
 
-IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBIndexBackendImpl> idbIndex, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor)
+IDBCursorBackendImpl::IDBCursorBackendImpl(PassRefPtr<IDBIndexBackendImpl> idbIndex, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor, IDBTransactionBackendInterface* transaction)
     : m_idbIndex(idbIndex)
     , m_keyRange(keyRange)
     , m_direction(direction)
     , m_query(query)
     , m_isSerializedScriptValueCursor(isSerializedScriptValueCursor)
+    , m_transaction(transaction)
 {
     loadCurrentRow();
 }
@@ -85,7 +88,17 @@ PassRefPtr<IDBAny> IDBCursorBackendImpl::value() const
     return IDBAny::create(m_currentIDBKeyValue.get());
 }
 
-void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
+{
+    RefPtr<IDBCursorBackendImpl> cursor = this;
+    RefPtr<SerializedScriptValue> value = prpValue;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    // FIXME: Throw DATA_ERR and SERIAL_ERR when appropriate.
+    if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::updateInternal, cursor, value, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+}
+
+void IDBCursorBackendImpl::updateInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> cursor, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBCallbacks> callbacks)
 {
     // FIXME: This method doesn't update indexes. It's dangerous to call in its current state.
     callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Not implemented."));
@@ -93,82 +106,100 @@ void IDBCursorBackendImpl::update(PassRefPtr<SerializedScriptValue> prpValue, Pa
 
     RefPtr<SerializedScriptValue> value = prpValue;
 
-    if (!m_query || m_currentId == InvalidId) {
+    if (!cursor->m_query || cursor->m_currentId == InvalidId) {
         // FIXME: Use the proper error code when it's specced.
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Operation not possible."));
         return;
     }
 
     String sql = "UPDATE ObjectStoreData SET value = ? WHERE id = ?";
-    SQLiteStatement updateQuery(database()->sqliteDatabase(), sql);
+    SQLiteStatement updateQuery(cursor->database()->sqliteDatabase(), sql);
     
     bool ok = updateQuery.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
     updateQuery.bindText(1, value->toWireString());
-    updateQuery.bindInt64(2, m_currentId);
+    updateQuery.bindInt64(2, cursor->m_currentId);
     ok = updateQuery.step() == SQLResultDone;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 
-    if (m_isSerializedScriptValueCursor)
-        m_currentSerializedScriptValue = value.release();
+    if (cursor->m_isSerializedScriptValueCursor)
+        cursor->m_currentSerializedScriptValue = value.release();
     callbacks->onSuccess();
 }
 
-void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendImpl::continueFunction(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
+{
+    RefPtr<IDBCursorBackendImpl> cursor = this;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::continueFunctionInternal, cursor, key, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+}
+
+void IDBCursorBackendImpl::continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> prpCursor, PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> callbacks)
 {
+    RefPtr<IDBCursorBackendImpl> cursor = prpCursor;
     RefPtr<IDBKey> key = prpKey;
     while (true) {
-        if (!m_query || m_query->step() != SQLResultRow) {
-            m_query = 0;
-            m_currentId = InvalidId;
-            m_currentKey = 0;
-            m_currentSerializedScriptValue = 0;
-            m_currentIDBKeyValue = 0;
+        if (!cursor->m_query || cursor->m_query->step() != SQLResultRow) {
+            cursor->m_query = 0;
+            cursor->m_currentId = InvalidId;
+            cursor->m_currentKey = 0;
+            cursor->m_currentSerializedScriptValue = 0;
+            cursor->m_currentIDBKeyValue = 0;
             callbacks->onSuccess();
             return;
         }
 
-        RefPtr<IDBKey> oldKey = m_currentKey;
-        loadCurrentRow();
+        RefPtr<IDBKey> oldKey = cursor->m_currentKey;
+        cursor->loadCurrentRow();
 
         // If a key was supplied, we must loop until we find that key (or hit the end).
-        if (key && !key->isEqual(m_currentKey.get()))
+        if (key && !key->isEqual(cursor->m_currentKey.get()))
             continue;
 
         // If we don't have a uniqueness constraint, we can stop now.
-        if (m_direction == IDBCursor::NEXT || m_direction == IDBCursor::PREV)
+        if (cursor->m_direction == IDBCursor::NEXT || cursor->m_direction == IDBCursor::PREV)
             break;
-        if (!m_currentKey->isEqual(oldKey.get()))
+        if (!cursor->m_currentKey->isEqual(oldKey.get()))
             break;
     }
 
-    callbacks->onSuccess(this);
+    callbacks->onSuccess(cursor.get());
+}
+
+void IDBCursorBackendImpl::remove(PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
+{
+    RefPtr<IDBCursorBackendImpl> cursor = this;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!m_transaction->scheduleTask(createCallbackTask(&IDBCursorBackendImpl::removeInternal, cursor, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBCursorBackendImpl::remove(PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendImpl::removeInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl> cursor, PassRefPtr<IDBCallbacks> callbacks)
 {
     // FIXME: This method doesn't update indexes. It's dangerous to call in its current state.
     callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Not implemented."));
     return;
 
-    if (!m_query || m_currentId == InvalidId) {
+    if (!cursor->m_query || cursor->m_currentId == InvalidId) {
         // FIXME: Use the proper error code when it's specced.
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Operation not possible."));
         return;
     }
 
     String sql = "DELETE FROM ObjectStoreData WHERE id = ?";
-    SQLiteStatement deleteQuery(database()->sqliteDatabase(), sql);
+    SQLiteStatement deleteQuery(cursor->database()->sqliteDatabase(), sql);
     
     bool ok = deleteQuery.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    deleteQuery.bindInt64(1, m_currentId);
+    deleteQuery.bindInt64(1, cursor->m_currentId);
     ok = deleteQuery.step() == SQLResultDone;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 
-    m_currentId = InvalidId;
-    m_currentSerializedScriptValue = 0;
-    m_currentIDBKeyValue = 0;
+    cursor->m_currentId = InvalidId;
+    cursor->m_currentSerializedScriptValue = 0;
+    cursor->m_currentIDBKeyValue = 0;
     callbacks->onSuccess();
 }
 
diff --git a/WebCore/storage/IDBCursorBackendImpl.h b/WebCore/storage/IDBCursorBackendImpl.h
index b67ec70..5dd45f2 100644
--- a/WebCore/storage/IDBCursorBackendImpl.h
+++ b/WebCore/storage/IDBCursorBackendImpl.h
@@ -41,35 +41,40 @@ class IDBDatabaseBackendImpl;
 class IDBIndexBackendImpl;
 class IDBKeyRange;
 class IDBObjectStoreBackendImpl;
+class IDBTransactionBackendInterface;
 class SQLiteStatement;
 class SerializedScriptValue;
 
 class IDBCursorBackendImpl : public IDBCursorBackendInterface {
 public:
-    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query)
+    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, IDBTransactionBackendInterface* transaction)
     {
-        return adoptRef(new IDBCursorBackendImpl(objectStore, keyRange, direction, query));
+        return adoptRef(new IDBCursorBackendImpl(objectStore, keyRange, direction, query, transaction));
     }
-    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor)
+    static PassRefPtr<IDBCursorBackendImpl> create(PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> keyRange, IDBCursor::Direction direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor, IDBTransactionBackendInterface* transaction)
     {
-        return adoptRef(new IDBCursorBackendImpl(index, keyRange, direction, query, isSerializedScriptValueCursor));
+        return adoptRef(new IDBCursorBackendImpl(index, keyRange, direction, query, isSerializedScriptValueCursor, transaction));
     }
     virtual ~IDBCursorBackendImpl();
 
     virtual unsigned short direction() const;
     virtual PassRefPtr<IDBKey> key() const;
     virtual PassRefPtr<IDBAny> value() const;
-    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>);
-    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void remove(PassRefPtr<IDBCallbacks>);
+    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBCallbacks>, ExceptionCode&);
 
 private:
-    IDBCursorBackendImpl(PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassOwnPtr<SQLiteStatement> query);
-    IDBCursorBackendImpl(PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor);
+    IDBCursorBackendImpl(PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassOwnPtr<SQLiteStatement> query, IDBTransactionBackendInterface*);
+    IDBCursorBackendImpl(PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, IDBCursor::Direction, PassOwnPtr<SQLiteStatement> query, bool isSerializedScriptValueCursor, IDBTransactionBackendInterface*);
 
     void loadCurrentRow();
     IDBDatabaseBackendImpl* database() const;
 
+    static void updateInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>);
+    static void continueFunctionInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
+    static void removeInternal(ScriptExecutionContext*, PassRefPtr<IDBCursorBackendImpl>, PassRefPtr<IDBCallbacks>);
+
     static const int64_t InvalidId = -1;
 
     // Only one or the other should be used.
@@ -86,6 +91,8 @@ private:
     // Only one of these will ever be used for each instance. Which depends on m_isSerializedScriptValueCursor.
     RefPtr<SerializedScriptValue> m_currentSerializedScriptValue;
     RefPtr<IDBKey> m_currentIDBKeyValue;
+
+    RefPtr<IDBTransactionBackendInterface> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBCursorBackendInterface.h b/WebCore/storage/IDBCursorBackendInterface.h
index 4b209c4..e1ac274 100644
--- a/WebCore/storage/IDBCursorBackendInterface.h
+++ b/WebCore/storage/IDBCursorBackendInterface.h
@@ -28,6 +28,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "ExceptionCode.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/Threading.h>
@@ -48,9 +49,9 @@ public:
     virtual PassRefPtr<IDBKey> key() const = 0;
     virtual PassRefPtr<IDBAny> value() const = 0;
 
-    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void remove(PassRefPtr<IDBCallbacks>) = 0;
+    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&) = 0;
+    virtual void continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, ExceptionCode&) = 0;
+    virtual void remove(PassRefPtr<IDBCallbacks>, ExceptionCode&) = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBDatabase.cpp b/WebCore/storage/IDBDatabase.cpp
index 0ea7ac2..1ee0fa9 100644
--- a/WebCore/storage/IDBDatabase.cpp
+++ b/WebCore/storage/IDBDatabase.cpp
@@ -27,7 +27,10 @@
 #include "IDBDatabase.h"
 
 #include "IDBAny.h"
+#include "IDBDatabaseError.h"
+#include "IDBDatabaseException.h"
 #include "IDBFactoryBackendInterface.h"
+#include "IDBIndex.h"
 #include "IDBObjectStore.h"
 #include "IDBRequest.h"
 #include "IDBTransaction.h"
@@ -40,7 +43,7 @@ namespace WebCore {
 IDBDatabase::IDBDatabase(PassRefPtr<IDBDatabaseBackendInterface> backend)
     : m_backend(backend)
 {
-    // We pass a reference to this object before it can be adopted.
+    // We pass a reference of this object before it can be adopted.
     relaxAdoptionRequirement();
 }
 
@@ -48,47 +51,58 @@ IDBDatabase::~IDBDatabase()
 {
 }
 
-PassRefPtr<IDBRequest> IDBDatabase::createObjectStore(ScriptExecutionContext* context, const String& name, const String& keyPath, bool autoIncrement)
+void IDBDatabase::setSetVersionTransaction(IDBTransactionBackendInterface* transaction)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->createObjectStore(name, keyPath, autoIncrement, request);
-    return request;
+    m_setVersionTransaction = transaction;
 }
 
-// FIXME: remove this method.
-PassRefPtr<IDBObjectStore> IDBDatabase::objectStore(const String& name, unsigned short mode)
+PassRefPtr<IDBObjectStore> IDBDatabase::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, ExceptionCode& ec)
 {
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->objectStore(name, mode);
-    ASSERT(objectStore); // FIXME: If this is null, we should raise a NOT_FOUND_ERR.
-    return IDBObjectStore::create(objectStore.release(), 0);
+    if (!m_setVersionTransaction) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return 0;
+    }
+
+    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_backend->createObjectStore(name, keyPath, autoIncrement, m_setVersionTransaction.get(), ec);
+    if (!objectStore)
+        return 0;
+    return IDBObjectStore::create(objectStore.release(), m_setVersionTransaction.get());
 }
 
-PassRefPtr<IDBRequest> IDBDatabase::removeObjectStore(ScriptExecutionContext* context, const String& name)
+void IDBDatabase::removeObjectStore(const String& name, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->removeObjectStore(name, request);
-    return request;
+    if (!m_setVersionTransaction) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return;
+    }
+
+    m_backend->removeObjectStore(name, m_setVersionTransaction.get(), ec);
 }
 
-PassRefPtr<IDBRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version)
+PassRefPtr<IDBRequest> IDBDatabase::setVersion(ScriptExecutionContext* context, const String& version, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->setVersion(version, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), 0);
+    m_backend->setVersion(version, request, ec);
     return request;
 }
 
-PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* context, DOMStringList* storeNames, unsigned short mode, unsigned long timeout)
+PassRefPtr<IDBTransaction> IDBDatabase::transaction(ScriptExecutionContext* context, DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode& ec)
 {
     // We need to create a new transaction synchronously. Locks are acquired asynchronously. Operations
     // can be queued against the transaction at any point. They will start executing as soon as the
     // appropriate locks have been acquired.
     // Also note that each backend object corresponds to exactly one IDBTransaction object.
-    RefPtr<IDBTransactionBackendInterface> transactionBackend = m_backend->transaction(storeNames, mode, timeout);
+    RefPtr<IDBTransactionBackendInterface> transactionBackend = m_backend->transaction(storeNames, mode, timeout, ec);
     RefPtr<IDBTransaction> transaction = IDBTransaction::create(context, transactionBackend, this);
     transactionBackend->setCallbacks(transaction.get());
     return transaction.release();
 }
 
+void IDBDatabase::close()
+{
+    m_backend->close();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebCore/storage/IDBDatabase.h b/WebCore/storage/IDBDatabase.h
index dc70114..df56f46 100644
--- a/WebCore/storage/IDBDatabase.h
+++ b/WebCore/storage/IDBDatabase.h
@@ -27,7 +27,9 @@
 #define IDBDatabase_h
 
 #include "DOMStringList.h"
+#include "ExceptionCode.h"
 #include "IDBDatabaseBackendInterface.h"
+#include "IDBObjectStore.h"
 #include "IDBTransaction.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -38,7 +40,6 @@
 namespace WebCore {
 
 class IDBAny;
-class IDBObjectStore;
 class IDBRequest;
 class ScriptExecutionContext;
 
@@ -50,22 +51,31 @@ public:
     }
     ~IDBDatabase();
 
+    void setSetVersionTransaction(IDBTransactionBackendInterface*);
+
     // Implement the IDL
     String name() const { return m_backend->name(); }
     String version() const { return m_backend->version(); }
     PassRefPtr<DOMStringList> objectStores() const { return m_backend->objectStores(); }
 
-    PassRefPtr<IDBRequest> createObjectStore(ScriptExecutionContext*, const String& name, const String& keyPath = String(), bool autoIncrement = false);
-    PassRefPtr<IDBObjectStore> objectStore(const String& name, unsigned short mode = IDBTransaction::READ_ONLY);
-    PassRefPtr<IDBRequest> removeObjectStore(ScriptExecutionContext*, const String& name);
-    PassRefPtr<IDBRequest> setVersion(ScriptExecutionContext*, const String& version);
-    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, DOMStringList* storeNames = 0, unsigned short mode = IDBTransaction::READ_ONLY,
-                                           unsigned long timeout = 0); // FIXME: what should the default timeout be?
+    // FIXME: Try to modify the code generator so this is unneeded.
+    PassRefPtr<IDBObjectStore> createObjectStore(const String& name, ExceptionCode& ec) { return createObjectStore(name, String(), ec); }
+    PassRefPtr<IDBObjectStore> createObjectStore(const String& name, const String& keyPath, ExceptionCode& ec) { return createObjectStore(name, keyPath, false, ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, ExceptionCode& ec) { return transaction(context, 0, ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, DOMStringList* storeNames, ExceptionCode& ec) { return transaction(context, storeNames, IDBTransaction::READ_ONLY, ec); }
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext* context, DOMStringList* storeNames, unsigned short mode, ExceptionCode& ec) { return transaction(context, storeNames, mode, 0, ec); } // FIXME: what should the default timeout be?
+
+    PassRefPtr<IDBObjectStore> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, ExceptionCode&);
+    void removeObjectStore(const String& name, ExceptionCode&);
+    PassRefPtr<IDBRequest> setVersion(ScriptExecutionContext*, const String& version, ExceptionCode&);
+    PassRefPtr<IDBTransaction> transaction(ScriptExecutionContext*, DOMStringList*, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    void close();
 
 private:
     IDBDatabase(PassRefPtr<IDBDatabaseBackendInterface>);
 
     RefPtr<IDBDatabaseBackendInterface> m_backend;
+    RefPtr<IDBTransactionBackendInterface> m_setVersionTransaction;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBDatabase.idl b/WebCore/storage/IDBDatabase.idl
index 347b3a7..b529c9a 100644
--- a/WebCore/storage/IDBDatabase.idl
+++ b/WebCore/storage/IDBDatabase.idl
@@ -32,14 +32,15 @@ module storage {
         readonly attribute DOMString version;
         readonly attribute DOMStringList objectStores;
 
-
-        [CallWith=ScriptExecutionContext] IDBRequest createObjectStore(in DOMString name, in [Optional, ConvertNullToNullString] DOMString keyPath, in [Optional] boolean autoIncrement);
-        // FIXME: objectStore needs to be able to raise an IDBDatabaseException.
-        IDBObjectStore objectStore(in DOMString name, in [Optional] unsigned short mode);
-        [CallWith=ScriptExecutionContext] IDBRequest removeObjectStore(in DOMString name);
-        [CallWith=ScriptExecutionContext] IDBRequest setVersion(in DOMString version);
-        [CallWith=ScriptExecutionContext] IDBTransaction transaction (in [Optional] DOMStringList storeNames, in [Optional] unsigned short mode, in [Optional] unsigned long timeout);
-        // FIXME: Add close.
+        IDBObjectStore createObjectStore(in DOMString name, in [Optional, ConvertNullToNullString] DOMString keyPath, in [Optional] boolean autoIncrement)
+            raises (IDBDatabaseException);
+        void removeObjectStore(in DOMString name)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest setVersion(in DOMString version)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBTransaction transaction (in [Optional] DOMStringList storeNames, in [Optional] unsigned short mode, in [Optional] unsigned long timeout)
+            raises (IDBDatabaseException);
+        void close();
     };
 
 }
diff --git a/WebCore/storage/IDBDatabaseBackendImpl.cpp b/WebCore/storage/IDBDatabaseBackendImpl.cpp
index b8fe9b5..dc61e22 100644
--- a/WebCore/storage/IDBDatabaseBackendImpl.cpp
+++ b/WebCore/storage/IDBDatabaseBackendImpl.cpp
@@ -26,21 +26,23 @@
 #include "config.h"
 #include "IDBDatabaseBackendImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
+#include "CrossThreadTask.h"
 #include "DOMStringList.h"
 #include "IDBDatabaseException.h"
 #include "IDBObjectStoreBackendImpl.h"
+#include "IDBTransactionBackendInterface.h"
 #include "IDBTransactionCoordinator.h"
 #include "SQLiteDatabase.h"
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 namespace WebCore {
 
-static bool extractMetaData(SQLiteDatabase* sqliteDatabase, const String& expectedName, String& foundDescription, String& foundVersion)
+static bool extractMetaData(SQLiteDatabase* sqliteDatabase, const String& expectedName, String& foundVersion)
 {
-    SQLiteStatement metaDataQuery(*sqliteDatabase, "SELECT name, description, version FROM MetaData");
+    SQLiteStatement metaDataQuery(*sqliteDatabase, "SELECT name, version FROM MetaData");
     if (metaDataQuery.prepare() != SQLResultOk || metaDataQuery.step() != SQLResultRow)
         return false;
 
@@ -48,8 +50,7 @@ static bool extractMetaData(SQLiteDatabase* sqliteDatabase, const String& expect
         LOG_ERROR("Name in MetaData (%s) doesn't match expected (%s) for IndexedDB", metaDataQuery.getColumnText(0).utf8().data(), expectedName.utf8().data());
         ASSERT_NOT_REACHED();
     }
-    foundDescription = metaDataQuery.getColumnText(1);
-    foundVersion = metaDataQuery.getColumnText(2);
+    foundVersion = metaDataQuery.getColumnText(1);
 
     if (metaDataQuery.step() == SQLResultRow) {
         LOG_ERROR("More than one row found in MetaData table");
@@ -80,26 +81,21 @@ static bool setMetaData(SQLiteDatabase* sqliteDatabase, const String& name, cons
         return false;
     }
 
-    // FIXME: Should we assert there's only one row?
-
     return true;
 }
 
 IDBDatabaseBackendImpl::IDBDatabaseBackendImpl(const String& name, const String& description, PassOwnPtr<SQLiteDatabase> sqliteDatabase, IDBTransactionCoordinator* coordinator)
     : m_sqliteDatabase(sqliteDatabase)
     , m_name(name)
+    , m_description(description)
     , m_version("")
     , m_transactionCoordinator(coordinator)
 {
     ASSERT(!m_name.isNull());
+    ASSERT(!m_description.isNull());
 
-    // FIXME: The spec is in flux about how to handle description. Sync it up once a final decision is made.
-    String foundDescription = "";
-    bool result = extractMetaData(m_sqliteDatabase.get(), m_name, foundDescription, m_version);
-    m_description = description.isNull() ? foundDescription : description;
-
-    if (!result || m_description != foundDescription)
-        setMetaData(m_sqliteDatabase.get(), m_name, m_description, m_version);
+    extractMetaData(m_sqliteDatabase.get(), m_name, m_version);
+    setMetaData(m_sqliteDatabase.get(), m_name, m_description, m_version);
 
     loadObjectStores();
 }
@@ -125,35 +121,49 @@ PassRefPtr<DOMStringList> IDBDatabaseBackendImpl::objectStores() const
     return objectStoreNames.release();
 }
 
-void IDBDatabaseBackendImpl::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBObjectStoreBackendInterface>  IDBDatabaseBackendImpl::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
     if (m_objectStores.contains(name)) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "An objectStore with that name already exists."));
-        return;
+        // FIXME: Throw CONSTRAINT_ERR in this case.
+        return 0;
     }
 
-    SQLiteStatement insert(sqliteDatabase(), "INSERT INTO ObjectStores (name, keyPath, doAutoIncrement) VALUES (?, ?, ?)");
-    bool ok = insert.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    insert.bindText(1, name);
-    insert.bindText(2, keyPath);
-    insert.bindInt(3, static_cast<int>(autoIncrement));
-    ok = insert.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    int64_t id = sqliteDatabase().lastInsertRowID();
-
-    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(this, id, name, keyPath, autoIncrement);
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = IDBObjectStoreBackendImpl::create(this, name, keyPath, autoIncrement);
     ASSERT(objectStore->name() == name);
+
+    RefPtr<IDBDatabaseBackendImpl> database = this;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBDatabaseBackendImpl::createObjectStoreInternal, database, objectStore, transaction),
+                                   createCallbackTask(&IDBDatabaseBackendImpl::removeObjectStoreFromMap, database, objectStore))) {
+        return 0;
+    }
+
     m_objectStores.set(name, objectStore);
-    callbacks->onSuccess(objectStore.get());
+    return objectStore.release();
 }
 
-// FIXME: Do not expose this method via IDL.
-PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendImpl::objectStore(const String& name, unsigned short mode)
+void IDBDatabaseBackendImpl::createObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore,  PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
-    ASSERT_UNUSED(mode, !mode); // FIXME: Remove the mode parameter. Transactions have modes, not object stores.
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_objectStores.get(name);
-    return objectStore.release();
+    SQLiteStatement insert(database->sqliteDatabase(), "INSERT INTO ObjectStores (name, keyPath, doAutoIncrement) VALUES (?, ?, ?)");
+    if (insert.prepare() != SQLResultOk) {
+        transaction->abort();
+        return;
+    }
+    insert.bindText(1, objectStore->name());
+    insert.bindText(2, objectStore->keyPath());
+    insert.bindInt(3, static_cast<int>(objectStore->autoIncrement()));
+    if (insert.step() != SQLResultDone) {
+        transaction->abort();
+        return;
+    }
+    int64_t id = database->sqliteDatabase().lastInsertRowID();
+    objectStore->setId(id);
+    transaction->didCompleteTaskEvents();
+}
+
+PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseBackendImpl::objectStore(const String& name)
+{
+    return m_objectStores.get(name);
 }
 
 static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
@@ -166,38 +176,68 @@ static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 }
 
-void IDBDatabaseBackendImpl::removeObjectStore(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseBackendImpl::removeObjectStore(const String& name, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
     RefPtr<IDBObjectStoreBackendImpl> objectStore = m_objectStores.get(name);
     if (!objectStore) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "No objectStore with that name exists."));
+        ec = IDBDatabaseException::NOT_FOUND_ERR;
         return;
     }
+    RefPtr<IDBDatabaseBackendImpl> database = this;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBDatabaseBackendImpl::removeObjectStoreInternal, database, objectStore, transaction),
+                                   createCallbackTask(&IDBDatabaseBackendImpl::addObjectStoreToMap, database, objectStore))) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return;
+    }
+    m_objectStores.remove(name);
+}
 
-    SQLiteTransaction transaction(sqliteDatabase());
-    transaction.begin();
-    doDelete(sqliteDatabase(), "DELETE FROM ObjectStores WHERE id = ?", objectStore->id());
-    doDelete(sqliteDatabase(), "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStore->id());
-    doDelete(sqliteDatabase(), "DELETE FROM IndexData WHERE indexId IN (SELECT id FROM Indexes WHERE objectStoreId = ?)", objectStore->id());
-    doDelete(sqliteDatabase(), "DELETE FROM Indexes WHERE objectStoreId = ?", objectStore->id());
-    transaction.commit();
+void IDBDatabaseBackendImpl::removeObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBTransactionBackendInterface> transaction)
+{
+    doDelete(database->sqliteDatabase(), "DELETE FROM ObjectStores WHERE id = ?", objectStore->id());
+    doDelete(database->sqliteDatabase(), "DELETE FROM ObjectStoreData WHERE objectStoreId = ?", objectStore->id());
+    doDelete(database->sqliteDatabase(), "DELETE FROM IndexData WHERE indexId IN (SELECT id FROM Indexes WHERE objectStoreId = ?)", objectStore->id());
+    doDelete(database->sqliteDatabase(), "DELETE FROM Indexes WHERE objectStoreId = ?", objectStore->id());
 
-    m_objectStores.remove(name);
-    callbacks->onSuccess();
+    transaction->didCompleteTaskEvents();
 }
 
-void IDBDatabaseBackendImpl::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseBackendImpl::setVersion(const String& version, PassRefPtr<IDBCallbacks> prpCallbacks, ExceptionCode& ec)
 {
-    m_version = version;
-    setMetaData(m_sqliteDatabase.get(), m_name, m_description, m_version);
-    callbacks->onSuccess();
+    RefPtr<IDBDatabaseBackendImpl> database = this;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    RefPtr<DOMStringList> objectStores = DOMStringList::create();
+    RefPtr<IDBTransactionBackendInterface> transaction = m_transactionCoordinator->createTransaction(objectStores.get(), IDBTransaction::VERSION_CHANGE, 0, this);
+    if (!transaction->scheduleTask(createCallbackTask(&IDBDatabaseBackendImpl::setVersionInternal, database, version, callbacks, transaction),
+                                   createCallbackTask(&IDBDatabaseBackendImpl::resetVersion, database, m_version))) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+    }
+}
+
+void IDBDatabaseBackendImpl::setVersionInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, const String& version, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
+{
+    database->m_version = version;
+    if (!setMetaData(database->m_sqliteDatabase.get(), database->m_name, database->m_description, database->m_version)) {
+        // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+        transaction->abort();
+        return;
+    }
+    callbacks->onSuccess(transaction);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList* objectStores, unsigned short mode, unsigned long timeout)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseBackendImpl::transaction(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, ExceptionCode&)
 {
+    // FIXME: Return not allowed err if close has been called.
     return m_transactionCoordinator->createTransaction(objectStores, mode, timeout, this);
 }
 
+void IDBDatabaseBackendImpl::close()
+{
+    // FIXME: Implement.
+}
+
 void IDBDatabaseBackendImpl::loadObjectStores()
 {
     SQLiteStatement objectStoresQuery(sqliteDatabase(), "SELECT id, name, keyPath, doAutoIncrement FROM ObjectStores");
@@ -214,6 +254,25 @@ void IDBDatabaseBackendImpl::loadObjectStores()
     }
 }
 
+void IDBDatabaseBackendImpl::removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore)
+{
+    ASSERT(database->m_objectStores.contains(objectStore->name()));
+    database->m_objectStores.remove(objectStore->name());
+}
+
+void IDBDatabaseBackendImpl::addObjectStoreToMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, PassRefPtr<IDBObjectStoreBackendImpl> objectStore)
+{
+    RefPtr<IDBObjectStoreBackendImpl> objectStorePtr = objectStore;
+    ASSERT(!database->m_objectStores.contains(objectStorePtr->name()));
+    database->m_objectStores.set(objectStorePtr->name(), objectStorePtr);
+}
+
+void IDBDatabaseBackendImpl::resetVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl> database, const String& version)
+{
+    database->m_version = version;
+}
+
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebCore/storage/IDBDatabaseBackendImpl.h b/WebCore/storage/IDBDatabaseBackendImpl.h
index 7e08ad6..bb6429c 100644
--- a/WebCore/storage/IDBDatabaseBackendImpl.h
+++ b/WebCore/storage/IDBDatabaseBackendImpl.h
@@ -50,18 +50,18 @@ public:
     void setDescription(const String& description);
     SQLiteDatabase& sqliteDatabase() const { return *m_sqliteDatabase.get(); }
 
-    // Implements IDBDatabase
     virtual String name() const { return m_name; }
     virtual String description() const { return m_description; }
     virtual String version() const { return m_version; }
     virtual PassRefPtr<DOMStringList> objectStores() const;
 
-    virtual void createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, unsigned short mode);
-    virtual void removeObjectStore(const String& name, PassRefPtr<IDBCallbacks>);
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout);
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void removeObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    virtual void close();
 
+    PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name);
     IDBTransactionCoordinator* transactionCoordinator() const { return m_transactionCoordinator.get(); }
 
 private:
@@ -69,6 +69,15 @@ private:
 
     void loadObjectStores();
 
+    static void createObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void removeObjectStoreInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void setVersionInternal(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, const String& version, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
+
+    // These are used as setVersion transaction abort tasks.
+    static void removeObjectStoreFromMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>);
+    static void addObjectStoreToMap(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, PassRefPtr<IDBObjectStoreBackendImpl>);
+    static void resetVersion(ScriptExecutionContext*, PassRefPtr<IDBDatabaseBackendImpl>, const String& version);
+
     OwnPtr<SQLiteDatabase> m_sqliteDatabase;
     String m_name;
     String m_description;
diff --git a/WebCore/storage/IDBDatabaseBackendInterface.h b/WebCore/storage/IDBDatabaseBackendInterface.h
index a2e042a..4b0255d 100644
--- a/WebCore/storage/IDBDatabaseBackendInterface.h
+++ b/WebCore/storage/IDBDatabaseBackendInterface.h
@@ -26,6 +26,7 @@
 #ifndef IDBDatabaseBackendInterface_h
 #define IDBDatabaseBackendInterface_h
 
+#include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/Threading.h>
@@ -54,12 +55,11 @@ public:
     virtual String version() const = 0;
     virtual PassRefPtr<DOMStringList> objectStores() const = 0;
 
-    virtual void createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks>) = 0;
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, unsigned short mode) = 0;
-    virtual void removeObjectStore(const String& name, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>) = 0;
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout) = 0;
-    // FIXME: Add close.
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void removeObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&) = 0;
+    virtual void close() = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBFactory.cpp b/WebCore/storage/IDBFactory.cpp
index 06c06ea..649eb37 100644
--- a/WebCore/storage/IDBFactory.cpp
+++ b/WebCore/storage/IDBFactory.cpp
@@ -37,6 +37,7 @@
 #include "Frame.h"
 #include "GroupSettings.h"
 #include "IDBDatabase.h"
+#include "IDBDatabaseException.h"
 #include "IDBFactoryBackendInterface.h"
 #include "IDBKeyRange.h"
 #include "IDBRequest.h"
@@ -56,7 +57,7 @@ IDBFactory::~IDBFactory()
 {
 }
 
-PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, const String& description)
+PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const String& name, const String& description, ExceptionCode& ec)
 {
     if (!context->isDocument()) {
         // FIXME: make this work with workers.
@@ -67,8 +68,17 @@ PassRefPtr<IDBRequest> IDBFactory::open(ScriptExecutionContext* context, const S
     if (!document->frame() || !document->page())
         return 0;
 
-    RefPtr<IDBRequest> request = IDBRequest::create(document, IDBAny::create(this));
-    m_factoryBackend->open(name, description, request, document->securityOrigin(), document->frame(), document->page()->group().groupSettings()->indexedDBDatabasePath());
+
+    // FIXME: Raise a NON_TRANSIENT_ERR if the name is invalid.
+
+    if (description.isNull()) {
+        ec = IDBDatabaseException::NON_TRANSIENT_ERR;
+        return 0;
+    }
+
+    RefPtr<IDBRequest> request = IDBRequest::create(document, IDBAny::create(this), 0);
+    GroupSettings* groupSettings = document->page()->group().groupSettings();
+    m_factoryBackend->open(name, description, request, document->securityOrigin(), document->frame(), groupSettings->indexedDBDatabasePath(), groupSettings->indexedDBQuotaBytes());
     return request;
 }
 
diff --git a/WebCore/storage/IDBFactory.h b/WebCore/storage/IDBFactory.h
index a96aa38..8953245 100644
--- a/WebCore/storage/IDBFactory.h
+++ b/WebCore/storage/IDBFactory.h
@@ -31,6 +31,7 @@
 #include "DOMStringList.h"
 #include "ExceptionCode.h"
 #include "IDBFactoryBackendInterface.h"
+#include "IDBRequest.h"
 #include "PlatformString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -42,7 +43,6 @@ namespace WebCore {
 
 class IDBKey;
 class IDBKeyRange;
-class IDBRequest;
 class IDBFactoryBackendInterface;
 class ScriptExecutionContext;
 
@@ -54,7 +54,7 @@ public:
     }
     ~IDBFactory();
 
-    PassRefPtr<IDBRequest> open(ScriptExecutionContext*, const String& name, const String& description = String());
+    PassRefPtr<IDBRequest> open(ScriptExecutionContext*, const String& name, const String& description, ExceptionCode&);
 
 private:
     IDBFactory(IDBFactoryBackendInterface*);
diff --git a/WebCore/storage/IDBFactory.idl b/WebCore/storage/IDBFactory.idl
index 215d67c..646df41 100644
--- a/WebCore/storage/IDBFactory.idl
+++ b/WebCore/storage/IDBFactory.idl
@@ -28,7 +28,8 @@ module storage {
     interface [
         Conditional=INDEXED_DATABASE
     ] IDBFactory {
-        [CallWith=ScriptExecutionContext] IDBRequest open(in DOMString name, in [Optional, ConvertUndefinedOrNullToNullString] DOMString description);
+        [CallWith=ScriptExecutionContext] IDBRequest open(in DOMString name, in [ConvertUndefinedOrNullToNullString] DOMString description)
+            raises (IDBDatabaseException);
     };
 
 }
diff --git a/WebCore/storage/IDBFactoryBackendImpl.cpp b/WebCore/storage/IDBFactoryBackendImpl.cpp
index 6219c2d..c18294d 100644
--- a/WebCore/storage/IDBFactoryBackendImpl.cpp
+++ b/WebCore/storage/IDBFactoryBackendImpl.cpp
@@ -52,7 +52,7 @@ IDBFactoryBackendImpl::~IDBFactoryBackendImpl()
 {
 }
 
-static PassOwnPtr<SQLiteDatabase> openSQLiteDatabase(SecurityOrigin* securityOrigin, String name, const String& pathBase)
+static PassOwnPtr<SQLiteDatabase> openSQLiteDatabase(SecurityOrigin* securityOrigin, String name, const String& pathBase, int64_t maximumSize)
 {
     String path = ":memory:";
     if (!pathBase.isEmpty()) {
@@ -72,6 +72,7 @@ static PassOwnPtr<SQLiteDatabase> openSQLiteDatabase(SecurityOrigin* securityOri
         return 0;
     }
 
+    sqliteDatabase->setMaximumSize(maximumSize);
     return sqliteDatabase.release();
 }
 
@@ -98,7 +99,7 @@ static bool createTables(SQLiteDatabase* sqliteDatabase)
         "CREATE UNIQUE INDEX IF NOT EXISTS ObjectStoreData_composit ON ObjectStoreData(keyString, keyDate, keyNumber, objectStoreId)",
 
         "DROP TABLE IF EXISTS IndexData",
-        "CREATE TABLE IF NOT EXISTS IndexData (id INTEGER PRIMARY KEY, indexId INTEGER NOT NULL REFERENCES Indexes(id), keyString TEXT, keyDate INTEGER, keyNumber INTEGER, objectStoreDataId INTEGER NOT NULL UNIQUE REFERENCES ObjectStoreData(id))",
+        "CREATE TABLE IF NOT EXISTS IndexData (id INTEGER PRIMARY KEY, indexId INTEGER NOT NULL REFERENCES Indexes(id), keyString TEXT, keyDate INTEGER, keyNumber INTEGER, objectStoreDataId INTEGER NOT NULL REFERENCES ObjectStoreData(id))",
         "DROP INDEX IF EXISTS IndexData_composit",
         "CREATE INDEX IF NOT EXISTS IndexData_composit ON IndexData(keyString, keyDate, keyNumber, indexId)",
         "DROP INDEX IF EXISTS IndexData_objectStoreDataId",
@@ -117,7 +118,7 @@ static bool createTables(SQLiteDatabase* sqliteDatabase)
     return true;
 }
 
-void IDBFactoryBackendImpl::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir)
+void IDBFactoryBackendImpl::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> securityOrigin, Frame*, const String& dataDir, int64_t maximumSize)
 {
     IDBDatabaseBackendMap::iterator it = m_databaseBackendMap.find(name);
     if (it != m_databaseBackendMap.end()) {
@@ -129,7 +130,7 @@ void IDBFactoryBackendImpl::open(const String& name, const String& description,
 
     // FIXME: Everything from now on should be done on another thread.
 
-    OwnPtr<SQLiteDatabase> sqliteDatabase = openSQLiteDatabase(securityOrigin.get(), name, dataDir);
+    OwnPtr<SQLiteDatabase> sqliteDatabase = openSQLiteDatabase(securityOrigin.get(), name, dataDir, maximumSize);
     if (!sqliteDatabase || !createTables(sqliteDatabase.get())) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Internal error."));
         return;
diff --git a/WebCore/storage/IDBFactoryBackendImpl.h b/WebCore/storage/IDBFactoryBackendImpl.h
index 76e545e..211b7fa 100644
--- a/WebCore/storage/IDBFactoryBackendImpl.h
+++ b/WebCore/storage/IDBFactoryBackendImpl.h
@@ -49,7 +49,7 @@ public:
     }
     virtual ~IDBFactoryBackendImpl();
 
-    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir);
+    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
 
     static String databaseFileName(const String& name, SecurityOrigin*);
 
diff --git a/WebCore/storage/IDBFactoryBackendInterface.h b/WebCore/storage/IDBFactoryBackendInterface.h
index 4914024..7d922c3 100644
--- a/WebCore/storage/IDBFactoryBackendInterface.h
+++ b/WebCore/storage/IDBFactoryBackendInterface.h
@@ -51,7 +51,7 @@ public:
     static PassRefPtr<IDBFactoryBackendInterface> create();
     virtual ~IDBFactoryBackendInterface() { }
 
-    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir) = 0;
+    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize) = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBIndex.cpp b/WebCore/storage/IDBIndex.cpp
index 5cd12dd..a008470 100644
--- a/WebCore/storage/IDBIndex.cpp
+++ b/WebCore/storage/IDBIndex.cpp
@@ -33,43 +33,55 @@
 #include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "IDBRequest.h"
+#include "IDBTransactionBackendInterface.h"
 
 namespace WebCore {
 
-IDBIndex::IDBIndex(PassRefPtr<IDBIndexBackendInterface> backend)
+IDBIndex::IDBIndex(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransactionBackendInterface* transaction)
     : m_backend(backend)
+    , m_transaction(transaction)
 {
+    ASSERT(m_backend);
+    ASSERT(m_transaction);
 }
 
 IDBIndex::~IDBIndex()
 {
 }
 
-PassRefPtr<IDBRequest> IDBIndex::openObjectCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction)
+PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->openObjectCursor(keyRange, direction, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->openCursor(keyRange, direction, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBIndex::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction)
+PassRefPtr<IDBRequest> IDBIndex::openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->openCursor(keyRange, direction, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->openKeyCursor(keyRange, direction, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBIndex::getObject(ScriptExecutionContext* context, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->getObject(key, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->get(key, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBIndex::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBIndex::getKey(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_backend->get(key, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_backend->getKey(key, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
diff --git a/WebCore/storage/IDBIndex.h b/WebCore/storage/IDBIndex.h
index 45fcfa1..4a1a666 100644
--- a/WebCore/storage/IDBIndex.h
+++ b/WebCore/storage/IDBIndex.h
@@ -28,6 +28,8 @@
 
 #include "IDBCursor.h"
 #include "IDBIndexBackendInterface.h"
+#include "IDBKeyRange.h"
+#include "IDBRequest.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 
@@ -37,9 +39,9 @@ namespace WebCore {
 
 class IDBIndex : public RefCounted<IDBIndex> {
 public:
-    static PassRefPtr<IDBIndex> create(PassRefPtr<IDBIndexBackendInterface> backend)
+    static PassRefPtr<IDBIndex> create(PassRefPtr<IDBIndexBackendInterface> backend, IDBTransactionBackendInterface* transaction)
     {
-        return adoptRef(new IDBIndex(backend));
+        return adoptRef(new IDBIndex(backend, transaction));
     }
     ~IDBIndex();
 
@@ -49,15 +51,22 @@ public:
     String keyPath() const { return m_backend->keyPath(); }
     bool unique() const { return m_backend->unique(); }
 
-    PassRefPtr<IDBRequest> openObjectCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange> = 0, unsigned short direction = IDBCursor::NEXT);
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange> = 0, unsigned short direction = IDBCursor::NEXT);
-    PassRefPtr<IDBRequest> getObject(ScriptExecutionContext*, PassRefPtr<IDBKey>);
-    PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>);
+    // FIXME: Try to modify the code generator so this is unneeded.
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); }
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openKeyCursor(context, 0, ec); }
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openKeyCursor(context, keyRange, IDBCursor::NEXT, ec); }
+
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
+    PassRefPtr<IDBRequest> openKeyCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
+    PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> getKey(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
 
 private:
-    IDBIndex(PassRefPtr<IDBIndexBackendInterface>);
+    IDBIndex(PassRefPtr<IDBIndexBackendInterface>, IDBTransactionBackendInterface* transaction);
 
     RefPtr<IDBIndexBackendInterface> m_backend;
+    RefPtr<IDBTransactionBackendInterface> m_transaction;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBIndex.idl b/WebCore/storage/IDBIndex.idl
index ba3ecea..7c2c962 100644
--- a/WebCore/storage/IDBIndex.idl
+++ b/WebCore/storage/IDBIndex.idl
@@ -33,11 +33,14 @@ module storage {
         readonly attribute DOMString keyPath;
         readonly attribute boolean unique;
 
-        // FIXME: All of these should raise on certain errors.
-        [CallWith=ScriptExecutionContext] IDBRequest openObjectCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction);
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction);
-        [CallWith=ScriptExecutionContext] IDBRequest getObject(in IDBKey key);
-        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key);
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest openKeyCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest getKey(in IDBKey key)
+            raises (IDBDatabaseException);
     };
 
 }
diff --git a/WebCore/storage/IDBIndexBackendImpl.cpp b/WebCore/storage/IDBIndexBackendImpl.cpp
index 6f698c6..2a991fa 100644
--- a/WebCore/storage/IDBIndexBackendImpl.cpp
+++ b/WebCore/storage/IDBIndexBackendImpl.cpp
@@ -28,6 +28,7 @@
 
 #if ENABLE(INDEXED_DATABASE)
 
+#include "CrossThreadTask.h"
 #include "IDBCallbacks.h"
 #include "IDBCursorBackendImpl.h"
 #include "IDBDatabaseBackendImpl.h"
@@ -49,6 +50,15 @@ IDBIndexBackendImpl::IDBIndexBackendImpl(IDBObjectStoreBackendImpl* objectStore,
 {
 }
 
+IDBIndexBackendImpl::IDBIndexBackendImpl(IDBObjectStoreBackendImpl* objectStore, const String& name, const String& keyPath, bool unique)
+    : m_objectStore(objectStore)
+    , m_id(InvalidId)
+    , m_name(name)
+    , m_keyPath(keyPath)
+    , m_unique(unique)
+{
+}
+
 IDBIndexBackendImpl::~IDBIndexBackendImpl()
 {
 }
@@ -58,7 +68,7 @@ String IDBIndexBackendImpl::storeName()
     return m_objectStore->name();
 }
 
-static void openCursorInternal(SQLiteDatabase& database, IDBIndexBackendImpl* index, IDBKeyRange* range, unsigned short untypedDirection, bool objectCursor, IDBCallbacks* callbacks)
+void IDBIndexBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKeyRange> range, unsigned short untypedDirection, bool objectCursor, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     // Several files depend on this order of selects.
     String sql = String("SELECT IndexData.id, IndexData.keyString, IndexData.keyDate, IndexData.keyNumber, ")
@@ -80,7 +90,7 @@ static void openCursorInternal(SQLiteDatabase& database, IDBIndexBackendImpl* in
     else
         sql += "IndexData.keyString DESC, IndexData.keyDate DESC, IndexData.keyNumber DESC, IndexData.id DESC";
 
-    OwnPtr<SQLiteStatement> query = adoptPtr(new SQLiteStatement(database, sql));
+    OwnPtr<SQLiteStatement> query = adoptPtr(new SQLiteStatement(index->sqliteDatabase(), sql));
     bool ok = query->prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
@@ -96,32 +106,42 @@ static void openCursorInternal(SQLiteDatabase& database, IDBIndexBackendImpl* in
         return;
     }
 
-    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(index, range, direction, query.release(), objectCursor);
+    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(index, range, direction, query.release(), objectCursor, transaction.get());
     callbacks->onSuccess(cursor.release());
 }
 
-void IDBIndexBackendImpl::openObjectCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
-    openCursorInternal(sqliteDatabase(), this, keyRange.get(), direction, true, callbacks.get());
+    RefPtr<IDBIndexBackendImpl> index = this;
+    RefPtr<IDBKeyRange> keyRange = prpKeyRange;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    if (!transaction->scheduleTask(createCallbackTask(&openCursorInternal, index, keyRange, direction, true, callbacks, transaction)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBIndexBackendImpl::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendImpl::openKeyCursor(PassRefPtr<IDBKeyRange> prpKeyRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
 {
-    openCursorInternal(sqliteDatabase(), this, keyRange.get(), direction, false, callbacks.get());
+    RefPtr<IDBIndexBackendImpl> index = this;
+    RefPtr<IDBKeyRange> keyRange = prpKeyRange;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    if (!transaction->scheduleTask(createCallbackTask(&openCursorInternal, index, keyRange, direction, false, callbacks, transaction)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-static void getInternal(SQLiteDatabase& database, int64 id, IDBKey* key, bool getObject, IDBCallbacks* callbacks)
+void IDBIndexBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBKey> key, bool getObject, PassRefPtr<IDBCallbacks> callbacks)
 {
     String sql = String("SELECT ")
                  + (getObject ? "ObjectStoreData.value " : "ObjectStoreData.keyString, ObjectStoreData.keyDate, ObjectStoreData.keyNumber ")
                  + "FROM IndexData INNER JOIN ObjectStoreData ON IndexData.objectStoreDataId = ObjectStoreData.id "
                  + "WHERE IndexData.indexId = ?  AND  " + key->whereSyntax("IndexData.")
                  + "ORDER BY IndexData.id LIMIT 1"; // Order by insertion order when all else fails.
-    SQLiteStatement query(database, sql);
+    SQLiteStatement query(index->sqliteDatabase(), sql);
     bool ok = query.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
-    query.bindInt64(1, id);
+    query.bindInt64(1, index->id());
     key->bind(query, 2);
     if (query.step() != SQLResultRow) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the index."));
@@ -135,14 +155,22 @@ static void getInternal(SQLiteDatabase& database, int64 id, IDBKey* key, bool ge
     ASSERT(query.step() != SQLResultRow);
 }
 
-void IDBIndexBackendImpl::getObject(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    getInternal(sqliteDatabase(), m_id, key.get(), true, callbacks.get());
+    RefPtr<IDBIndexBackendImpl> index = this;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!transaction->scheduleTask(createCallbackTask(&getInternal, index, key, true, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBIndexBackendImpl::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendImpl::getKey(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    getInternal(sqliteDatabase(), m_id, key.get(), false, callbacks.get());
+    RefPtr<IDBIndexBackendImpl> index = this;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!transaction->scheduleTask(createCallbackTask(&getInternal, index, key, false, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
 static String whereClause(IDBKey* key)
diff --git a/WebCore/storage/IDBIndexBackendImpl.h b/WebCore/storage/IDBIndexBackendImpl.h
index a98ed2a..d5e81ae 100644
--- a/WebCore/storage/IDBIndexBackendImpl.h
+++ b/WebCore/storage/IDBIndexBackendImpl.h
@@ -35,6 +35,7 @@ namespace WebCore {
 class IDBKey;
 class IDBObjectStoreBackendImpl;
 class SQLiteDatabase;
+class ScriptExecutionContext;
 
 class IDBIndexBackendImpl : public IDBIndexBackendInterface {
 public:
@@ -42,9 +43,19 @@ public:
     {
         return adoptRef(new IDBIndexBackendImpl(objectStore, id, name, keyPath, unique));
     }
+    static PassRefPtr<IDBIndexBackendImpl> create(IDBObjectStoreBackendImpl* objectStore, const String& name, const String& keyPath, bool unique)
+    {
+        return adoptRef(new IDBIndexBackendImpl(objectStore, name, keyPath, unique));
+    }
     virtual ~IDBIndexBackendImpl();
 
-    int64_t id() { return m_id; }
+    int64_t id() const
+    {
+        ASSERT(m_id != InvalidId);
+        return m_id;
+    }
+    void setId(int64_t id) { m_id = id; }
+
     bool addingKeyAllowed(IDBKey*);
 
     // Implements IDBIndexBackendInterface.
@@ -53,18 +64,24 @@ public:
     virtual String keyPath() { return m_keyPath; }
     virtual bool unique() { return m_unique; }
 
-    virtual void openObjectCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void getObject(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void openKeyCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     IDBObjectStoreBackendImpl* objectStore() const { return m_objectStore.get(); }
 
 private:
     IDBIndexBackendImpl(IDBObjectStoreBackendImpl*, int64_t id, const String& name, const String& keyPath, bool unique);
+    IDBIndexBackendImpl(IDBObjectStoreBackendImpl*, const String& name, const String& keyPath, bool unique);
 
     SQLiteDatabase& sqliteDatabase() const;
 
+    static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKeyRange>, unsigned short direction, bool objectCursor, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBKey>, bool getObject, PassRefPtr<IDBCallbacks>);
+
+    static const int64_t InvalidId = 0;
+
     RefPtr<IDBObjectStoreBackendImpl> m_objectStore;
 
     int64_t m_id;
diff --git a/WebCore/storage/IDBIndexBackendInterface.h b/WebCore/storage/IDBIndexBackendInterface.h
index ff2316f..e0e578d 100644
--- a/WebCore/storage/IDBIndexBackendInterface.h
+++ b/WebCore/storage/IDBIndexBackendInterface.h
@@ -26,6 +26,7 @@
 #ifndef IDBIndexBackendInterface_h
 #define IDBIndexBackendInterface_h
 
+#include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/Forward.h>
 
@@ -36,6 +37,7 @@ namespace WebCore {
 class IDBCallbacks;
 class IDBKey;
 class IDBKeyRange;
+class IDBTransactionBackendInterface;
 
 class IDBIndexBackendInterface : public ThreadSafeShared<IDBIndexBackendInterface> {
 public:
@@ -46,10 +48,10 @@ public:
     virtual String keyPath() = 0;
     virtual bool unique() = 0;
 
-    virtual void openObjectCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void getObject(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>) = 0;
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void openKeyCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBKey.cpp b/WebCore/storage/IDBKey.cpp
index 3eec36c..d0f3c2b 100644
--- a/WebCore/storage/IDBKey.cpp
+++ b/WebCore/storage/IDBKey.cpp
@@ -46,7 +46,7 @@ IDBKey::IDBKey(int32_t number)
 
 IDBKey::IDBKey(const String& string)
     : m_type(StringType)
-    , m_string(string)
+    , m_string(string.crossThreadString())
 {
 }
 
diff --git a/WebCore/storage/IDBKey.h b/WebCore/storage/IDBKey.h
index 3175e7e..0303a38 100644
--- a/WebCore/storage/IDBKey.h
+++ b/WebCore/storage/IDBKey.h
@@ -26,17 +26,18 @@
 #ifndef IDBKey_h
 #define IDBKey_h
 
+#if ENABLE(INDEXED_DATABASE)
+
 #include "PlatformString.h"
 #include <wtf/Forward.h>
-
-#if ENABLE(INDEXED_DATABASE)
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
 class SQLiteStatement;
 
 // FIXME: Add dates.
-class IDBKey : public RefCounted<IDBKey> {
+class IDBKey : public ThreadSafeShared<IDBKey> {
 public:
     static PassRefPtr<IDBKey> create()
     {
@@ -82,6 +83,9 @@ public:
     int bind(SQLiteStatement& query, int column) const;
     void bindWithNulls(SQLiteStatement& query, int baseColumn) const;
 
+    using ThreadSafeShared<IDBKey>::ref;
+    using ThreadSafeShared<IDBKey>::deref;
+
 private:
     IDBKey();
     explicit IDBKey(int32_t);
diff --git a/WebCore/storage/IDBKeyRange.h b/WebCore/storage/IDBKeyRange.h
index 4621a50..d246ebc 100644
--- a/WebCore/storage/IDBKeyRange.h
+++ b/WebCore/storage/IDBKeyRange.h
@@ -30,11 +30,11 @@
 
 #include "IDBKey.h"
 #include <wtf/PassRefPtr.h>
-#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
 
 namespace WebCore {
 
-class IDBKeyRange : public RefCounted<IDBKeyRange> {
+class IDBKeyRange : public ThreadSafeShared<IDBKeyRange> {
 public:
     // Keep in sync with what's in the .idl file.
     enum Flags {
diff --git a/WebCore/storage/IDBKeyTree.h b/WebCore/storage/IDBKeyTree.h
deleted file mode 100644
index 70d6f83..0000000
--- a/WebCore/storage/IDBKeyTree.h
+++ /dev/null
@@ -1,153 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef IDBKeyTree_h
-#define IDBKeyTree_h
-
-#if ENABLE(INDEXED_DATABASE)
-
-#include "IDBKey.h"
-#include <wtf/AVLTree.h>
-#include <wtf/Vector.h>
-
-namespace WebCore {
-
-template <typename ValueType>
-class IDBKeyTree : public RefCounted<IDBKeyTree<ValueType> > {
-public:
-    static PassRefPtr<IDBKeyTree> create()
-    {
-        return adoptRef(new IDBKeyTree());
-    }
-    ~IDBKeyTree();
-
-    ValueType* get(IDBKey* key);
-    void put(IDBKey* key, ValueType* value);
-    void remove(IDBKey* key);
-
-private:
-    struct TreeNode {
-        RefPtr<ValueType> value;
-        RefPtr<IDBKey> key;
-
-        TreeNode* less;
-        TreeNode* greater;
-        int balanceFactor;
-    };
-
-    struct AVLTreeAbstractor {
-        typedef TreeNode* handle;
-        typedef size_t size;
-        typedef IDBKey* key;
-
-        handle get_less(handle h) { return h->less; }
-        void set_less(handle h, handle lh) { h->less = lh; }
-        handle get_greater(handle h) { return h->greater; }
-        void set_greater(handle h, handle gh) { h->greater = gh; }
-        int get_balance_factor(handle h) { return h->balanceFactor; }
-        void set_balance_factor(handle h, int bf) { h->balanceFactor = bf; }
-
-        static handle null() { return 0; }
-
-        int compare_key_key(key va, key vb);
-        int compare_key_node(key k, handle h) { return compare_key_key(k, h->key.get()); }
-        int compare_node_node(handle h1, handle h2) { return compare_key_key(h1->key.get(), h2->key.get()); }
-    };
-
-    IDBKeyTree();
-
-    typedef WTF::AVLTree<AVLTreeAbstractor> TreeType;
-    TreeType m_tree;
-};
-
-template <typename ValueType>
-IDBKeyTree<ValueType>::IDBKeyTree()
-{
-}
-
-template <typename ValueType>
-IDBKeyTree<ValueType>::~IDBKeyTree()
-{
-    typename TreeType::Iterator iter;
-    iter.start_iter_least(m_tree);
-    for (; *iter; ++iter)
-        delete *iter;
-    m_tree.purge();
-}
-
-template <typename ValueType>
-int IDBKeyTree<ValueType>::AVLTreeAbstractor::compare_key_key(key va, key vb)
-{
-    if (va->type() != vb->type())
-        return vb->type() - va->type();
-
-    switch (va->type()) {
-    case IDBKey::NullType:
-        return 0;
-    case IDBKey::NumberType:
-        return vb->number() - va->number();
-    case IDBKey::StringType:
-        return codePointCompare(va->string(), vb->string());
-    // FIXME: Handle dates.  Oh, and test this thoroughly.
-    default:
-        ASSERT_NOT_REACHED();
-        return 0;
-    }
-}
-
-template <typename ValueType>
-ValueType* IDBKeyTree<ValueType>::get(IDBKey* key)
-{
-    TreeNode* node = m_tree.search(key);
-    if (!node)
-        return 0;
-    return node->value.get();
-}
-
-template <typename ValueType>
-void IDBKeyTree<ValueType>::put(IDBKey* key, ValueType* value)
-{
-    TreeNode* node = m_tree.search(key);
-    if (!node) {
-        node = new TreeNode();
-        node->key = key;
-        m_tree.insert(node);
-    }
-    node->value = value;
-}
-
-template <typename ValueType>
-void IDBKeyTree<ValueType>::remove(IDBKey* key)
-{
-    TreeNode* node = m_tree.remove(key);
-    if (node)
-        delete node;
-}
-
-}
-
-#endif // ENABLE(INDEXED_DATABASE)
-
-#endif // IDBKeyTree_h
diff --git a/WebCore/storage/IDBObjectStore.cpp b/WebCore/storage/IDBObjectStore.cpp
index 4c5cf34..c30243e 100644
--- a/WebCore/storage/IDBObjectStore.cpp
+++ b/WebCore/storage/IDBObjectStore.cpp
@@ -43,6 +43,8 @@ IDBObjectStore::IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface> idbObj
     : m_objectStore(idbObjectStore)
     , m_transaction(transaction)
 {
+    ASSERT(m_objectStore);
+    ASSERT(m_transaction);
     // We pass a reference to this object before it can be adopted.
     relaxAdoptionRequirement();
 }
@@ -62,61 +64,71 @@ PassRefPtr<DOMStringList> IDBObjectStore::indexNames() const
     return m_objectStore->indexNames();
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBObjectStore::get(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
     RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
-    m_objectStore->get(key, request, m_transaction.get());
+    m_objectStore->get(key, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request.release();
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBObjectStore::add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->put(value, key, true, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_objectStore->put(value, key, true, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBObjectStore::put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->put(value, key, false, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_objectStore->put(value, key, false, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::remove(ScriptExecutionContext* context, PassRefPtr<IDBKey> key)
+PassRefPtr<IDBRequest> IDBObjectStore::remove(ScriptExecutionContext* context, PassRefPtr<IDBKey> key, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->remove(key, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_objectStore->remove(key, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request;
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::createIndex(ScriptExecutionContext* context, const String& name, const String& keyPath, bool unique)
+PassRefPtr<IDBIndex> IDBObjectStore::createIndex(const String& name, const String& keyPath, bool unique, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->createIndex(name, keyPath, unique, request);
-    return request;
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, m_transaction.get(), ec);
+    ASSERT(!index != !ec); // If we didn't get an index, we should have gotten an exception code. And vice versa.
+    if (!index)
+        return 0;
+    return IDBIndex::create(index.release(), m_transaction.get());
 }
 
-PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name)
+PassRefPtr<IDBIndex> IDBObjectStore::index(const String& name, ExceptionCode& ec)
 {
-    // FIXME: If this is null, we should raise a NOT_FOUND_ERR.
-    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name);
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name, ec);
+    ASSERT(!index != !ec); // If we didn't get an index, we should have gotten an exception code. And vice versa.
     if (!index)
         return 0;
-    return IDBIndex::create(index.release());
+    return IDBIndex::create(index.release(), m_transaction.get());
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::removeIndex(ScriptExecutionContext* context, const String& name)
+void IDBObjectStore::removeIndex(const String& name, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->removeIndex(name, request);
-    return request;
+    m_objectStore->removeIndex(name, m_transaction.get(), ec);
 }
 
-PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, unsigned short direction)
+PassRefPtr<IDBRequest> IDBObjectStore::openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> range, unsigned short direction, ExceptionCode& ec)
 {
-    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this));
-    m_objectStore->openCursor(range, direction, request);
+    RefPtr<IDBRequest> request = IDBRequest::create(context, IDBAny::create(this), m_transaction.get());
+    m_objectStore->openCursor(range, direction, request, m_transaction.get(), ec);
+    if (ec)
+        return 0;
     return request.release();
 }
 
diff --git a/WebCore/storage/IDBObjectStore.h b/WebCore/storage/IDBObjectStore.h
index df5b3f7..dc92233 100644
--- a/WebCore/storage/IDBObjectStore.h
+++ b/WebCore/storage/IDBObjectStore.h
@@ -27,10 +27,13 @@
 #define IDBObjectStore_h
 
 #include "IDBCursor.h"
+#include "IDBIndex.h"
+#include "IDBKey.h"
 #include "IDBKeyRange.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBRequest.h"
 #include "PlatformString.h"
+#include "SerializedScriptValue.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
 #include <wtf/RefPtr.h>
@@ -41,10 +44,7 @@ namespace WebCore {
 
 class DOMStringList;
 class IDBAny;
-class IDBIndexRequest;
-class IDBKey;
 class IDBTransactionBackendInterface;
-class SerializedScriptValue;
 
 class IDBObjectStore : public RefCounted<IDBObjectStore> {
 public:
@@ -58,16 +58,23 @@ public:
     String keyPath() const;
     PassRefPtr<DOMStringList> indexNames() const;
 
-    PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey> key);
-    PassRefPtr<IDBRequest> add(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key = 0);
-    PassRefPtr<IDBRequest> put(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key = 0);
-    PassRefPtr<IDBRequest> remove(ScriptExecutionContext*, PassRefPtr<IDBKey> key);
+    // FIXME: Try to modify the code generator so this is unneeded.
+    PassRefPtr<IDBRequest> add(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return add(context, value, 0, ec);  }
+    PassRefPtr<IDBRequest> put(ScriptExecutionContext* context, PassRefPtr<SerializedScriptValue> value, ExceptionCode& ec) { return put(context, value, 0, ec);  }
+    PassRefPtr<IDBIndex> createIndex(const String& name, const String& keyPath, ExceptionCode& ec) { return createIndex(name, keyPath, false, ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, ExceptionCode& ec) { return openCursor(context, 0, ec); }
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext* context, PassRefPtr<IDBKeyRange> keyRange, ExceptionCode& ec) { return openCursor(context, keyRange, IDBCursor::NEXT, ec); }
 
-    PassRefPtr<IDBRequest> createIndex(ScriptExecutionContext*, const String& name, const String& keyPath, bool unique = false);
-    PassRefPtr<IDBIndex> index(const String& name);
-    PassRefPtr<IDBRequest> removeIndex(ScriptExecutionContext*, const String& name);
+    PassRefPtr<IDBRequest> get(ScriptExecutionContext*, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> add(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> put(ScriptExecutionContext*, PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, ExceptionCode&);
+    PassRefPtr<IDBRequest> remove(ScriptExecutionContext*, PassRefPtr<IDBKey> key, ExceptionCode&);
 
-    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange> = 0, unsigned short direction = IDBCursor::NEXT);
+    PassRefPtr<IDBIndex> createIndex(const String& name, const String& keyPath, bool unique, ExceptionCode&);
+    PassRefPtr<IDBIndex> index(const String& name, ExceptionCode&);
+    void removeIndex(const String& name, ExceptionCode&);
+
+    PassRefPtr<IDBRequest> openCursor(ScriptExecutionContext*, PassRefPtr<IDBKeyRange>, unsigned short direction, ExceptionCode&);
 
 private:
     IDBObjectStore(PassRefPtr<IDBObjectStoreBackendInterface>, IDBTransactionBackendInterface* transaction);
diff --git a/WebCore/storage/IDBObjectStore.idl b/WebCore/storage/IDBObjectStore.idl
index ccd0311..31eb865 100644
--- a/WebCore/storage/IDBObjectStore.idl
+++ b/WebCore/storage/IDBObjectStore.idl
@@ -28,21 +28,25 @@ module storage {
     interface [
         Conditional=INDEXED_DATABASE
     ] IDBObjectStore {
-        // FIXME: Many of these should raise on certain errors.
-        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key);        
-        [CallWith=ScriptExecutionContext] IDBRequest add(in SerializedScriptValue value, in [Optional] IDBKey key);
-        [CallWith=ScriptExecutionContext] IDBRequest put(in SerializedScriptValue value, in [Optional] IDBKey key);
-        [CallWith=ScriptExecutionContext] IDBRequest remove(in IDBKey key);
-        // FIXME: write openCursor
-        [CallWith=ScriptExecutionContext] IDBRequest createIndex(in DOMString name, in [ConvertNullToNullString] DOMString keyPath, in [Optional] boolean unique);
-        // FIXME: This needs to raise an IDBDatabaseException on errors.
-        IDBIndex index(in DOMString name);
-        [CallWith=ScriptExecutionContext] IDBRequest removeIndex(in DOMString name);
-
-        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction);
-
         readonly attribute DOMString name;
         readonly attribute [ConvertNullStringTo=Null] DOMString keyPath;
         readonly attribute DOMStringList indexNames;
+
+        [CallWith=ScriptExecutionContext] IDBRequest put(in SerializedScriptValue value, in [Optional] IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest add(in SerializedScriptValue value, in [Optional] IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest remove(in IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest get(in IDBKey key)
+            raises (IDBDatabaseException);
+        [CallWith=ScriptExecutionContext] IDBRequest openCursor(in [Optional] IDBKeyRange range, in [Optional] unsigned short direction)
+            raises (IDBDatabaseException);
+        IDBIndex createIndex(in DOMString name, in [ConvertNullToNullString] DOMString keyPath, in [Optional] boolean unique)
+            raises (IDBDatabaseException);
+        IDBIndex index(in DOMString name)
+            raises (IDBDatabaseException);
+        void removeIndex(in DOMString name)
+            raises (IDBDatabaseException);
     };
 }
diff --git a/WebCore/storage/IDBObjectStoreBackendImpl.cpp b/WebCore/storage/IDBObjectStoreBackendImpl.cpp
index 18d6b0c..f3aee91 100644
--- a/WebCore/storage/IDBObjectStoreBackendImpl.cpp
+++ b/WebCore/storage/IDBObjectStoreBackendImpl.cpp
@@ -26,6 +26,9 @@
 #include "config.h"
 #include "IDBObjectStoreBackendImpl.h"
 
+#if ENABLE(INDEXED_DATABASE)
+
+#include "CrossThreadTask.h"
 #include "DOMStringList.h"
 #include "IDBBindingUtilities.h"
 #include "IDBCallbacks.h"
@@ -33,6 +36,7 @@
 #include "IDBDatabaseBackendImpl.h"
 #include "IDBDatabaseException.h"
 #include "IDBIndexBackendImpl.h"
+#include "IDBKey.h"
 #include "IDBKeyPath.h"
 #include "IDBKeyPathBackendImpl.h"
 #include "IDBKeyRange.h"
@@ -42,37 +46,8 @@
 #include "SQLiteStatement.h"
 #include "SQLiteTransaction.h"
 
-#if ENABLE(INDEXED_DATABASE)
-
 namespace WebCore {
 
-template <class T, class Method, class Param1, class Param2>
-class IDBTask : public ScriptExecutionContext::Task {
-public:
-    IDBTask(T* obj, Method method, const Param1& param1, const Param2& param2)
-        : m_obj(obj), m_method(method), m_param1(param1), m_param2(param2) 
-    {
-    }
-
-    virtual void performTask(ScriptExecutionContext*) 
-    {
-        if (m_obj)
-            (m_obj->*m_method)(m_param1, m_param2);
-    }
-
-private:
-    T* m_obj;
-    Method m_method;
-    Param1 m_param1;
-    Param2 m_param2;
-};
-
-template <class T, class Method, class Param1, class Param2>
-PassOwnPtr<ScriptExecutionContext::Task> createTask(T* object, Method method, const Param1& param1, const Param2& param2)
-{
-    return adoptPtr(new IDBTask<T, Method, Param1, Param2>(object, method, param1, param2));
-}
-
 IDBObjectStoreBackendImpl::~IDBObjectStoreBackendImpl()
 {
 }
@@ -87,6 +62,15 @@ IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBDatabaseBackendImpl* dat
     loadIndexes();
 }
 
+IDBObjectStoreBackendImpl::IDBObjectStoreBackendImpl(IDBDatabaseBackendImpl* database, const String& name, const String& keyPath, bool autoIncrement)
+    : m_database(database)
+    , m_id(InvalidId)
+    , m_name(name)
+    , m_keyPath(keyPath)
+    , m_autoIncrement(autoIncrement)
+{
+}
+
 PassRefPtr<DOMStringList> IDBObjectStoreBackendImpl::indexNames() const
 {
     RefPtr<DOMStringList> indexNames = DOMStringList::create();
@@ -106,19 +90,22 @@ static void bindWhereClause(SQLiteStatement& query, int64_t id, IDBKey* key)
     key->bind(query, 2);
 }
 
-void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction)
+void IDBObjectStoreBackendImpl::get(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    if (!transaction->scheduleTask(createTask(this, &IDBObjectStoreBackendImpl::getInternal, key, callbacks)))
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_ALLOWED_ERR, "Get must be called in the context of a transaction."));
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::getInternal, objectStore, key, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBObjectStoreBackendImpl::getInternal(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
-    SQLiteStatement query(sqliteDatabase(), "SELECT keyString, keyDate, keyNumber, value FROM ObjectStoreData " + whereClause(key.get()));
+    SQLiteStatement query(objectStore->sqliteDatabase(), "SELECT keyString, keyDate, keyNumber, value FROM ObjectStoreData " + whereClause(key.get()));
     bool ok = query.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
-    bindWhereClause(query, m_id, key.get());
+    bindWhereClause(query, objectStore->id(), key.get());
     if (query.step() != SQLResultRow) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the object store."));
         return;
@@ -144,13 +131,13 @@ static PassRefPtr<IDBKey> fetchKeyFromKeyPath(SerializedScriptValue* value, cons
     return keys[0].release();
 }
 
-static void putObjectStoreData(SQLiteDatabase& db, IDBKey* key, SerializedScriptValue* value, int64_t objectStoreId, int64_t* dataRowId)
+static bool putObjectStoreData(SQLiteDatabase& db, IDBKey* key, SerializedScriptValue* value, int64_t objectStoreId, int64_t* dataRowId)
 {
     String sql = *dataRowId != -1 ? "UPDATE ObjectStoreData SET keyString = ?, keyDate = ?, keyNumber = ?, value = ? WHERE id = ?"
                                   : "INSERT INTO ObjectStoreData (keyString, keyDate, keyNumber, value, objectStoreId) VALUES (?, ?, ?, ?, ?)";
     SQLiteStatement query(db, sql);
-    bool ok = query.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
+    if (query.prepare() != SQLResultOk)
+        return false;
     key->bindWithNulls(query, 1);
     query.bindText(4, value->toWireString());
     if (*dataRowId != -1)
@@ -158,44 +145,63 @@ static void putObjectStoreData(SQLiteDatabase& db, IDBKey* key, SerializedScript
     else
         query.bindInt64(5, objectStoreId);
 
-    ok = query.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
+    if (query.step() != SQLResultDone)
+        return false;
 
     if (*dataRowId == -1)
         *dataRowId = db.lastInsertRowID();
+
+    return true;
 }
 
-static void putIndexData(SQLiteDatabase& db, IDBKey* key, int64_t indexId, int64_t objectStoreDataId)
+static bool deleteIndexData(SQLiteDatabase& db, int64_t objectStoreDataId)
 {
     SQLiteStatement deleteQuery(db, "DELETE FROM IndexData WHERE objectStoreDataId = ?");
-    bool ok = deleteQuery.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
+    if (deleteQuery.prepare() != SQLResultOk)
+        return false;
     deleteQuery.bindInt64(1, objectStoreDataId);
-    ok = deleteQuery.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 
+    return deleteQuery.step() == SQLResultDone;
+}
+
+static bool putIndexData(SQLiteDatabase& db, IDBKey* key, int64_t indexId, int64_t objectStoreDataId)
+{
     SQLiteStatement putQuery(db, "INSERT INTO IndexData (keyString, keyDate, keyNumber, indexId, objectStoreDataId) VALUES (?, ?, ?, ?, ?)");
-    ok = putQuery.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
+    if (putQuery.prepare() != SQLResultOk)
+        return false;
     key->bindWithNulls(putQuery, 1);
     putQuery.bindInt64(4, indexId);
     putQuery.bindInt64(5, objectStoreDataId);
 
-    ok = putQuery.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
+    return putQuery.step() == SQLResultDone;
+}
+
+void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, bool addOnly, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+{
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<SerializedScriptValue> value = prpValue;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    // FIXME: This should throw a SERIAL_ERR on structured clone problems.
+    // FIXME: This should throw a DATA_ERR when the wrong key/keyPath data is supplied.
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::putInternal, objectStore, value, key, addOnly, callbacks, transaction)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
 }
 
-void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, bool addOnly, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<SerializedScriptValue> prpValue, PassRefPtr<IDBKey> prpKey, bool addOnly, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     RefPtr<SerializedScriptValue> value = prpValue;
     RefPtr<IDBKey> key = prpKey;
 
-    if (!m_keyPath.isNull()) {
+    // FIXME: Support auto-increment.
+
+    if (!objectStore->m_keyPath.isNull()) {
         if (key) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "A key was supplied for an objectStore that has a keyPath."));
             return;
         }
-        key = fetchKeyFromKeyPath(value.get(), m_keyPath);
+        key = fetchKeyFromKeyPath(value.get(), objectStore->m_keyPath);
         if (!key) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "The key could not be fetched from the keyPath."));
             return;
@@ -206,7 +212,7 @@ void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue,
     }
 
     Vector<RefPtr<IDBKey> > indexKeys;
-    for (IndexMap::iterator it = m_indexes.begin(); it != m_indexes.end(); ++it) {
+    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it) {
         RefPtr<IDBKey> key = fetchKeyFromKeyPath(value.get(), it->second->keyPath());
         if (!key) {
             callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "The key could not be fetched from an index's keyPath."));
@@ -219,36 +225,63 @@ void IDBObjectStoreBackendImpl::put(PassRefPtr<SerializedScriptValue> prpValue,
         indexKeys.append(key.release());
     }
 
-    SQLiteStatement getQuery(sqliteDatabase(), "SELECT id FROM ObjectStoreData " + whereClause(key.get()));
+    SQLiteStatement getQuery(objectStore->sqliteDatabase(), "SELECT id FROM ObjectStoreData " + whereClause(key.get()));
     bool ok = getQuery.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
-    bindWhereClause(getQuery, m_id, key.get());
+    bindWhereClause(getQuery, objectStore->id(), key.get());
     bool isExistingValue = getQuery.step() == SQLResultRow;
     if (addOnly && isExistingValue) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Key already exists in the object store."));
         return;
     }
 
-    // Before this point, don't do any mutation.  After this point, don't error out.
+    // Before this point, don't do any mutation.  After this point, rollback the transaction in case of error.
 
     int64_t dataRowId = isExistingValue ? getQuery.getColumnInt(0) : -1;
-    putObjectStoreData(sqliteDatabase(), key.get(), value.get(), m_id, &dataRowId);
+    if (!putObjectStoreData(objectStore->sqliteDatabase(), key.get(), value.get(), objectStore->id(), &dataRowId)) {
+        // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+        transaction->abort();
+        return;
+    }
+
+    if (!deleteIndexData(objectStore->sqliteDatabase(), dataRowId)) {
+        // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
+        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+        transaction->abort();
+        return;
+    }
 
     int i = 0;
-    for (IndexMap::iterator it = m_indexes.begin(); it != m_indexes.end(); ++it, ++i)
-        putIndexData(sqliteDatabase(), indexKeys[i].get(), it->second->id(), dataRowId);
+    for (IndexMap::iterator it = objectStore->m_indexes.begin(); it != objectStore->m_indexes.end(); ++it, ++i) {
+        if (!putIndexData(objectStore->sqliteDatabase(), indexKeys[i].get(), it->second->id(), dataRowId)) {
+            // FIXME: The Indexed Database specification does not have an error code dedicated to I/O errors.
+            callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::UNKNOWN_ERR, "Error writing data to stable storage."));
+            transaction->abort();
+            return;
+        }
+    }
 
     callbacks->onSuccess(key.get());
 }
 
-void IDBObjectStoreBackendImpl::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::remove(PassRefPtr<IDBKey> prpKey, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
+{
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBKey> key = prpKey;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::removeInternal, objectStore, key, callbacks)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+}
+
+void IDBObjectStoreBackendImpl::removeInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
 {
-    SQLiteStatement query(sqliteDatabase(), "DELETE FROM ObjectStoreData " + whereClause(key.get()));
+    SQLiteStatement query(objectStore->sqliteDatabase(), "DELETE FROM ObjectStoreData " + whereClause(key.get()));
     bool ok = query.prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
-    bindWhereClause(query, m_id, key.get());
+    bindWhereClause(query, objectStore->id(), key.get());
     if (query.step() != SQLResultDone) {
         callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Key does not exist in the object store."));
         return;
@@ -257,33 +290,60 @@ void IDBObjectStoreBackendImpl::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCal
     callbacks->onSuccess();
 }
 
-void IDBObjectStoreBackendImpl::createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     if (m_indexes.contains(name)) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::CONSTRAINT_ERR, "Index name already exists."));
-        return;
+        ec = IDBDatabaseException::CONSTRAINT_ERR;
+        return 0;
+    }
+    if (transaction->mode() != IDBTransaction::VERSION_CHANGE) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return 0;
     }
 
-    SQLiteStatement insert(sqliteDatabase(), "INSERT INTO Indexes (objectStoreId, name, keyPath, isUnique) VALUES (?, ?, ?, ?)");
-    bool ok = insert.prepare() == SQLResultOk;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    insert.bindInt64(1, m_id);
-    insert.bindText(2, name);
-    insert.bindText(3, keyPath);
-    insert.bindInt(4, static_cast<int>(unique));
-    ok = insert.step() == SQLResultDone;
-    ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
-    int64_t id = sqliteDatabase().lastInsertRowID();
-
-    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(this, id, name, keyPath, unique);
+    RefPtr<IDBIndexBackendImpl> index = IDBIndexBackendImpl::create(this, name, keyPath, unique);
     ASSERT(index->name() == name);
+
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBTransactionBackendInterface> transactionPtr = transaction;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::createIndexInternal, objectStore, index, transaction),
+                                   createCallbackTask(&IDBObjectStoreBackendImpl::removeIndexFromMap, objectStore, index))) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return 0;
+    }
+
     m_indexes.set(name, index);
-    callbacks->onSuccess(index.get());
+    return index.release();
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(const String& name)
+void IDBObjectStoreBackendImpl::createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
-    return m_indexes.get(name);
+    SQLiteStatement insert(objectStore->sqliteDatabase(), "INSERT INTO Indexes (objectStoreId, name, keyPath, isUnique) VALUES (?, ?, ?, ?)");
+    if (insert.prepare() != SQLResultOk) {
+        transaction->abort();
+        return;
+    }
+    insert.bindInt64(1, objectStore->m_id);
+    insert.bindText(2, index->name());
+    insert.bindText(3, index->keyPath());
+    insert.bindInt(4, static_cast<int>(index->unique()));
+    if (insert.step() != SQLResultDone) {
+        transaction->abort();
+        return;
+    }
+    int64_t id = objectStore->sqliteDatabase().lastInsertRowID();
+    index->setId(id);
+    transaction->didCompleteTaskEvents();
+}
+
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreBackendImpl::index(const String& name, ExceptionCode& ec)
+{
+    RefPtr<IDBIndexBackendInterface> index = m_indexes.get(name);
+    if (!index) {
+        ec = IDBDatabaseException::NOT_FOUND_ERR;
+        return 0;
+    }
+    return index.release();
 }
 
 static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
@@ -296,25 +356,43 @@ static void doDelete(SQLiteDatabase& db, const char* sql, int64_t id)
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling.
 }
 
-void IDBObjectStoreBackendImpl::removeIndex(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::removeIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     RefPtr<IDBIndexBackendImpl> index = m_indexes.get(name);
     if (!index) {
-        callbacks->onError(IDBDatabaseError::create(IDBDatabaseException::NOT_FOUND_ERR, "Index name does not exist."));
+        ec = IDBDatabaseException::NOT_FOUND_ERR;
         return;
     }
 
-    SQLiteTransaction transaction(sqliteDatabase());
-    transaction.begin();
-    doDelete(sqliteDatabase(), "DELETE FROM Indexes WHERE id = ?", index->id());
-    doDelete(sqliteDatabase(), "DELETE FROM IndexData WHERE indexId = ?", index->id());
-    transaction.commit();
-
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBTransactionBackendInterface> transactionPtr = transaction;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::removeIndexInternal, objectStore, index, transactionPtr),
+                                   createCallbackTask(&IDBObjectStoreBackendImpl::addIndexToMap, objectStore, index))) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return;
+    }
     m_indexes.remove(name);
-    callbacks->onSuccess();
 }
 
-void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short tmpDirection, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreBackendImpl::removeIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index, PassRefPtr<IDBTransactionBackendInterface> transaction)
+{
+    doDelete(objectStore->sqliteDatabase(), "DELETE FROM Indexes WHERE id = ?", index->id());
+    doDelete(objectStore->sqliteDatabase(), "DELETE FROM IndexData WHERE indexId = ?", index->id());
+
+    transaction->didCompleteTaskEvents();
+}
+
+void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> prpRange, unsigned short direction, PassRefPtr<IDBCallbacks> prpCallbacks, IDBTransactionBackendInterface* transactionPtr, ExceptionCode& ec)
+{
+    RefPtr<IDBObjectStoreBackendImpl> objectStore = this;
+    RefPtr<IDBKeyRange> range = prpRange;
+    RefPtr<IDBCallbacks> callbacks = prpCallbacks;
+    RefPtr<IDBTransactionBackendInterface> transaction = transactionPtr;
+    if (!transaction->scheduleTask(createCallbackTask(&IDBObjectStoreBackendImpl::openCursorInternal, objectStore, range, direction, callbacks, transaction)))
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+}
+
+void IDBObjectStoreBackendImpl::openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBKeyRange> range, unsigned short tmpDirection, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<IDBTransactionBackendInterface> transaction)
 {
     // Several files depend on this order of selects.
     String sql = "SELECT id, keyString, keyDate, keyNumber, value FROM ObjectStoreData WHERE ";
@@ -330,7 +408,7 @@ void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> range, unsign
     else
         sql += "keyString DESC, keyDate DESC, keyNumber DESC";
 
-    OwnPtr<SQLiteStatement> query = adoptPtr(new SQLiteStatement(sqliteDatabase(), sql));
+    OwnPtr<SQLiteStatement> query = adoptPtr(new SQLiteStatement(objectStore->sqliteDatabase(), sql));
     bool ok = query->prepare() == SQLResultOk;
     ASSERT_UNUSED(ok, ok); // FIXME: Better error handling?
 
@@ -339,14 +417,14 @@ void IDBObjectStoreBackendImpl::openCursor(PassRefPtr<IDBKeyRange> range, unsign
         currentColumn += range->left()->bind(*query, currentColumn);
     if (range->flags() & IDBKeyRange::RIGHT_BOUND || range->flags() == IDBKeyRange::SINGLE)
         currentColumn += range->right()->bind(*query, currentColumn);
-    query->bindInt64(currentColumn, m_id);
+    query->bindInt64(currentColumn, objectStore->id());
 
     if (query->step() != SQLResultRow) {
         callbacks->onSuccess();
         return;
     }
 
-    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(this, range, direction, query.release());
+    RefPtr<IDBCursorBackendInterface> cursor = IDBCursorBackendImpl::create(objectStore, range, direction, query.release(), transaction.get());
     callbacks->onSuccess(cursor.release());
 }
 
@@ -373,6 +451,20 @@ SQLiteDatabase& IDBObjectStoreBackendImpl::sqliteDatabase() const
     return m_database->sqliteDatabase();
 }
 
+void IDBObjectStoreBackendImpl::removeIndexFromMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
+{
+    ASSERT(objectStore->m_indexes.contains(index->name()));
+    objectStore->m_indexes.remove(index->name());
+}
+
+void IDBObjectStoreBackendImpl::addIndexToMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl> objectStore, PassRefPtr<IDBIndexBackendImpl> index)
+{
+    RefPtr<IDBIndexBackendImpl> indexPtr = index;
+    ASSERT(!objectStore->m_indexes.contains(indexPtr->name()));
+    objectStore->m_indexes.set(indexPtr->name(), indexPtr);
+}
+
+
 } // namespace WebCore
 
 #endif
diff --git a/WebCore/storage/IDBObjectStoreBackendImpl.h b/WebCore/storage/IDBObjectStoreBackendImpl.h
index 36c0014..09223b1 100644
--- a/WebCore/storage/IDBObjectStoreBackendImpl.h
+++ b/WebCore/storage/IDBObjectStoreBackendImpl.h
@@ -38,6 +38,7 @@ class IDBDatabaseBackendImpl;
 class IDBIndexBackendImpl;
 class IDBTransactionBackendInterface;
 class SQLiteDatabase;
+class ScriptExecutionContext;
 
 class IDBObjectStoreBackendImpl : public IDBObjectStoreBackendInterface {
 public:
@@ -45,32 +46,55 @@ public:
     {
         return adoptRef(new IDBObjectStoreBackendImpl(database, id, name, keyPath, autoIncrement));
     }
-    ~IDBObjectStoreBackendImpl();
+    static PassRefPtr<IDBObjectStoreBackendImpl> create(IDBDatabaseBackendImpl* database, const String& name, const String& keyPath, bool autoIncrement)
+    {
+        return adoptRef(new IDBObjectStoreBackendImpl(database, name, keyPath, autoIncrement));
+    }
+    virtual ~IDBObjectStoreBackendImpl();
 
-    int64_t id() const { return m_id; }
-    String name() const { return m_name; }
-    String keyPath() const { return m_keyPath; }
-    PassRefPtr<DOMStringList> indexNames() const;
+    int64_t id() const
+    {
+        ASSERT(m_id != InvalidId);
+        return m_id;
+    }
+    void setId(int64_t id) { m_id = id; }
 
-    void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface* transaction);
-    void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>);
-    void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    virtual String name() const { return m_name; }
+    virtual String keyPath() const { return m_keyPath; }
+    virtual PassRefPtr<DOMStringList> indexNames() const;
+    virtual bool autoIncrement() const { return m_autoIncrement; }
 
-    void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>);
-    PassRefPtr<IDBIndexBackendInterface> index(const String& name);
-    void removeIndex(const String& name, PassRefPtr<IDBCallbacks>);
+    virtual void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
-    void openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>);
+    virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
+    virtual void removeIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+
+    virtual void openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
     IDBDatabaseBackendImpl* database() const { return m_database.get(); }
 
 private:
     IDBObjectStoreBackendImpl(IDBDatabaseBackendImpl*, int64_t id, const String& name, const String& keyPath, bool autoIncrement);
+    IDBObjectStoreBackendImpl(IDBDatabaseBackendImpl*, const String& name, const String& keyPath, bool autoIncrement);
 
     void loadIndexes();
     SQLiteDatabase& sqliteDatabase() const;
 
-    void getInternal(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void getInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void putInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void removeInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    static void createIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void removeIndexInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>, PassRefPtr<IDBTransactionBackendInterface>);
+    static void openCursorInternal(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>, PassRefPtr<IDBTransactionBackendInterface>);
+
+    // These are used as setVersion transaction abort tasks.
+    static void removeIndexFromMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>);
+    static void addIndexToMap(ScriptExecutionContext*, PassRefPtr<IDBObjectStoreBackendImpl>, PassRefPtr<IDBIndexBackendImpl>);
+
+    static const int64_t InvalidId = 0;
 
     RefPtr<IDBDatabaseBackendImpl> m_database;
 
diff --git a/WebCore/storage/IDBObjectStoreBackendInterface.h b/WebCore/storage/IDBObjectStoreBackendInterface.h
index c19855c..8763d90 100644
--- a/WebCore/storage/IDBObjectStoreBackendInterface.h
+++ b/WebCore/storage/IDBObjectStoreBackendInterface.h
@@ -26,6 +26,7 @@
 #ifndef IDBObjectStoreBackendInterface_h
 #define IDBObjectStoreBackendInterface_h
 
+#include "ExceptionCode.h"
 #include "PlatformString.h"
 #include <wtf/Threading.h>
 
@@ -49,15 +50,15 @@ public:
     virtual String keyPath() const = 0;
     virtual PassRefPtr<DOMStringList> indexNames() const = 0;
 
-    virtual void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface* transaction) = 0;
-    virtual void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>) = 0;
-    virtual void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>) = 0;
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual void remove(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
-    virtual void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>) = 0;
-    virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name) = 0;
-    virtual void removeIndex(const String& name, PassRefPtr<IDBCallbacks>) = 0;
+    virtual PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
+    virtual PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&) = 0;
+    virtual void removeIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>) = 0;
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&) = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBRequest.cpp b/WebCore/storage/IDBRequest.cpp
index c672642..c67e379 100644
--- a/WebCore/storage/IDBRequest.cpp
+++ b/WebCore/storage/IDBRequest.cpp
@@ -53,8 +53,8 @@ IDBRequest::IDBRequest(ScriptExecutionContext* context, PassRefPtr<IDBAny> sourc
     , m_timer(this, &IDBRequest::timerFired)
     , m_readyState(LOADING)
 {
-    if (transaction)
-        IDBPendingTransactionMonitor::removePendingTransaction(transaction);
+    if (m_transaction)
+        IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
 }
 
 IDBRequest::~IDBRequest()
@@ -70,10 +70,13 @@ IDBRequest::~IDBRequest()
     ASSERT(!m_transaction);
 }
 
-bool IDBRequest::resetReadyState()
+bool IDBRequest::resetReadyState(IDBTransactionBackendInterface* transaction)
 {
     ASSERT(m_readyState == DONE);
     m_readyState = LOADING;
+    ASSERT(!m_transaction);
+    m_transaction = transaction;
+    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
     return true;
 }
 
@@ -89,7 +92,7 @@ void IDBRequest::onSuccess()
 
 void IDBRequest::onSuccess(PassRefPtr<IDBCursorBackendInterface> backend)
 {
-    scheduleEvent(IDBAny::create(IDBCursor::create(backend, this)), 0);
+    scheduleEvent(IDBAny::create(IDBCursor::create(backend, this, m_transaction.get())), 0);
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
@@ -99,7 +102,7 @@ void IDBRequest::onSuccess(PassRefPtr<IDBDatabaseBackendInterface> backend)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBIndexBackendInterface> backend)
 {
-    scheduleEvent(IDBAny::create(IDBIndex::create(backend)), 0);
+    scheduleEvent(IDBAny::create(IDBIndex::create(backend, m_transaction.get())), 0);
 }
 
 void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
@@ -109,9 +112,20 @@ void IDBRequest::onSuccess(PassRefPtr<IDBKey> idbKey)
 
 void IDBRequest::onSuccess(PassRefPtr<IDBObjectStoreBackendInterface> backend)
 {
-    // FIXME: the transaction pointer should be the one of the setVersion transaction. This is because
-    // this callback is only executed for operations that neen to run in a setVersion transaction.
-    scheduleEvent(IDBAny::create(IDBObjectStore::create(backend, 0)), 0);
+    // FIXME: This function should go away once createObjectStore is sync.
+    scheduleEvent(IDBAny::create(IDBObjectStore::create(backend, m_transaction.get())), 0);
+}
+
+void IDBRequest::onSuccess(PassRefPtr<IDBTransactionBackendInterface> prpBackend)
+{
+    RefPtr<IDBTransactionBackendInterface> backend = prpBackend;
+    // This is only used by setVersion which will always have a source that's an IDBDatabase.
+    m_source->idbDatabase()->setSetVersionTransaction(backend.get());
+    RefPtr<IDBTransaction> frontend = IDBTransaction::create(scriptExecutionContext(), backend, m_source->idbDatabase().get());
+    backend->setCallbacks(frontend.get());
+    m_transaction = backend;
+    IDBPendingTransactionMonitor::removePendingTransaction(m_transaction.get());
+    scheduleEvent(IDBAny::create(frontend.release()), 0);
 }
 
 void IDBRequest::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
@@ -151,6 +165,10 @@ void IDBRequest::timerFired(Timer<IDBRequest>*)
     // need to make sure that resume() doesn't re-start the timer based on m_selfRef being set.
     RefPtr<IDBRequest> selfRef = m_selfRef.release();
 
+    // readyStateReset can be called synchronously while we're dispatching the event.
+    RefPtr<IDBTransactionBackendInterface> transaction = m_transaction;
+    m_transaction.clear();
+
     Vector<PendingEvent> pendingEvents;
     pendingEvents.swap(m_pendingEvents);
     for (size_t i = 0; i < pendingEvents.size(); ++i) {
@@ -162,12 +180,11 @@ void IDBRequest::timerFired(Timer<IDBRequest>*)
             dispatchEvent(IDBSuccessEvent::create(m_source, pendingEvents[i].m_result));
         }
     }
-    if (m_transaction) {
+    if (transaction) {
         // Now that we processed all pending events, let the transaction monitor check if
         // it can commit the current transaction or if there's anything new pending.
         // FIXME: Handle the workers case.
-        m_transaction->didCompleteTaskEvents();
-        m_transaction.clear();
+        transaction->didCompleteTaskEvents();
     }
 }
 
diff --git a/WebCore/storage/IDBRequest.h b/WebCore/storage/IDBRequest.h
index 75cd9a8..fa68208 100644
--- a/WebCore/storage/IDBRequest.h
+++ b/WebCore/storage/IDBRequest.h
@@ -46,7 +46,7 @@ class IDBTransactionBackendInterface;
 
 class IDBRequest : public IDBCallbacks, public EventTarget, public ActiveDOMObject {
 public:
-    static PassRefPtr<IDBRequest> create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction = 0) { return adoptRef(new IDBRequest(context, source, transaction)); }
+    static PassRefPtr<IDBRequest> create(ScriptExecutionContext* context, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction) { return adoptRef(new IDBRequest(context, source, transaction)); }
     virtual ~IDBRequest();
 
     // Defined in the IDL
@@ -58,7 +58,7 @@ public:
     DEFINE_ATTRIBUTE_EVENT_LISTENER(success);
     DEFINE_ATTRIBUTE_EVENT_LISTENER(error);
 
-    bool resetReadyState();
+    bool resetReadyState(IDBTransactionBackendInterface*);
 
     // IDBCallbacks
     virtual void onError(PassRefPtr<IDBDatabaseError>);
@@ -68,6 +68,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBObjectStoreBackendInterface>);
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
     // EventTarget
@@ -77,8 +78,8 @@ public:
     virtual ScriptExecutionContext* scriptExecutionContext() const;
     virtual bool canSuspend() const;
 
-    using RefCounted<IDBCallbacks>::ref;
-    using RefCounted<IDBCallbacks>::deref;
+    using ThreadSafeShared<IDBCallbacks>::ref;
+    using ThreadSafeShared<IDBCallbacks>::deref;
 
 private:
     IDBRequest(ScriptExecutionContext*, PassRefPtr<IDBAny> source, IDBTransactionBackendInterface* transaction);
diff --git a/WebCore/storage/IDBTimeoutEvent.cpp b/WebCore/storage/IDBTimeoutEvent.cpp
new file mode 100644
index 0000000..b61ee47
--- /dev/null
+++ b/WebCore/storage/IDBTimeoutEvent.cpp
@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "IDBTimeoutEvent.h"
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "EventNames.h"
+#include "IDBAny.h"
+
+namespace WebCore {
+
+PassRefPtr<IDBTimeoutEvent> IDBTimeoutEvent::create()
+{
+    return adoptRef(new IDBTimeoutEvent());
+}
+
+IDBTimeoutEvent::IDBTimeoutEvent()
+    : IDBEvent(eventNames().abortEvent, 0) // FIXME: set the source to the transaction
+{
+}
+
+IDBTimeoutEvent::~IDBTimeoutEvent()
+{
+}
+
+} // namespace WebCore
+
+#endif
diff --git a/WebCore/storage/IDBTimeoutEvent.h b/WebCore/storage/IDBTimeoutEvent.h
new file mode 100644
index 0000000..afc9ba4
--- /dev/null
+++ b/WebCore/storage/IDBTimeoutEvent.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef IDBTimeoutEvent_h
+#define IDBTimeoutEvent_h
+
+#if ENABLE(INDEXED_DATABASE)
+
+#include "IDBEvent.h"
+#include "PlatformString.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+class IDBTimeoutEvent : public IDBEvent {
+public:
+    static PassRefPtr<IDBTimeoutEvent> create();
+    // FIXME: Need to allow creation of these events from JS.
+    virtual ~IDBTimeoutEvent();
+
+    virtual bool isIDBTimeoutEvent() const { return true; }
+
+private:
+    IDBTimeoutEvent();
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(INDEXED_DATABASE)
+
+#endif // IDBTimeoutEvent_h
diff --git a/WebCore/storage/IDBTransaction.cpp b/WebCore/storage/IDBTransaction.cpp
index a223b7f..334c001 100644
--- a/WebCore/storage/IDBTransaction.cpp
+++ b/WebCore/storage/IDBTransaction.cpp
@@ -31,11 +31,14 @@
 #include "Event.h"
 #include "EventException.h"
 #include "IDBAbortEvent.h"
+#include "IDBCompleteEvent.h"
 #include "IDBDatabase.h"
 #include "IDBDatabaseException.h"
+#include "IDBIndex.h"
 #include "IDBObjectStore.h"
 #include "IDBObjectStoreBackendInterface.h"
 #include "IDBPendingTransactionMonitor.h"
+#include "IDBTimeoutEvent.h"
 #include "ScriptExecutionContext.h"
 
 namespace WebCore {
@@ -44,8 +47,10 @@ IDBTransaction::IDBTransaction(ScriptExecutionContext* context, PassRefPtr<IDBTr
     : ActiveDOMObject(context, this)
     , m_backend(backend)
     , m_database(db)
-    , m_stopped(false)
-    , m_timer(this, &IDBTransaction::timerFired)
+    , m_mode(m_backend->mode())
+    , m_onAbortTimer(this, &IDBTransaction::onAbortTimerFired)
+    , m_onCompleteTimer(this, &IDBTransaction::onCompleteTimerFired)
+    , m_onTimeoutTimer(this, &IDBTransaction::onTimeoutTimerFired)
 {
     IDBPendingTransactionMonitor::addPendingTransaction(m_backend.get());
 }
@@ -56,7 +61,7 @@ IDBTransaction::~IDBTransaction()
 
 unsigned short IDBTransaction::mode() const
 {
-    return m_backend->mode();
+    return m_mode;
 }
 
 IDBDatabase* IDBTransaction::db()
@@ -64,11 +69,15 @@ IDBDatabase* IDBTransaction::db()
     return m_database.get();
 }
 
-PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, const ExceptionCode&)
+PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, ExceptionCode& ec)
 {
+    if (!m_backend) {
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
+        return 0;
+    }
     RefPtr<IDBObjectStoreBackendInterface> objectStoreBackend = m_backend->objectStore(name);
     if (!objectStoreBackend) {
-        // FIXME: throw IDBDatabaseException::NOT_ALLOWED_ERR.
+        ec = IDBDatabaseException::NOT_ALLOWED_ERR;
         return 0;
     }
     RefPtr<IDBObjectStore> objectStore = IDBObjectStore::create(objectStoreBackend, m_backend.get());
@@ -77,7 +86,8 @@ PassRefPtr<IDBObjectStore> IDBTransaction::objectStore(const String& name, const
 
 void IDBTransaction::abort()
 {
-    m_backend->abort();
+    if (m_backend)
+        m_backend->abort();
 }
 
 ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
@@ -87,18 +97,32 @@ ScriptExecutionContext* IDBTransaction::scriptExecutionContext() const
 
 void IDBTransaction::onAbort()
 {
-    if (!m_stopped) {
-        m_selfRef = this;
-        m_stopped = true;
-        m_timer.startOneShot(0);
-    }
-    // Release the backend as it holds a (circular) reference back to us.
-    m_backend.clear();
+    ASSERT(!m_onAbortTimer.isActive());
+    ASSERT(!m_onCompleteTimer.isActive());
+    ASSERT(!m_onTimeoutTimer.isActive());
+    m_selfRef = this;
+    m_onAbortTimer.startOneShot(0);
+    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
+}
+
+void IDBTransaction::onComplete()
+{
+    ASSERT(!m_onAbortTimer.isActive());
+    ASSERT(!m_onCompleteTimer.isActive());
+    ASSERT(!m_onTimeoutTimer.isActive());
+    m_selfRef = this;
+    m_onCompleteTimer.startOneShot(0);
+    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
 }
 
-int IDBTransaction::id() const
+void IDBTransaction::onTimeout()
 {
-    return m_backend->id();
+    ASSERT(!m_onAbortTimer.isActive());
+    ASSERT(!m_onCompleteTimer.isActive());
+    ASSERT(!m_onTimeoutTimer.isActive());
+    m_selfRef = this;
+    m_onTimeoutTimer.startOneShot(0);
+    m_backend.clear(); // Release the backend as it holds a (circular) reference back to us.
 }
 
 bool IDBTransaction::canSuspend() const
@@ -110,11 +134,8 @@ bool IDBTransaction::canSuspend() const
 
 void IDBTransaction::stop()
 {
-    if (!m_stopped) {
-        // The document is getting detached. Abort!
-        m_stopped = true;
+    if (m_backend)
         m_backend->abort();
-    }
 }
 
 EventTargetData* IDBTransaction::eventTargetData()
@@ -127,14 +148,28 @@ EventTargetData* IDBTransaction::ensureEventTargetData()
     return &m_eventTargetData;
 }
 
-void IDBTransaction::timerFired(Timer<IDBTransaction>* transaction)
+void IDBTransaction::onAbortTimerFired(Timer<IDBTransaction>* transaction)
 {
     ASSERT(m_selfRef);
-
     RefPtr<IDBTransaction> selfRef = m_selfRef.release();
     dispatchEvent(IDBAbortEvent::create());
 }
 
+void IDBTransaction::onCompleteTimerFired(Timer<IDBTransaction>* transaction)
+{
+    ASSERT(m_selfRef);
+    RefPtr<IDBTransaction> selfRef = m_selfRef.release();
+    dispatchEvent(IDBCompleteEvent::create());
+}
+
+
+void IDBTransaction::onTimeoutTimerFired(Timer<IDBTransaction>* transaction)
+{
+    ASSERT(m_selfRef);
+    RefPtr<IDBTransaction> selfRef = m_selfRef.release();
+    dispatchEvent(IDBTimeoutEvent::create());
+}
+
 }
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebCore/storage/IDBTransaction.h b/WebCore/storage/IDBTransaction.h
index 0d6f3ea..8db5205 100644
--- a/WebCore/storage/IDBTransaction.h
+++ b/WebCore/storage/IDBTransaction.h
@@ -60,7 +60,7 @@ public:
 
     unsigned short mode() const;
     IDBDatabase* db();
-    PassRefPtr<IDBObjectStore> objectStore(const String& name, const ExceptionCode&);
+    PassRefPtr<IDBObjectStore> objectStore(const String& name, ExceptionCode&);
     void abort();
 
     DEFINE_ATTRIBUTE_EVENT_LISTENER(abort);
@@ -69,7 +69,8 @@ public:
 
     // IDBTransactionCallbacks
     virtual void onAbort();
-    virtual int id() const;
+    virtual void onComplete();
+    virtual void onTimeout();
 
     // EventTarget
     virtual IDBTransaction* toIDBTransaction() { return this; }
@@ -91,14 +92,18 @@ private:
     virtual EventTargetData* eventTargetData();
     virtual EventTargetData* ensureEventTargetData();
 
-    void timerFired(Timer<IDBTransaction>*);
+    void onAbortTimerFired(Timer<IDBTransaction>*);
+    void onCompleteTimerFired(Timer<IDBTransaction>*);
+    void onTimeoutTimerFired(Timer<IDBTransaction>*);
 
     EventTargetData m_eventTargetData;
     RefPtr<IDBTransactionBackendInterface> m_backend;
     RefPtr<IDBDatabase> m_database;
+    unsigned short m_mode;
 
-    bool m_stopped;
-    Timer<IDBTransaction> m_timer;
+    Timer<IDBTransaction> m_onAbortTimer;
+    Timer<IDBTransaction> m_onCompleteTimer;
+    Timer<IDBTransaction> m_onTimeoutTimer;
     RefPtr<IDBTransaction> m_selfRef; // This is set to us iff there's an event pending.
 };
 
diff --git a/WebCore/storage/IDBTransactionBackendImpl.cpp b/WebCore/storage/IDBTransactionBackendImpl.cpp
index 4f18437..5016a3f 100644
--- a/WebCore/storage/IDBTransactionBackendImpl.cpp
+++ b/WebCore/storage/IDBTransactionBackendImpl.cpp
@@ -42,30 +42,34 @@ PassRefPtr<IDBTransactionBackendImpl> IDBTransactionBackendImpl::create(DOMStrin
 IDBTransactionBackendImpl::IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, int id, IDBDatabaseBackendImpl* database)
     : m_objectStoreNames(objectStores)
     , m_mode(mode)
-    , m_timeout(timeout)
+    , m_timeout(timeout) // FIXME: Implement timeout.
     , m_id(id)
-    , m_state(NotStarted)
+    , m_state(Unused)
     , m_database(database)
     , m_transaction(new SQLiteTransaction(database->sqliteDatabase()))
-    , m_timer(this, &IDBTransactionBackendImpl::timerFired)
+    , m_taskTimer(this, &IDBTransactionBackendImpl::taskTimerFired)
+    , m_taskEventTimer(this, &IDBTransactionBackendImpl::taskEventTimerFired)
     , m_pendingEvents(0)
 {
 }
 
 PassRefPtr<IDBObjectStoreBackendInterface> IDBTransactionBackendImpl::objectStore(const String& name)
 {
-    if (isFinished())
+    if (m_state == Finished)
         return 0;
-    return m_database->objectStore(name, 0); // FIXME: remove mode param.
+    return m_database->objectStore(name);
 }
 
-bool IDBTransactionBackendImpl::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task> task)
+bool IDBTransactionBackendImpl::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task> task, PassOwnPtr<ScriptExecutionContext::Task> abortTask)
 {
-    if (isFinished())
+    if (m_state == Finished)
         return false;
 
     m_taskQueue.append(task);
-    if (m_state == NotStarted)
+    if (abortTask)
+        m_abortTaskQueue.prepend(abortTask);
+
+    if (m_state == Unused)
         start();
 
     return true;
@@ -73,66 +77,73 @@ bool IDBTransactionBackendImpl::scheduleTask(PassOwnPtr<ScriptExecutionContext::
 
 void IDBTransactionBackendImpl::abort()
 {
-    if (isFinished())
+    if (m_state == Finished)
         return;
 
     m_state = Finished;
+    m_taskTimer.stop();
+    m_taskEventTimer.stop();
     m_transaction->rollback();
+
+    // Run the abort tasks, if any.
+    while (!m_abortTaskQueue.isEmpty()) {
+        OwnPtr<ScriptExecutionContext::Task> task(m_abortTaskQueue.first().release());
+        m_abortTaskQueue.removeFirst();
+        task->performTask(0);
+    }
+
     m_callbacks->onAbort();
     m_database->transactionCoordinator()->didFinishTransaction(this);
 }
 
 void IDBTransactionBackendImpl::didCompleteTaskEvents()
 {
-    ASSERT(m_state == Started);
-    ASSERT(m_pendingEvents);
+    if (m_state == Finished)
+        return;
 
+    ASSERT(m_state == Running);
+    ASSERT(m_pendingEvents);
     m_pendingEvents--;
 
-    if (!m_pendingEvents && m_taskQueue.isEmpty()) {
-        // The last task event has completed and the task
-        // queue is empty. Commit the transaction.
-        commit();
-        return;
-    }
-
-    // We are still waiting for other events to complete. However,
-    // the task queue is non-empty and the timer is inactive.
-    // We can therfore schedule the timer again.
-    if (!m_taskQueue.isEmpty() && !m_timer.isActive())
-        m_timer.startOneShot(0);
+    if (!m_taskEventTimer.isActive())
+        m_taskEventTimer.startOneShot(0);
 }
 
 void IDBTransactionBackendImpl::run()
 {
-    ASSERT(m_state == Started);
-    ASSERT(!m_timer.isActive());
+    ASSERT(m_state == StartPending || m_state == Running);
+    ASSERT(!m_taskTimer.isActive());
 
-    m_timer.startOneShot(0);
+    m_taskTimer.startOneShot(0);
 }
 
 void IDBTransactionBackendImpl::start()
 {
-    ASSERT(m_state == NotStarted);
+    ASSERT(m_state == Unused);
 
-    m_state = Started;
-    m_transaction->begin();
+    m_state = StartPending;
     m_database->transactionCoordinator()->didStartTransaction(this);
 }
 
 void IDBTransactionBackendImpl::commit()
 {
-    ASSERT(m_state == Started);
+    ASSERT(m_state == Running);
 
     m_state = Finished;
     m_transaction->commit();
+    m_callbacks->onComplete();
     m_database->transactionCoordinator()->didFinishTransaction(this);
 }
 
-void IDBTransactionBackendImpl::timerFired(Timer<IDBTransactionBackendImpl>*)
+void IDBTransactionBackendImpl::taskTimerFired(Timer<IDBTransactionBackendImpl>*)
 {
     ASSERT(!m_taskQueue.isEmpty());
-    ASSERT(m_state == Started);
+
+    if (m_state == StartPending) {
+        m_transaction->begin();
+        m_state = Running;
+    } else
+        ASSERT(m_state == Running);
 
     TaskQueue queue;
     queue.swap(m_taskQueue);
@@ -144,6 +155,24 @@ void IDBTransactionBackendImpl::timerFired(Timer<IDBTransactionBackendImpl>*)
     }
 }
 
+void IDBTransactionBackendImpl::taskEventTimerFired(Timer<IDBTransactionBackendImpl>*)
+{
+    ASSERT(m_state == Running);
+
+    if (!m_pendingEvents && m_taskQueue.isEmpty()) {
+        // The last task event has completed and the task
+        // queue is empty. Commit the transaction.
+        commit();
+        return;
+    }
+
+    // We are still waiting for other events to complete. However,
+    // the task queue is non-empty and the timer is inactive.
+    // We can therfore schedule the timer again.
+    if (!m_taskQueue.isEmpty() && !m_taskTimer.isActive())
+        m_taskTimer.startOneShot(0);
+}
+
 };
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebCore/storage/IDBTransactionBackendImpl.h b/WebCore/storage/IDBTransactionBackendImpl.h
index c037a11..5f7409b 100644
--- a/WebCore/storage/IDBTransactionBackendImpl.h
+++ b/WebCore/storage/IDBTransactionBackendImpl.h
@@ -47,28 +47,29 @@ public:
 
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name);
     virtual unsigned short mode() const { return m_mode; }
-    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task> task, PassOwnPtr<ScriptExecutionContext::Task> abortTask);
     virtual void didCompleteTaskEvents();
     virtual void abort();
     virtual int id() const { return m_id; }
     virtual void setCallbacks(IDBTransactionCallbacks* callbacks) { m_callbacks = callbacks; }
 
     void run();
-    bool isFinished() const { return m_state == Finished; }
 
 private:
     IDBTransactionBackendImpl(DOMStringList* objectStores, unsigned short mode, unsigned long timeout, int id, IDBDatabaseBackendImpl*);
 
     enum State {
-        NotStarted,
-        Started,
-        Finished,
+        Unused, // Created, but no tasks yet.
+        StartPending, // Enqueued tasks, but SQLite transaction not yet started.
+        Running, // SQLite transaction started but not yet finished.
+        Finished, // Either aborted or committed.
     };
 
     void start();
     void commit();
 
-    void timerFired(Timer<IDBTransactionBackendImpl>*);
+    void taskTimerFired(Timer<IDBTransactionBackendImpl>*);
+    void taskEventTimerFired(Timer<IDBTransactionBackendImpl>*);
 
     RefPtr<DOMStringList> m_objectStoreNames;
     unsigned short m_mode;
@@ -81,11 +82,13 @@ private:
 
     typedef Deque<OwnPtr<ScriptExecutionContext::Task> > TaskQueue;
     TaskQueue m_taskQueue;
+    TaskQueue m_abortTaskQueue;
 
     OwnPtr<SQLiteTransaction> m_transaction;
 
     // FIXME: delete the timer once we have threads instead.
-    Timer<IDBTransactionBackendImpl> m_timer;
+    Timer<IDBTransactionBackendImpl> m_taskTimer;
+    Timer<IDBTransactionBackendImpl> m_taskEventTimer;
     int m_pendingEvents;
 };
 
diff --git a/WebCore/storage/IDBTransactionBackendInterface.h b/WebCore/storage/IDBTransactionBackendInterface.h
index db95d03..65b097d 100644
--- a/WebCore/storage/IDBTransactionBackendInterface.h
+++ b/WebCore/storage/IDBTransactionBackendInterface.h
@@ -50,7 +50,7 @@ public:
 
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name) = 0;
     virtual unsigned short mode() const = 0;
-    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>) = 0;
+    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task> task, PassOwnPtr<ScriptExecutionContext::Task> abortTask = 0) = 0;
     virtual void didCompleteTaskEvents() = 0;
     virtual void abort() = 0;
     virtual int id() const = 0;
diff --git a/WebCore/storage/IDBTransactionCallbacks.h b/WebCore/storage/IDBTransactionCallbacks.h
index 38181fc..348608d 100644
--- a/WebCore/storage/IDBTransactionCallbacks.h
+++ b/WebCore/storage/IDBTransactionCallbacks.h
@@ -41,8 +41,8 @@ public:
     virtual ~IDBTransactionCallbacks() { }
 
     virtual void onAbort() = 0;
-    virtual int id() const = 0;
-    // FIXME: add the rest
+    virtual void onComplete() = 0;
+    virtual void onTimeout() = 0;
 };
 
 } // namespace WebCore
diff --git a/WebCore/storage/IDBTransactionCoordinator.h b/WebCore/storage/IDBTransactionCoordinator.h
index 5e54ab4..fddb003 100644
--- a/WebCore/storage/IDBTransactionCoordinator.h
+++ b/WebCore/storage/IDBTransactionCoordinator.h
@@ -69,8 +69,8 @@ private:
     // This map owns all transactions known to the coordinator.
     HashMap<int, RefPtr<IDBTransactionBackendImpl> > m_transactions;
     // Transactions in different states are grouped below.
-    ListHashSet<IDBTransactionBackendImpl* > m_startedTransactions;
-    HashSet<IDBTransactionBackendImpl* > m_runningTransactions;
+    ListHashSet<IDBTransactionBackendImpl*> m_startedTransactions;
+    HashSet<IDBTransactionBackendImpl*> m_runningTransactions;
     int m_nextID;
 };
 
diff --git a/WebCore/svg/SVGAnimatedProperty.h b/WebCore/svg/DeprecatedSVGAnimatedProperty.h
index d9cbeec..e2f2af7 100644
--- a/WebCore/svg/SVGAnimatedProperty.h
+++ b/WebCore/svg/DeprecatedSVGAnimatedProperty.h
@@ -18,27 +18,27 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef SVGAnimatedProperty_h
-#define SVGAnimatedProperty_h
+#ifndef DeprecatedSVGAnimatedProperty_h
+#define DeprecatedSVGAnimatedProperty_h
 
 #if ENABLE(SVG)
 #include "SVGAnimatedPropertySynchronizer.h"
-#include "SVGAnimatedPropertyTraits.h"
-#include "SVGAnimatedTemplate.h"
+#include "DeprecatedSVGAnimatedPropertyTraits.h"
+#include "DeprecatedSVGAnimatedTemplate.h"
 
 namespace WebCore {
 
 template<typename AnimatedType>
-class SVGAnimatedProperty;
+class DeprecatedSVGAnimatedProperty;
 
 template<typename AnimatedType>
-class SVGAnimatedPropertyTearOff : public SVGAnimatedTemplate<AnimatedType> {
+class DeprecatedSVGAnimatedPropertyTearOff : public DeprecatedSVGAnimatedTemplate<AnimatedType> {
 public:
-    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
-    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
+    typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+    typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
 
-    typedef SVGAnimatedPropertyTearOff<AnimatedType> Self;
-    typedef SVGAnimatedProperty<AnimatedType> Creator;
+    typedef DeprecatedSVGAnimatedPropertyTearOff<AnimatedType> Self;
+    typedef DeprecatedSVGAnimatedProperty<AnimatedType> Creator;
 
     static PassRefPtr<Self> create(Creator& creator, SVGElement* contextElement)
     {
@@ -62,14 +62,14 @@ public:
     virtual const QualifiedName& associatedAttributeName() const { return m_creator.associatedAttributeName(); }
 
 private:
-    SVGAnimatedPropertyTearOff(Creator& creator, SVGElement* contextElement)
+    DeprecatedSVGAnimatedPropertyTearOff(Creator& creator, SVGElement* contextElement)
         : m_creator(creator)
         , m_contextElement(contextElement)
     {
         m_creator.setShouldSynchronize(true);
     }
 
-    virtual ~SVGAnimatedPropertyTearOff()
+    virtual ~DeprecatedSVGAnimatedPropertyTearOff()
     {
         m_creator.setShouldSynchronize(false);
     }
@@ -79,36 +79,36 @@ private:
 };
 
 template<typename AnimatedType>
-class SVGAnimatedProperty {
+class DeprecatedSVGAnimatedProperty {
 public:
-    virtual ~SVGAnimatedProperty() { }
+    virtual ~DeprecatedSVGAnimatedProperty() { }
 
-    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
-    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
-    typedef typename SVGAnimatedPropertyTraits<AnimatedType>::StoredType StoredType;
+    typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+    typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
+    typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::StoredType StoredType;
 
-    SVGAnimatedProperty()
-        : m_value(SVGAnimatedPropertyTraits<AnimatedType>::null())
+    DeprecatedSVGAnimatedProperty()
+        : m_value(DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::null())
         , m_shouldSynchronize(false)
     {
     }
 
     template<typename ConstructorParameterOne>
-    SVGAnimatedProperty(const ConstructorParameterOne& value1)
+    DeprecatedSVGAnimatedProperty(const ConstructorParameterOne& value1)
         : m_value(value1)
         , m_shouldSynchronize(false)
     {
     }
 
     template<typename ConstructorParameterOne, typename ConstructorParameterTwo>
-    SVGAnimatedProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2)
+    DeprecatedSVGAnimatedProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2)
         : m_value(value1, value2)
         , m_shouldSynchronize(false)
     {
     }
 
-    ReturnType value() const { return SVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
-    ReturnType baseValue() const { return SVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
+    ReturnType value() const { return DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
+    ReturnType baseValue() const { return DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::toReturnType(m_value); }
 
     void setValue(PassType type) { m_value = type; }
     void setBaseValue(PassType type) { m_value = type; }
@@ -127,29 +127,29 @@ protected:
 
 // Helper macro used within DECLARE_ANIMATED_PROPERTY below
 #define DEFINE_ANIMATED_PROPERTY(OwnerType, DOMAttribute, AnimatedType, UpperProperty) \
-class SVGAnimatedProperty##UpperProperty : public SVGAnimatedProperty<AnimatedType> { \
+class DeprecatedSVGAnimatedProperty##UpperProperty : public DeprecatedSVGAnimatedProperty<AnimatedType> { \
 public: \
-    SVGAnimatedProperty##UpperProperty() \
-        : SVGAnimatedProperty<AnimatedType>() \
+    DeprecatedSVGAnimatedProperty##UpperProperty() \
+        : DeprecatedSVGAnimatedProperty<AnimatedType>() \
     { \
     } \
     \
     template<typename ConstructorParameterOne> \
-    SVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1) \
-        : SVGAnimatedProperty<AnimatedType>(value1) \
+    DeprecatedSVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1) \
+        : DeprecatedSVGAnimatedProperty<AnimatedType>(value1) \
     { \
     } \
     \
     template<typename ConstructorParameterOne, typename ConstructorParameterTwo> \
-    SVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2) \
-        : SVGAnimatedProperty<AnimatedType>(value1, value2) \
+    DeprecatedSVGAnimatedProperty##UpperProperty(const ConstructorParameterOne& value1, const ConstructorParameterTwo& value2) \
+        : DeprecatedSVGAnimatedProperty<AnimatedType>(value1, value2) \
     { \
     } \
     \
     void synchronize(SVGElement* contextElement) \
     { \
         ASSERT(m_shouldSynchronize); \
-        AtomicString value(SVGAnimatedPropertyTraits<AnimatedType>::toString(baseValue())); \
+        AtomicString value(DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::toString(baseValue())); \
         SVGAnimatedPropertySynchronizer<IsDerivedFromSVGElement<OwnerType>::value>::synchronize(contextElement, DOMAttribute, value); \
     } \
     \
@@ -162,29 +162,29 @@ public: \
 // Helper macro shared by DECLARE_ANIMATED_PROPERTY / DECLARE_ANIMATED_PROPERTY_MULTIPLE_WRAPPERS
 #define DECLARE_ANIMATED_PROPERTY_SHARED(OwnerType, DOMAttribute, SVGDOMAttributeIdentifier, AnimatedType, UpperProperty, LowerProperty) \
 private: \
-    typedef SVGAnimatedPropertyTearOff<AnimatedType> SVGAnimatedPropertyTearOff##UpperProperty; \
+    typedef DeprecatedSVGAnimatedPropertyTearOff<AnimatedType> DeprecatedSVGAnimatedPropertyTearOff##UpperProperty; \
     DEFINE_ANIMATED_PROPERTY(OwnerType, DOMAttribute, AnimatedType, UpperProperty); \
-    SVGAnimatedProperty##UpperProperty m_##LowerProperty; \
+    DeprecatedSVGAnimatedProperty##UpperProperty m_##LowerProperty; \
     \
 public: \
-    SVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty() const \
+    DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty() const \
     { \
         return m_##LowerProperty.value(); \
     } \
     \
-    SVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty##BaseValue() const \
+    DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::ReturnType LowerProperty##BaseValue() const \
     { \
         return m_##LowerProperty.baseValue(); \
     } \
     \
-    void set##UpperProperty(SVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
+    void set##UpperProperty(DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
     { \
         m_##LowerProperty.setValue(type); \
         SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
         contextElement->invalidateSVGAttributes(); \
     } \
     \
-    void set##UpperProperty##BaseValue(SVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
+    void set##UpperProperty##BaseValue(DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::PassType type) \
     { \
         m_##LowerProperty.setBaseValue(type); \
         SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
@@ -199,10 +199,10 @@ public: \
         m_##LowerProperty.synchronize(contextElement); \
     } \
     \
-    PassRefPtr<SVGAnimatedPropertyTearOff##UpperProperty> LowerProperty##Animated() \
+    PassRefPtr<DeprecatedSVGAnimatedPropertyTearOff##UpperProperty> LowerProperty##Animated() \
     { \
         SVGElement* contextElement = GetOwnerElementForType<OwnerType, IsDerivedFromSVGElement<OwnerType>::value>::ownerElement(this); \
-        return lookupOrCreateWrapper<AnimatedType, SVGAnimatedPropertyTearOff##UpperProperty>(contextElement, m_##LowerProperty, DOMAttribute); \
+        return lookupOrCreateWrapper<AnimatedType, DeprecatedSVGAnimatedPropertyTearOff##UpperProperty>(contextElement, m_##LowerProperty, DOMAttribute); \
     }
 
 // Used for SVG DOM properties that map exactly to one XML DOM attribute
diff --git a/WebCore/svg/SVGAnimatedPropertyTraits.h b/WebCore/svg/DeprecatedSVGAnimatedPropertyTraits.h
index 5cc69a9..a660198 100644
--- a/WebCore/svg/SVGAnimatedPropertyTraits.h
+++ b/WebCore/svg/DeprecatedSVGAnimatedPropertyTraits.h
@@ -18,8 +18,8 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef SVGAnimatedPropertyTraits_h
-#define SVGAnimatedPropertyTraits_h
+#ifndef DeprecatedSVGAnimatedPropertyTraits_h
+#define DeprecatedSVGAnimatedPropertyTraits_h
 
 #if ENABLE(SVG)
 #include "FloatRect.h"
@@ -34,11 +34,11 @@
 namespace WebCore {
 
 template<typename Type>
-struct SVGAnimatedPropertyTraits : public Noncopyable { };
+struct DeprecatedSVGAnimatedPropertyTraits : public Noncopyable { };
 
 // SVGAnimatedAngle
 template<>
-struct SVGAnimatedPropertyTraits<SVGAngle> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGAngle> : public Noncopyable {
     typedef const SVGAngle& PassType;
     typedef SVGAngle ReturnType;
     typedef SVGAngle StoredType;
@@ -50,7 +50,7 @@ struct SVGAnimatedPropertyTraits<SVGAngle> : public Noncopyable {
 
 // SVGAnimatedBoolean
 template<>
-struct SVGAnimatedPropertyTraits<bool> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<bool> : public Noncopyable {
     typedef const bool& PassType;
     typedef bool ReturnType;
     typedef bool StoredType;
@@ -62,7 +62,7 @@ struct SVGAnimatedPropertyTraits<bool> : public Noncopyable {
 
 // SVGAnimatedEnumeration
 template<>
-struct SVGAnimatedPropertyTraits<int> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<int> : public Noncopyable {
     typedef const int& PassType;
     typedef int ReturnType;
     typedef int StoredType;
@@ -74,7 +74,7 @@ struct SVGAnimatedPropertyTraits<int> : public Noncopyable {
 
 // SVGAnimatedInteger
 template<>
-struct SVGAnimatedPropertyTraits<long> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<long> : public Noncopyable {
     typedef const long& PassType;
     typedef long ReturnType;
     typedef long StoredType;
@@ -86,7 +86,7 @@ struct SVGAnimatedPropertyTraits<long> : public Noncopyable {
 
 // SVGAnimatedLength
 template<>
-struct SVGAnimatedPropertyTraits<SVGLength> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGLength> : public Noncopyable {
     typedef const SVGLength& PassType;
     typedef SVGLength ReturnType;
     typedef SVGLength StoredType;
@@ -98,7 +98,7 @@ struct SVGAnimatedPropertyTraits<SVGLength> : public Noncopyable {
 
 // SVGAnimatedLengthList
 template<>
-struct SVGAnimatedPropertyTraits<SVGLengthList*> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGLengthList*> : public Noncopyable {
     typedef SVGLengthList* PassType;
     typedef SVGLengthList* ReturnType;
     typedef RefPtr<SVGLengthList> StoredType;
@@ -110,7 +110,7 @@ struct SVGAnimatedPropertyTraits<SVGLengthList*> : public Noncopyable {
 
 // SVGAnimatedNumber
 template<>
-struct SVGAnimatedPropertyTraits<float> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<float> : public Noncopyable {
     typedef const float& PassType;
     typedef float ReturnType;
     typedef float StoredType;
@@ -122,7 +122,7 @@ struct SVGAnimatedPropertyTraits<float> : public Noncopyable {
 
 // SVGAnimatedNumberList
 template<>
-struct SVGAnimatedPropertyTraits<SVGNumberList*> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGNumberList*> : public Noncopyable {
     typedef SVGNumberList* PassType;
     typedef SVGNumberList* ReturnType;
     typedef RefPtr<SVGNumberList> StoredType;
@@ -134,7 +134,7 @@ struct SVGAnimatedPropertyTraits<SVGNumberList*> : public Noncopyable {
 
 // SVGAnimatedPreserveAspectRatio
 template<>
-struct SVGAnimatedPropertyTraits<SVGPreserveAspectRatio> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGPreserveAspectRatio> : public Noncopyable {
     typedef const SVGPreserveAspectRatio& PassType;
     typedef SVGPreserveAspectRatio ReturnType;
     typedef SVGPreserveAspectRatio StoredType;
@@ -146,7 +146,7 @@ struct SVGAnimatedPropertyTraits<SVGPreserveAspectRatio> : public Noncopyable {
 
 // SVGAnimatedRect
 template<>
-struct SVGAnimatedPropertyTraits<FloatRect> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<FloatRect> : public Noncopyable {
     typedef const FloatRect& PassType;
     typedef FloatRect ReturnType;
     typedef FloatRect StoredType;
@@ -158,7 +158,7 @@ struct SVGAnimatedPropertyTraits<FloatRect> : public Noncopyable {
 
 // SVGAnimatedString
 template<>
-struct SVGAnimatedPropertyTraits<String> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<String> : public Noncopyable {
     typedef const String& PassType;
     typedef String ReturnType;
     typedef String StoredType;
@@ -170,7 +170,7 @@ struct SVGAnimatedPropertyTraits<String> : public Noncopyable {
 
 // SVGAnimatedTransformList
 template<>
-struct SVGAnimatedPropertyTraits<SVGTransformList*> : public Noncopyable {
+struct DeprecatedSVGAnimatedPropertyTraits<SVGTransformList*> : public Noncopyable {
     typedef SVGTransformList* PassType;
     typedef SVGTransformList* ReturnType;
     typedef RefPtr<SVGTransformList> StoredType;
diff --git a/WebCore/svg/SVGAnimatedTemplate.h b/WebCore/svg/DeprecatedSVGAnimatedTemplate.h
index 307c66a..8e29f50 100644
--- a/WebCore/svg/SVGAnimatedTemplate.h
+++ b/WebCore/svg/DeprecatedSVGAnimatedTemplate.h
@@ -18,11 +18,11 @@
  * Boston, MA 02110-1301, USA.
  */
 
-#ifndef SVGAnimatedTemplate_h
-#define SVGAnimatedTemplate_h
+#ifndef DeprecatedSVGAnimatedTemplate_h
+#define DeprecatedSVGAnimatedTemplate_h
 
 #if ENABLE(SVG)
-#include "SVGAnimatedPropertyTraits.h"
+#include "DeprecatedSVGAnimatedPropertyTraits.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 
@@ -36,15 +36,15 @@ namespace WebCore {
     class SVGTransformList;
     class QualifiedName;
 
-    struct SVGAnimatedTypeWrapperKey {            
+    struct DeprecatedSVGAnimatedTypeWrapperKey {            
         // Empty value
-        SVGAnimatedTypeWrapperKey()
+        DeprecatedSVGAnimatedTypeWrapperKey()
             : element(0)
             , attributeName(0)
         { }
 
         // Deleted value
-        SVGAnimatedTypeWrapperKey(WTF::HashTableDeletedValueType)
+        DeprecatedSVGAnimatedTypeWrapperKey(WTF::HashTableDeletedValueType)
             : element(reinterpret_cast<SVGElement*>(-1))
         {
         }
@@ -54,7 +54,7 @@ namespace WebCore {
             return element == reinterpret_cast<SVGElement*>(-1);
         }
 
-        SVGAnimatedTypeWrapperKey(const SVGElement* _element, const AtomicString& _attributeName)
+        DeprecatedSVGAnimatedTypeWrapperKey(const SVGElement* _element, const AtomicString& _attributeName)
             : element(_element)
             , attributeName(_attributeName.impl())
         {
@@ -62,7 +62,7 @@ namespace WebCore {
             ASSERT(attributeName);
         }
 
-        bool operator==(const SVGAnimatedTypeWrapperKey& other) const
+        bool operator==(const DeprecatedSVGAnimatedTypeWrapperKey& other) const
         {
             return element == other.element && attributeName == other.attributeName;
         }
@@ -71,13 +71,13 @@ namespace WebCore {
         AtomicStringImpl* attributeName;
     };
     
-    struct SVGAnimatedTypeWrapperKeyHash {
-        static unsigned hash(const SVGAnimatedTypeWrapperKey& key)
+    struct DeprecatedSVGAnimatedTypeWrapperKeyHash {
+        static unsigned hash(const DeprecatedSVGAnimatedTypeWrapperKey& key)
         {
-            return StringImpl::computeHash(reinterpret_cast<const UChar*>(&key), sizeof(SVGAnimatedTypeWrapperKey) / sizeof(UChar));
+            return StringImpl::computeHash(reinterpret_cast<const UChar*>(&key), sizeof(DeprecatedSVGAnimatedTypeWrapperKey) / sizeof(UChar));
         }
 
-        static bool equal(const SVGAnimatedTypeWrapperKey& a, const SVGAnimatedTypeWrapperKey& b)
+        static bool equal(const DeprecatedSVGAnimatedTypeWrapperKey& a, const DeprecatedSVGAnimatedTypeWrapperKey& b)
         {
             return a == b;
         }
@@ -85,27 +85,27 @@ namespace WebCore {
         static const bool safeToCompareToEmptyOrDeleted = true;
     };
 
-    struct SVGAnimatedTypeWrapperKeyHashTraits : WTF::GenericHashTraits<SVGAnimatedTypeWrapperKey> {
+    struct DeprecatedSVGAnimatedTypeWrapperKeyHashTraits : WTF::GenericHashTraits<DeprecatedSVGAnimatedTypeWrapperKey> {
         static const bool emptyValueIsZero = true;
 
-        static void constructDeletedValue(SVGAnimatedTypeWrapperKey& slot)
+        static void constructDeletedValue(DeprecatedSVGAnimatedTypeWrapperKey& slot)
         {
-            new (&slot) SVGAnimatedTypeWrapperKey(WTF::HashTableDeletedValue);
+            new (&slot) DeprecatedSVGAnimatedTypeWrapperKey(WTF::HashTableDeletedValue);
         }
 
-        static bool isDeletedValue(const SVGAnimatedTypeWrapperKey& value)
+        static bool isDeletedValue(const DeprecatedSVGAnimatedTypeWrapperKey& value)
         {
             return value.isHashTableDeletedValue();
         }
     };
  
     template<typename AnimatedType>
-    class SVGAnimatedTemplate : public RefCounted<SVGAnimatedTemplate<AnimatedType> > {
+    class DeprecatedSVGAnimatedTemplate : public RefCounted<DeprecatedSVGAnimatedTemplate<AnimatedType> > {
     public:
-        typedef typename SVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
-        typedef typename SVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
+        typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::PassType PassType;
+        typedef typename DeprecatedSVGAnimatedPropertyTraits<AnimatedType>::ReturnType ReturnType;
 
-        virtual ~SVGAnimatedTemplate() { forgetWrapper(this); }
+        virtual ~DeprecatedSVGAnimatedTemplate() { forgetWrapper(this); }
 
         virtual ReturnType baseVal() const = 0;
         virtual void setBaseVal(PassType) = 0;
@@ -115,7 +115,7 @@ namespace WebCore {
 
         virtual const QualifiedName& associatedAttributeName() const = 0;
 
-        typedef HashMap<SVGAnimatedTypeWrapperKey, SVGAnimatedTemplate<AnimatedType>*, SVGAnimatedTypeWrapperKeyHash, SVGAnimatedTypeWrapperKeyHashTraits > ElementToWrapperMap;
+        typedef HashMap<DeprecatedSVGAnimatedTypeWrapperKey, DeprecatedSVGAnimatedTemplate<AnimatedType>*, DeprecatedSVGAnimatedTypeWrapperKeyHash, DeprecatedSVGAnimatedTypeWrapperKeyHashTraits > ElementToWrapperMap;
         typedef typename ElementToWrapperMap::const_iterator ElementToWrapperMapIterator;
 
         static ElementToWrapperMap* wrapperCache()
@@ -124,7 +124,7 @@ namespace WebCore {
             return s_wrapperCache;
         }
 
-        static void forgetWrapper(SVGAnimatedTemplate<AnimatedType>* wrapper)
+        static void forgetWrapper(DeprecatedSVGAnimatedTemplate<AnimatedType>* wrapper)
         {
             ElementToWrapperMap* cache = wrapperCache();
             ElementToWrapperMapIterator itr = cache->begin();
@@ -139,12 +139,12 @@ namespace WebCore {
     };
 
     template<typename AnimatedType>
-    class SVGAnimatedProperty;
+    class DeprecatedSVGAnimatedProperty;
 
     template<typename AnimatedType, typename AnimatedTearOff>
-    PassRefPtr<AnimatedTearOff> lookupOrCreateWrapper(SVGElement* element, SVGAnimatedProperty<AnimatedType>& creator, const QualifiedName& attrName)
+    PassRefPtr<AnimatedTearOff> lookupOrCreateWrapper(SVGElement* element, DeprecatedSVGAnimatedProperty<AnimatedType>& creator, const QualifiedName& attrName)
     {
-        SVGAnimatedTypeWrapperKey key(element, attrName.localName());
+        DeprecatedSVGAnimatedTypeWrapperKey key(element, attrName.localName());
         RefPtr<AnimatedTearOff> wrapper = static_cast<AnimatedTearOff*>(AnimatedTearOff::wrapperCache()->get(key));
 
         if (!wrapper) {
@@ -156,18 +156,18 @@ namespace WebCore {
     }
 
     // Common type definitions, to ease IDL generation.
-    typedef SVGAnimatedTemplate<SVGAngle> SVGAnimatedAngle;
-    typedef SVGAnimatedTemplate<bool> SVGAnimatedBoolean;
-    typedef SVGAnimatedTemplate<int> SVGAnimatedEnumeration;
-    typedef SVGAnimatedTemplate<long> SVGAnimatedInteger;
-    typedef SVGAnimatedTemplate<SVGLength> SVGAnimatedLength;
-    typedef SVGAnimatedTemplate<SVGLengthList*> SVGAnimatedLengthList;
-    typedef SVGAnimatedTemplate<float> SVGAnimatedNumber;
-    typedef SVGAnimatedTemplate<SVGNumberList*> SVGAnimatedNumberList; 
-    typedef SVGAnimatedTemplate<SVGPreserveAspectRatio> SVGAnimatedPreserveAspectRatio;
-    typedef SVGAnimatedTemplate<FloatRect> SVGAnimatedRect;
-    typedef SVGAnimatedTemplate<String> SVGAnimatedString;
-    typedef SVGAnimatedTemplate<SVGTransformList*> SVGAnimatedTransformList;
+    typedef DeprecatedSVGAnimatedTemplate<SVGAngle> SVGAnimatedAngle;
+    typedef DeprecatedSVGAnimatedTemplate<bool> SVGAnimatedBoolean;
+    typedef DeprecatedSVGAnimatedTemplate<int> SVGAnimatedEnumeration;
+    typedef DeprecatedSVGAnimatedTemplate<long> SVGAnimatedInteger;
+    typedef DeprecatedSVGAnimatedTemplate<SVGLength> SVGAnimatedLength;
+    typedef DeprecatedSVGAnimatedTemplate<SVGLengthList*> SVGAnimatedLengthList;
+    typedef DeprecatedSVGAnimatedTemplate<float> SVGAnimatedNumber;
+    typedef DeprecatedSVGAnimatedTemplate<SVGNumberList*> SVGAnimatedNumberList; 
+    typedef DeprecatedSVGAnimatedTemplate<SVGPreserveAspectRatio> SVGAnimatedPreserveAspectRatio;
+    typedef DeprecatedSVGAnimatedTemplate<FloatRect> SVGAnimatedRect;
+    typedef DeprecatedSVGAnimatedTemplate<String> SVGAnimatedString;
+    typedef DeprecatedSVGAnimatedTemplate<SVGTransformList*> SVGAnimatedTransformList;
 
 }
 
diff --git a/WebCore/svg/SVGAElement.cpp b/WebCore/svg/SVGAElement.cpp
index d711a52..56078ad 100644
--- a/WebCore/svg/SVGAElement.cpp
+++ b/WebCore/svg/SVGAElement.cpp
@@ -27,7 +27,6 @@
 
 #include "Attr.h"
 #include "Attribute.h"
-#include "CSSHelper.h"
 #include "Document.h"
 #include "EventHandler.h"
 #include "EventNames.h"
@@ -35,6 +34,7 @@
 #include "FrameLoader.h"
 #include "FrameLoaderTypes.h"
 #include "HTMLAnchorElement.h"
+#include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "PlatformMouseEvent.h"
@@ -137,7 +137,7 @@ void SVGAElement::defaultEventHandler(Event* event)
         }
 
         if (isLinkClick(event)) {
-            String url = deprecatedParseURL(href());
+            String url = stripLeadingAndTrailingHTMLSpaces(href());
 
 #if ENABLE(SVG_ANIMATION)
             if (url[0] == '#') {
diff --git a/WebCore/svg/SVGAnimateMotionElement.cpp b/WebCore/svg/SVGAnimateMotionElement.cpp
index b50a993..26151ed 100644
--- a/WebCore/svg/SVGAnimateMotionElement.cpp
+++ b/WebCore/svg/SVGAnimateMotionElement.cpp
@@ -112,9 +112,10 @@ Path SVGAnimateMotionElement::animationPath() const
         if (child->hasTagName(SVGNames::mpathTag)) {
             SVGMPathElement* mPath = static_cast<SVGMPathElement*>(child);
             SVGPathElement* pathElement = mPath->pathElement();
+            Path path;
             if (pathElement)
-                return pathElement->toPathData();
-            return Path();
+                pathElement->toPathData(path);
+            return path;
         }
     }
     if (hasAttribute(SVGNames::pathAttr))
diff --git a/WebCore/svg/SVGCircleElement.cpp b/WebCore/svg/SVGCircleElement.cpp
index b5a5184..eb38b87 100644
--- a/WebCore/svg/SVGCircleElement.cpp
+++ b/WebCore/svg/SVGCircleElement.cpp
@@ -25,7 +25,7 @@
 
 #include "Attribute.h"
 #include "FloatPoint.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -77,7 +77,7 @@ void SVGCircleElement::svgAttributeChanged(const QualifiedName& attrName)
     if (isLengthAttribute)
         updateRelativeLengthsInformation();
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
@@ -121,9 +121,16 @@ void SVGCircleElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeExternalResourcesRequired();
 }
 
-Path SVGCircleElement::toPathData() const
+void SVGCircleElement::toPathData(Path& path) const
 {
-    return Path::createCircle(FloatPoint(cx().value(this), cy().value(this)), r().value(this));
+    ASSERT(path.isEmpty());
+
+    float radius = r().value(this);
+
+    if (radius <= 0)
+        return;
+
+    path.addEllipse(FloatRect(cx().value(this) - radius, cy().value(this) - radius, radius * 2, radius * 2));
 }
 
 bool SVGCircleElement::selfHasRelativeLengths() const
diff --git a/WebCore/svg/SVGCircleElement.h b/WebCore/svg/SVGCircleElement.h
index dd11792..4eb9262 100644
--- a/WebCore/svg/SVGCircleElement.h
+++ b/WebCore/svg/SVGCircleElement.h
@@ -45,7 +45,7 @@ namespace WebCore {
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
 
         virtual bool selfHasRelativeLengths() const;
 
diff --git a/WebCore/svg/SVGElement.cpp b/WebCore/svg/SVGElement.cpp
index 1b19f25..ea79e78 100644
--- a/WebCore/svg/SVGElement.cpp
+++ b/WebCore/svg/SVGElement.cpp
@@ -116,7 +116,7 @@ void SVGElement::setXmlbase(const String& value, ExceptionCode&)
 
 SVGSVGElement* SVGElement::ownerSVGElement() const
 {
-    Node* n = isShadowNode() ? const_cast<SVGElement*>(this)->shadowParentNode() : parentNode();
+    ContainerNode* n = isShadowNode() ? const_cast<SVGElement*>(this)->shadowParentNode() : parentNode();
     while (n) {
         if (n->hasTagName(SVGNames::svgTag))
             return static_cast<SVGSVGElement*>(n);
@@ -131,7 +131,7 @@ SVGElement* SVGElement::viewportElement() const
 {
     // This function needs shadow tree support - as RenderSVGContainer uses this function
     // to determine the "overflow" property. <use> on <symbol> wouldn't work otherwhise.
-    Node* n = isShadowNode() ? const_cast<SVGElement*>(this)->shadowParentNode() : parentNode();
+    ContainerNode* n = isShadowNode() ? const_cast<SVGElement*>(this)->shadowParentNode() : parentNode();
     while (n) {
         if (n->hasTagName(SVGNames::svgTag) || n->hasTagName(SVGNames::imageTag) || n->hasTagName(SVGNames::symbolTag))
             return static_cast<SVGElement*>(n);
diff --git a/WebCore/svg/SVGElement.h b/WebCore/svg/SVGElement.h
index fb28279..5681284 100644
--- a/WebCore/svg/SVGElement.h
+++ b/WebCore/svg/SVGElement.h
@@ -110,7 +110,7 @@ namespace WebCore {
 }
 
 // This file needs to be included after the SVGElement declaration
-#include "SVGAnimatedProperty.h"
+#include "DeprecatedSVGAnimatedProperty.h" // NOLINT
 
 #endif
 #endif
diff --git a/WebCore/svg/SVGEllipseElement.cpp b/WebCore/svg/SVGEllipseElement.cpp
index 5e18910..7615a24 100644
--- a/WebCore/svg/SVGEllipseElement.cpp
+++ b/WebCore/svg/SVGEllipseElement.cpp
@@ -25,7 +25,7 @@
 
 #include "Attribute.h"
 #include "FloatPoint.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -83,7 +83,7 @@ void SVGEllipseElement::svgAttributeChanged(const QualifiedName& attrName)
     if (isLengthAttribute)
         updateRelativeLengthsInformation();
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
@@ -130,10 +130,19 @@ void SVGEllipseElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeExternalResourcesRequired();
 }
 
-Path SVGEllipseElement::toPathData() const
+void SVGEllipseElement::toPathData(Path& path) const
 {
-    return Path::createEllipse(FloatPoint(cx().value(this), cy().value(this)),
-                                          rx().value(this), ry().value(this));
+    ASSERT(path.isEmpty());
+
+    float radiusX = rx().value(this);
+    if (radiusX <= 0)
+        return;
+
+    float radiusY = ry().value(this);
+    if (radiusY <= 0)
+        return;
+
+    path.addEllipse(FloatRect(cx().value(this) - radiusX, cy().value(this) - radiusY, radiusX * 2, radiusY * 2));
 }
  
 bool SVGEllipseElement::selfHasRelativeLengths() const
diff --git a/WebCore/svg/SVGEllipseElement.h b/WebCore/svg/SVGEllipseElement.h
index bee815c..cad329e 100644
--- a/WebCore/svg/SVGEllipseElement.h
+++ b/WebCore/svg/SVGEllipseElement.h
@@ -45,7 +45,7 @@ namespace WebCore {
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
 
         virtual bool selfHasRelativeLengths() const;
 
diff --git a/WebCore/svg/SVGExternalResourcesRequired.h b/WebCore/svg/SVGExternalResourcesRequired.h
index 6322538..5f0d8e9 100644
--- a/WebCore/svg/SVGExternalResourcesRequired.h
+++ b/WebCore/svg/SVGExternalResourcesRequired.h
@@ -42,7 +42,7 @@ namespace WebCore {
         bool isKnownAttribute(const QualifiedName&);
 
     protected:
-        virtual void setExternalResourcesRequiredBaseValue(SVGAnimatedPropertyTraits<bool>::PassType) = 0;
+        virtual void setExternalResourcesRequiredBaseValue(DeprecatedSVGAnimatedPropertyTraits<bool>::PassType) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGFEColorMatrixElement.cpp b/WebCore/svg/SVGFEColorMatrixElement.cpp
index f14b4e7..83d112c 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.cpp
+++ b/WebCore/svg/SVGFEColorMatrixElement.cpp
@@ -62,6 +62,16 @@ void SVGFEColorMatrixElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEColorMatrixElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::typeAttr
+        || attrName == SVGNames::inAttr
+        || attrName == SVGNames::valuesAttr)
+        invalidate();
+}
+
 void SVGFEColorMatrixElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
diff --git a/WebCore/svg/SVGFEColorMatrixElement.h b/WebCore/svg/SVGFEColorMatrixElement.h
index 873d530..5d626a2 100644
--- a/WebCore/svg/SVGFEColorMatrixElement.h
+++ b/WebCore/svg/SVGFEColorMatrixElement.h
@@ -36,6 +36,7 @@ private:
     SVGFEColorMatrixElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*);
 
diff --git a/WebCore/svg/SVGFECompositeElement.cpp b/WebCore/svg/SVGFECompositeElement.cpp
index b6f1002..6d7e7b2 100644
--- a/WebCore/svg/SVGFECompositeElement.cpp
+++ b/WebCore/svg/SVGFECompositeElement.cpp
@@ -71,6 +71,20 @@ void SVGFECompositeElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFECompositeElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::inAttr
+        || attrName == SVGNames::in2Attr
+        || attrName == SVGNames::operatorAttr
+        || attrName == SVGNames::k1Attr
+        || attrName == SVGNames::k2Attr
+        || attrName == SVGNames::k3Attr
+        || attrName == SVGNames::k4Attr)
+        invalidate();
+}
+
 void SVGFECompositeElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
diff --git a/WebCore/svg/SVGFECompositeElement.h b/WebCore/svg/SVGFECompositeElement.h
index 19683de..6d47cac 100644
--- a/WebCore/svg/SVGFECompositeElement.h
+++ b/WebCore/svg/SVGFECompositeElement.h
@@ -35,6 +35,7 @@ private:
     SVGFECompositeElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*);
 
diff --git a/WebCore/svg/SVGFEConvolveMatrixElement.cpp b/WebCore/svg/SVGFEConvolveMatrixElement.cpp
index db2fad5..d7f14a2 100644
--- a/WebCore/svg/SVGFEConvolveMatrixElement.cpp
+++ b/WebCore/svg/SVGFEConvolveMatrixElement.cpp
@@ -93,14 +93,35 @@ void SVGFEConvolveMatrixElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
-void SVGFEConvolveMatrixElement::setOrder(float, float)
+void SVGFEConvolveMatrixElement::setOrder(float x, float y)
 {
-    // FIXME: Needs an implementation.
+    setOrderXBaseValue(x);
+    setOrderYBaseValue(y);
+    invalidate();
 }
 
-void SVGFEConvolveMatrixElement::setKernelUnitLength(float, float)
+void SVGFEConvolveMatrixElement::setKernelUnitLength(float x, float y)
 {
-    // FIXME: Needs an implementation.
+    setKernelUnitLengthXBaseValue(x);
+    setKernelUnitLengthYBaseValue(y);
+    invalidate();
+}
+
+void SVGFEConvolveMatrixElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::inAttr
+        || attrName == SVGNames::orderAttr
+        || attrName == SVGNames::edgeModeAttr
+        || attrName == SVGNames::kernelMatrixAttr
+        || attrName == SVGNames::divisorAttr
+        || attrName == SVGNames::biasAttr
+        || attrName == SVGNames::targetXAttr
+        || attrName == SVGNames::targetYAttr
+        || attrName == SVGNames::kernelUnitLengthAttr
+        || attrName == SVGNames::preserveAlphaAttr)
+        invalidate();
 }
 
 PassRefPtr<FilterEffect> SVGFEConvolveMatrixElement::build(SVGFilterBuilder* filterBuilder)
diff --git a/WebCore/svg/SVGFEConvolveMatrixElement.h b/WebCore/svg/SVGFEConvolveMatrixElement.h
index b1fe7e2..5c4e8c4 100644
--- a/WebCore/svg/SVGFEConvolveMatrixElement.h
+++ b/WebCore/svg/SVGFEConvolveMatrixElement.h
@@ -38,6 +38,7 @@ private:
     SVGFEConvolveMatrixElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*);
 
     DECLARE_ANIMATED_PROPERTY(SVGFEConvolveMatrixElement, SVGNames::inAttr, String, In1, in1)
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.cpp b/WebCore/svg/SVGFEGaussianBlurElement.cpp
index 3dfd51c..a9fef61 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.cpp
+++ b/WebCore/svg/SVGFEGaussianBlurElement.cpp
@@ -42,9 +42,11 @@ PassRefPtr<SVGFEGaussianBlurElement> SVGFEGaussianBlurElement::create(const Qual
     return adoptRef(new SVGFEGaussianBlurElement(tagName, document));
 }
 
-void SVGFEGaussianBlurElement::setStdDeviation(float, float)
+void SVGFEGaussianBlurElement::setStdDeviation(float x, float y)
 {
-    // FIXME: Needs an implementation.
+    setStdDeviationXBaseValue(x);
+    setStdDeviationYBaseValue(y);
+    invalidate();
 }
 
 void SVGFEGaussianBlurElement::parseMappedAttribute(Attribute* attr)
@@ -62,6 +64,15 @@ void SVGFEGaussianBlurElement::parseMappedAttribute(Attribute* attr)
         SVGFilterPrimitiveStandardAttributes::parseMappedAttribute(attr);
 }
 
+void SVGFEGaussianBlurElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGFilterPrimitiveStandardAttributes::svgAttributeChanged(attrName);
+
+    if (attrName == SVGNames::inAttr
+        || attrName == SVGNames::stdDeviationAttr)
+        invalidate();
+}
+
 void SVGFEGaussianBlurElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGFilterPrimitiveStandardAttributes::synchronizeProperty(attrName);
diff --git a/WebCore/svg/SVGFEGaussianBlurElement.h b/WebCore/svg/SVGFEGaussianBlurElement.h
index 36b7383..90f956c 100644
--- a/WebCore/svg/SVGFEGaussianBlurElement.h
+++ b/WebCore/svg/SVGFEGaussianBlurElement.h
@@ -40,6 +40,7 @@ private:
     SVGFEGaussianBlurElement(const QualifiedName&, Document*);
 
     virtual void parseMappedAttribute(Attribute*);
+    virtual void svgAttributeChanged(const QualifiedName&);
     virtual void synchronizeProperty(const QualifiedName&);
     virtual PassRefPtr<FilterEffect> build(SVGFilterBuilder*);
 
diff --git a/WebCore/svg/SVGFEImageElement.cpp b/WebCore/svg/SVGFEImageElement.cpp
index b9d1a3d..0ea7933 100644
--- a/WebCore/svg/SVGFEImageElement.cpp
+++ b/WebCore/svg/SVGFEImageElement.cpp
@@ -27,6 +27,7 @@
 #include "Attr.h"
 #include "CachedImage.h"
 #include "CachedResourceLoader.h"
+#include "ColorSpace.h"
 #include "Document.h"
 #include "RenderObject.h"
 #include "RenderSVGResource.h"
@@ -134,7 +135,7 @@ PassRefPtr<FilterEffect> SVGFEImageElement::build(SVGFilterBuilder*)
             return 0;
 
         IntRect targetRect = enclosingIntRect(renderer->objectBoundingBox());
-        m_targetImage = ImageBuffer::create(targetRect.size(), LinearRGB);
+        m_targetImage = ImageBuffer::create(targetRect.size(), ColorSpaceLinearRGB);
 
         AffineTransform contentTransformation;
         SVGImageBufferTools::renderSubtreeToImageBuffer(m_targetImage.get(), renderer, contentTransformation);
diff --git a/WebCore/svg/SVGFELightElement.cpp b/WebCore/svg/SVGFELightElement.cpp
index 61d7df0..315aa29 100644
--- a/WebCore/svg/SVGFELightElement.cpp
+++ b/WebCore/svg/SVGFELightElement.cpp
@@ -78,7 +78,7 @@ void SVGFELightElement::svgAttributeChanged(const QualifiedName& attrName)
         || attrName == SVGNames::pointsAtZAttr
         || attrName == SVGNames::specularExponentAttr
         || attrName == SVGNames::limitingConeAngleAttr) {
-        if (Node* parentNode = parent()) {
+        if (ContainerNode* parentNode = parent()) {
             RenderObject* renderer = parentNode->renderer();
             if (renderer && renderer->isSVGResourceFilterPrimitive())
                 RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
@@ -131,7 +131,7 @@ void SVGFELightElement::childrenChanged(bool changedByParser, Node* beforeChange
     SVGElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
 
     if (!changedByParser) {
-        if (Node* parentNode = parent()) {
+        if (ContainerNode* parentNode = parent()) {
             RenderObject* renderer = parentNode->renderer();
             if (renderer && renderer->isSVGResourceFilterPrimitive())
                 RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
diff --git a/WebCore/svg/SVGFEMergeNodeElement.cpp b/WebCore/svg/SVGFEMergeNodeElement.cpp
index 4bd5ac5..ee1ac3a 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.cpp
+++ b/WebCore/svg/SVGFEMergeNodeElement.cpp
@@ -24,6 +24,8 @@
 #include "SVGFEMergeNodeElement.h"
 
 #include "Attribute.h"
+#include "RenderSVGResource.h"
+#include "SVGFilterElement.h"
 
 namespace WebCore {
 
@@ -46,6 +48,24 @@ void SVGFEMergeNodeElement::parseMappedAttribute(Attribute* attr)
         SVGElement::parseMappedAttribute(attr);
 }
 
+void SVGFEMergeNodeElement::svgAttributeChanged(const QualifiedName& attrName)
+{
+    SVGElement::svgAttributeChanged(attrName);
+
+    if (attrName != SVGNames::inAttr)
+        return;
+
+    ContainerNode* parentNode = parent();
+    if (!parentNode)
+        return;
+
+    RenderObject* renderer = parentNode->renderer();
+    if (!renderer || !renderer->isSVGResourceFilterPrimitive())
+        return;
+    
+    RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
+}
+
 void SVGFEMergeNodeElement::synchronizeProperty(const QualifiedName& attrName)
 {
     SVGElement::synchronizeProperty(attrName);
diff --git a/WebCore/svg/SVGFEMergeNodeElement.h b/WebCore/svg/SVGFEMergeNodeElement.h
index 65c5d3d..89506dc 100644
--- a/WebCore/svg/SVGFEMergeNodeElement.h
+++ b/WebCore/svg/SVGFEMergeNodeElement.h
@@ -35,6 +35,7 @@ namespace WebCore {
         SVGFEMergeNodeElement(const QualifiedName&, Document*);
 
         virtual void parseMappedAttribute(Attribute*);
+        virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
         DECLARE_ANIMATED_PROPERTY(SVGFEMergeNodeElement, SVGNames::inAttr, String, In1, in1)
diff --git a/WebCore/svg/SVGFitToViewBox.h b/WebCore/svg/SVGFitToViewBox.h
index d6551f5..ecc89bb 100644
--- a/WebCore/svg/SVGFitToViewBox.h
+++ b/WebCore/svg/SVGFitToViewBox.h
@@ -39,8 +39,8 @@ public:
     bool parseMappedAttribute(Document*, Attribute*);
     bool isKnownAttribute(const QualifiedName&);
 
-    virtual void setViewBoxBaseValue(SVGAnimatedPropertyTraits<FloatRect>::PassType) = 0;
-    virtual void setPreserveAspectRatioBaseValue(SVGAnimatedPropertyTraits<SVGPreserveAspectRatio>::PassType) = 0;
+    virtual void setViewBoxBaseValue(DeprecatedSVGAnimatedPropertyTraits<FloatRect>::PassType) = 0;
+    virtual void setPreserveAspectRatioBaseValue(DeprecatedSVGAnimatedPropertyTraits<SVGPreserveAspectRatio>::PassType) = 0;
 
 private:
     bool parseViewBox(Document*, const String&, FloatRect&);
diff --git a/WebCore/svg/SVGFontFaceFormatElement.cpp b/WebCore/svg/SVGFontFaceFormatElement.cpp
index e3182c4..939b062 100644
--- a/WebCore/svg/SVGFontFaceFormatElement.cpp
+++ b/WebCore/svg/SVGFontFaceFormatElement.cpp
@@ -46,7 +46,7 @@ void SVGFontFaceFormatElement::childrenChanged(bool changedByParser, Node* befor
     if (!parentNode() || !parentNode()->hasTagName(font_face_uriTag))
         return;
     
-    Node* ancestor = parentNode()->parentNode();
+    ContainerNode* ancestor = parentNode()->parentNode();
     if (!ancestor || !ancestor->hasTagName(font_face_srcTag))
         return;
     
diff --git a/WebCore/svg/SVGFontFaceUriElement.cpp b/WebCore/svg/SVGFontFaceUriElement.cpp
index 3ecba16..58a22c7 100644
--- a/WebCore/svg/SVGFontFaceUriElement.cpp
+++ b/WebCore/svg/SVGFontFaceUriElement.cpp
@@ -76,9 +76,9 @@ void SVGFontFaceUriElement::childrenChanged(bool changedByParser, Node* beforeCh
     if (!parentNode() || !parentNode()->hasTagName(font_face_srcTag))
         return;
     
-    Node* grandParent = parentNode()->parentNode();
-    if (grandParent && grandParent->hasTagName(font_faceTag))
-        static_cast<SVGFontFaceElement*>(grandParent)->rebuildFontFace();
+    ContainerNode* grandparent = parentNode()->parentNode();
+    if (grandparent && grandparent->hasTagName(font_faceTag))
+        static_cast<SVGFontFaceElement*>(grandparent)->rebuildFontFace();
 }
 
 void SVGFontFaceUriElement::insertedIntoDocument()
diff --git a/WebCore/svg/SVGGlyphElement.cpp b/WebCore/svg/SVGGlyphElement.cpp
index 8ded0fc..baa9966 100644
--- a/WebCore/svg/SVGGlyphElement.cpp
+++ b/WebCore/svg/SVGGlyphElement.cpp
@@ -49,7 +49,7 @@ PassRefPtr<SVGGlyphElement> SVGGlyphElement::create(const QualifiedName& tagName
 
 void SVGGlyphElement::invalidateGlyphCache()
 {
-    Node* fontNode = parentNode();
+    ContainerNode* fontNode = parentNode();
     if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
diff --git a/WebCore/svg/SVGGlyphElement.h b/WebCore/svg/SVGGlyphElement.h
index a7dd570..7dc7430 100644
--- a/WebCore/svg/SVGGlyphElement.h
+++ b/WebCore/svg/SVGGlyphElement.h
@@ -72,16 +72,15 @@ namespace WebCore {
 
         bool operator==(const SVGGlyphIdentifier& other) const
         {
-            return isValid == other.isValid &&
-                   orientation == other.orientation &&
-                   arabicForm == other.arabicForm &&
-                   glyphName == other.glyphName &&
-                   horizontalAdvanceX == other.horizontalAdvanceX &&
-                   verticalOriginX == other.verticalOriginX &&
-                   verticalOriginY == other.verticalOriginY &&
-                   verticalAdvanceY == other.verticalAdvanceY &&
-                   pathData.debugString() == other.pathData.debugString() &&
-                   languages == other.languages;
+            return isValid == other.isValid
+                && orientation == other.orientation
+                && arabicForm == other.arabicForm
+                && glyphName == other.glyphName
+                && horizontalAdvanceX == other.horizontalAdvanceX
+                && verticalOriginX == other.verticalOriginX
+                && verticalOriginY == other.verticalOriginY
+                && verticalAdvanceY == other.verticalAdvanceY
+                && languages == other.languages;
         }
 
         bool isValid : 1;
diff --git a/WebCore/svg/SVGGradientElement.cpp b/WebCore/svg/SVGGradientElement.cpp
index 523e4df..ca61088 100644
--- a/WebCore/svg/SVGGradientElement.cpp
+++ b/WebCore/svg/SVGGradientElement.cpp
@@ -26,7 +26,7 @@
 
 #include "Attribute.h"
 #include "CSSStyleSelector.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGHiddenContainer.h"
 #include "RenderSVGResourceLinearGradient.h"
 #include "RenderSVGResourceRadialGradient.h"
diff --git a/WebCore/svg/SVGHKernElement.cpp b/WebCore/svg/SVGHKernElement.cpp
index a432daa..7f83241 100644
--- a/WebCore/svg/SVGHKernElement.cpp
+++ b/WebCore/svg/SVGHKernElement.cpp
@@ -47,7 +47,7 @@ PassRefPtr<SVGHKernElement> SVGHKernElement::create(const QualifiedName& tagName
 
 void SVGHKernElement::insertedIntoDocument()
 {
-    Node* fontNode = parentNode();
+    ContainerNode* fontNode = parentNode();
     if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
@@ -56,7 +56,7 @@ void SVGHKernElement::insertedIntoDocument()
 
 void SVGHKernElement::removedFromDocument()
 {
-    Node* fontNode = parentNode();
+    ContainerNode* fontNode = parentNode();
     if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
diff --git a/WebCore/svg/SVGImageElement.cpp b/WebCore/svg/SVGImageElement.cpp
index f6fa013..fcfa54f 100644
--- a/WebCore/svg/SVGImageElement.cpp
+++ b/WebCore/svg/SVGImageElement.cpp
@@ -108,8 +108,13 @@ void SVGImageElement::svgAttributeChanged(const QualifiedName& attrName)
         return;
     }
 
-    if (isLengthAttribute
-        || attrName == SVGNames::preserveAspectRatioAttr
+    if (isLengthAttribute) {
+        renderer->updateFromElement();
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer, false);
+        return;
+    }
+
+    if (attrName == SVGNames::preserveAspectRatioAttr
         || SVGTests::isKnownAttribute(attrName)
         || SVGLangSpace::isKnownAttribute(attrName)
         || SVGExternalResourcesRequired::isKnownAttribute(attrName))
diff --git a/WebCore/svg/SVGImageLoader.cpp b/WebCore/svg/SVGImageLoader.cpp
index 2079f74..8f1c1b5 100644
--- a/WebCore/svg/SVGImageLoader.cpp
+++ b/WebCore/svg/SVGImageLoader.cpp
@@ -25,6 +25,7 @@
 
 #include "Event.h"
 #include "EventNames.h"
+#include "HTMLParserIdioms.h"
 #include "SVGImageElement.h"
 #include "RenderImage.h"
 
@@ -48,7 +49,7 @@ void SVGImageLoader::dispatchLoadEvent()
 
 String SVGImageLoader::sourceURI(const AtomicString& attr) const
 {
-    return KURL(element()->baseURI(), deprecatedParseURL(attr)).string();
+    return KURL(element()->baseURI(), stripLeadingAndTrailingHTMLSpaces(attr)).string();
 }
 
 }
diff --git a/WebCore/svg/SVGLineElement.cpp b/WebCore/svg/SVGLineElement.cpp
index bd15890..4ee5f0d 100644
--- a/WebCore/svg/SVGLineElement.cpp
+++ b/WebCore/svg/SVGLineElement.cpp
@@ -25,7 +25,7 @@
 
 #include "Attribute.h"
 #include "FloatPoint.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -79,7 +79,7 @@ void SVGLineElement::svgAttributeChanged(const QualifiedName& attrName)
     if (isLengthAttribute)
         updateRelativeLengthsInformation();
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
@@ -126,10 +126,12 @@ void SVGLineElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeExternalResourcesRequired();
 }
 
-Path SVGLineElement::toPathData() const
+void SVGLineElement::toPathData(Path& path) const
 {
-    return Path::createLine(FloatPoint(x1().value(this), y1().value(this)),
-                            FloatPoint(x2().value(this), y2().value(this)));
+    ASSERT(path.isEmpty());
+
+    path.moveTo(FloatPoint(x1().value(this), y1().value(this)));
+    path.addLineTo(FloatPoint(x2().value(this), y2().value(this)));
 }
 
 bool SVGLineElement::selfHasRelativeLengths() const
diff --git a/WebCore/svg/SVGLineElement.h b/WebCore/svg/SVGLineElement.h
index 21007f0..55a268c 100644
--- a/WebCore/svg/SVGLineElement.h
+++ b/WebCore/svg/SVGLineElement.h
@@ -47,7 +47,7 @@ namespace WebCore {
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
 
         virtual bool supportsMarkers() const { return true; }
 
diff --git a/WebCore/svg/SVGLinearGradientElement.cpp b/WebCore/svg/SVGLinearGradientElement.cpp
index ec351d7..840a31e 100644
--- a/WebCore/svg/SVGLinearGradientElement.cpp
+++ b/WebCore/svg/SVGLinearGradientElement.cpp
@@ -113,9 +113,8 @@ RenderObject* SVGLinearGradientElement::createRenderer(RenderArena* arena, Rende
     return new (arena) RenderSVGResourceLinearGradient(this);
 }
 
-LinearGradientAttributes SVGLinearGradientElement::collectGradientProperties()
+void SVGLinearGradientElement::collectGradientAttributes(LinearGradientAttributes& attributes)
 {
-    LinearGradientAttributes attributes;
     HashSet<SVGGradientElement*> processedGradients;
 
     bool isLinear = true;
@@ -170,8 +169,6 @@ LinearGradientAttributes SVGLinearGradientElement::collectGradientProperties()
         } else
             current = 0;
     }
-
-    return attributes;
 }
 
 void SVGLinearGradientElement::calculateStartEndPoints(const LinearGradientAttributes& attributes, FloatPoint& startPoint, FloatPoint& endPoint)
diff --git a/WebCore/svg/SVGLinearGradientElement.h b/WebCore/svg/SVGLinearGradientElement.h
index dec912f..86bebf3 100644
--- a/WebCore/svg/SVGLinearGradientElement.h
+++ b/WebCore/svg/SVGLinearGradientElement.h
@@ -33,7 +33,7 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGLinearGradientElement> create(const QualifiedName&, Document*);
 
-        LinearGradientAttributes collectGradientProperties();
+        void collectGradientAttributes(LinearGradientAttributes&);
         void calculateStartEndPoints(const LinearGradientAttributes&, FloatPoint& startPoint, FloatPoint& endPoint);
 
     private:
diff --git a/WebCore/svg/SVGLocatable.cpp b/WebCore/svg/SVGLocatable.cpp
index 3311a5a..9a823ff 100644
--- a/WebCore/svg/SVGLocatable.cpp
+++ b/WebCore/svg/SVGLocatable.cpp
@@ -44,7 +44,7 @@ static bool isViewportElement(Node* node)
 SVGElement* SVGLocatable::nearestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
-    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
         if (isViewportElement(n))
             return static_cast<SVGElement*>(n);
     }
@@ -56,7 +56,7 @@ SVGElement* SVGLocatable::farthestViewportElement(const SVGElement* element)
 {
     ASSERT(element);
     SVGElement* farthest = 0;
-    for (Node* n = element->parentNode(); n && !n->isDocumentNode(); n = n->parentNode()) {
+    for (ContainerNode* n = element->parentNode(); n; n = n->parentNode()) {
         if (isViewportElement(n))
             farthest = static_cast<SVGElement*>(n);
     }
diff --git a/WebCore/svg/SVGPathElement.cpp b/WebCore/svg/SVGPathElement.cpp
index 3ed85a3..920e947 100644
--- a/WebCore/svg/SVGPathElement.cpp
+++ b/WebCore/svg/SVGPathElement.cpp
@@ -24,7 +24,7 @@
 #include "SVGPathElement.h"
 
 #include "Attribute.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGNames.h"
 #include "SVGPathParserFactory.h"
@@ -57,14 +57,18 @@ PassRefPtr<SVGPathElement> SVGPathElement::create(const QualifiedName& tagName,
 float SVGPathElement::getTotalLength()
 {
     // FIXME: this may wish to use the pathSegList instead of the pathdata if that's cheaper to build (or cached)
-    return toPathData().length();
+    Path path;
+    toPathData(path);
+    return path.length();
 }
 
 FloatPoint SVGPathElement::getPointAtLength(float length)
 {
     // FIXME: this may wish to use the pathSegList instead of the pathdata if that's cheaper to build (or cached)
     bool ok = false;
-    return toPathData().pointAtLength(length, ok);
+    Path path;
+    toPathData(path);
+    return path.pointAtLength(length, ok);
 }
 
 unsigned long SVGPathElement::getPathSegAtLength(float length)
@@ -197,7 +201,7 @@ void SVGPathElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGStyledTransformableElement::svgAttributeChanged(attrName);
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
@@ -262,12 +266,12 @@ SVGPathSegList* SVGPathElement::animatedNormalizedPathSegList() const
     return 0;
 }
 
-Path SVGPathElement::toPathData() const
+void SVGPathElement::toPathData(Path& path) const
 {
-    Path result;
+    ASSERT(path.isEmpty());
+
     SVGPathParserFactory* factory = SVGPathParserFactory::self();
-    factory->buildPathFromSVGPathSegList(pathSegList(), result);
-    return result;
+    factory->buildPathFromSVGPathSegList(pathSegList(), path);
 }
 
 }
diff --git a/WebCore/svg/SVGPathElement.h b/WebCore/svg/SVGPathElement.h
index cc4e7bd..394983d 100644
--- a/WebCore/svg/SVGPathElement.h
+++ b/WebCore/svg/SVGPathElement.h
@@ -89,7 +89,7 @@ namespace WebCore {
         virtual SVGPathSegList* animatedPathSegList() const;
         virtual SVGPathSegList* animatedNormalizedPathSegList() const;
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
 
     private:
         SVGPathElement(const QualifiedName&, Document*);
diff --git a/WebCore/svg/SVGPathParserFactory.cpp b/WebCore/svg/SVGPathParserFactory.cpp
index b251ec4..e707c20 100644
--- a/WebCore/svg/SVGPathParserFactory.cpp
+++ b/WebCore/svg/SVGPathParserFactory.cpp
@@ -33,7 +33,6 @@
 #include "SVGPathStringBuilder.h"
 #include "SVGPathStringSource.h"
 #include "SVGPathTraversalStateBuilder.h"
-#include "StringBuilder.h"
 
 namespace WebCore {
 
diff --git a/WebCore/svg/SVGPathStringBuilder.cpp b/WebCore/svg/SVGPathStringBuilder.cpp
index 951956d..e5f4419 100644
--- a/WebCore/svg/SVGPathStringBuilder.cpp
+++ b/WebCore/svg/SVGPathStringBuilder.cpp
@@ -24,81 +24,92 @@
 
 namespace WebCore {
 
+String SVGPathStringBuilder::result()
+{
+    unsigned size = m_stringBuilder.length();
+    if (!size)
+        return String();
+
+    // Remove trailing space.
+    m_stringBuilder.resize(size - 1);
+    return m_stringBuilder.toString();
+}
+
 void SVGPathStringBuilder::moveTo(const FloatPoint& targetPoint, bool, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("M %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("M %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("m %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("m %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::lineTo(const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("L %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("L %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("l %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("l %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::lineToHorizontal(float x, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("H %.6lg", x));
+        m_stringBuilder.append(String::format("H %.6lg ", x));
     else
-        m_stringBuilder.append(String::format("h %.6lg", x));
+        m_stringBuilder.append(String::format("h %.6lg ", x));
 }
 
 void SVGPathStringBuilder::lineToVertical(float y, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("V %.6lg", y));
+        m_stringBuilder.append(String::format("V %.6lg ", y));
     else
-        m_stringBuilder.append(String::format("v %.6lg", y));
+        m_stringBuilder.append(String::format("v %.6lg ", y));
 }
 
 void SVGPathStringBuilder::curveToCubic(const FloatPoint& point1, const FloatPoint& point2, const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("C %.6lg %.6lg %.6lg %.6lg %.6lg %.6lg", point1.x(), point1.y(), point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("C %.6lg %.6lg %.6lg %.6lg %.6lg %.6lg ", point1.x(), point1.y(), point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("c %.6lg %.6lg %.6lg %.6lg %.6lg %.6lg", point1.x(), point1.y(), point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("c %.6lg %.6lg %.6lg %.6lg %.6lg %.6lg ", point1.x(), point1.y(), point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::curveToCubicSmooth(const FloatPoint& point2, const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("S %.6lg %.6lg %.6lg %.6lg", point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("S %.6lg %.6lg %.6lg %.6lg ", point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("s %.6lg %.6lg %.6lg %.6lg", point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("s %.6lg %.6lg %.6lg %.6lg ", point2.x(), point2.y(), targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::curveToQuadratic(const FloatPoint& point1, const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("Q %.6lg %.6lg %.6lg %.6lg", point1.x(), point1.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("Q %.6lg %.6lg %.6lg %.6lg ", point1.x(), point1.y(), targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("q %.6lg %.6lg %.6lg %.6lg", point1.x(), point1.y(), targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("q %.6lg %.6lg %.6lg %.6lg ", point1.x(), point1.y(), targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::curveToQuadraticSmooth(const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("T %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("T %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("t %.6lg %.6lg", targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("t %.6lg %.6lg ", targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::arcTo(float r1, float r2, float angle, bool largeArcFlag, bool sweepFlag, const FloatPoint& targetPoint, PathCoordinateMode mode)
 {
     if (mode == AbsoluteCoordinates)
-        m_stringBuilder.append(String::format("A %.6lg %.6lg %.6lg %d %d %.6lg %.6lg", r1, r2, angle, largeArcFlag, sweepFlag, targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("A %.6lg %.6lg %.6lg %d %d %.6lg %.6lg ", r1, r2, angle, largeArcFlag, sweepFlag, targetPoint.x(), targetPoint.y()));
     else
-        m_stringBuilder.append(String::format("a %.6lg %.6lg %.6lg %d %d %.6lg %.6lg", r1, r2, angle, largeArcFlag, sweepFlag, targetPoint.x(), targetPoint.y()));
+        m_stringBuilder.append(String::format("a %.6lg %.6lg %.6lg %d %d %.6lg %.6lg ", r1, r2, angle, largeArcFlag, sweepFlag, targetPoint.x(), targetPoint.y()));
 }
 
 void SVGPathStringBuilder::closePath()
 {
-    m_stringBuilder.append("Z");
+    m_stringBuilder.append("Z ");
 }
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGPathStringBuilder.h b/WebCore/svg/SVGPathStringBuilder.h
index a51c40c..6a7e980 100644
--- a/WebCore/svg/SVGPathStringBuilder.h
+++ b/WebCore/svg/SVGPathStringBuilder.h
@@ -23,16 +23,16 @@
 #if ENABLE(SVG)
 #include "FloatPoint.h"
 #include "SVGPathConsumer.h"
-#include "StringBuilder.h"
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
 class SVGPathStringBuilder : public SVGPathConsumer {
 public:
-    String result() { return m_stringBuilder.toString(ConcatAddingSpacesBetweenIndividualStrings); }
+    String result();
 
 private:
-    virtual void cleanup() { m_stringBuilder.clear(); }
+    virtual void cleanup() { m_stringBuilder = StringBuilder(); }
     virtual void incrementPathSegmentCount() { }
     virtual bool continueConsuming() { return true; }
 
diff --git a/WebCore/svg/SVGPatternElement.cpp b/WebCore/svg/SVGPatternElement.cpp
index 6a8a108..0f3b5d4 100644
--- a/WebCore/svg/SVGPatternElement.cpp
+++ b/WebCore/svg/SVGPatternElement.cpp
@@ -200,9 +200,8 @@ RenderObject* SVGPatternElement::createRenderer(RenderArena* arena, RenderStyle*
     return new (arena) RenderSVGResourcePattern(this);
 }
 
-PatternAttributes SVGPatternElement::collectPatternProperties() const
+void SVGPatternElement::collectPatternAttributes(PatternAttributes& attributes) const
 {
-    PatternAttributes attributes;
     HashSet<const SVGPatternElement*> processedPatterns;
 
     const SVGPatternElement* current = this;
@@ -246,8 +245,6 @@ PatternAttributes SVGPatternElement::collectPatternProperties() const
         } else
             current = 0;
     }
-
-    return attributes;
 }
 
 bool SVGPatternElement::selfHasRelativeLengths() const
diff --git a/WebCore/svg/SVGPatternElement.h b/WebCore/svg/SVGPatternElement.h
index 497660a..a93c54c 100644
--- a/WebCore/svg/SVGPatternElement.h
+++ b/WebCore/svg/SVGPatternElement.h
@@ -45,7 +45,7 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGPatternElement> create(const QualifiedName&, Document*);
 
-        PatternAttributes collectPatternProperties() const;
+        void collectPatternAttributes(PatternAttributes&) const;
 
     private:
         SVGPatternElement(const QualifiedName&, Document*);
diff --git a/WebCore/svg/SVGPolyElement.cpp b/WebCore/svg/SVGPolyElement.cpp
index da8aba4..6e935f1 100644
--- a/WebCore/svg/SVGPolyElement.cpp
+++ b/WebCore/svg/SVGPolyElement.cpp
@@ -26,7 +26,7 @@
 #include "Attribute.h"
 #include "Document.h"
 #include "FloatPoint.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGNames.h"
 #include "SVGParserUtilities.h"
@@ -81,7 +81,7 @@ void SVGPolyElement::svgAttributeChanged(const QualifiedName& attrName)
     if (attrName == SVGNames::pointsAttr)
         invalidateSVGAttributes();
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
diff --git a/WebCore/svg/SVGPolygonElement.cpp b/WebCore/svg/SVGPolygonElement.cpp
index 57e2d53..38f5bce 100644
--- a/WebCore/svg/SVGPolygonElement.cpp
+++ b/WebCore/svg/SVGPolygonElement.cpp
@@ -37,22 +37,21 @@ PassRefPtr<SVGPolygonElement> SVGPolygonElement::create(const QualifiedName& tag
     return adoptRef(new SVGPolygonElement(tagName, document));
 }
 
-Path SVGPolygonElement::toPathData() const
+void SVGPolygonElement::toPathData(Path& path) const
 {
-    Path polyData;
+    ASSERT(path.isEmpty());
 
     int len = points()->numberOfItems();
     if (len < 1)
-        return polyData;
+        return;
     
     ExceptionCode ec = 0;
-    polyData.moveTo(points()->getItem(0, ec));
+    path.moveTo(points()->getItem(0, ec));
 
     for (int i = 1; i < len; ++i)
-        polyData.addLineTo(points()->getItem(i, ec));
+        path.addLineTo(points()->getItem(i, ec));
 
-    polyData.closeSubpath();
-    return polyData;
+    path.closeSubpath();
 }
 
 }
diff --git a/WebCore/svg/SVGPolygonElement.h b/WebCore/svg/SVGPolygonElement.h
index 7a5bda8..5c88d11 100644
--- a/WebCore/svg/SVGPolygonElement.h
+++ b/WebCore/svg/SVGPolygonElement.h
@@ -33,7 +33,7 @@ namespace WebCore {
     private:
         SVGPolygonElement(const QualifiedName&, Document*);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGPolylineElement.cpp b/WebCore/svg/SVGPolylineElement.cpp
index 7ec8431..c9750b2 100644
--- a/WebCore/svg/SVGPolylineElement.cpp
+++ b/WebCore/svg/SVGPolylineElement.cpp
@@ -37,21 +37,19 @@ PassRefPtr<SVGPolylineElement> SVGPolylineElement::create(const QualifiedName& t
     return adoptRef(new SVGPolylineElement(tagName, document));
 }
 
-Path SVGPolylineElement::toPathData() const
+void SVGPolylineElement::toPathData(Path& path) const
 {
-    Path polyData;
+    ASSERT(path.isEmpty());
 
     int len = points()->numberOfItems();
     if (len < 1)
-        return polyData;
+        return;
 
     ExceptionCode ec = 0;
-    polyData.moveTo(points()->getItem(0, ec));
+    path.moveTo(points()->getItem(0, ec));
 
     for (int i = 1; i < len; ++i)
-        polyData.addLineTo(points()->getItem(i, ec));
-    
-    return polyData;
+        path.addLineTo(points()->getItem(i, ec));
 }
 
 }
diff --git a/WebCore/svg/SVGPolylineElement.h b/WebCore/svg/SVGPolylineElement.h
index d3fe555..dfcfcda 100644
--- a/WebCore/svg/SVGPolylineElement.h
+++ b/WebCore/svg/SVGPolylineElement.h
@@ -33,7 +33,7 @@ namespace WebCore {
     private:
         SVGPolylineElement(const QualifiedName&, Document*);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGRadialGradientElement.cpp b/WebCore/svg/SVGRadialGradientElement.cpp
index 80aba78..584b1b6 100644
--- a/WebCore/svg/SVGRadialGradientElement.cpp
+++ b/WebCore/svg/SVGRadialGradientElement.cpp
@@ -123,9 +123,8 @@ RenderObject* SVGRadialGradientElement::createRenderer(RenderArena* arena, Rende
     return new (arena) RenderSVGResourceRadialGradient(this);
 }
 
-RadialGradientAttributes SVGRadialGradientElement::collectGradientProperties()
+void SVGRadialGradientElement::collectGradientAttributes(RadialGradientAttributes& attributes)
 {
-    RadialGradientAttributes attributes;
     HashSet<SVGGradientElement*> processedGradients;
 
     bool isRadial = true;
@@ -190,8 +189,6 @@ RadialGradientAttributes SVGRadialGradientElement::collectGradientProperties()
 
     if (!attributes.hasFy())
         attributes.setFy(attributes.cy());
-
-    return attributes;
 }
 
 void SVGRadialGradientElement::calculateFocalCenterPointsAndRadius(const RadialGradientAttributes& attributes, FloatPoint& focalPoint, FloatPoint& centerPoint, float& radius)
diff --git a/WebCore/svg/SVGRadialGradientElement.h b/WebCore/svg/SVGRadialGradientElement.h
index e528a13..61333af 100644
--- a/WebCore/svg/SVGRadialGradientElement.h
+++ b/WebCore/svg/SVGRadialGradientElement.h
@@ -33,7 +33,7 @@ namespace WebCore {
     public:
         static PassRefPtr<SVGRadialGradientElement> create(const QualifiedName&, Document*);
 
-        RadialGradientAttributes collectGradientProperties();
+        void collectGradientAttributes(RadialGradientAttributes&);
         void calculateFocalCenterPointsAndRadius(const RadialGradientAttributes&, FloatPoint& focalPoint, FloatPoint& centerPoint, float& radius);
 
     private:
diff --git a/WebCore/svg/SVGRectElement.cpp b/WebCore/svg/SVGRectElement.cpp
index 43ba888..46ed8de 100644
--- a/WebCore/svg/SVGRectElement.cpp
+++ b/WebCore/svg/SVGRectElement.cpp
@@ -24,7 +24,7 @@
 #include "SVGRectElement.h"
 
 #include "Attribute.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "RenderSVGResource.h"
 #include "SVGLength.h"
 #include "SVGNames.h"
@@ -94,7 +94,7 @@ void SVGRectElement::svgAttributeChanged(const QualifiedName& attrName)
     if (isLengthAttribute)
         updateRelativeLengthsInformation();
 
-    RenderPath* renderer = static_cast<RenderPath*>(this->renderer());
+    RenderSVGPath* renderer = static_cast<RenderSVGPath*>(this->renderer());
     if (!renderer)
         return;
 
@@ -147,19 +147,37 @@ void SVGRectElement::synchronizeProperty(const QualifiedName& attrName)
         synchronizeExternalResourcesRequired();
 }
 
-Path SVGRectElement::toPathData() const
+void SVGRectElement::toPathData(Path& path) const
 {
-    FloatRect rect(x().value(this), y().value(this), width().value(this), height().value(this));
+    ASSERT(path.isEmpty());
+
+    float widthValue = width().value(this);
+    if (widthValue <= 0)
+        return;
+
+    float heightValue = height().value(this);
+    if (heightValue <= 0)
+        return;
+
+    float xValue = x().value(this);
+    float yValue = y().value(this);
+
+    FloatRect rect(xValue, yValue, widthValue, heightValue);
 
     bool hasRx = hasAttribute(SVGNames::rxAttr);
     bool hasRy = hasAttribute(SVGNames::ryAttr);
     if (hasRx || hasRy) {
-        float _rx = hasRx ? rx().value(this) : ry().value(this);
-        float _ry = hasRy ? ry().value(this) : rx().value(this);
-        return Path::createRoundedRectangle(rect, FloatSize(_rx, _ry));
+        float rxValue = rx().value(this);
+        float ryValue = ry().value(this);
+        if (!hasRx)
+            rxValue = ryValue;
+        else if (!hasRy)
+            ryValue = rxValue;
+        path.addRoundedRect(rect, FloatSize(rxValue, ryValue));
+        return;
     }
 
-    return Path::createRectangle(rect);
+    path.addRect(rect);
 }
 
 bool SVGRectElement::selfHasRelativeLengths() const
diff --git a/WebCore/svg/SVGRectElement.h b/WebCore/svg/SVGRectElement.h
index 382078d..668366b 100644
--- a/WebCore/svg/SVGRectElement.h
+++ b/WebCore/svg/SVGRectElement.h
@@ -45,7 +45,7 @@ namespace WebCore {
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
-        virtual Path toPathData() const;
+        virtual void toPathData(Path&) const;
 
         virtual bool selfHasRelativeLengths() const;
 
diff --git a/WebCore/svg/SVGStyledElement.cpp b/WebCore/svg/SVGStyledElement.cpp
index f554846..d4fa89c 100644
--- a/WebCore/svg/SVGStyledElement.cpp
+++ b/WebCore/svg/SVGStyledElement.cpp
@@ -60,6 +60,10 @@ SVGStyledElement::SVGStyledElement(const QualifiedName& tagName, Document* docum
 {
 }
 
+SVGStyledElement::~SVGStyledElement()
+{
+}
+
 String SVGStyledElement::title() const
 {
     // According to spec, we should not return titles when hovering over <svg> elements (those 
diff --git a/WebCore/svg/SVGStyledElement.h b/WebCore/svg/SVGStyledElement.h
index 3482a4f..5e996b3 100644
--- a/WebCore/svg/SVGStyledElement.h
+++ b/WebCore/svg/SVGStyledElement.h
@@ -35,6 +35,8 @@ namespace WebCore {
     class SVGStyledElement : public SVGElement,
                              public SVGStylable {
     public:
+        virtual ~SVGStyledElement();
+
         virtual String title() const;
 
         bool hasRelativeLengths() const { return !m_elementsWithRelativeLengths.isEmpty(); }
diff --git a/WebCore/svg/SVGStyledLocatableElement.cpp b/WebCore/svg/SVGStyledLocatableElement.cpp
index d22e708..f29121b 100644
--- a/WebCore/svg/SVGStyledLocatableElement.cpp
+++ b/WebCore/svg/SVGStyledLocatableElement.cpp
@@ -24,7 +24,6 @@
 #include "SVGStyledLocatableElement.h"
 
 #include "AffineTransform.h"
-#include "RenderPath.h"
 #include "SVGElement.h"
 #include "SVGSVGElement.h"
 
diff --git a/WebCore/svg/SVGStyledTransformableElement.cpp b/WebCore/svg/SVGStyledTransformableElement.cpp
index af10ed7..9b34203 100644
--- a/WebCore/svg/SVGStyledTransformableElement.cpp
+++ b/WebCore/svg/SVGStyledTransformableElement.cpp
@@ -25,7 +25,7 @@
 
 #include "AffineTransform.h"
 #include "Attr.h"
-#include "RenderPath.h"
+#include "RenderSVGPath.h"
 #include "SVGDocument.h"
 #include "SVGStyledElement.h"
 #include "SVGTransformList.h"
@@ -38,6 +38,10 @@ SVGStyledTransformableElement::SVGStyledTransformableElement(const QualifiedName
 {
 }
 
+SVGStyledTransformableElement::~SVGStyledTransformableElement()
+{
+}
+
 AffineTransform SVGStyledTransformableElement::getCTM(StyleUpdateStrategy styleUpdateStrategy) const
 {
     return SVGLocatable::computeCTM(this, SVGLocatable::NearestViewportScope, styleUpdateStrategy);
@@ -104,15 +108,14 @@ FloatRect SVGStyledTransformableElement::getBBox(StyleUpdateStrategy styleUpdate
 RenderObject* SVGStyledTransformableElement::createRenderer(RenderArena* arena, RenderStyle*)
 {
     // By default, any subclass is expected to do path-based drawing
-    return new (arena) RenderPath(this);
+    return new (arena) RenderSVGPath(this);
 }
 
-Path SVGStyledTransformableElement::toClipPath() const
+void SVGStyledTransformableElement::toClipPath(Path& path) const
 {
-    Path pathData = toPathData();
+    toPathData(path);
     // FIXME: How do we know the element has done a layout?
-    pathData.transform(animatedLocalTransform());
-    return pathData;
+    path.transform(animatedLocalTransform());
 }
 
 }
diff --git a/WebCore/svg/SVGStyledTransformableElement.h b/WebCore/svg/SVGStyledTransformableElement.h
index 7668889..5349cfa 100644
--- a/WebCore/svg/SVGStyledTransformableElement.h
+++ b/WebCore/svg/SVGStyledTransformableElement.h
@@ -33,6 +33,8 @@ class AffineTransform;
 class SVGStyledTransformableElement : public SVGStyledLocatableElement,
                                       public SVGTransformable {
 public:
+    virtual ~SVGStyledTransformableElement();
+
     virtual AffineTransform getCTM(StyleUpdateStrategy = AllowStyleUpdate) const;
     virtual AffineTransform getScreenCTM(StyleUpdateStrategy = AllowStyleUpdate) const;
     virtual SVGElement* nearestViewportElement() const;
@@ -47,8 +49,8 @@ public:
     bool isKnownAttribute(const QualifiedName&);
 
     // "base class" methods for all the elements which render as paths
-    virtual Path toPathData() const { return Path(); }
-    virtual Path toClipPath() const;
+    virtual void toPathData(Path&) const { }
+    virtual void toClipPath(Path&) const;
     virtual RenderObject* createRenderer(RenderArena*, RenderStyle*);
 
 protected:
diff --git a/WebCore/svg/SVGTSpanElement.cpp b/WebCore/svg/SVGTSpanElement.cpp
index d1deb70..b88600a 100644
--- a/WebCore/svg/SVGTSpanElement.cpp
+++ b/WebCore/svg/SVGTSpanElement.cpp
@@ -1,6 +1,6 @@
 /*
  * Copyright (C) 2004, 2005, 2007 Nikolas Zimmermann <zimmermann@kde.org>
- * Copyright (C) 2004, 2005, 2006 Rob Buis <buis@kde.org>
+ * Copyright (C) 2004, 2005, 2006, 2010 Rob Buis <buis@kde.org>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -45,7 +45,10 @@ bool SVGTSpanElement::childShouldCreateRenderer(Node* child) const
 #if ENABLE(SVG_FONTS)
         || child->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::tspanTag) || child->hasTagName(SVGNames::trefTag) || child->hasTagName(SVGNames::textPathTag))
+        || child->hasTagName(SVGNames::tspanTag)
+        || child->hasTagName(SVGNames::trefTag)
+        || child->hasTagName(SVGNames::aTag)
+        || child->hasTagName(SVGNames::textPathTag))
         return true;
 
     return false;
diff --git a/WebCore/svg/SVGTextContentElement.cpp b/WebCore/svg/SVGTextContentElement.cpp
index 9d44b10..cdb9d81 100644
--- a/WebCore/svg/SVGTextContentElement.cpp
+++ b/WebCore/svg/SVGTextContentElement.cpp
@@ -26,6 +26,7 @@
 #include "CSSPropertyNames.h"
 #include "CSSValueKeywords.h"
 #include "Frame.h"
+#include "RenderObject.h"
 #include "SVGTextQuery.h"
 #include "SelectionController.h"
 #include "XMLNames.h"
@@ -215,6 +216,30 @@ bool SVGTextContentElement::selfHasRelativeLengths() const
     return textLength().isRelative();
 }
 
+SVGTextContentElement* SVGTextContentElement::elementFromRenderer(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+
+    if (!renderer->isSVGText() && !renderer->isSVGInline())
+        return 0;
+
+    Node* node = renderer->node();
+    ASSERT(node);
+    ASSERT(node->isSVGElement());
+
+    if (!node->hasTagName(SVGNames::textTag)
+        && !node->hasTagName(SVGNames::tspanTag)
+#if ENABLE(SVG_FONTS)
+        && !node->hasTagName(SVGNames::altGlyphTag)
+#endif
+        && !node->hasTagName(SVGNames::trefTag)
+        && !node->hasTagName(SVGNames::textPathTag))
+        return 0;
+
+    return static_cast<SVGTextContentElement*>(node);
+}
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGTextContentElement.h b/WebCore/svg/SVGTextContentElement.h
index cf3698b..a63e27a 100644
--- a/WebCore/svg/SVGTextContentElement.h
+++ b/WebCore/svg/SVGTextContentElement.h
@@ -54,6 +54,8 @@ namespace WebCore {
 
         bool isKnownAttribute(const QualifiedName&);
 
+        static SVGTextContentElement* elementFromRenderer(RenderObject*);
+
     protected:
         SVGTextContentElement(const QualifiedName&, Document*);
 
diff --git a/WebCore/svg/SVGTextPathElement.cpp b/WebCore/svg/SVGTextPathElement.cpp
index 82adb29..bbfa0e2 100644
--- a/WebCore/svg/SVGTextPathElement.cpp
+++ b/WebCore/svg/SVGTextPathElement.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2007 Nikolas Zimmermann <zimmermann@kde.org>
+ * Copyright (C) 2010 Rob Buis <rwlbuis@gmail.com>
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -119,7 +120,10 @@ bool SVGTextPathElement::childShouldCreateRenderer(Node* child) const
 #if ENABLE(SVG_FONTS)
         || child->hasTagName(SVGNames::altGlyphTag)
 #endif
-        || child->hasTagName(SVGNames::trefTag) || child->hasTagName(SVGNames::tspanTag) || child->hasTagName(SVGNames::textPathTag))
+        || child->hasTagName(SVGNames::trefTag)
+        || child->hasTagName(SVGNames::tspanTag)
+        || child->hasTagName(SVGNames::aTag)
+        || child->hasTagName(SVGNames::textPathTag))
         return true;
 
     return false;
diff --git a/WebCore/svg/SVGTextPositioningElement.cpp b/WebCore/svg/SVGTextPositioningElement.cpp
index 4703482..cbc324d 100644
--- a/WebCore/svg/SVGTextPositioningElement.cpp
+++ b/WebCore/svg/SVGTextPositioningElement.cpp
@@ -24,8 +24,8 @@
 #include "SVGTextPositioningElement.h"
 
 #include "Attribute.h"
-#include "RenderObject.h"
 #include "RenderSVGResource.h"
+#include "RenderSVGText.h"
 #include "SVGLengthList.h"
 #include "SVGNames.h"
 #include "SVGNumberList.h"
@@ -58,21 +58,65 @@ void SVGTextPositioningElement::parseMappedAttribute(Attribute* attr)
         SVGTextContentElement::parseMappedAttribute(attr);
 }
 
+static inline void updatePositioningValuesInRenderer(RenderObject* renderer)
+{
+    RenderSVGText* textRenderer = 0;
+
+    if (renderer->isSVGText())
+        textRenderer = toRenderSVGText(renderer);
+    else {
+        // Locate RenderSVGText parent renderer.
+        RenderObject* parent = renderer->parent();
+        while (parent && !parent->isSVGText())
+            parent = parent->parent();
+
+        if (parent) {
+            ASSERT(parent->isSVGText());
+            textRenderer = toRenderSVGText(parent);
+        }
+    }
+
+    if (!textRenderer)
+        return;
+
+    textRenderer->setNeedsPositioningValuesUpdate();
+}
+
 void SVGTextPositioningElement::svgAttributeChanged(const QualifiedName& attrName)
 {
     SVGTextContentElement::svgAttributeChanged(attrName);
 
-    if (attrName == SVGNames::xAttr
-        || attrName == SVGNames::yAttr
-        || attrName == SVGNames::dxAttr
-        || attrName == SVGNames::dyAttr)
+    bool updateRelativeLengths = attrName == SVGNames::xAttr
+                              || attrName == SVGNames::yAttr
+                              || attrName == SVGNames::dxAttr
+                              || attrName == SVGNames::dyAttr;
+
+    if (updateRelativeLengths)
         updateRelativeLengthsInformation();
 
-    if (!renderer())
+    RenderObject* renderer = this->renderer();
+    if (!renderer)
+        return;
+
+    if (updateRelativeLengths || attrName == SVGNames::rotateAttr) {
+        updatePositioningValuesInRenderer(renderer);
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
+        return;
+    }
+
+    if (SVGTextContentElement::isKnownAttribute(attrName))
+        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer);
+}
+
+void SVGTextPositioningElement::childrenChanged(bool changedByParser, Node* beforeChange, Node* afterChange, int childCountDelta)
+{
+    SVGTextContentElement::childrenChanged(changedByParser, beforeChange, afterChange, childCountDelta);
+
+    if (changedByParser)
         return;
 
-    if (isKnownAttribute(attrName))
-        RenderSVGResource::markForLayoutAndParentResourceInvalidation(renderer());
+    if (RenderObject* object = renderer())
+        updatePositioningValuesInRenderer(object);
 }
 
 void SVGTextPositioningElement::synchronizeProperty(const QualifiedName& attrName)
@@ -100,16 +144,6 @@ void SVGTextPositioningElement::synchronizeProperty(const QualifiedName& attrNam
         synchronizeRotate();
 }
 
-bool SVGTextPositioningElement::isKnownAttribute(const QualifiedName& attrName)
-{
-    return (attrName.matches(SVGNames::xAttr) ||
-            attrName.matches(SVGNames::yAttr) ||
-            attrName.matches(SVGNames::dxAttr) ||
-            attrName.matches(SVGNames::dyAttr) ||
-            attrName.matches(SVGNames::rotateAttr) ||
-            SVGTextContentElement::isKnownAttribute(attrName));
-}
-
 static inline bool listContainsRelativeValue(SVGLengthList* list)
 {
     if (!list)
@@ -143,6 +177,30 @@ bool SVGTextPositioningElement::selfHasRelativeLengths() const
     return false;
 }
 
+SVGTextPositioningElement* SVGTextPositioningElement::elementFromRenderer(RenderObject* renderer)
+{
+    if (!renderer)
+        return 0;
+
+    if (!renderer->isSVGText() && !renderer->isSVGInline())
+        return 0;
+
+    Node* node = renderer->node();
+    ASSERT(node);
+    ASSERT(node->isSVGElement());
+
+    if (!node->hasTagName(SVGNames::textTag)
+        && !node->hasTagName(SVGNames::tspanTag)
+#if ENABLE(SVG_FONTS)
+        && !node->hasTagName(SVGNames::altGlyphTag)
+#endif
+        && !node->hasTagName(SVGNames::trefTag))
+        return 0;
+
+    return static_cast<SVGTextPositioningElement*>(node);
+}
+
+
 }
 
 #endif // ENABLE(SVG)
diff --git a/WebCore/svg/SVGTextPositioningElement.h b/WebCore/svg/SVGTextPositioningElement.h
index 57a4028..41de9f3 100644
--- a/WebCore/svg/SVGTextPositioningElement.h
+++ b/WebCore/svg/SVGTextPositioningElement.h
@@ -29,15 +29,17 @@
 namespace WebCore {
 
     class SVGTextPositioningElement : public SVGTextContentElement {
+    public:
+        static SVGTextPositioningElement* elementFromRenderer(RenderObject*);
+
     protected:
         SVGTextPositioningElement(const QualifiedName&, Document*);
 
         virtual void parseMappedAttribute(Attribute*);
+        virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
         virtual void svgAttributeChanged(const QualifiedName&);
         virtual void synchronizeProperty(const QualifiedName&);
 
-        bool isKnownAttribute(const QualifiedName&);
-
         virtual bool selfHasRelativeLengths() const;
 
         DECLARE_ANIMATED_PROPERTY(SVGTextPositioningElement, SVGNames::xAttr, SVGLengthList*, X, x)
diff --git a/WebCore/svg/SVGURIReference.h b/WebCore/svg/SVGURIReference.h
index 92a93a9..096f5a5 100644
--- a/WebCore/svg/SVGURIReference.h
+++ b/WebCore/svg/SVGURIReference.h
@@ -39,7 +39,7 @@ namespace WebCore {
         static String getTarget(const String& url);
 
     protected:
-        virtual void setHrefBaseValue(SVGAnimatedPropertyTraits<String>::PassType) = 0;
+        virtual void setHrefBaseValue(DeprecatedSVGAnimatedPropertyTraits<String>::PassType) = 0;
     };
 
 } // namespace WebCore
diff --git a/WebCore/svg/SVGUseElement.cpp b/WebCore/svg/SVGUseElement.cpp
index 782efa8..474b0a4 100644
--- a/WebCore/svg/SVGUseElement.cpp
+++ b/WebCore/svg/SVGUseElement.cpp
@@ -47,6 +47,8 @@
 #include "XMLDocumentParser.h"
 #include "XMLSerializer.h"
 
+#include <wtf/text/StringConcatenate.h>
+
 // Dump SVGElementInstance object tree - useful to debug instanceRoot problems
 // #define DUMP_INSTANCE_TREE
 
@@ -296,7 +298,7 @@ void SVGUseElement::updateContainerOffsets()
     SVGElement* shadowRoot = m_targetElementInstance->shadowTreeElement();
     ASSERT(shadowRoot);
 
-    Node* parentNode = shadowRoot->parentNode();
+    ContainerNode* parentNode = shadowRoot->parentNode();
     ASSERT(parentNode);
     ASSERT(parentNode->isSVGElement());
     ASSERT(parentNode->hasTagName(SVGNames::gTag));
@@ -370,7 +372,7 @@ void dumpInstanceTree(unsigned int& depth, String& text, SVGElementInstance* tar
         text += "  ";
 
     const HashSet<SVGElementInstance*>& elementInstances = element->instancesForElement();
-    text += String::format("Corresponding element is associated with %i instance(s):\n", elementInstances.size());
+    text += makeString("Corresponding element is associated with ", String::number(elementInstances.size()), " instance(s):\n");
 
     const HashSet<SVGElementInstance*>::const_iterator end = elementInstances.end();
     for (HashSet<SVGElementInstance*>::const_iterator it = elementInstances.begin(); it != end; ++it) {
@@ -477,7 +479,7 @@ void SVGUseElement::buildShadowAndInstanceTree(SVGShadowTreeRootElement* shadowR
 
     // Do not build the shadow/instance tree for <use> elements living in a shadow tree.
     // The will be expanded soon anyway - see expandUseElementsInShadowTree().
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     while (parent) {
         if (parent->isShadowNode())
             return;
@@ -624,25 +626,24 @@ static bool isDirectReference(Node* n)
            n->hasTagName(SVGNames::textTag);
 }
 
-Path SVGUseElement::toClipPath() const
+void SVGUseElement::toClipPath(Path& path) const
 {
+    ASSERT(path.isEmpty());
+
     Node* n = m_targetElementInstance ? m_targetElementInstance->shadowTreeElement() : 0;
     if (!n)
-        return Path();
+        return;
 
     if (n->isSVGElement() && static_cast<SVGElement*>(n)->isStyledTransformable()) {
         if (!isDirectReference(n))
             // Spec: Indirect references are an error (14.3.5)
             document()->accessSVGExtensions()->reportError("Not allowed to use indirect reference in <clip-path>");
         else {
-            Path clipPath = static_cast<SVGStyledTransformableElement*>(n)->toClipPath();
-            clipPath.translate(FloatSize(x().value(this), y().value(this)));
-            clipPath.transform(animatedLocalTransform());
-            return clipPath;
+            static_cast<SVGStyledTransformableElement*>(n)->toClipPath(path);
+            path.translate(FloatSize(x().value(this), y().value(this)));
+            path.transform(animatedLocalTransform());
         }
     }
-
-    return Path();
 }
 
 RenderObject* SVGUseElement::rendererClipChild() const
@@ -797,6 +798,7 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
         // Don't ASSERT(target) here, it may be "pending", too.
         // Setup sub-shadow tree root node
         RefPtr<SVGShadowTreeContainerElement> cloneParent = SVGShadowTreeContainerElement::create(document());
+        use->cloneChildNodes(cloneParent.get());
 
         // Spec: In the generated content, the 'use' will be replaced by 'g', where all attributes from the
         // 'use' element except for x, y, width, height and xlink:href are transferred to the generated 'g' element.
@@ -806,14 +808,6 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
         if (target && !isDisallowedElement(target)) {
             RefPtr<Element> newChild = target->cloneElementWithChildren();
 
-            // We don't walk the target tree element-by-element, and clone each element,
-            // but instead use cloneElementWithChildren(). This is an optimization for the common
-            // case where <use> doesn't contain disallowed elements (ie. <foreignObject>).
-            // Though if there are disallowed elements in the subtree, we have to remove them.
-            // For instance: <use> on <g> containing <foreignObject> (indirect case).
-            if (subtreeContainsDisallowedElement(newChild.get()))
-                removeDisallowedElementsFromSubtree(newChild.get());
-
             SVGElement* newChildPtr = 0;
             if (newChild->isSVGElement())
                 newChildPtr = static_cast<SVGElement*>(newChild.get());
@@ -823,6 +817,14 @@ void SVGUseElement::expandUseElementsInShadowTree(SVGShadowTreeRootElement* shad
             ASSERT(!ec);
         }
 
+        // We don't walk the target tree element-by-element, and clone each element,
+        // but instead use cloneElementWithChildren(). This is an optimization for the common
+        // case where <use> doesn't contain disallowed elements (ie. <foreignObject>).
+        // Though if there are disallowed elements in the subtree, we have to remove them.
+        // For instance: <use> on <g> containing <foreignObject> (indirect case).
+        if (subtreeContainsDisallowedElement(cloneParent.get()))
+            removeDisallowedElementsFromSubtree(cloneParent.get());
+
         // Replace <use> with referenced content.
         ASSERT(use->parentNode()); 
         use->parentNode()->replaceChild(cloneParent.release(), use, ec);
diff --git a/WebCore/svg/SVGUseElement.h b/WebCore/svg/SVGUseElement.h
index 9366d25..b8ba71d 100644
--- a/WebCore/svg/SVGUseElement.h
+++ b/WebCore/svg/SVGUseElement.h
@@ -67,7 +67,7 @@ namespace WebCore {
         virtual void attach();
         virtual void detach();
 
-        virtual Path toClipPath() const;
+        virtual void toClipPath(Path&) const;
 
         static void removeDisallowedElementsFromSubtree(Node* element);
 
diff --git a/WebCore/svg/SVGVKernElement.cpp b/WebCore/svg/SVGVKernElement.cpp
index b9f3c17..eed13d2 100644
--- a/WebCore/svg/SVGVKernElement.cpp
+++ b/WebCore/svg/SVGVKernElement.cpp
@@ -45,7 +45,7 @@ PassRefPtr<SVGVKernElement> SVGVKernElement::create(const QualifiedName& tagName
 
 void SVGVKernElement::insertedIntoDocument()
 {
-    Node* fontNode = parentNode();
+    ContainerNode* fontNode = parentNode();
     if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
@@ -54,7 +54,7 @@ void SVGVKernElement::insertedIntoDocument()
 
 void SVGVKernElement::removedFromDocument()
 {
-    Node* fontNode = parentNode();
+    ContainerNode* fontNode = parentNode();
     if (fontNode && fontNode->hasTagName(SVGNames::fontTag)) {
         if (SVGFontElement* element = static_cast<SVGFontElement*>(fontNode))
             element->invalidateGlyphCache();
diff --git a/WebCore/svg/animation/SVGSMILElement.cpp b/WebCore/svg/animation/SVGSMILElement.cpp
index 99a5189..a90b444 100644
--- a/WebCore/svg/animation/SVGSMILElement.cpp
+++ b/WebCore/svg/animation/SVGSMILElement.cpp
@@ -463,7 +463,7 @@ void SVGSMILElement::reschedule()
 SVGElement* SVGSMILElement::targetElement() const
 {
     String href = xlinkHref();
-    Node* target = href.isEmpty() ? parentNode() : document()->getElementById(SVGURIReference::getTarget(href));
+    ContainerNode* target = href.isEmpty() ? parentNode() : document()->getElementById(SVGURIReference::getTarget(href));
     if (target && target->isSVGElement())
         return static_cast<SVGElement*>(target);
     return 0;
diff --git a/WebCore/svg/graphics/SVGImage.cpp b/WebCore/svg/graphics/SVGImage.cpp
index 2d1d592..c9804ae 100644
--- a/WebCore/svg/graphics/SVGImage.cpp
+++ b/WebCore/svg/graphics/SVGImage.cpp
@@ -224,7 +224,7 @@ NativeImagePtr SVGImage::nativeImageForCurrentFrame()
         OwnPtr<ImageBuffer> buffer = ImageBuffer::create(size());
         if (!buffer) // failed to allocate image
             return 0;
-        draw(buffer->context(), rect(), rect(), DeviceColorSpace, CompositeSourceOver);
+        draw(buffer->context(), rect(), rect(), ColorSpaceDeviceRGB, CompositeSourceOver);
         m_frameCache = buffer->copyImage();
     }
     return m_frameCache->nativeImageForCurrentFrame();
diff --git a/WebCore/svg/graphics/filters/SVGFEImage.cpp b/WebCore/svg/graphics/filters/SVGFEImage.cpp
index c94547b..ed90588 100644
--- a/WebCore/svg/graphics/filters/SVGFEImage.cpp
+++ b/WebCore/svg/graphics/filters/SVGFEImage.cpp
@@ -44,21 +44,33 @@ PassRefPtr<FEImage> FEImage::create(RefPtr<Image> image, const SVGPreserveAspect
     return adoptRef(new FEImage(image, preserveAspectRatio));
 }
 
-void FEImage::apply(Filter*)
+void FEImage::determineAbsolutePaintRect(Filter*)
+{
+    ASSERT(m_image);
+    FloatRect srcRect(FloatPoint(), m_image->size());
+    FloatRect paintRect(m_absoluteSubregion);
+    m_preserveAspectRatio.transformRect(paintRect, srcRect);
+    paintRect.intersect(maxEffectRect());
+    setAbsolutePaintRect(enclosingIntRect(paintRect));
+}
+
+void FEImage::apply(Filter* filter)
 {
     if (!m_image.get())
         return;
 
-    GraphicsContext* filterContext = effectContext();
+    GraphicsContext* filterContext = effectContext(filter);
     if (!filterContext)
         return;
 
     FloatRect srcRect(FloatPoint(), m_image->size());
-    FloatRect destRect(FloatPoint(), filterPrimitiveSubregion().size());
-
+    FloatRect destRect(m_absoluteSubregion);
     m_preserveAspectRatio.transformRect(destRect, srcRect);
 
-    filterContext->drawImage(m_image.get(), DeviceColorSpace, destRect, srcRect);
+    IntPoint paintLocation = absolutePaintRect().location();
+    destRect.move(-paintLocation.x(), -paintLocation.y());
+
+    filterContext->drawImage(m_image.get(), ColorSpaceDeviceRGB, destRect, srcRect);
 }
 
 void FEImage::dump()
diff --git a/WebCore/svg/graphics/filters/SVGFEImage.h b/WebCore/svg/graphics/filters/SVGFEImage.h
index fe2d8c4..9efb5f1 100644
--- a/WebCore/svg/graphics/filters/SVGFEImage.h
+++ b/WebCore/svg/graphics/filters/SVGFEImage.h
@@ -33,9 +33,15 @@ class FEImage : public FilterEffect {
 public:
     static PassRefPtr<FEImage> create(RefPtr<Image>, const SVGPreserveAspectRatio&);
 
+    void setAbsoluteSubregion(const FloatRect& absoluteSubregion) { m_absoluteSubregion = absoluteSubregion; }
+
     virtual void apply(Filter*);
     virtual void dump();
 
+    virtual void determineAbsolutePaintRect(Filter*);
+
+    virtual FilterEffectType filterEffectType() const { return FilterEffectTypeImage; }
+
     virtual TextStream& externalRepresentation(TextStream&, int indention) const;
     
 private:
@@ -43,6 +49,7 @@ private:
 
     RefPtr<Image> m_image;
     SVGPreserveAspectRatio m_preserveAspectRatio;
+    FloatRect m_absoluteSubregion;
 };
 
 } // namespace WebCore
diff --git a/WebCore/svg/graphics/filters/SVGFilter.cpp b/WebCore/svg/graphics/filters/SVGFilter.cpp
index d72dc3d..dfdccd7 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.cpp
+++ b/WebCore/svg/graphics/filters/SVGFilter.cpp
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2009 Dirk Schulze <krit@webkit.org>
+ * Copyright (C) Research In Motion Limited 2010. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
@@ -22,14 +23,19 @@
 #if ENABLE(SVG) && ENABLE(FILTERS)
 #include "SVGFilter.h"
 
+#include "SVGFEImage.h"
+
 namespace WebCore {
 
-SVGFilter::SVGFilter(const FloatRect& targetBoundingBox, const FloatRect& filterRect, bool effectBBoxMode)
+SVGFilter::SVGFilter(const AffineTransform& absoluteTransform, const FloatRect& absoluteSourceDrawingRegion, const FloatRect& targetBoundingBox, const FloatRect& filterRegion, bool effectBBoxMode)
     : Filter()
+    , m_absoluteTransform(absoluteTransform)
+    , m_absoluteSourceDrawingRegion(absoluteSourceDrawingRegion)
     , m_targetBoundingBox(targetBoundingBox)
-    , m_filterRect(filterRect)
+    , m_filterRegion(filterRegion)
     , m_effectBBoxMode(effectBBoxMode)
 {
+    m_absoluteFilterRegion = absoluteTransform.mapRect(filterRegion);
 }
 
 void SVGFilter::determineFilterPrimitiveSubregion(FilterEffect* effect, const FloatRect& unionOfPreviousPrimitiveSubregions)
@@ -65,23 +71,48 @@ void SVGFilter::determineFilterPrimitiveSubregion(FilterEffect* effect, const Fl
             newSubRegion.setHeight(unionOfPreviousPrimitiveSubregions.height());
     }
 
-    // clip every filter effect to the filter region
-    newSubRegion.intersect(m_filterRect);
-
     effect->setFilterPrimitiveSubregion(newSubRegion);
-    
     // TODO: Everything above should be moved to a first phase of layout in RenderSVGResourceFilterPrimitive.
     // The scaling of the subregion to the repaint rect should be merged with a more intelligent repaint logic
     // and moved to the second phase of layout in RenderSVGResourceFilterPrimitive.
     // See bug https://bugs.webkit.org/show_bug.cgi?id=45614.
+    newSubRegion = m_absoluteTransform.mapRect(newSubRegion);
     newSubRegion.scale(filterResolution().width(), filterResolution().height());
-    effect->setRepaintRectInLocalCoordinates(newSubRegion);
-    m_maxImageSize = m_maxImageSize.expandedTo(newSubRegion.size()); 
+
+    // FEImage needs the unclipped subregion in absolute coordinates to determine the correct
+    // destination rect in combination with preserveAspectRatio.
+    if (effect->filterEffectType() == FilterEffectTypeImage) {
+        FEImage* imageEffect = static_cast<FEImage*>(effect);
+        imageEffect->setAbsoluteSubregion(newSubRegion);
+    }
+
+    // Clip every filter effect to the filter region.
+    FloatRect absoluteScaledFilterRegion = m_absoluteFilterRegion;
+    absoluteScaledFilterRegion.scale(filterResolution().width(), filterResolution().height());
+    newSubRegion.intersect(absoluteScaledFilterRegion);
+
+    effect->setMaxEffectRect(enclosingIntRect(newSubRegion));
+    if (effect->filterEffectType() != FilterEffectTypeSourceInput)
+        m_maxImageSize = m_maxImageSize.expandedTo(newSubRegion.size()); 
+}
+
+float SVGFilter::applyHorizontalScale(float value) const
+{
+    if (m_effectBBoxMode)
+        value *= m_targetBoundingBox.width();
+    return Filter::applyHorizontalScale(value) * m_absoluteFilterRegion.width() / m_filterRegion.width();
+}
+
+float SVGFilter::applyVerticalScale(float value) const
+{
+    if (m_effectBBoxMode)
+        value *= m_targetBoundingBox.height();
+    return Filter::applyVerticalScale(value) * m_absoluteFilterRegion.height() / m_filterRegion.height();
 }
 
-PassRefPtr<SVGFilter> SVGFilter::create(const FloatRect& targetBoundingBox, const FloatRect& filterRect, bool effectBBoxMode)
+PassRefPtr<SVGFilter> SVGFilter::create(const AffineTransform& absoluteTransform, const FloatRect& absoluteSourceDrawingRegion, const FloatRect& targetBoundingBox, const FloatRect& filterRegion, bool effectBBoxMode)
 {
-    return adoptRef(new SVGFilter(targetBoundingBox, filterRect, effectBBoxMode));
+    return adoptRef(new SVGFilter(absoluteTransform, absoluteSourceDrawingRegion, targetBoundingBox, filterRegion, effectBBoxMode));
 }
 
 } // namespace WebCore
diff --git a/WebCore/svg/graphics/filters/SVGFilter.h b/WebCore/svg/graphics/filters/SVGFilter.h
index 631f1ee..1b19e9f 100644
--- a/WebCore/svg/graphics/filters/SVGFilter.h
+++ b/WebCore/svg/graphics/filters/SVGFilter.h
@@ -21,6 +21,7 @@
 #define SVGFilter_h
 
 #if ENABLE(SVG) && ENABLE(FILTERS)
+#include "AffineTransform.h"
 #include "Filter.h"
 #include "FilterEffect.h"
 #include "FloatRect.h"
@@ -32,27 +33,36 @@
 
 namespace WebCore {
 
-    class SVGFilter : public Filter {
-    public:
-        static PassRefPtr<SVGFilter> create(const FloatRect&, const FloatRect&, bool);
+class SVGFilter : public Filter {
+public:
+    static PassRefPtr<SVGFilter> create(const AffineTransform&, const FloatRect&, const FloatRect&, const FloatRect&, bool);
 
-        virtual bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
+    virtual bool effectBoundingBoxMode() const { return m_effectBBoxMode; }
 
-        virtual FloatRect filterRegion() const { return m_filterRect; }
-        
-        virtual FloatRect sourceImageRect() const { return m_targetBoundingBox; }
+    virtual FloatRect filterRegionInUserSpace() const { return m_filterRegion; }
+    virtual FloatRect filterRegion() const { return m_absoluteFilterRegion; }
 
-        virtual FloatSize maxImageSize() const { return m_maxImageSize; }
-        virtual void determineFilterPrimitiveSubregion(FilterEffect*, const FloatRect&);
+    virtual FloatPoint mapAbsolutePointToLocalPoint(const FloatPoint& point) const { return m_absoluteTransform.inverse().mapPoint(point); }
 
-    private:
-        SVGFilter(const FloatRect& targetBoundingBox, const FloatRect& filterRect, bool effectBBoxMode);
+    virtual float applyHorizontalScale(float value) const;
+    virtual float applyVerticalScale(float value) const;
 
-        FloatSize m_maxImageSize;
-        FloatRect m_targetBoundingBox;
-        FloatRect m_filterRect;
-        bool m_effectBBoxMode;
-    };
+    virtual FloatRect sourceImageRect() const { return m_absoluteSourceDrawingRegion; }
+    
+    virtual FloatSize maxImageSize() const { return m_maxImageSize; }
+    virtual void determineFilterPrimitiveSubregion(FilterEffect*, const FloatRect&);
+
+private:
+    SVGFilter(const AffineTransform& absoluteTransform, const FloatRect& absoluteSourceDrawingRegion, const FloatRect& targetBoundingBox, const FloatRect& filterRegion, bool effectBBoxMode);
+
+    AffineTransform m_absoluteTransform;
+    FloatRect m_absoluteSourceDrawingRegion;
+    FloatRect m_targetBoundingBox;
+    FloatRect m_absoluteFilterRegion;
+    FloatRect m_filterRegion;
+    bool m_effectBBoxMode;
+    FloatSize m_maxImageSize;
+};
 
 } // namespace WebCore
 
diff --git a/WebCore/svg/SVGAnimatedPropertySynchronizer.h b/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
index 55f77b1..476f1fd 100644
--- a/WebCore/svg/SVGAnimatedPropertySynchronizer.h
+++ b/WebCore/svg/properties/SVGAnimatedPropertySynchronizer.h
@@ -20,7 +20,7 @@
 #ifndef SVGAnimatedPropertySynchronizer_h
 #define SVGAnimatedPropertySynchronizer_h
 
-#include "SVGAnimatedPropertyTraits.h"
+#include "DeprecatedSVGAnimatedPropertyTraits.h"
 
 #if ENABLE(SVG)
 namespace WebCore {
diff --git a/WebCore/webaudio/AudioBasicProcessorNode.cpp b/WebCore/webaudio/AudioBasicProcessorNode.cpp
new file mode 100644
index 0000000..cadaa73
--- /dev/null
+++ b/WebCore/webaudio/AudioBasicProcessorNode.cpp
@@ -0,0 +1,146 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioBasicProcessorNode.h"
+
+#include "AudioBus.h"
+#include "AudioNodeInput.h"
+#include "AudioNodeOutput.h"
+#include "AudioProcessor.h"
+
+namespace WebCore {
+
+AudioBasicProcessorNode::AudioBasicProcessorNode(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
+{
+    addInput(adoptPtr(new AudioNodeInput(this)));
+    addOutput(adoptPtr(new AudioNodeOutput(this, 0)));
+
+    // The subclass must create m_processor.
+}
+
+void AudioBasicProcessorNode::initialize()
+{
+    if (isInitialized())
+        return;
+
+    ASSERT(processor());
+    processor()->initialize();
+
+    AudioNode::initialize();
+}
+
+void AudioBasicProcessorNode::uninitialize()
+{
+    if (!isInitialized())
+        return;
+
+    ASSERT(processor());
+    processor()->uninitialize();
+
+    AudioNode::uninitialize();
+}
+
+void AudioBasicProcessorNode::process(size_t framesToProcess)
+{
+    AudioBus* destinationBus = output(0)->bus();
+    
+    // The realtime thread can't block on this lock, so we call tryLock() instead.
+    if (m_processLock.tryLock()) {
+        if (!isInitialized() || !processor())
+            destinationBus->zero();
+        else {
+            AudioBus* sourceBus = input(0)->bus();
+
+            // FIXME: if we take "tail time" into account, then we can avoid calling processor()->process() once the tail dies down.
+            if (!input(0)->isConnected())
+                sourceBus->zero();
+            
+            processor()->process(sourceBus, destinationBus, framesToProcess);  
+        }
+
+        m_processLock.unlock();
+    } else {
+        // Too bad - the tryLock() failed.  We must be in the middle of re-connecting and were already outputting silence anyway...
+        destinationBus->zero();
+    }
+}
+
+// Nice optimization in the very common case allowing for "in-place" processing
+void AudioBasicProcessorNode::pullInputs(size_t framesToProcess)
+{
+    // Render input stream - suggest to the input to render directly into output bus for in-place processing in process() if possible.
+    input(0)->pull(output(0)->bus(), framesToProcess);
+}
+
+void AudioBasicProcessorNode::reset()
+{
+    if (processor())
+        processor()->reset();
+}
+
+// As soon as we know the channel count of our input, we can lazily initialize.
+// Sometimes this may be called more than once with different channel counts, in which case we must safely
+// uninitialize and then re-initialize with the new channel count.
+void AudioBasicProcessorNode::checkNumberOfChannelsForInput(AudioNodeInput* input)
+{
+    ASSERT(isMainThread());
+    
+    ASSERT(input == this->input(0));
+    if (input != this->input(0))
+        return;
+
+    ASSERT(processor());
+    if (!processor())
+        return;
+
+    unsigned numberOfChannels = input->numberOfChannels();
+    
+    if (isInitialized() && numberOfChannels != output(0)->numberOfChannels()) {
+        // We're already initialized but the channel count has changed.
+        // We need to be careful since we may be actively processing right now, so synchronize with process().
+        MutexLocker locker(m_processLock);
+        uninitialize();
+    }
+    
+    // This will propagate the channel count to any nodes connected further down the chain...
+    output(0)->setNumberOfChannels(numberOfChannels);
+
+    // Re-initialize the processor with the new channel count.
+    processor()->setNumberOfChannels(numberOfChannels);
+    initialize();
+}
+
+unsigned AudioBasicProcessorNode::numberOfChannels()
+{
+    return output(0)->numberOfChannels();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/AudioBasicProcessorNode.h b/WebCore/webaudio/AudioBasicProcessorNode.h
new file mode 100644
index 0000000..38bfd3b
--- /dev/null
+++ b/WebCore/webaudio/AudioBasicProcessorNode.h
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioBasicProcessorNode_h
+#define AudioBasicProcessorNode_h
+
+#include "AudioNode.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/RefCounted.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class AudioBus;
+class AudioNodeInput;
+class AudioProcessor;
+    
+// AudioBasicProcessorNode is an AudioNode with one input and one output where the input and output have the same number of channels.
+class AudioBasicProcessorNode : public AudioNode {
+public:
+    AudioBasicProcessorNode(AudioContext*, double sampleRate);
+
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void pullInputs(size_t framesToProcess);
+    virtual void reset();
+    virtual void initialize();
+    virtual void uninitialize();
+
+    // Called in the main thread when the number of channels for the input may have changed.
+    virtual void checkNumberOfChannelsForInput(AudioNodeInput*);
+
+    // Returns the number of channels for both the input and the output.
+    unsigned numberOfChannels();
+
+protected:
+    AudioProcessor* processor() { return m_processor.get(); }
+    OwnPtr<AudioProcessor> m_processor;
+
+private:
+    // This synchronizes live channel count changes which require an uninitialization / re-initialization.
+    mutable Mutex m_processLock;
+};
+
+} // namespace WebCore
+
+#endif // AudioBasicProcessorNode_h
diff --git a/WebCore/webaudio/AudioChannelMerger.cpp b/WebCore/webaudio/AudioChannelMerger.cpp
new file mode 100644
index 0000000..c418a61
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelMerger.cpp
@@ -0,0 +1,102 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioChannelMerger.h"
+
+#include "AudioNodeInput.h"
+#include "AudioNodeOutput.h"
+
+namespace WebCore {
+    
+// This is considering that 5.1 (6 channels) is the largest we'll ever deal with.
+// It can easily be increased to support more if the web audio specification is updated.
+const unsigned NumberOfInputs = 6;
+
+AudioChannelMerger::AudioChannelMerger(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
+{
+    // Create a fixed number of inputs (able to handle the maximum number of channels we deal with).
+    for (unsigned i = 0; i < NumberOfInputs; ++i)
+        addInput(adoptPtr(new AudioNodeInput(this)));
+
+    addOutput(adoptPtr(new AudioNodeOutput(this, 1)));
+    
+    setType(NodeTypeChannelMerger);
+    
+    initialize();
+}
+
+void AudioChannelMerger::process(size_t framesToProcess)
+{
+    AudioNodeOutput* output = this->output(0);
+    ASSERT(output);
+    ASSERT_UNUSED(framesToProcess, framesToProcess == output->bus()->length());    
+    
+    // Count how many channels we have all together from all of the inputs.
+    unsigned numberOfOutputChannels = 0;
+    for (unsigned i = 0; i < numberOfInputs(); ++i) {
+        AudioNodeInput* input = this->input(i);
+        if (input->isConnected())
+            numberOfOutputChannels += input->bus()->numberOfChannels();
+    }
+
+    // Set the correct number of channels on the output
+    output->setNumberOfChannels(numberOfOutputChannels);
+    
+    // Now merge the channels back into one output.
+    unsigned outputChannelIndex = 0;
+    for (unsigned i = 0; i < numberOfInputs(); ++i) {
+        AudioNodeInput* input = this->input(i);
+        if (input->isConnected()) {
+            unsigned numberOfInputChannels = input->bus()->numberOfChannels();
+            
+            // Merge channels from this particular input.
+            for (unsigned j = 0; j < numberOfInputChannels; ++j) {
+                AudioChannel* inputChannel = input->bus()->channel(j);
+                AudioChannel* outputChannel = output->bus()->channel(outputChannelIndex);
+                outputChannel->copyFrom(inputChannel);
+                
+                ++outputChannelIndex;
+            }
+        }
+    }
+    
+    ASSERT(outputChannelIndex == numberOfOutputChannels);
+}
+
+void AudioChannelMerger::reset()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/AudioChannelMerger.h b/WebCore/webaudio/AudioChannelMerger.h
new file mode 100644
index 0000000..20a9628
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelMerger.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioChannelMerger_h
+#define AudioChannelMerger_h
+
+#include "AudioNode.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class AudioContext;
+    
+class AudioChannelMerger : public AudioNode {
+public:
+    static PassRefPtr<AudioChannelMerger> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new AudioChannelMerger(context, sampleRate));      
+    }
+
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void reset();
+
+private:
+    AudioChannelMerger(AudioContext*, double sampleRate);
+};
+
+} // namespace WebCore
+
+#endif // AudioChannelMerger_h
diff --git a/WebCore/webaudio/AudioChannelMerger.idl b/WebCore/webaudio/AudioChannelMerger.idl
new file mode 100644
index 0000000..3862af9
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelMerger.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    interface [
+        Conditional=WEB_AUDIO
+    ] AudioChannelMerger : AudioNode {
+    };
+}
diff --git a/WebCore/webaudio/AudioChannelSplitter.cpp b/WebCore/webaudio/AudioChannelSplitter.cpp
new file mode 100644
index 0000000..2689cd7
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelSplitter.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioChannelSplitter.h"
+
+#include "AudioNodeInput.h"
+#include "AudioNodeOutput.h"
+
+namespace WebCore {
+    
+// This is considering that 5.1 (6 channels) is the largest we'll ever deal with.
+// It can easily be increased to support more if the web audio specification is updated.
+const unsigned NumberOfOutputs = 6;
+
+AudioChannelSplitter::AudioChannelSplitter(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
+{
+    addInput(adoptPtr(new AudioNodeInput(this)));
+
+    // Create a fixed number of outputs (able to handle the maximum number of channels fed to an input).
+    for (unsigned i = 0; i < NumberOfOutputs; ++i)
+        addOutput(adoptPtr(new AudioNodeOutput(this, 1)));
+    
+    setType(NodeTypeChannelSplitter);
+    
+    initialize();
+}
+
+void AudioChannelSplitter::process(size_t framesToProcess)
+{
+    AudioBus* source = input(0)->bus();
+    ASSERT(source);
+    ASSERT_UNUSED(framesToProcess, framesToProcess == source->length());
+    
+    unsigned numberOfSourceChannels = source->numberOfChannels();
+    
+    ASSERT(numberOfOutputs() == NumberOfOutputs);
+    for (unsigned i = 0; i < NumberOfOutputs; ++i) {
+        AudioBus* destination = output(i)->bus();
+        ASSERT(destination);
+        
+        if (i < numberOfSourceChannels) {
+            // Split the channel out if it exists in the source.
+            // It would be nice to avoid the copy and simply pass along pointers, but this becomes extremely difficult with fanout and fanin.
+            destination->channel(0)->copyFrom(source->channel(i));
+        } else if (output(i)->fanOutCount() > 0) {
+            // Only bother zeroing out the destination if it's connected to anything
+            destination->zero();
+        }
+    }
+}
+
+void AudioChannelSplitter::reset()
+{
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/AudioChannelSplitter.h b/WebCore/webaudio/AudioChannelSplitter.h
new file mode 100644
index 0000000..29092d6
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelSplitter.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioChannelSplitter_h
+#define AudioChannelSplitter_h
+
+#include "AudioNode.h"
+#include <wtf/PassRefPtr.h>
+
+namespace WebCore {
+
+class AudioContext;
+    
+class AudioChannelSplitter : public AudioNode {
+public:
+    static PassRefPtr<AudioChannelSplitter> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new AudioChannelSplitter(context, sampleRate));      
+    }
+
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void reset();
+
+private:
+    AudioChannelSplitter(AudioContext*, double sampleRate);
+};
+
+} // namespace WebCore
+
+#endif // AudioChannelSplitter_h
diff --git a/WebCore/webaudio/AudioChannelSplitter.idl b/WebCore/webaudio/AudioChannelSplitter.idl
new file mode 100644
index 0000000..a7450e6
--- /dev/null
+++ b/WebCore/webaudio/AudioChannelSplitter.idl
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    interface [
+        Conditional=WEB_AUDIO
+    ] AudioChannelSplitter : AudioNode {
+    };
+}
diff --git a/WebCore/webaudio/AudioContext.cpp b/WebCore/webaudio/AudioContext.cpp
index 6ca8ee1..f971e6a 100644
--- a/WebCore/webaudio/AudioContext.cpp
+++ b/WebCore/webaudio/AudioContext.cpp
@@ -1,29 +1,25 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
@@ -58,7 +54,9 @@
 
 // FIXME: check the proper way to reference an undefined thread ID
 const int UndefinedThreadIdentifier = 0xffffffff;
- 
+
+const unsigned MaxNodesToDeletePerQuantum = 10;
+
 namespace WebCore {
 
 PassRefPtr<CachedAudio> AudioContext::createAudioRequest(const String &url, bool mixToMono)
@@ -102,10 +100,10 @@ AudioContext::AudioContext(Document* document)
     m_temporaryStereoBus = adoptPtr(new AudioBus(2, AudioNode::ProcessingSizeInFrames));
 
     // This sets in motion an asynchronous loading mechanism on another thread.
-    // We can check hrtfDatabaseLoader()->isLoaded() to find out whether or not it has been fully loaded.
+    // We can check m_hrtfDatabaseLoader->isLoaded() to find out whether or not it has been fully loaded.
     // It's not that useful to have a callback function for this since the audio thread automatically starts rendering on the graph
     // when this has finished (see AudioDestinationNode).
-    hrtfDatabaseLoader()->loadAsynchronously(sampleRate());
+    m_hrtfDatabaseLoader = HRTFDatabaseLoader::createAndLoadAsynchronouslyIfNecessary(sampleRate());
 }
 
 AudioContext::~AudioContext()
@@ -172,7 +170,7 @@ bool AudioContext::isRunnable() const
         return false;
     
     // Check with the HRTF spatialization system to see if it's finished loading.
-    return hrtfDatabaseLoader()->isLoaded();
+    return m_hrtfDatabaseLoader->isLoaded();
 }
 
 void AudioContext::stop()
@@ -346,10 +344,9 @@ void AudioContext::lock(bool& mustReleaseLock)
     } else {
         // Acquire the lock.
         m_contextGraphMutex.lock();
+        m_graphOwnerThread = thisThread;
         mustReleaseLock = true;
     }
-
-    m_graphOwnerThread = thisThread;
 }
 
 bool AudioContext::tryLock(bool& mustReleaseLock)
@@ -412,7 +409,7 @@ void AudioContext::addDeferredFinishDeref(AudioNode* node, AudioNode::RefType re
 void AudioContext::handlePostRenderTasks()
 {
     ASSERT(isAudioThread());
-    
+ 
     // Must use a tryLock() here too.  Don't worry, the lock will very rarely be contended and this method is called frequently.
     // The worst that can happen is that there will be some nodes which will take slightly longer than usual to be deleted or removed
     // from the render graph (in which case they'll render silence).
@@ -434,7 +431,7 @@ void AudioContext::handlePostRenderTasks()
 
 void AudioContext::handleDeferredFinishDerefs()
 {
-    ASSERT(isAudioThread());
+    ASSERT(isAudioThread() && isGraphOwner());
     for (unsigned i = 0; i < m_deferredFinishDerefList.size(); ++i) {
         AudioNode* node = m_deferredFinishDerefList[i].m_node;
         AudioNode::RefType refType = m_deferredFinishDerefList[i].m_refType;
@@ -455,10 +452,15 @@ void AudioContext::deleteMarkedNodes()
     ASSERT(isGraphOwner() || isAudioThreadFinished());
 
     // Note: deleting an AudioNode can cause m_nodesToDelete to grow.
+    size_t nodesDeleted = 0;
     while (size_t n = m_nodesToDelete.size()) {
         AudioNode* node = m_nodesToDelete[n - 1];
         m_nodesToDelete.removeLast();
         delete node;
+
+        // Don't delete too many nodes per render quantum since we don't want to do too much work in the realtime audio thread.
+        if (++nodesDeleted > MaxNodesToDeletePerQuantum)
+            break;
     }
 }
 
diff --git a/WebCore/webaudio/AudioContext.h b/WebCore/webaudio/AudioContext.h
index f175bfe..9fe1347 100644
--- a/WebCore/webaudio/AudioContext.h
+++ b/WebCore/webaudio/AudioContext.h
@@ -1,29 +1,25 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #ifndef AudioContext_h
@@ -32,6 +28,7 @@
 #include "ActiveDOMObject.h"
 #include "AudioBus.h"
 #include "AudioDestinationNode.h"
+#include "HRTFDatabaseLoader.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefCounted.h>
@@ -241,6 +238,9 @@ private:
 
     // Only accessed in the audio thread.
     Vector<RefInfo> m_deferredFinishDerefList;
+    
+    // HRTF Database loader
+    RefPtr<HRTFDatabaseLoader> m_hrtfDatabaseLoader;
 };
 
 } // WebCore
diff --git a/WebCore/webaudio/AudioContext.idl b/WebCore/webaudio/AudioContext.idl
index 8951121..35aea35 100644
--- a/WebCore/webaudio/AudioContext.idl
+++ b/WebCore/webaudio/AudioContext.idl
@@ -1,29 +1,25 @@
 /*
- * Copyright (C) 2010 Google Inc. All rights reserved.
+ * Copyright (C) 2010, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
- *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *    notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
  *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
  * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
  * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
  * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 module webaudio {
diff --git a/WebCore/webaudio/AudioGainNode.cpp b/WebCore/webaudio/AudioGainNode.cpp
new file mode 100644
index 0000000..332929d
--- /dev/null
+++ b/WebCore/webaudio/AudioGainNode.cpp
@@ -0,0 +1,116 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioGainNode.h"
+
+#include "AudioBus.h"
+#include "AudioNodeInput.h"
+#include "AudioNodeOutput.h"
+
+namespace WebCore {
+
+AudioGainNode::AudioGainNode(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
+    , m_lastGain(1.0)
+{
+    m_gain = AudioGain::create("gain", 1.0, 0.0, 1.0);
+
+    addInput(adoptPtr(new AudioNodeInput(this)));
+    addOutput(adoptPtr(new AudioNodeOutput(this, 1)));
+    
+    setType(NodeTypeGain);
+    
+    initialize();
+}
+
+void AudioGainNode::process(size_t /*framesToProcess*/)
+{
+    // FIXME: there is a nice optimization to avoid processing here, and let the gain change
+    // happen in the summing junction input of the AudioNode we're connected to.
+    // Then we can avoid all of the following:
+
+    AudioBus* outputBus = output(0)->bus();
+    ASSERT(outputBus);
+
+    // The realtime thread can't block on this lock, so we call tryLock() instead.
+    if (m_processLock.tryLock()) {
+        if (!isInitialized() || !input(0)->isConnected())
+            outputBus->zero();
+        else {
+            AudioBus* inputBus = input(0)->bus();
+
+            // Apply the gain with de-zippering into the output bus.
+            outputBus->copyWithGainFrom(*inputBus, &m_lastGain, gain()->value());
+        }
+
+        m_processLock.unlock();
+    } else {
+        // Too bad - the tryLock() failed.  We must be in the middle of re-connecting and were already outputting silence anyway...
+        outputBus->zero();
+    }
+}
+
+void AudioGainNode::reset()
+{
+    // Snap directly to desired gain.
+    m_lastGain = gain()->value();
+}
+
+// FIXME: this can go away when we do mixing with gain directly in summing junction of AudioNodeInput
+//
+// As soon as we know the channel count of our input, we can lazily initialize.
+// Sometimes this may be called more than once with different channel counts, in which case we must safely
+// uninitialize and then re-initialize with the new channel count.
+void AudioGainNode::checkNumberOfChannelsForInput(AudioNodeInput* input)
+{
+    ASSERT(input && input == this->input(0));
+    if (input != this->input(0))
+        return;
+        
+    unsigned numberOfChannels = input->numberOfChannels();    
+
+    if (isInitialized() && numberOfChannels != output(0)->numberOfChannels()) {
+        // We're already initialized but the channel count has changed.
+        // We need to be careful since we may be actively processing right now, so synchronize with process().
+        MutexLocker locker(m_processLock);
+        uninitialize();
+    }
+
+    // This will propagate the channel count to any nodes connected further downstream in the graph.
+    output(0)->setNumberOfChannels(numberOfChannels);
+
+    initialize();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/AudioGainNode.h b/WebCore/webaudio/AudioGainNode.h
new file mode 100644
index 0000000..91f9d16
--- /dev/null
+++ b/WebCore/webaudio/AudioGainNode.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioGainNode_h
+#define AudioGainNode_h
+
+#include "AudioGain.h"
+#include "AudioNode.h"
+#include <wtf/PassRefPtr.h>
+#include <wtf/Threading.h>
+
+namespace WebCore {
+
+class AudioContext;
+    
+// AudioGainNode is an AudioNode with one input and one output which applies a gain (volume) change to the audio signal.
+// De-zippering (smoothing) is applied when the gain value is changed dynamically.
+
+class AudioGainNode : public AudioNode {
+public:
+    static PassRefPtr<AudioGainNode> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new AudioGainNode(context, sampleRate));      
+    }
+    
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void reset();
+
+    // Called in the main thread when the number of channels for the input may have changed.
+    virtual void checkNumberOfChannelsForInput(AudioNodeInput*);
+
+    // JavaScript interface
+    AudioGain* gain() { return m_gain.get(); }                                   
+    
+private:
+    AudioGainNode(AudioContext*, double sampleRate);
+
+    double m_lastGain; // for de-zippering
+    RefPtr<AudioGain> m_gain;
+
+    // This synchronizes live channel count changes which require an uninitialization / re-initialization.
+    // FIXME: this can go away when we implement optimization for mixing with gain directly in summing junction of AudioNodeInput.
+    mutable Mutex m_processLock;
+};
+
+} // namespace WebCore
+
+#endif // AudioGainNode_h
diff --git a/WebCore/webaudio/AudioGainNode.idl b/WebCore/webaudio/AudioGainNode.idl
new file mode 100644
index 0000000..8bf117a
--- /dev/null
+++ b/WebCore/webaudio/AudioGainNode.idl
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    interface [
+        Conditional=WEB_AUDIO,
+        GenerateToJS
+    ] AudioGainNode : AudioNode {
+        // FIXME: eventually it will be interesting to remove the readonly restriction, but need to properly deal with thread safety here.
+        readonly attribute AudioGain gain;
+    };
+}
diff --git a/WebCore/webaudio/AudioNode.cpp b/WebCore/webaudio/AudioNode.cpp
index 497ac95..9335c10 100644
--- a/WebCore/webaudio/AudioNode.cpp
+++ b/WebCore/webaudio/AudioNode.cpp
@@ -67,6 +67,16 @@ AudioNode::~AudioNode()
 #endif
 }
 
+void AudioNode::initialize()
+{
+    m_isInitialized = true;
+}
+
+void AudioNode::uninitialize()
+{
+    m_isInitialized = false;
+}
+
 void AudioNode::setType(NodeType type)
 {
     m_type = type;
diff --git a/WebCore/webaudio/AudioNode.h b/WebCore/webaudio/AudioNode.h
index b697457..52f886d 100644
--- a/WebCore/webaudio/AudioNode.h
+++ b/WebCore/webaudio/AudioNode.h
@@ -100,8 +100,8 @@ public:
 
     // No significant resources should be allocated until initialize() is called.
     // Processing may not occur until a node is initialized.
-    virtual void initialize() = 0;
-    virtual void uninitialize() = 0;
+    virtual void initialize();
+    virtual void uninitialize();
 
     bool isInitialized() const { return m_isInitialized; }
     void lazyInitialize();
@@ -144,9 +144,8 @@ protected:
     // Called from context's audio thread.
     virtual void pullInputs(size_t framesToProcess);
 
-    bool m_isInitialized;
-
 private:
+    volatile bool m_isInitialized;
     NodeType m_type;
     RefPtr<AudioContext> m_context;
     double m_sampleRate;
diff --git a/WebCore/webaudio/AudioPannerNode.cpp b/WebCore/webaudio/AudioPannerNode.cpp
new file mode 100644
index 0000000..b7282e3
--- /dev/null
+++ b/WebCore/webaudio/AudioPannerNode.cpp
@@ -0,0 +1,321 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "AudioPannerNode.h"
+
+#include "AudioBufferSourceNode.h"
+#include "AudioBus.h"
+#include "AudioContext.h"
+#include "AudioNodeInput.h"
+#include "AudioNodeOutput.h"
+#include "HRTFPanner.h"
+#include <wtf/MathExtras.h>
+
+using namespace std;
+
+namespace WebCore {
+
+static void fixNANs(double &x)
+{
+    if (isnan(x) || isinf(x))
+        x = 0.0;
+}
+
+AudioPannerNode::AudioPannerNode(AudioContext* context, double sampleRate)
+    : AudioNode(context, sampleRate)
+    , m_panningModel(Panner::PanningModelHRTF)
+    , m_lastGain(-1.0)
+    , m_connectionCount(0)
+{
+    addInput(adoptPtr(new AudioNodeInput(this)));
+    addOutput(adoptPtr(new AudioNodeOutput(this, 2)));
+    
+    m_distanceGain = AudioGain::create("distanceGain", 1.0, 0.0, 1.0);
+    m_coneGain = AudioGain::create("coneGain", 1.0, 0.0, 1.0);
+
+    m_position = Vector3(0, 0, 0);
+    m_orientation = Vector3(1, 0, 0);
+    m_velocity = Vector3(0, 0, 0);
+    
+    setType(NodeTypePanner);
+
+    initialize();
+}
+
+AudioPannerNode::~AudioPannerNode()
+{
+    uninitialize();
+}
+
+void AudioPannerNode::pullInputs(size_t framesToProcess)
+{
+    // We override pullInputs(), so we can detect new AudioSourceNodes which have connected to us when new connections are made.
+    // These AudioSourceNodes need to be made aware of our existence in order to handle doppler shift pitch changes.
+    if (m_connectionCount != context()->connectionCount()) {
+        m_connectionCount = context()->connectionCount();
+
+        // Recursively go through all nodes connected to us.
+        notifyAudioSourcesConnectedToNode(this);
+    }
+    
+    AudioNode::pullInputs(framesToProcess);
+}
+
+void AudioPannerNode::process(size_t framesToProcess)
+{
+    AudioBus* destination = output(0)->bus();
+
+    if (!isInitialized() || !input(0)->isConnected() || !m_panner.get()) {
+        destination->zero();
+        return;
+    }
+
+    AudioBus* source = input(0)->bus();
+
+    if (!source) {
+        destination->zero();
+        return;
+    }
+
+    // Apply the panning effect.
+    double azimuth;
+    double elevation;
+    getAzimuthElevation(&azimuth, &elevation);
+    m_panner->pan(azimuth, elevation, source, destination, framesToProcess);
+
+    // Get the distance and cone gain.
+    double totalGain = distanceConeGain();
+
+    // Snap to desired gain at the beginning.
+    if (m_lastGain == -1.0)
+        m_lastGain = totalGain;
+        
+    // Apply gain in-place with de-zippering.
+    destination->copyWithGainFrom(*destination, &m_lastGain, totalGain);
+}
+
+void AudioPannerNode::reset()
+{
+    m_lastGain = -1.0; // force to snap to initial gain
+    if (m_panner.get())
+        m_panner->reset();
+}
+
+void AudioPannerNode::initialize()
+{
+    if (isInitialized())
+        return;
+        
+    m_panner = Panner::create(m_panningModel, sampleRate());
+
+    AudioNode::initialize();
+}
+
+void AudioPannerNode::uninitialize()
+{
+    if (!isInitialized())
+        return;
+        
+    m_panner.clear();
+    AudioNode::uninitialize();
+}
+
+AudioListener* AudioPannerNode::listener()
+{
+    return context()->listener();
+}
+
+void AudioPannerNode::setPanningModel(unsigned short model)
+{
+    if (!m_panner.get() || model != m_panningModel) {
+        OwnPtr<Panner> newPanner = Panner::create(model, sampleRate());
+        m_panner = newPanner.release();
+    }
+}
+
+void AudioPannerNode::getAzimuthElevation(double* outAzimuth, double* outElevation)
+{
+    // FIXME: we should cache azimuth and elevation (if possible), so we only re-calculate if a change has been made.
+
+    double azimuth = 0.0;
+
+    // Calculate the source-listener vector
+    Vector3 listenerPosition = listener()->position();
+    Vector3 sourceListener = m_position - listenerPosition;
+
+    if (sourceListener.isZero()) {
+        // degenerate case if source and listener are at the same point
+        *outAzimuth = 0.0;
+        *outElevation = 0.0;
+        return;
+    }
+
+    sourceListener.normalize();
+
+    // Align axes
+    Vector3 listenerFront = listener()->orientation();
+    Vector3 listenerUp = listener()->upVector();
+    Vector3 listenerRight = cross(listenerFront, listenerUp);
+    listenerRight.normalize();
+
+    Vector3 listenerFrontNorm = listenerFront;
+    listenerFrontNorm.normalize();
+
+    Vector3 up = cross(listenerRight, listenerFrontNorm);
+
+    double upProjection = dot(sourceListener, up);
+
+    Vector3 projectedSource = sourceListener - upProjection * up;
+    projectedSource.normalize();
+
+    azimuth = 180.0 * acos(dot(projectedSource, listenerRight)) / M_PI;
+    fixNANs(azimuth); // avoid illegal values
+
+    // Source  in front or behind the listener
+    double frontBack = dot(projectedSource, listenerFrontNorm);
+    if (frontBack < 0.0)
+        azimuth = 360.0 - azimuth;
+
+    // Make azimuth relative to "front" and not "right" listener vector
+    if ((azimuth >= 0.0) && (azimuth <= 270.0))
+        azimuth = 90.0 - azimuth;
+    else
+        azimuth = 450.0 - azimuth;
+
+    // Elevation
+    double elevation = 90.0 - 180.0 * acos(dot(sourceListener, up)) / M_PI;
+    fixNANs(azimuth); // avoid illegal values
+
+    if (elevation > 90.0)
+        elevation = 180.0 - elevation;
+    else if (elevation < -90.0)
+        elevation = -180.0 - elevation;
+
+    if (outAzimuth)
+        *outAzimuth = azimuth;
+    if (outElevation)
+        *outElevation = elevation;
+}
+
+float AudioPannerNode::dopplerRate()
+{
+    double dopplerShift = 1.0;
+
+    // FIXME: optimize for case when neither source nor listener has changed...
+    double dopplerFactor = listener()->dopplerFactor();
+
+    if (dopplerFactor > 0.0) {
+        double speedOfSound = listener()->speedOfSound();
+
+        const Vector3 &sourceVelocity = m_velocity;
+        const Vector3 &listenerVelocity = listener()->velocity();
+
+        // Don't bother if both source and listener have no velocity
+        bool sourceHasVelocity = !sourceVelocity.isZero();
+        bool listenerHasVelocity = !listenerVelocity.isZero();
+
+        if (sourceHasVelocity || listenerHasVelocity) {
+            // Calculate the source to listener vector
+            Vector3 listenerPosition = listener()->position();
+            Vector3 sourceToListener = m_position - listenerPosition;
+
+            double sourceListenerMagnitude = sourceToListener.abs();
+
+            double listenerProjection = dot(sourceToListener, listenerVelocity) / sourceListenerMagnitude;
+            double sourceProjection = dot(sourceToListener, sourceVelocity) / sourceListenerMagnitude;
+
+            listenerProjection = -listenerProjection;
+            sourceProjection = -sourceProjection;
+
+            double scaledSpeedOfSound = speedOfSound / dopplerFactor;
+            listenerProjection = min(listenerProjection, scaledSpeedOfSound);
+            sourceProjection = min(sourceProjection, scaledSpeedOfSound);
+
+            dopplerShift = ((speedOfSound - dopplerFactor * listenerProjection) / (speedOfSound - dopplerFactor * sourceProjection));
+            fixNANs(dopplerShift); // avoid illegal values
+
+            // Limit the pitch shifting to 4 octaves up and 3 octaves down.
+            if (dopplerShift > 16.0)
+                dopplerShift = 16.0;
+            else if (dopplerShift < 0.125)
+                dopplerShift = 0.125;   
+        }
+    }
+
+    return static_cast<float>(dopplerShift);
+}
+
+float AudioPannerNode::distanceConeGain()
+{
+    Vector3 listenerPosition = listener()->position();
+
+    double listenerDistance = distance(m_position, listenerPosition);
+    double distanceGain = m_distanceEffect.gain(listenerDistance);
+    
+    m_distanceGain->setValue(static_cast<float>(distanceGain));
+
+    // FIXME: could optimize by caching coneGain
+    double coneGain = m_coneEffect.gain(m_position, m_orientation, listenerPosition);
+    
+    m_coneGain->setValue(static_cast<float>(coneGain));
+
+    return float(distanceGain * coneGain);
+}
+
+void AudioPannerNode::notifyAudioSourcesConnectedToNode(AudioNode* node)
+{
+    ASSERT(node);
+    if (!node)
+        return;
+        
+    // First check if this node is an AudioBufferSourceNode.  If so, let it know about us so that doppler shift pitch can be taken into account.
+    if (node->type() == NodeTypeAudioBufferSource) {
+        AudioBufferSourceNode* bufferSourceNode = reinterpret_cast<AudioBufferSourceNode*>(node);
+        bufferSourceNode->setPannerNode(this);
+    } else {    
+        // Go through all inputs to this node.
+        for (unsigned i = 0; i < node->numberOfInputs(); ++i) {
+            AudioNodeInput* input = node->input(i);
+
+            // For each input, go through all of its connections, looking for AudioBufferSourceNodes.
+            for (unsigned j = 0; j < input->numberOfConnections(); ++j) {
+                AudioNodeOutput* connectedOutput = input->output(j);
+                AudioNode* connectedNode = connectedOutput->node();
+                notifyAudioSourcesConnectedToNode(connectedNode); // recurse
+            }
+        }
+    }
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/AudioPannerNode.h b/WebCore/webaudio/AudioPannerNode.h
new file mode 100644
index 0000000..144b61b
--- /dev/null
+++ b/WebCore/webaudio/AudioPannerNode.h
@@ -0,0 +1,154 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef AudioPannerNode_h
+#define AudioPannerNode_h
+
+#include "AudioBus.h"
+#include "AudioGain.h"
+#include "AudioListener.h"
+#include "AudioNode.h"
+#include "Cone.h"
+#include "Distance.h"
+#include "Panner.h"
+#include <wtf/OwnPtr.h>
+#include <wtf/Vector3.h>
+
+namespace WebCore {
+
+// AudioPannerNode is an AudioNode with one input and one output.
+// It positions a sound in 3D space, with the exact effect dependent on the panning model.
+// It has a position and an orientation in 3D space which is relative to the position and orientation of the context's AudioListener.
+// A distance effect will attenuate the gain as the position moves away from the listener.
+// A cone effect will attenuate the gain as the orientation moves away from the listener.
+// All of these effects follow the OpenAL specification very closely.
+
+class AudioPannerNode : public AudioNode {
+public:
+    enum {
+        PASSTHROUGH = 0,
+        EQUALPOWER = 1,
+        HRTF = 2,
+        SOUNDFIELD = 3,
+        MATRIXMIX = 4
+    };
+
+    static PassRefPtr<AudioPannerNode> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new AudioPannerNode(context, sampleRate));
+    }
+
+    virtual ~AudioPannerNode();
+
+    // AudioNode
+    virtual void process(size_t framesToProcess);
+    virtual void pullInputs(size_t framesToProcess);
+    virtual void reset();
+    virtual void initialize();
+    virtual void uninitialize();
+
+    // Listener
+    AudioListener* listener();
+
+    // Panning model
+    unsigned short panningModel() const { return m_panningModel; }
+    void setPanningModel(unsigned short);
+
+    // Position
+    Vector3 position() const { return m_position; }
+    void setPosition(float x, float y, float z) { m_position = Vector3(x, y, z); }
+
+    // Orientation
+    Vector3 orientation() const { return m_position; }
+    void setOrientation(float x, float y, float z) { m_orientation = Vector3(x, y, z); }
+
+    // Velocity
+    Vector3 velocity() const { return m_velocity; }
+    void setVelocity(float x, float y, float z) { m_velocity = Vector3(x, y, z); }
+
+    // Distance parameters
+    unsigned short distanceModel() { return m_distanceEffect.model(); }
+    void setDistanceModel(unsigned short model) { m_distanceEffect.setModel(static_cast<DistanceEffect::ModelType>(model), true); }
+    
+    float refDistance() { return static_cast<float>(m_distanceEffect.refDistance()); }
+    void setRefDistance(float refDistance) { m_distanceEffect.setRefDistance(refDistance); }
+
+    float maxDistance() { return static_cast<float>(m_distanceEffect.maxDistance()); }
+    void setMaxDistance(float maxDistance) { m_distanceEffect.setMaxDistance(maxDistance); }
+
+    float rolloffFactor() { return static_cast<float>(m_distanceEffect.rolloffFactor()); }
+    void setRolloffFactor(float rolloffFactor) { m_distanceEffect.setRolloffFactor(rolloffFactor); }
+
+    // Sound cones - angles in degrees
+    float coneInnerAngle() const { return static_cast<float>(m_coneEffect.innerAngle()); }
+    void setConeInnerAngle(float angle) { m_coneEffect.setInnerAngle(angle); }
+
+    float coneOuterAngle() const { return static_cast<float>(m_coneEffect.outerAngle()); }
+    void setConeOuterAngle(float angle) { m_coneEffect.setOuterAngle(angle); }
+
+    float coneOuterGain() const { return static_cast<float>(m_coneEffect.outerGain()); }
+    void setConeOuterGain(float angle) { m_coneEffect.setOuterGain(angle); }
+
+    void getAzimuthElevation(double* outAzimuth, double* outElevation);
+    float dopplerRate();
+
+    // Accessors for dynamically calculated gain values.
+    AudioGain* distanceGain() { return m_distanceGain.get(); }                                        
+    AudioGain* coneGain() { return m_coneGain.get(); }                                        
+
+private:
+    AudioPannerNode(AudioContext*, double sampleRate);
+
+    // Returns the combined distance and cone gain attenuation.
+    float distanceConeGain();
+
+    // Notifies any AudioBufferSourceNodes connected to us either directly or indirectly about our existence.
+    // This is in order to handle the pitch change necessary for the doppler shift.
+    void notifyAudioSourcesConnectedToNode(AudioNode*);
+
+    OwnPtr<Panner> m_panner;
+    unsigned m_panningModel;
+
+    // FIXME: upgrade to FloatPoint3D from Vector3.
+    Vector3 m_position;
+    Vector3 m_orientation;
+    Vector3 m_velocity;
+
+    // Gain
+    RefPtr<AudioGain> m_distanceGain;
+    RefPtr<AudioGain> m_coneGain;
+    DistanceEffect m_distanceEffect;
+    ConeEffect m_coneEffect;
+    double m_lastGain;
+
+    unsigned m_connectionCount;
+};
+
+} // namespace WebCore
+
+#endif // AudioPannerNode_h
diff --git a/WebCore/webaudio/AudioPannerNode.idl b/WebCore/webaudio/AudioPannerNode.idl
new file mode 100644
index 0000000..eb6db40
--- /dev/null
+++ b/WebCore/webaudio/AudioPannerNode.idl
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    interface [
+        Conditional=WEB_AUDIO,
+        GenerateConstructor,
+        GenerateToJS
+    ] AudioPannerNode : AudioNode {
+        // Panning model
+        const unsigned short PASSTHROUGH = 0;
+        const unsigned short EQUALPOWER = 1;
+        const unsigned short HRTF = 2;
+        const unsigned short SOUNDFIELD = 3;
+
+        // Default model for stereo is HRTF 
+        attribute unsigned long panningModel; // FIXME: use unsigned short when glue generation supports it
+
+        // Uses a 3D cartesian coordinate system 
+        void setPosition(in float x, in float y, in float z);
+        void setOrientation(in float x, in float y, in float z);
+        void setVelocity(in float x, in float y, in float z);
+
+        // Distance model
+        attribute unsigned long distanceModel; // FIXME: use unsigned short when glue generation supports it
+        attribute float refDistance;
+        attribute float maxDistance;
+        attribute float rolloffFactor;
+
+        // Directional sound cone
+        attribute float coneInnerAngle;
+        attribute float coneOuterAngle;
+        attribute float coneOuterGain;
+
+        // Dynamically calculated gain values          
+        readonly attribute AudioGain coneGain;
+        readonly attribute AudioGain distanceGain;
+    };
+}
diff --git a/WebCore/webaudio/BiquadDSPKernel.cpp b/WebCore/webaudio/BiquadDSPKernel.cpp
new file mode 100644
index 0000000..a4b28be
--- /dev/null
+++ b/WebCore/webaudio/BiquadDSPKernel.cpp
@@ -0,0 +1,77 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "BiquadDSPKernel.h"
+
+#include "BiquadProcessor.h"
+
+namespace WebCore {
+
+void BiquadDSPKernel::process(const float* source, float* destination, size_t framesToProcess)
+{
+    ASSERT(source && destination && biquadProcessor());
+    
+    // Recompute filter coefficients if any of the parameters have changed.
+    // FIXME: as an optimization, implement a way that a Biquad object can simply copy its internal filter coefficients from another Biquad object.
+    // Then re-factor this code to only run for the first BiquadDSPKernel of each BiquadProcessor.
+    if (biquadProcessor()->filterCoefficientsDirty()) {
+        double value1 = biquadProcessor()->parameter1()->smoothedValue();
+        double value2 = biquadProcessor()->parameter2()->smoothedValue();
+        
+        // Convert from Hertz to normalized frequency 0 -> 1.
+        double nyquist = this->nyquist();
+        double normalizedValue1 = value1 / nyquist;
+
+        // Configure the biquad with the new filter parameters for the appropriate type of filter.
+        switch (biquadProcessor()->type()) {
+        case BiquadProcessor::LowPass2:
+            m_biquad.setLowpassParams(normalizedValue1, value2);
+            break;
+
+        case BiquadProcessor::HighPass2:
+            m_biquad.setHighpassParams(normalizedValue1, value2);
+            break;
+
+        case BiquadProcessor::LowShelf:
+            m_biquad.setLowShelfParams(normalizedValue1, value2);
+            break;
+
+        // FIXME: add other biquad filter types...
+        case BiquadProcessor::Peaking:
+        case BiquadProcessor::Allpass:
+        case BiquadProcessor::HighShelf:
+            break;
+        }
+    }
+
+    m_biquad.process(source, destination, framesToProcess);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/BiquadDSPKernel.h b/WebCore/webaudio/BiquadDSPKernel.h
new file mode 100644
index 0000000..47d0f34
--- /dev/null
+++ b/WebCore/webaudio/BiquadDSPKernel.h
@@ -0,0 +1,56 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BiquadDSPKernel_h
+#define BiquadDSPKernel_h
+
+#include "AudioDSPKernel.h"
+#include "Biquad.h"
+#include "BiquadProcessor.h"
+
+namespace WebCore {
+
+class BiquadProcessor;
+
+// BiquadDSPKernel is an AudioDSPKernel and is responsible for filtering one channel of a BiquadProcessor using a Biquad object.
+
+class BiquadDSPKernel : public AudioDSPKernel {
+public:  
+    BiquadDSPKernel(BiquadProcessor* processor)
+    : AudioDSPKernel(processor)
+    {
+    }
+    
+    // AudioDSPKernel
+    virtual void process(const float* source, float* dest, size_t framesToProcess);
+    virtual void reset() { m_biquad.reset(); }
+    
+protected:
+    Biquad m_biquad;
+    BiquadProcessor* biquadProcessor() { return static_cast<BiquadProcessor*>(processor()); }
+};
+
+} // namespace WebCore
+
+#endif // BiquadDSPKernel_h
diff --git a/WebCore/webaudio/BiquadProcessor.cpp b/WebCore/webaudio/BiquadProcessor.cpp
new file mode 100644
index 0000000..97a480e
--- /dev/null
+++ b/WebCore/webaudio/BiquadProcessor.cpp
@@ -0,0 +1,125 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "BiquadProcessor.h"
+
+#include "BiquadDSPKernel.h"
+
+namespace WebCore {
+
+BiquadProcessor::BiquadProcessor(FilterType type, double sampleRate, size_t numberOfChannels, bool autoInitialize)
+    : AudioDSPKernelProcessor(sampleRate, numberOfChannels)
+    , m_type(type)
+    , m_parameter1(0)
+    , m_parameter2(0)
+    , m_parameter3(0)
+    , m_filterCoefficientsDirty(true)
+{
+    double nyquist = 0.5 * this->sampleRate();
+    
+    switch (type) {
+    // Highpass and lowpass share the same parameters and only differ in filter type.
+    case LowPass2:
+    case HighPass2:
+        m_parameter1 = AudioParam::create("frequency", 350.0, 20.0, nyquist);
+        m_parameter2 = AudioParam::create("resonance", 0.0, -20.0, 20.0);
+        m_parameter3 = AudioParam::create("unused", 0.0, 0.0, 1.0);
+        break;
+
+    case Peaking:
+        m_parameter1 = AudioParam::create("frequency", 2500.0, 20.0, nyquist);
+        m_parameter2 = AudioParam::create("gain", 0.0, -20.0, 20.0);
+        m_parameter3 = AudioParam::create("Q", 0.5, 0.0, 1000.0);
+        break;
+    case Allpass:
+        m_parameter1 = AudioParam::create("frequency", 2500.0, 20.0, nyquist);
+        m_parameter2 = AudioParam::create("Q", 0.5, 0.0, 1000.0);
+        m_parameter3 = AudioParam::create("unused", 0.0, 0.0, 1.0);
+        break;
+    case LowShelf:
+        m_parameter1 = AudioParam::create("frequency", 80.0, 20.0, nyquist);
+        m_parameter2 = AudioParam::create("gain", 0.0, 0.0, 1.0);
+        m_parameter3 = AudioParam::create("unused", 0.0, 0.0, 1.0);
+        break;
+    case HighShelf:
+        m_parameter1 = AudioParam::create("frequency", 10000.0, 20.0, nyquist);
+        m_parameter2 = AudioParam::create("gain", 0.0, 0.0, 1.0);
+        m_parameter3 = AudioParam::create("unused", 0.0, 0.0, 1.0);
+        break;
+    }
+
+    if (autoInitialize)
+        initialize();
+}
+
+BiquadProcessor::~BiquadProcessor()
+{
+    if (isInitialized())
+        uninitialize();
+}
+
+PassOwnPtr<AudioDSPKernel> BiquadProcessor::createKernel()
+{
+    return adoptPtr(new BiquadDSPKernel(this));
+}
+
+void BiquadProcessor::process(AudioBus* source, AudioBus* destination, size_t framesToProcess)
+{
+    if (!isInitialized()) {
+        destination->zero();
+        return;
+    }
+        
+    // Deal with smoothing / de-zippering.  Start out assuming filter parameters are not changing.
+    // The BiquadDSPKernel objects rely on this value to see if they need to re-compute their internal filter coefficients.
+    m_filterCoefficientsDirty = false;
+    
+    if (m_hasJustReset) {
+        // Snap to exact values first time after reset, then smooth for subsequent changes.
+        m_parameter1->resetSmoothedValue();
+        m_parameter2->resetSmoothedValue();
+        m_parameter3->resetSmoothedValue();
+        m_filterCoefficientsDirty = true;
+        m_hasJustReset = false;
+    } else {
+        // Smooth all of the filter parameters.  If they haven't yet converged to their target value then mark coefficients as dirty.
+        bool isStable1 = m_parameter1->smooth();
+        bool isStable2 = m_parameter2->smooth();
+        bool isStable3 = m_parameter3->smooth();
+        if (!(isStable1 && isStable2 && isStable3))
+            m_filterCoefficientsDirty = true;
+    }
+        
+    // For each channel of our input, process using the corresponding BiquadDSPKernel into the output channel.
+    for (unsigned i = 0; i < m_kernels.size(); ++i)
+        m_kernels[i]->process(source->channel(i)->data(), destination->channel(i)->data(), framesToProcess);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/BiquadProcessor.h b/WebCore/webaudio/BiquadProcessor.h
new file mode 100644
index 0000000..55dca33
--- /dev/null
+++ b/WebCore/webaudio/BiquadProcessor.h
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef BiquadProcessor_h
+#define BiquadProcessor_h
+
+#include "AudioDSPKernel.h"
+#include "AudioDSPKernelProcessor.h"
+#include "AudioNode.h"
+#include "AudioParam.h"
+#include "Biquad.h"
+#include <wtf/RefPtr.h>
+
+namespace WebCore {
+
+// BiquadProcessor is an AudioDSPKernelProcessor which uses Biquad objects to implement several common filters.
+
+class BiquadProcessor : public AudioDSPKernelProcessor {
+public:
+    enum FilterType {
+        LowPass2,
+        HighPass2,
+        Peaking,
+        Allpass,
+        LowShelf,
+        HighShelf
+    };
+    
+    BiquadProcessor(FilterType, double sampleRate, size_t numberOfChannels, bool autoInitialize = true);
+    virtual ~BiquadProcessor();
+    
+    virtual PassOwnPtr<AudioDSPKernel> createKernel();
+        
+    virtual void process(AudioBus* source, AudioBus* destination, size_t framesToProcess);
+
+    bool filterCoefficientsDirty() const { return m_filterCoefficientsDirty; }
+
+    AudioParam* parameter1() { return m_parameter1.get(); }
+    AudioParam* parameter2() { return m_parameter2.get(); }
+    AudioParam* parameter3() { return m_parameter3.get(); }
+
+    FilterType type() const { return m_type; }
+
+private:
+    FilterType m_type;
+
+    RefPtr<AudioParam> m_parameter1;
+    RefPtr<AudioParam> m_parameter2;
+    RefPtr<AudioParam> m_parameter3;
+
+    // so DSP kernels know when to re-compute coefficients
+    bool m_filterCoefficientsDirty;
+};
+
+} // namespace WebCore
+
+#endif // BiquadProcessor_h
diff --git a/WebCore/webaudio/DelayDSPKernel.cpp b/WebCore/webaudio/DelayDSPKernel.cpp
new file mode 100644
index 0000000..9cb0450
--- /dev/null
+++ b/WebCore/webaudio/DelayDSPKernel.cpp
@@ -0,0 +1,140 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "DelayDSPKernel.h"
+
+#include "AudioUtilities.h"
+#include <algorithm>
+
+using namespace std;
+  
+const double DefaultMaxDelayTime = 1.0;
+const double SmoothingTimeConstant = 0.020; // 20ms
+  
+namespace WebCore {
+
+DelayDSPKernel::DelayDSPKernel(DelayProcessor* processor)
+    : AudioDSPKernel(processor)
+    , m_maxDelayTime(DefaultMaxDelayTime)
+    , m_writeIndex(0)
+    , m_firstTime(true)
+{
+    ASSERT(processor && processor->sampleRate() > 0);
+    if (!processor)
+        return;
+
+    m_buffer.resize(static_cast<size_t>(processor->sampleRate() * DefaultMaxDelayTime));
+    m_buffer.zero();
+
+    m_smoothingRate = AudioUtilities::discreteTimeConstantForSampleRate(SmoothingTimeConstant, processor->sampleRate());
+}
+
+DelayDSPKernel::DelayDSPKernel(double maxDelayTime, double sampleRate)
+    : AudioDSPKernel(sampleRate)
+    , m_maxDelayTime(maxDelayTime)
+    , m_writeIndex(0)
+    , m_firstTime(true)
+{
+    ASSERT(maxDelayTime > 0.0);
+    if (maxDelayTime <= 0.0)
+        return;
+        
+    size_t bufferLength = static_cast<size_t>(sampleRate * maxDelayTime);
+    ASSERT(bufferLength);
+    if (!bufferLength)
+        return;
+    
+    m_buffer.resize(bufferLength);
+    m_buffer.zero();
+
+    m_smoothingRate = AudioUtilities::discreteTimeConstantForSampleRate(SmoothingTimeConstant, sampleRate);
+}
+
+void DelayDSPKernel::process(const float* source, float* destination, size_t framesToProcess)
+{
+    size_t bufferLength = m_buffer.size();
+    float* buffer = m_buffer.data();
+
+    ASSERT(bufferLength);
+    if (!bufferLength)
+        return;
+        
+    ASSERT(source && destination);
+    if (!source || !destination)
+        return;
+        
+    double sampleRate = this->sampleRate();
+    double delayTime = delayProcessor() ? delayProcessor()->delayTime()->value() : m_desiredDelayFrames / sampleRate;
+
+    // Make sure the delay time is in a valid range.
+    delayTime = min(maxDelayTime(), delayTime);
+    delayTime = max(0.0, delayTime);
+
+    if (m_firstTime) {
+        m_currentDelayTime = delayTime;
+        m_firstTime = false;
+    }
+    
+    int n = framesToProcess;
+    while (n--) {
+        // Approach desired delay time.
+        m_currentDelayTime += (delayTime - m_currentDelayTime) * m_smoothingRate;
+
+        double desiredDelayFrames = m_currentDelayTime * sampleRate;
+
+        double readPosition = m_writeIndex + bufferLength - desiredDelayFrames;
+        if (readPosition > bufferLength)
+            readPosition -= bufferLength;
+
+        // Linearly interpolate in-between delay times.
+        int readIndex1 = static_cast<int>(readPosition);
+        int readIndex2 = (readIndex1 + 1) % bufferLength;
+        double interpolationFactor = readPosition - readIndex1;
+
+        double input = static_cast<float>(*source++);
+        buffer[m_writeIndex] = static_cast<float>(input);
+        m_writeIndex = (m_writeIndex + 1) % bufferLength;        
+        
+        double sample1 = buffer[readIndex1];
+        double sample2 = buffer[readIndex2];
+        
+        double output = (1.0 - interpolationFactor) * sample1 + interpolationFactor * sample2;
+
+        *destination++ = static_cast<float>(output);
+    }        
+}
+
+void DelayDSPKernel::reset()
+{
+    m_firstTime = true;
+    m_buffer.zero();
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/DelayDSPKernel.h b/WebCore/webaudio/DelayDSPKernel.h
new file mode 100644
index 0000000..2ae36cb
--- /dev/null
+++ b/WebCore/webaudio/DelayDSPKernel.h
@@ -0,0 +1,62 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef DelayDSPKernel_h
+#define DelayDSPKernel_h
+
+#include "AudioArray.h"
+#include "AudioDSPKernel.h"
+#include "DelayProcessor.h"
+
+namespace WebCore {
+
+class DelayProcessor;
+    
+class DelayDSPKernel : public AudioDSPKernel {
+public:  
+    DelayDSPKernel(DelayProcessor*);
+    DelayDSPKernel(double maxDelayTime, double sampleRate);
+    
+    virtual void process(const float* source, float* destination, size_t framesToProcess);
+    virtual void reset();
+    
+    double maxDelayTime() const { return m_maxDelayTime; }
+    
+    void setDelayFrames(double numberOfFrames) { m_desiredDelayFrames = numberOfFrames; }
+    
+private:
+    AudioFloatArray m_buffer;
+    double m_maxDelayTime;
+    int m_writeIndex;
+    double m_currentDelayTime;
+    double m_smoothingRate;
+    bool m_firstTime;
+    double m_desiredDelayFrames;
+
+    DelayProcessor* delayProcessor() { return static_cast<DelayProcessor*>(processor()); }
+};
+
+} // namespace WebCore
+
+#endif // DelayDSPKernel_h
diff --git a/WebCore/webaudio/HighPass2FilterNode.cpp b/WebCore/webaudio/HighPass2FilterNode.cpp
new file mode 100644
index 0000000..ca33784
--- /dev/null
+++ b/WebCore/webaudio/HighPass2FilterNode.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "HighPass2FilterNode.h"
+
+namespace WebCore {
+
+HighPass2FilterNode::HighPass2FilterNode(AudioContext* context, double sampleRate)
+    : AudioBasicProcessorNode(context, sampleRate)
+{
+    m_processor = adoptPtr(new BiquadProcessor(BiquadProcessor::HighPass2, sampleRate, 1, false));
+    setType(NodeTypeHighPass2Filter);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/HighPass2FilterNode.h b/WebCore/webaudio/HighPass2FilterNode.h
new file mode 100644
index 0000000..be0beb6
--- /dev/null
+++ b/WebCore/webaudio/HighPass2FilterNode.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef HighPass2FilterNode_h
+#define HighPass2FilterNode_h
+
+#include "AudioBasicProcessorNode.h"
+#include "BiquadProcessor.h"
+
+namespace WebCore {
+
+class AudioParam;
+    
+class HighPass2FilterNode : public AudioBasicProcessorNode {
+public:
+    static PassRefPtr<HighPass2FilterNode> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new HighPass2FilterNode(context, sampleRate));      
+    }
+
+    AudioParam* cutoff() { return biquadProcessor()->parameter1(); }
+    AudioParam* resonance() { return biquadProcessor()->parameter2(); }
+    
+private:
+    HighPass2FilterNode(AudioContext*, double sampleRate);
+
+    BiquadProcessor* biquadProcessor() { return static_cast<BiquadProcessor*>(processor()); }
+};
+
+} // namespace WebCore
+
+#endif // HighPass2FilterNode_h
diff --git a/WebCore/webaudio/HighPass2FilterNode.idl b/WebCore/webaudio/HighPass2FilterNode.idl
new file mode 100644
index 0000000..399f9b5
--- /dev/null
+++ b/WebCore/webaudio/HighPass2FilterNode.idl
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    // Two-pole highpass filter
+    // FIXME: design BiquadNode and use instead of this
+    interface [
+        Conditional=WEB_AUDIO,
+        GenerateToJS
+    ] HighPass2FilterNode : AudioNode {
+        readonly attribute AudioParam cutoff;
+        readonly attribute AudioParam resonance;
+    };
+}
diff --git a/WebCore/webaudio/LowPass2FilterNode.cpp b/WebCore/webaudio/LowPass2FilterNode.cpp
new file mode 100644
index 0000000..691f4ed
--- /dev/null
+++ b/WebCore/webaudio/LowPass2FilterNode.cpp
@@ -0,0 +1,42 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+
+#if ENABLE(WEB_AUDIO)
+
+#include "LowPass2FilterNode.h"
+
+namespace WebCore {
+
+LowPass2FilterNode::LowPass2FilterNode(AudioContext* context, double sampleRate)
+    : AudioBasicProcessorNode(context, sampleRate)
+{
+    m_processor = adoptPtr(new BiquadProcessor(BiquadProcessor::LowPass2, sampleRate, 1, false));
+    setType(NodeTypeLowPass2Filter);
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(WEB_AUDIO)
diff --git a/WebCore/webaudio/LowPass2FilterNode.h b/WebCore/webaudio/LowPass2FilterNode.h
new file mode 100644
index 0000000..43d7051
--- /dev/null
+++ b/WebCore/webaudio/LowPass2FilterNode.h
@@ -0,0 +1,53 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef LowPass2FilterNode_h
+#define LowPass2FilterNode_h
+
+#include "AudioBasicProcessorNode.h"
+#include "BiquadProcessor.h"
+
+namespace WebCore {
+
+class AudioParam;
+    
+class LowPass2FilterNode : public AudioBasicProcessorNode {
+public:
+    static PassRefPtr<LowPass2FilterNode> create(AudioContext* context, double sampleRate)
+    {
+        return adoptRef(new LowPass2FilterNode(context, sampleRate));      
+    }
+
+    AudioParam* cutoff() { return biquadProcessor()->parameter1(); }
+    AudioParam* resonance() { return biquadProcessor()->parameter2(); }
+    
+private:
+    LowPass2FilterNode(AudioContext*, double sampleRate);
+
+    BiquadProcessor* biquadProcessor() { return static_cast<BiquadProcessor*>(processor()); }
+};
+
+} // namespace WebCore
+
+#endif // LowPass2FilterNode_h
diff --git a/WebCore/webaudio/LowPass2FilterNode.idl b/WebCore/webaudio/LowPass2FilterNode.idl
new file mode 100644
index 0000000..310c21e
--- /dev/null
+++ b/WebCore/webaudio/LowPass2FilterNode.idl
@@ -0,0 +1,35 @@
+/*
+ * Copyright (C) 2010, Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1.  Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+ * ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+ * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+module audio {
+    // Two-pole lowpass filter
+    // FIXME: design BiquadNode and use instead of this
+    interface [
+        Conditional=WEB_AUDIO,
+        GenerateToJS
+    ] LowPass2FilterNode : AudioNode {
+        readonly attribute AudioParam cutoff;
+        readonly attribute AudioParam resonance;
+    };
+}
diff --git a/WebCore/websockets/WebSocket.cpp b/WebCore/websockets/WebSocket.cpp
index 073a924..358a742 100644
--- a/WebCore/websockets/WebSocket.cpp
+++ b/WebCore/websockets/WebSocket.cpp
@@ -42,11 +42,12 @@
 #include "Logging.h"
 #include "MessageEvent.h"
 #include "ScriptExecutionContext.h"
-#include "StringBuilder.h"
 #include "ThreadableWebSocketChannel.h"
 #include "WebSocketChannel.h"
-#include <wtf/text/CString.h>
 #include <wtf/StdLibExtras.h>
+#include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -140,7 +141,7 @@ void WebSocket::connect(const KURL& url, const String& protocol, ExceptionCode&
         return;
     }
     if (!portAllowed(url)) {
-        scriptExecutionContext()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, String::format("WebSocket port %d blocked", url.port()), 0, scriptExecutionContext()->securityOrigin()->toString());
+        scriptExecutionContext()->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, makeString("WebSocket port ", String::number(url.port()), " blocked"), 0, scriptExecutionContext()->securityOrigin()->toString());
         m_state = CLOSED;
         ec = SECURITY_ERR;
         return;
diff --git a/WebCore/websockets/WebSocketChannel.cpp b/WebCore/websockets/WebSocketChannel.cpp
index 5ce1cc3..45bb206 100644
--- a/WebCore/websockets/WebSocketChannel.cpp
+++ b/WebCore/websockets/WebSocketChannel.cpp
@@ -48,6 +48,7 @@
 #include "WebSocketHandshake.h"
 
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 #include <wtf/text/StringHash.h>
 #include <wtf/Deque.h>
 #include <wtf/FastMalloc.h>
@@ -157,7 +158,7 @@ void WebSocketChannel::didOpen(SocketStreamHandle* handle)
     if (InspectorController* controller = m_context->inspectorController())
         controller->willSendWebSocketHandshakeRequest(identifier(), m_handshake.clientHandshakeRequest());
 #endif
-    const CString& handshakeMessage = m_handshake.clientHandshakeMessage();
+    CString handshakeMessage = m_handshake.clientHandshakeMessage();
     if (!handle->send(handshakeMessage.data(), handshakeMessage.length())) {
         m_context->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, "Error sending handshake message.", 0, m_handshake.clientOrigin());
         handle->close();
@@ -246,7 +247,7 @@ bool WebSocketChannel::appendToBuffer(const char* data, size_t len)
         m_bufferSize = newBufferSize;
         return true;
     }
-    m_context->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, String::format("WebSocket frame (at %lu bytes) is too long.", static_cast<unsigned long>(newBufferSize)), 0, m_handshake.clientOrigin());
+    m_context->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, makeString("WebSocket frame (at ", String::number(static_cast<unsigned long>(newBufferSize)), " bytes) is too long."), 0, m_handshake.clientOrigin());
     return false;
 }
 
diff --git a/WebCore/websockets/WebSocketHandshake.cpp b/WebCore/websockets/WebSocketHandshake.cpp
index effbb67..5049098 100644
--- a/WebCore/websockets/WebSocketHandshake.cpp
+++ b/WebCore/websockets/WebSocketHandshake.cpp
@@ -43,7 +43,6 @@
 #include "Logging.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
-#include "StringBuilder.h"
 
 #include <wtf/MD5.h>
 #include <wtf/RandomNumber.h>
@@ -52,6 +51,8 @@
 #include <wtf/Vector.h>
 #include <wtf/text/AtomicString.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebCore {
 
@@ -75,7 +76,7 @@ static String hostName(const KURL& url, bool secure)
     StringBuilder builder;
     builder.append(url.host().lower());
     if (url.port() && ((!secure && url.port() != 80) || (secure && url.port() != 443))) {
-        builder.append(":");
+        builder.append(':');
         builder.append(String::number(url.port()));
     }
     return builder.toString();
@@ -318,7 +319,7 @@ int WebSocketHandshake::readServerHandshake(const char* header, size_t len)
     m_response.setStatusText(statusText);
     if (statusCode != 101) {
         m_mode = Failed;
-        m_context->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, String::format("Unexpected response code: %d", statusCode), 0, clientOrigin());
+        m_context->addMessage(JSMessageSource, LogMessageType, ErrorMessageLevel, makeString("Unexpected response code: ", String::number(statusCode)), 0, clientOrigin());
         return len;
     }
     m_mode = Normal;
diff --git a/WebCore/wml/WMLAElement.cpp b/WebCore/wml/WMLAElement.cpp
index c60db5e..00067fe 100644
--- a/WebCore/wml/WMLAElement.cpp
+++ b/WebCore/wml/WMLAElement.cpp
@@ -37,6 +37,7 @@
 #include "FrameLoader.h"
 #include "HTMLAnchorElement.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "KeyboardEvent.h"
 #include "MouseEvent.h"
 #include "RenderBox.h"
@@ -128,7 +129,7 @@ void WMLAElement::defaultEventHandler(Event* event)
         }
 
         if (isLinkClick(event)) {
-            handleLinkClick(event, document(), deprecatedParseURL(getAttribute(HTMLNames::hrefAttr)), target(), event);
+            handleLinkClick(event, document(), stripLeadingAndTrailingHTMLSpaces(getAttribute(HTMLNames::hrefAttr)), target(), event);
             return;
         }
     }
diff --git a/WebCore/wml/WMLDoElement.cpp b/WebCore/wml/WMLDoElement.cpp
index 9398aa0..17a6d10 100644
--- a/WebCore/wml/WMLDoElement.cpp
+++ b/WebCore/wml/WMLDoElement.cpp
@@ -120,7 +120,7 @@ void WMLDoElement::insertedIntoDocument()
     if (!hasAttribute(HTMLNames::nameAttr))
         m_name = m_type;
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -130,7 +130,7 @@ void WMLDoElement::insertedIntoDocument()
 
 void WMLDoElement::removedFromDocument()
 {
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
 
     if (parent  && parent->isWMLElement()) {
         if (WMLEventHandlingElement* eventHandlingElement = toWMLEventHandlingElement(static_cast<WMLElement*>(parent)))
diff --git a/WebCore/wml/WMLImageLoader.cpp b/WebCore/wml/WMLImageLoader.cpp
index 1f1054f..1e4c96b 100644
--- a/WebCore/wml/WMLImageLoader.cpp
+++ b/WebCore/wml/WMLImageLoader.cpp
@@ -24,8 +24,8 @@
 #include "WMLImageLoader.h"
 
 #include "CachedImage.h"
-#include "CSSHelper.h"
 #include "HTMLNames.h"
+#include "HTMLParserIdioms.h"
 #include "WMLImageElement.h"
 #include "WMLNames.h"
 
@@ -49,7 +49,7 @@ void WMLImageLoader::dispatchLoadEvent()
 
 String WMLImageLoader::sourceURI(const AtomicString& attr) const
 {
-    return KURL(element()->baseURI(), deprecatedParseURL(attr));
+    return KURL(element()->baseURI(), stripLeadingAndTrailingHTMLSpaces(attr));
 }
 
 void WMLImageLoader::notifyFinished(CachedResource* image)
diff --git a/WebCore/wml/WMLNoopElement.cpp b/WebCore/wml/WMLNoopElement.cpp
index 3afddeb..fbd3788 100644
--- a/WebCore/wml/WMLNoopElement.cpp
+++ b/WebCore/wml/WMLNoopElement.cpp
@@ -49,7 +49,7 @@ void WMLNoopElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->isWMLElement())
         return;
 
diff --git a/WebCore/wml/WMLOptGroupElement.cpp b/WebCore/wml/WMLOptGroupElement.cpp
index 7c59a7e..3e15c7b 100644
--- a/WebCore/wml/WMLOptGroupElement.cpp
+++ b/WebCore/wml/WMLOptGroupElement.cpp
@@ -55,49 +55,9 @@ const AtomicString& WMLOptGroupElement::formControlType() const
     return optgroup;
 }
 
-bool WMLOptGroupElement::insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = WMLFormControlElement::insertBefore(newChild, refChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
-    return result;
-}
-
-bool WMLOptGroupElement::replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = WMLFormControlElement::replaceChild(newChild, oldChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
-    return result;
-}
-
-bool WMLOptGroupElement::removeChild(Node* oldChild, ExceptionCode& ec)
-{
-    bool result = WMLFormControlElement::removeChild(oldChild, ec);
-    if (result)
-        recalcSelectOptions();
-    return result;
-}
-
-bool WMLOptGroupElement::appendChild(PassRefPtr<Node> newChild, ExceptionCode& ec, bool shouldLazyAttach)
-{
-    bool result = WMLFormControlElement::appendChild(newChild, ec, shouldLazyAttach);
-    if (result)
-        recalcSelectOptions();
-    return result;
-}
-
-bool WMLOptGroupElement::removeChildren()
-{
-    bool result = WMLFormControlElement::removeChildren();
-    if (result)
-        recalcSelectOptions();
-    return result;
-}
-
 static inline WMLSelectElement* ownerSelectElement(Element* element)
 {
-    Node* select = element->parentNode();
+    ContainerNode* select = element->parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
 
diff --git a/WebCore/wml/WMLOptGroupElement.h b/WebCore/wml/WMLOptGroupElement.h
index 3cfa47d..c49749e 100644
--- a/WebCore/wml/WMLOptGroupElement.h
+++ b/WebCore/wml/WMLOptGroupElement.h
@@ -38,12 +38,6 @@ public:
 
     virtual bool rendererIsNeeded(RenderStyle*) { return false; }
 
-    virtual bool insertBefore(PassRefPtr<Node> newChild, Node* refChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool replaceChild(PassRefPtr<Node> newChild, Node* oldChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChild(Node* child, ExceptionCode&);
-    virtual bool appendChild(PassRefPtr<Node> newChild, ExceptionCode&, bool shouldLazyAttach = false);
-    virtual bool removeChildren();
-
     virtual void accessKeyAction(bool sendToAnyElement);
     virtual void childrenChanged(bool changedByParser = false, Node* beforeChange = 0, Node* afterChange = 0, int childCountDelta = 0);
     virtual void parseMappedAttribute(Attribute*);
diff --git a/WebCore/wml/WMLOptionElement.cpp b/WebCore/wml/WMLOptionElement.cpp
index bc97215..6c8aa74 100644
--- a/WebCore/wml/WMLOptionElement.cpp
+++ b/WebCore/wml/WMLOptionElement.cpp
@@ -56,7 +56,7 @@ const AtomicString& WMLOptionElement::formControlType() const
 
 static inline WMLSelectElement* ownerSelectElement(Element* element)
 {
-    Node* select = element->parentNode();
+    ContainerNode* select = element->parentNode();
     while (select && !select->hasTagName(selectTag))
         select = select->parentNode();
 
diff --git a/WebCore/wml/WMLPostfieldElement.cpp b/WebCore/wml/WMLPostfieldElement.cpp
index b168dbb..25ce05a 100644
--- a/WebCore/wml/WMLPostfieldElement.cpp
+++ b/WebCore/wml/WMLPostfieldElement.cpp
@@ -48,14 +48,14 @@ void WMLPostfieldElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (parent && parent->hasTagName(goTag))
         static_cast<WMLGoElement*>(parent)->registerPostfieldElement(this);
 }
 
 void WMLPostfieldElement::removedFromDocument()
 {
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (parent && parent->hasTagName(goTag))
         static_cast<WMLGoElement*>(parent)->deregisterPostfieldElement(this);
 
diff --git a/WebCore/wml/WMLSetvarElement.cpp b/WebCore/wml/WMLSetvarElement.cpp
index a0fc3e8..0514602 100644
--- a/WebCore/wml/WMLSetvarElement.cpp
+++ b/WebCore/wml/WMLSetvarElement.cpp
@@ -60,7 +60,7 @@ void WMLSetvarElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
  
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -70,7 +70,7 @@ void WMLSetvarElement::insertedIntoDocument()
 
 void WMLSetvarElement::removedFromDocument()
 {
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (parent && parent->isWMLElement()) {
         if (static_cast<WMLElement*>(parent)->isWMLTaskElement())
             static_cast<WMLTaskElement*>(parent)->deregisterVariableSetter(this);
diff --git a/WebCore/wml/WMLTableElement.cpp b/WebCore/wml/WMLTableElement.cpp
index eb22503..ed3522d 100644
--- a/WebCore/wml/WMLTableElement.cpp
+++ b/WebCore/wml/WMLTableElement.cpp
@@ -231,7 +231,7 @@ void WMLTableElement::alignCells(Vector<WMLElement*>& columnElements, WMLElement
     bool rtl = false;
     if (RenderObject* renderer = rowElement->renderer()) {
         if (RenderStyle* style = renderer->style())
-            rtl = style->direction() == RTL;
+            rtl = !style->isLeftToRightDirection();
     }
 
     rowElement->setAttribute(HTMLNames::alignAttr, rtl ? "right" : "left");
diff --git a/WebCore/wml/WMLTaskElement.cpp b/WebCore/wml/WMLTaskElement.cpp
index d49a03e..3d1d636 100644
--- a/WebCore/wml/WMLTaskElement.cpp
+++ b/WebCore/wml/WMLTaskElement.cpp
@@ -47,7 +47,7 @@ void WMLTaskElement::insertedIntoDocument()
 {
     WMLElement::insertedIntoDocument();
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -61,7 +61,7 @@ void WMLTaskElement::insertedIntoDocument()
 
 void WMLTaskElement::removedFromDocument()
 {
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (parent && parent->isWMLElement()) {
         if (parent->hasTagName(anchorTag))
             static_cast<WMLAnchorElement*>(parent)->deregisterTask(this);
diff --git a/WebCore/wml/WMLTimerElement.cpp b/WebCore/wml/WMLTimerElement.cpp
index feac38b..dd6c4aa 100644
--- a/WebCore/wml/WMLTimerElement.cpp
+++ b/WebCore/wml/WMLTimerElement.cpp
@@ -63,7 +63,7 @@ void WMLTimerElement::insertedIntoDocument()
     if (value().toInt() <= 0)
         return;
 
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (!parent || !parent->isWMLElement())
         return;
 
@@ -75,7 +75,7 @@ void WMLTimerElement::insertedIntoDocument()
 
 void WMLTimerElement::removedFromDocument()
 {
-    Node* parent = parentNode();
+    ContainerNode* parent = parentNode();
     if (parent && parent->isWMLElement() && parent->hasTagName(cardTag)) {
         m_card->setIntrinsicEventTimer(0);
         m_card = 0;
diff --git a/WebCore/workers/SharedWorker.cpp b/WebCore/workers/SharedWorker.cpp
index b25b28e..997f9cd 100644
--- a/WebCore/workers/SharedWorker.cpp
+++ b/WebCore/workers/SharedWorker.cpp
@@ -39,6 +39,7 @@
 #include "KURL.h"
 #include "MessageChannel.h"
 #include "MessagePort.h"
+#include "ScriptExecutionContext.h"
 #include "SharedWorkerRepository.h"
 
 namespace WebCore {
diff --git a/WebCore/workers/WorkerContext.cpp b/WebCore/workers/WorkerContext.cpp
index 6cee246..a535191 100644
--- a/WebCore/workers/WorkerContext.cpp
+++ b/WebCore/workers/WorkerContext.cpp
@@ -66,11 +66,13 @@
 #if ENABLE(FILE_SYSTEM)
 #include "AsyncFileSystem.h"
 #include "DOMFileSystem.h"
+#include "DOMFileSystemSync.h"
 #include "ErrorCallback.h"
 #include "FileError.h"
 #include "FileSystemCallback.h"
 #include "FileSystemCallbacks.h"
 #include "LocalFileSystem.h"
+#include "SyncCallbackHelper.h"
 #endif
 
 namespace WebCore {
@@ -338,12 +340,12 @@ EventTargetData* WorkerContext::ensureEventTargetData()
 }
 
 #if ENABLE(BLOB)
-String WorkerContext::createBlobURL(Blob* blob)
+String WorkerContext::createObjectURL(Blob* blob)
 {
     return scriptExecutionContext()->createPublicBlobURL(blob).string();
 }
 
-void WorkerContext::revokeBlobURL(const String& blobURLString)
+void WorkerContext::revokeObjectURL(const String& blobURLString)
 {
     scriptExecutionContext()->revokePublicBlobURL(KURL(ParsedURLString, blobURLString));
 }
@@ -363,7 +365,26 @@ void WorkerContext::requestFileSystem(int type, long long size, PassRefPtr<FileS
         return;
     }
 
-    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, this));
+    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(successCallback, errorCallback, this), false);
+}
+
+PassRefPtr<DOMFileSystemSync> WorkerContext::requestFileSystemSync(int type, long long size, ExceptionCode& ec)
+{
+    ec = 0;
+    if (!AsyncFileSystem::isAvailable() || !securityOrigin()->canAccessFileSystem()) {
+        ec = SECURITY_ERR;
+        return 0;
+    }
+
+    AsyncFileSystem::Type fileSystemType = static_cast<AsyncFileSystem::Type>(type);
+    if (fileSystemType != AsyncFileSystem::Temporary && fileSystemType != AsyncFileSystem::Persistent) {
+        ec = INVALID_MODIFICATION_ERR;
+        return 0;
+    }
+
+    FileSystemSyncCallbackHelper helper;
+    LocalFileSystem::localFileSystem().requestFileSystem(this, fileSystemType, size, FileSystemCallbacks::create(helper.successCallback(), helper.errorCallback(), this), true);
+    return helper.getResult(ec);
 }
 
 COMPILE_ASSERT(static_cast<int>(WorkerContext::TEMPORARY) == static_cast<int>(AsyncFileSystem::Temporary), enum_mismatch);
diff --git a/WebCore/workers/WorkerContext.h b/WebCore/workers/WorkerContext.h
index 4128a56..5d15d94 100644
--- a/WebCore/workers/WorkerContext.h
+++ b/WebCore/workers/WorkerContext.h
@@ -45,6 +45,7 @@
 namespace WebCore {
 
     class Blob;
+    class DOMFileSystemSync;
     class Database;
     class DatabaseCallback;
     class DatabaseSync;
@@ -120,8 +121,8 @@ namespace WebCore {
         virtual bool isJSExecutionTerminated() const;
 
 #if ENABLE(BLOB)
-        String createBlobURL(Blob*);
-        void revokeBlobURL(const String&);
+        String createObjectURL(Blob*);
+        void revokeObjectURL(const String&);
 #endif
 
 #if ENABLE(FILE_SYSTEM)
@@ -130,6 +131,7 @@ namespace WebCore {
             PERSISTENT,
         };
         void requestFileSystem(int type, long long size, PassRefPtr<FileSystemCallback>, PassRefPtr<ErrorCallback>);
+        PassRefPtr<DOMFileSystemSync> requestFileSystemSync(int type, long long size, ExceptionCode&);
 #endif
 
         // These methods are used for GC marking. See JSWorkerContext::markChildren(MarkStack&) in
diff --git a/WebCore/workers/WorkerContext.idl b/WebCore/workers/WorkerContext.idl
index 3e185c0..45ac5b1 100644
--- a/WebCore/workers/WorkerContext.idl
+++ b/WebCore/workers/WorkerContext.idl
@@ -101,17 +101,27 @@ module threads {
         attribute BlobBuilderConstructor BlobBuilder;
         attribute FileReaderConstructor FileReader;
         attribute FileReaderSyncConstructor FileReaderSync;
-        DOMString createBlobURL(in Blob blob);
-        void revokeBlobURL(in DOMString blobURL);
+        DOMString createObjectURL(in Blob blob);
+        void revokeObjectURL(in DOMString blobURL);
 #endif
 
 #if defined(ENABLE_FILE_SYSTEM) && ENABLE_FILE_SYSTEM
         const unsigned short TEMPORARY = 0;
         const unsigned short PERSISTENT = 1;
-        [EnabledAtRuntime] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] void requestFileSystem(in unsigned short type, in long long size, in [Callback, Optional] FileSystemCallback successCallback, in [Callback, Optional] ErrorCallback errorCallback);
+        [EnabledAtRuntime=FileSystem] DOMFileSystemSync requestFileSystemSync(in unsigned short type, in long long size) raises (FileException);
 
                  attribute [EnabledAtRuntime=FileSystem] FlagsConstructor Flags;
 #endif
+
+        attribute [Conditional=BLOB,EnabledAtRuntime] ArrayBufferConstructor ArrayBuffer; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Int8ArrayConstructor Int8Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Uint8ArrayConstructor Uint8Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Int16ArrayConstructor Int16Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Uint16ArrayConstructor Uint16Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Int32ArrayConstructor Int32Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Uint32ArrayConstructor Uint32Array; // Usable with new operator
+        attribute [Conditional=BLOB,EnabledAtRuntime] Float32ArrayConstructor Float32Array; // Usable with new operator
     };
 
 }
diff --git a/WebCore/workers/WorkerScriptLoader.h b/WebCore/workers/WorkerScriptLoader.h
index a1a9afc..fc8b0b4 100644
--- a/WebCore/workers/WorkerScriptLoader.h
+++ b/WebCore/workers/WorkerScriptLoader.h
@@ -33,7 +33,6 @@
 #include "KURL.h"
 #include "ResourceRequest.h"
 #include "ResourceResponse.h"
-#include "ScriptString.h"
 #include "TextResourceDecoder.h"
 #include "ThreadableLoader.h"
 #include "ThreadableLoaderClient.h"
diff --git a/WebCore/xml/XMLHttpRequest.cpp b/WebCore/xml/XMLHttpRequest.cpp
index 07a816d..afab73d 100644
--- a/WebCore/xml/XMLHttpRequest.cpp
+++ b/WebCore/xml/XMLHttpRequest.cpp
@@ -35,7 +35,7 @@
 #include "File.h"
 #include "HTTPParsers.h"
 #include "InspectorController.h"
-#include "InspectorTimelineAgent.h"
+#include "InspectorInstrumentation.h"
 #include "ResourceError.h"
 #include "ResourceRequest.h"
 #include "SecurityOrigin.h"
@@ -173,7 +173,6 @@ XMLHttpRequest::XMLHttpRequest(ScriptExecutionContext* context)
     , m_asBlob(false)
 #endif
     , m_state(UNSENT)
-    , m_responseText("")
     , m_createdDocument(false)
     , m_error(false)
     , m_uploadEventsAllowed(true)
@@ -226,7 +225,7 @@ XMLHttpRequest::State XMLHttpRequest::readyState() const
     return m_state;
 }
 
-const ScriptString& XMLHttpRequest::responseText(ExceptionCode& ec) const
+String XMLHttpRequest::responseText(ExceptionCode& ec)
 {
 #if ENABLE(XHR_RESPONSE_BLOB)
     if (m_asBlob)
@@ -234,10 +233,10 @@ const ScriptString& XMLHttpRequest::responseText(ExceptionCode& ec) const
 #else
     UNUSED_PARAM(ec);
 #endif
-    return m_responseText;
+    return m_responseBuilder.toStringPreserveCapacity();
 }
 
-Document* XMLHttpRequest::responseXML(ExceptionCode& ec) const
+Document* XMLHttpRequest::responseXML(ExceptionCode& ec)
 {
 #if ENABLE(XHR_RESPONSE_BLOB)
     if (m_asBlob) {
@@ -259,7 +258,7 @@ Document* XMLHttpRequest::responseXML(ExceptionCode& ec) const
             m_responseXML = Document::create(0, m_url);
             m_responseXML->open();
             // FIXME: Set Last-Modified.
-            m_responseXML->write(String(m_responseText));
+            m_responseXML->write(m_responseBuilder.toStringPreserveCapacity());
             m_responseXML->finishParsing();
             m_responseXML->close();
 
@@ -303,35 +302,17 @@ void XMLHttpRequest::callReadyStateChangeListener()
     if (!scriptExecutionContext())
         return;
 
-#if ENABLE(INSPECTOR)
-    InspectorTimelineAgent* timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
-    bool callTimelineAgentOnReadyStateChange = timelineAgent && hasEventListeners(eventNames().readystatechangeEvent);
-    if (callTimelineAgentOnReadyStateChange)
-        timelineAgent->willChangeXHRReadyState(m_url.string(), m_state);
-#endif
+    InspectorInstrumentationCookie cookie = InspectorInstrumentation::willChangeXHRReadyState(scriptExecutionContext(), this);
 
     if (m_async || (m_state <= OPENED || m_state == DONE))
         m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().readystatechangeEvent), m_state == DONE ? FlushProgressEvent : DoNotFlushProgressEvent);
 
-#if ENABLE(INSPECTOR)
-    if (callTimelineAgentOnReadyStateChange && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
-        timelineAgent->didChangeXHRReadyState();
-#endif
+    InspectorInstrumentation::didChangeXHRReadyState(cookie);
 
     if (m_state == DONE && !m_error) {
-#if ENABLE(INSPECTOR)
-        timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext());
-        bool callTimelineAgentOnLoad = timelineAgent && hasEventListeners(eventNames().loadEvent);
-        if (callTimelineAgentOnLoad)
-            timelineAgent->willLoadXHR(m_url.string());
-#endif
-
+        InspectorInstrumentationCookie cookie = InspectorInstrumentation::willLoadXHR(scriptExecutionContext(), this);
         m_progressEventThrottle.dispatchEvent(XMLHttpRequestProgressEvent::create(eventNames().loadEvent));
-
-#if ENABLE(INSPECTOR)
-        if (callTimelineAgentOnLoad && (timelineAgent = InspectorTimelineAgent::retrieve(scriptExecutionContext())))
-            timelineAgent->didLoadXHR();
-#endif
+        InspectorInstrumentation::didLoadXHR(cookie);
     }
 }
 
@@ -645,7 +626,7 @@ void XMLHttpRequest::abort()
 
     internalAbort();
 
-    m_responseText = "";
+    m_responseBuilder.clear();
     m_createdDocument = false;
     m_responseXML = 0;
 #if ENABLE(XHR_RESPONSE_BLOB)
@@ -694,7 +675,7 @@ void XMLHttpRequest::internalAbort()
 void XMLHttpRequest::clearResponse()
 {
     m_response = ResourceResponse();
-    m_responseText = "";
+    m_responseBuilder.clear();
     m_createdDocument = false;
     m_responseXML = 0;
 #if ENABLE(XHR_RESPONSE_BLOB)
@@ -751,7 +732,7 @@ void XMLHttpRequest::dropProtection()
     // report the extra cost at that point.
     JSC::JSGlobalData* globalData = scriptExecutionContext()->globalData();
     if (hasCachedDOMObjectWrapper(globalData, this))
-        globalData->heap.reportExtraMemoryCost(m_responseText.size() * 2);
+        globalData->heap.reportExtraMemoryCost(m_responseBuilder.length() * 2);
 #endif
 
     unsetPendingActivity(this);
@@ -960,7 +941,9 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
         changeState(HEADERS_RECEIVED);
 
     if (m_decoder)
-        m_responseText += m_decoder->flush();
+        m_responseBuilder.append(m_decoder->flush());
+
+    m_responseBuilder.shrinkToFit();
 
 #if ENABLE(XHR_RESPONSE_BLOB)
     // FIXME: Set m_responseBlob to something here in the m_asBlob case.
@@ -968,7 +951,7 @@ void XMLHttpRequest::didFinishLoading(unsigned long identifier)
 
 #if ENABLE(INSPECTOR)
     if (InspectorController* inspector = scriptExecutionContext()->inspectorController())
-        inspector->resourceRetrievedByXMLHttpRequest(identifier, m_responseText, m_url, m_lastSendURL, m_lastSendLineNumber);
+        inspector->resourceRetrievedByXMLHttpRequest(identifier, m_responseBuilder.toStringPreserveCapacity(), m_url, m_lastSendURL, m_lastSendLineNumber);
 #endif
 
     bool hadLoader = m_loader;
@@ -1037,7 +1020,7 @@ void XMLHttpRequest::didReceiveData(const char* data, int len)
     if (len == -1)
         len = strlen(data);
 
-    m_responseText += m_decoder->decode(data, len);
+    m_responseBuilder.append(m_decoder->decode(data, len));
 
     if (!m_error) {
         long long expectedLength = m_response.expectedContentLength();
diff --git a/WebCore/xml/XMLHttpRequest.h b/WebCore/xml/XMLHttpRequest.h
index 481b51f..cb4e1cf 100644
--- a/WebCore/xml/XMLHttpRequest.h
+++ b/WebCore/xml/XMLHttpRequest.h
@@ -26,11 +26,11 @@
 #include "EventTarget.h"
 #include "FormData.h"
 #include "ResourceResponse.h"
-#include "ScriptString.h"
 #include "ThreadableLoaderClient.h"
 #include "XMLHttpRequestProgressEventThrottle.h"
 #include <wtf/OwnPtr.h>
 #include <wtf/text/AtomicStringHash.h>
+#include <wtf/text/StringBuilder.h>
 
 namespace WebCore {
 
@@ -89,8 +89,8 @@ public:
     void overrideMimeType(const String& override);
     String getAllResponseHeaders(ExceptionCode&) const;
     String getResponseHeader(const AtomicString& name, ExceptionCode&) const;
-    const ScriptString& responseText(ExceptionCode&) const;
-    Document* responseXML(ExceptionCode&) const;
+    String responseText(ExceptionCode&);
+    Document* responseXML(ExceptionCode&);
 #if ENABLE(XHR_RESPONSE_BLOB)
     Blob* responseBlob(ExceptionCode&) const;
 #endif
@@ -176,13 +176,7 @@ private:
 
     RefPtr<TextResourceDecoder> m_decoder;
 
-    // Unlike most strings in the DOM, we keep this as a ScriptString, not a WTF::String.
-    // That's because these strings can easily get huge (they are filled from the network with
-    // no parsing) and because JS can easily observe many intermediate states, so it's very useful
-    // to be able to share the buffer with JavaScript versions of the whole or partial string.
-    // In contrast, this string doesn't interact much with the rest of the engine so it's not that
-    // big a cost that it isn't a String.
-    ScriptString m_responseText;
+    StringBuilder m_responseBuilder;
     mutable bool m_createdDocument;
     mutable RefPtr<Document> m_responseXML;
 
diff --git a/WebCore/xml/XPathParser.cpp b/WebCore/xml/XPathParser.cpp
index 20e7590..c242a5c 100644
--- a/WebCore/xml/XPathParser.cpp
+++ b/WebCore/xml/XPathParser.cpp
@@ -410,6 +410,10 @@ Parser::Parser()
     reset(String());
 }
 
+Parser::~Parser()
+{
+}
+
 void Parser::reset(const String& data)
 {
     m_nextPos = 0;
diff --git a/WebCore/xml/XPathParser.h b/WebCore/xml/XPathParser.h
index e779603..44a8e48 100644
--- a/WebCore/xml/XPathParser.h
+++ b/WebCore/xml/XPathParser.h
@@ -61,6 +61,7 @@ namespace WebCore {
         class Parser : public Noncopyable {
         public:
             Parser();
+            ~Parser();
 
             XPathNSResolver* resolver() const { return m_resolver.get(); }
             bool expandQName(const String& qName, String& localName, String& namespaceURI);
diff --git a/WebCore/xml/XPathStep.cpp b/WebCore/xml/XPathStep.cpp
index 6e60952..ddd8c3c 100644
--- a/WebCore/xml/XPathStep.cpp
+++ b/WebCore/xml/XPathStep.cpp
@@ -255,11 +255,11 @@ void Step::nodesInAxis(Node* context, NodeSet& nodes) const
             return;
         case ParentAxis:
             if (context->isAttributeNode()) {
-                Node* n = static_cast<Attr*>(context)->ownerElement();
+                Element* n = static_cast<Attr*>(context)->ownerElement();
                 if (nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             } else {
-                Node* n = context->parentNode();
+                ContainerNode* n = context->parentNode();
                 if (n && nodeMatches(n, ParentAxis, m_nodeTest))
                     nodes.append(n);
             }
diff --git a/WebKit/CMakeLists.txt b/WebKit/CMakeLists.txt
index 7de8686..6fb9582 100644
--- a/WebKit/CMakeLists.txt
+++ b/WebKit/CMakeLists.txt
@@ -29,6 +29,7 @@ SET(WebKit_INCLUDE_DIRECTORIES
     "${WEBCORE_DIR}/rendering/style"
     "${WEBCORE_DIR}/storage"
     "${WEBCORE_DIR}/svg"
+    "${WEBCORE_DIR}/svg/properties"
     "${JAVASCRIPTCORE_DIR}"
     "${JAVASCRIPTCORE_DIR}/ForwardingHeaders"
     "${JAVASCRIPTCORE_DIR}/API"
diff --git a/WebKit/ChangeLog b/WebKit/ChangeLog
index 0126336..4c9ebbe 100644
--- a/WebKit/ChangeLog
+++ b/WebKit/ChangeLog
@@ -1,3 +1,67 @@
+2010-10-20  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Not reviewed.
+
+        Fix efl build, add missing svg/properties include directory.
+
+        * CMakeLists.txt:
+
+2010-10-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47864
+        Convert WebNSUserDefaultsExtras.m to .mm
+
+        * WebKit.xcodeproj/project.pbxproj: Renamed WebNSUserDefaultsExtras.m.
+
+2010-10-12  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (new parser): Leopard/Tiger Mail <head>/<body> quirk is gone
+        https://bugs.webkit.org/show_bug.cgi?id=45693
+
+        * WebKit.xcodeproj/project.pbxproj:
+         - Add the MailQuirksUserScript.js to the project.
+
+2010-10-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WebIconFetcher from WebKit and IconFetcher from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=47523
+
+        Remove all traces of the WebKit WebIconFetcher class. It's SPI that nobody uses.
+
+        * WebKit.xcodeproj/project.pbxproj:
+
+2010-10-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add Private API for creating a WebKit1 WebSerializedJSValue from the internal
+        representation of a WebKit2 WebSerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=47390
+
+        * WebKit.xcodeproj/project.pbxproj:
+        Add WebSerializedJSValuePrivate.h.
+
+2010-10-05  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Get the link from a plugin when creating a context menu
+        https://bugs.webkit.org/show_bug.cgi?id=47130
+
+        * chromium/public/WebPlugin.h:
+        (WebKit::WebPlugin::linkAtPosition):
+        * chromium/public/WebView.h:
+        * chromium/src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::mouseDidMoveOverElement):
+        * chromium/src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+
 2010-09-22  Lucas De Marchi  <lucas.demarchi@profusion.mobi>
 
         Unreviewed, EFL build fix.
diff --git a/WebKit/WebKit.xcodeproj/project.pbxproj b/WebKit/WebKit.xcodeproj/project.pbxproj
index a2a6091..3eaa49f 100644
--- a/WebKit/WebKit.xcodeproj/project.pbxproj
+++ b/WebKit/WebKit.xcodeproj/project.pbxproj
@@ -29,9 +29,6 @@
 		14D8252F0AF955090004F057 /* WebChromeClient.h in Headers */ = {isa = PBXBuildFile; fileRef = 14D8252D0AF955090004F057 /* WebChromeClient.h */; };
 		14D825300AF955090004F057 /* WebChromeClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = 14D8252E0AF955090004F057 /* WebChromeClient.mm */; };
 		1A20D08B0ED384F20043FA9F /* QuartzCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = 1A20D08A0ED384F20043FA9F /* QuartzCore.framework */; };
-		1A2D754D0DE480B900F0A648 /* WebIconFetcher.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2D754B0DE480B900F0A648 /* WebIconFetcher.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		1A2D754E0DE480B900F0A648 /* WebIconFetcher.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A2D754C0DE480B900F0A648 /* WebIconFetcher.mm */; };
-		1A2D75500DE4810E00F0A648 /* WebIconFetcherInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2D754F0DE4810E00F0A648 /* WebIconFetcherInternal.h */; };
 		1A2DBE9F0F251E3A0036F8A6 /* ProxyInstance.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A2DBE9D0F251E3A0036F8A6 /* ProxyInstance.h */; };
 		1A2DBEA00F251E3A0036F8A6 /* ProxyInstance.mm in Sources */ = {isa = PBXBuildFile; fileRef = 1A2DBE9E0F251E3A0036F8A6 /* ProxyInstance.mm */; };
 		1A4DF5220EC8C74D006BD4B4 /* WebNetscapePluginView.h in Headers */ = {isa = PBXBuildFile; fileRef = 1A4DF5200EC8C74D006BD4B4 /* WebNetscapePluginView.h */; };
@@ -133,7 +130,7 @@
 		65E0F88408500917007E5CB9 /* WebNSURLRequestExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E0F88208500917007E5CB9 /* WebNSURLRequestExtras.h */; };
 		65E0F88508500917007E5CB9 /* WebNSURLRequestExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = 65E0F88308500917007E5CB9 /* WebNSURLRequestExtras.m */; };
 		65E0F9E608500F23007E5CB9 /* WebNSUserDefaultsExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 65E0F9E408500F23007E5CB9 /* WebNSUserDefaultsExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
-		65E0F9E708500F23007E5CB9 /* WebNSUserDefaultsExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = 65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.m */; };
+		65E0F9E708500F23007E5CB9 /* WebNSUserDefaultsExtras.mm in Sources */ = {isa = PBXBuildFile; fileRef = 65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.mm */; };
 		65EEDE57084FFC9E0002DB25 /* WebNSFileManagerExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = 65EEDE55084FFC9E0002DB25 /* WebNSFileManagerExtras.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		65EEDE58084FFC9E0002DB25 /* WebNSFileManagerExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = 65EEDE56084FFC9E0002DB25 /* WebNSFileManagerExtras.m */; };
 		65FFB7FC0AD0B7D30048CD05 /* WebDocumentLoaderMac.h in Headers */ = {isa = PBXBuildFile; fileRef = 65FFB7FA0AD0B7D30048CD05 /* WebDocumentLoaderMac.h */; };
@@ -339,6 +336,7 @@
 		A70936B00B5608DC00CDB48E /* WebDragClient.mm in Sources */ = {isa = PBXBuildFile; fileRef = A70936AE0B5608DC00CDB48E /* WebDragClient.mm */; };
 		A7D3C5BC0B5773C5002CA450 /* WebPasteboardHelper.h in Headers */ = {isa = PBXBuildFile; fileRef = A7D3C5BA0B5773C5002CA450 /* WebPasteboardHelper.h */; };
 		A7D3C5BD0B5773C5002CA450 /* WebPasteboardHelper.mm in Sources */ = {isa = PBXBuildFile; fileRef = A7D3C5BB0B5773C5002CA450 /* WebPasteboardHelper.mm */; };
+		A864B3F6123ED9FA00C2A612 /* MailQuirksUserScript.js in Resources */ = {isa = PBXBuildFile; fileRef = A864B3E5123ED83D00C2A612 /* MailQuirksUserScript.js */; };
 		AB9FBBBB0F8582B0006ADC43 /* WebDOMOperationsInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = AB9FBBBA0F8582B0006ADC43 /* WebDOMOperationsInternal.h */; };
 		ABDDF20D08EB0DDC001E1241 /* WebDownloadInternal.h in Headers */ = {isa = PBXBuildFile; fileRef = ABDDF20C08EB0DDC001E1241 /* WebDownloadInternal.h */; };
 		B6CE5C24100BC5CE00219936 /* WebApplicationCache.mm in Sources */ = {isa = PBXBuildFile; fileRef = B68049720FFBCEC1009F7F62 /* WebApplicationCache.mm */; };
@@ -378,6 +376,7 @@
 		ED7F6D8B0980683500C235ED /* WebNSDataExtrasPrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = ED7F6D8A0980683500C235ED /* WebNSDataExtrasPrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		EDE983800BCDF5FE00FDAE28 /* WebNSArrayExtras.h in Headers */ = {isa = PBXBuildFile; fileRef = EDE9837E0BCDF5FE00FDAE28 /* WebNSArrayExtras.h */; };
 		EDE983810BCDF5FE00FDAE28 /* WebNSArrayExtras.m in Sources */ = {isa = PBXBuildFile; fileRef = EDE9837F0BCDF5FE00FDAE28 /* WebNSArrayExtras.m */; };
+		F67DD7E6125E4527007BDCB8 /* WebSerializedJSValuePrivate.h in Headers */ = {isa = PBXBuildFile; fileRef = F67DD7E5125E4527007BDCB8 /* WebSerializedJSValuePrivate.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F834AAD70E64B1C700E2737C /* WebTextIterator.h in Headers */ = {isa = PBXBuildFile; fileRef = F834AAD50E64B1C700E2737C /* WebTextIterator.h */; settings = {ATTRIBUTES = (Private, ); }; };
 		F834AAD80E64B1C700E2737C /* WebTextIterator.mm in Sources */ = {isa = PBXBuildFile; fileRef = F834AAD60E64B1C700E2737C /* WebTextIterator.mm */; };
 /* End PBXBuildFile section */
@@ -405,9 +404,6 @@
 		14D8252D0AF955090004F057 /* WebChromeClient.h */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.c.h; path = WebChromeClient.h; sourceTree = "<group>"; };
 		14D8252E0AF955090004F057 /* WebChromeClient.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebChromeClient.mm; sourceTree = "<group>"; };
 		1A20D08A0ED384F20043FA9F /* QuartzCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = QuartzCore.framework; path = /System/Library/Frameworks/QuartzCore.framework; sourceTree = "<absolute>"; };
-		1A2D754B0DE480B900F0A648 /* WebIconFetcher.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconFetcher.h; sourceTree = "<group>"; };
-		1A2D754C0DE480B900F0A648 /* WebIconFetcher.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebIconFetcher.mm; sourceTree = "<group>"; };
-		1A2D754F0DE4810E00F0A648 /* WebIconFetcherInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebIconFetcherInternal.h; sourceTree = "<group>"; };
 		1A2DBE9D0F251E3A0036F8A6 /* ProxyInstance.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = ProxyInstance.h; sourceTree = "<group>"; };
 		1A2DBE9E0F251E3A0036F8A6 /* ProxyInstance.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = ProxyInstance.mm; sourceTree = "<group>"; };
 		1A4DF5200EC8C74D006BD4B4 /* WebNetscapePluginView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebNetscapePluginView.h; sourceTree = "<group>"; };
@@ -561,7 +557,7 @@
 		65E0F88208500917007E5CB9 /* WebNSURLRequestExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSURLRequestExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65E0F88308500917007E5CB9 /* WebNSURLRequestExtras.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebNSURLRequestExtras.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65E0F9E408500F23007E5CB9 /* WebNSUserDefaultsExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSUserDefaultsExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
-		65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.m */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.objc; path = WebNSUserDefaultsExtras.m; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebNSUserDefaultsExtras.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65E1150307EFFEBF009B8BF7 /* WebPluginContainerCheck.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebPluginContainerCheck.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65E1150407EFFEBF009B8BF7 /* WebPluginContainerCheck.mm */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPluginContainerCheck.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		65EEDE55084FFC9E0002DB25 /* WebNSFileManagerExtras.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebNSFileManagerExtras.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -651,6 +647,7 @@
 		A70936AE0B5608DC00CDB48E /* WebDragClient.mm */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.cpp.objcpp; path = WebDragClient.mm; sourceTree = "<group>"; };
 		A7D3C5BA0B5773C5002CA450 /* WebPasteboardHelper.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebPasteboardHelper.h; sourceTree = "<group>"; };
 		A7D3C5BB0B5773C5002CA450 /* WebPasteboardHelper.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebPasteboardHelper.mm; sourceTree = "<group>"; };
+		A864B3E5123ED83D00C2A612 /* MailQuirksUserScript.js */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.javascript; path = MailQuirksUserScript.js; sourceTree = "<group>"; };
 		AB9FBBBA0F8582B0006ADC43 /* WebDOMOperationsInternal.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebDOMOperationsInternal.h; sourceTree = "<group>"; };
 		ABDDF20C08EB0DDC001E1241 /* WebDownloadInternal.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebDownloadInternal.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		B68049710FFBCEC1009F7F62 /* WebApplicationCache.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebApplicationCache.h; sourceTree = "<group>"; };
@@ -745,6 +742,7 @@
 		F5F732D202FF4D4F01A80180 /* WebKit.exp */ = {isa = PBXFileReference; fileEncoding = 30; lastKnownFileType = sourcecode.exports; name = WebKit.exp; path = mac/WebKit.exp; sourceTree = "<group>"; tabWidth = 4; usesTabs = 0; };
 		F5F81C3902B67C26018635CA /* WebRenderNode.h */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = WebRenderNode.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
 		F5F81C3A02B67C26018635CA /* WebRenderNode.mm */ = {isa = PBXFileReference; fileEncoding = 4; indentWidth = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = WebRenderNode.mm; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
+		F67DD7E5125E4527007BDCB8 /* WebSerializedJSValuePrivate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = WebSerializedJSValuePrivate.h; sourceTree = "<group>"; };
 		F738C9E903FAD3DF0321FBE0 /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		F738C9EA03FAD3DF0321FBE0 /* WebCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
 		F79B974804019934036909D2 /* CarbonUtils.h */ = {isa = PBXFileReference; fileEncoding = 30; indentWidth = 4; lastKnownFileType = sourcecode.c.h; path = CarbonUtils.h; sourceTree = "<group>"; tabWidth = 8; usesTabs = 0; };
@@ -934,6 +932,7 @@
 		254DC334016E1D3F0ECA149E /* Misc */ = {
 			isa = PBXGroup;
 			children = (
+				A864B3E5123ED83D00C2A612 /* MailQuirksUserScript.js */,
 				1CCFFD120B1F81F2002EE926 /* OldWebAssertions.c */,
 				5DE92FEE0BD7017E0059A5FD /* WebAssertions.h */,
 				5241ADF30B1BC48A004012BD /* WebCache.h */,
@@ -950,9 +949,6 @@
 				51B2A0FF0ADB15D0002A9BEE /* WebIconDatabaseDelegate.h */,
 				9304B2FF0B02341500F7850D /* WebIconDatabaseInternal.h */,
 				F528E3EB031E91AD01CA2ACA /* WebIconDatabasePrivate.h */,
-				1A2D754B0DE480B900F0A648 /* WebIconFetcher.h */,
-				1A2D754C0DE480B900F0A648 /* WebIconFetcher.mm */,
-				1A2D754F0DE4810E00F0A648 /* WebIconFetcherInternal.h */,
 				2568C72C0174912D0ECA149E /* WebKit.h */,
 				F5927D4E02D26C5E01CA2DBB /* WebKitErrors.h */,
 				83730F9803FB1E660004736E /* WebKitErrors.m */,
@@ -1000,7 +996,7 @@
 				65E0F88208500917007E5CB9 /* WebNSURLRequestExtras.h */,
 				65E0F88308500917007E5CB9 /* WebNSURLRequestExtras.m */,
 				65E0F9E408500F23007E5CB9 /* WebNSUserDefaultsExtras.h */,
-				65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.m */,
+				65E0F9E508500F23007E5CB9 /* WebNSUserDefaultsExtras.mm */,
 				F508946902B71D59018A9CD4 /* WebNSViewExtras.h */,
 				F508946A02B71D59018A9CD4 /* WebNSViewExtras.m */,
 				9345DDAE0365FB27008635CE /* WebNSWindowExtras.h */,
@@ -1225,6 +1221,7 @@
 				C0B1F7E710AC8E3100C925D9 /* WebScriptWorldInternal.h */,
 				BC26C69D10B743F400B687ED /* WebSerializedJSValue.h */,
 				BC26C6A410B7447A00B687ED /* WebSerializedJSValue.mm */,
+				F67DD7E5125E4527007BDCB8 /* WebSerializedJSValuePrivate.h */,
 				936A2DE90FD2D08400D312DB /* WebTextCompletionController.h */,
 				936A2DE70FD2D08000D312DB /* WebTextCompletionController.mm */,
 				F834AAD50E64B1C700E2737C /* WebTextIterator.h */,
@@ -1508,8 +1505,6 @@
 				51B2A1000ADB15D0002A9BEE /* WebIconDatabaseDelegate.h in Headers */,
 				9304B3000B02341500F7850D /* WebIconDatabaseInternal.h in Headers */,
 				939810190824BF01008DF038 /* WebIconDatabasePrivate.h in Headers */,
-				1A2D754D0DE480B900F0A648 /* WebIconFetcher.h in Headers */,
-				1A2D75500DE4810E00F0A648 /* WebIconFetcherInternal.h in Headers */,
 				5D7BF8140C2A1D90008CE06D /* WebInspector.h in Headers */,
 				06693DDC0BFBA85200216072 /* WebInspectorClient.h in Headers */,
 				7A8FF0D11075024A00A80A08 /* WebInspectorPrivate.h in Headers */,
@@ -1600,6 +1595,7 @@
 				C0B1F7E810AC8E3100C925D9 /* WebScriptWorld.h in Headers */,
 				C0B1F7EA10AC8E3100C925D9 /* WebScriptWorldInternal.h in Headers */,
 				BC26C69E10B743F400B687ED /* WebSerializedJSValue.h in Headers */,
+				F67DD7E6125E4527007BDCB8 /* WebSerializedJSValuePrivate.h in Headers */,
 				939810270824BF01008DF038 /* WebStringTruncator.h in Headers */,
 				93EB178F09F88D510091F8FF /* WebSystemInterface.h in Headers */,
 				936A2DEA0FD2D08400D312DB /* WebTextCompletionController.h in Headers */,
@@ -1674,6 +1670,7 @@
 			isa = PBXProject;
 			buildConfigurationList = 149C283208902B0F008A9EFC /* Build configuration list for PBXProject "WebKit" */;
 			compatibilityVersion = "Xcode 2.4";
+			developmentRegion = English;
 			hasScannedForEncodings = 1;
 			knownRegions = (
 				English,
@@ -1699,6 +1696,7 @@
 			isa = PBXResourcesBuildPhase;
 			buildActionMask = 2147483647;
 			files = (
+				A864B3F6123ED9FA00C2A612 /* MailQuirksUserScript.js in Resources */,
 				939810BA0824BF01008DF038 /* IDNScriptWhiteList.txt in Resources */,
 				5DE83A7F0D0F7FAD00CAD12A /* Localizable.strings in Resources */,
 				939810B70824BF01008DF038 /* url_icon.tiff in Resources */,
@@ -1907,7 +1905,6 @@
 				939810F40824BF01008DF038 /* WebHTMLView.mm in Sources */,
 				939810C10824BF01008DF038 /* WebIconDatabase.mm in Sources */,
 				51494CD70C7EBDE0004178C5 /* WebIconDatabaseClient.mm in Sources */,
-				1A2D754E0DE480B900F0A648 /* WebIconFetcher.mm in Sources */,
 				939810E30824BF01008DF038 /* WebImageRendererFactory.m in Sources */,
 				5D7BF8150C2A1D90008CE06D /* WebInspector.mm in Sources */,
 				06693DDD0BFBA85200216072 /* WebInspectorClient.mm in Sources */,
@@ -1951,7 +1948,7 @@
 				939811190824BF01008DF038 /* WebNSPrintOperationExtras.m in Sources */,
 				939811120824BF01008DF038 /* WebNSURLExtras.mm in Sources */,
 				65E0F88508500917007E5CB9 /* WebNSURLRequestExtras.m in Sources */,
-				65E0F9E708500F23007E5CB9 /* WebNSUserDefaultsExtras.m in Sources */,
+				65E0F9E708500F23007E5CB9 /* WebNSUserDefaultsExtras.mm in Sources */,
 				939810C90824BF01008DF038 /* WebNSViewExtras.m in Sources */,
 				939810CA0824BF01008DF038 /* WebNSWindowExtras.m in Sources */,
 				939810D00824BF01008DF038 /* WebPanelAuthenticationHandler.m in Sources */,
diff --git a/WebKit/cf/ChangeLog b/WebKit/cf/ChangeLog
index 957dce1..1efdd4d 100644
--- a/WebKit/cf/ChangeLog
+++ b/WebKit/cf/ChangeLog
@@ -1,3 +1,13 @@
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: [crash] when Inspector Open in CSSStyleSelector::loadPendingImages().
+        https://bugs.webkit.org/show_bug.cgi?id=46224
+
+        * WebCoreSupport/WebInspectorClientCF.cpp:
+        (WebInspectorClient::sendMessageToFrontend):
+
 2010-06-14  Ilya Tikhonovsky  <loislo@chromium.org>
 
         Reviewed by Pavel Feldman.
diff --git a/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp b/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
index dc5a186..62fdd4d 100644
--- a/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
+++ b/WebKit/cf/WebCoreSupport/WebInspectorClientCF.cpp
@@ -102,20 +102,5 @@ void WebInspectorClient::releaseFrontendPage()
 
 bool WebInspectorClient::sendMessageToFrontend(const String& message)
 {
-    if (!m_frontendPage)
-        return false;
-
-    Frame* frame = m_frontendPage->mainFrame();
-    if (!frame)
-        return false;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController)
-        return false;
-
-    String dispatchToFrontend("WebInspector.dispatchMessageFromBackend(");
-    dispatchToFrontend += message;
-    dispatchToFrontend += ");";
-    scriptController->executeScript(dispatchToFrontend);
-    return true;
+    return doDispatchMessageOnFrontendPage(m_frontendPage, message);
 }
diff --git a/WebKit/chromium/ChangeLog b/WebKit/chromium/ChangeLog
index a28517a..bd2faa8 100644
--- a/WebKit/chromium/ChangeLog
+++ b/WebKit/chromium/ChangeLog
@@ -1,3 +1,1746 @@
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70165.
+        http://trac.webkit.org/changeset/70165
+        https://bugs.webkit.org/show_bug.cgi?id=48007
+
+        It broke tests on Qt bot (Requested by Ossy on #webkit).
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeScript):
+        (WebKit::WebFrameImpl::executeScriptInIsolatedWorld):
+        (WebKit::WebFrameImpl::executeScriptAndReturnValue):
+
+2010-10-20  Peter Rybin  <peter.rybin@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        HTML parser should provide script column position within HTML document to JavaScript engine
+        https://bugs.webkit.org/show_bug.cgi?id=45271
+
+        Replaces script line number with TextPosition structure.
+
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::executeScript):
+        (WebKit::WebFrameImpl::executeScriptInIsolatedWorld):
+        (WebKit::WebFrameImpl::executeScriptAndReturnValue):
+
+2010-10-20  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Fix crash when mousing over scrollview
+        https://bugs.webkit.org/show_bug.cgi?id=47956
+
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::mouseDidMoveOverElement):
+        * src/ChromiumBridge.cpp:
+        (WebCore::ChromiumBridge::pluginScriptableObject):
+        * src/ContextMenuClientImpl.cpp:
+        (WebKit::ContextMenuClientImpl::getCustomMenuFromDefaultItems):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::redirectDataToPlugin):
+        * src/WebPluginContainerImpl.h:
+        (WebKit::WebPluginContainerImpl::isPluginContainer):
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70149.
+        http://trac.webkit.org/changeset/70149
+        https://bugs.webkit.org/show_bug.cgi?id=47989
+
+        "Build breaks in mac and win" (Requested by satish on
+        #webkit).
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-19  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+ 
+        Patch the current speech input implementation to use and validate the
+        nearest language tag. The language is now passed to the startRecognition
+        methods so that language-specific recognition could be used. Also added
+        a second parameter to setMockSpeechInputResult for the language used in
+        speech recognition.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        This is the 2nd of a 4-sided patch in Chromium and WebKit. For more
+        details see http://codereview.chromium.org/3615005/show and
+        http://codereview.chromium.org/3595018/show.
+
+        * public/WebSpeechInputController.h:
+        (WebKit::WebSpeechInputController::startRecognition):
+        * public/WebSpeechInputControllerMock.h:
+        * src/SpeechInputClientImpl.cpp:
+        (WebKit::SpeechInputClientImpl::create):
+        (WebKit::SpeechInputClientImpl::startRecognition):
+        * src/SpeechInputClientImpl.h:
+        * src/WebSpeechInputControllerMockImpl.cpp:
+        (WebKit::WebSpeechInputControllerMockImpl::setMockRecognitionResult):
+        (WebKit::WebSpeechInputControllerMockImpl::startRecognition):
+        * src/WebSpeechInputControllerMockImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        * src/WebViewImpl.h:
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Unreviewed Chromium win build fix.
+
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::TEST):
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Merge ColorSpace and ImageColorSpace enums
+        https://bugs.webkit.org/show_bug.cgi?id=47922
+
+        Renamed ColorSpace enum entries DeviceColorSpace and sRGBColorSpace to ColorSpaceDeviceRGB and ColorSpaceSRGB
+        to follow webkit style rules.
+
+        * src/WebFontImpl.cpp:
+        (WebKit::WebFontImpl::drawText):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::paintWithContext):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::doPixelReadbackToCanvas):
+        * tests/TransparencyWinTest.cpp:
+        (WebCore::TEST):
+
+2010-10-19  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: expose request/response cookies in HAR
+        https://bugs.webkit.org/show_bug.cgi?id=47894
+
+        * src/WebResourceRawHeaders.cpp:
+        (WebKit::addHeader): paste coalescent headers using "\n: as a separator instead of ", "
+
+2010-10-19  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] Use webkit's TestNetscapePlugIn in DRT mac
+        https://bugs.webkit.org/show_bug.cgi?id=47850
+
+        * WebKit.gyp: Copy WebKitTestPlugIn into plugins and add
+            GCC_SYMBOLS_PRIVATE_EXTERN: NO to export the symbols.
+
+2010-10-19  Tony Chang  <tony@chromium.org>
+
+        Unreviewed.  Rolling chromium DEPS to 63057 to pick up mac plugin
+        loading in DRT.
+
+        * DEPS: bump chromium DEPS to 63057.
+
+2010-10-19  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] DumpRenderTree shouldn't put '.' in include path
+        https://bugs.webkit.org/show_bug.cgi?id=47877
+
+        * WebKit.gyp: Replace '.' with <(chromium_src_dir) and add public
+
+2010-10-18  Adrienne Walker  <enne@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        Turn off antialiasing when using Mesa during testing.
+        https://bugs.webkit.org/show_bug.cgi?id=47697
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::validateAttributes):
+
+2010-10-18  James Robinson  <jamesr@chromium.org>
+
+        Update the chromium DEPS from 62399 to 62813 to pick up skia fixes
+
+        * DEPS:
+
+2010-10-17  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: Introduce InspectorResourceAgent.h/cpp and ResourceManager.js to
+        fill network panel with data.
+        https://bugs.webkit.org/show_bug.cgi?id=47779
+
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::didReceiveResponse):
+
+2010-10-17  Pascal Massimino  <pascal.massimino@gmail.com>
+
+        Reviewed by Adam Barth.
+
+        Add support for WebP image decoding in ImageDecoder
+        using library libwebp-decode library available from
+        http://www.webmproject.org/code/
+
+        https://bugs.webkit.org/show_bug.cgi?id=47512
+
+        Tests: fast/images/webp-image-decoding.html
+
+        * CMakeLists.txt:
+            add platform/image-decoders/webp files and directory
+        * GNUmakefile.am:
+            add platform/image-decoders/webp directory
+        * WebCore.gyp/WebCore.gyp:
+            add platform/image-decoders/webp directory
+        * WebCore.gypi:
+            add platform/image-decoders/webp directory
+        * features.gypi:
+            add WTF_USE_WEBP=1
+        * platform/image-decoders/ImageDecoder.cpp:
+        (WebCore::ImageDecoder::create):
+            instantiate webp decoder for file starting with 'RIFF????WEBP'
+        * platform/image-decoders/webp: Added.
+        * platform/image-decoders/webp/WEBPImageDecoder.cpp: Added.
+        (WebCore::WEBPImageDecoder::WEBPImageDecoder):
+        (WebCore::WEBPImageDecoder::~WEBPImageDecoder):
+        (WebCore::WEBPImageDecoder::isSizeAvailable):
+        (WebCore::WEBPImageDecoder::frameBufferAtIndex):
+        (WebCore::WEBPImageDecoder::decode):
+            sub-class handling decoding of webp images
+        * platform/image-decoders/webp/WEBPImageDecoder.h: Added.
+        (WebCore::WEBPImageDecoder::filenameExtension):
+        (WebCore::WEBPImageDecoder::supportsAlpha):
+            header for webp-decoder sub-class
+
+2010-10-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] compile TestNetscapePlugIn on Chromium mac
+        https://bugs.webkit.org/show_bug.cgi?id=47633
+
+        * WebKit.gyp:  Add a mac specific target for compiling TestNetscapePlugIn
+            Fix an include dir so we can compile in a chromium checkout.
+
+2010-10-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69809.
+        http://trac.webkit.org/changeset/69809
+        https://bugs.webkit.org/show_bug.cgi?id=47725
+
+        Broke chromium mac compile (Requested by japhet on #webkit).
+
+        * WebKit.gyp:
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * src/BackForwardListClientImpl.cpp:
+        (WebKit::BackForwardListClientImpl::itemAtIndex):
+        * src/DebuggerAgentManager.cpp:
+        (WebKit::DebuggerAgentManager::debugDetach):
+        * src/LocalizedStrings.cpp:
+        (WebCore::imageTitle):
+        * src/WebPageSerializer.cpp:
+        (WebKit::WebPageSerializer::generateMetaCharsetDeclaration):
+        (WebKit::WebPageSerializer::generateBaseTagDeclaration):
+
+2010-10-14  Wei Jia  <wjia@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Retrieve info of lock keys from stashed currentInputEvent which
+        is stored by chromium when it passes input event to WebCore.
+        Retrieving only when stashed event is a keyboard event, which
+        means synthetic KeyboardEvent inherits lock key state from real
+        keyboard event.
+        https://bugs.webkit.org/show_bug.cgi?id=46518
+
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::handleKeyboardEvent):
+
+2010-10-14  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] null check the widget before sending it data as calling didReceiveData might delete it
+        https://bugs.webkit.org/show_bug.cgi?id=47708
+
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::committedLoad):
+
+2010-10-14  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] compile TestNetscapePlugIn on Chromium mac
+        https://bugs.webkit.org/show_bug.cgi?id=47633
+
+        * WebKit.gyp:  Add a mac specific target for compiling TestNetscapePlugIn
+
+2010-10-13  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Jian Li.
+
+        [Chromium] Enable FILE_SYSTEM by default for chromium
+        https://bugs.webkit.org/show_bug.cgi?id=47639
+
+        * features.gypi: Add FILE_SYSTEM=1. Also remove FILE_READER=1
+        as it seems to be not used anymore.
+
+2010-10-13  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        IndexedDB should fire some errors synchronously
+        https://bugs.webkit.org/show_bug.cgi?id=47530
+
+        * public/WebIDBCursor.h:
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::transaction):
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+        * public/WebIDBObjectStore.h:
+        * public/WebIDBTransactionCallbacks.h:
+        * src/IDBCursorBackendProxy.cpp:
+        (WebCore::IDBCursorBackendProxy::update):
+        (WebCore::IDBCursorBackendProxy::continueFunction):
+        (WebCore::IDBCursorBackendProxy::remove):
+        * src/IDBCursorBackendProxy.h:
+        * src/IDBDatabaseProxy.cpp:
+        (WebCore::IDBDatabaseProxy::createObjectStore):
+        (WebCore::IDBDatabaseProxy::removeObjectStore):
+        (WebCore::IDBDatabaseProxy::setVersion):
+        (WebCore::IDBDatabaseProxy::transaction):
+        * src/IDBDatabaseProxy.h:
+        * src/IDBIndexBackendProxy.cpp:
+        (WebCore::IDBIndexBackendProxy::openCursor):
+        (WebCore::IDBIndexBackendProxy::openKeyCursor):
+        (WebCore::IDBIndexBackendProxy::get):
+        (WebCore::IDBIndexBackendProxy::getKey):
+        * src/IDBIndexBackendProxy.h:
+        * src/IDBObjectStoreProxy.cpp:
+        (WebCore::IDBObjectStoreProxy::get):
+        (WebCore::IDBObjectStoreProxy::put):
+        (WebCore::IDBObjectStoreProxy::remove):
+        (WebCore::IDBObjectStoreProxy::createIndex):
+        (WebCore::IDBObjectStoreProxy::index):
+        (WebCore::IDBObjectStoreProxy::removeIndex):
+        (WebCore::IDBObjectStoreProxy::openCursor):
+        * src/IDBObjectStoreProxy.h:
+        * src/WebIDBCursorImpl.cpp:
+        (WebKit::WebIDBCursorImpl::update):
+        (WebKit::WebIDBCursorImpl::continueFunction):
+        (WebKit::WebIDBCursorImpl::remove):
+        * src/WebIDBCursorImpl.h:
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::createObjectStore):
+        (WebKit::WebIDBDatabaseImpl::removeObjectStore):
+        (WebKit::WebIDBDatabaseImpl::setVersion):
+        (WebKit::WebIDBDatabaseImpl::transaction):
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBIndexImpl.cpp:
+        (WebKit::WebIDBIndexImpl::openObjectCursor):
+        (WebKit::WebIDBIndexImpl::openKeyCursor):
+        (WebKit::WebIDBIndexImpl::getObject):
+        (WebKit::WebIDBIndexImpl::getKey):
+        * src/WebIDBIndexImpl.h:
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::get):
+        (WebKit::WebIDBObjectStoreImpl::put):
+        (WebKit::WebIDBObjectStoreImpl::remove):
+        (WebKit::WebIDBObjectStoreImpl::createIndex):
+        (WebKit::WebIDBObjectStoreImpl::index):
+        (WebKit::WebIDBObjectStoreImpl::removeIndex):
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        * src/WebIDBObjectStoreImpl.h:
+
+2010-10-13  Brett Wilson  <brettw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Save and restore the GraphicsContext around setting the clip rect for
+        drawing text.
+        https://bugs.webkit.org/show_bug.cgi?id=47634
+
+        * src/WebFontImpl.cpp:
+        (WebKit::WebFontImpl::drawText):
+
+2010-10-13  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        Revert changes to WebViewImpl in r69633
+        https://bugs.webkit.org/show_bug.cgi?id=47610
+
+        Revert change to WebViewImpl.cpp in
+        http://trac.webkit.org/changeset/69633 which incorrectly used
+        PassRefPtr for a local variable instead of RefPtr. This was a fix
+        for changes in http://trac.webkit.org/changeset/69619 and
+        http://trac.webkit.org/changeset/69624 .
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        Bug 43987 - Downloading using XHR is much slower than before
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::encodeAndFlushBuffer):
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Tony Chang.
+
+        [Chromium] Clean up WebPageSerializerImpl::serialize
+        https://bugs.webkit.org/show_bug.cgi?id=47577
+
+        This patch shouldn't have any behavior change.  I'm just trying to
+        understand what this code does.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::saveHTMLContentToBuffer):
+        (WebKit::WebPageSerializerImpl::encodeAndFlushBuffer):
+        (WebKit::WebPageSerializerImpl::serialize):
+        * src/WebPageSerializerImpl.h:
+
+2010-10-13  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        First step towards client-based Geolocation in Chromium. Build
+        fixes for CLIENT_BASED_GEOLOCATION preprocessor feature define.
+        https://bugs.webkit.org/show_bug.cgi?id=47586
+
+        * WebKit.gyp:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::requestGeolocationPermissionForFrame):
+        (WebKit::ChromeClientImpl::cancelGeolocationPermissionRequestForFrame):
+        * src/ChromiumBridge.cpp:
+        * src/WebGeolocationServiceMock.cpp:
+        (WebKit::WebGeolocationServiceMock::createWebGeolocationServiceMock):
+        (WebKit::WebGeolocationServiceMock::setMockGeolocationPermission):
+        (WebKit::WebGeolocationServiceMock::setMockGeolocationPosition):
+        (WebKit::WebGeolocationServiceMock::setMockGeolocationError):
+
+2010-10-11  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        [Chromium] Cleanup WebIDBFactory::open once the Chromium plumbing has landed.
+        https://bugs.webkit.org/show_bug.cgi?id=47531
+
+        Remove the temporary open() method since the appropriate Chromium plumbing was
+        added in http://codereview.chromium.org/3729003/
+
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Clean up SerializeDomParam
+        https://bugs.webkit.org/show_bug.cgi?id=47580
+
+        This patch just renames a bunch of the members of this struct to be
+        more sensible.  No behavior change, well, except for one struct member
+        that wasn't initialized.  I didn't trace through this code to see if
+        the uninitialized value was used anywhere, but initializing all the
+        values seems like a good idea.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::SerializeDomParam::SerializeDomParam):
+        (WebKit::WebPageSerializerImpl::preActionBeforeSerializeOpenTag):
+        (WebKit::WebPageSerializerImpl::postActionAfterSerializeOpenTag):
+        (WebKit::WebPageSerializerImpl::postActionAfterSerializeEndTag):
+        (WebKit::WebPageSerializerImpl::encodeAndFlushBuffer):
+        (WebKit::WebPageSerializerImpl::openTagToString):
+        (WebKit::WebPageSerializerImpl::endTagToString):
+        (WebKit::WebPageSerializerImpl::buildContentForNode):
+        * src/WebPageSerializerImpl.h:
+
+2010-10-13  Yury Semikhatsky  <yurys@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: stack information is inconsistent between console.trace and runtime errors.
+        https://bugs.webkit.org/show_bug.cgi?id=47252
+
+        * DEPS: bump up V8 revision
+
+2010-10-12  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed. Fixes for all WebGL content causing assertion failures
+        in Chromium after http://trac.webkit.org/changeset/69619 and
+        http://trac.webkit.org/changeset/69624 .
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::create):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+
+2010-10-12  Alok priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Remove support for ANGLE SH_VERSION <= 100
+        https://bugs.webkit.org/show_bug.cgi?id=47307
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::angleCreateCompilers):
+        (WebKit::WebGraphicsContext3DDefaultImpl::angleValidateShaderSource):
+
+2010-10-12  James Robinson  <jamesr@chromium.org>
+
+        Unreviewed chromium compile fixes for http://trac.webkit.org/changeset/69619.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::create):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setIsAcceleratedCompositingActive):
+        * src/WebViewImpl.h:
+
+2010-10-12  Jian Li  <jianli@chromium.org>
+
+        Unreviewed. Bump up revision in order to pick up fix.
+
+        * DEPS:
+
+2010-10-12  Jian Li  <jianli@chromium.org>
+
+        Unreview. Build fix for chromium.
+
+        * public/WebBlobRegistry.h:
+
+2010-10-12  Jian Li  <jianli@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Update WebBlobData to adapt to BlobData change in terms of
+        handling string data item.
+        https://bugs.webkit.org/show_bug.cgi?id=47423
+
+        Also remove unneeded methods in WebBlobData. WebBlobStorageData.* are
+        also removed since they're not longer needed.
+
+        * WebKit.gyp:
+        * public/WebBlobData.h:
+        * public/WebBlobRegistry.h:
+        * public/WebBlobStorageData.h: Removed.
+        * public/WebThreadSafeData.h: Added.
+        * src/WebBlobData.cpp:
+        * src/WebBlobStorageData.cpp: Removed.
+        * src/WebThreadSafeData.cpp: Added.
+
+2010-10-12  Kavita Kanetkar  <kkanetkar@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        [FileSystem] Add ability to pass a bool to create or not create root path while opening filesystem.
+        https://bugs.webkit.org/show_bug.cgi?id=47519
+
+        * public/WebCommonWorkerClient.h:
+        (WebKit::WebCommonWorkerClient::openFileSystem):
+        * public/WebFrameClient.h:
+        (WebKit::WebFrameClient::openFileSystem):
+
+2010-10-12  James Robinson  <jamesr@chromium.org>
+
+        Reviewed by Nate Chapin (in person).
+
+        Fix chromium compile.
+
+        * src/WebPageSerializerImpl.cpp:
+        (WebKit::WebPageSerializerImpl::WebPageSerializerImpl):
+        (WebKit::WebPageSerializerImpl::serialize):
+
+2010-10-12  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Gavin Barraclough.
+
+        Unify JSC::StringBuilder & WebCore::StringBuilder
+        https://bugs.webkit.org/show_bug.cgi?id=47538
+
+        * src/LocalizedStrings.cpp:
+        (WebCore::imageTitle): Use WTF::StringBuilder.
+        * src/WebEntities.cpp:
+        (WebKit::WebEntities::convertEntitiesInString): Ditto.
+        * src/WebPageSerializerImpl.cpp: Remove useless includes.
+        (WebKit::WebPageSerializerImpl::encodeAndFlushBuffer): 
+        * src/WebPageSerializerImpl.h: Use WTF::StringBuilder.
+
+2010-10-07  Stephen White  <senorblanco@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Zero-out all textures created via WebGraphicsContext3DDefaultImpl::texImage2D().
+        https://bugs.webkit.org/show_bug.cgi?id=47178
+        
+        Covered by fast/canvas/toDataURL-alpha.html, when run with --accelerated-2d-canvas.
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::bytesPerComponent):
+        (WebKit::componentsPerPixel):
+        (WebKit::imageSizeInBytes):
+        (WebKit::WebGraphicsContext3DDefaultImpl::texImage2D):
+
+2010-10-12  Dave Moore  <davemoore@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Use new WebThemeEngine api on chromium / linux to draw scrollbars.
+        https://bugs.webkit.org/show_bug.cgi?id=47473
+
+        * public/WebThemeEngine.h: Removed.
+        * chromium/src/ChromiumBridge.cpp:
+
+2010-10-11  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Prepare Clipboard/DragData for transition to new drag-and-drop interface.
+        https://bugs.webkit.org/show_bug.cgi?id=44992
+
+        Add a new entry point for drag in to allow a graceful transition
+        from the legacy drag and drop model, where all data is copied in at the
+        beginning of a drag, to a model where data is retrieved on demand via
+        IPCs. The rationale for this is when we begin supporting arbitrary MIME
+        types in dataTransfer, we don't want to be copying aribtrary amounts of
+        data over for each start drag IPC.
+
+        * public/WebView.h:
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::initialize): Use the legacy data object.
+        (WebKit::WebDragData::ensureMutable): Change the if to an ASSERT.
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::dragTargetDragEnterNew): New entry point.
+        * src/WebViewImpl.h:
+
+2010-10-11  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [Chromium] Add plumbing for synchronous indexedDB exceptions
+        https://bugs.webkit.org/show_bug.cgi?id=47511
+
+        Add a WebExceptionCode file (already run by fishd) and add versions of
+        each applicable method that take such a parameter.  A follow up patch
+        will be posted with the meat.
+
+        * WebKit.gyp:
+        * public/WebExceptionCode.h: Added.
+        * public/WebIDBCursor.h:
+        (WebKit::WebIDBCursor::update):
+        (WebKit::WebIDBCursor::continueFunction):
+        (WebKit::WebIDBCursor::remove):
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::objectStore):
+        (WebKit::WebIDBDatabase::createObjectStore):
+        (WebKit::WebIDBDatabase::removeObjectStore):
+        (WebKit::WebIDBDatabase::setVersion):
+        (WebKit::WebIDBDatabase::transaction):
+        * public/WebIDBIndex.h:
+        (WebKit::WebIDBIndex::openObjectCursor):
+        (WebKit::WebIDBIndex::openKeyCursor):
+        (WebKit::WebIDBIndex::getObject):
+        (WebKit::WebIDBIndex::getKey):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::get):
+        (WebKit::WebIDBObjectStore::put):
+        (WebKit::WebIDBObjectStore::remove):
+        (WebKit::WebIDBObjectStore::createIndex):
+        (WebKit::WebIDBObjectStore::index):
+        (WebKit::WebIDBObjectStore::removeIndex):
+        (WebKit::WebIDBObjectStore::openCursor):
+
+2010-10-11  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        The names of IndexedDB-specific attributes of DOMWindow should be prefixed with 'webkit'.
+        https://bugs.webkit.org/show_bug.cgi?id=47508
+
+        * src/WebRuntimeFeatures.cpp:
+        (WebKit::WebRuntimeFeatures::enableIndexedDatabase):
+        (WebKit::WebRuntimeFeatures::isIndexedDatabaseEnabled):
+
+2010-10-11  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, roll chromium DEPS to pick up Dave's fix for
+        scrollbar painting.  This will be needed by an upcoming patch.
+
+        * DEPS:
+
+2010-10-11  Kinuko Yasuda  <kinuko@google.com>
+
+        Reviewed by David Levin.
+
+        Support DirectoryEntry.removeRecursively for FileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=47400
+
+        * src/AsyncFileSystemChromium.cpp:
+        (WebCore::AsyncFileSystemChromium::removeRecursively): Added.
+        * src/AsyncFileSystemChromium.h:
+        * src/WorkerAsyncFileSystemChromium.cpp:
+        (WebCore::WorkerAsyncFileSystemChromium::removeRecursively): Added.
+        * src/WorkerAsyncFileSystemChromium.h:
+        * src/WorkerFileSystemCallbacksBridge.cpp:
+        (WebKit::WorkerFileSystemCallbacksBridge::postRemoveRecursivelyToMainThread): Added.
+        (WebKit::WorkerFileSystemCallbacksBridge::removeRecursivelyOnMainThread): Added.
+        * src/WorkerFileSystemCallbacksBridge.h:
+
+2010-10-09  Varun Jain  <varunjain@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Adding one method to the WebView interface: method to inform the
+        renderer to scroll the currently focused element into view, for
+        instance, when it is hidden due to window resizing.
+        Also adding methods to WebNode and WebElement to expose more
+        features of the underlying WebCore::Node.
+        https://bugs.webkit.org/show_bug.cgi?id=46296
+
+        * public/WebElement.h:
+        * public/WebNode.h:
+        * public/WebView.h:
+        * src/WebElement.h:
+        (WebKit::WebElement::isTextFormControlElement):
+        * src/WebNode.cpp:
+        (WebKit::WebNode::isContentEditable):
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::scrollFocusedNodeIntoView):
+        * src/WebViewImpl.h:
+
+2010-10-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        [Chromium] IDBFactory::open only works in single process mode.
+        https://bugs.webkit.org/show_bug.cgi?id=47444
+
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+
+2010-10-08  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IndexedDB does not have a quota mechanism.
+        https://bugs.webkit.org/show_bug.cgi?id=47389
+
+        * public/WebIDBFactory.h:
+        (WebKit::WebIDBFactory::open):
+        * src/IDBFactoryBackendProxy.cpp:
+        (WebCore::IDBFactoryBackendProxy::open):
+        * src/IDBFactoryBackendProxy.h:
+        * src/WebIDBFactoryImpl.cpp:
+        (WebKit::WebIDBFactoryImpl::open):
+        * src/WebIDBFactoryImpl.h:
+
+2010-10-07  Zhenyao Mo  <zmo@google.com>
+
+        Unreviewed, roll chromium to r61902.
+
+        * DEPS:
+
+2010-10-07  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Tony Chang.
+
+        Copy mesa lib into DumpRenderTree bundle in Mac
+        https://bugs.webkit.org/show_bug.cgi?id=47385
+
+        * WebKit.gyp:
+
+2010-10-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Minor naming cleanup in WebDragData, part 2
+        https://bugs.webkit.org/show_bug.cgi?id=47227
+
+        Chromium no longer uses the deprecated methods, so delete them.
+
+        * DEPS:
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+
+2010-10-07  Dave Moore  <davemoore@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        Add WebThemeEngine api for chromium/linux
+        https://bugs.webkit.org/show_bug.cgi?id=47278
+        Create new linux specific version of WinThemeEngine.h and move
+        existing windows specific one to win directory. Keep old top
+        level file until chromium is updated to use the new ones.
+
+        * WebKit.gyp:
+        * public/WebThemeEngine.h:
+        * src/ChromiumBridge.cpp:
+
+2010-10-07  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Chromium multi-dll build broken due to WebResourceRawHeaders methods lacking WEBKIT_API decl spec
+        https://bugs.webkit.org/show_bug.cgi?id=47329
+
+        * public/WebResourceRawHeaders.h:
+        (WebKit::WebResourceRawHeaders::WebResourceRawHeaders):
+        (WebKit::WebResourceRawHeaders::~WebResourceRawHeaders):
+        (WebKit::WebResourceRawHeaders::operator =):
+        * src/WebResourceRawHeaders.cpp:
+        (WebKit::WebResourceRawHeaders::initialize):
+        (WebKit::WebResourceRawHeaders::reset):
+        (WebKit::WebResourceRawHeaders::assign):
+
+2010-10-06  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Remove unused accessibility functions from webkit.
+        https://bugs.webkit.org/attachment.cgi?bugid=46707
+
+        * public/WebAccessibilityCache.h:
+        * public/WebViewClient.h:
+        * src/ChromeClientImpl.cpp:
+        (WebKit::ChromeClientImpl::focusedNodeChanged):
+        * src/WebAccessibilityCacheImpl.cpp:
+        * src/WebAccessibilityCacheImpl.h:
+
+2010-10-06  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Add FileSystemSync implementation for Worker
+        https://bugs.webkit.org/show_bug.cgi?id=47044
+
+        * src/LocalFileSystemChromium.cpp:
+        (WebCore::LocalFileSystem::requestFileSystem): Added a new parameter
+        for synchronous mode.
+        * src/WebFileSystemCallbacksImpl.cpp:
+        (WebKit::WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl): Added
+        a parameter for synchronous mode.
+        (WebKit::WebFileSystemCallbacksImpl::didOpenFileSystem): Changed to
+        creates WorkerAsyncFileSystemChromium with synchronous flag.
+        * src/WebFileSystemCallbacksImpl.h:
+        * src/WebWorkerBase.cpp:
+        (WebKit::WebWorkerBase::openFileSystem): Added a parameter for
+        synchronous mode.
+        * src/WebWorkerBase.h:
+        * src/WorkerAsyncFileSystemChromium.cpp:
+        (WebCore::WorkerAsyncFileSystemChromium::WorkerAsyncFileSystemChromium):
+        (WebCore::WorkerAsyncFileSystemChromium::waitForOperationToComplete):
+        Added.
+        (WebCore::WorkerAsyncFileSystemChromium::move):
+        (WebCore::WorkerAsyncFileSystemChromium::copy):
+        (WebCore::WorkerAsyncFileSystemChromium::remove):
+        (WebCore::WorkerAsyncFileSystemChromium::readMetadata):
+        (WebCore::WorkerAsyncFileSystemChromium::createFile):
+        (WebCore::WorkerAsyncFileSystemChromium::createDirectory):
+        (WebCore::WorkerAsyncFileSystemChromium::fileExists):
+        (WebCore::WorkerAsyncFileSystemChromium::directoryExists):
+        (WebCore::WorkerAsyncFileSystemChromium::readDirectory):
+        (WebCore::WorkerAsyncFileSystemChromium::createWorkerFileSystemCallbacksBridge):
+        Updated to store the created bridge in a member variable so that
+        we can call bridge->stop() later when the RunLoop is terminating.
+        * src/WorkerAsyncFileSystemChromium.h:
+        (WebCore::WorkerAsyncFileSystemChromium::create): Added a new
+        parameter for synchronous mode.
+
+2010-10-06  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IDBDatabase and IDBObjectStore metadata is not recovered correctly when the setVersion transactions aborts.
+        https://bugs.webkit.org/show_bug.cgi?id=47245
+
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebCore::IDBTransactionBackendProxy::scheduleTask):
+        * src/IDBTransactionBackendProxy.h:
+
+2010-10-06  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [Chromium] Add webkit unit tests to chromium multi-dll build.
+
+        In chromium multi-dll build mode, compile the webkit unit tests
+        code in webkit.dll and export an api that runs the tests.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46907
+
+        * WebKit.gyp:
+        * WebKit.gypi:
+        * tests/RunAllTests.cpp:
+        (main):
+        * tests/WebUnitTests.cpp: Added.
+        (WebKit::RunAllUnitTests):
+        * tests/WebUnitTests.h: Added.
+
+2010-10-05  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [Chromium] WebIDBKeyRange should handle null left/right pointers
+        https://bugs.webkit.org/show_bug.cgi?id=47247
+
+        * src/WebIDBKeyRange.cpp:
+        (WebKit::WebIDBKeyRange::assign):
+        (WebKit::WebIDBKeyRange::left):
+        (WebKit::WebIDBKeyRange::right):
+        (WebKit::WebIDBKeyRange::flags):
+
+2010-10-06  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r69202.
+        http://trac.webkit.org/changeset/69202
+        https://bugs.webkit.org/show_bug.cgi?id=46937
+
+        Broke compile of test_shell
+
+        * DEPS:
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::hasFileNames):
+        (WebKit::WebDragData::fileNames):
+        (WebKit::WebDragData::setFileNames):
+        (WebKit::WebDragData::appendToFileNames):
+        (WebKit::WebDragData::fileContentFileName):
+        (WebKit::WebDragData::setFileContentFileName):
+
+2010-10-06  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Minor naming cleanup in WebDragData, part 2
+        https://bugs.webkit.org/show_bug.cgi?id=46937
+
+        Chromium no longer uses the deprecated methods, so delete them.
+
+        * DEPS:
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+
+2010-09-29  Alpha Lam  <hclam@chromium.org>
+
+        Reviewed by James Robinson.
+
+        Render textures in video frame directly.
+        https://bugs.webkit.org/show_bug.cgi?id=46765
+
+        Add getter for accessing textures stored in VideoFrameChromium and WebVideoFrame.
+        Also explicitly instruct VideoLayerChromium to release video frame when the owner
+        of video frame is going away.
+
+        * public/WebVideoFrame.h:
+        * src/AssertMatchingEnums.cpp:
+        * src/VideoFrameChromiumImpl.cpp:
+        (WebKit::VideoFrameChromiumImpl::texture):
+        * src/VideoFrameChromiumImpl.h:
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl):
+        (WebKit::WebMediaPlayerClientImpl::load):
+        * src/WebMediaPlayerClientImpl.h:
+
+2010-10-05  Nat Duca  <nduca@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] Handle composited root layer invalidations in screenspace,
+        fixing the disappearing scrollbar problem.
+        https://bugs.webkit.org/show_bug.cgi?id=46864
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::composite):
+        (WebKit::WebViewImpl::scrollRootLayerRect):
+        (WebKit::WebViewImpl::invalidateRootLayerRect):
+        (WebKit::WebViewImpl::doComposite):
+
+2010-10-05  Kenneth Russell  <kbr@google.com>
+
+        Unreviewed, follow up to 47216. Add newline above "protected:".
+
+        * public/WebFrame.h:
+
+2010-10-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Implement layerTreeAsText in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=47216
+
+        Plumbed Frame::layerTreeAsText through Chromium's WebKit API to
+        make it callable from DumpRenderTree.
+
+        No new tests; verified with existing compositor layout tests.
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::layerTreeAsText):
+        * src/WebFrameImpl.h:
+
+2010-10-05  Andrew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Notification onclick() events don't act like user gestures
+        https://bugs.webkit.org/show_bug.cgi?id=47137
+
+        * src/WebNotification.cpp:
+        (WebKit::WebNotification::dispatchClickEvent):
+        Use UserGestureIndicator to make sure click events are treated like user gestures.
+
+2010-10-05  Alok Priyadarshi  <alokp@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Supported ANGLE SH_VERSION > 100
+        https://bugs.webkit.org/show_bug.cgi?id=47024
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::angleCreateCompilers):
+        (WebKit::WebGraphicsContext3DDefaultImpl::angleValidateShaderSource):
+
+2010-10-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Rename get* and open*Cursor per the spec on IDBIndex
+        https://bugs.webkit.org/show_bug.cgi?id=46906
+
+        The spec changed so that:
+        IDBIndex.get -> getKey
+        IDBIndex.getObject -> get
+        IDBIndex.openCursor -> openKeyCursor
+        IDBIndex.openObjectCursor -> openCursor
+
+        * public/WebIDBIndex.h:
+        (WebKit::WebIDBIndex::openCursor):
+        (WebKit::WebIDBIndex::openKeyCursor):
+        (WebKit::WebIDBIndex::get):
+        (WebKit::WebIDBIndex::getKey):
+        * src/IDBIndexBackendProxy.cpp:
+        (WebCore::IDBIndexBackendProxy::openCursor):
+        (WebCore::IDBIndexBackendProxy::openKeyCursor):
+        (WebCore::IDBIndexBackendProxy::get):
+        (WebCore::IDBIndexBackendProxy::getKey):
+        * src/IDBIndexBackendProxy.h:
+        * src/WebIDBIndexImpl.cpp:
+        (WebKit::WebIDBIndexImpl::openObjectCursor):
+        (WebKit::WebIDBIndexImpl::openKeyCursor):
+        (WebKit::WebIDBIndexImpl::getObject):
+        (WebKit::WebIDBIndexImpl::getKey):
+        * src/WebIDBIndexImpl.h:
+
+2010-10-04  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        IDBDatabase::createObjectStore/removeObjectStore and IDBObjectStore::createIndex/removeIndex should be synchronous.
+        https://bugs.webkit.org/show_bug.cgi?id=46883
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::createObjectStore):
+        (WebKit::WebIDBDatabase::removeObjectStore):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::createIndex):
+        (WebKit::WebIDBObjectStore::removeIndex):
+        * src/IDBDatabaseProxy.cpp:
+        (WebCore::IDBDatabaseProxy::createObjectStore):
+        (WebCore::IDBDatabaseProxy::removeObjectStore):
+        * src/IDBDatabaseProxy.h:
+        * src/IDBObjectStoreProxy.cpp:
+        (WebCore::IDBObjectStoreProxy::createIndex):
+        (WebCore::IDBObjectStoreProxy::removeIndex):
+        * src/IDBObjectStoreProxy.h:
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::createObjectStore):
+        (WebKit::WebIDBDatabaseImpl::removeObjectStore):
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::createIndex):
+        (WebKit::WebIDBObjectStoreImpl::removeIndex):
+        * src/WebIDBObjectStoreImpl.h:
+
+2010-10-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Yury Semikhatsky.
+
+        Web Inspector: [Chromium][Extension API] provide tab id of inspected tab in extension API
+        https://bugs.webkit.org/show_bug.cgi?id=47080
+
+        * src/js/DevTools.js: Added a way for extension to get tabId of inspected window.
+        (WebInspector.platformExtensionAPI):
+        (WebInspector.buildPlatformExtensionAPI):
+        (WebInspector.setInspectedTabId):
+
+2010-10-04  Tony Gentilcore  <tonyg@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Properly clear WebKit cache when chromium cache is cleared
+        https://bugs.webkit.org/show_bug.cgi?id=47119
+
+        Contributed by Ricardo Vargas.
+
+        See: http://code.google.com/p/chromium/issues/detail?id=54336
+
+        * src/WebCache.cpp:
+        (WebKit::WebCache::clear):
+
+2010-10-04  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Fix broken C++ in PODInterval and PODIntervalTree
+        https://bugs.webkit.org/show_bug.cgi?id=47063
+
+        Change functions to be template specializations, like it's now required
+        by PODIntervalTree and friends.
+
+        * tests/PODIntervalTreeTest.cpp:
+
+2010-10-04  Matt Mueller  <mattm@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        When building under chromium, build libwebkit as the same type (shared
+        or static) as chromium.  Fixes problems with multiple calls to global
+        initializers/finalizers in shared chromium build.
+        https://bugs.webkit.org/show_bug.cgi?id=46762
+
+        * WebKit.gyp:
+
+2010-10-04  Alpha Lam  <hclam@chromium.org>
+
+        Build fix. Not reviewed.
+
+        Remove a function declaration.
+
+        * src/ChromeClientImpl.h:
+
+2010-10-04  Alpha Lam  <hclam@chromium.org>
+
+        Build fix. Not reviewed.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47135
+        Add a stub method to make the build happy.
+
+        * src/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::stopLoadingInFrame):
+
+2010-10-04  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by James Robinson.
+
+        Move SharedGraphicsContext3D from ChromeClient to Page
+        https://bugs.webkit.org/show_bug.cgi?id=47113
+
+        * src/ChromeClientImpl.cpp:
+        * src/WebViewImpl.cpp:
+        * src/WebViewImpl.h:
+
+2010-10-04  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        Implement IndexedDB's oncomplete and ontimeout.
+        https://bugs.webkit.org/show_bug.cgi?id=47106
+
+        * public/WebIDBTransactionCallbacks.h:
+        (WebKit::WebIDBTransactionCallbacks::id):
+        (WebKit::WebIDBTransactionCallbacks::onAbort):
+        (WebKit::WebIDBTransactionCallbacks::onComplete):
+        (WebKit::WebIDBTransactionCallbacks::onTimeout):
+        * src/IDBTransactionCallbacksProxy.cpp:
+        (WebCore::IDBTransactionCallbacksProxy::onComplete):
+        (WebCore::IDBTransactionCallbacksProxy::onTimeout):
+        * src/IDBTransactionCallbacksProxy.h:
+        * src/WebIDBTransactionCallbacksImpl.cpp:
+        (WebCore::WebIDBTransactionCallbacksImpl::onComplete):
+        (WebCore::WebIDBTransactionCallbacksImpl::onTimeout):
+        * src/WebIDBTransactionCallbacksImpl.h:
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename RedirectScheduler to NavigationScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=47037
+
+        Update for name change.
+
+        * src/ApplicationCacheHost.cpp:
+        (WebCore::ApplicationCacheHost::selectCacheWithManifest):
+        * src/WebFrameImpl.cpp:
+        (WebKit::WebFrameImpl::loadJavaScriptURL):
+
+2010-10-01  Victoria Kirst  <vrk@google.com>
+
+        Reviewed by James Robinson.
+
+        Fixing crash when audio media player is destructed
+        https://bugs.webkit.org/show_bug.cgi?id=47020
+
+        Creates the VideoLayerChromium layer only if the media player contains
+        a video.
+
+        * src/WebMediaPlayerClientImpl.cpp:
+        (WebKit::WebMediaPlayerClientImpl::readyStateChanged):
+        (WebKit::WebMediaPlayerClientImpl::create):
+
+2010-10-01  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [Chromium] Remove WebURLLoaderClient::didFinishLoading(WebURLLoader*)
+        https://bugs.webkit.org/show_bug.cgi?id=47008
+
+        Now that WebURLLoaderClient::didFinishLoading(WebURLLoader*) has no
+        more callers, it can be removed (requires a Chromium roll to
+        http://crrev.com/61206, which actually removed the last usage).
+
+        * DEPS:
+        * public/WebURLLoaderClient.h:
+
+2010-10-01  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Minor naming cleanup in WebDragData
+        https://bugs.webkit.org/show_bug.cgi?id=46937
+
+        This is a two-part patch--one to add the new methods with normalized
+        names that follow general WebKit convention, and a followup patch to
+        remove the original methods once Chromium is updated.
+
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::hasFileNames): renamed to containsFilenames
+        (WebKit::WebDragData::fileNames): renamed to filenames
+        (WebKit::WebDragData::setFileNames): renamed to setFilenames
+        (WebKit::WebDragData::appendToFileNames): renamed to appendToFilenames
+        (WebKit::WebDragData::containsFilenames):
+        (WebKit::WebDragData::filenames):
+        (WebKit::WebDragData::setFilenames):
+        (WebKit::WebDragData::appendToFilenames):
+        (WebKit::WebDragData::fileContentFileName): renamed to fileContentFilename
+        (WebKit::WebDragData::setFileContentFileName): renamed to setFileContentFilename
+        (WebKit::WebDragData::fileContentFilename):
+        (WebKit::WebDragData::setFileContentFilename):
+
+2010-10-01  Jochen Eisinger  <jochen@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] add an identifier method to WebFrame. The identifier can be used to identify
+        a given frame of a view over time. Using a pointer to the WebFrame object is fragile,
+        since a new frame might have been allocated at the same address as an old, deleted frame.
+        https://bugs.webkit.org/show_bug.cgi?id=46884
+
+        * public/WebFrame.h:
+        * src/WebFrameImpl.cpp:
+        (WebKit::generateFrameIdentifier):
+        (WebKit::WebFrameImpl::identifier):
+        (WebKit::WebFrameImpl::WebFrameImpl):
+        * src/WebFrameImpl.h:
+
+2010-09-29  John Abd-El-Malek  <jam@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Changes to consolidate plugin zoom
+        https://bugs.webkit.org/show_bug.cgi?id=46550
+
+        * public/WebPlugin.h:
+        (WebKit::WebPlugin::setZoomLevel):
+        * public/WebPluginContainer.h:
+        * public/WebView.h:
+        * public/WebViewClient.h:
+        (WebKit::WebViewClient::zoomLimitsChanged):
+        (WebKit::WebViewClient::zoomLevelChanged):
+        * src/FrameLoaderClientImpl.cpp:
+        (WebKit::FrameLoaderClientImpl::createPlugin):
+        * src/WebPluginContainerImpl.cpp:
+        (WebKit::WebPluginContainerImpl::loadFrameRequest):
+        (WebKit::WebPluginContainerImpl::zoomChanged):
+        (WebKit::WebPluginContainerImpl::zoomLimitsChanged):
+        * src/WebPluginContainerImpl.h:
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::WebViewImpl):
+        (WebKit::WebViewImpl::zoomLevel):
+        (WebKit::WebViewImpl::setZoomLevel):
+        (WebKit::WebViewImpl::zoomLimitsChanged):
+        (WebKit::WebViewImpl::fullFramePluginZoomLevelChanged):
+        (WebKit::WebView::zoomLevelToZoomFactor):
+        (WebKit::WebView::zoomFactorToZoomLevel):
+        * src/WebViewImpl.h:
+
+2010-09-30  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by James Robinson.
+
+        [Chromium] build fails unless ACCELERATED_2D_CANVAS defined
+        https://bugs.webkit.org/show_bug.cgi?id=46955
+        
+        Added ifdef guard around SharedGraphicsContext3D.
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::getSharedGraphicsContext3D):
+        * src/WebViewImpl.h:
+
+2010-09-30  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Chris Marrin.
+
+        Add GetGraphicsResetStatusARB entry point from ARB_robustness
+        extension to GraphicsContext3D
+        https://bugs.webkit.org/show_bug.cgi?id=46850
+
+        Added a stub for GraphicsContext3D::getGraphicsResetStatusARB.
+
+        * src/GraphicsContext3DChromium.cpp:
+        (WebCore::GraphicsContext3D::getGraphicsResetStatusARB):
+
+2010-09-30  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove WebHTTPBody::appendFileRange(..., const WebFileInfo&).
+
+        * public/WebHTTPBody.h:
+        * src/WebHTTPBody.cpp:
+        (WebKit::WebHTTPBody::elementAt):
+
+2010-09-30  Nico Weber  <thakis@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        [chromium] Fix clang error in KURLTest.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=46861
+
+        * tests/KURLTest.cpp:
+        (WTF::operator<<):
+
+2010-09-30  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Refactor ChromiumDataObject to use getters/setters.
+        https://bugs.webkit.org/show_bug.cgi?id=46559
+
+        This is an intermediate step to converting ChromiumDataObject to use
+        callbacks to the browser to retrieve data.
+
+        * public/WebDragData.h:
+        * src/WebDragData.cpp:
+        (WebKit::WebDragData::initialize):
+        (WebKit::WebDragData::url):
+        (WebKit::WebDragData::setURL):
+        (WebKit::WebDragData::urlTitle):
+        (WebKit::WebDragData::setURLTitle):
+        (WebKit::WebDragData::downloadMetadata):
+        (WebKit::WebDragData::setDownloadMetadata):
+        (WebKit::WebDragData::fileExtension):
+        (WebKit::WebDragData::setFileExtension):
+        (WebKit::WebDragData::hasFileNames):
+        (WebKit::WebDragData::fileNames):
+        (WebKit::WebDragData::setFileNames):
+        (WebKit::WebDragData::appendToFileNames):
+        (WebKit::WebDragData::plainText):
+        (WebKit::WebDragData::setPlainText):
+        (WebKit::WebDragData::htmlText):
+        (WebKit::WebDragData::setHTMLText):
+        (WebKit::WebDragData::htmlBaseURL):
+        (WebKit::WebDragData::setHTMLBaseURL):
+        (WebKit::WebDragData::fileContentFileName):
+        (WebKit::WebDragData::setFileContentFileName):
+        (WebKit::WebDragData::fileContent):
+        (WebKit::WebDragData::setFileContent):
+
+2010-09-29  Zhenyao Mo  <zmo@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        glsl-conformance.html on khronos will crash chromium --in-process-webgl
+        https://bugs.webkit.org/show_bug.cgi?id=46863
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp: Make ShaderSourceMap as <ShaderID, ShaderSourceEntry*>, so map resizing will be efficient and we don't need to worry about pointer copying.
+        (WebKit::WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl):
+        (WebKit::WebGraphicsContext3DDefaultImpl::compileShader):
+        (WebKit::WebGraphicsContext3DDefaultImpl::getShaderiv):
+        (WebKit::WebGraphicsContext3DDefaultImpl::getShaderInfoLog):
+        (WebKit::WebGraphicsContext3DDefaultImpl::getShaderSource):
+        (WebKit::WebGraphicsContext3DDefaultImpl::shaderSource):
+        (WebKit::WebGraphicsContext3DDefaultImpl::createShader):
+        (WebKit::WebGraphicsContext3DDefaultImpl::deleteShader):
+        * src/WebGraphicsContext3DDefaultImpl.h: Ditto.
+        (WebKit::WebGraphicsContext3DDefaultImpl::ShaderSourceEntry::ShaderSourceEntry):
+
+2010-09-30  Andrei Popescu  <andreip@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        [Chromium] WebIDBDatabase and WebIDBObjectStore are missing methods called from Chromium land.
+        https://bugs.webkit.org/show_bug.cgi?id=46922
+        
+        The missing functions were removed in r68795.
+
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::createObjectStore):
+        (WebKit::WebIDBDatabase::removeObjectStore):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::createIndex):
+        (WebKit::WebIDBObjectStore::removeIndex):
+
+2010-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Add accelerated compositing support to DumpRenderTree and test_shell
+        https://bugs.webkit.org/show_bug.cgi?id=46849
+
+        Added offscreen code path for WebGraphicsContext3DDefaultImpl which
+        works with the compositor integration in both DumpRenderTree and
+        test_shell, since both pass a non-null WebCanvas* to WebViewImpl::paint
+        and thereby trigger the compositor's readback code path. Added support
+        for --enable-accelerated-compositing to DumpRenderTree.
+
+        Tested in both test_shell and DumpRenderTree on Linux, the latter by
+        modifying a compositing layout test, dumping the pixels and verifying
+        that they matched the output when the compositor was active.
+
+        * src/WebGraphicsContext3DDefaultImpl.cpp:
+        (WebKit::WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl):
+        (WebKit::WebGraphicsContext3DDefaultImpl::initialize):
+        (WebKit::WebGraphicsContext3DDefaultImpl::resolveMultisampledFramebuffer):
+        (WebKit::WebGraphicsContext3DDefaultImpl::getPlatformTextureId):
+        (WebKit::WebGraphicsContext3DDefaultImpl::prepareTexture):
+        (WebKit::WebGraphicsContext3DDefaultImpl::readBackFramebuffer):
+        (WebKit::WebGraphicsContext3DDefaultImpl::copyTexImage2D):
+        (WebKit::WebGraphicsContext3DDefaultImpl::copyTexSubImage2D):
+        (WebKit::WebGraphicsContext3DDefaultImpl::readPixels):
+        * src/WebGraphicsContext3DDefaultImpl.h:
+
+2010-09-29  Jeremy Orlow  <jorlow@chromium.org>
+
+        Reviewed by Steve Block.
+
+        Finished IDBTransaction for IndexedDB
+        https://bugs.webkit.org/show_bug.cgi?id=46823
+
+        Plumbing.
+
+        * public/WebIDBCallbacks.h:
+        (WebKit::WebIDBCallbacks::onSuccess):
+        * public/WebIDBDatabase.h:
+        (WebKit::WebIDBDatabase::createObjectStore):
+        (WebKit::WebIDBDatabase::removeObjectStore):
+        (WebKit::WebIDBDatabase::close):
+        * public/WebIDBIndex.h:
+        (WebKit::WebIDBIndex::openObjectCursor):
+        (WebKit::WebIDBIndex::openCursor):
+        (WebKit::WebIDBIndex::getObject):
+        (WebKit::WebIDBIndex::get):
+        * public/WebIDBObjectStore.h:
+        (WebKit::WebIDBObjectStore::get):
+        (WebKit::WebIDBObjectStore::put):
+        (WebKit::WebIDBObjectStore::remove):
+        (WebKit::WebIDBObjectStore::createIndex):
+        (WebKit::WebIDBObjectStore::removeIndex):
+        (WebKit::WebIDBObjectStore::openCursor):
+        * public/WebIDBTransaction.h:
+        (WebKit::WebIDBTransaction::id):
+        (WebKit::WebIDBTransaction::getIDBTransactionBackendInterface):
+        * src/IDBCallbacksProxy.cpp:
+        (WebCore::IDBCallbacksProxy::onSuccess):
+        * src/IDBCallbacksProxy.h:
+        * src/IDBDatabaseProxy.cpp:
+        (WebCore::IDBDatabaseProxy::createObjectStore):
+        (WebCore::IDBDatabaseProxy::removeObjectStore):
+        (WebCore::IDBDatabaseProxy::close):
+        * src/IDBDatabaseProxy.h:
+        * src/IDBIndexBackendProxy.cpp:
+        (WebCore::IDBIndexBackendProxy::openObjectCursor):
+        (WebCore::IDBIndexBackendProxy::openCursor):
+        (WebCore::IDBIndexBackendProxy::getObject):
+        (WebCore::IDBIndexBackendProxy::get):
+        * src/IDBIndexBackendProxy.h:
+        * src/IDBObjectStoreProxy.cpp:
+        (WebCore::IDBObjectStoreProxy::put):
+        (WebCore::IDBObjectStoreProxy::remove):
+        (WebCore::IDBObjectStoreProxy::createIndex):
+        (WebCore::IDBObjectStoreProxy::removeIndex):
+        (WebCore::IDBObjectStoreProxy::openCursor):
+        * src/IDBObjectStoreProxy.h:
+        * src/IDBTransactionBackendProxy.cpp:
+        (WebCore::IDBTransactionBackendProxy::IDBTransactionBackendProxy):
+        * src/WebIDBCallbacksImpl.cpp:
+        (WebCore::WebIDBCallbacksImpl::onSuccess):
+        * src/WebIDBCallbacksImpl.h:
+        * src/WebIDBDatabaseImpl.cpp:
+        (WebKit::WebIDBDatabaseImpl::createObjectStore):
+        (WebKit::WebIDBDatabaseImpl::removeObjectStore):
+        (WebKit::WebIDBDatabaseImpl::close):
+        * src/WebIDBDatabaseImpl.h:
+        * src/WebIDBIndexImpl.cpp:
+        (WebKit::WebIDBIndexImpl::openCursor):
+        (WebKit::WebIDBIndexImpl::openObjectCursor):
+        (WebKit::WebIDBIndexImpl::getObject):
+        (WebKit::WebIDBIndexImpl::get):
+        * src/WebIDBIndexImpl.h:
+        * src/WebIDBObjectStoreImpl.cpp:
+        (WebKit::WebIDBObjectStoreImpl::put):
+        (WebKit::WebIDBObjectStoreImpl::remove):
+        (WebKit::WebIDBObjectStoreImpl::createIndex):
+        (WebKit::WebIDBObjectStoreImpl::removeIndex):
+        (WebKit::WebIDBObjectStoreImpl::openCursor):
+        * src/WebIDBObjectStoreImpl.h:
+
+2010-09-29  Andrey Kosyakov  <caseq@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: display headers actually used by network stack in Resources tab
+        Added plumbing for raw headers flag and response field between chromium and WebCore.
+        https://bugs.webkit.org/show_bug.cgi?id=46092
+
+        * WebKit.gyp:
+        * public/WebResourceRawHeaders.h: Added.
+        * public/WebURLRequest.h:
+        * public/WebURLResponse.h:
+        * src/WebDevToolsAgentImpl.cpp:
+        (WebKit::WebDevToolsAgentImpl::willSendRequest):
+        * src/WebResourceRawHeaders.cpp: Added.
+        (WebKit::WebResourceRawHeaders::WebResourceRawHeaders):
+        (WebKit::WebResourceRawHeaders::~WebResourceRawHeaders):
+        (WebKit::WebResourceRawHeaders::operator WTF::PassRefPtr<WebCore::ResourceRawHeaders>):
+        (WebKit::addHeader):
+        (WebKit::WebResourceRawHeaders::addRequestHeader):
+        (WebKit::WebResourceRawHeaders::addResponseHeader):
+        * src/WebURLRequest.cpp:
+        (WebKit::WebURLRequest::setReportRawHeaders):
+        (WebKit::WebURLRequest::reportRawHeaders):
+        * src/WebURLResponse.cpp:
+        (WebKit::WebURLResponse::resourceRawHeaders):
+        (WebKit::WebURLResponse::setResourceRawHeaders):
+        * src/WebURLResponsePrivate.h:
+
+2010-09-30  Avi Drissman  <avi@google.com>
+
+        Reviewed by Kenneth Russell.
+
+        [Chromium] Tabbing into page doesn't always select the first element
+        https://bugs.webkit.org/show_bug.cgi?id=46856
+
+        * src/WebViewImpl.cpp:
+        (WebKit::WebViewImpl::setInitialFocus):
+
+2010-09-30  Alexey Marinichev  <amarinichev@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        Rename chromium's GraphicsContext3D.cpp to match others.
+        https://bugs.webkit.org/show_bug.cgi?id=46771
+
+        * WebKit.gyp:
+        * src/GraphicsContext3DChromium.cpp: Renamed from WebKit/chromium/src/GraphicsContext3D.cpp.
+
+2010-09-29  Kent Tamura  <tkent@chromium.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        Refactor HTMLInputElement: Make DeprecatedInputType private.
+        https://bugs.webkit.org/show_bug.cgi?id=46791
+
+        * src/WebPasswordFormUtils.cpp:
+        (WebKit::findPasswordFormFields):
+         Accept any text field types as a username field.
+        * src/WebSearchableFormData.cpp:
+        (WebCore::HasSuitableTextElement):
+         Accept any text field types as a search query field.
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by Dumitru Daniliuc.
+
+        Add removeRecursively to WebKit WebFileSystem API
+        https://bugs.webkit.org/show_bug.cgi?id=46842
+
+        * public/WebFileSystem.h:
+        (WebKit::WebFileSystem::removeRecursively): Added.
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Fix DirectoryReader's behavior to trigger only one EntriesCallback per readEntries
+        https://bugs.webkit.org/show_bug.cgi?id=46563
+
+        * src/WebFileSystemCallbacksImpl.cpp:
+        (WebKit::WebFileSystemCallbacksImpl::didReadDirectory):
+
+2010-09-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] enable -Werror for DRT and webkit_unit_tests on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=46829
+
+        * WebKit.gyp:
+        * tests/ArenaTestHelpers.h:
+        (WebCore::ArenaTestHelpers::TrackedAllocator::free):
+        * tests/IDBKeyPathTest.cpp:
+        (WebCore::checkKeyPath):
+
+2010-09-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] enable -Werror on chromium linux webkit
+        https://bugs.webkit.org/show_bug.cgi?id=46821
+
+        * WebKit.gyp:
+        * src/gtk/WebInputEventFactory.cpp:
+
+2010-09-29  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed removal of unused #define from WebHistory.h.
+        Chromium usage of WEBKIT_BUG_40451_IS_FIXED was removed with
+        http://crrev.com/50642.
+
+        * public/WebHistoryItem.h:
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed, adding one more missing change from the last patch.
+        https://bugs.webkit.org/show_bug.cgi?id=46524
+
+        * WebKit.gyp:
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Unreviewed, adding the new files that were supposed to be added
+        but I missed to include in my previous patch.
+        https://bugs.webkit.org/show_bug.cgi?id=46524
+
+        * src/WorkerAsyncFileSystemChromium.cpp: Added.
+        * src/WorkerAsyncFileSystemChromium.h: Added.
+
+2010-09-29  Kinuko Yasuda  <kinuko@chromium.org>
+
+        Reviewed by David Levin.
+
+        Bridge all FileSystem operations on Workers to the MainThread
+        https://bugs.webkit.org/show_bug.cgi?id=46524
+
+        * src/LocalFileSystemChromium.cpp:
+        (WebCore::LocalFileSystem::requestFileSystem): Changed the worker case
+        code to create WebFileSystemCallbacksImpl with the current
+        ScriptExecutionContext (WorkerContext).
+        * src/WebFileSystemCallbacksImpl.cpp:
+        (WebKit::WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl): Added
+        a new constructor that takes ScriptExecutionContext (WorkerContext)
+        for workers.
+        (WebKit::WebFileSystemCallbacksImpl::didOpenFileSystem): Added the
+        code for workers that creates WorkerAsyncFileSystemChromium.
+        * src/WebFileSystemCallbacksImpl.h:
+        * src/WorkerAsyncFileSystemChromium.cpp: Added.
+        * src/WorkerAsyncFileSystemChromium.h: Added.
+        * src/WorkerFileSystemCallbacksBridge.cpp: Added methods for regular
+        file system operations to proxy them to the main thread.
+        (WebKit::WorkerFileSystemCallbacksBridge::createForOpenFileSystem):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForMove):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForCopy):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForRemove):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForReadMetadata):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForCreateFile):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForCreateDirectory):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForFileExists):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForDirectoryExists):
+        (WebKit::WorkerFileSystemCallbacksBridge::createForReadDirectory):
+        (WebKit::MainThreadFileSystemCallbacks::didSucceed):
+        (WebKit::MainThreadFileSystemCallbacks::didReadMetadata):
+        (WebKit::MainThreadFileSystemCallbacks::didReadDirectory):
+        (WebKit::WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::moveOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::copyOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::removeOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::readMetadataOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::createFileOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::createDirectoryOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::fileExistsOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::directoryExistsOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::readDirectoryOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didSucceedOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didReadMetadataOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didReadDirectoryOnMainThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didSucceedOnWorkerThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didReadMetadataOnWorkerThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::didReadDirectoryOnWorkerThread):
+        (WebKit::WorkerFileSystemCallbacksBridge::derefIfWorkerIsStopped):
+        * src/WorkerFileSystemCallbacksBridge.h:
+
+2010-09-29  Matt Perry  <mpcomplete@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        Remove obsolete registerExtension variants from chromium port.
+        https://bugs.webkit.org/show_bug.cgi?id=46683
+
+        * public/WebScriptController.h:
+        * src/WebScriptController.cpp:
+
+2010-09-29  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Add method which checks if a WebAccessibilityObject is in the cache.
+        https://bugs.webkit.org/show_bug.cgi?id=46605
+
+        * public/WebAccessibilityCache.h:
+        * src/WebAccessibilityCacheImpl.cpp:
+        (WebKit::WebAccessibilityCacheImpl::isCached):
+        * src/WebAccessibilityCacheImpl.h:
+
+2010-09-29  Anantanarayanan G Iyengar  <ananta@chromium.org>
+
+        Reviewed by Darin Fisher.
+
+        [chromium] Honor z-index specified by a plugin
+        https://bugs.webkit.org/show_bug.cgi?id=46223
+        
+        The Chromium plugin code which implements the iframe shim technique
+        for overlaying a windowed plugin with content on the page should
+        honor the z-index specified on the plugin widget. If the z-index
+        here is greater than the enclosing iframe shim then the plugin
+        should be displayed over the iframe. Updated the layout test to test
+        for this case. Skipped the plugins/iframe-shims.html layout test on
+        platforms which don't support it.
+
+        * src/WebPluginContainerImpl.cpp:
+
 2010-09-28  Vangelis Kokkevis  <vangelis@chromium.org>
 
         Reviewed by Kenneth Russell.
diff --git a/WebKit/chromium/DEPS b/WebKit/chromium/DEPS
index 722dd94..86a9387 100644
--- a/WebKit/chromium/DEPS
+++ b/WebKit/chromium/DEPS
@@ -32,7 +32,7 @@
 
 vars = {
   'chromium_svn': 'http://src.chromium.org/svn/trunk/src',
-  'chromium_rev': '60394',
+  'chromium_rev': '63057'
 }
 
 deps = {
@@ -99,6 +99,8 @@ deps = {
     From('chromium_deps', 'src/third_party/libvpx/include'),
   'third_party/libvpx/lib':
     From('chromium_deps', 'src/third_party/libvpx/lib'),
+  'third_party/libwebp':
+    Var('chromium_svn')+'/third_party/libwebp@'+Var('chromium_rev'),
   'tools/grit':
     Var('chromium_svn')+'/tools/grit@'+Var('chromium_rev'),
   'tools/generate_stubs':
diff --git a/WebKit/chromium/WebKit.gyp b/WebKit/chromium/WebKit.gyp
index 5b953e3..e1e1a5f 100644
--- a/WebKit/chromium/WebKit.gyp
+++ b/WebKit/chromium/WebKit.gyp
@@ -36,7 +36,6 @@
         'features.gypi',
     ],
     'variables': {
-        'webkit_target_type': 'static_library',
         'conditions': [
             # Location of the chromium src directory and target type is different
             # if webkit is built inside chromium or as standalone project.
@@ -44,6 +43,7 @@
                 # Webkit is being built outside of the full chromium project.
                 # e.g. via build-webkit --chromium
                 'chromium_src_dir': '../../WebKit/chromium',
+                'webkit_target_type': 'static_library',
 
                 # List of DevTools source files, ordered by dependencies. It is used both
                 # for copying them to resource dir, and for generating 'devtools.html' file.
@@ -54,6 +54,7 @@
             },{
                 # WebKit is checked out in src/chromium/third_party/WebKit
                 'chromium_src_dir': '../../../..',
+                'webkit_target_type': '<(library)',
 
                 'devtools_files': [
                     '<@(devtools_css_files)',
@@ -95,6 +96,7 @@
                 'public/linux/WebFontRendering.h',
                 'public/linux/WebFontRenderStyle.h',
                 'public/linux/WebRenderTheme.h',
+                'public/linux/WebThemeEngine.h',
                 'public/x11/WebScreenInfoFactory.h',
                 'public/mac/WebInputEventFactory.h',
                 'public/mac/WebSandboxSupport.h',
@@ -110,7 +112,6 @@
                 'public/WebBindings.h',
                 'public/WebBlobData.h',
                 'public/WebBlobRegistry.h',
-                'public/WebBlobStorageData.h',
                 'public/WebCache.h',
                 'public/WebCanvas.h',
                 'public/WebClipboard.h',
@@ -148,6 +149,7 @@
                 'public/WebDragData.h',
                 'public/WebEditingAction.h',
                 'public/WebElement.h',
+                'public/WebExceptionCode.h',
                 'public/WebFileChooserCompletion.h',
                 'public/WebFileChooserParams.h',
                 'public/WebFileError.h',
@@ -231,6 +233,7 @@
                 'public/WebRange.h',
                 'public/WebRect.h',
                 'public/WebRegularExpression.h',
+                'public/WebResourceRawHeaders.h',
                 'public/WebRuntimeFeatures.h',
                 'public/WebScrollbar.h',
                 'public/WebScrollbarClient.h',
@@ -261,7 +264,7 @@
                 'public/WebTextDirection.h',
                 'public/WebTextInputType.h',
                 'public/WebTextRun.h',
-                'public/WebThemeEngine.h',
+                'public/WebThreadSafeData.h',
                 'public/WebURL.h',
                 'public/WebURLError.h',
                 'public/WebURLLoader.h',
@@ -279,6 +282,7 @@
                 'public/win/WebInputEventFactory.h',
                 'public/win/WebSandboxSupport.h',
                 'public/win/WebScreenInfoFactory.h',
+                'public/win/WebThemeEngine.h',
                 'src/ApplicationCacheHost.cpp',
                 'src/ApplicationCacheHostInternal.h',
                 'src/AssertMatchingEnums.cpp',
@@ -324,7 +328,7 @@
                 'src/FrameLoaderClientImpl.cpp',
                 'src/FrameLoaderClientImpl.h',
                 'src/FrameNetworkingContextImpl.h',
-                'src/GraphicsContext3D.cpp',
+                'src/GraphicsContext3DChromium.cpp',
                 'src/GraphicsContext3DInternal.h',
                 'src/gtk/WebFontInfo.cpp',
                 'src/gtk/WebFontInfo.h',
@@ -386,7 +390,6 @@
                 'src/WebAttribute.cpp',
                 'src/WebBindings.cpp',
                 'src/WebBlobData.cpp',
-                'src/WebBlobStorageData.cpp',
                 'src/WebCache.cpp',
                 'src/WebColor.cpp',
                 'src/WebCommon.cpp',
@@ -495,6 +498,7 @@
                 'src/WebPopupMenuImpl.h',
                 'src/WebRange.cpp',
                 'src/WebRegularExpression.cpp',
+                'src/WebResourceRawHeaders.cpp',
                 'src/WebRuntimeFeatures.cpp',
                 'src/WebScriptController.cpp',
                 'src/WebScrollbarImpl.cpp',
@@ -518,6 +522,7 @@
                 'src/WebStorageNamespaceImpl.h',
                 'src/WebString.cpp',
                 'src/WebTextRun.cpp',
+                'src/WebThreadSafeData.cpp',
                 'src/WebURL.cpp',
                 'src/WebURLLoadTiming.cpp',
                 'src/WebURLRequest.cpp',
@@ -533,6 +538,8 @@
                 'src/WebWorkerClientImpl.h',
                 'src/WebWorkerImpl.cpp',
                 'src/WebWorkerImpl.h',
+                'src/WorkerAsyncFileSystemChromium.cpp',
+                'src/WorkerAsyncFileSystemChromium.h',
                 'src/WorkerFileSystemCallbacksBridge.cpp',
                 'src/WorkerFileSystemCallbacksBridge.h',
                 'src/WrappedResourceRequest.h',
@@ -551,7 +558,9 @@
                             ],
                             'dependencies': [
                                 '../../WebCore/WebCore.gyp/WebCore.gyp:webcore_bindings',
+                                '<(chromium_src_dir)/base/base.gyp:test_support_base',
                                 '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
+                                '<(chromium_src_dir)/testing/gtest.gyp:gtest',
                                 '<(chromium_src_dir)/third_party/icu/icu.gyp:*',
                                 '<(chromium_src_dir)/third_party/libjpeg/libjpeg.gyp:libjpeg',
                                 '<(chromium_src_dir)/third_party/libpng/libpng.gyp:libpng',
@@ -572,6 +581,13 @@
                                 '<(chromium_src_dir)/build/temp_gyp/googleurl.gyp:googleurl',
                                 '<(chromium_src_dir)/v8/tools/gyp/v8.gyp:v8',
                             ],
+                            'sources': [
+                                '<@(webkit_unittest_files)',
+                                'tests/PopupMenuTest.cpp',
+                                'tests/TransparencyWinTest.cpp',
+                                'tests/UniscribeHelperTest.cpp',
+                                'tests/WebUnitTests.cpp'
+                            ]
                         }],
                     ],
                 }, {
@@ -602,11 +618,6 @@
                     'sources/': [
                         ['exclude', 'Skia\\.cpp$'],
                     ],
-                    'variables': {
-                        # FIXME: Turn on warnings on other platforms and for
-                        # other targets.
-                        'chromium_code': 1,
-                    }
                 }, { # else: OS!="mac"
                     'sources/': [
                         ['exclude', '/mac/'],
@@ -619,6 +630,10 @@
                     ],
                 }, { # else: OS!="win"
                     'sources/': [['exclude', '/win/']],
+                    'variables': {
+                        # FIXME: Turn on warnings on Windows.
+                        'chromium_code': 1,
+                    }
                 }],
                 ['"ENABLE_3D_CANVAS=1" in feature_defines', {
                     'conditions': [
@@ -631,6 +646,12 @@
                         }],
                     ],
                 }],
+                ['"ENABLE_CLIENT_BASED_GEOLOCATION=1" in feature_defines', {
+                    'sources/': [
+                        ['exclude', 'WebGeolocationService.*$'],
+                        ['include', 'WebGeolocationServiceMock.*'],
+                    ],
+                }]
             ],
         },
 
@@ -717,40 +738,32 @@
 
         {
             'target_name': 'webkit_unit_tests',
+            'type': 'executable',
+            'msvs_guid': '7CEFE800-8403-418A-AD6A-2D52C6FC3EAD',
+            'dependencies': [
+                'webkit',
+                '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
+                '<(chromium_src_dir)/testing/gtest.gyp:gtest',
+                '<(chromium_src_dir)/base/base.gyp:base',
+                '<(chromium_src_dir)/base/base.gyp:base_i18n',
+                '<(chromium_src_dir)/base/base.gyp:test_support_base',
+                '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_support',
+            ],
+            'sources': [
+                'tests/RunAllTests.cpp',
+            ],
+            'include_dirs': [
+                'public',
+                'src',
+            ],
             'conditions': [
-                # FIXME: make webkit unit tests working for multi dll build.
                 ['inside_chromium_build==1 and OS=="win" and component=="shared_library"', {
-                    'type': 'none',
-                }, {
-                    'type': 'executable',
-                    'msvs_guid': '7CEFE800-8403-418A-AD6A-2D52C6FC3EAD',
-                    'dependencies': [
-                        'webkit',
-                        '../../WebCore/WebCore.gyp/WebCore.gyp:webcore',
-                        '<(chromium_src_dir)/testing/gtest.gyp:gtest',
-                        '<(chromium_src_dir)/base/base.gyp:base',
-                        '<(chromium_src_dir)/base/base.gyp:base_i18n',
-                        '<(chromium_src_dir)/base/base.gyp:test_support_base',
-                        '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_support',
-                    ],
-                    'include_dirs': [
-                        'public',
-                        'src',
+                    'defines': [
+                        'WEBKIT_DLL_UNITTEST',
                     ],
+                }, {
                     'sources': [
-                        'tests/ArenaTestHelpers.h',
-                        'tests/DragImageTest.cpp',
-                        'tests/IDBBindingUtilitiesTest.cpp',
-                        'tests/IDBKeyPathTest.cpp',
-                        'tests/KeyboardTest.cpp',
-                        'tests/KURLTest.cpp',
-                        'tests/PODArenaTest.cpp',
-                        'tests/PODIntervalTreeTest.cpp',
-                        'tests/PODRedBlackTreeTest.cpp',
-                        'tests/RunAllTests.cpp',
-                        'tests/TilingDataTest.cpp',
-                        'tests/TreeTestHelpers.cpp',
-                        'tests/TreeTestHelpers.h',
+                        '<@(webkit_unittest_files)',
                     ],
                     'conditions': [
                         ['OS=="win"', {
@@ -775,6 +788,10 @@
                             'include_dirs': [
                                 'public/gtk',
                             ],
+                            'variables': {
+                              # FIXME: Enable warnings on other platforms.
+                              'chromium_code': 1,
+                            },
                         }],
                     ],
                 }],
@@ -808,11 +825,11 @@
                 '<(chromium_src_dir)/third_party/icu/icu.gyp:icuuc',
                 '<(chromium_src_dir)/third_party/mesa/mesa.gyp:osmesa',
                 '<(chromium_src_dir)/webkit/support/webkit_support.gyp:blob',
-                '<(chromium_src_dir)/webkit/support/webkit_support.gyp:copy_npapi_layout_test_plugin',
                 '<(chromium_src_dir)/webkit/support/webkit_support.gyp:webkit_support',
             ],
             'include_dirs': [
-                '.',
+                '<(chromium_src_dir)',
+                'public',
                 '../../JavaScriptCore',
                 '../../JavaScriptCore/wtf', # wtf/text/*.h refers headers in wtf/ without wtf/.
                 '<(DEPTH)',
@@ -882,8 +899,11 @@
                     ], # actions
                 }],
                 ['OS=="mac"', {
-                    'dependencies': ['LayoutTestHelper'],
-
+                    'dependencies': [
+                        'copy_mesa',
+                        'LayoutTestHelper',
+                        'TestNetscapePlugIn',
+                    ],
                     'mac_bundle_resources': [
                         '<(ahem_path)',
                         '../../WebKitTools/DumpRenderTree/fonts/WebKitWeightWatcher100.ttf',
@@ -899,14 +919,18 @@
                     ],
                     # Workaround for http://code.google.com/p/gyp/issues/detail?id=160
                     'copies': [{
-                        'destination': '<(PRODUCT_DIR)/DumpRenderTree.app/Contents/PlugIns/',
-                        'files': ['<(PRODUCT_DIR)/TestNetscapePlugIn.plugin/'],
+                        'destination': '<(PRODUCT_DIR)/plugins/',
+                        'files': ['<(PRODUCT_DIR)/WebKitTestNetscapePlugIn.plugin/'],
                     }],
                 },{ # OS!="mac"
                     'sources/': [
                         # .mm is already excluded by common.gypi
                         ['exclude', 'Mac\\.cpp$'],
-                    ]
+                    ],
+                    'dependencies': [
+                        # FIXME: Switch to webkit.org's plugin.
+                        '<(chromium_src_dir)/webkit/support/webkit_support.gyp:copy_npapi_layout_test_plugin',
+                    ],
                 }],
                 ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="solaris"', {
                     'dependencies': [
@@ -924,6 +948,10 @@
                             '<(INTERMEDIATE_DIR)/repack/DumpRenderTree.pak',
                         ]
                     }],
+                    'variables': {
+                      # FIXME: Enable warnings on other platforms.
+                      'chromium_code': 1,
+                    },
                 },{ # OS!="linux" and OS!="freebsd" and OS!="openbsd" and OS!="solaris"
                     'sources/': [
                         ['exclude', '(Gtk|Linux)\\.cpp$']
@@ -952,6 +980,51 @@
                         ],
                     },
                 },
+                {
+                    'target_name': 'copy_mesa',
+                    'type': 'none',
+                    'dependencies': ['<(chromium_src_dir)/third_party/mesa/mesa.gyp:osmesa'],
+                    'copies': [{
+                        'destination': '<(PRODUCT_DIR)/DumpRenderTree.app/Contents/MacOS/',
+                        'files': ['<(PRODUCT_DIR)/osmesa.so'],
+                    }],
+                },
+                {
+                    'target_name': 'TestNetscapePlugIn',
+                    'type': 'loadable_module',
+                    'sources': [ '<@(test_plugin_files)' ],
+                    'dependencies': [
+                        '<(chromium_src_dir)/third_party/npapi/npapi.gyp:npapi',
+                    ],
+                    'include_dirs': [
+                        '<(chromium_src_dir)',
+                        '../../WebKitTools/DumpRenderTree/TestNetscapePlugIn',
+                        '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders',
+                    ],
+
+                    # Mac specific stuff.
+                    'mac_bundle': 1,
+                    # It would be nice to name this TestNetscapePlugIn, but
+                    # that name is already used by the fork of this plugin in
+                    # Chromium.
+                    'product_name': 'WebKitTestNetscapePlugIn',
+                    'product_extension': 'plugin',
+                    'link_settings': {
+                        'libraries': [
+                            '$(SDKROOT)/System/Library/Frameworks/Carbon.framework',
+                            '$(SDKROOT)/System/Library/Frameworks/Cocoa.framework',
+                            '$(SDKROOT)/System/Library/Frameworks/QuartzCore.framework',
+                        ]
+                    },
+                    'xcode_settings': {
+                        'GCC_SYMBOLS_PRIVATE_EXTERN': 'NO',
+                        # This is a temporary fork of
+                        # DRT/TestNetscapePlugIn/mac/Info.plist.  Once we get
+                        # rid of our forked plugin in the chromium repo, we
+                        # can share the same Info.plist.
+                        'INFOPLIST_FILE': '../../WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist',
+                    },
+                }
             ],
         }],
     ], # conditions
diff --git a/WebKit/chromium/WebKit.gypi b/WebKit/chromium/WebKit.gypi
index 035015b..016cf1a 100644
--- a/WebKit/chromium/WebKit.gypi
+++ b/WebKit/chromium/WebKit.gypi
@@ -51,6 +51,20 @@
             'src/js/Images/statusbarMenuButtonChromium.png',
             'src/js/Images/statusbarMenuButtonSelectedChromium.png',
         ],
+        'webkit_unittest_files': [
+            'tests/ArenaTestHelpers.h',
+            'tests/DragImageTest.cpp',
+            'tests/IDBBindingUtilitiesTest.cpp',
+            'tests/IDBKeyPathTest.cpp',
+            'tests/KeyboardTest.cpp',
+            'tests/KURLTest.cpp',
+            'tests/PODArenaTest.cpp',
+            'tests/PODIntervalTreeTest.cpp',
+            'tests/PODRedBlackTreeTest.cpp',
+            'tests/TilingDataTest.cpp',
+            'tests/TreeTestHelpers.cpp',
+            'tests/TreeTestHelpers.h',
+        ],
     },
 }
 
diff --git a/WebKit/chromium/features.gypi b/WebKit/chromium/features.gypi
index 900bb7a..1e78b04 100644
--- a/WebKit/chromium/features.gypi
+++ b/WebKit/chromium/features.gypi
@@ -52,7 +52,7 @@
         'ENABLE_DIRECTORY_UPLOAD=1',
         'ENABLE_DOM_STORAGE=1',
         'ENABLE_EVENTSOURCE=1',
-        'ENABLE_FILE_READER=1',
+        'ENABLE_FILE_SYSTEM=1',
         'ENABLE_FILTERS=1',
         'ENABLE_GEOLOCATION=1',
         'ENABLE_ICONDATABASE=0',
@@ -87,6 +87,7 @@
         'ENABLE_XPATH=1',
         'ENABLE_XSLT=1',
         'WTF_USE_ACCELERATED_COMPOSITING=1',
+        'WTF_USE_WEBP=1',
       ],
 
       'use_accelerated_compositing%': 1,
diff --git a/WebKit/chromium/public/WebAccessibilityCache.h b/WebKit/chromium/public/WebAccessibilityCache.h
index c9aec1f..bb2fc7b 100644
--- a/WebKit/chromium/public/WebAccessibilityCache.h
+++ b/WebKit/chromium/public/WebAccessibilityCache.h
@@ -51,8 +51,8 @@ public:
     virtual bool isInitialized() const = 0;
 
     virtual WebAccessibilityObject getObjectById(int) = 0;
-    virtual bool isValidId(int) const = 0;
     virtual int addOrGetId(const WebAccessibilityObject& object) = 0;
+    virtual bool isCached(const WebAccessibilityObject&) = 0;
 
     virtual void remove(int) = 0;
     virtual void clear() = 0;
diff --git a/WebKit/chromium/public/WebBlobData.h b/WebKit/chromium/public/WebBlobData.h
index 8c0e1aa..67b6cd6 100644
--- a/WebKit/chromium/public/WebBlobData.h
+++ b/WebKit/chromium/public/WebBlobData.h
@@ -31,7 +31,7 @@
 #ifndef WebBlobData_h
 #define WebBlobData_h
 
-#include "WebCString.h"
+#include "WebThreadSafeData.h"
 #include "WebString.h"
 #include "WebURL.h"
 
@@ -48,7 +48,7 @@ class WebBlobData {
 public:
     struct Item {
         enum { TypeData, TypeFile, TypeBlob } type;
-        WebCString data;
+        WebThreadSafeData data;
         WebString filePath;
         WebURL blobURL;
         long long offset;
@@ -72,17 +72,9 @@ public:
     // index is out of bounds.
     WEBKIT_API bool itemAt(size_t index, Item& result) const;
 
-    // Appends to the list of items.
-    WEBKIT_API void appendData(const WebCString&);
-    WEBKIT_API void appendFile(const WebString& filePath);
-    WEBKIT_API void appendFile(const WebString& filePath, long long offset, long long length, double expectedModificationTime);
-    WEBKIT_API void appendBlob(const WebURL& blobURL, long long offset, long long length);
-
     WEBKIT_API WebString contentType() const;
-    WEBKIT_API void setContentType(const WebString&);
 
     WEBKIT_API WebString contentDisposition() const;
-    WEBKIT_API void setContentDisposition(const WebString&);
 
 #if WEBKIT_IMPLEMENTATION
     WebBlobData(const WTF::PassOwnPtr<WebCore::BlobData>&);
diff --git a/WebKit/chromium/public/WebBlobRegistry.h b/WebKit/chromium/public/WebBlobRegistry.h
index cbd9a99..7c5be55 100644
--- a/WebKit/chromium/public/WebBlobRegistry.h
+++ b/WebKit/chromium/public/WebBlobRegistry.h
@@ -31,7 +31,7 @@
 #ifndef WebBlobRegistry_h
 #define WebBlobRegistry_h
 
-#include "WebBlobStorageData.h"
+#include "WebCommon.h"
 
 namespace WebKit {
 
diff --git a/WebKit/chromium/public/WebCommonWorkerClient.h b/WebKit/chromium/public/WebCommonWorkerClient.h
index 39d8aa9..b99d39d 100644
--- a/WebKit/chromium/public/WebCommonWorkerClient.h
+++ b/WebKit/chromium/public/WebCommonWorkerClient.h
@@ -87,6 +87,12 @@ public:
     virtual bool allowDatabase(WebFrame*, const WebString& name, const WebString& displayName, unsigned long estimatedSize) = 0;
 
     // Called on the main webkit thread before opening a file system.
+    virtual void openFileSystem(WebFileSystem::Type, long long size, bool create, WebFileSystemCallbacks*)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+    }
+
+    // This will be removed once changes in chromium use the new method above.
     virtual void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*)
     {
         WEBKIT_ASSERT_NOT_REACHED();
diff --git a/WebKit/chromium/public/WebDragData.h b/WebKit/chromium/public/WebDragData.h
index 2979519..1d704f0 100644
--- a/WebKit/chromium/public/WebDragData.h
+++ b/WebKit/chromium/public/WebDragData.h
@@ -66,7 +66,7 @@ public:
 
     bool isNull() const { return !m_private; }
 
-    WEBKIT_API WebURL url() const;
+    WEBKIT_API WebString url() const;
     WEBKIT_API void setURL(const WebURL&);
 
     WEBKIT_API WebString urlTitle() const;
@@ -78,10 +78,10 @@ public:
     WEBKIT_API WebString fileExtension() const;
     WEBKIT_API void setFileExtension(const WebString&);
 
-    WEBKIT_API bool hasFileNames() const;
-    WEBKIT_API void fileNames(WebVector<WebString>&) const;
-    WEBKIT_API void setFileNames(const WebVector<WebString>&);
-    WEBKIT_API void appendToFileNames(const WebString&);
+    WEBKIT_API bool containsFilenames() const;
+    WEBKIT_API void filenames(WebVector<WebString>&) const;
+    WEBKIT_API void setFilenames(const WebVector<WebString>&);
+    WEBKIT_API void appendToFilenames(const WebString&);
 
     WEBKIT_API WebString plainText() const;
     WEBKIT_API void setPlainText(const WebString&);
@@ -92,8 +92,8 @@ public:
     WEBKIT_API WebURL htmlBaseURL() const;
     WEBKIT_API void setHTMLBaseURL(const WebURL&);
 
-    WEBKIT_API WebString fileContentFileName() const;
-    WEBKIT_API void setFileContentFileName(const WebString&);
+    WEBKIT_API WebString fileContentFilename() const;
+    WEBKIT_API void setFileContentFilename(const WebString&);
 
     WEBKIT_API WebData fileContent() const;
     WEBKIT_API void setFileContent(const WebData&);
diff --git a/WebKit/chromium/public/WebElement.h b/WebKit/chromium/public/WebElement.h
index 5b6fd6a..8d51e98 100644
--- a/WebKit/chromium/public/WebElement.h
+++ b/WebKit/chromium/public/WebElement.h
@@ -50,6 +50,7 @@ class WebNamedNodeMap;
         void assign(const WebElement& e) { WebNode::assign(e); }
 
         WEBKIT_API bool isFormControlElement() const;
+        WEBKIT_API bool isTextFormControlElement() const;
         WEBKIT_API WebString tagName() const;
         WEBKIT_API bool hasTagName(const WebString&) const;
         WEBKIT_API bool hasAttribute(const WebString&) const;
diff --git a/WebKit/chromium/public/WebExceptionCode.h b/WebKit/chromium/public/WebExceptionCode.h
new file mode 100644
index 0000000..61d53d9
--- /dev/null
+++ b/WebKit/chromium/public/WebExceptionCode.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebExceptionCode_h
+#define WebExceptionCode_h
+
+namespace WebKit {
+
+// This should match how ExceptionCode is defined in WebCore.
+typedef int WebExceptionCode;
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebFileSystem.h b/WebKit/chromium/public/WebFileSystem.h
index b21235d..7198f31 100644
--- a/WebKit/chromium/public/WebFileSystem.h
+++ b/WebKit/chromium/public/WebFileSystem.h
@@ -58,10 +58,16 @@ public:
     virtual void copy(const WebString& srcPath, const WebString& destPath, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
 
     // Deletes a file or directory at a given |path|.
+    // It is an error to try to remove a directory that is not empty.
     // WebFileSystemCallbacks::didSucceed() must be called when the operation is completed successfully.
     // WebFileSystemCallbacks::didFail() must be called otherwise.
     virtual void remove(const WebString& path, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
 
+    // Deletes a file or directory recursively at a given |path|.
+    // WebFileSystemCallbacks::didSucceed() must be called when the operation is completed successfully.
+    // WebFileSystemCallbacks::didFail() must be called otherwise.
+    virtual void removeRecursively(const WebString& path, WebFileSystemCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
+
     // Retrieves the metadata information of the file or directory at the given |path|.
     // WebFileSystemCallbacks::didReadMetadata() must be called with a valid metadata when the retrieval is completed successfully.
     // WebFileSystemCallbacks::didFail() must be called otherwise.
diff --git a/WebKit/chromium/public/WebFrame.h b/WebKit/chromium/public/WebFrame.h
index 5d41d10..8f2c861 100644
--- a/WebKit/chromium/public/WebFrame.h
+++ b/WebKit/chromium/public/WebFrame.h
@@ -109,6 +109,9 @@ public:
     // frame name unique within the hierarchy.
     virtual void setName(const WebString&) = 0;
 
+    // A globally unique identifier for this frame.
+    virtual long long identifier() const = 0;
+
     // The url of the document loaded in this frame.  This is equivalent to
     // dataSource()->request().url().
     virtual WebURL url() const = 0;
@@ -547,6 +550,11 @@ public:
     virtual bool pauseSVGAnimation(const WebString& animationId,
                                    double time,
                                    const WebString& elementId) = 0;
+
+    // Dumps the layer tree, used by the accelerated compositor, in
+    // text form. This is used only by layout tests.
+    virtual WebString layerTreeAsText() const = 0;
+
 protected:
     ~WebFrame() { }
 };
diff --git a/WebKit/chromium/public/WebFrameClient.h b/WebKit/chromium/public/WebFrameClient.h
index a72e2fd..458604e 100644
--- a/WebKit/chromium/public/WebFrameClient.h
+++ b/WebKit/chromium/public/WebFrameClient.h
@@ -349,7 +349,13 @@ public:
     // WebFileSystemCallbacks::didOpenFileSystem() must be called with
     // a name and root path for the requested FileSystem when the operation
     // is completed successfully. WebFileSystemCallbacks::didFail() must be
-    // called otherwise.
+    // called otherwise. The create bool is for indicating whether or not to
+    // create root path for file systems if it do not exist.
+    virtual void openFileSystem(
+        WebFrame*, WebFileSystem::Type, long long size,
+        bool create, WebFileSystemCallbacks*) { }
+
+    // This method will be deleted once chromium uses the new method above.
     virtual void openFileSystem(
         WebFrame*, WebFileSystem::Type, long long size,
         WebFileSystemCallbacks*) { }
diff --git a/WebKit/chromium/public/WebHTTPBody.h b/WebKit/chromium/public/WebHTTPBody.h
index 6e45bf6..8c37622 100644
--- a/WebKit/chromium/public/WebHTTPBody.h
+++ b/WebKit/chromium/public/WebHTTPBody.h
@@ -32,7 +32,6 @@
 #define WebHTTPBody_h
 
 #include "WebData.h"
-#include "WebFileInfo.h"
 #include "WebNonCopyable.h"
 #include "WebString.h"
 #include "WebURL.h"
@@ -54,8 +53,6 @@ public:
         WebString filePath;
         long long fileStart;
         long long fileLength; // -1 means to the end of the file.
-        // FIXME: remove this field once all users of Element have been switched to use 'modificationTime'.
-        WebFileInfo fileInfo;
         double modificationTime;
         WebURL blobURL;
     };
@@ -88,8 +85,6 @@ public:
     WEBKIT_API void appendFile(const WebString&);
     // Passing -1 to fileLength means to the end of the file.
     WEBKIT_API void appendFileRange(const WebString&, long long fileStart, long long fileLength, double modificationTime);
-    // FIXME: Remove this method once all callers have been switched to use the method above.
-    WEBKIT_API void appendFileRange(const WebString&, long long fileStart, long long fileLength, const WebFileInfo&);
     WEBKIT_API void appendBlob(const WebURL&);
 
     // Identifies a particular form submission instance.  A value of 0 is
diff --git a/WebKit/chromium/public/WebHistoryItem.h b/WebKit/chromium/public/WebHistoryItem.h
index 1b4863e..b5cd02b 100644
--- a/WebKit/chromium/public/WebHistoryItem.h
+++ b/WebKit/chromium/public/WebHistoryItem.h
@@ -34,9 +34,6 @@
 #include "WebCommon.h"
 #include "WebPrivatePtr.h"
 
-// FIXME: Remove this once Chromium starts using itemSequenceNumber.
-#define WEBKIT_BUG_40451_IS_FIXED
-
 namespace WebCore { class HistoryItem; }
 
 namespace WebKit {
diff --git a/WebKit/chromium/public/WebIDBCallbacks.h b/WebKit/chromium/public/WebIDBCallbacks.h
index 2e2c4d2..64ffc08 100644
--- a/WebKit/chromium/public/WebIDBCallbacks.h
+++ b/WebKit/chromium/public/WebIDBCallbacks.h
@@ -36,6 +36,7 @@ class WebIDBDatabaseError;
 class WebIDBKey;
 class WebIDBIndex;
 class WebIDBObjectStore;
+class WebIDBTransaction;
 class WebSerializedScriptValue;
 
 class WebIDBCallbacks {
@@ -51,6 +52,7 @@ public:
     virtual void onSuccess(const WebIDBKey&) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBIndex*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(WebIDBObjectStore*) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void onSuccess(WebIDBTransaction*) { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual void onSuccess(const WebSerializedScriptValue&) { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
diff --git a/WebKit/chromium/public/WebIDBCursor.h b/WebKit/chromium/public/WebIDBCursor.h
index 05bd51a..2e5e98b 100644
--- a/WebKit/chromium/public/WebIDBCursor.h
+++ b/WebKit/chromium/public/WebIDBCursor.h
@@ -27,6 +27,7 @@
 #define WebIDBCursor_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBKey.h"
 #include "WebSerializedScriptValue.h"
@@ -52,9 +53,9 @@ public:
     // One or the other will set, depending on what type of cursor this is.
     virtual void value(WebSerializedScriptValue& serializedScriptValue, WebIDBKey& idbKey) const { WEBKIT_ASSERT_NOT_REACHED(); }
 
-    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void remove(WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void remove(WebIDBCallbacks*, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebIDBDatabase.h b/WebKit/chromium/public/WebIDBDatabase.h
index 4e5cdcb..c67a117 100644
--- a/WebKit/chromium/public/WebIDBDatabase.h
+++ b/WebKit/chromium/public/WebIDBDatabase.h
@@ -28,6 +28,7 @@
 
 #include "WebCommon.h"
 #include "WebDOMStringList.h"
+#include "WebExceptionCode.h"
 
 namespace WebKit {
 
@@ -61,22 +62,21 @@ public:
         WEBKIT_ASSERT_NOT_REACHED();
         return WebDOMStringList();
     }
-    virtual void createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
-    // Transfers ownership of the WebIDBObjectStore to the caller.
-    virtual WebIDBObjectStore* objectStore(const WebString& name, unsigned short mode)
-    {
+
+    virtual WebIDBObjectStore* createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&)
+    { 
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-    virtual void removeObjectStore(const WebString& name, WebIDBCallbacks* callbacks) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void removeObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
     // Transfers ownership of the WebIDBTransaction to the caller.
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout)
+    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-
+    virtual void close() { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebIDBFactory.h b/WebKit/chromium/public/WebIDBFactory.h
index cb5d369..c7fbe02 100755
--- a/WebKit/chromium/public/WebIDBFactory.h
+++ b/WebKit/chromium/public/WebIDBFactory.h
@@ -52,7 +52,10 @@ public:
     virtual ~WebIDBFactory() { }
 
     // The WebKit implementation of open ignores the WebFrame* parameter.
-    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* webFrame, const WebString& dataDir) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame* webFrame, const WebString& dataDir, unsigned long long maximumSize)
+    {
+        WEBKIT_ASSERT_NOT_REACHED();
+    }
 
     // The file name that would be used for persisting a given indexed database on the file system.
     WEBKIT_API static WebString databaseFileName(const WebString& name, const WebSecurityOrigin&);
diff --git a/WebKit/chromium/public/WebIDBIndex.h b/WebKit/chromium/public/WebIDBIndex.h
index b4ba1f4..7c77878 100644
--- a/WebKit/chromium/public/WebIDBIndex.h
+++ b/WebKit/chromium/public/WebIDBIndex.h
@@ -26,6 +26,7 @@
 #ifndef WebIDBIndex_h
 #define WebIDBIndex_h
 
+#include "WebExceptionCode.h"
 #include "WebIDBTransaction.h"
 #include "WebString.h"
 
@@ -61,43 +62,49 @@ public:
         return false;
     }
 
-    // FIXME: Remove the versions without transaction parameters.
-    virtual void openObjectCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
+    virtual void openObjectCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode&)
     {
-        openObjectCursor(range, direction, callbacks);
+        WebExceptionCode ec = 0;
+        openObjectCursor(range, direction, callbacks, transaction, ec);
     }
-    virtual void openObjectCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks)
+    virtual void openObjectCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
     {
-        WebIDBTransaction transaction;
         openObjectCursor(range, direction, callbacks, transaction);
     }
-    virtual void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
+    virtual void openKeyCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode&)
     {
-        openCursor(range, direction, callbacks);
+        WebExceptionCode ec = 0;
+        openKeyCursor(range, direction, callbacks, transaction, ec);
     }
-    virtual void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks)
+    virtual void openKeyCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
     {
-        WebIDBTransaction transaction;
-        openCursor(range, direction, callbacks, transaction);
+        openKeyCursor(range, direction, callbacks, transaction);
     }
-    virtual void getObject(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
+    virtual void getObject(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode&)
     {
-        getObject(key, callbacks);
+        WebExceptionCode ec = 0;
+        getObject(key, callbacks, transaction, ec);
     }
-    virtual void getObject(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+    virtual void getObject(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
     {
-        WebIDBTransaction transaction;
         getObject(key, callbacks, transaction);
     }
-    virtual void get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
+    virtual void getKey(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode&)
     {
-        get(key, callbacks);
+        WebExceptionCode ec = 0;
+        getKey(key, callbacks, transaction, ec);
     }
-    virtual void get(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+    virtual void getKey(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
     {
-        WebIDBTransaction transaction;
-        get(key, callbacks, transaction);
+        getKey(key, callbacks, transaction);
     }
+
+    /*
+    virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void openKeyCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void getObject(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void getKey(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    */
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebIDBObjectStore.h b/WebKit/chromium/public/WebIDBObjectStore.h
index 19efd48..f5f1473 100755
--- a/WebKit/chromium/public/WebIDBObjectStore.h
+++ b/WebKit/chromium/public/WebIDBObjectStore.h
@@ -27,6 +27,7 @@
 #define WebIDBObjectStore_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebDOMStringList.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBTransaction.h"
@@ -58,52 +59,22 @@ public:
         return WebDOMStringList();
     }
 
-    // FIXME: Remove the default parameters for transactionIds.
-    virtual void get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
+    virtual void get(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void put(const WebSerializedScriptValue&, const WebIDBKey&, bool addOnly, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void remove(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual WebIDBIndex* createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction&, WebExceptionCode&)
     {
-        get(key, callbacks);
-    }
-    virtual void get(const WebIDBKey& key, WebIDBCallbacks* callbacks)
-    {
-        WebIDBTransaction transaction;
-        get(key, callbacks, transaction);
-    }
-    virtual void put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
-    {
-        put(value, key, addOnly, callbacks);
-    }
-    virtual void put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks)
-    {
-        WebIDBTransaction transaction;
-        put(value, key, addOnly, callbacks, transaction);
-    }
-    virtual void remove(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
-    {
-        remove(key, callbacks);
-    }
-    virtual void remove(const WebIDBKey& key, WebIDBCallbacks* callbacks)
-    {
-        WebIDBTransaction transaction;
-        remove(key, callbacks, transaction);
+        WEBKIT_ASSERT_NOT_REACHED();
+        return 0;
     }
-    virtual void createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
     // Transfers ownership of the WebIDBIndex to the caller.
-    virtual WebIDBIndex* index(const WebString& name)
+    virtual WebIDBIndex* index(const WebString& name, WebExceptionCode&)
     {
         WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
-    virtual void removeIndex(const WebString& name, WebIDBCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction&)
-    {
-        openCursor(range, direction, callbacks);
-    }
-    virtual void openCursor(const WebIDBKeyRange& range, unsigned short direction, WebIDBCallbacks* callbacks)
-    {
-        WebIDBTransaction transaction;
-        openCursor(range, direction, callbacks, transaction);
-    }
-    // FIXME: finish.
+    virtual void removeIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&) { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebIDBTransaction.h b/WebKit/chromium/public/WebIDBTransaction.h
index 7b51b97..6a739c3 100644
--- a/WebKit/chromium/public/WebIDBTransaction.h
+++ b/WebKit/chromium/public/WebIDBTransaction.h
@@ -54,8 +54,7 @@ public:
     virtual void didCompleteTaskEvents() { WEBKIT_ASSERT_NOT_REACHED(); }
     virtual int id() const
     {
-        // FIXME: Uncomment this after the next Chromium WebKit roll.
-        //WEBKIT_ASSERT_NOT_REACHED();
+        WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
     virtual void setCallbacks(WebIDBTransactionCallbacks*) { WEBKIT_ASSERT_NOT_REACHED(); }
@@ -63,7 +62,6 @@ public:
     // FIXME: this is never called from WebCore. Find a cleaner solution.
     virtual WebCore::IDBTransactionBackendInterface* getIDBTransactionBackendInterface() const
     {
-        WEBKIT_ASSERT_NOT_REACHED();
         return 0;
     }
 
diff --git a/WebKit/chromium/public/WebIDBTransactionCallbacks.h b/WebKit/chromium/public/WebIDBTransactionCallbacks.h
index 4b92217..c9b6b05 100644
--- a/WebKit/chromium/public/WebIDBTransactionCallbacks.h
+++ b/WebKit/chromium/public/WebIDBTransactionCallbacks.h
@@ -34,11 +34,8 @@ public:
     virtual ~WebIDBTransactionCallbacks() { }
 
     virtual void onAbort() { WEBKIT_ASSERT_NOT_REACHED(); }
-    virtual int id() const
-    { 
-        WEBKIT_ASSERT_NOT_REACHED();
-        return 0;
-    }
+    virtual void onComplete() { WEBKIT_ASSERT_NOT_REACHED(); }
+    virtual void onTimeout() { WEBKIT_ASSERT_NOT_REACHED(); }
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebNode.h b/WebKit/chromium/public/WebNode.h
index f54ff04..7116dfa 100644
--- a/WebKit/chromium/public/WebNode.h
+++ b/WebKit/chromium/public/WebNode.h
@@ -96,6 +96,7 @@ public:
     WEBKIT_API WebNodeList childNodes();
     WEBKIT_API WebString createMarkup() const;
     WEBKIT_API bool isTextNode() const;
+    WEBKIT_API bool isContentEditable() const;
     WEBKIT_API bool isElementNode() const;
     WEBKIT_API void addEventListener(const WebString& eventType, WebDOMEventListener* listener, bool useCapture);
     WEBKIT_API void removeEventListener(const WebString& eventType, WebDOMEventListener* listener, bool useCapture);
diff --git a/WebKit/chromium/public/WebPlugin.h b/WebKit/chromium/public/WebPlugin.h
index 816d38b..17e29e2 100644
--- a/WebKit/chromium/public/WebPlugin.h
+++ b/WebKit/chromium/public/WebPlugin.h
@@ -33,6 +33,7 @@
 
 #include "WebCanvas.h"
 #include "WebString.h"
+#include "WebURL.h"
 
 struct NPObject;
 
@@ -42,10 +43,10 @@ class WebDataSource;
 class WebFrame;
 class WebInputEvent;
 class WebPluginContainer;
-class WebURL;
 class WebURLResponse;
 struct WebCursorInfo;
 struct WebPluginParams;
+struct WebPoint;
 struct WebRect;
 struct WebURLError;
 template <typename T> class WebVector;
@@ -98,8 +99,12 @@ public:
     virtual WebString selectionAsText() const { return WebString(); }
     virtual WebString selectionAsMarkup() const { return WebString(); }
 
+    // If the given position is over a link, returns the absolute url.
+    // Otherwise an empty url is returned.
+    virtual WebURL linkAtPosition(const WebPoint& position) const { return WebURL(); }
+
     // Used for zooming of full page plugins.
-    virtual void setZoomFactor(float scale, bool textOnly) { }
+    virtual void setZoomLevel(double level, bool textOnly) { }
 
     // Find interface.
     // Start a new search.  The plugin should search for a little bit at a time so that it
diff --git a/WebKit/chromium/public/WebPluginContainer.h b/WebKit/chromium/public/WebPluginContainer.h
index 66ef9ab..af20c66 100644
--- a/WebKit/chromium/public/WebPluginContainer.h
+++ b/WebKit/chromium/public/WebPluginContainer.h
@@ -78,6 +78,9 @@ public:
     virtual void loadFrameRequest(
         const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData) = 0;
 
+    // Notifies that the zoom level has changed.
+    virtual void zoomLevelChanged(double zoomLevel) = 0;
+
     virtual WebPlugin* plugin() = 0;
     virtual void setPlugin(WebPlugin*) = 0;
 
diff --git a/WebKit/chromium/public/WebResourceRawHeaders.h b/WebKit/chromium/public/WebResourceRawHeaders.h
new file mode 100644
index 0000000..b91e68b
--- /dev/null
+++ b/WebKit/chromium/public/WebResourceRawHeaders.h
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebResourceRawHeaders_h
+#define WebResourceRawHeaders_h
+
+#include "WebCommon.h"
+#include "WebPrivatePtr.h"
+
+namespace WebCore {
+struct ResourceRawHeaders;
+}
+
+namespace WebKit {
+class WebHTTPHeaderVisitor;
+class WebResourceRawHeadersMapPrivate;
+class WebString;
+
+class WebResourceRawHeaders {
+public:
+    WebResourceRawHeaders() { initialize(); }
+    ~WebResourceRawHeaders() { reset(); }
+    WebResourceRawHeaders(const WebResourceRawHeaders& r) { assign(r); }
+    WebResourceRawHeaders& operator =(const WebResourceRawHeaders& r)
+    { 
+        assign(r);
+        return *this;
+    }
+
+    WEBKIT_API void initialize();
+    WEBKIT_API void reset();
+    WEBKIT_API void assign(const WebResourceRawHeaders& r);
+    WEBKIT_API void addRequestHeader(const WebString& name, const WebString& value);
+    WEBKIT_API void addResponseHeader(const WebString& name, const WebString& value);
+
+#if WEBKIT_IMPLEMENTATION
+    WebResourceRawHeaders(WTF::PassRefPtr<WebCore::ResourceRawHeaders>);
+    operator WTF::PassRefPtr<WebCore::ResourceRawHeaders>() const;
+#endif
+
+private:
+    WebPrivatePtr<WebCore::ResourceRawHeaders> m_private;
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebScriptController.h b/WebKit/chromium/public/WebScriptController.h
index 5c360b2..368f33d 100644
--- a/WebKit/chromium/public/WebScriptController.h
+++ b/WebKit/chromium/public/WebScriptController.h
@@ -51,12 +51,7 @@ public:
     // matching group.
     // Will only affect v8 contexts initialized after this call. Takes ownership
     // of the v8::Extension object passed.
-    // FIXME: remove the latter 2 versions in phase 3 of multipart checkin:
-    // https://bugs.webkit.org/show_bug.cgi?id=45721
     WEBKIT_API static void registerExtension(v8::Extension*);
-    WEBKIT_API static void registerExtension(v8::Extension*,
-                                             const WebString& schemeRestriction);
-    WEBKIT_API static void registerExtension(v8::Extension*, int extensionGroup);
 
     // Enables special settings which are only applicable if V8 is executed
     // in the single thread which must be the main thread.
diff --git a/WebKit/chromium/public/WebBlobStorageData.h b/WebKit/chromium/public/WebThreadSafeData.h
index a9c0c8b..a000b39 100644..100755
--- a/WebKit/chromium/public/WebBlobStorageData.h
+++ b/WebKit/chromium/public/WebThreadSafeData.h
@@ -28,56 +28,50 @@
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebBlobStorageData_h
-#define WebBlobStorageData_h
+#ifndef WebThreadSafeData_h
+#define WebThreadSafeData_h
 
-#include "WebBlobData.h"
-#include "WebData.h"
-#include "WebFileInfo.h"
-#include "WebString.h"
+#include "WebCommon.h"
+#include "WebPrivatePtr.h"
 
-#if WEBKIT_IMPLEMENTATION
-namespace WebCore { class BlobStorageData; }
-namespace WTF { template <typename T> class PassRefPtr; }
+#if !WEBKIT_IMPLEMENTATION
+#include <string>
 #endif
 
-namespace WebKit {
+namespace WebCore { class RawData; }
 
-class WebBlobStorageDataPrivate;
+namespace WebKit {
 
-class WebBlobStorageData {
+// A container for raw bytes.  It is inexpensive to copy a WebThreadSafeData object.
+// It is safe to pass a WebThreadSafeData across threads!!!
+class WebThreadSafeData {
 public:
-    ~WebBlobStorageData() { reset(); }
-
-    WebBlobStorageData() : m_private(0) { }
+    WebThreadSafeData() { }
+    ~WebThreadSafeData() { reset(); }
 
+    WEBKIT_API void assign(const WebThreadSafeData&);
     WEBKIT_API void reset();
 
-    bool isNull() const { return !m_private; }
-
-    // Returns the number of items.
-    WEBKIT_API size_t itemCount() const;
+    WEBKIT_API size_t size() const;
+    WEBKIT_API const char* data() const;
 
-    // Retrieves the values of the item at the given index. Returns false if
-    // index is out of bounds.
-    WEBKIT_API bool itemAt(size_t index, WebBlobData::Item& result) const;
-
-    WEBKIT_API WebString contentType() const;
-    WEBKIT_API WebString contentDisposition() const;
+    bool isEmpty() const { return !size(); }
 
 #if WEBKIT_IMPLEMENTATION
-    WebBlobStorageData(const WTF::PassRefPtr<WebCore::BlobStorageData>&);
-    WebBlobStorageData& operator=(const WTF::PassRefPtr<WebCore::BlobStorageData>&);
-    operator WTF::PassRefPtr<WebCore::BlobStorageData>() const;
+    WebThreadSafeData(const WTF::PassRefPtr<WebCore::RawData>&);
+    WebThreadSafeData& operator=(const WTF::PassRefPtr<WebCore::RawData>&);
+#else
+    operator std::string() const
+    {
+        size_t len = size();
+        return len ? std::string(data(), len) : std::string();
+    }
 #endif
 
 private:
-#if WEBKIT_IMPLEMENTATION
-    void assign(const WTF::PassRefPtr<WebCore::BlobStorageData>&);
-#endif
-    WebBlobStorageDataPrivate* m_private;
+    WebPrivatePtr<WebCore::RawData> m_private;
 };
 
 } // namespace WebKit
 
-#endif // WebBlobStorageData_h
+#endif
diff --git a/WebKit/chromium/public/WebURLLoaderClient.h b/WebKit/chromium/public/WebURLLoaderClient.h
index 7614ea3..87d100f 100644
--- a/WebKit/chromium/public/WebURLLoaderClient.h
+++ b/WebKit/chromium/public/WebURLLoaderClient.h
@@ -66,9 +66,6 @@ public:
     // Called when the load completes successfully.
     virtual void didFinishLoading(WebURLLoader*, double finishTime) { }
 
-    // FIXME: remove this once clients are updated.
-    virtual void didFinishLoading(WebURLLoader* loader) { didFinishLoading(loader, 0); }
-
     // Called when the load completes with an error.
     virtual void didFail(WebURLLoader*, const WebURLError&) { }
 
diff --git a/WebKit/chromium/public/WebURLRequest.h b/WebKit/chromium/public/WebURLRequest.h
index 36d6791..e64ce80 100644
--- a/WebKit/chromium/public/WebURLRequest.h
+++ b/WebKit/chromium/public/WebURLRequest.h
@@ -134,6 +134,11 @@ public:
     WEBKIT_API bool reportLoadTiming() const;
     WEBKIT_API void setReportLoadTiming(bool);
 
+    // Controls whether actual headers sent and received for request are
+    // collected and reported.
+    WEBKIT_API bool reportRawHeaders() const;
+    WEBKIT_API void setReportRawHeaders(bool);
+
     WEBKIT_API TargetType targetType() const;
     WEBKIT_API void setTargetType(TargetType);
 
diff --git a/WebKit/chromium/public/WebURLResponse.h b/WebKit/chromium/public/WebURLResponse.h
index ac75d4c..f78c2db 100644
--- a/WebKit/chromium/public/WebURLResponse.h
+++ b/WebKit/chromium/public/WebURLResponse.h
@@ -32,6 +32,7 @@
 #define WebURLResponse_h
 
 #include "WebCommon.h"
+#include "WebPrivateOwnPtr.h"
 
 #if defined(WEBKIT_IMPLEMENTATION)
 namespace WebCore { class ResourceResponse; }
@@ -41,6 +42,7 @@ namespace WebKit {
 
 class WebCString;
 class WebHTTPHeaderVisitor;
+class WebResourceRawHeaders;
 class WebString;
 class WebURL;
 class WebURLLoadTiming;
@@ -82,6 +84,9 @@ public:
     WEBKIT_API WebURLLoadTiming loadTiming();
     WEBKIT_API void setLoadTiming(const WebURLLoadTiming&);
 
+    WEBKIT_API WebResourceRawHeaders resourceRawHeaders();
+    WEBKIT_API void setResourceRawHeaders(const WebResourceRawHeaders&);
+
     WEBKIT_API double responseTime() const;
     WEBKIT_API void setResponseTime(double);
 
diff --git a/WebKit/chromium/public/WebVideoFrame.h b/WebKit/chromium/public/WebVideoFrame.h
index 5e34f2a..58f1111 100644
--- a/WebKit/chromium/public/WebVideoFrame.h
+++ b/WebKit/chromium/public/WebVideoFrame.h
@@ -53,10 +53,7 @@ public:
 
     enum SurfaceType {
         SurfaceTypeSystemMemory,
-        SurfaceTypeOMXBufferHead,
-        SurfaceTypeEGLImage,
-        SurfaceTypeMFBuffer,
-        SurfaceTypeDirect3DSurface
+        SurfaceTypeTexture,
     };
 
     virtual SurfaceType surfaceType() const = 0;
@@ -66,6 +63,7 @@ public:
     virtual unsigned planes() const = 0;
     virtual int stride(unsigned plane) const = 0;
     virtual const void* data(unsigned plane) const = 0;
+    virtual unsigned texture(unsigned plane) const = 0;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/public/WebView.h b/WebKit/chromium/public/WebView.h
index 7a8a4af..e504bd7 100644
--- a/WebKit/chromium/public/WebView.h
+++ b/WebKit/chromium/public/WebView.h
@@ -54,6 +54,10 @@ struct WebPoint;
 
 class WebView : public WebWidget {
 public:
+    WEBKIT_API static const double textSizeMultiplierRatio;
+    WEBKIT_API static const double minTextSizeMultiplier;
+    WEBKIT_API static const double maxTextSizeMultiplier;
+
     // Controls the time that user scripts injected into the document run.
     enum UserScriptInjectAt {
         UserScriptInjectAtDocumentStart,
@@ -157,13 +161,18 @@ public:
     // send it.
     virtual void clearFocusedNode() = 0;
 
+    // Scrolls the node currently in focus into view.
+    virtual void scrollFocusedNodeIntoView() = 0;
+
 
     // Zoom ----------------------------------------------------------------
 
     // Returns the current zoom level.  0 is "original size", and each increment
-    // above or below represents zooming 20% larger or smaller to limits of 300%
-    // and 50% of original size, respectively.
-    virtual int zoomLevel() = 0;
+    // above or below represents zooming 20% larger or smaller to default limits
+    // of 300% and 50% of original size, respectively.  Only plugins use
+    // non whole-numbers, since they might choose to have specific zoom level so
+    // that fixed-width content is fit-to-page-width, for example.
+    virtual double zoomLevel() = 0;
 
     // Changes the zoom level to the specified level, clamping at the limits
     // noted above, and returns the current zoom level after applying the
@@ -173,7 +182,16 @@ public:
     // page will be zoomed. You can only have either text zoom or full page zoom
     // at one time.  Changing the mode while the page is zoomed will have odd
     // effects.
-    virtual int setZoomLevel(bool textOnly, int zoomLevel) = 0;
+    virtual double setZoomLevel(bool textOnly, double zoomLevel) = 0;
+
+    // Updates the zoom limits for this view.
+    virtual void zoomLimitsChanged(double minimumZoomLevel,
+                                   double maximumZoomLevel) = 0;
+
+    // Helper functions to convert between zoom level and zoom factor.  zoom
+    // factor is zoom percent / 100, so 300% = 3.0.
+    WEBKIT_API static double zoomLevelToZoomFactor(double zoomLevel);
+    WEBKIT_API static double zoomFactorToZoomLevel(double factor);
 
 
     // Media ---------------------------------------------------------------
@@ -208,6 +226,9 @@ public:
         const WebDragData&, int identity,
         const WebPoint& clientPoint, const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed) = 0;
+    virtual WebDragOperation dragTargetDragEnterNew(
+        int identity, const WebPoint& clientPoint, const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed) = 0;
     virtual WebDragOperation dragTargetDragOver(
         const WebPoint& clientPoint, const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed) = 0;
diff --git a/WebKit/chromium/public/WebViewClient.h b/WebKit/chromium/public/WebViewClient.h
index 3b0e47a..858cb2a 100644
--- a/WebKit/chromium/public/WebViewClient.h
+++ b/WebKit/chromium/public/WebViewClient.h
@@ -272,10 +272,6 @@ public:
 
     // Accessibility -------------------------------------------------------
 
-    // Notifies embedder that the focus has changed to the given
-    // accessibility object.
-    virtual void focusAccessibilityObject(const WebAccessibilityObject&) { }
-
     // Notifies embedder about an accessibility notification.
     virtual void postAccessibilityNotification(const WebAccessibilityObject&, WebAccessibilityNotification) { }
 
@@ -348,6 +344,17 @@ public:
     // Access the embedder API for device orientation services.
     virtual WebDeviceOrientationClient* deviceOrientationClient() { return 0; }
 
+
+    // Zoom ----------------------------------------------------------------
+
+    // Informs the browser that the zoom levels for this frame have changed from
+    // the default values.
+    virtual void zoomLimitsChanged(double minimumLevel, double maximumLevel) { }
+
+    // Informs the browser that the zoom level has changed as a result of an
+    // action that wasn't initiated by the client.
+    virtual void zoomLevelChanged() { }
+
 protected:
     ~WebViewClient() { }
 };
diff --git a/WebKit/chromium/public/linux/WebThemeEngine.h b/WebKit/chromium/public/linux/WebThemeEngine.h
new file mode 100644
index 0000000..fd72cf7
--- /dev/null
+++ b/WebKit/chromium/public/linux/WebThemeEngine.h
@@ -0,0 +1,89 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebThemeEngine_h
+#define WebThemeEngine_h
+
+#include "../WebCanvas.h"
+#include "../WebColor.h"
+#include "../WebSize.h"
+
+namespace WebKit {
+
+struct WebRect;
+
+class WebThemeEngine {
+public:
+    // The UI part which is being accessed.
+    enum Part {
+        PartScrollbarDownArrow,
+        PartScrollbarLeftArrow,
+        PartScrollbarRightArrow,
+        PartScrollbarUpArrow,
+        PartScrollbarHorizontalThumb,
+        PartScrollbarVerticalThumb,
+        PartScrollbarHoriztonalTrack,
+        PartScrollbarVerticalTrack
+    };
+
+    // The current state of the associated Part.
+    enum State {
+        StateDisabled,
+        StateHover,
+        StateNormal,
+        StatePressed,
+    };
+
+    // Extra parameters for drawing the PartScrollbarHoriztonalTrack and
+    // PartScrollbarVerticalTrack.
+    struct ScrollbarTrackExtraParams {
+        // The bounds of the entire track, as opposed to the part being painted.
+        int trackX;
+        int trackY;
+        int trackWidth;
+        int trackHeight;
+    };
+
+    union ExtraParams {
+        ScrollbarTrackExtraParams scrollbarTrack;
+    };
+
+    // Gets the size of the given theme part. For variable sized items
+    // like vertical scrollbar thumbs, the width will be the required width of
+    // the track while the height will be the minimum height.
+    virtual WebSize getSize(Part) { return WebSize(); }
+    // Paint the given the given theme part.
+    virtual void paint(
+        WebCanvas*, Part, State, const WebRect&, const ExtraParams*) {}
+};
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/chromium/public/WebThemeEngine.h b/WebKit/chromium/public/win/WebThemeEngine.h
index ab59fa2..1890db6 100644
--- a/WebKit/chromium/public/WebThemeEngine.h
+++ b/WebKit/chromium/public/win/WebThemeEngine.h
@@ -31,8 +31,9 @@
 #ifndef WebThemeEngine_h
 #define WebThemeEngine_h
 
-#include "WebCanvas.h"
-#include "WebColor.h"
+#include "../WebCanvas.h"
+#include "../WebColor.h"
+#include "../WebSize.h"
 
 namespace WebKit {
 
@@ -41,7 +42,6 @@ struct WebSize;
 
 class WebThemeEngine {
 public:
-#ifdef WIN32
 // The part and state parameters correspond to values defined by the
 // Windows Theme API (see
 // http://msdn.microsoft.com/en-us/library/bb773187(VS.85).aspx ).
@@ -83,8 +83,6 @@ public:
     virtual void paintProgressBar(
         WebCanvas*, const WebRect& barRect, const WebRect& valueRect,
         bool determinate, double animatedSeconds) {}
-
-#endif
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/ApplicationCacheHost.cpp b/WebKit/chromium/src/ApplicationCacheHost.cpp
index 3bfcfe2..f1b1a91 100644
--- a/WebKit/chromium/src/ApplicationCacheHost.cpp
+++ b/WebKit/chromium/src/ApplicationCacheHost.cpp
@@ -108,7 +108,7 @@ void ApplicationCacheHost::selectCacheWithManifest(const KURL& manifestURL)
             // see WebCore::ApplicationCacheGroup::selectCache()
             const KURL& docURL = m_documentLoader->frame()->document()->url();
             String referrer = m_documentLoader->frameLoader()->referrer();
-            m_documentLoader->frame()->redirectScheduler()->scheduleLocationChange(docURL, referrer);
+            m_documentLoader->frame()->navigationScheduler()->scheduleLocationChange(docURL, referrer);
         }
     }
 }
@@ -256,6 +256,11 @@ void ApplicationCacheHost::stopDeferringEvents()
     m_defersEvents = false;
 }
 
+void ApplicationCacheHost::stopLoadingInFrame(Frame* frame)
+{
+    // FIXME: Implement this method.
+}
+
 void ApplicationCacheHost::dispatchDOMEvent(EventID id, int total, int done)
 {
     if (m_domApplicationCache) {
diff --git a/WebKit/chromium/src/AssertMatchingEnums.cpp b/WebKit/chromium/src/AssertMatchingEnums.cpp
index f3b8f5a..9647a44 100644
--- a/WebKit/chromium/src/AssertMatchingEnums.cpp
+++ b/WebKit/chromium/src/AssertMatchingEnums.cpp
@@ -321,10 +321,7 @@ COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatEmpty, VideoFrameChromium::Emp
 COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::FormatASCII, VideoFrameChromium::ASCII);
 
 COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeSystemMemory, VideoFrameChromium::TypeSystemMemory);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeOMXBufferHead, VideoFrameChromium::TypeOMXBufferHead);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeEGLImage, VideoFrameChromium::TypeEGLImage);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeMFBuffer, VideoFrameChromium::TypeMFBuffer);
-COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeDirect3DSurface, VideoFrameChromium::TypeDirect3DSurface);
+COMPILE_ASSERT_MATCHING_ENUM(WebVideoFrame::SurfaceTypeTexture, VideoFrameChromium::TypeTexture);
 #endif
 
 #if ENABLE(NOTIFICATIONS)
diff --git a/WebKit/chromium/src/AsyncFileSystemChromium.cpp b/WebKit/chromium/src/AsyncFileSystemChromium.cpp
index db65bbd..5975e72 100644
--- a/WebKit/chromium/src/AsyncFileSystemChromium.cpp
+++ b/WebKit/chromium/src/AsyncFileSystemChromium.cpp
@@ -61,14 +61,14 @@ AsyncFileSystemChromium::~AsyncFileSystemChromium()
 {
 }
 
-void AsyncFileSystemChromium::move(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystemChromium::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    m_webFileSystem->move(srcPath, destPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    m_webFileSystem->move(sourcePath, destinationPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
-void AsyncFileSystemChromium::copy(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void AsyncFileSystemChromium::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
-    m_webFileSystem->copy(srcPath, destPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    m_webFileSystem->copy(sourcePath, destinationPath, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
 void AsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
@@ -76,6 +76,11 @@ void AsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSys
     m_webFileSystem->remove(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
 }
 
+void AsyncFileSystemChromium::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    m_webFileSystem->removeRecursively(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+}
+
 void AsyncFileSystemChromium::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
 {
     m_webFileSystem->readMetadata(path, new WebKit::WebFileSystemCallbacksImpl(callbacks));
diff --git a/WebKit/chromium/src/AsyncFileSystemChromium.h b/WebKit/chromium/src/AsyncFileSystemChromium.h
index d8698d5..6205609 100644
--- a/WebKit/chromium/src/AsyncFileSystemChromium.h
+++ b/WebKit/chromium/src/AsyncFileSystemChromium.h
@@ -34,7 +34,7 @@
 #if ENABLE(FILE_SYSTEM)
 
 #include "AsyncFileSystem.h"
-#include <wtf/PassRefPtr.h>
+#include <wtf/PassOwnPtr.h>
 
 namespace WebKit {
 class WebFileSystem;
@@ -46,12 +46,17 @@ class AsyncFileSystemCallbacks;
 
 class AsyncFileSystemChromium : public AsyncFileSystem {
 public:
-    AsyncFileSystemChromium(const String& rootPath);
+    static PassOwnPtr<AsyncFileSystem> create(const String& rootPath)
+    {
+        return adoptPtr(new AsyncFileSystemChromium(rootPath));
+    }
+
     virtual ~AsyncFileSystemChromium();
 
-    virtual void move(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks>);
-    virtual void copy(const String& srcPath, const String& destPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
     virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
@@ -61,6 +66,7 @@ public:
     virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
 
 private:
+    explicit AsyncFileSystemChromium(const String& rootPath);
     WebKit::WebFileSystem* m_webFileSystem;
 };
 
diff --git a/WebKit/chromium/src/BackForwardListClientImpl.cpp b/WebKit/chromium/src/BackForwardListClientImpl.cpp
index f5b04ab..2976329 100644
--- a/WebKit/chromium/src/BackForwardListClientImpl.cpp
+++ b/WebKit/chromium/src/BackForwardListClientImpl.cpp
@@ -34,6 +34,7 @@
 #include "HistoryItem.h"
 #include "WebViewClient.h"
 #include "WebViewImpl.h"
+#include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
@@ -102,11 +103,8 @@ HistoryItem* BackForwardListClientImpl::itemAtIndex(int index)
     // differently.  It should perhaps just ask the FrameLoaderClient to
     // perform those navigations.
 
-    String url_string = String::format(
-        "%s://go/%d", backForwardNavigationScheme, index);
-
-    m_pendingHistoryItem =
-        HistoryItem::create(url_string, String(), 0.0);
+    String urlString = makeString(backForwardNavigationScheme, "://go/", String::number(index));
+    m_pendingHistoryItem = HistoryItem::create(urlString, String(), 0);
     return m_pendingHistoryItem.get();
 }
 
diff --git a/WebKit/chromium/src/ChromeClientImpl.cpp b/WebKit/chromium/src/ChromeClientImpl.cpp
index 5f702e0..4f1705f 100644
--- a/WebKit/chromium/src/ChromeClientImpl.cpp
+++ b/WebKit/chromium/src/ChromeClientImpl.cpp
@@ -55,10 +55,10 @@
 #include "NotificationPresenterImpl.h"
 #include "Page.h"
 #include "PopupMenuChromium.h"
+#include "RenderWidget.h"
 #include "ScriptController.h"
 #include "SearchPopupMenuChromium.h"
 #include "SecurityOrigin.h"
-#include "SharedGraphicsContext3D.h"
 #if USE(V8)
 #include "V8Proxy.h"
 #endif
@@ -72,6 +72,8 @@
 #include "WebInputEvent.h"
 #include "WebKit.h"
 #include "WebNode.h"
+#include "WebPlugin.h"
+#include "WebPluginContainerImpl.h"
 #include "WebPopupMenuImpl.h"
 #include "WebPopupMenuInfo.h"
 #include "WebPopupType.h"
@@ -246,28 +248,6 @@ void ChromeClientImpl::focusedNodeChanged(Node* node)
             focusURL = hitTest.absoluteLinkURL();
     }
     m_webView->client()->setKeyboardFocusURL(focusURL);
-    
-    if (!node)
-        return;
-
-    // If accessibility is enabled, we should notify assistive technology that
-    // the active AccessibilityObject changed.
-    Document* document = node->document();
-    if (!document) {
-        ASSERT_NOT_REACHED();
-        return;
-    }
-
-    // TODO: Remove once the FocusedUIElementChanged notification is handled downstream.
-    if (document && document->axObjectCache()->accessibilityEnabled()) {
-        // Retrieve the focused AccessibilityObject.
-        AccessibilityObject* focusedAccObj =
-            document->axObjectCache()->getOrCreate(node->renderer());
-
-        // Alert assistive technology that focus changed.
-        if (focusedAccObj)
-            m_webView->client()->focusAccessibilityObject(WebAccessibilityObject(focusedAccObj));
-    }
 }
 
 Page* ChromeClientImpl::createWindow(
@@ -604,11 +584,25 @@ void ChromeClientImpl::mouseDidMoveOverElement(
 {
     if (!m_webView->client())
         return;
+
+    WebURL url;
     // Find out if the mouse is over a link, and if so, let our UI know...
     if (result.isLiveLink() && !result.absoluteLinkURL().string().isEmpty())
-        m_webView->client()->setMouseOverURL(result.absoluteLinkURL());
-    else
-        m_webView->client()->setMouseOverURL(WebURL());
+        url = result.absoluteLinkURL();
+    else if (result.innerNonSharedNode()
+             && (result.innerNonSharedNode()->hasTagName(HTMLNames::objectTag)
+                 || result.innerNonSharedNode()->hasTagName(HTMLNames::embedTag))) {
+        RenderObject* object = result.innerNonSharedNode()->renderer();
+        if (object && object->isWidget()) {
+            Widget* widget = toRenderWidget(object)->widget();
+            if (widget && widget->isPluginContainer()) {
+                WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
+                url = plugin->plugin()->linkAtPosition(result.point());
+            }
+        }
+    }
+
+    m_webView->client()->setMouseOverURL(url);
 }
 
 void ChromeClientImpl::setToolTip(const String& tooltipText, TextDirection dir)
@@ -777,15 +771,23 @@ NotificationPresenter* ChromeClientImpl::notificationPresenter() const
 
 void ChromeClientImpl::requestGeolocationPermissionForFrame(Frame* frame, Geolocation* geolocation)
 {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // FIXME: Implement Client-based Geolocation Permissions
+#else
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     geolocationService->geolocationServiceBridge()->attachBridgeIfNeeded();
     m_webView->client()->geolocationService()->requestPermissionForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
+#endif
 }
 
 void ChromeClientImpl::cancelGeolocationPermissionRequestForFrame(Frame* frame, Geolocation* geolocation)
 {
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+    // FIXME: Implement Client-based Geolocation Permissions
+#else
     GeolocationServiceChromium* geolocationService = static_cast<GeolocationServiceChromium*>(geolocation->getGeolocationService());
     m_webView->client()->geolocationService()->cancelPermissionRequestForFrame(geolocationService->geolocationServiceBridge()->getBridgeId(), frame->document()->url());
+#endif
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -805,11 +807,6 @@ bool ChromeClientImpl::allowsAcceleratedCompositing() const
 }
 #endif
 
-WebCore::SharedGraphicsContext3D* ChromeClientImpl::getSharedGraphicsContext3D()
-{
-    return m_webView->getSharedGraphicsContext3D();
-}
-
 bool ChromeClientImpl::supportsFullscreenForNode(const WebCore::Node* node)
 {
     if (m_webView->client() && node->hasTagName(WebCore::HTMLNames::videoTag))
diff --git a/WebKit/chromium/src/ChromeClientImpl.h b/WebKit/chromium/src/ChromeClientImpl.h
index 02f1de6..b1208f7 100644
--- a/WebKit/chromium/src/ChromeClientImpl.h
+++ b/WebKit/chromium/src/ChromeClientImpl.h
@@ -155,8 +155,6 @@ public:
     virtual bool allowsAcceleratedCompositing() const;
 #endif
 
-    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
-
     virtual bool supportsFullscreenForNode(const WebCore::Node*);
     virtual void enterFullscreenForNode(WebCore::Node*);
     virtual void exitFullscreenForNode(WebCore::Node*);
diff --git a/WebKit/chromium/src/ChromiumBridge.cpp b/WebKit/chromium/src/ChromiumBridge.cpp
index b906575..1af32cf 100644
--- a/WebKit/chromium/src/ChromiumBridge.cpp
+++ b/WebKit/chromium/src/ChromiumBridge.cpp
@@ -63,10 +63,11 @@
 
 #if OS(WINDOWS)
 #include "WebRect.h"
-#include "WebThemeEngine.h"
+#include "win/WebThemeEngine.h"
 #endif
 
 #if OS(LINUX) || OS(FREEBSD)
+#include "linux/WebThemeEngine.h"
 #include "WebFontInfo.h"
 #include "WebFontRenderStyle.h"
 #endif
@@ -85,7 +86,11 @@
 #include "PlatformContextSkia.h"
 #include "PluginData.h"
 #include "SharedBuffer.h"
+
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
 #include "WebGeolocationServiceBridgeImpl.h"
+#endif
+
 #include "Worker.h"
 #include "WorkerContextProxy.h"
 #include <wtf/Assertions.h>
@@ -464,12 +469,14 @@ bool ChromiumBridge::loadFont(NSFont* srcFont, ATSFontContainerRef* out)
 }
 #endif
 
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
 // Geolocation ----------------------------------------------------------------
 
 GeolocationServiceBridge* ChromiumBridge::createGeolocationServiceBridge(GeolocationServiceChromium* geolocationServiceChromium)
 {
     return createGeolocationServiceBridgeImpl(geolocationServiceChromium);
 }
+#endif
 
 // Databases ------------------------------------------------------------------
 
@@ -584,14 +591,9 @@ bool ChromiumBridge::plugins(bool refresh, Vector<PluginInfo>* results)
 
 NPObject* ChromiumBridge::pluginScriptableObject(Widget* widget)
 {
-    if (!widget)
+    if (!widget || !widget->isPluginContainer())
         return 0;
 
-    ASSERT(!widget->isFrameView());
-
-    // NOTE:  We have to trust that the widget passed to us here is a
-    // WebPluginContainerImpl.  There isn't a way to dynamically verify it,
-    // since the derived class (Widget) has no identifier.
     return static_cast<WebPluginContainerImpl*>(widget)->scriptableObject();
 }
 
@@ -739,6 +741,60 @@ void ChromiumBridge::paintProgressBar(
         gc->platformContext()->canvas(), barRect, valueRect, determinate, animatedSeconds);
 }
 
+#elif OS(LINUX)
+
+static WebThemeEngine::Part WebThemePart(ChromiumBridge::ThemePart part)
+{
+    switch (part) {
+    case ChromiumBridge::PartScrollbarDownArrow: return WebThemeEngine::PartScrollbarDownArrow;
+    case ChromiumBridge::PartScrollbarLeftArrow: return WebThemeEngine::PartScrollbarLeftArrow;
+    case ChromiumBridge::PartScrollbarRightArrow: return WebThemeEngine::PartScrollbarRightArrow;
+    case ChromiumBridge::PartScrollbarUpArrow: return WebThemeEngine::PartScrollbarUpArrow;
+    case ChromiumBridge::PartScrollbarHorizontalThumb: return WebThemeEngine::PartScrollbarHorizontalThumb;
+    case ChromiumBridge::PartScrollbarVerticalThumb: return WebThemeEngine::PartScrollbarVerticalThumb;
+    case ChromiumBridge::PartScrollbarHoriztonalTrack: return WebThemeEngine::PartScrollbarHoriztonalTrack;
+    case ChromiumBridge::PartScrollbarVerticalTrack: return WebThemeEngine::PartScrollbarVerticalTrack;
+    }
+    ASSERT_NOT_REACHED();
+    return WebThemeEngine::PartScrollbarDownArrow;
+}
+
+static WebThemeEngine::State WebThemeState(ChromiumBridge::ThemePaintState state)
+{
+    switch (state) {
+    case ChromiumBridge::StateDisabled: return WebThemeEngine::StateDisabled;
+    case ChromiumBridge::StateHover: return WebThemeEngine::StateHover;
+    case ChromiumBridge::StateNormal: return WebThemeEngine::StateNormal;
+    case ChromiumBridge::StatePressed: return WebThemeEngine::StatePressed;
+    }
+    ASSERT_NOT_REACHED();
+    return WebThemeEngine::StateDisabled;
+}
+
+static void GetWebThemeExtraParams(ChromiumBridge::ThemePart part, ChromiumBridge::ThemePaintState state, const ChromiumBridge::ThemePaintExtraParams* extraParams, WebThemeEngine::ExtraParams* webThemeExtraParams)
+{
+    if (part == ChromiumBridge::PartScrollbarHoriztonalTrack || part == ChromiumBridge::PartScrollbarVerticalTrack) {
+        webThemeExtraParams->scrollbarTrack.trackX = extraParams->scrollbarTrack.trackX;
+        webThemeExtraParams->scrollbarTrack.trackY = extraParams->scrollbarTrack.trackY;
+        webThemeExtraParams->scrollbarTrack.trackWidth = extraParams->scrollbarTrack.trackWidth;
+        webThemeExtraParams->scrollbarTrack.trackHeight = extraParams->scrollbarTrack.trackHeight;
+    }
+}
+
+IntSize ChromiumBridge::getThemePartSize(ThemePart part)
+{
+     return webKitClient()->themeEngine()->getSize(WebThemePart(part));
+}
+
+void ChromiumBridge::paintThemePart(
+    GraphicsContext* gc, ThemePart part, ThemePaintState state, const IntRect& rect, const ThemePaintExtraParams* extraParams)
+{
+    WebThemeEngine::ExtraParams webThemeExtraParams;
+    GetWebThemeExtraParams(part, state, extraParams, &webThemeExtraParams);
+    webKitClient()->themeEngine()->paint(
+        gc->platformContext()->canvas(), WebThemePart(part), WebThemeState(state), rect, &webThemeExtraParams);
+}
+
 #endif
 
 // Trace Event ----------------------------------------------------------------
diff --git a/WebKit/chromium/src/ContextMenuClientImpl.cpp b/WebKit/chromium/src/ContextMenuClientImpl.cpp
index ef611e1..d9ccb17 100644
--- a/WebKit/chromium/src/ContextMenuClientImpl.cpp
+++ b/WebKit/chromium/src/ContextMenuClientImpl.cpp
@@ -208,7 +208,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
         RenderObject* object = r.innerNonSharedNode()->renderer();
         if (object && object->isWidget()) {
             Widget* widget = toRenderWidget(object)->widget();
-            if (widget) {
+            if (widget && widget->isPluginContainer()) {
                 WebPluginContainerImpl* plugin = static_cast<WebPluginContainerImpl*>(widget);
                 WebString text = plugin->plugin()->selectionAsText();
                 if (!text.isEmpty()) {
@@ -216,6 +216,7 @@ PlatformMenuDescription ContextMenuClientImpl::getCustomMenuFromDefaultItems(
                     data.editFlags |= WebContextMenuData::CanCopy;
                 }
                 data.editFlags &= ~WebContextMenuData::CanTranslate;
+                data.linkURL = plugin->plugin()->linkAtPosition(data.mousePosition);
             }
         }
     }
diff --git a/WebKit/chromium/src/DebuggerAgentManager.cpp b/WebKit/chromium/src/DebuggerAgentManager.cpp
index dfc186c..0860cb1 100644
--- a/WebKit/chromium/src/DebuggerAgentManager.cpp
+++ b/WebKit/chromium/src/DebuggerAgentManager.cpp
@@ -41,6 +41,7 @@
 #include "WebViewImpl.h"
 #include <wtf/HashSet.h>
 #include <wtf/Noncopyable.h>
+#include <wtf/text/StringConcatenate.h>
 
 namespace WebKit {
 
@@ -153,10 +154,9 @@ void DebuggerAgentManager::debugDetach(DebuggerAgentImpl* debuggerAgent)
         }
     } else {
       // Remove all breakpoints set by the agent.
-      WTF::String clearBreakpointGroupCmd = WTF::String::format(
+      String clearBreakpointGroupCmd = makeString(
           "{\"seq\":1,\"type\":\"request\",\"command\":\"clearbreakpointgroup\","
-              "\"arguments\":{\"groupId\":%d}}",
-          hostId);
+              "\"arguments\":{\"groupId\":", String::number(hostId), "}}");
       sendCommandToV8(clearBreakpointGroupCmd, new CallerIdWrapper());
 
       if (isOnBreakpoint) {
diff --git a/WebKit/chromium/src/FrameLoaderClientImpl.cpp b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
index ba9c8fd..b4c62f4 100644
--- a/WebKit/chromium/src/FrameLoaderClientImpl.cpp
+++ b/WebKit/chromium/src/FrameLoaderClientImpl.cpp
@@ -1072,7 +1072,11 @@ void FrameLoaderClientImpl::committedLoad(DocumentLoader* loader, const char* da
             m_pluginWidget->didReceiveResponse(
                 m_webFrame->frame()->loader()->activeDocumentLoader()->response());
         }
-        m_pluginWidget->didReceiveData(data, length);
+
+        // It's possible that the above call removed the pointer to the plugin, so
+        // check before calling it.
+        if (m_pluginWidget.get())
+            m_pluginWidget->didReceiveData(data, length);
     }
 }
 
@@ -1411,14 +1415,6 @@ PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
     if (!webPlugin->initialize(container.get()))
         return 0;
 
-    bool zoomTextOnly = m_webFrame->viewImpl()->zoomTextOnly();
-    float zoomFactor = zoomTextOnly ? m_webFrame->frame()->textZoomFactor() : m_webFrame->frame()->pageZoomFactor();
-    if (zoomFactor != 1) {
-        // There's a saved zoom level, so tell the plugin about it since
-        // WebViewImpl::setZoomLevel was called before the plugin was created.
-        webPlugin->setZoomFactor(zoomFactor, zoomTextOnly);
-    }
-
     // The element might have been removed during plugin initialization!
     if (!element->renderer())
         return 0;
@@ -1430,7 +1426,8 @@ PassRefPtr<Widget> FrameLoaderClientImpl::createPlugin(
 // (e.g., acrobat reader).
 void FrameLoaderClientImpl::redirectDataToPlugin(Widget* pluginWidget)
 {
-    m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
+    if (pluginWidget->isPluginContainer())
+        m_pluginWidget = static_cast<WebPluginContainerImpl*>(pluginWidget);
     ASSERT(m_pluginWidget.get());
 }
 
diff --git a/WebKit/chromium/src/GraphicsContext3D.cpp b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
index c78d334..afc2707 100644
--- a/WebKit/chromium/src/GraphicsContext3D.cpp
+++ b/WebKit/chromium/src/GraphicsContext3DChromium.cpp
@@ -801,15 +801,15 @@ GraphicsContext3D::~GraphicsContext3D()
 {
 }
 
-PassOwnPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
+PassRefPtr<GraphicsContext3D> GraphicsContext3D::create(GraphicsContext3D::Attributes attrs, HostWindow* hostWindow, GraphicsContext3D::RenderStyle renderStyle)
 {
     OwnPtr<GraphicsContext3DInternal> internal = adoptPtr(new GraphicsContext3DInternal());
     if (!internal->initialize(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow)) {
         return 0;
     }
-    PassOwnPtr<GraphicsContext3D> result = new GraphicsContext3D(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow);
+    RefPtr<GraphicsContext3D> result = adoptRef(new GraphicsContext3D(attrs, hostWindow, renderStyle == RenderDirectlyToHostWindow));
     result->m_internal = internal.release();
-    return result;
+    return result.release();
 }
 
 PlatformGraphicsContext3D GraphicsContext3D::platformGraphicsContext3D() const
@@ -1047,6 +1047,11 @@ bool GraphicsContext3D::isErrorGeneratedOnOutOfBoundsAccesses() const
     return m_internal->isErrorGeneratedOnOutOfBoundsAccesses();
 }
 
+int GraphicsContext3D::getGraphicsResetStatusARB()
+{
+    return NO_ERROR;
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(3D_CANVAS)
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.cpp b/WebKit/chromium/src/IDBCallbacksProxy.cpp
index 3eab622..69051d0 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBCallbacksProxy.cpp
@@ -38,6 +38,7 @@
 #include "WebIDBIndexImpl.h"
 #include "WebIDBKey.h"
 #include "WebIDBObjectStoreImpl.h"
+#include "WebIDBTransactionImpl.h"
 #include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
@@ -100,6 +101,12 @@ void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBObjectStoreBackendInterface> bac
     m_callbacks.clear();
 }
 
+void IDBCallbacksProxy::onSuccess(PassRefPtr<IDBTransactionBackendInterface> backend)
+{
+    m_callbacks->onSuccess(new WebKit::WebIDBTransactionImpl(backend));
+    m_callbacks.clear();
+}
+
 void IDBCallbacksProxy::onSuccess(PassRefPtr<SerializedScriptValue> serializedScriptValue)
 {
     m_callbacks->onSuccess(WebKit::WebSerializedScriptValue(serializedScriptValue));
diff --git a/WebKit/chromium/src/IDBCallbacksProxy.h b/WebKit/chromium/src/IDBCallbacksProxy.h
index 506dbb0..8c26161 100644
--- a/WebKit/chromium/src/IDBCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBCallbacksProxy.h
@@ -54,6 +54,7 @@ public:
     virtual void onSuccess(PassRefPtr<IDBIndexBackendInterface>);
     virtual void onSuccess(PassRefPtr<IDBKey>);
     virtual void onSuccess(PassRefPtr<IDBObjectStoreBackendInterface>);
+    virtual void onSuccess(PassRefPtr<IDBTransactionBackendInterface>);
     virtual void onSuccess(PassRefPtr<SerializedScriptValue>);
 
 private:
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.cpp b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
index cf18917..94491f9 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.cpp
@@ -75,19 +75,19 @@ PassRefPtr<IDBAny> IDBCursorBackendProxy::value() const
     return IDBAny::create<IDBKey>(webKey);
 }
 
-void IDBCursorBackendProxy::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::update(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->update(value, new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->update(value, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-void IDBCursorBackendProxy::continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::continueFunction(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->continueFunction(key, new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->continueFunction(key, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-void IDBCursorBackendProxy::remove(PassRefPtr<IDBCallbacks> callbacks)
+void IDBCursorBackendProxy::remove(PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_idbCursor->remove(new WebIDBCallbacksImpl(callbacks));
+    m_idbCursor->remove(new WebIDBCallbacksImpl(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBCursorBackendProxy.h b/WebKit/chromium/src/IDBCursorBackendProxy.h
index d8b621a..0a7a288 100644
--- a/WebKit/chromium/src/IDBCursorBackendProxy.h
+++ b/WebKit/chromium/src/IDBCursorBackendProxy.h
@@ -45,9 +45,9 @@ public:
     virtual unsigned short direction() const;
     virtual PassRefPtr<IDBKey> key() const;
     virtual PassRefPtr<IDBAny> value() const;
-    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>);
-    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void remove(PassRefPtr<IDBCallbacks>);
+    virtual void update(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void continueFunction(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBCallbacks>, ExceptionCode&);
 
 private:
     IDBCursorBackendProxy(PassOwnPtr<WebKit::WebIDBCursor>);
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.cpp b/WebKit/chromium/src/IDBDatabaseProxy.cpp
index ce5e0a6..4fecf1b 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.cpp
+++ b/WebKit/chromium/src/IDBDatabaseProxy.cpp
@@ -76,36 +76,42 @@ PassRefPtr<DOMStringList> IDBDatabaseProxy::objectStores() const
     return m_webIDBDatabase->objectStores();
 }
 
-void IDBDatabaseProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseProxy::createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, new WebIDBCallbacksImpl(callbacks));
-}
-
-PassRefPtr<IDBObjectStoreBackendInterface> IDBDatabaseProxy::objectStore(const String& name, unsigned short mode)
-{
-    WebKit::WebIDBObjectStore* objectStore = m_webIDBDatabase->objectStore(name, mode);
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    WebKit::WebIDBObjectStore* objectStore = m_webIDBDatabase->createObjectStore(name, keyPath, autoIncrement, *transactionProxy->getWebIDBTransaction(), ec);
     if (!objectStore)
         return 0;
     return IDBObjectStoreProxy::create(objectStore);
 }
 
-void IDBDatabaseProxy::removeObjectStore(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseProxy::removeObjectStore(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBDatabase->removeObjectStore(name, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBDatabase->removeObjectStore(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks)
+void IDBDatabaseProxy::setVersion(const String& version, PassRefPtr<IDBCallbacks> callbacks, ExceptionCode& ec)
 {
-    m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks));
+    m_webIDBDatabase->setVersion(version, new WebIDBCallbacksImpl(callbacks), ec);
 }
 
-PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout)
+PassRefPtr<IDBTransactionBackendInterface> IDBDatabaseProxy::transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode& ec)
 {
     WebKit::WebDOMStringList names(storeNames);
-    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, timeout);
+    WebKit::WebIDBTransaction* transaction = m_webIDBDatabase->transaction(names, mode, timeout, ec);
     return IDBTransactionBackendProxy::create(transaction);
 }
 
+void IDBDatabaseProxy::close()
+{
+    m_webIDBDatabase->close();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebKit/chromium/src/IDBDatabaseProxy.h b/WebKit/chromium/src/IDBDatabaseProxy.h
index fffd23e..5d20073 100644
--- a/WebKit/chromium/src/IDBDatabaseProxy.h
+++ b/WebKit/chromium/src/IDBDatabaseProxy.h
@@ -47,13 +47,11 @@ public:
     virtual String version() const;
     virtual PassRefPtr<DOMStringList> objectStores() const;
 
-    // FIXME: Add setVersion.
-
-    virtual void createObjectStore(const String& name, const String& keyPath, bool autoIncrement, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name, unsigned short mode);
-    virtual void removeObjectStore(const String& name, PassRefPtr<IDBCallbacks>);
-    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>);
-    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout);
+    virtual PassRefPtr<IDBObjectStoreBackendInterface> createObjectStore(const String& name, const String& keyPath, bool autoIncrement, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void removeObjectStore(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void setVersion(const String& version, PassRefPtr<IDBCallbacks>, ExceptionCode&);
+    virtual PassRefPtr<IDBTransactionBackendInterface> transaction(DOMStringList* storeNames, unsigned short mode, unsigned long timeout, ExceptionCode&);
+    virtual void close();
 
 private:
     IDBDatabaseProxy(PassOwnPtr<WebKit::WebIDBDatabase>);
diff --git a/WebKit/chromium/src/IDBFactoryBackendProxy.cpp b/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
index d43e787..2e65246 100755
--- a/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBFactoryBackendProxy.cpp
@@ -59,10 +59,10 @@ IDBFactoryBackendProxy::~IDBFactoryBackendProxy()
 {
 }
 
-void IDBFactoryBackendProxy::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir)
+void IDBFactoryBackendProxy::open(const String& name, const String& description, PassRefPtr<IDBCallbacks> callbacks, PassRefPtr<SecurityOrigin> origin, Frame* frame, const String& dataDir, int64_t maximumSize)
 {
     WebKit::WebFrame* webFrame = WebKit::WebFrameImpl::fromFrame(frame);
-    m_webIDBFactory->open(name, description, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir);
+    m_webIDBFactory->open(name, description, new WebIDBCallbacksImpl(callbacks), origin, webFrame, dataDir, maximumSize);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBFactoryBackendProxy.h b/WebKit/chromium/src/IDBFactoryBackendProxy.h
index 6371686..0a55b59 100755
--- a/WebKit/chromium/src/IDBFactoryBackendProxy.h
+++ b/WebKit/chromium/src/IDBFactoryBackendProxy.h
@@ -45,7 +45,7 @@ public:
     virtual ~IDBFactoryBackendProxy();
 
     PassRefPtr<DOMStringList> databases(void) const;
-    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir);
+    virtual void open(const String& name, const String& description, PassRefPtr<IDBCallbacks>, PassRefPtr<SecurityOrigin>, Frame*, const String& dataDir, int64_t maximumSize);
 
 private:
     IDBFactoryBackendProxy();
diff --git a/WebKit/chromium/src/IDBIndexBackendProxy.cpp b/WebKit/chromium/src/IDBIndexBackendProxy.cpp
index f92f4f2..410750e 100644
--- a/WebKit/chromium/src/IDBIndexBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBIndexBackendProxy.cpp
@@ -30,6 +30,7 @@
 
 #include "IDBCallbacks.h"
 #include "IDBKeyRange.h"
+#include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacksImpl.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndex.h"
@@ -72,24 +73,36 @@ bool IDBIndexBackendProxy::unique()
     return m_webIDBIndex->unique();
 }
 
-void IDBIndexBackendProxy::openObjectCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->openObjectCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->openObjectCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::openCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::openKeyCursor(PassRefPtr<IDBKeyRange> keyRange, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->openCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->openKeyCursor(keyRange, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::getObject(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->getObject(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->getObject(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBIndexBackendProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBIndexBackendProxy::getKey(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBIndex->get(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBIndex->getKey(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBIndexBackendProxy.h b/WebKit/chromium/src/IDBIndexBackendProxy.h
index 6aafdfa..e9de05a 100644
--- a/WebKit/chromium/src/IDBIndexBackendProxy.h
+++ b/WebKit/chromium/src/IDBIndexBackendProxy.h
@@ -46,10 +46,10 @@ public:
     virtual String keyPath();
     virtual bool unique();
 
-    virtual void openObjectCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>);
-    virtual void getObject(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
-    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>);
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void openKeyCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void getKey(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
     IDBIndexBackendProxy(PassOwnPtr<WebKit::WebIDBIndex>);
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.cpp b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
index 82ca5f6..e537718 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.cpp
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.cpp
@@ -72,45 +72,63 @@ PassRefPtr<DOMStringList> IDBObjectStoreProxy::indexNames() const
     return m_webIDBObjectStore->indexNames();
 }
 
-void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction)
+void IDBObjectStoreProxy::get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
     // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
     // all implementations of IDB interfaces are proxy objects.
     IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
-    m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction());
+    m_webIDBObjectStore->get(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->put(value, key, addOnly, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->remove(key, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->remove(key, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks> callbacks)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->createIndex(name, keyPath, unique, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    WebKit::WebIDBIndex* index = m_webIDBObjectStore->createIndex(name, keyPath, unique, *transactionProxy->getWebIDBTransaction(), ec);
+    if (!index)
+        return 0;
+    return IDBIndexBackendProxy::create(index);
 }
 
-PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::index(const String& name)
+PassRefPtr<IDBIndexBackendInterface> IDBObjectStoreProxy::index(const String& name, ExceptionCode& ec)
 {
-    WebKit::WebIDBIndex* index = m_webIDBObjectStore->index(name);
+    WebKit::WebIDBIndex* index = m_webIDBObjectStore->index(name, ec);
     if (!index)
         return 0;
     return IDBIndexBackendProxy::create(index);
 }
 
-void IDBObjectStoreProxy::removeIndex(const String& name, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::removeIndex(const String& name, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->removeIndex(name, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->removeIndex(name, *transactionProxy->getWebIDBTransaction(), ec);
 }
 
-void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks)
+void IDBObjectStoreProxy::openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks> callbacks, IDBTransactionBackendInterface* transaction, ExceptionCode& ec)
 {
-    m_webIDBObjectStore->openCursor(range, direction, new WebIDBCallbacksImpl(callbacks));
+    // The transaction pointer is guaranteed to be a pointer to a proxy object as, in the renderer,
+    // all implementations of IDB interfaces are proxy objects.
+    IDBTransactionBackendProxy* transactionProxy = static_cast<IDBTransactionBackendProxy*>(transaction);
+    m_webIDBObjectStore->openCursor(range, direction, new WebIDBCallbacksImpl(callbacks), *transactionProxy->getWebIDBTransaction(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBObjectStoreProxy.h b/WebKit/chromium/src/IDBObjectStoreProxy.h
index 13dfe23..1e19279 100755
--- a/WebKit/chromium/src/IDBObjectStoreProxy.h
+++ b/WebKit/chromium/src/IDBObjectStoreProxy.h
@@ -40,21 +40,21 @@ namespace WebCore {
 class IDBObjectStoreProxy : public IDBObjectStoreBackendInterface {
 public:
     static PassRefPtr<IDBObjectStoreBackendInterface> create(PassOwnPtr<WebKit::WebIDBObjectStore>);
-    ~IDBObjectStoreProxy();
+    virtual ~IDBObjectStoreProxy();
 
-    String name() const;
-    String keyPath() const;
-    PassRefPtr<DOMStringList> indexNames() const;
+    virtual String name() const;
+    virtual String keyPath() const;
+    virtual PassRefPtr<DOMStringList> indexNames() const;
 
-    void get(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*);
-    void put(PassRefPtr<SerializedScriptValue> value, PassRefPtr<IDBKey> key, bool addOnly, PassRefPtr<IDBCallbacks>);
-    void remove(PassRefPtr<IDBKey> key, PassRefPtr<IDBCallbacks>);
+    virtual void get(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void put(PassRefPtr<SerializedScriptValue>, PassRefPtr<IDBKey>, bool addOnly, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
+    virtual void remove(PassRefPtr<IDBKey>, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
-    void createIndex(const String& name, const String& keyPath, bool unique, PassRefPtr<IDBCallbacks>);
-    PassRefPtr<IDBIndexBackendInterface> index(const String& name);
-    void removeIndex(const String& name, PassRefPtr<IDBCallbacks>);
+    PassRefPtr<IDBIndexBackendInterface> createIndex(const String& name, const String& keyPath, bool unique, IDBTransactionBackendInterface*, ExceptionCode&);
+    PassRefPtr<IDBIndexBackendInterface> index(const String& name, ExceptionCode&);
+    void removeIndex(const String& name, IDBTransactionBackendInterface*, ExceptionCode&);
 
-    virtual void openCursor(PassRefPtr<IDBKeyRange> range, unsigned short direction, PassRefPtr<IDBCallbacks>);
+    virtual void openCursor(PassRefPtr<IDBKeyRange>, unsigned short direction, PassRefPtr<IDBCallbacks>, IDBTransactionBackendInterface*, ExceptionCode&);
 
 private:
     IDBObjectStoreProxy(PassOwnPtr<WebKit::WebIDBObjectStore>);
diff --git a/WebKit/chromium/src/IDBTransactionBackendProxy.cpp b/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
index 59e88d8..4b19ee4 100644
--- a/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
+++ b/WebKit/chromium/src/IDBTransactionBackendProxy.cpp
@@ -45,6 +45,8 @@ PassRefPtr<IDBTransactionBackendInterface> IDBTransactionBackendProxy::create(Pa
 IDBTransactionBackendProxy::IDBTransactionBackendProxy(PassOwnPtr<WebKit::WebIDBTransaction> transaction)
     : m_webIDBTransaction(transaction)
 {
+    if (!m_webIDBTransaction)
+        m_webIDBTransaction = adoptPtr(new WebKit::WebIDBTransaction());
 }
 
 IDBTransactionBackendProxy::~IDBTransactionBackendProxy()
@@ -69,7 +71,7 @@ void IDBTransactionBackendProxy::abort()
     m_webIDBTransaction->abort();
 }
 
-bool IDBTransactionBackendProxy::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>)
+bool IDBTransactionBackendProxy::scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>, PassOwnPtr<ScriptExecutionContext::Task>)
 {
     // This should never be reached as it's the impl objects who get to
     // execute tasks in the browser process.
diff --git a/WebKit/chromium/src/IDBTransactionBackendProxy.h b/WebKit/chromium/src/IDBTransactionBackendProxy.h
index 3daf73e..0c56f19 100644
--- a/WebKit/chromium/src/IDBTransactionBackendProxy.h
+++ b/WebKit/chromium/src/IDBTransactionBackendProxy.h
@@ -45,7 +45,7 @@ public:
     virtual PassRefPtr<IDBObjectStoreBackendInterface> objectStore(const String& name);
     virtual unsigned short mode() const;
     virtual void abort();
-    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>);
+    virtual bool scheduleTask(PassOwnPtr<ScriptExecutionContext::Task>, PassOwnPtr<ScriptExecutionContext::Task>);
     virtual void didCompleteTaskEvents();
     virtual int id() const;
     virtual void setCallbacks(IDBTransactionCallbacks*);
diff --git a/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp b/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
index be7d44f..3a19fe2 100644
--- a/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
+++ b/WebKit/chromium/src/IDBTransactionCallbacksProxy.cpp
@@ -55,9 +55,16 @@ void IDBTransactionCallbacksProxy::onAbort()
     m_callbacks.clear();
 }
 
-int IDBTransactionCallbacksProxy::id() const
+void IDBTransactionCallbacksProxy::onComplete()
 {
-    return m_callbacks->id();
+    m_callbacks->onComplete();
+    m_callbacks.clear();
+}
+
+void IDBTransactionCallbacksProxy::onTimeout()
+{
+    m_callbacks->onTimeout();
+    m_callbacks.clear();
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/IDBTransactionCallbacksProxy.h b/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
index 821eff4..891d5c9 100644
--- a/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
+++ b/WebKit/chromium/src/IDBTransactionCallbacksProxy.h
@@ -46,8 +46,8 @@ public:
     virtual ~IDBTransactionCallbacksProxy();
 
     virtual void onAbort();
-    virtual int id() const;
-    // FIXME: implement onComplete().
+    virtual void onComplete();
+    virtual void onTimeout();
 
 private:
     IDBTransactionCallbacksProxy(PassOwnPtr<WebKit::WebIDBTransactionCallbacks>);
diff --git a/WebKit/chromium/src/LocalFileSystemChromium.cpp b/WebKit/chromium/src/LocalFileSystemChromium.cpp
index 7bf4335..25b1feb 100644
--- a/WebKit/chromium/src/LocalFileSystemChromium.cpp
+++ b/WebKit/chromium/src/LocalFileSystemChromium.cpp
@@ -57,7 +57,7 @@ LocalFileSystem& LocalFileSystem::localFileSystem()
     return *localFileSystem;
 }
 
-void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFileSystem::Type type, long long size, PassOwnPtr<AsyncFileSystemCallbacks> callbacks, bool synchronous)
 {
     ASSERT(context);
     if (context->isDocument()) {
@@ -68,7 +68,7 @@ void LocalFileSystem::requestFileSystem(ScriptExecutionContext* context, AsyncFi
         WorkerContext* workerContext = static_cast<WorkerContext*>(context);
         WorkerLoaderProxy* workerLoaderProxy = &workerContext->thread()->workerLoaderProxy();
         WebWorkerBase* webWorker = static_cast<WebWorkerBase*>(workerLoaderProxy);
-        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks));
+        webWorker->openFileSystem(static_cast<WebFileSystem::Type>(type), size, new WebFileSystemCallbacksImpl(callbacks, context, synchronous), synchronous);
     }
 }
 
diff --git a/WebKit/chromium/src/LocalizedStrings.cpp b/WebKit/chromium/src/LocalizedStrings.cpp
index 3354c30..fbc35ce 100644
--- a/WebKit/chromium/src/LocalizedStrings.cpp
+++ b/WebKit/chromium/src/LocalizedStrings.cpp
@@ -33,14 +33,15 @@
 
 #include "IntSize.h"
 #include "NotImplemented.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 
 #include "WebKit.h"
 #include "WebKitClient.h"
 #include "WebLocalizedString.h"
 #include "WebString.h"
 
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
+
 using WebKit::WebLocalizedString;
 
 namespace WebCore {
@@ -213,14 +214,13 @@ String keygenMenuMediumGradeKeySize()
 // Used in ImageDocument.cpp as the title for pages when that page is an image.
 String imageTitle(const String& filename, const IntSize& size)
 {
-    // Note that we cannot use String::format because it works for ASCII only.
     StringBuilder result;
     result.append(filename);
     result.append(" (");
     result.append(String::number(size.width()));
     result.append(static_cast<UChar>(0xD7));  // U+00D7 (multiplication sign)
     result.append(String::number(size.height()));
-    result.append(")");
+    result.append(')');
     return result.toString();
 }
 
diff --git a/WebKit/chromium/src/VideoFrameChromiumImpl.cpp b/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
index a60fe28..99e3e1e 100644
--- a/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
+++ b/WebKit/chromium/src/VideoFrameChromiumImpl.cpp
@@ -100,6 +100,13 @@ const void* VideoFrameChromiumImpl::data(unsigned plane) const
     return 0;
 }
 
+unsigned VideoFrameChromiumImpl::texture(unsigned plane) const
+{
+    if (m_webVideoFrame)
+        return m_webVideoFrame->texture(plane);
+    return 0;
+}
+
 const IntSize VideoFrameChromiumImpl::requiredTextureSize(unsigned plane) const
 {
     switch (format()) {
diff --git a/WebKit/chromium/src/VideoFrameChromiumImpl.h b/WebKit/chromium/src/VideoFrameChromiumImpl.h
index 042cd7e..f86ee1c 100644
--- a/WebKit/chromium/src/VideoFrameChromiumImpl.h
+++ b/WebKit/chromium/src/VideoFrameChromiumImpl.h
@@ -56,6 +56,7 @@ public:
     virtual unsigned planes() const;
     virtual int stride(unsigned plane) const;
     virtual const void* data(unsigned plane) const;
+    virtual unsigned texture(unsigned plane) const;
     virtual const IntSize requiredTextureSize(unsigned plane) const;
 
 private:
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
index 8304878..f91bd1c 100644
--- a/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.cpp
@@ -118,11 +118,6 @@ WebAccessibilityObject WebAccessibilityCacheImpl::getObjectById(int id)
     return WebAccessibilityObject(it->second->accessibilityObject());
 }
 
-bool WebAccessibilityCacheImpl::isValidId(int id) const
-{
-    return id >= firstObjectId;
-}
-
 void WebAccessibilityCacheImpl::remove(int id)
 {
     ObjectMap::iterator it = m_objectMap.find(id);
@@ -166,4 +161,17 @@ int WebAccessibilityCacheImpl::addOrGetId(const WebAccessibilityObject& object)
     return m_nextNewId++;
 }
 
+bool WebAccessibilityCacheImpl::isCached(const WebAccessibilityObject& object)
+{
+    if (!object.isValid())
+        return false;
+
+    RefPtr<AccessibilityObject> o = toAccessibilityObject(object);
+    IdMap::iterator it = m_idMap.find(o.get());
+    if (it == m_idMap.end())
+        return false;
+        
+    return true;
+}
+
 }
diff --git a/WebKit/chromium/src/WebAccessibilityCacheImpl.h b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
index 5148b74..c72c0fc 100644
--- a/WebKit/chromium/src/WebAccessibilityCacheImpl.h
+++ b/WebKit/chromium/src/WebAccessibilityCacheImpl.h
@@ -45,8 +45,8 @@ public:
     virtual bool isInitialized() const { return m_initialized; }
 
     virtual WebAccessibilityObject getObjectById(int);
-    virtual bool isValidId(int) const;
     virtual int addOrGetId(const WebKit::WebAccessibilityObject&);
+    virtual bool isCached(const WebAccessibilityObject&);
 
     virtual void remove(int);
     virtual void clear();
diff --git a/WebKit/chromium/src/WebBlobData.cpp b/WebKit/chromium/src/WebBlobData.cpp
index 4cd1d67..42018dd 100644
--- a/WebKit/chromium/src/WebBlobData.cpp
+++ b/WebKit/chromium/src/WebBlobData.cpp
@@ -32,6 +32,7 @@
 #include "WebBlobData.h"
 
 #include "BlobData.h"
+#include <wtf/PassOwnPtr.h>
 
 using namespace WebCore;
 
@@ -89,54 +90,18 @@ bool WebBlobData::itemAt(size_t index, Item& result) const
     return false;
 }
 
-void WebBlobData::appendData(const WebCString& data)
-{
-    ASSERT(!isNull());
-    m_private->appendData(data);
-}
-
-void WebBlobData::appendFile(const WebString& filePath)
-{
-    ASSERT(!isNull());
-    m_private->appendFile(filePath);
-}
-
-void WebBlobData::appendFile(const WebString& filePath, long long offset, long long length, double expectedModificationTime)
-{
-    ASSERT(!isNull());
-    m_private->appendFile(filePath, offset, length, expectedModificationTime);
-}
-
-void WebBlobData::appendBlob(const WebURL& blobURL, long long offset, long long length)
-{
-    ASSERT(!isNull());
-    m_private->appendBlob(blobURL, offset, length);
-}
-
 WebString WebBlobData::contentType() const
 {
     ASSERT(!isNull());
     return m_private->contentType();
 }
 
-void WebBlobData::setContentType(const WebString& contentType)
-{
-    ASSERT(!isNull());
-    m_private->setContentType(contentType);
-}
-
 WebString WebBlobData::contentDisposition() const
 {
     ASSERT(!isNull());
     return m_private->contentDisposition();
 }
 
-void WebBlobData::setContentDisposition(const WebString& contentDisposition)
-{
-    ASSERT(!isNull());
-    m_private->setContentDisposition(contentDisposition);
-}
-
 WebBlobData::WebBlobData(const PassOwnPtr<BlobData>& data)
     : m_private(0)
 {
diff --git a/WebKit/chromium/src/WebBlobStorageData.cpp b/WebKit/chromium/src/WebBlobStorageData.cpp
deleted file mode 100644
index 38a25fe..0000000
--- a/WebKit/chromium/src/WebBlobStorageData.cpp
+++ /dev/null
@@ -1,113 +0,0 @@
-/*
- * Copyright (C) 2010 Google Inc. All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions are
- * met:
- *
- *     * Redistributions of source code must retain the above copyright
- * notice, this list of conditions and the following disclaimer.
- *     * Redistributions in binary form must reproduce the above
- * copyright notice, this list of conditions and the following disclaimer
- * in the documentation and/or other materials provided with the
- * distribution.
- *     * Neither the name of Google Inc. nor the names of its
- * contributors may be used to endorse or promote products derived from
- * this software without specific prior written permission.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
- * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
- * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
- * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
- * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
- * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
- * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#include "config.h"
-#include "WebBlobStorageData.h"
-
-#include "BlobStorageData.h"
-
-using namespace WebCore;
-
-namespace WebKit {
-
-class WebBlobStorageDataPrivate : public BlobStorageData {
-};
-
-void WebBlobStorageData::reset()
-{
-    assign(0);
-}
-
-size_t WebBlobStorageData::itemCount() const
-{
-    ASSERT(!isNull());
-    return m_private->items().size();
-}
-
-bool WebBlobStorageData::itemAt(size_t index, WebBlobData::Item& result) const
-{
-    ASSERT(!isNull());
-
-    if (index >= m_private->items().size())
-        return false;
-
-    const BlobDataItem& item = m_private->items()[index];
-    result.offset = item.offset;
-    result.length = item.length;
-    result.expectedModificationTime = item.expectedModificationTime;
-    if (item.type == BlobDataItem::Data) {
-        result.type = WebBlobData::Item::TypeData;
-        result.data.assign(item.data.data(), static_cast<size_t>(item.data.length()));
-        return true;
-    } else {
-        ASSERT(item.type == BlobDataItem::File);
-        result.type = WebBlobData::Item::TypeFile;
-        result.filePath = item.path;
-        return true;
-    }
-}
-
-WebString WebBlobStorageData::contentType() const
-{
-    ASSERT(!isNull());
-    return m_private->contentType();
-}
-
-WebString WebBlobStorageData::contentDisposition() const
-{
-    ASSERT(!isNull());
-    return m_private->contentDisposition();
-}
-
-WebBlobStorageData::WebBlobStorageData(const PassRefPtr<BlobStorageData>& data)
-    : m_private(0)
-{
-    assign(data);
-}
-
-WebBlobStorageData& WebBlobStorageData::operator=(const PassRefPtr<BlobStorageData>& data)
-{
-    assign(data);
-    return *this;
-}
-
-WebBlobStorageData::operator PassRefPtr<BlobStorageData>() const
-{
-    return m_private;
-}
-
-void WebBlobStorageData::assign(const PassRefPtr<BlobStorageData>& data)
-{
-    if (m_private)
-        m_private->deref();
-    m_private = static_cast<WebBlobStorageDataPrivate*>(data.leakRef());
-}
-
-} // namespace WebKit
diff --git a/WebKit/chromium/src/WebCache.cpp b/WebKit/chromium/src/WebCache.cpp
index 9d03a4d..c124bdf 100644
--- a/WebKit/chromium/src/WebCache.cpp
+++ b/WebKit/chromium/src/WebCache.cpp
@@ -67,15 +67,8 @@ void WebCache::clear()
 {
     Cache* cache = WebCore::cache();
     if (cache && !cache->disabled()) {
-        // NOTE: I think using setDisabled() instead of setCapacities() will
-        // remove from the cache items that won't actually be freed from memory
-        // (due to other live references to them), so it just results in wasting
-        // time later and not saving memory compared to the below technique.
-        unsigned minDeadCapacity = cache->m_minDeadCapacity;
-        unsigned maxDeadCapacity = cache->m_maxDeadCapacity;
-        unsigned capacity = cache->m_capacity;
-        cache->setCapacities(0, 0, 0);  // Will prune the cache.
-        cache->setCapacities(minDeadCapacity, maxDeadCapacity, capacity);
+        cache->setDisabled(true);
+        cache->setDisabled(false);
     }
 }
 
diff --git a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
index c7bb050..9b7b2bd 100644
--- a/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
+++ b/WebKit/chromium/src/WebDevToolsAgentImpl.cpp
@@ -317,8 +317,11 @@ void WebDevToolsAgentImpl::identifierForInitialRequest(
 
 void WebDevToolsAgentImpl::willSendRequest(unsigned long resourceId, WebURLRequest& request)
 {
-    if (InspectorController* ic = inspectorController())
+    if (InspectorController* ic = inspectorController()) {
         ic->willSendRequest(resourceId, request.toMutableResourceRequest(), ResourceResponse());
+        if (ic->hasFrontend() && request.reportLoadTiming())
+            request.setReportRawHeaders(true);
+    }
 }
 
 void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
@@ -330,7 +333,7 @@ void WebDevToolsAgentImpl::didReceiveData(unsigned long resourceId, int length)
 void WebDevToolsAgentImpl::didReceiveResponse(unsigned long resourceId, const WebURLResponse& response)
 {
     if (InspectorController* ic = inspectorController())
-        ic->didReceiveResponse(resourceId, response.toResourceResponse());
+        ic->didReceiveResponse(resourceId, 0, response.toResourceResponse());
 }
 
 void WebDevToolsAgentImpl::didFinishLoading(unsigned long resourceId)
diff --git a/WebKit/chromium/src/WebDragData.cpp b/WebKit/chromium/src/WebDragData.cpp
index 643c35d..9167c69 100644
--- a/WebKit/chromium/src/WebDragData.cpp
+++ b/WebKit/chromium/src/WebDragData.cpp
@@ -32,6 +32,8 @@
 #include "WebDragData.h"
 
 #include "ChromiumDataObject.h"
+#include "ChromiumDataObjectLegacy.h"
+#include "ClipboardMimeTypes.h"
 #include "WebData.h"
 #include "WebString.h"
 #include "WebURL.h"
@@ -48,7 +50,7 @@ class WebDragDataPrivate : public ChromiumDataObject {
 
 void WebDragData::initialize()
 {
-    assign(static_cast<WebDragDataPrivate*>(ChromiumDataObject::create().releaseRef()));
+    assign(static_cast<WebDragDataPrivate*>(ChromiumDataObject::create(ChromiumDataObjectLegacy::create(Clipboard::DragAndDrop)).releaseRef()));
 }
 
 void WebDragData::reset()
@@ -64,137 +66,144 @@ void WebDragData::assign(const WebDragData& other)
     assign(p);
 }
 
-WebURL WebDragData::url() const
+WebString WebDragData::url() const
 {
     ASSERT(!isNull());
-    return m_private->getURL();
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeURL, ignoredSuccess);
 }
 
 void WebDragData::setURL(const WebURL& url)
 {
     ensureMutable();
-    m_private->setURL(url);
+    m_private->setData(mimeTypeURL, KURL(url).string());
 }
 
 WebString WebDragData::urlTitle() const
 {
     ASSERT(!isNull());
-    return m_private->urlTitle;
+    return m_private->urlTitle();
 }
 
 void WebDragData::setURLTitle(const WebString& urlTitle)
 {
     ensureMutable();
-    m_private->urlTitle = urlTitle;
+    m_private->setUrlTitle(urlTitle);
 }
 
 WebString WebDragData::downloadMetadata() const
 {
     ASSERT(!isNull());
-    return m_private->downloadMetadata;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeDownloadURL, ignoredSuccess);
 }
 
 void WebDragData::setDownloadMetadata(const WebString& downloadMetadata)
 {
     ensureMutable();
-    m_private->downloadMetadata = downloadMetadata;
+    m_private->setData(mimeTypeDownloadURL, downloadMetadata);
 }
 
 WebString WebDragData::fileExtension() const
 {
     ASSERT(!isNull());
-    return m_private->fileExtension;
+    return m_private->fileExtension();
 }
 
 void WebDragData::setFileExtension(const WebString& fileExtension)
 {
     ensureMutable();
-    m_private->fileExtension = fileExtension;
+    m_private->setFileExtension(fileExtension);
 }
 
-bool WebDragData::hasFileNames() const
+bool WebDragData::containsFilenames() const
 {
     ASSERT(!isNull());
-    return !m_private->filenames.isEmpty();
+    return m_private->containsFilenames();
 }
 
-void WebDragData::fileNames(WebVector<WebString>& fileNames) const
+void WebDragData::filenames(WebVector<WebString>& filenames) const
 {
     ASSERT(!isNull());
-    fileNames = m_private->filenames;
+    filenames = m_private->filenames();
 }
 
-void WebDragData::setFileNames(const WebVector<WebString>& fileNames)
+void WebDragData::setFilenames(const WebVector<WebString>& filenames)
 {
     ensureMutable();
-    m_private->filenames.clear();
-    m_private->filenames.append(fileNames.data(), fileNames.size());
+    Vector<String> filenamesCopy;
+    filenamesCopy.append(filenames.data(), filenames.size());
+    m_private->setFilenames(filenamesCopy);
 }
 
-void WebDragData::appendToFileNames(const WebString& fileName)
+void WebDragData::appendToFilenames(const WebString& filename)
 {
     ensureMutable();
-    m_private->filenames.append(fileName);
+    Vector<String> filenames = m_private->filenames();
+    filenames.append(filename);
+    m_private->setFilenames(filenames);
 }
 
 WebString WebDragData::plainText() const
 {
     ASSERT(!isNull());
-    return m_private->plainText;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeTextPlain, ignoredSuccess);
 }
 
 void WebDragData::setPlainText(const WebString& plainText)
 {
     ensureMutable();
-    m_private->plainText = plainText;
+    m_private->setData(mimeTypeTextPlain, plainText);
 }
 
 WebString WebDragData::htmlText() const
 {
     ASSERT(!isNull());
-    return m_private->textHtml;
+    bool ignoredSuccess;
+    return m_private->getData(mimeTypeTextHTML, ignoredSuccess);
 }
 
 void WebDragData::setHTMLText(const WebString& htmlText)
 {
     ensureMutable();
-    m_private->textHtml = htmlText;
+    m_private->setData(mimeTypeTextHTML, htmlText);
 }
 
 WebURL WebDragData::htmlBaseURL() const
 {
     ASSERT(!isNull());
-    return m_private->htmlBaseUrl;
+    return m_private->htmlBaseUrl();
 }
 
 void WebDragData::setHTMLBaseURL(const WebURL& htmlBaseURL)
 {
     ensureMutable();
-    m_private->htmlBaseUrl = htmlBaseURL;
+    m_private->setHtmlBaseUrl(htmlBaseURL);
 }
 
-WebString WebDragData::fileContentFileName() const
+WebString WebDragData::fileContentFilename() const
 {
     ASSERT(!isNull());
-    return m_private->fileContentFilename;
+    return m_private->fileContentFilename();
 }
 
-void WebDragData::setFileContentFileName(const WebString& fileName)
+void WebDragData::setFileContentFilename(const WebString& filename)
 {
     ensureMutable();
-    m_private->fileContentFilename = fileName;
+    m_private->setFileContentFilename(filename);
 }
 
 WebData WebDragData::fileContent() const
 {
     ASSERT(!isNull());
-    return WebData(m_private->fileContent);
+    return WebData(m_private->fileContent());
 }
 
 void WebDragData::setFileContent(const WebData& fileContent)
 {
     ensureMutable();
-    m_private->fileContent = fileContent;
+    m_private->setFileContent(fileContent);
 }
 
 WebDragData::WebDragData(const WTF::PassRefPtr<WebCore::ChromiumDataObject>& data)
@@ -224,8 +233,7 @@ void WebDragData::assign(WebDragDataPrivate* p)
 void WebDragData::ensureMutable()
 {
     ASSERT(!isNull());
-    if (!m_private->hasOneRef())
-        assign(static_cast<WebDragDataPrivate*>(m_private->copy().releaseRef()));
+    ASSERT(m_private->hasOneRef());
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebElement.cpp b/WebKit/chromium/src/WebElement.cpp
index 91f310d..34daa34 100644
--- a/WebKit/chromium/src/WebElement.cpp
+++ b/WebKit/chromium/src/WebElement.cpp
@@ -47,6 +47,11 @@ bool WebElement::isFormControlElement() const
     return constUnwrap<Element>()->isFormControlElement();
 }
 
+bool WebElement::isTextFormControlElement() const
+{
+    return constUnwrap<Element>()->isTextFormControl();
+}
+
 WebString WebElement::tagName() const
 {
     return constUnwrap<Element>()->tagName();
diff --git a/WebKit/chromium/src/WebEntities.cpp b/WebKit/chromium/src/WebEntities.cpp
index bfdd9f2..4e37dde 100644
--- a/WebKit/chromium/src/WebEntities.cpp
+++ b/WebKit/chromium/src/WebEntities.cpp
@@ -31,15 +31,12 @@
 #include "config.h"
 #include "WebEntities.h"
 
-#include <string.h>
-
-#include "PlatformString.h"
-#include "StringBuilder.h"
-#include <wtf/HashMap.h>
-
 #include "WebString.h"
 
-using namespace WebCore;
+#include <string.h>
+#include <wtf/HashMap.h>
+#include <wtf/text/StringBuilder.h>
+#include <wtf/text/WTFString.h>
 
 namespace WebKit {
 
@@ -76,9 +73,9 @@ String WebEntities::convertEntitiesInString(const String& value) const
             // Append content before entity code.
             if (curPos > startPos)
                 result.append(String(startPos, curPos - startPos));
-            result.append("&");
+            result.append('&');
             result.append(m_entitiesMap.get(*curPos));
-            result.append(";");
+            result.append(';');
             startPos = ++curPos;
         } else
             curPos++;
diff --git a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
index a23add7..f44e8f1 100644
--- a/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebFileSystemCallbacksImpl.cpp
@@ -34,19 +34,23 @@
 
 #include "AsyncFileSystemCallbacks.h"
 #include "AsyncFileSystemChromium.h"
-#include "ExceptionCode.h"
+#include "ScriptExecutionContext.h"
 #include "WebFileSystemEntry.h"
 #include "WebFileInfo.h"
 #include "WebString.h"
+#include "WorkerAsyncFileSystemChromium.h"
 #include <wtf/Vector.h>
 
 using namespace WebCore;
 
 namespace WebKit {
 
-WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+WebFileSystemCallbacksImpl::WebFileSystemCallbacksImpl(PassOwnPtr<AsyncFileSystemCallbacks> callbacks, WebCore::ScriptExecutionContext* context, bool synchronous)
     : m_callbacks(callbacks)
+    , m_context(context)
+    , m_synchronous(synchronous)
 {
+    ASSERT(m_callbacks);
 }
 
 WebFileSystemCallbacksImpl::~WebFileSystemCallbacksImpl()
@@ -55,37 +59,35 @@ WebFileSystemCallbacksImpl::~WebFileSystemCallbacksImpl()
 
 void WebFileSystemCallbacksImpl::didSucceed()
 {
-    ASSERT(m_callbacks);
     m_callbacks->didSucceed();
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didReadMetadata(const WebFileInfo& info)
 {
-    ASSERT(m_callbacks);
     m_callbacks->didReadMetadata(info.modificationTime);
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didReadDirectory(const WebVector<WebFileSystemEntry>& entries, bool hasMore)
 {
-    ASSERT(m_callbacks);
     for (size_t i = 0; i < entries.size(); ++i)
         m_callbacks->didReadDirectoryEntry(entries[i].name, entries[i].isDirectory);
     m_callbacks->didReadDirectoryEntries(hasMore);
-    if (!hasMore)
-        delete this;
+    delete this;
 }
 
 void WebFileSystemCallbacksImpl::didOpenFileSystem(const WebString& name, const WebString& path)
 {
-    m_callbacks->didOpenFileSystem(name, new AsyncFileSystemChromium(path));
+    if (m_context && m_context->isWorkerContext())
+        m_callbacks->didOpenFileSystem(name, WorkerAsyncFileSystemChromium::create(m_context, path, m_synchronous));
+    else
+        m_callbacks->didOpenFileSystem(name, AsyncFileSystemChromium::create(path));
     delete this;
 }
 
 void WebFileSystemCallbacksImpl::didFail(WebFileError error)
 {
-    ASSERT(m_callbacks);
     m_callbacks->didFail(error);
     delete this;
 }
diff --git a/WebKit/chromium/src/WebFileSystemCallbacksImpl.h b/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
index 36ab9ff..75fa2bb 100644
--- a/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
+++ b/WebKit/chromium/src/WebFileSystemCallbacksImpl.h
@@ -38,6 +38,7 @@
 
 namespace WebCore {
 class AsyncFileSystemCallbacks;
+class ScriptExecutionContext;
 }
 
 namespace WebKit {
@@ -48,7 +49,7 @@ class WebString;
 
 class WebFileSystemCallbacksImpl : public WebFileSystemCallbacks {
 public:
-    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>);
+    WebFileSystemCallbacksImpl(PassOwnPtr<WebCore::AsyncFileSystemCallbacks>, WebCore::ScriptExecutionContext* = 0, bool synchronous = false);
     virtual ~WebFileSystemCallbacksImpl();
 
     virtual void didSucceed();
@@ -59,6 +60,10 @@ public:
 
 private:
     OwnPtr<WebCore::AsyncFileSystemCallbacks> m_callbacks;
+
+    // Used for worker's openFileSystem callbacks.
+    WebCore::ScriptExecutionContext* m_context;
+    bool m_synchronous;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebFontImpl.cpp b/WebKit/chromium/src/WebFontImpl.cpp
index 6fa5494..8c61997 100644
--- a/WebKit/chromium/src/WebFontImpl.cpp
+++ b/WebKit/chromium/src/WebFontImpl.cpp
@@ -103,9 +103,11 @@ void WebFontImpl::drawText(WebCanvas* canvas, const WebTextRun& run, const WebFl
     notImplemented();
 #endif
 
-    gc.setFillColor(color, DeviceColorSpace);
+    gc.save();
+    gc.setFillColor(color, ColorSpaceDeviceRGB);
     gc.clip(WebCore::FloatRect(clip));
     m_font.drawText(&gc, run, leftBaseline, from, to);
+    gc.restore();
 }
 
 int WebFontImpl::calculateWidth(const WebTextRun& run) const
diff --git a/WebKit/chromium/src/WebFrameImpl.cpp b/WebKit/chromium/src/WebFrameImpl.cpp
index 1b64e5a..b4d23c0 100644
--- a/WebKit/chromium/src/WebFrameImpl.cpp
+++ b/WebKit/chromium/src/WebFrameImpl.cpp
@@ -261,6 +261,12 @@ static void frameContentAsPlainText(size_t maxChars, Frame* frame,
     }
 }
 
+static long long generateFrameIdentifier()
+{
+    static long long next = 0;
+    return ++next;
+}
+
 WebPluginContainerImpl* WebFrameImpl::pluginContainerFromFrame(Frame* frame)
 {
     if (!frame)
@@ -488,6 +494,11 @@ void WebFrameImpl::setName(const WebString& name)
     m_frame->tree()->setName(name);
 }
 
+long long WebFrameImpl::identifier() const
+{
+    return m_identifier;
+}
+
 WebURL WebFrameImpl::url() const
 {
     const WebDataSource* ds = dataSource();
@@ -1759,6 +1770,13 @@ bool WebFrameImpl::pauseSVGAnimation(const WebString& animationId, double time,
 #endif
 }
 
+WebString WebFrameImpl::layerTreeAsText() const
+{
+    if (!m_frame)
+        return WebString();
+    return WebString(m_frame->layerTreeAsText());
+}
+
 // WebFrameImpl public ---------------------------------------------------------
 
 PassRefPtr<WebFrameImpl> WebFrameImpl::create(WebFrameClient* client)
@@ -1779,6 +1797,7 @@ WebFrameImpl::WebFrameImpl(WebFrameClient* client)
     , m_scopingComplete(false)
     , m_nextInvalidateAfter(0)
     , m_animationController(this)
+    , m_identifier(generateFrameIdentifier())
 {
     ChromiumBridge::incrementStatsCounter(webFrameActiveCount);
     frameCount++;
@@ -1869,7 +1888,7 @@ void WebFrameImpl::paintWithContext(GraphicsContext& gc, const WebRect& rect)
         frameView()->paint(&gc, dirtyRect);
         m_frame->page()->inspectorController()->drawNodeHighlight(gc);
     } else
-        gc.fillRect(dirtyRect, Color::white, DeviceColorSpace);
+        gc.fillRect(dirtyRect, Color::white, ColorSpaceDeviceRGB);
     gc.restore();
 }
 
@@ -2242,7 +2261,7 @@ void WebFrameImpl::loadJavaScriptURL(const KURL& url)
     if (!result.getString(scriptResult))
         return;
 
-    if (!m_frame->redirectScheduler()->locationChangePending())
+    if (!m_frame->navigationScheduler()->locationChangePending())
         m_frame->loader()->writer()->replaceDocument(scriptResult);
 }
 
diff --git a/WebKit/chromium/src/WebFrameImpl.h b/WebKit/chromium/src/WebFrameImpl.h
index d93254b..35158a1 100644
--- a/WebKit/chromium/src/WebFrameImpl.h
+++ b/WebKit/chromium/src/WebFrameImpl.h
@@ -67,6 +67,7 @@ public:
     // WebFrame methods:
     virtual WebString name() const;
     virtual void setName(const WebString&);
+    virtual long long identifier() const;
     virtual WebURL url() const;
     virtual WebURL favIconURL() const;
     virtual WebURL openSearchDescriptionURL() const;
@@ -189,6 +190,7 @@ public:
     virtual bool pauseSVGAnimation(const WebString& animationId,
                                    double time,
                                    const WebString& elementId);
+    virtual WebString layerTreeAsText() const;
 
     static PassRefPtr<WebFrameImpl> create(WebFrameClient* client);
     ~WebFrameImpl();
@@ -386,6 +388,9 @@ private:
 
     // Keeps a reference to the frame's WebAnimationController.
     WebAnimationControllerImpl m_animationController;
+
+    // The identifier of this frame.
+    long long m_identifier;
 };
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebGeolocationServiceMock.cpp b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
index e149cf1..07d3f44 100644
--- a/WebKit/chromium/src/WebGeolocationServiceMock.cpp
+++ b/WebKit/chromium/src/WebGeolocationServiceMock.cpp
@@ -42,6 +42,38 @@
 
 #if ENABLE(GEOLOCATION)
 
+#if ENABLE(CLIENT_BASED_GEOLOCATION)
+// FIXME: Implement mock bindings for client-based geolocation. Ultimately
+// move to another class and remove WebGeolocationService*.
+
+namespace WebKit {
+
+class WebGeolocationServiceMockClientBasedImpl : public WebGeolocationServiceMock {
+};
+
+WebGeolocationServiceMock* WebGeolocationServiceMock::createWebGeolocationServiceMock()
+{
+    return new WebGeolocationServiceMockClientBasedImpl;
+}
+
+void WebGeolocationServiceMock::setMockGeolocationPermission(bool allowed)
+{
+    // FIXME: Implement mock binding
+}
+
+void WebGeolocationServiceMock::setMockGeolocationPosition(double latitude, double longitude, double accuracy)
+{
+    // FIXME: Implement mock binding
+}
+
+void WebGeolocationServiceMock::setMockGeolocationError(int errorCode, const WebString& message)
+{
+    // FIXME: Implement mock binding
+}
+
+} // namespace WebKit
+
+#else
 using WebCore::Coordinates;
 using WebCore::Frame;
 using WebCore::Geolocation;
@@ -241,4 +273,5 @@ void WebGeolocationServiceMockImpl::notifyPendingPermissions()
 
 } // namespace WebKit
 
+#endif // ENABLE(CLIENT_BASED_GEOLOCATION)
 #endif // ENABLE(GEOLOCATION)
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
index 45bc2ee..1625eb8 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.cpp
@@ -37,6 +37,8 @@
 #include "app/gfx/gl/gl_bindings.h"
 #include "app/gfx/gl/gl_context.h"
 #include "NotImplemented.h"
+#include "WebView.h"
+#include <wtf/OwnArrayPtr.h>
 #include <wtf/PassOwnPtr.h>
 #include <wtf/text/CString.h>
 
@@ -67,6 +69,7 @@ WebGraphicsContext3DDefaultImpl::VertexAttribPointerState::VertexAttribPointerSt
 
 WebGraphicsContext3DDefaultImpl::WebGraphicsContext3DDefaultImpl()
     : m_initialized(false)
+    , m_renderDirectlyToWebView(false)
     , m_texture(0)
     , m_fbo(0)
     , m_depthStencilBuffer(0)
@@ -106,25 +109,59 @@ WebGraphicsContext3DDefaultImpl::~WebGraphicsContext3DDefaultImpl()
 
         m_glContext->Destroy();
 
+        for (ShaderSourceMap::iterator ii = m_shaderSourceMap.begin(); ii != m_shaderSourceMap.end(); ++ii) {
+            if (ii->second)
+                delete ii->second;
+        }
         angleDestroyCompilers();
     }
 }
 
 bool WebGraphicsContext3DDefaultImpl::initialize(WebGraphicsContext3D::Attributes attributes, WebView* webView, bool renderDirectlyToWebView)
 {
-    if (renderDirectlyToWebView) {
-        // This mode isn't supported with the in-process implementation yet. (FIXME)
-        return false;
-    }
-
     if (!gfx::GLContext::InitializeOneOff())
         return false;
 
-    m_glContext = WTF::adoptPtr(gfx::GLContext::CreateOffscreenGLContext(0));
+    m_renderDirectlyToWebView = renderDirectlyToWebView;
+    gfx::GLContext* shareContext = 0;
+
+    if (!renderDirectlyToWebView) {
+        // Pick up the compositor's context to share resources with.
+        WebGraphicsContext3D* viewContext = webView->graphicsContext3D();
+        if (viewContext) {
+            WebGraphicsContext3DDefaultImpl* contextImpl = static_cast<WebGraphicsContext3DDefaultImpl*>(viewContext);
+            shareContext = contextImpl->m_glContext.get();
+        } else {
+            // The compositor's context didn't get created
+            // successfully, so conceptually there is no way we can
+            // render successfully to the WebView.
+            m_renderDirectlyToWebView = false;
+        }
+    }
+
+    // This implementation always renders offscreen regardless of
+    // whether renderDirectlyToWebView is true. Both DumpRenderTree
+    // and test_shell paint first to an intermediate offscreen buffer
+    // and from there to the window, and WebViewImpl::paint already
+    // correctly handles the case where the compositor is active but
+    // the output needs to go to a WebCanvas.
+    m_glContext = WTF::adoptPtr(gfx::GLContext::CreateOffscreenGLContext(shareContext));
     if (!m_glContext)
         return false;
 
     m_attributes = attributes;
+
+    // FIXME: for the moment we disable multisampling for the compositor.
+    // It actually works in this implementation, but there are a few
+    // considerations. First, we likely want to reduce the fuzziness in
+    // these tests as much as possible because we want to run pixel tests.
+    // Second, Mesa's multisampling doesn't seem to antialias straight
+    // edges in some CSS 3D samples. Third, we don't have multisampling
+    // support for the compositor in the normal case at the time of this
+    // writing.
+    if (renderDirectlyToWebView)
+        m_attributes.antialias = false;
+
     validateAttributes();
 
     glEnable(GL_VERTEX_PROGRAM_POINT_SIZE);
@@ -159,12 +196,30 @@ void WebGraphicsContext3DDefaultImpl::validateAttributes()
 #endif
         if (!isValidVendor || !strstr(extensions, "GL_EXT_framebuffer_multisample"))
             m_attributes.antialias = false;
+
+        // Don't antialias when using Mesa to ensure more reliable testing and
+        // because it doesn't appear to multisample straight lines correctly.
+        const char* renderer = reinterpret_cast<const char*>(glGetString(GL_RENDERER));
+        if (!strncmp(renderer, "Mesa", 4))
+            m_attributes.antialias = false;
     }
     // FIXME: instead of enforcing premultipliedAlpha = true, implement the
     // correct behavior when premultipliedAlpha = false is requested.
     m_attributes.premultipliedAlpha = true;
 }
 
+void WebGraphicsContext3DDefaultImpl::resolveMultisampledFramebuffer(unsigned x, unsigned y, unsigned width, unsigned height)
+{
+    if (m_attributes.antialias) {
+        bool mustRestoreFBO = (m_boundFBO != m_multisampleFBO);
+        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
+        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
+        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+        if (mustRestoreFBO)
+            glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+    }
+}
+
 bool WebGraphicsContext3DDefaultImpl::makeContextCurrent()
 {
     return m_glContext->MakeCurrent();
@@ -218,13 +273,15 @@ bool WebGraphicsContext3DDefaultImpl::isErrorGeneratedOnOutOfBoundsAccesses()
 
 unsigned int WebGraphicsContext3DDefaultImpl::getPlatformTextureId()
 {
-    ASSERT_NOT_REACHED();
-    return 0;
+    return m_texture;
 }
 
 void WebGraphicsContext3DDefaultImpl::prepareTexture()
 {
-    ASSERT_NOT_REACHED();
+    if (!m_renderDirectlyToWebView) {
+        // We need to prepare our rendering results for the compositor.
+        resolveMultisampledFramebuffer(0, 0, m_cachedWidth, m_cachedHeight);
+    }
 }
 
 static int createTextureObject(GLenum target)
@@ -434,19 +491,8 @@ bool WebGraphicsContext3DDefaultImpl::readBackFramebuffer(unsigned char* pixels,
     // vertical flip is only a temporary solution anyway until Chrome
     // is fully GPU composited, it wasn't worth the complexity.
 
-    bool mustRestoreFBO = false;
-    if (m_attributes.antialias) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(0, 0, m_cachedWidth, m_cachedHeight, 0, 0, m_cachedWidth, m_cachedHeight, GL_COLOR_BUFFER_BIT, GL_LINEAR);
-        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-        mustRestoreFBO = true;
-    } else {
-        if (m_boundFBO != m_fbo) {
-            mustRestoreFBO = true;
-            glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
-        }
-    }
+    resolveMultisampledFramebuffer(0, 0, m_cachedWidth, m_cachedHeight);
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
 
     GLint packAlignment = 4;
     bool mustRestorePackAlignment = false;
@@ -463,8 +509,7 @@ bool WebGraphicsContext3DDefaultImpl::readBackFramebuffer(unsigned char* pixels,
     if (mustRestorePackAlignment)
         glPixelStorei(GL_PACK_ALIGNMENT, packAlignment);
 
-    if (mustRestoreFBO)
-        glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
+    glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 
 #ifdef FLIP_FRAMEBUFFER_VERTICALLY
     if (pixels)
@@ -682,13 +727,14 @@ void WebGraphicsContext3DDefaultImpl::compileShader(WebGLId shader)
         glCompileShader(shader);
         return;
     }
-    ShaderSourceEntry& entry = result->second;
+    ShaderSourceEntry* entry = result->second;
+    ASSERT(entry);
 
-    if (!angleValidateShaderSource(entry))
+    if (!angleValidateShaderSource(*entry))
         return; // Shader didn't validate, don't move forward with compiling translated source
 
-    int shaderLength = entry.translatedSource ? strlen(entry.translatedSource) : 0;
-    glShaderSource(shader, 1, const_cast<const char**>(&entry.translatedSource), &shaderLength);
+    int shaderLength = entry->translatedSource ? strlen(entry->translatedSource) : 0;
+    glShaderSource(shader, 1, const_cast<const char**>(&entry->translatedSource), &shaderLength);
     glCompileShader(shader);
 
 #ifndef NDEBUG
@@ -704,16 +750,15 @@ void WebGraphicsContext3DDefaultImpl::copyTexImage2D(unsigned long target, long
 {
     makeContextCurrent();
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
 
     glCopyTexImage2D(target, level, internalformat, x, y, width, height, border);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -722,16 +767,15 @@ void WebGraphicsContext3DDefaultImpl::copyTexSubImage2D(unsigned long target, lo
 {
     makeContextCurrent();
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
     }
 
     glCopyTexSubImage2D(target, level, xoffset, yoffset, x, y, width, height);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -962,24 +1006,25 @@ void WebGraphicsContext3DDefaultImpl::getShaderiv(WebGLId shader, unsigned long
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
         switch (pname) {
         case GL_COMPILE_STATUS:
-            if (!entry.isValid) {
+            if (!entry->isValid) {
                 *value = 0;
                 return;
             }
             break;
         case GL_INFO_LOG_LENGTH:
-            if (!entry.isValid) {
-                *value = entry.log ? strlen(entry.log) : 0;
+            if (!entry->isValid) {
+                *value = entry->log ? strlen(entry->log) : 0;
                 if (*value)
                     (*value)++;
                 return;
             }
             break;
         case GL_SHADER_SOURCE_LENGTH:
-            *value = entry.source ? strlen(entry.source) : 0;
+            *value = entry->source ? strlen(entry->source) : 0;
             if (*value)
                 (*value)++;
             return;
@@ -995,11 +1040,12 @@ WebString WebGraphicsContext3DDefaultImpl::getShaderInfoLog(WebGLId shader)
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (!entry.isValid) {
-            if (!entry.log)
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (!entry->isValid) {
+            if (!entry->log)
                 return WebString();
-            WebString res = WebString::fromUTF8(entry.log, strlen(entry.log));
+            WebString res = WebString::fromUTF8(entry->log, strlen(entry->log));
             return res;
         }
     }
@@ -1025,10 +1071,11 @@ WebString WebGraphicsContext3DDefaultImpl::getShaderSource(WebGLId shader)
 
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (!entry.source)
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (!entry->source)
             return WebString();
-        WebString res = WebString::fromUTF8(entry.source, strlen(entry.source));
+        WebString res = WebString::fromUTF8(entry->source, strlen(entry->source));
         return res;
     }
 
@@ -1105,17 +1152,16 @@ void WebGraphicsContext3DDefaultImpl::readPixels(long x, long y, unsigned long w
     // FIXME: remove the two glFlush calls when the driver bug is fixed, i.e.,
     // all previous rendering calls should be done before reading pixels.
     glFlush();
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO) {
-        glBindFramebufferEXT(GL_READ_FRAMEBUFFER_EXT, m_multisampleFBO);
-        glBindFramebufferEXT(GL_DRAW_FRAMEBUFFER_EXT, m_fbo);
-        glBlitFramebufferEXT(x, y, x + width, y + height, x, y, x + width, y + height, GL_COLOR_BUFFER_BIT, GL_LINEAR);
+    bool needsResolve = (m_attributes.antialias && m_boundFBO == m_multisampleFBO);
+    if (needsResolve) {
+        resolveMultisampledFramebuffer(x, y, width, height);
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_fbo);
         glFlush();
     }
 
     glReadPixels(x, y, width, height, format, type, pixels);
 
-    if (m_attributes.antialias && m_boundFBO == m_multisampleFBO)
+    if (needsResolve)
         glBindFramebufferEXT(GL_FRAMEBUFFER_EXT, m_boundFBO);
 }
 
@@ -1151,20 +1197,86 @@ DELEGATE_TO_GL_2(sampleCoverage, SampleCoverage, double, bool)
 
 DELEGATE_TO_GL_4(scissor, Scissor, long, long, unsigned long, unsigned long)
 
+unsigned bytesPerComponent(unsigned type)
+{
+    switch (type) {
+    case GL_BYTE:
+    case GL_UNSIGNED_BYTE:
+        return 1;
+    case GL_SHORT:
+    case GL_UNSIGNED_SHORT:
+    case GL_UNSIGNED_SHORT_5_6_5:
+    case GL_UNSIGNED_SHORT_4_4_4_4:
+    case GL_UNSIGNED_SHORT_5_5_5_1:
+        return 2;
+    case GL_FLOAT:
+        return 4;
+    default:
+        return 4;
+    }
+}
+
+unsigned componentsPerPixel(unsigned format, unsigned type)
+{
+    switch (type) {
+    case GL_UNSIGNED_SHORT_5_6_5:
+    case GL_UNSIGNED_SHORT_4_4_4_4:
+    case GL_UNSIGNED_SHORT_5_5_5_1:
+        return 1;
+    default:
+        break;
+    }
+    switch (format) {
+    case GL_LUMINANCE:
+        return 1;
+    case GL_LUMINANCE_ALPHA:
+        return 2;
+    case GL_RGB:
+        return 3;
+    case GL_RGBA:
+    case GL_BGRA_EXT:
+        return 4;
+    default:
+        return 4;
+    }
+}
+
+// N.B.:  This code does not protect against integer overflow (as the command
+// buffer implementation does), so it should not be considered robust enough
+// for use in the browser.  Since this implementation is only used for layout
+// tests, this should be ok for now.
+size_t imageSizeInBytes(unsigned width, unsigned height, unsigned format, unsigned type)
+{
+    return width * height * bytesPerComponent(type) * componentsPerPixel(format, type);
+}
+
+void WebGraphicsContext3DDefaultImpl::texImage2D(unsigned target, unsigned level, unsigned internalFormat, unsigned width, unsigned height, unsigned border, unsigned format, unsigned type, const void* pixels)
+{
+    OwnArrayPtr<uint8> zero;
+    if (!pixels) {
+        size_t size = imageSizeInBytes(width, height, format, type);
+        zero.set(new uint8[size]);
+        memset(zero.get(), 0, size);
+        pixels = zero.get();
+    }
+    glTexImage2D(target, level, internalFormat, width, height, border, format, type, pixels);
+}
+
 void WebGraphicsContext3DDefaultImpl::shaderSource(WebGLId shader, const char* string)
 {
     makeContextCurrent();
     GLint length = string ? strlen(string) : 0;
     ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
     if (result != m_shaderSourceMap.end()) {
-        ShaderSourceEntry& entry = result->second;
-        if (entry.source) {
-            fastFree(entry.source);
-            entry.source = 0;
+        ShaderSourceEntry* entry = result->second;
+        ASSERT(entry);
+        if (entry->source) {
+            fastFree(entry->source);
+            entry->source = 0;
         }
-        if (!tryFastMalloc((length + 1) * sizeof(char)).getValue(entry.source))
+        if (!tryFastMalloc((length + 1) * sizeof(char)).getValue(entry->source))
             return; // FIXME: generate an error?
-        memcpy(entry.source, string, (length + 1) * sizeof(char));
+        memcpy(entry->source, string, (length + 1) * sizeof(char));
     } else
         glShaderSource(shader, 1, &string, &length);
 }
@@ -1181,8 +1293,6 @@ DELEGATE_TO_GL_3(stencilOp, StencilOp, unsigned long, unsigned long, unsigned lo
 
 DELEGATE_TO_GL_4(stencilOpSeparate, StencilOpSeparate, unsigned long, unsigned long, unsigned long, unsigned long)
 
-DELEGATE_TO_GL_9(texImage2D, TexImage2D, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, unsigned, const void*)
-
 DELEGATE_TO_GL_3(texParameterf, TexParameterf, unsigned, unsigned, float);
 
 DELEGATE_TO_GL_3(texParameteri, TexParameteri, unsigned, unsigned, int);
@@ -1311,10 +1421,12 @@ unsigned WebGraphicsContext3DDefaultImpl::createShader(unsigned long shaderType)
     ASSERT(shaderType == GL_VERTEX_SHADER || shaderType == GL_FRAGMENT_SHADER);
     unsigned shader = glCreateShader(shaderType);
     if (shader) {
-        ShaderSourceEntry entry;
-        entry.type = shaderType;
-        m_shaderSourceMap.set(shader, entry);
+        ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
+        if (result != m_shaderSourceMap.end())
+            delete result->second;
+        m_shaderSourceMap.set(shader, new ShaderSourceEntry(shaderType));
     }
+
     return shader;
 }
 
@@ -1353,8 +1465,12 @@ void WebGraphicsContext3DDefaultImpl::deleteRenderbuffer(unsigned renderbuffer)
 void WebGraphicsContext3DDefaultImpl::deleteShader(unsigned shader)
 {
     makeContextCurrent();
+
+    ShaderSourceMap::iterator result = m_shaderSourceMap.find(shader);
+    if (result != m_shaderSourceMap.end())
+        delete result->second;
+    m_shaderSourceMap.remove(result);
     glDeleteShader(shader);
-    m_shaderSourceMap.remove(shader);
 }
 
 void WebGraphicsContext3DDefaultImpl::deleteTexture(unsigned texture)
@@ -1368,29 +1484,20 @@ bool WebGraphicsContext3DDefaultImpl::angleCreateCompilers()
     if (!ShInitialize())
         return false;
 
-    TBuiltInResource resource;
-    resource.MaxVertexAttribs = 0;
-    getIntegerv(GL_MAX_VERTEX_ATTRIBS, &resource.MaxVertexAttribs);
-    resource.MaxVertexUniformVectors = 0;
-    getIntegerv(MAX_VERTEX_UNIFORM_VECTORS,
-                &resource.MaxVertexUniformVectors);
-    resource.MaxVaryingVectors = 0;
-    getIntegerv(MAX_VARYING_VECTORS,
-                &resource.MaxVaryingVectors);
-    resource.MaxVertexTextureImageUnits = 0;
-    getIntegerv(GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS, &resource.MaxVertexTextureImageUnits);
-    resource.MaxCombinedTextureImageUnits = 0;
-    getIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &resource.MaxCombinedTextureImageUnits);
-    resource.MaxTextureImageUnits = 0;
-    getIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS, &resource.MaxTextureImageUnits);
-    resource.MaxFragmentUniformVectors = 0;
-    getIntegerv(MAX_FRAGMENT_UNIFORM_VECTORS,
-                &resource.MaxFragmentUniformVectors);
+    ShBuiltInResources resources;
+    ShInitBuiltInResources(&resources);
+    getIntegerv(GL_MAX_VERTEX_ATTRIBS, &resources.MaxVertexAttribs);
+    getIntegerv(MAX_VERTEX_UNIFORM_VECTORS, &resources.MaxVertexUniformVectors);
+    getIntegerv(MAX_VARYING_VECTORS, &resources.MaxVaryingVectors);
+    getIntegerv(GL_MAX_VERTEX_TEXTURE_IMAGE_UNITS, &resources.MaxVertexTextureImageUnits);
+    getIntegerv(GL_MAX_COMBINED_TEXTURE_IMAGE_UNITS, &resources.MaxCombinedTextureImageUnits);
+    getIntegerv(GL_MAX_TEXTURE_IMAGE_UNITS, &resources.MaxTextureImageUnits);
+    getIntegerv(MAX_FRAGMENT_UNIFORM_VECTORS, &resources.MaxFragmentUniformVectors);
     // Always set to 1 for OpenGL ES.
-    resource.MaxDrawBuffers = 1;
+    resources.MaxDrawBuffers = 1;
 
-    m_fragmentCompiler = ShConstructCompiler(EShLangFragment, EShSpecWebGL, &resource);
-    m_vertexCompiler = ShConstructCompiler(EShLangVertex, EShSpecWebGL, &resource);
+    m_fragmentCompiler = ShConstructCompiler(SH_FRAGMENT_SHADER, SH_WEBGL_SPEC, &resources);
+    m_vertexCompiler = ShConstructCompiler(SH_VERTEX_SHADER, SH_WEBGL_SPEC, &resources);
     return (m_fragmentCompiler && m_vertexCompiler);
 }
 
@@ -1430,7 +1537,7 @@ bool WebGraphicsContext3DDefaultImpl::angleValidateShaderSource(ShaderSourceEntr
     if (!compiler)
         return false;
 
-    if (!ShCompile(compiler, &entry.source, 1, EShOptObjectCode)) {
+    if (!ShCompile(compiler, &entry.source, 1, SH_OBJECT_CODE)) {
         int logSize = 0;
         ShGetInfo(compiler, SH_INFO_LOG_LENGTH, &logSize);
         if (logSize > 1 && tryFastMalloc(logSize * sizeof(char)).getValue(entry.log))
diff --git a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
index 319d9d8..124ceac 100644
--- a/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
+++ b/WebKit/chromium/src/WebGraphicsContext3DDefaultImpl.h
@@ -273,6 +273,8 @@ public:
 private:
     WebGraphicsContext3D::Attributes m_attributes;
     bool m_initialized;
+    bool m_renderDirectlyToWebView;
+
     unsigned int m_texture;
     unsigned int m_fbo;
     unsigned int m_depthStencilBuffer;
@@ -298,6 +300,9 @@ private:
     // not be honored based on the capabilities of the OpenGL implementation.
     void validateAttributes();
 
+    // Resolve the given rectangle of the multisampled framebuffer if necessary.
+    void resolveMultisampledFramebuffer(unsigned x, unsigned y, unsigned width, unsigned height);
+
     // Note: we aren't currently using this information, but we will
     // need to in order to verify that all enabled vertex arrays have
     // a valid buffer bound -- to avoid crashes on certain cards.
@@ -327,8 +332,8 @@ private:
 
     // ANGLE related.
     struct ShaderSourceEntry {
-        ShaderSourceEntry()
-                : type(0)
+        ShaderSourceEntry(unsigned long shaderType)
+                : type(shaderType)
                 , source(0)
                 , log(0)
                 , translatedSource(0)
@@ -357,7 +362,7 @@ private:
     void angleDestroyCompilers();
     bool angleValidateShaderSource(ShaderSourceEntry& entry);
 
-    typedef HashMap<WebGLId, ShaderSourceEntry> ShaderSourceMap;
+    typedef HashMap<WebGLId, ShaderSourceEntry*> ShaderSourceMap;
     ShaderSourceMap m_shaderSourceMap;
 
     ShHandle m_fragmentCompiler;
diff --git a/WebKit/chromium/src/WebHTTPBody.cpp b/WebKit/chromium/src/WebHTTPBody.cpp
index 93b94c2..f32b64f 100644
--- a/WebKit/chromium/src/WebHTTPBody.cpp
+++ b/WebKit/chromium/src/WebHTTPBody.cpp
@@ -32,7 +32,6 @@
 #include "WebHTTPBody.h"
 
 #include "FormData.h"
-#include "WebFileInfo.h"
 
 using namespace WebCore;
 
@@ -78,8 +77,6 @@ bool WebHTTPBody::elementAt(size_t index, Element& result) const
     result.filePath.reset();
     result.fileStart = 0;
     result.fileLength = 0;
-    // FIXME: remove this line once all users of Element have been switched to use 'modificationTime'.
-    result.fileInfo.modificationTime = 0.0;
     result.modificationTime = 0.0;
     result.blobURL = KURL();
 
@@ -94,8 +91,6 @@ bool WebHTTPBody::elementAt(size_t index, Element& result) const
 #if ENABLE(BLOB)
         result.fileStart = element.m_fileStart;
         result.fileLength = element.m_fileLength;
-        // FIXME: remove this line once all users of Element have been switched to use 'modificationTime'.
-        result.fileInfo.modificationTime = element.m_expectedFileModificationTime;
         result.modificationTime = element.m_expectedFileModificationTime;
 #endif
         break;
@@ -135,12 +130,6 @@ void WebHTTPBody::appendFileRange(const WebString& filePath, long long fileStart
 #endif
 }
 
-// FIXME: Remove this method once all callers have been switched to use the method above.
-void WebHTTPBody::appendFileRange(const WebString& filePath, long long fileStart, long long fileLength, const WebFileInfo& fileInfo)
-{
-    return appendFileRange(filePath, fileStart, fileLength, fileInfo.modificationTime);
-}
-
 void WebHTTPBody::appendBlob(const WebURL& blobURL)
 {
 #if ENABLE(BLOB)
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
index fe67789..14ed02e 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.cpp
@@ -33,12 +33,14 @@
 #include "IDBIndexBackendProxy.h"
 #include "IDBKey.h"
 #include "IDBObjectStoreProxy.h"
+#include "IDBTransactionBackendProxy.h"
 #include "WebIDBCallbacks.h"
 #include "WebIDBDatabase.h"
 #include "WebIDBDatabaseError.h"
 #include "WebIDBIndex.h"
 #include "WebIDBKey.h"
 #include "WebIDBObjectStore.h"
+#include "WebIDBTransaction.h"
 #include "WebSerializedScriptValue.h"
 
 #if ENABLE(INDEXED_DATABASE)
@@ -89,6 +91,11 @@ void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBObjectStore* webKitInstance)
     m_callbacks->onSuccess(IDBObjectStoreProxy::create(webKitInstance));
 }
 
+void WebIDBCallbacksImpl::onSuccess(WebKit::WebIDBTransaction* webKitInstance)
+{
+    m_callbacks->onSuccess(IDBTransactionBackendProxy::create(webKitInstance));
+}
+
 void WebIDBCallbacksImpl::onSuccess(const WebKit::WebSerializedScriptValue& serializedScriptValue)
 {
     m_callbacks->onSuccess(serializedScriptValue);
diff --git a/WebKit/chromium/src/WebIDBCallbacksImpl.h b/WebKit/chromium/src/WebIDBCallbacksImpl.h
index 1835c60..33a72f4 100644
--- a/WebKit/chromium/src/WebIDBCallbacksImpl.h
+++ b/WebKit/chromium/src/WebIDBCallbacksImpl.h
@@ -48,6 +48,7 @@ public:
     virtual void onSuccess(const WebKit::WebIDBKey&);
     virtual void onSuccess(WebKit::WebIDBIndex*);
     virtual void onSuccess(WebKit::WebIDBObjectStore*);
+    virtual void onSuccess(WebKit::WebIDBTransaction*);
     virtual void onSuccess(const WebKit::WebSerializedScriptValue&);
 
 private:
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.cpp b/WebKit/chromium/src/WebIDBCursorImpl.cpp
index 6a1053e..eca5d42 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.cpp
+++ b/WebKit/chromium/src/WebIDBCursorImpl.cpp
@@ -70,19 +70,19 @@ void WebIDBCursorImpl::value(WebSerializedScriptValue& serializedScriptValue, We
         ASSERT_NOT_REACHED();
 }
 
-void WebIDBCursorImpl::update(const WebSerializedScriptValue& value, WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::update(const WebSerializedScriptValue& value, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->update(value, IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->update(value, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-void WebIDBCursorImpl::continueFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::continueFunction(const WebIDBKey& key, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->continueFunction(key, IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->continueFunction(key, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-void WebIDBCursorImpl::remove(WebIDBCallbacks* callbacks)
+void WebIDBCursorImpl::remove(WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_idbCursorBackend->remove(IDBCallbacksProxy::create(callbacks));
+    m_idbCursorBackend->remove(IDBCallbacksProxy::create(callbacks), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBCursorImpl.h b/WebKit/chromium/src/WebIDBCursorImpl.h
index 5fb9e1c..39fa44b 100644
--- a/WebKit/chromium/src/WebIDBCursorImpl.h
+++ b/WebKit/chromium/src/WebIDBCursorImpl.h
@@ -27,6 +27,7 @@
 #define WebIDBCursorImpl_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebIDBCursor.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -44,9 +45,9 @@ public:
     virtual unsigned short direction() const;
     virtual WebIDBKey key() const;
     virtual void value(WebSerializedScriptValue&, WebIDBKey&) const;
-    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*);
-    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*);
-    virtual void remove(WebIDBCallbacks*);
+    virtual void update(const WebSerializedScriptValue&, WebIDBCallbacks*, WebExceptionCode&);
+    virtual void continueFunction(const WebIDBKey&, WebIDBCallbacks*, WebExceptionCode&);
+    virtual void remove(WebIDBCallbacks*, WebExceptionCode&);
 
  private:
     WTF::RefPtr<WebCore::IDBCursorBackendInterface> m_idbCursorBackend;
diff --git a/WebKit/chromium/src/WebIDBDatabaseImpl.cpp b/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
index 8870ff9..2d95e21 100644
--- a/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
+++ b/WebKit/chromium/src/WebIDBDatabaseImpl.cpp
@@ -69,38 +69,38 @@ WebDOMStringList WebIDBDatabaseImpl::objectStores() const
     return m_databaseBackend->objectStores();
 }
 
-void WebIDBDatabaseImpl::createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, WebIDBCallbacks* callbacks)
+WebIDBObjectStore* WebIDBDatabaseImpl::createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_databaseBackend->createObjectStore(name, keyPath, autoIncrement, IDBCallbacksProxy::create(callbacks));
-}
-
-WebIDBObjectStore* WebIDBDatabaseImpl::objectStore(const WebString& name, unsigned short mode)
-{
-    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_databaseBackend->objectStore(name, mode);
+    RefPtr<IDBObjectStoreBackendInterface> objectStore = m_databaseBackend->createObjectStore(name, keyPath, autoIncrement, transaction.getIDBTransactionBackendInterface(), ec);
     if (!objectStore)
         return 0;
     return new WebIDBObjectStoreImpl(objectStore);
 }
 
-void WebIDBDatabaseImpl::removeObjectStore(const WebString& name, WebIDBCallbacks* callbacks)
+void WebIDBDatabaseImpl::removeObjectStore(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_databaseBackend->removeObjectStore(name, IDBCallbacksProxy::create(callbacks));
+    m_databaseBackend->removeObjectStore(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks)
+void WebIDBDatabaseImpl::setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode& ec)
 {
-    m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(callbacks));
+    m_databaseBackend->setVersion(version, IDBCallbacksProxy::create(callbacks), ec);
 }
 
-WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout)
+WebIDBTransaction* WebIDBDatabaseImpl::transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode& ec)
 {
     RefPtr<DOMStringList> nameList = PassRefPtr<DOMStringList>(names);
-    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, timeout);
+    RefPtr<IDBTransactionBackendInterface> transaction = m_databaseBackend->transaction(nameList.get(), mode, timeout, ec);
     if (!transaction)
         return 0;
     return new WebIDBTransactionImpl(transaction);
 }
 
+void WebIDBDatabaseImpl::close()
+{
+    m_databaseBackend->close();
+}
+
 } // namespace WebCore
 
 #endif // ENABLE(INDEXED_DATABASE)
diff --git a/WebKit/chromium/src/WebIDBDatabaseImpl.h b/WebKit/chromium/src/WebIDBDatabaseImpl.h
index e0eaaa5..fda4265 100644
--- a/WebKit/chromium/src/WebIDBDatabaseImpl.h
+++ b/WebKit/chromium/src/WebIDBDatabaseImpl.h
@@ -27,6 +27,7 @@
 #define WebIDBDatabaseImpl_h
 
 #include "WebCommon.h"
+#include "WebExceptionCode.h"
 #include "WebIDBDatabase.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
@@ -49,11 +50,11 @@ public:
     virtual WebString version() const;
     virtual WebDOMStringList objectStores() const;
 
-    virtual void createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, WebIDBCallbacks* callbacks);
-    virtual WebIDBObjectStore* objectStore(const WebString& name, unsigned short mode);
-    virtual void removeObjectStore(const WebString& name, WebIDBCallbacks* callbacks);
-    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks);
-    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout);
+    virtual WebIDBObjectStore* createObjectStore(const WebString& name, const WebString& keyPath, bool autoIncrement, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void removeObjectStore(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void setVersion(const WebString& version, WebIDBCallbacks* callbacks, WebExceptionCode&);
+    virtual WebIDBTransaction* transaction(const WebDOMStringList& names, unsigned short mode, unsigned long timeout, WebExceptionCode&);
+    virtual void close();
 
 private:
     WTF::RefPtr<WebCore::IDBDatabaseBackendInterface> m_databaseBackend;
diff --git a/WebKit/chromium/src/WebIDBFactoryImpl.cpp b/WebKit/chromium/src/WebIDBFactoryImpl.cpp
index 7147cf0..5d0ab85 100755
--- a/WebKit/chromium/src/WebIDBFactoryImpl.cpp
+++ b/WebKit/chromium/src/WebIDBFactoryImpl.cpp
@@ -58,9 +58,9 @@ WebIDBFactoryImpl::~WebIDBFactoryImpl()
 {
 }
 
-void WebIDBFactoryImpl::open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir)
+void WebIDBFactoryImpl::open(const WebString& name, const WebString& description, WebIDBCallbacks* callbacks, const WebSecurityOrigin& origin, WebFrame*, const WebString& dataDir, unsigned long long maximumSize)
 {
-    m_idbFactoryBackend->open(name, description, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir);
+    m_idbFactoryBackend->open(name, description, IDBCallbacksProxy::create(callbacks), origin, 0, dataDir, maximumSize);
 }
 
 } // namespace WebKit
diff --git a/WebKit/chromium/src/WebIDBFactoryImpl.h b/WebKit/chromium/src/WebIDBFactoryImpl.h
index a0a4d7d..4bc9426 100755
--- a/WebKit/chromium/src/WebIDBFactoryImpl.h
+++ b/WebKit/chromium/src/WebIDBFactoryImpl.h
@@ -42,7 +42,7 @@ public:
     WebIDBFactoryImpl();
     virtual ~WebIDBFactoryImpl();
 
-    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir);
+    virtual void open(const WebString& name, const WebString& description, WebIDBCallbacks*, const WebSecurityOrigin&, WebFrame*, const WebString& dataDir, unsigned long long maximumSize);
 
 private:
     WTF::RefPtr<WebCore::IDBFactoryBackendInterface> m_idbFactoryBackend;
diff --git a/WebKit/chromium/src/WebIDBIndexImpl.cpp b/WebKit/chromium/src/WebIDBIndexImpl.cpp
index c049aac..6e8e1f2 100644
--- a/WebKit/chromium/src/WebIDBIndexImpl.cpp
+++ b/WebKit/chromium/src/WebIDBIndexImpl.cpp
@@ -68,24 +68,24 @@ bool WebIDBIndexImpl::unique() const
     return m_backend->unique();
 }
 
-void WebIDBIndexImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::openObjectCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks));
+    m_backend->openCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::openObjectCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::openKeyCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->openObjectCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks));
+    m_backend->openKeyCursor(keyRange, direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::getObject(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::getObject(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->getObject(keyRange, IDBCallbacksProxy::create(callbacks));
+    m_backend->get(keyRange, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBIndexImpl::get(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks)
+void WebIDBIndexImpl::getKey(const WebIDBKey& keyRange, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_backend->get(keyRange, IDBCallbacksProxy::create(callbacks));
+    m_backend->getKey(keyRange, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBIndexImpl.h b/WebKit/chromium/src/WebIDBIndexImpl.h
index 2108001..f68da7f 100644
--- a/WebKit/chromium/src/WebIDBIndexImpl.h
+++ b/WebKit/chromium/src/WebIDBIndexImpl.h
@@ -46,10 +46,10 @@ public:
     virtual WebString keyPath() const;
     virtual bool unique() const;
 
-    virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*); 
-    virtual void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*);
-    virtual void getObject(const WebIDBKey&, WebIDBCallbacks*);
-    virtual void get(const WebIDBKey&, WebIDBCallbacks*);
+    virtual void openObjectCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&); 
+    virtual void openKeyCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void getObject(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    virtual void getKey(const WebIDBKey&, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
 private:
     WTF::RefPtr<WebCore::IDBIndexBackendInterface> m_backend;
diff --git a/WebKit/chromium/src/WebIDBKeyRange.cpp b/WebKit/chromium/src/WebIDBKeyRange.cpp
index 4ce9452..720af5f 100644
--- a/WebKit/chromium/src/WebIDBKeyRange.cpp
+++ b/WebKit/chromium/src/WebIDBKeyRange.cpp
@@ -41,7 +41,10 @@ void WebIDBKeyRange::assign(const WebIDBKeyRange& other)
 
 void WebIDBKeyRange::assign(const WebIDBKey& left, const WebIDBKey& right, unsigned short flags)
 {
-    m_private = IDBKeyRange::create(left, right, flags);
+    if (left.type() == WebIDBKey::InvalidType && right.type() == WebIDBKey::InvalidType)
+        m_private = 0;
+    else
+        m_private = IDBKeyRange::create(left, right, flags);
 }
 
 void WebIDBKeyRange::reset()
@@ -51,16 +54,22 @@ void WebIDBKeyRange::reset()
 
 WebIDBKey WebIDBKeyRange::left() const
 {
+    if (!m_private.get())
+        return WebIDBKey::createInvalid();
     return m_private->left();
 }
 
 WebIDBKey WebIDBKeyRange::right() const
 {
+    if (!m_private.get())
+        return WebIDBKey::createInvalid();
     return m_private->right();
 }
 
 unsigned short WebIDBKeyRange::flags() const
 {
+    if (!m_private.get())
+        return 0;
     return m_private->flags();
 }
 
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
index 36d8ace..96495fe 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.cpp
@@ -66,42 +66,45 @@ WebDOMStringList WebIDBObjectStoreImpl::indexNames() const
     return m_objectStore->indexNames();
 }
 
-void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction)
+void WebIDBObjectStoreImpl::get(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->get(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface());
+    m_objectStore->get(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->put(value, key, addOnly, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::remove(const WebIDBKey& key, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::remove(const WebIDBKey& key, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->remove(key, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->remove(key, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks)
+WebIDBIndex* WebIDBObjectStoreImpl::createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->createIndex(name, keyPath, unique, IDBCallbacksProxy::create(callbacks));
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->createIndex(name, keyPath, unique, transaction.getIDBTransactionBackendInterface(), ec);
+    if (!index)
+        return 0;
+    return new WebIDBIndexImpl(index);
 }
 
-WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name)
+WebIDBIndex* WebIDBObjectStoreImpl::index(const WebString& name, WebExceptionCode& ec)
 {
-    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name);
+    RefPtr<IDBIndexBackendInterface> index = m_objectStore->index(name, ec);
     if (!index)
         return 0;
     return new WebIDBIndexImpl(index);
 }
 
-void WebIDBObjectStoreImpl::removeIndex(const WebString& name, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::removeIndex(const WebString& name, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->removeIndex(name, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->removeIndex(name, transaction.getIDBTransactionBackendInterface(), ec);
 }
 
-void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks)
+void WebIDBObjectStoreImpl::openCursor(const WebIDBKeyRange& keyRange, unsigned short direction, WebIDBCallbacks* callbacks, const WebIDBTransaction& transaction, WebExceptionCode& ec)
 {
-    m_objectStore->openCursor(IDBKeyRange::create(keyRange.left(), keyRange.right(), keyRange.flags()), direction, IDBCallbacksProxy::create(callbacks));
+    m_objectStore->openCursor(IDBKeyRange::create(keyRange.left(), keyRange.right(), keyRange.flags()), direction, IDBCallbacksProxy::create(callbacks), transaction.getIDBTransactionBackendInterface(), ec);
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBObjectStoreImpl.h b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
index a9f1200..9148118 100755
--- a/WebKit/chromium/src/WebIDBObjectStoreImpl.h
+++ b/WebKit/chromium/src/WebIDBObjectStoreImpl.h
@@ -47,15 +47,15 @@ public:
     WebString keyPath() const;
     WebDOMStringList indexNames() const;
 
-    void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&);
-    void put(const WebSerializedScriptValue& value, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*);
-    void remove(const WebIDBKey& key, WebIDBCallbacks*);
+    void get(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void put(const WebSerializedScriptValue&, const WebIDBKey& key, bool addOnly, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
+    void remove(const WebIDBKey& key, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
-    void createIndex(const WebString& name, const WebString& keyPath, bool unique, WebIDBCallbacks* callbacks);
-    WebIDBIndex* index(const WebString& name);
-    void removeIndex(const WebString& name, WebIDBCallbacks* callbacks);
+    WebIDBIndex* createIndex(const WebString& name, const WebString& keyPath, bool unique, const WebIDBTransaction&, WebExceptionCode&);
+    WebIDBIndex* index(const WebString& name, WebExceptionCode&);
+    void removeIndex(const WebString& name, const WebIDBTransaction&, WebExceptionCode&);
 
-    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*);
+    void openCursor(const WebIDBKeyRange&, unsigned short direction, WebIDBCallbacks*, const WebIDBTransaction&, WebExceptionCode&);
 
  private:
     WTF::RefPtr<WebCore::IDBObjectStoreBackendInterface> m_objectStore;
diff --git a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
index 264ddc5..96924cf 100644
--- a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
+++ b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.cpp
@@ -46,9 +46,14 @@ void WebIDBTransactionCallbacksImpl::onAbort()
     m_callbacks->onAbort();
 }
 
-int WebIDBTransactionCallbacksImpl::id() const
+void WebIDBTransactionCallbacksImpl::onComplete()
 {
-    return m_callbacks->id();
+    m_callbacks->onComplete();
+}
+
+void WebIDBTransactionCallbacksImpl::onTimeout()
+{
+    m_callbacks->onTimeout();
 }
 
 } // namespace WebCore
diff --git a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
index 398a679a..89b9cbe 100644
--- a/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
+++ b/WebKit/chromium/src/WebIDBTransactionCallbacksImpl.h
@@ -42,7 +42,8 @@ public:
     virtual ~WebIDBTransactionCallbacksImpl();
 
     virtual void onAbort();
-    virtual int id() const;
+    virtual void onComplete();
+    virtual void onTimeout();
 
 private:
     RefPtr<IDBTransactionCallbacks> m_callbacks;
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
index f0ece0d..e19308a 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.cpp
@@ -95,6 +95,14 @@ WebMediaPlayer* WebMediaPlayerClientImpl::mediaPlayer() const
 
 // WebMediaPlayerClient --------------------------------------------------------
 
+WebMediaPlayerClientImpl::~WebMediaPlayerClientImpl()
+{
+    // VideoLayerChromium may outlive this object so make sure all frames are
+    // released.
+    if (m_videoLayer.get())
+        m_videoLayer->releaseCurrentFrame();
+}
+
 void WebMediaPlayerClientImpl::networkStateChanged()
 {
     ASSERT(m_mediaPlayer);
@@ -105,6 +113,8 @@ void WebMediaPlayerClientImpl::readyStateChanged()
 {
     ASSERT(m_mediaPlayer);
     m_mediaPlayer->readyStateChanged();
+    if (hasVideo() && supportsAcceleratedRendering() && !m_videoLayer.get())
+        m_videoLayer = VideoLayerChromium::create(0, this);
 }
 
 void WebMediaPlayerClientImpl::volumeChanged(float newVolume)
@@ -173,6 +183,11 @@ void WebMediaPlayerClientImpl::load(const String& url)
     Frame* frame = static_cast<HTMLMediaElement*>(
         m_mediaPlayer->mediaPlayerClient())->document()->frame();
 
+    // Video frame object is owned by WebMediaPlayer. Before destroying
+    // WebMediaPlayer all frames need to be released.
+    if (m_videoLayer.get())
+        m_videoLayer->releaseCurrentFrame();
+
     m_webMediaPlayer.set(createWebMediaPlayer(this, frame));
     if (m_webMediaPlayer.get())
         m_webMediaPlayer->load(KURL(ParsedURLString, url));
@@ -455,9 +470,6 @@ MediaPlayerPrivateInterface* WebMediaPlayerClientImpl::create(MediaPlayer* playe
     // if necessary.
     client->m_supportsAcceleratedCompositing =
         frame->contentRenderer()->compositor()->hasAcceleratedCompositing();
-
-    if (client->m_supportsAcceleratedCompositing)
-        client->m_videoLayer = VideoLayerChromium::create(0, client);
 #endif
 
     return client;
diff --git a/WebKit/chromium/src/WebMediaPlayerClientImpl.h b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
index e014871..6535094 100644
--- a/WebKit/chromium/src/WebMediaPlayerClientImpl.h
+++ b/WebKit/chromium/src/WebMediaPlayerClientImpl.h
@@ -36,6 +36,7 @@
 #include "MediaPlayerPrivate.h"
 #include "VideoFrameChromium.h"
 #include "VideoFrameProvider.h"
+#include "VideoLayerChromium.h"
 #include "WebMediaPlayerClient.h"
 #include <wtf/OwnPtr.h>
 
@@ -61,6 +62,7 @@ public:
     WebMediaPlayer* mediaPlayer() const;
 
     // WebMediaPlayerClient methods:
+    virtual ~WebMediaPlayerClientImpl();
     virtual void networkStateChanged();
     virtual void readyStateChanged();
     virtual void volumeChanged(float);
@@ -129,7 +131,7 @@ private:
     WebCore::MediaPlayer* m_mediaPlayer;
     OwnPtr<WebMediaPlayer> m_webMediaPlayer;
 #if USE(ACCELERATED_COMPOSITING)
-    RefPtr<WebCore::PlatformLayer> m_videoLayer;
+    RefPtr<WebCore::VideoLayerChromium> m_videoLayer;
     bool m_supportsAcceleratedCompositing;
 #endif
     static bool m_isEnabled;
diff --git a/WebKit/chromium/src/WebNode.cpp b/WebKit/chromium/src/WebNode.cpp
index caea589..e91d1ee 100644
--- a/WebKit/chromium/src/WebNode.cpp
+++ b/WebKit/chromium/src/WebNode.cpp
@@ -32,6 +32,7 @@
 #include "WebNode.h"
 
 #include "Document.h"
+#include "Element.h"
 #include "Frame.h"
 #include "FrameLoaderClientImpl.h"
 #include "Node.h"
@@ -144,6 +145,11 @@ bool WebNode::isTextNode() const
     return m_private->isTextNode();
 }
 
+bool WebNode::isContentEditable() const
+{
+    return m_private->isContentEditable();
+}
+
 bool WebNode::isElementNode() const
 {
     return m_private->isElementNode();
diff --git a/WebKit/chromium/src/WebNotification.cpp b/WebKit/chromium/src/WebNotification.cpp
index bfc1bec..c3b1f51 100644
--- a/WebKit/chromium/src/WebNotification.cpp
+++ b/WebKit/chromium/src/WebNotification.cpp
@@ -34,6 +34,7 @@
 #if ENABLE(NOTIFICATIONS)
 
 #include "Notification.h"
+#include "UserGestureIndicator.h"
 
 #include "WebString.h"
 #include "WebTextDirection.h"
@@ -140,6 +141,8 @@ void WebNotification::dispatchCloseEvent(bool /* byUser */)
 
 void WebNotification::dispatchClickEvent()
 {
+    // Make sure clicks on notifications are treated as user gestures.
+    UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
     RefPtr<Event> event = Event::create(eventNames().clickEvent, false, true);
     m_private->dispatchEvent(event.release());
 }
diff --git a/WebKit/chromium/src/WebPageSerializer.cpp b/WebKit/chromium/src/WebPageSerializer.cpp
index 4f93702..1fda484 100644
--- a/WebKit/chromium/src/WebPageSerializer.cpp
+++ b/WebKit/chromium/src/WebPageSerializer.cpp
@@ -32,7 +32,6 @@
 #include "WebPageSerializer.h"
 
 #include "KURL.h"
-#include "PlatformString.h"
 
 #include "WebFrame.h"
 #include "WebPageSerializerClient.h"
@@ -41,6 +40,8 @@
 #include "WebURL.h"
 #include "WebVector.h"
 
+#include <wtf/text/StringConcatenate.h>
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -59,8 +60,7 @@ bool WebPageSerializer::serialize(WebFrame* frame,
 
 WebString WebPageSerializer::generateMetaCharsetDeclaration(const WebString& charset)
 {
-    return String::format("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=%s\">",
-                          charset.utf8().data());
+    return makeString("<meta http-equiv=\"Content-Type\" content=\"text/html; charset=", static_cast<const String&>(charset), "\">");
 }
 
 WebString WebPageSerializer::generateMarkOfTheWebDeclaration(const WebURL& url)
@@ -72,10 +72,9 @@ WebString WebPageSerializer::generateMarkOfTheWebDeclaration(const WebURL& url)
 
 WebString WebPageSerializer::generateBaseTagDeclaration(const WebString& baseTarget)
 {
-    String targetDeclaration;
-    if (!baseTarget.isEmpty())
-        targetDeclaration = String::format(" target=\"%s\"", baseTarget.utf8().data());
-    return String::format("<base href=\".\"%s>", targetDeclaration.utf8().data());
+    if (baseTarget.isEmpty())
+        return makeString("<base href=\".\">");
+    return makeString("<base href=\".\" target=\"", static_cast<const String&>(baseTarget), "\">");
 }
 
 }  // namespace WebKit
diff --git a/WebKit/chromium/src/WebPageSerializerImpl.cpp b/WebKit/chromium/src/WebPageSerializerImpl.cpp
index 885ee25..0d85d78 100644
--- a/WebKit/chromium/src/WebPageSerializerImpl.cpp
+++ b/WebKit/chromium/src/WebPageSerializerImpl.cpp
@@ -88,8 +88,6 @@
 #include "HTMLMetaElement.h"
 #include "HTMLNames.h"
 #include "KURL.h"
-#include "PlatformString.h"
-#include "StringBuilder.h"
 #include "TextEncoding.h"
 #include "markup.h"
 
@@ -107,22 +105,22 @@ namespace WebKit {
 // contegious string is found in the page.
 static const unsigned dataBufferCapacity = 65536;
 
-WebPageSerializerImpl::SerializeDomParam::SerializeDomParam(const KURL& currentFrameURL,
+WebPageSerializerImpl::SerializeDomParam::SerializeDomParam(const KURL& url,
                                                             const TextEncoding& textEncoding,
-                                                            Document* doc,
+                                                            Document* document,
                                                             const String& directoryName)
-    : currentFrameURL(currentFrameURL)
+    : url(url)
     , textEncoding(textEncoding)
-    , doc(doc)
+    , document(document)
     , directoryName(directoryName)
-    , hasDoctype(false)
-    , hasCheckedMeta(false)
+    , isHTMLDocument(document->isHTMLDocument())
+    , haveSeenDocType(false)
+    , haveAddedCharsetDeclaration(false)
     , skipMetaElement(0)
     , isInScriptOrStyleTag(false)
-    , hasDocDeclaration(false)
+    , haveAddedXMLProcessingDirective(false)
+    , haveAddedContentsBeforeEnd(false)
 {
-    // Cache the value since we check it lots of times.
-    isHTMLDocument = doc->isHTMLDocument();
 }
 
 String WebPageSerializerImpl::preActionBeforeSerializeOpenTag(
@@ -150,41 +148,41 @@ String WebPageSerializerImpl::preActionBeforeSerializeOpenTag(
             }
         } else if (element->hasTagName(HTMLNames::htmlTag)) {
             // Check something before processing the open tag of HEAD element.
-            // First we add doc type declaration if original doc has it.
-            if (!param->hasDoctype) {
-                param->hasDoctype = true;
-                result.append(createMarkup(param->doc->doctype()));
+            // First we add doc type declaration if original document has it.
+            if (!param->haveSeenDocType) {
+                param->haveSeenDocType = true;
+                result.append(createMarkup(param->document->doctype()));
             }
 
             // Add MOTW declaration before html tag.
             // See http://msdn2.microsoft.com/en-us/library/ms537628(VS.85).aspx.
-            result.append(WebPageSerializer::generateMarkOfTheWebDeclaration(param->currentFrameURL));
+            result.append(WebPageSerializer::generateMarkOfTheWebDeclaration(param->url));
         } else if (element->hasTagName(HTMLNames::baseTag)) {
             // Comment the BASE tag when serializing dom.
             result.append("<!--");
         }
     } else {
         // Write XML declaration.
-        if (!param->hasDocDeclaration) {
-            param->hasDocDeclaration = true;
+        if (!param->haveAddedXMLProcessingDirective) {
+            param->haveAddedXMLProcessingDirective = true;
             // Get encoding info.
-            String xmlEncoding = param->doc->xmlEncoding();
+            String xmlEncoding = param->document->xmlEncoding();
             if (xmlEncoding.isEmpty())
-                xmlEncoding = param->doc->frame()->loader()->writer()->encoding();
+                xmlEncoding = param->document->frame()->loader()->writer()->encoding();
             if (xmlEncoding.isEmpty())
                 xmlEncoding = UTF8Encoding().name();
             result.append("<?xml version=\"");
-            result.append(param->doc->xmlVersion());
+            result.append(param->document->xmlVersion());
             result.append("\" encoding=\"");
             result.append(xmlEncoding);
-            if (param->doc->xmlStandalone())
+            if (param->document->xmlStandalone())
                 result.append("\" standalone=\"yes");
             result.append("\"?>\n");
         }
-        // Add doc type declaration if original doc has it.
-        if (!param->hasDoctype) {
-            param->hasDoctype = true;
-            result.append(createMarkup(param->doc->doctype()));
+        // Add doc type declaration if original document has it.
+        if (!param->haveSeenDocType) {
+            param->haveSeenDocType = true;
+            result.append(createMarkup(param->document->doctype()));
         }
     }
     return result.toString();
@@ -195,13 +193,13 @@ String WebPageSerializerImpl::postActionAfterSerializeOpenTag(
 {
     StringBuilder result;
 
-    param->hasAddedContentsBeforeEnd = false;
+    param->haveAddedContentsBeforeEnd = false;
     if (!param->isHTMLDocument)
         return result.toString();
     // Check after processing the open tag of HEAD element
-    if (!param->hasCheckedMeta
+    if (!param->haveAddedCharsetDeclaration
         && element->hasTagName(HTMLNames::headTag)) {
-        param->hasCheckedMeta = true;
+        param->haveAddedCharsetDeclaration = true;
         // Check meta element. WebKit only pre-parse the first 512 bytes
         // of the document. If the whole <HEAD> is larger and meta is the
         // end of head part, then this kind of pages aren't decoded correctly
@@ -212,7 +210,7 @@ String WebPageSerializerImpl::postActionAfterSerializeOpenTag(
         result.append(WebPageSerializer::generateMetaCharsetDeclaration(
             String(param->textEncoding.name())));
 
-        param->hasAddedContentsBeforeEnd = true;
+        param->haveAddedContentsBeforeEnd = true;
         // Will search each META which has charset declaration, and skip them all
         // in PreActionBeforeSerializeOpenTag.
     } else if (element->hasTagName(HTMLNames::scriptTag)
@@ -259,7 +257,7 @@ String WebPageSerializerImpl::postActionAfterSerializeEndTag(
         result.append("-->");
         // Append a new base tag declaration.
         result.append(WebPageSerializer::generateBaseTagDeclaration(
-            param->doc->baseTarget()));
+            param->document->baseTarget()));
     }
 
     return result.toString();
@@ -271,27 +269,27 @@ void WebPageSerializerImpl::saveHTMLContentToBuffer(
     m_dataBuffer.append(result);
     encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsNotFinished,
                          param,
-                         0);
+                         DoNotForceFlush);
 }
 
 void WebPageSerializerImpl::encodeAndFlushBuffer(
     WebPageSerializerClient::PageSerializationStatus status,
     SerializeDomParam* param,
-    bool force)
+    FlushOption flushOption)
 {
     // Data buffer is not full nor do we want to force flush.
-    if (!force && m_dataBuffer.length() <= dataBufferCapacity)
+    if (flushOption != ForceFlush && m_dataBuffer.length() <= dataBufferCapacity)
         return;
 
     String content = m_dataBuffer.toString();
-    m_dataBuffer.clear();
+    m_dataBuffer = StringBuilder();
 
     // Convert the unicode content to target encoding
     CString encodedContent = param->textEncoding.encode(
         content.characters(), content.length(), EntitiesForUnencodables);
 
     // Send result to the client.
-    m_client->didSerializeDataForFrame(param->currentFrameURL,
+    m_client->didSerializeDataForFrame(param->url,
                                        WebCString(encodedContent.data(), encodedContent.length()),
                                        status);
 }
@@ -329,7 +327,7 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
                         result += attrValue;
                     else {
                         // Get the absolute link
-                        String completeURL = param->doc->completeURL(attrValue);
+                        String completeURL = param->document->completeURL(attrValue);
                         // Check whether we have local files for those link.
                         if (m_localLinks.contains(completeURL)) {
                             if (!m_localDirectoryName.isEmpty())
@@ -352,7 +350,7 @@ void WebPageSerializerImpl::openTagToString(const Element* element,
     // Do post action for open tag.
     String addedContents = postActionAfterSerializeOpenTag(element, param);
     // Complete the open tag for element when it has child/children.
-    if (element->hasChildNodes() || param->hasAddedContentsBeforeEnd)
+    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd)
         result += ">";
     // Append the added contents generate in  post action of open tag.
     result += addedContents;
@@ -372,7 +370,7 @@ void WebPageSerializerImpl::endTagToString(const Element* element,
     if (needSkip)
         return;
     // Write end tag when element has child/children.
-    if (element->hasChildNodes() || param->hasAddedContentsBeforeEnd) {
+    if (element->hasChildNodes() || param->haveAddedContentsBeforeEnd) {
         result += "</";
         result += element->nodeName().lower();
         result += ">";
@@ -422,7 +420,7 @@ void WebPageSerializerImpl::buildContentForNode(const Node* node,
         break;
     // Document type node can be in DOM?
     case Node::DOCUMENT_TYPE_NODE:
-        param->hasDoctype = true;
+        param->haveSeenDocType = true;
     default:
         // For other type node, call default action.
         saveHTMLContentToBuffer(createMarkup(node), param);
@@ -456,7 +454,7 @@ WebPageSerializerImpl::WebPageSerializerImpl(WebFrame* frame,
         m_localLinks.set(url.string(), localPaths[i]);
     }
 
-    ASSERT(!m_dataBuffer.length());
+    ASSERT(m_dataBuffer.isEmpty());
 }
 
 void WebPageSerializerImpl::collectTargetFrames()
@@ -491,55 +489,37 @@ void WebPageSerializerImpl::collectTargetFrames()
 
 bool WebPageSerializerImpl::serialize()
 {
-    // Collect target frames.
     if (!m_framesCollected)
         collectTargetFrames();
+
     bool didSerialization = false;
-    // Get KURL for main frame.
-    KURL mainPageURL = m_specifiedWebFrameImpl->frame()->loader()->url();
+    KURL mainURL = m_specifiedWebFrameImpl->frame()->document()->url();
 
-    // Go through all frames for serializing DOM for whole page, include
-    // sub-frames.
-    for (int i = 0; i < static_cast<int>(m_frames.size()); ++i) {
-        // Get current serializing frame.
-        WebFrameImpl* currentFrame = m_frames[i];
-        // Get current using document.
-        Document* currentDoc = currentFrame->frame()->document();
-        // Get current frame's URL.
-        const KURL& currentFrameURL = currentFrame->frame()->loader()->url();
-
-        // Check whether we have done this document.
-        if (currentFrameURL.isValid() && m_localLinks.contains(currentFrameURL.string())) {
-            // A new document, we will serialize it.
-            didSerialization = true;
-            // Get target encoding for current document.
-            String encoding = currentFrame->frame()->loader()->writer()->encoding();
-            // Create the text encoding object with target encoding.
-            TextEncoding textEncoding(encoding);
-            // Construct serialize parameter for late processing document.
-            SerializeDomParam param(currentFrameURL,
-                                    encoding.length() ? textEncoding : UTF8Encoding(),
-                                    currentDoc,
-                                    currentFrameURL == mainPageURL ? m_localDirectoryName : "");
-
-            // Process current document.
-            Element* rootElement = currentDoc->documentElement();
-            if (rootElement)
-                buildContentForNode(rootElement, &param);
-
-            // Flush the remainder data and finish serializing current frame.
-            encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsFinished,
-                                 &param,
-                                 1);
-        }
+    for (unsigned i = 0; i < m_frames.size(); ++i) {
+        WebFrameImpl* webFrame = m_frames[i];
+        Document* document = webFrame->frame()->document();
+        const KURL& url = document->url();
+
+        if (!url.isValid() || !m_localLinks.contains(url.string()))
+            continue;
+
+        didSerialization = true;
+
+        String encoding = webFrame->frame()->loader()->writer()->encoding();
+        const TextEncoding& textEncoding = encoding.isEmpty() ? UTF8Encoding() : TextEncoding(encoding);
+        String directoryName = url == mainURL ? m_localDirectoryName : "";
+
+        SerializeDomParam param(url, textEncoding, document, directoryName);
+
+        Element* documentElement = document->documentElement();
+        if (documentElement)
+            buildContentForNode(documentElement, &param);
+
+        encodeAndFlushBuffer(WebPageSerializerClient::CurrentFrameIsFinished, &param, ForceFlush);
     }
 
-    // We have done call frames, so we send message to embedder to tell it that
-    // frames are finished serializing.
-    ASSERT(!m_dataBuffer.length());
-    m_client->didSerializeDataForFrame(KURL(),
-                                       WebCString("", 0),
-                                       WebPageSerializerClient::AllFramesAreFinished);
+    ASSERT(m_dataBuffer.isEmpty());
+    m_client->didSerializeDataForFrame(KURL(), WebCString("", 0), WebPageSerializerClient::AllFramesAreFinished);
     return didSerialization;
 }
 
diff --git a/WebKit/chromium/src/WebPageSerializerImpl.h b/WebKit/chromium/src/WebPageSerializerImpl.h
index a7f2fb4..5ee8805 100644
--- a/WebKit/chromium/src/WebPageSerializerImpl.h
+++ b/WebKit/chromium/src/WebPageSerializerImpl.h
@@ -31,12 +31,12 @@
 #ifndef WebPageSerializerImpl_h
 #define WebPageSerializerImpl_h
 
-#include "PlatformString.h"
 #include <wtf/Forward.h>
 #include <wtf/HashMap.h>
 #include <wtf/Vector.h>
+#include <wtf/text/StringBuilder.h>
 #include <wtf/text/StringHash.h>
-#include "StringBuilder.h"
+#include <wtf/text/WTFString.h>
 
 #include "WebEntities.h"
 #include "WebPageSerializer.h"
@@ -98,7 +98,7 @@ private:
     // original link.
     LinkLocalPathMap m_localLinks;
     // Data buffer for saving result of serialized DOM data.
-    WebCore::StringBuilder m_dataBuffer;
+    StringBuilder m_dataBuffer;
     // Passing true to recursive_serialization_ indicates we will serialize not
     // only the specified frame but also all sub-frames in the specific frame.
     // Otherwise we only serialize the specified frame excluded all sub-frames.
@@ -116,42 +116,26 @@ private:
     WebEntities m_xmlEntities;
 
     struct SerializeDomParam {
-        // Frame URL of current processing document presented by GURL
-        const WebCore::KURL& currentFrameURL;
-        // Current using text encoding object.
+        const WebCore::KURL& url;
         const WebCore::TextEncoding& textEncoding;
-
-        // Document object of current frame.
-        WebCore::Document* doc;
-        // Local directory name of all local resource files.
+        WebCore::Document* document;
         const WTF::String& directoryName;
-
-        // Flag indicates current doc is html document or not. It's a cache value
-        // of Document.isHTMLDocument().
-        bool isHTMLDocument;
-        // Flag which indicate whether we have met document type declaration.
-        bool hasDoctype;
-        // Flag which indicate whether will process meta issue.
-        bool hasCheckedMeta;
+        bool isHTMLDocument; // document.isHTMLDocument()
+        bool haveSeenDocType;
+        bool haveAddedCharsetDeclaration;
         // This meta element need to be skipped when serializing DOM.
         const WebCore::Element* skipMetaElement;
         // Flag indicates we are in script or style tag.
         bool isInScriptOrStyleTag;
-        // Flag indicates whether we have written xml document declaration.
-        // It is only used in xml document
-        bool hasDocDeclaration;
+        bool haveAddedXMLProcessingDirective;
         // Flag indicates whether we have added additional contents before end tag.
         // This flag will be re-assigned in each call of function
         // PostActionAfterSerializeOpenTag and it could be changed in function
         // PreActionBeforeSerializeEndTag if the function adds new contents into
         // serialization stream.
-        bool hasAddedContentsBeforeEnd;
+        bool haveAddedContentsBeforeEnd;
 
-        // Constructor.
-        SerializeDomParam(const WebCore::KURL& currentFrameURL,
-                          const WebCore::TextEncoding& textEncoding,
-                          WebCore::Document* doc,
-                          const WTF::String& directoryName);
+        SerializeDomParam(const WebCore::KURL&, const WebCore::TextEncoding&, WebCore::Document*, const WTF::String& directoryName);
     };
 
     // Collect all target frames which need to be serialized.
@@ -177,12 +161,18 @@ private:
     // Save generated html content to data buffer.
     void saveHTMLContentToBuffer(const WTF::String& content,
                                  SerializeDomParam* param);
+
+    enum FlushOption {
+        ForceFlush,
+        DoNotForceFlush,
+    };
+
     // Flushes the content buffer by encoding and sending the content to the
     // WebPageSerializerClient. Content is not flushed if the buffer is not full
     // unless force is 1.
     void encodeAndFlushBuffer(WebPageSerializerClient::PageSerializationStatus status,
                               SerializeDomParam* param,
-                              bool force);
+                              FlushOption);
     // Serialize open tag of an specified element.
     void openTagToString(const WebCore::Element* element,
                          SerializeDomParam* param);
diff --git a/WebKit/chromium/src/WebPasswordFormUtils.cpp b/WebKit/chromium/src/WebPasswordFormUtils.cpp
index 6968e1a..b4997e5 100644
--- a/WebKit/chromium/src/WebPasswordFormUtils.cpp
+++ b/WebKit/chromium/src/WebPasswordFormUtils.cpp
@@ -98,9 +98,8 @@ void findPasswordFormFields(HTMLFormElement* form, PasswordFormFields* fields)
             if (!inputElement->isEnabledFormControl())
                 continue;
 
-            // FIXME: This needs to use a function other than deprecatedInputType.
-            // Does this really want to special-case TEXT, and not other text-field-like input elements?
-            if ((inputElement->deprecatedInputType() == HTMLInputElement::TEXT)
+            // Various input types such as text, url, email can be a username field.
+            if ((inputElement->isTextField() && !inputElement->isPasswordField())
                 && (inputElement->autoComplete())) {
                 fields->userName = inputElement;
                 break;
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.cpp b/WebKit/chromium/src/WebPluginContainerImpl.cpp
index 7f74db2..58deecc 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.cpp
+++ b/WebKit/chromium/src/WebPluginContainerImpl.cpp
@@ -48,6 +48,7 @@
 #include "WebURLError.h"
 #include "WebURLRequest.h"
 #include "WebVector.h"
+#include "WebViewImpl.h"
 #include "WrappedResourceResponse.h"
 
 #include "EventNames.h"
@@ -348,6 +349,12 @@ void WebPluginContainerImpl::loadFrameRequest(
         SendReferrer);
 }
 
+void WebPluginContainerImpl::zoomLevelChanged(double zoomLevel)
+{
+    WebViewImpl* view = WebViewImpl::fromPage(m_element->document()->frame()->page());
+    view->fullFramePluginZoomLevelChanged(zoomLevel);
+}
+
 void WebPluginContainerImpl::didReceiveResponse(const ResourceResponse& response)
 {
     // Make sure that the plugin receives window geometry before data, or else
@@ -461,6 +468,16 @@ void WebPluginContainerImpl::handleKeyboardEvent(KeyboardEvent* event)
         }
     }
 
+    const WebInputEvent* currentInputEvent = WebViewImpl::currentInputEvent();
+
+    // Copy stashed info over, and only copy here in order not to interfere
+    // the ctrl-c logic above.
+    if (currentInputEvent
+        && WebInputEvent::isKeyboardEventType(currentInputEvent->type)) {
+        webEvent.modifiers |= currentInputEvent->modifiers &
+            (WebInputEvent::CapsLockOn | WebInputEvent::NumLockOn);
+    }
+
     WebCursorInfo cursorInfo;
     if (m_webPlugin->handleInputEvent(webEvent, cursorInfo))
         event->setDefaultHandled();
@@ -541,11 +558,20 @@ static bool checkStackOnTop(
                     return false;
             }
 
-            // For compatibility with IE: when the plugin is not positioned,
-            // it stacks behind the iframe, even if it's later in the
-            // document order.
-            if (ro2->style()->position() == StaticPosition)
+            // If the plugin does not have an explicit z-index it stacks behind the iframe.
+            // This is for maintaining compatibility with IE.
+            if (ro2->style()->position() == StaticPosition) {
+                // The 0'th elements of these RenderObject arrays represent the plugin node and
+                // the iframe.
+                const RenderObject* pluginRenderObject = pluginZstack[0];
+                const RenderObject* iframeRenderObject = iframeZstack[0];
+
+                if (pluginRenderObject->style() && iframeRenderObject->style()) {
+                    if (pluginRenderObject->style()->zIndex() > iframeRenderObject->style()->zIndex())
+                        return false;
+                }
                 return true;
+            }
 
             // Inspect the document order.  Later order means higher
             // stacking.
diff --git a/WebKit/chromium/src/WebPluginContainerImpl.h b/WebKit/chromium/src/WebPluginContainerImpl.h
index 2a46e00..27f5f2e 100644
--- a/WebKit/chromium/src/WebPluginContainerImpl.h
+++ b/WebKit/chromium/src/WebPluginContainerImpl.h
@@ -73,6 +73,7 @@ public:
     virtual void setParentVisible(bool);
     virtual void setParent(WebCore::ScrollView*);
     virtual void widgetPositionsUpdated();
+    virtual bool isPluginContainer() const { return true; }
 
     // WebPluginContainer methods
     virtual WebElement element();
@@ -83,6 +84,7 @@ public:
     virtual NPObject* scriptableObjectForElement();
     virtual WebString executeScriptURL(const WebURL&, bool popupsAllowed);
     virtual void loadFrameRequest(const WebURLRequest&, const WebString& target, bool notifyNeeded, void* notifyData);
+    virtual void zoomLevelChanged(double zoomLevel);
 
     // This cannot be null.
     WebPlugin* plugin() { return m_webPlugin; }
diff --git a/WebKit/chromium/src/WebResourceRawHeaders.cpp b/WebKit/chromium/src/WebResourceRawHeaders.cpp
new file mode 100644
index 0000000..259365e
--- /dev/null
+++ b/WebKit/chromium/src/WebResourceRawHeaders.cpp
@@ -0,0 +1,87 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebResourceRawHeaders.h"
+
+#include "ResourceRawHeaders.h"
+#include "ResourceResponse.h"
+#include "WebHTTPHeaderVisitor.h"
+#include "WebString.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebResourceRawHeaders::initialize()
+{
+    m_private = adoptRef(new ResourceRawHeaders());
+}
+
+void WebResourceRawHeaders::reset()
+{
+    m_private.reset();
+}
+
+void WebResourceRawHeaders::assign(const WebResourceRawHeaders& r)
+{
+    m_private = r.m_private;
+}
+
+WebResourceRawHeaders::WebResourceRawHeaders(WTF::PassRefPtr<WebCore::ResourceRawHeaders> value)
+{
+    m_private = value;
+}
+
+WebResourceRawHeaders::operator WTF::PassRefPtr<WebCore::ResourceRawHeaders>() const
+{
+    return m_private.get();
+}
+
+static void addHeader(HTTPHeaderMap* map, const WebString& name, const WebString& value)
+{
+    pair<HTTPHeaderMap::iterator, bool> result = map->add(name, value);
+    if (!result.second)
+        result.first->second += String("\n") + value;
+}
+
+void WebResourceRawHeaders::addRequestHeader(const WebString& name, const WebString& value)
+{
+    ASSERT(!m_private.isNull());
+    addHeader(&m_private->requestHeaders, name, value);
+}
+
+void WebResourceRawHeaders::addResponseHeader(const WebString& name, const WebString& value)
+{
+    ASSERT(!m_private.isNull());
+    addHeader(&m_private->responseHeaders, name, value);
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebRuntimeFeatures.cpp b/WebKit/chromium/src/WebRuntimeFeatures.cpp
index 2279eeb..edb0413 100644
--- a/WebKit/chromium/src/WebRuntimeFeatures.cpp
+++ b/WebKit/chromium/src/WebRuntimeFeatures.cpp
@@ -171,14 +171,14 @@ bool WebRuntimeFeatures::isGeolocationEnabled()
 void WebRuntimeFeatures::enableIndexedDatabase(bool enable)
 {
 #if ENABLE(INDEXED_DATABASE)
-    RuntimeEnabledFeatures::setIndexedDBEnabled(enable);
+    RuntimeEnabledFeatures::setWebkitIndexedDBEnabled(enable);
 #endif
 }
 
 bool WebRuntimeFeatures::isIndexedDatabaseEnabled()
 {
 #if ENABLE(INDEXED_DATABASE)
-    return RuntimeEnabledFeatures::indexedDBEnabled();
+    return RuntimeEnabledFeatures::webkitIndexedDBEnabled();
 #else
     return false;
 #endif
diff --git a/WebKit/chromium/src/WebScriptController.cpp b/WebKit/chromium/src/WebScriptController.cpp
index 8877ba0..0aa11a6 100644
--- a/WebKit/chromium/src/WebScriptController.cpp
+++ b/WebKit/chromium/src/WebScriptController.cpp
@@ -46,18 +46,6 @@ void WebScriptController::registerExtension(v8::Extension* extension)
     V8Proxy::registerExtension(extension);
 }
 
-void WebScriptController::registerExtension(v8::Extension* extension,
-                                            const WebString& schemeRestriction)
-{
-    V8Proxy::registerExtension(extension, schemeRestriction);
-}
-
-void WebScriptController::registerExtension(v8::Extension* extension,
-                                            int extensionGroup)
-{
-    V8Proxy::registerExtension(extension, extensionGroup);
-}
-
 void WebScriptController::enableV8SingleThreadMode()
 {
     enableStringImplCache();
diff --git a/WebKit/chromium/src/WebSearchableFormData.cpp b/WebKit/chromium/src/WebSearchableFormData.cpp
index 5fc51ca..50192eb 100644
--- a/WebKit/chromium/src/WebSearchableFormData.cpp
+++ b/WebKit/chromium/src/WebSearchableFormData.cpp
@@ -166,26 +166,19 @@ bool HasSuitableTextElement(const HTMLFormElement* form, Vector<char>* encodedSt
 
         bool isTextElement = false;
         if (formElement->hasTagName(HTMLNames::inputTag)) {
-            if (static_cast<const HTMLInputElement*>(formElement)->isFileUpload()) {
+            const HTMLInputElement* input = static_cast<const HTMLInputElement*>(formElement);
+            if (input->isFileUpload()) {
                 // Too big, don't try to index this.
                 return 0;
             }
 
-            if (static_cast<const HTMLInputElement*>(formElement)->isPasswordField()) {
+            if (input->isPasswordField()) {
                 // Don't store passwords! This is most likely an https anyway.
                 return 0;
             }
 
-            // FIXME: This needs to use a function on HTMLInputElement other than deprecatedInputType.
-            // Also, it's not clear why TEXT should be handled differently than, say, SEARCH.
-            switch (static_cast<const HTMLInputElement*>(formElement)->deprecatedInputType()) {
-            case HTMLInputElement::TEXT:
-            case HTMLInputElement::ISINDEX:
+            if (input->isTextField())
                 isTextElement = true;
-                break;
-            default:
-                break;
-            }
       }
 
       FormDataList dataList(encoding);
diff --git a/WebKit/chromium/src/WebThreadSafeData.cpp b/WebKit/chromium/src/WebThreadSafeData.cpp
new file mode 100755
index 0000000..facaba3
--- /dev/null
+++ b/WebKit/chromium/src/WebThreadSafeData.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebThreadSafeData.h"
+
+#include "BlobData.h"
+
+using namespace WebCore;
+
+namespace WebKit {
+
+void WebThreadSafeData::reset()
+{
+    m_private.reset();
+}
+
+void WebThreadSafeData::assign(const WebThreadSafeData& other)
+{
+    m_private = other.m_private;
+}
+
+size_t WebThreadSafeData::size() const
+{
+    if (m_private.isNull())
+        return 0;
+    return m_private->length();
+}
+
+const char* WebThreadSafeData::data() const
+{
+    if (m_private.isNull())
+        return 0;
+    return m_private->data();
+}
+
+WebThreadSafeData::WebThreadSafeData(const PassRefPtr<RawData>& data)
+    : m_private(data.releaseRef())
+{
+}
+
+WebThreadSafeData& WebThreadSafeData::operator=(const PassRefPtr<RawData>& data)
+{
+    m_private = data;
+    return *this;
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/src/WebURLRequest.cpp b/WebKit/chromium/src/WebURLRequest.cpp
index 2950076..b243420 100644
--- a/WebKit/chromium/src/WebURLRequest.cpp
+++ b/WebKit/chromium/src/WebURLRequest.cpp
@@ -201,6 +201,16 @@ bool WebURLRequest::reportLoadTiming() const
     return m_private->m_resourceRequest->reportLoadTiming();
 }
 
+void WebURLRequest::setReportRawHeaders(bool reportRawHeaders)
+{
+    m_private->m_resourceRequest->setReportRawHeaders(reportRawHeaders);
+}
+
+bool WebURLRequest::reportRawHeaders() const
+{
+    return m_private->m_resourceRequest->reportRawHeaders();
+}
+
 void WebURLRequest::setReportLoadTiming(bool reportLoadTiming)
 {
     m_private->m_resourceRequest->setReportLoadTiming(reportLoadTiming);
diff --git a/WebKit/chromium/src/WebURLResponse.cpp b/WebKit/chromium/src/WebURLResponse.cpp
index aae413c..5343921 100644
--- a/WebKit/chromium/src/WebURLResponse.cpp
+++ b/WebKit/chromium/src/WebURLResponse.cpp
@@ -129,6 +129,16 @@ void WebURLResponse::setLoadTiming(const WebURLLoadTiming& timing)
     m_private->m_resourceResponse->setResourceLoadTiming(loadTiming.release());
 }
 
+WebResourceRawHeaders WebURLResponse::resourceRawHeaders()
+{
+    return WebResourceRawHeaders(m_private->m_resourceResponse->resourceRawHeaders());
+}
+
+void WebURLResponse::setResourceRawHeaders(const WebResourceRawHeaders& value)
+{
+    m_private->m_resourceResponse->setResourceRawHeaders(value);
+}
+
 double WebURLResponse::responseTime() const
 {
     return m_private->m_resourceResponse->responseTime();
diff --git a/WebKit/chromium/src/WebURLResponsePrivate.h b/WebKit/chromium/src/WebURLResponsePrivate.h
index dc5ce22..4181e4c 100644
--- a/WebKit/chromium/src/WebURLResponsePrivate.h
+++ b/WebKit/chromium/src/WebURLResponsePrivate.h
@@ -31,6 +31,7 @@
 #ifndef WebURLResponsePrivate_h
 #define WebURLResponsePrivate_h
 
+#include "WebResourceRawHeaders.h"
 #include "WebString.h"
 
 namespace WebCore { class ResourceResponse; }
diff --git a/WebKit/chromium/src/WebViewImpl.cpp b/WebKit/chromium/src/WebViewImpl.cpp
index c3df0c7..aeab400 100644
--- a/WebKit/chromium/src/WebViewImpl.cpp
+++ b/WebKit/chromium/src/WebViewImpl.cpp
@@ -88,7 +88,6 @@
 #include "SecurityOrigin.h"
 #include "SelectionController.h"
 #include "Settings.h"
-#include "SharedGraphicsContext3D.h"
 #include "Timer.h"
 #include "TypingCommand.h"
 #include "UserGestureIndicator.h"
@@ -143,9 +142,10 @@ namespace WebKit {
 // zooms text in or out (ie., change by 20%).  The min and max values limit
 // text zoom to half and 3x the original text size.  These three values match
 // those in Apple's port in WebKit/WebKit/WebView/WebView.mm
-static const double textSizeMultiplierRatio = 1.2;
-static const double minTextSizeMultiplier = 0.5;
-static const double maxTextSizeMultiplier = 3.0;
+const double WebView::textSizeMultiplierRatio = 1.2;
+const double WebView::minTextSizeMultiplier = 0.5;
+const double WebView::maxTextSizeMultiplier = 3.0;
+
 
 // The group name identifies a namespace of pages.  Page group is used on OSX
 // for some programs that use HTML views to display things that don't seem like
@@ -250,7 +250,8 @@ WebViewImpl::WebViewImpl(WebViewClient* client, WebDevToolsAgentClient* devTools
     , m_newNavigationLoader(0)
 #endif
     , m_zoomLevel(0)
-    , m_zoomTextOnly(false)
+    , m_minimumZoomLevel(zoomFactorToZoomLevel(minTextSizeMultiplier))
+    , m_maximumZoomLevel(zoomFactorToZoomLevel(maxTextSizeMultiplier))
     , m_contextMenuAllowed(false)
     , m_doingDragAndDrop(false)
     , m_ignoreInputEvents(false)
@@ -985,7 +986,7 @@ void WebViewImpl::doPixelReadbackToCanvas(WebCanvas* canvas, const IntRect& rect
         gc.scale(FloatSize(1.0f, -1.0f));
         // Use invertRect in next line, so that transform above inverts it back to
         // desired destination rect.
-        gc.drawImageBuffer(imageBuffer.get(), DeviceColorSpace, invertRect.location());
+        gc.drawImageBuffer(imageBuffer.get(), ColorSpaceDeviceRGB, invertRect.location());
         gc.restore();
     }
 }
@@ -1481,6 +1482,10 @@ void WebViewImpl::setInitialFocus(bool reverse)
     keyboardEvent.windowsKeyCode = 0x09;
     PlatformKeyboardEventBuilder platformEvent(keyboardEvent);
     RefPtr<KeyboardEvent> webkitEvent = KeyboardEvent::create(platformEvent, 0);
+
+    Frame* frame = page()->focusController()->focusedOrMainFrame();
+    if (Document* document = frame->document())
+        document->setFocusedNode(0);
     page()->focusController()->setInitialFocus(
         reverse ? FocusDirectionBackward : FocusDirectionForward,
         webkitEvent.get());
@@ -1520,36 +1525,69 @@ void WebViewImpl::clearFocusedNode()
     }
 }
 
-int WebViewImpl::zoomLevel()
+void WebViewImpl::scrollFocusedNodeIntoView()
+{
+    Node* focusedNode = focusedWebCoreNode();
+    if (focusedNode && focusedNode->isElementNode()) {
+        Element* elementNode = static_cast<Element*>(focusedNode);
+        elementNode->scrollIntoViewIfNeeded(true);
+    }
+}
+
+double WebViewImpl::zoomLevel()
 {
     return m_zoomLevel;
 }
 
-int WebViewImpl::setZoomLevel(bool textOnly, int zoomLevel)
+double WebViewImpl::setZoomLevel(bool textOnly, double zoomLevel)
 {
-    float zoomFactor = static_cast<float>(
-        std::max(std::min(std::pow(textSizeMultiplierRatio, zoomLevel),
-                          maxTextSizeMultiplier),
-                 minTextSizeMultiplier));
+    if (zoomLevel < m_minimumZoomLevel)
+        m_zoomLevel = m_minimumZoomLevel;
+    else if (zoomLevel > m_maximumZoomLevel)
+        m_zoomLevel = m_maximumZoomLevel;
+    else
+        m_zoomLevel = zoomLevel;
+
     Frame* frame = mainFrameImpl()->frame();
+    WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
+    if (pluginContainer)
+        pluginContainer->plugin()->setZoomLevel(m_zoomLevel, textOnly);
+    else {
+        double zoomFactor = zoomLevelToZoomFactor(m_zoomLevel);
+        if (textOnly)
+            frame->setPageAndTextZoomFactors(1, zoomFactor);
+        else
+            frame->setPageAndTextZoomFactors(zoomFactor, 1);
+    }
+    return m_zoomLevel;
+}
 
-    float oldZoomFactor = m_zoomTextOnly ? frame->textZoomFactor() : frame->pageZoomFactor();
+void WebViewImpl::zoomLimitsChanged(double minimumZoomLevel,
+                                    double maximumZoomLevel)
+{
+    m_minimumZoomLevel = minimumZoomLevel;
+    m_maximumZoomLevel = maximumZoomLevel;
+    m_client->zoomLimitsChanged(m_minimumZoomLevel, m_maximumZoomLevel);
+}
 
-    if (textOnly)
-        frame->setPageAndTextZoomFactors(1, zoomFactor);
-    else
-        frame->setPageAndTextZoomFactors(zoomFactor, 1);
+void WebViewImpl::fullFramePluginZoomLevelChanged(double zoomLevel)
+{
+    if (zoomLevel == m_zoomLevel)
+        return;
 
-    if (oldZoomFactor != zoomFactor || textOnly != m_zoomTextOnly) {
-        WebPluginContainerImpl* pluginContainer = WebFrameImpl::pluginContainerFromFrame(frame);
-        if (pluginContainer)
-            pluginContainer->plugin()->setZoomFactor(zoomFactor, textOnly);
-    }
+    m_zoomLevel = std::max(std::min(zoomLevel, m_maximumZoomLevel), m_minimumZoomLevel);
+    m_client->zoomLevelChanged();
+}
 
-    m_zoomLevel = zoomLevel;
-    m_zoomTextOnly = textOnly;
+double WebView::zoomLevelToZoomFactor(double zoomLevel)
+{
+    return std::pow(textSizeMultiplierRatio, zoomLevel);
+}
 
-    return m_zoomLevel;
+double WebView::zoomFactorToZoomLevel(double factor)
+{
+    // Since factor = 1.2^level, level = log(factor) / log(1.2)
+    return log(factor) / log(textSizeMultiplierRatio);
 }
 
 void WebViewImpl::performMediaPlayerAction(const WebMediaPlayerAction& action,
@@ -1652,6 +1690,21 @@ WebDragOperation WebViewImpl::dragTargetDragEnter(
     return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
 }
 
+WebDragOperation WebViewImpl::dragTargetDragEnterNew(
+    int identity,
+    const WebPoint& clientPoint,
+    const WebPoint& screenPoint,
+    WebDragOperationsMask operationsAllowed)
+{
+    ASSERT(!m_currentDragData.get());
+
+    m_currentDragData = ChromiumDataObject::createReadable(Clipboard::DragAndDrop);
+    m_dragIdentity = identity;
+    m_operationsAllowed = operationsAllowed;
+
+    return dragTargetDragEnterOrOver(clientPoint, screenPoint, DragEnter);
+}
+
 WebDragOperation WebViewImpl::dragTargetDragOver(
     const WebPoint& clientPoint,
     const WebPoint& screenPoint,
@@ -2228,10 +2281,11 @@ void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect&
         return;
 
     IntRect contentRect = view->visibleContentRect(false);
+    IntRect screenRect = view->contentsToWindow(contentRect);
 
     // We support fast scrolling in one direction at a time.
     if (scrollDelta.width() && scrollDelta.height()) {
-        invalidateRootLayerRect(WebRect(contentRect));
+        invalidateRootLayerRect(WebRect(screenRect));
         return;
     }
 
@@ -2241,29 +2295,43 @@ void WebViewImpl::scrollRootLayerRect(const IntSize& scrollDelta, const IntRect&
     IntRect damagedContentsRect;
     if (scrollDelta.width()) {
         int dx = scrollDelta.width();
-        damagedContentsRect.setY(contentRect.y());
-        damagedContentsRect.setHeight(contentRect.height());
+        damagedContentsRect.setY(screenRect.y());
+        damagedContentsRect.setHeight(screenRect.height());
         if (dx > 0) {
-            damagedContentsRect.setX(contentRect.x());
+            damagedContentsRect.setX(screenRect.x());
             damagedContentsRect.setWidth(dx);
         } else {
-            damagedContentsRect.setX(contentRect.right() + dx);
+            damagedContentsRect.setX(screenRect.right() + dx);
             damagedContentsRect.setWidth(-dx);
         }
     } else {
         int dy = scrollDelta.height();
-        damagedContentsRect.setX(contentRect.x());
-        damagedContentsRect.setWidth(contentRect.width());
+        damagedContentsRect.setX(screenRect.x());
+        damagedContentsRect.setWidth(screenRect.width());
         if (dy > 0) {
-            damagedContentsRect.setY(contentRect.y());
+            damagedContentsRect.setY(screenRect.y());
             damagedContentsRect.setHeight(dy);
         } else {
-            damagedContentsRect.setY(contentRect.bottom() + dy);
+            damagedContentsRect.setY(screenRect.bottom() + dy);
             damagedContentsRect.setHeight(-dy);
         }
     }
 
     m_rootLayerScrollDamage.unite(damagedContentsRect);
+
+    // Scroll any existing damage that intersects with clip rect
+    if (clipRect.intersects(m_rootLayerDirtyRect)) {
+        // Find the inner damage
+        IntRect innerDamage(clipRect);
+        innerDamage.intersect(m_rootLayerDirtyRect);
+
+        // Move the damage
+        innerDamage.move(scrollDelta.width(), scrollDelta.height());
+        
+        // Merge it back into the damaged rect
+        m_rootLayerDirtyRect.unite(innerDamage);
+    }
+
     setRootLayerNeedsDisplay();
 }
 
@@ -2278,15 +2346,10 @@ void WebViewImpl::invalidateRootLayerRect(const IntRect& rect)
 
     if (!page())
         return;
-    FrameView* view = page()->mainFrame()->view();
-
-    // rect is in viewport space. Convert to content space
-    // so that invalidations and scroll invalidations play well with one-another.
-    IntRect contentRect = view->windowToContents(rect);
 
     // FIXME: add a smarter damage aggregation logic and/or unify with 
     // LayerChromium's damage logic
-    m_rootLayerDirtyRect.unite(contentRect);
+    m_rootLayerDirtyRect.unite(rect);
     setRootLayerNeedsDisplay();
 }
 
@@ -2306,7 +2369,7 @@ void WebViewImpl::setIsAcceleratedCompositingActive(bool active)
         return;
     }
 
-    OwnPtr<GraphicsContext3D> context = m_temporaryOnscreenGraphicsContext3D.release();
+    RefPtr<GraphicsContext3D> context = m_temporaryOnscreenGraphicsContext3D.release();
     if (!context) {
         context = GraphicsContext3D::create(GraphicsContext3D::Attributes(), m_page->chrome(), GraphicsContext3D::RenderDirectlyToHostWindow);
         if (context)
@@ -2396,10 +2459,7 @@ void WebViewImpl::doComposite()
     damageRects.append(m_rootLayerScrollDamage);
     damageRects.append(m_rootLayerDirtyRect);
     for (size_t i = 0; i < damageRects.size(); ++i) {
-        // The damage rect for the root layer is in content space [e.g. unscrolled].
-        // Convert from content space to viewPort space.
-        const IntRect damagedContentRect = damageRects[i];
-        IntRect damagedRect = view->contentsToWindow(damagedContentRect);
+        IntRect damagedRect = damageRects[i];
 
         // Intersect this rectangle with the viewPort.
         damagedRect.intersect(viewPort);
@@ -2419,19 +2479,6 @@ void WebViewImpl::doComposite()
 #endif
 
 
-SharedGraphicsContext3D* WebViewImpl::getSharedGraphicsContext3D()
-{
-    if (!m_sharedContext3D) {
-        GraphicsContext3D::Attributes attr;
-        OwnPtr<GraphicsContext3D> context = GraphicsContext3D::create(attr, m_page->chrome());
-        if (!context)
-            return 0;
-        m_sharedContext3D = SharedGraphicsContext3D::create(context.release());
-    }
-
-    return m_sharedContext3D.get();
-}
-
 WebGraphicsContext3D* WebViewImpl::graphicsContext3D()
 {
 #if USE(ACCELERATED_COMPOSITING)
diff --git a/WebKit/chromium/src/WebViewImpl.h b/WebKit/chromium/src/WebViewImpl.h
index 9db914d..050b5e1 100644
--- a/WebKit/chromium/src/WebViewImpl.h
+++ b/WebKit/chromium/src/WebViewImpl.h
@@ -132,8 +132,11 @@ public:
     virtual void setFocusedFrame(WebFrame* frame);
     virtual void setInitialFocus(bool reverse);
     virtual void clearFocusedNode();
-    virtual int zoomLevel();
-    virtual int setZoomLevel(bool textOnly, int zoomLevel);
+    virtual void scrollFocusedNodeIntoView();
+    virtual double zoomLevel();
+    virtual double setZoomLevel(bool textOnly, double zoomLevel);
+    virtual void zoomLimitsChanged(double minimumZoomLevel,
+                                   double maximumZoomLevel);
     virtual void performMediaPlayerAction(
         const WebMediaPlayerAction& action,
         const WebPoint& location);
@@ -152,6 +155,11 @@ public:
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
         WebDragOperationsMask operationsAllowed);
+    virtual WebDragOperation dragTargetDragEnterNew(
+        int identity,
+        const WebPoint& clientPoint,
+        const WebPoint& screenPoint,
+        WebDragOperationsMask operationsAllowed);
     virtual WebDragOperation dragTargetDragOver(
         const WebPoint& clientPoint,
         const WebPoint& screenPoint,
@@ -338,17 +346,19 @@ public:
     // WebGL. Returns 0 if compositing support is not compiled in.
     virtual WebGraphicsContext3D* graphicsContext3D();
 
-    virtual WebCore::SharedGraphicsContext3D* getSharedGraphicsContext3D();
-
     WebCore::PopupContainer* selectPopup() const { return m_selectPopup.get(); }
 
-    bool zoomTextOnly() const { return m_zoomTextOnly; }
-
     // Returns true if the event leads to scrolling.
     static bool mapKeyCodeForScroll(int keyCode,
                                    WebCore::ScrollDirection* scrollDirection,
                                    WebCore::ScrollGranularity* scrollGranularity);
 
+    // Called by a full frame plugin inside this view to inform it that its
+    // zoom level has been updated.  The plugin should only call this function
+    // if the zoom change was triggered by the browser, it's only needed in case
+    // a plugin can update its own zoom, say because of its own UI.
+    void fullFramePluginZoomLevelChanged(double zoomLevel);
+
 private:
     friend class WebView;  // So WebView::Create can call our constructor
     friend class WTF::RefCounted<WebViewImpl>;
@@ -440,9 +450,11 @@ private:
 
     // Keeps track of the current zoom level. 0 means no zoom, positive numbers
     // mean zoom in, negative numbers mean zoom out.
-    int m_zoomLevel;
+    double m_zoomLevel;
+
+    double m_minimumZoomLevel;
 
-    bool m_zoomTextOnly;
+    double m_maximumZoomLevel;
 
     bool m_contextMenuAllowed;
 
@@ -536,10 +548,7 @@ private:
     // If we attempt to fetch the on-screen GraphicsContext3D before
     // the compositor has been turned on, we need to instantiate it
     // early. This member holds on to the GC3D in this case.
-    OwnPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
-
-    RefPtr<WebCore::SharedGraphicsContext3D> m_sharedContext3D;
-
+    RefPtr<WebCore::GraphicsContext3D> m_temporaryOnscreenGraphicsContext3D;
     OwnPtr<DeviceOrientationClientProxy> m_deviceOrientationClientProxy;
 };
 
diff --git a/WebKit/chromium/src/WebWorkerBase.cpp b/WebKit/chromium/src/WebWorkerBase.cpp
index 622f5c2..de4858c 100644
--- a/WebKit/chromium/src/WebWorkerBase.cpp
+++ b/WebKit/chromium/src/WebWorkerBase.cpp
@@ -237,13 +237,23 @@ bool WebWorkerBase::allowDatabase(WebFrame*, const WebString& name, const WebStr
 }
 
 #if ENABLE(FILE_SYSTEM)
-void WebWorkerBase::openFileSystem(WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks)
+void WebWorkerBase::openFileSystem(WebFileSystem::Type type, long long size, WebFileSystemCallbacks* callbacks, bool synchronous)
 {
+    WorkerRunLoop& runLoop = m_workerThread->runLoop();
     WorkerScriptController* controller = WorkerScriptController::controllerForContext();
     WorkerContext* workerContext = controller->workerContext();
 
+    // Create a unique mode for this openFileSystem call.
+    String mode = openFileSystemMode;
+    mode.append(String::number(runLoop.createUniqueId()));
+
     RefPtr<WorkerFileSystemCallbacksBridge> bridge = WorkerFileSystemCallbacksBridge::create(this, workerContext, callbacks);
-    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, openFileSystemMode);
+    bridge->postOpenFileSystemToMainThread(commonClient(), type, size, mode);
+
+    if (synchronous) {
+        if (runLoop.runInMode(workerContext, mode) == MessageQueueTerminated)
+            bridge->stop();
+    }
 }
 #endif
 
diff --git a/WebKit/chromium/src/WebWorkerBase.h b/WebKit/chromium/src/WebWorkerBase.h
index 1f4bc03..fe84bf7 100644
--- a/WebKit/chromium/src/WebWorkerBase.h
+++ b/WebKit/chromium/src/WebWorkerBase.h
@@ -93,7 +93,7 @@ public:
 
 #if ENABLE(FILE_SYSTEM)
     // Requests to open a file system for this worker. (Note that this is not the implementation for WebFrameClient::openFileSystem.)
-    void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*);
+    void openFileSystem(WebFileSystem::Type, long long size, WebFileSystemCallbacks*, bool synchronous);
 #endif
 
     // Executes the given task on the main thread.
diff --git a/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
new file mode 100644
index 0000000..1e70619
--- /dev/null
+++ b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.cpp
@@ -0,0 +1,155 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WorkerAsyncFileSystemChromium.h"
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystemCallbacks.h"
+#include "FileSystem.h"
+#include "NotImplemented.h"
+#include "WebFileSystem.h"
+#include "WebFileSystemCallbacksImpl.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebWorkerBase.h"
+#include "WorkerContext.h"
+#include "WorkerFileSystemCallbacksBridge.h"
+#include "WorkerScriptController.h"
+#include "WorkerThread.h"
+#include <wtf/text/CString.h>
+
+using namespace WebKit;
+
+namespace WebCore {
+
+static const char fileSystemOperationsMode[] = "fileSystemOperationsMode";
+
+WorkerAsyncFileSystemChromium::WorkerAsyncFileSystemChromium(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
+    : AsyncFileSystem(rootPath)
+    , m_scriptExecutionContext(context)
+    , m_webFileSystem(WebKit::webKitClient()->fileSystem())
+    , m_workerContext(static_cast<WorkerContext*>(context))
+    , m_synchronous(synchronous)
+{
+    ASSERT(m_webFileSystem);
+    ASSERT(m_scriptExecutionContext->isWorkerContext());
+
+    WorkerLoaderProxy* workerLoaderProxy = &m_workerContext->thread()->workerLoaderProxy();
+    m_worker = static_cast<WebWorkerBase*>(workerLoaderProxy);
+}
+
+WorkerAsyncFileSystemChromium::~WorkerAsyncFileSystemChromium()
+{
+}
+
+bool WorkerAsyncFileSystemChromium::waitForOperationToComplete()
+{
+    if (!m_bridgeForCurrentOperation.get())
+        return false;
+
+    RefPtr<WorkerFileSystemCallbacksBridge> bridge = m_bridgeForCurrentOperation.release();
+    if (m_workerContext->thread()->runLoop().runInMode(m_workerContext, m_modeForCurrentOperation) == MessageQueueTerminated) {
+        bridge->stop();
+        return false;
+    }
+    return true;
+}
+
+void WorkerAsyncFileSystemChromium::move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postMoveToMainThread(m_webFileSystem, sourcePath, destinationPath, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCopyToMainThread(m_webFileSystem, sourcePath, destinationPath, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postRemoveToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postRemoveRecursivelyToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postReadMetadataToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCreateFileToMainThread(m_webFileSystem, path, exclusive, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postCreateDirectoryToMainThread(m_webFileSystem, path, exclusive, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postFileExistsToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postDirectoryExistsToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    createWorkerFileSystemCallbacksBridge(callbacks)->postReadDirectoryToMainThread(m_webFileSystem, path, m_modeForCurrentOperation);
+}
+
+void WorkerAsyncFileSystemChromium::createWriter(AsyncFileWriterClient*, const String&, PassOwnPtr<AsyncFileSystemCallbacks>)
+{
+    notImplemented();
+}
+
+PassRefPtr<WorkerFileSystemCallbacksBridge> WorkerAsyncFileSystemChromium::createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks> callbacks)
+{
+    ASSERT(!m_synchronous || !m_bridgeForCurrentOperation.get());
+
+    m_modeForCurrentOperation = fileSystemOperationsMode;
+    m_modeForCurrentOperation.append(String::number(m_workerContext->thread()->runLoop().createUniqueId()));
+
+    m_bridgeForCurrentOperation = WorkerFileSystemCallbacksBridge::create(m_worker, m_scriptExecutionContext, new WebKit::WebFileSystemCallbacksImpl(callbacks));
+    return m_bridgeForCurrentOperation;
+}
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
diff --git a/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
new file mode 100644
index 0000000..0b4b708
--- /dev/null
+++ b/WebKit/chromium/src/WorkerAsyncFileSystemChromium.h
@@ -0,0 +1,95 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WorkerAsyncFileSystemChromium_h
+#define WorkerAsyncFileSystemChromium_h
+
+#if ENABLE(FILE_SYSTEM)
+
+#include "AsyncFileSystem.h"
+#include "PlatformString.h"
+#include <wtf/PassOwnPtr.h>
+#include <wtf/RefPtr.h>
+
+namespace WebKit {
+class WebFileSystem;
+class WebWorkerBase;
+class WorkerFileSystemCallbacksBridge;
+}
+
+namespace WebCore {
+
+class AsyncFileSystemCallbacks;
+class ScriptExecutionContext;
+class WorkerContext;
+
+class WorkerAsyncFileSystemChromium : public AsyncFileSystem {
+public:
+    static PassOwnPtr<AsyncFileSystem> create(ScriptExecutionContext* context, const String& rootPath, bool synchronous)
+    {
+        return adoptPtr(new WorkerAsyncFileSystemChromium(context, rootPath, synchronous));
+    }
+
+    virtual ~WorkerAsyncFileSystemChromium();
+
+    // Runs one pending operation (to wait for completion in the sync-mode).
+    virtual bool waitForOperationToComplete();
+
+    virtual void move(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void copy(const String& sourcePath, const String& destinationPath, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void remove(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void removeRecursively(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readMetadata(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createFile(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createDirectory(const String& path, bool exclusive, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void fileExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void directoryExists(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void readDirectory(const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+    virtual void createWriter(AsyncFileWriterClient* client, const String& path, PassOwnPtr<AsyncFileSystemCallbacks>);
+
+private:
+    WorkerAsyncFileSystemChromium(ScriptExecutionContext*, const String& rootPath, bool synchronous);
+
+    PassRefPtr<WebKit::WorkerFileSystemCallbacksBridge> createWorkerFileSystemCallbacksBridge(PassOwnPtr<AsyncFileSystemCallbacks>);
+
+    ScriptExecutionContext* m_scriptExecutionContext;
+    WebKit::WebFileSystem* m_webFileSystem;
+    WebKit::WebWorkerBase* m_worker;
+    WorkerContext* m_workerContext;
+    RefPtr<WebKit::WorkerFileSystemCallbacksBridge> m_bridgeForCurrentOperation;
+    String m_modeForCurrentOperation;
+    bool m_synchronous;
+};
+
+} // namespace WebCore
+
+#endif // ENABLE(FILE_SYSTEM)
+
+#endif // WorkerAsyncFileSystemChromium_h
diff --git a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
index d112886..6c31221 100644
--- a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
+++ b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.cpp
@@ -35,7 +35,9 @@
 
 #include "CrossThreadTask.h"
 #include "WebCommonWorkerClient.h"
+#include "WebFileInfo.h"
 #include "WebFileSystemCallbacks.h"
+#include "WebFileSystemEntry.h"
 #include "WebString.h"
 #include "WebWorkerBase.h"
 #include "WorkerContext.h"
@@ -44,6 +46,37 @@
 #include <wtf/MainThread.h>
 #include <wtf/Threading.h>
 
+namespace WebCore {
+
+template<> struct CrossThreadCopierBase<false, false, WebKit::WebFileInfo> {
+    typedef WebKit::WebFileInfo Type;
+    static Type copy(const WebKit::WebFileInfo& info)
+    {
+        // Perform per-field copy to make sure we don't do any (unexpected) non-thread safe copy here.
+        struct WebKit::WebFileInfo newInfo;
+        newInfo.modificationTime = info.modificationTime;
+        newInfo.length = info.length;
+        newInfo.type = info.type;
+        return newInfo;
+    }
+};
+
+template<> struct CrossThreadCopierBase<false, false, WebKit::WebVector<WebKit::WebFileSystemEntry> > {
+    typedef WebKit::WebVector<WebKit::WebFileSystemEntry> Type;
+    static Type copy(const WebKit::WebVector<WebKit::WebFileSystemEntry>& entries)
+    {
+        WebKit::WebVector<WebKit::WebFileSystemEntry> newEntries(entries.size());
+        for (size_t i = 0; i < entries.size(); ++i) {
+            String name = entries[i].name;
+            newEntries[i].isDirectory = entries[i].isDirectory;
+            newEntries[i].name = name.crossThreadString();
+        }
+        return newEntries;
+    }
+};
+
+}
+
 using namespace WebCore;
 
 namespace WebKit {
@@ -51,9 +84,11 @@ namespace WebKit {
 // FileSystemCallbacks that are to be dispatched on the main thread.
 class MainThreadFileSystemCallbacks : public WebFileSystemCallbacks {
 public:
-    static PassOwnPtr<MainThreadFileSystemCallbacks> create(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
+    // Callbacks are self-destructed and we always return leaked pointer here.
+    static MainThreadFileSystemCallbacks* createLeakedPtr(PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& mode)
     {
-        return adoptPtr(new MainThreadFileSystemCallbacks(bridge, mode));
+        OwnPtr<MainThreadFileSystemCallbacks> callbacks = adoptPtr(new MainThreadFileSystemCallbacks(bridge, mode));
+        return callbacks.leakPtr();
     }
 
     virtual ~MainThreadFileSystemCallbacks()
@@ -74,17 +109,20 @@ public:
 
     virtual void didSucceed()
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didSucceedOnMainThread(m_mode);
+        delete this;
     }
 
     virtual void didReadMetadata(const WebFileInfo& info)
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didReadMetadataOnMainThread(info, m_mode);
+        delete this;
     }
 
     virtual void didReadDirectory(const WebVector<WebFileSystemEntry>& entries, bool hasMore)
     {
-        WEBKIT_ASSERT_NOT_REACHED();
+        m_bridge->didReadDirectoryOnMainThread(entries, hasMore, m_mode);
+        delete this;
     }
 
 private:
@@ -114,33 +152,148 @@ void WorkerFileSystemCallbacksBridge::stop()
 
 void WorkerFileSystemCallbacksBridge::postOpenFileSystemToMainThread(WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, const String& mode)
 {
-    m_selfRef = this;
-    ASSERT(m_workerContext->isContextThread());
-    ASSERT(m_worker);
-    m_worker->dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, this, mode));
+    dispatchTaskToMainThread(createCallbackTask(&openFileSystemOnMainThread, commonClient, type, size, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postMoveToMainThread(WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&moveOnMainThread, fileSystem, sourcePath, destinationPath, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCopyToMainThread(WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&copyOnMainThread, fileSystem, sourcePath, destinationPath, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postRemoveToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&removeOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postRemoveRecursivelyToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&removeRecursivelyOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postReadMetadataToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&readMetadataOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCreateFileToMainThread(WebFileSystem* fileSystem, const String& path, bool exclusive, const String& mode)
+{
+    dispatchTaskToMainThread(createCallbackTask(&createFileOnMainThread, fileSystem, path, exclusive, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postCreateDirectoryToMainThread(WebFileSystem* fileSystem, const String& path, bool exclusive, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&createDirectoryOnMainThread, fileSystem, path, exclusive, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postFileExistsToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&fileExistsOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postDirectoryExistsToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&directoryExistsOnMainThread, fileSystem, path, this, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::postReadDirectoryToMainThread(WebFileSystem* fileSystem, const String& path, const String& mode)
+{
+    ASSERT(fileSystem);
+    dispatchTaskToMainThread(createCallbackTask(&readDirectoryOnMainThread, fileSystem, path, this, mode));
 }
 
 void WorkerFileSystemCallbacksBridge::openFileSystemOnMainThread(ScriptExecutionContext*, WebCommonWorkerClient* commonClient, WebFileSystem::Type type, long long size, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
 {
-    ASSERT(isMainThread());
     if (!commonClient)
         bridge->didFailOnMainThread(WebFileErrorAbort, mode);
     else {
-        // MainThreadFileSystemCallbacks is self-destructed, so we leak ptr here.
-        commonClient->openFileSystem(type, size, MainThreadFileSystemCallbacks::create(bridge, mode).leakPtr());
+        commonClient->openFileSystem(type, size, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
     }
 }
 
+void WorkerFileSystemCallbacksBridge::moveOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->move(sourcePath, destinationPath, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::copyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& sourcePath, const String& destinationPath, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->copy(sourcePath, destinationPath, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::removeOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->remove(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::removeRecursivelyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->removeRecursively(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::readMetadataOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->readMetadata(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::createFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->createFile(path, exclusive, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::createDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->createDirectory(path, exclusive, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->fileExists(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->directoryExists(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
+void WorkerFileSystemCallbacksBridge::readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem* fileSystem, const String& path, WorkerFileSystemCallbacksBridge* bridge, const String& mode)
+{
+    fileSystem->readDirectory(path, MainThreadFileSystemCallbacks::createLeakedPtr(bridge, mode));
+}
+
 void WorkerFileSystemCallbacksBridge::didFailOnMainThread(WebFileError error, const String& mode)
 {
-    ASSERT(isMainThread());
-    mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, m_selfRef, error), mode);
+    mayPostTaskToWorker(createCallbackTask(&didFailOnWorkerThread, this, error), mode);
 }
 
 void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnMainThread(const String& name, const String& rootPath, const String& mode)
 {
-    ASSERT(isMainThread());
-    mayPostTaskToWorker(createCallbackTask(&didOpenFileSystemOnWorkerThread, m_selfRef, name, rootPath), mode);
+    mayPostTaskToWorker(createCallbackTask(&didOpenFileSystemOnWorkerThread, this, name, rootPath), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didSucceedOnMainThread(const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didSucceedOnWorkerThread, this), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadMetadataOnMainThread(const WebFileInfo& info, const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didReadMetadataOnWorkerThread, this, info), mode);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadDirectoryOnMainThread(const WebVector<WebFileSystemEntry>& entries, bool hasMore, const String& mode)
+{
+    mayPostTaskToWorker(createCallbackTask(&didReadDirectoryOnWorkerThread, this, entries, hasMore), mode);
 }
 
 WorkerFileSystemCallbacksBridge::WorkerFileSystemCallbacksBridge(WebWorkerBase* worker, ScriptExecutionContext* scriptExecutionContext, WebFileSystemCallbacks* callbacks)
@@ -157,30 +310,79 @@ WorkerFileSystemCallbacksBridge::~WorkerFileSystemCallbacksBridge()
     ASSERT(!m_callbacksOnWorkerThread);
 }
 
-void WorkerFileSystemCallbacksBridge::didFailOnWorkerThread(ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, WebFileError error)
+void WorkerFileSystemCallbacksBridge::didFailOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, WebFileError error)
 {
-    if (bridge->m_callbacksOnWorkerThread) {
-        ASSERT(bridge->m_workerContext->isContextThread());
-        bridge->m_callbacksOnWorkerThread->didFail(error);
-        bridge->m_callbacksOnWorkerThread = 0;
-    }
+    bridge->m_callbacksOnWorkerThread->didFail(error);
 }
 
-void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnWorkerThread(ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, const String& name, const String& rootPath)
+void WorkerFileSystemCallbacksBridge::didOpenFileSystemOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const String& name, const String& rootPath)
 {
-    if (bridge->m_callbacksOnWorkerThread) {
-        ASSERT(bridge->m_workerContext->isContextThread());
-        bridge->m_callbacksOnWorkerThread->didOpenFileSystem(name, rootPath);
-        bridge->m_callbacksOnWorkerThread = 0;
+    bridge->m_callbacksOnWorkerThread->didOpenFileSystem(name, rootPath);
+}
+
+void WorkerFileSystemCallbacksBridge::didSucceedOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge)
+{
+    bridge->m_callbacksOnWorkerThread->didSucceed();
+}
+
+void WorkerFileSystemCallbacksBridge::didReadMetadataOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const WebFileInfo& info)
+{
+    bridge->m_callbacksOnWorkerThread->didReadMetadata(info);
+}
+
+void WorkerFileSystemCallbacksBridge::didReadDirectoryOnWorkerThread(ScriptExecutionContext*, WorkerFileSystemCallbacksBridge* bridge, const WebVector<WebFileSystemEntry>& entries, bool hasMore)
+{
+    bridge->m_callbacksOnWorkerThread->didReadDirectory(entries, hasMore);
+}
+
+bool WorkerFileSystemCallbacksBridge::derefIfWorkerIsStopped()
+{
+    WebWorkerBase* worker = 0;
+    {
+        MutexLocker locker(m_mutex);
+        worker = m_worker;
+    }
+
+    if (!worker) {
+        m_selfRef.clear();
+        return true;
     }
+    return false;
+}
+
+void WorkerFileSystemCallbacksBridge::runTaskOnMainThread(WebCore::ScriptExecutionContext* scriptExecutionContext, WorkerFileSystemCallbacksBridge* bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
+{
+    ASSERT(isMainThread());
+    if (bridge->derefIfWorkerIsStopped())
+        return;
+    taskToRun->performTask(scriptExecutionContext);
+}
+
+void WorkerFileSystemCallbacksBridge::runTaskOnWorkerThread(WebCore::ScriptExecutionContext* scriptExecutionContext, PassRefPtr<WorkerFileSystemCallbacksBridge> bridge, PassOwnPtr<WebCore::ScriptExecutionContext::Task> taskToRun)
+{
+    if (!bridge->m_callbacksOnWorkerThread)
+        return;
+    ASSERT(bridge->m_workerContext->isContextThread());
+    taskToRun->performTask(scriptExecutionContext);
+    bridge->m_callbacksOnWorkerThread = 0;
+}
+
+void WorkerFileSystemCallbacksBridge::dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task> task)
+{
+    ASSERT(!m_selfRef);
+    ASSERT(m_worker);
+    ASSERT(m_workerContext->isContextThread());
+    m_selfRef = this;
+    m_worker->dispatchTaskToMainThread(createCallbackTask(&runTaskOnMainThread, this, task));
 }
 
 void WorkerFileSystemCallbacksBridge::mayPostTaskToWorker(PassOwnPtr<ScriptExecutionContext::Task> task, const String& mode)
 {
+    ASSERT(isMainThread());
     { // Let go of the mutex before possibly deleting this due to m_selfRef.clear().
         MutexLocker locker(m_mutex);
         if (m_worker)
-            m_worker->postTaskForModeToWorkerContext(task, mode);
+            m_worker->postTaskForModeToWorkerContext(createCallbackTask(&runTaskOnWorkerThread, m_selfRef, task), mode);
     }
     m_selfRef.clear();
 }
diff --git a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
index 899127e..fa57f38 100644
--- a/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
+++ b/WebKit/chromium/src/WorkerFileSystemCallbacksBridge.h
@@ -68,10 +68,6 @@ struct WebFileSystemEntry;
 //      releases a self-reference to the bridge.
 class WorkerFileSystemCallbacksBridge : public ThreadSafeShared<WorkerFileSystemCallbacksBridge>, public WebCore::WorkerContext::Observer {
 public:
-    static PassRefPtr<WorkerFileSystemCallbacksBridge> create(WebWorkerBase* worker, WebCore::ScriptExecutionContext* workerContext, WebFileSystemCallbacks* callbacks)
-    {
-        return WTF::adoptRef(new WorkerFileSystemCallbacksBridge(worker, workerContext, callbacks));
-    }
     ~WorkerFileSystemCallbacksBridge();
 
     // WorkerContext::Observer method.
@@ -82,26 +78,64 @@ public:
 
     void stop();
 
-    // Posts an initial request task to the main thread. It is supposed to be called immediately after the bridge is constructed. (It doesn't check if the context has been stopped or not.)
+    static PassRefPtr<WorkerFileSystemCallbacksBridge> create(WebWorkerBase* worker, WebCore::ScriptExecutionContext* workerContext, WebFileSystemCallbacks* callbacks)
+    {
+        return adoptRef(new WorkerFileSystemCallbacksBridge(worker, workerContext, callbacks));
+    }
+
+    // Methods that create an instance and post an initial request task to the main thread. They must be called on the worker thread.
     void postOpenFileSystemToMainThread(WebCommonWorkerClient*, WebFileSystem::Type, long long size, const String& mode);
+    void postMoveToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
+    void postCopyToMainThread(WebFileSystem*, const String& srcPath, const String& destPath, const String& mode);
+    void postRemoveToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postRemoveRecursivelyToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postReadMetadataToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postCreateFileToMainThread(WebFileSystem*, const String& path, bool exclusive, const String& mode);
+    void postCreateDirectoryToMainThread(WebFileSystem*, const String& path, bool exclusive, const String& mode);
+    void postFileExistsToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postDirectoryExistsToMainThread(WebFileSystem*, const String& path, const String& mode);
+    void postReadDirectoryToMainThread(WebFileSystem*, const String& path, const String& mode);
 
     // Callback methods that are called on the main thread.
     void didFailOnMainThread(WebFileError, const String& mode);
     void didOpenFileSystemOnMainThread(const String& name, const String& rootPath, const String& mode);
+    void didSucceedOnMainThread(const String& mode);
+    void didReadMetadataOnMainThread(const WebFileInfo&, const String& mode);
+    void didReadDirectoryOnMainThread(const WebVector<WebFileSystemEntry>&, bool hasMore, const String& mode);
 
 private:
     WorkerFileSystemCallbacksBridge(WebWorkerBase*, WebCore::ScriptExecutionContext*, WebFileSystemCallbacks*);
 
-    // Method that is to be called on the main thread.
+    // Methods that are to be called on the main thread.
     static void openFileSystemOnMainThread(WebCore::ScriptExecutionContext*, WebCommonWorkerClient*, WebFileSystem::Type, long long size, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void moveOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void copyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& srcPath, const String& destPath, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void removeOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void removeRecursivelyOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void readMetadataOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void createFileOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void createDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, bool exclusive, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void fileExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void directoryExistsOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
+    static void readDirectoryOnMainThread(WebCore::ScriptExecutionContext*, WebFileSystem*, const String& path, WorkerFileSystemCallbacksBridge*, const String& mode);
 
     friend class MainThreadFileSystemCallbacks;
 
     // Methods that dispatch WebFileSystemCallbacks on the worker threads.
     // They release a selfRef of the WorkerFileSystemCallbacksBridge.
-    static void didFailOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, WebFileError);
-    static void didOpenFileSystemOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, const String& name, const String& rootPath);
+    static void didFailOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, WebFileError);
+    static void didOpenFileSystemOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const String& name, const String& rootPath);
+    static void didSucceedOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*);
+    static void didReadMetadataOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebFileInfo&);
+    static void didReadDirectoryOnWorkerThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, const WebVector<WebFileSystemEntry>&, bool hasMore);
+
+    // For early-exist; this deref's selfRef and returns true if the worker is already null.
+    bool derefIfWorkerIsStopped();
+
+    static void runTaskOnMainThread(WebCore::ScriptExecutionContext*, WorkerFileSystemCallbacksBridge*, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
+    static void runTaskOnWorkerThread(WebCore::ScriptExecutionContext*, PassRefPtr<WorkerFileSystemCallbacksBridge>, PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
 
+    void dispatchTaskToMainThread(PassOwnPtr<WebCore::ScriptExecutionContext::Task>);
     void mayPostTaskToWorker(PassOwnPtr<WebCore::ScriptExecutionContext::Task>, const String& mode);
 
     // m_selfRef keeps a reference to itself until a task is created for the worker thread (at which point the task holds the reference).
diff --git a/WebKit/chromium/src/gtk/WebInputEventFactory.cpp b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
index 0d55c43..71d1b39 100644
--- a/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
+++ b/WebKit/chromium/src/gtk/WebInputEventFactory.cpp
@@ -52,7 +52,7 @@ bool countsAsDoubleClick(gint timeDiff, gint xDiff, gint yDiff)
     gint doubleClickDistance = 5;
     g_object_get(G_OBJECT(settings),
                  "gtk-double-click-time", &doubleClickTime,
-                 "gtk-double-click-distance", &doubleClickDistance, 0);
+                 "gtk-double-click-distance", &doubleClickDistance, NULL);
     return timeDiff <= doubleClickTime && abs(xDiff) <= doubleClickDistance && abs(yDiff) <= doubleClickDistance;
 }
 
diff --git a/WebKit/chromium/src/js/DevTools.js b/WebKit/chromium/src/js/DevTools.js
index a66e174..4c23057 100644
--- a/WebKit/chromium/src/js/DevTools.js
+++ b/WebKit/chromium/src/js/DevTools.js
@@ -162,3 +162,25 @@ WebInspector.resetToolbarColors = function()
 
 }
 
+////////////////////////////////////////////////////////
+// Platform-specific WebInspector extensions support. //
+////////////////////////////////////////////////////////
+
+WebInspector.platformExtensionAPI = function(tabId)
+{
+    function getTabId()
+    {
+        return tabId;
+    }
+    webInspector.inspectedWindow.__proto__.__defineGetter__("tabId", getTabId);
+}
+
+WebInspector.buildPlatformExtensionAPI = function()
+{
+    return "(" + WebInspector.platformExtensionAPI + ")(" + WebInspector._inspectedTabId + ");";
+}
+
+WebInspector.setInspectedTabId = function(tabId)
+{
+    WebInspector._inspectedTabId = tabId;
+}
diff --git a/WebKit/chromium/tests/ArenaTestHelpers.h b/WebKit/chromium/tests/ArenaTestHelpers.h
index 87f827d..70936e5 100644
--- a/WebKit/chromium/tests/ArenaTestHelpers.h
+++ b/WebKit/chromium/tests/ArenaTestHelpers.h
@@ -28,6 +28,7 @@
 
 #include "PODArena.h"
 #include <gtest/gtest.h>
+#include <wtf/NotFound.h>
 #include <wtf/Vector.h>
 
 namespace WebCore {
@@ -52,7 +53,7 @@ public:
     virtual void free(void* ptr)
     {
         size_t slot = m_allocatedRegions.find(ptr);
-        ASSERT_GE(slot, 0);
+        ASSERT_NE(slot, notFound);
         m_allocatedRegions.remove(slot);
         PODArena::FastMallocAllocator::free(ptr);
     }
diff --git a/WebKit/chromium/tests/IDBKeyPathTest.cpp b/WebKit/chromium/tests/IDBKeyPathTest.cpp
index ac10f4f..6c378d6 100644
--- a/WebKit/chromium/tests/IDBKeyPathTest.cpp
+++ b/WebKit/chromium/tests/IDBKeyPathTest.cpp
@@ -58,7 +58,7 @@ void checkKeyPath(const String& keyPath, const Vector<IDBKeyPathElement>& expect
     if (error != IDBKeyPathParseErrorNone)
         return;
     ASSERT_EQ(expected.size(), idbKeyPathElements.size());
-    for (int i = 0; i < expected.size(); ++i) {
+    for (size_t i = 0; i < expected.size(); ++i) {
         ASSERT_TRUE(expected[i].type == idbKeyPathElements[i].type) << i;
         if (expected[i].type == IDBKeyPathElement::IsIndexed)
             ASSERT_EQ(expected[i].index, idbKeyPathElements[i].index) << i;
diff --git a/WebKit/chromium/tests/KURLTest.cpp b/WebKit/chromium/tests/KURLTest.cpp
index c46da2a..152dd31 100644
--- a/WebKit/chromium/tests/KURLTest.cpp
+++ b/WebKit/chromium/tests/KURLTest.cpp
@@ -37,13 +37,16 @@
 
 #include "KURL.h"
 
-namespace {
-
+namespace WTF {
 // Output stream operator so gTest's macros work with WebCore strings.
-std::ostream& operator<<(std::ostream& out, const WTF::String& str)
+std::ostream& operator<<(std::ostream& out, const String& str)
 {
     return str.isEmpty() ? out : out << str.utf8().data();
 }
+} // namespace WTF
+
+namespace {
+
 
 struct ComponentCase {
     const char* url;
diff --git a/WebKit/chromium/tests/PODIntervalTreeTest.cpp b/WebKit/chromium/tests/PODIntervalTreeTest.cpp
index 3a8a245..8241a89 100644
--- a/WebKit/chromium/tests/PODIntervalTreeTest.cpp
+++ b/WebKit/chromium/tests/PODIntervalTreeTest.cpp
@@ -41,15 +41,20 @@ using TreeTestHelpers::generateSeed;
 using TreeTestHelpers::initRandom;
 using TreeTestHelpers::nextRandom;
 
-inline String valueToString(const float& value)
-{
-    return String::number(value);
-}
+#ifndef NDEBUG
+template<>
+struct ValueToString<float> {
+    static String string(const float& value) { return String::number(value); }
+};
 
-inline String valueToString(void* const& value)
-{
-    return String::format("0x%p", value);
-}
+template<>
+struct ValueToString<void*> {
+    static String string(void* const& value)
+    {
+        return String::format("0x%p", value);
+    }
+};
+#endif
 
 TEST(PODIntervalTreeTest, TestInsertion)
 {
@@ -82,6 +87,16 @@ TEST(PODIntervalTreeTest, TestQueryAgainstZeroSizeInterval)
     EXPECT_EQ(4, result[0].high());
 }
 
+#ifndef NDEBUG
+template<>
+struct ValueToString<int*> {
+    static String string(int* const& value)
+    {
+        return String::format("0x%p", value);
+    }
+};
+#endif
+
 TEST(PODIntervalTreeTest, TestDuplicateElementInsertion)
 {
     PODIntervalTree<float, int*> tree;
@@ -113,13 +128,18 @@ public:
     int b;
 };
 
-inline String valueToString(const UserData1& value)
-{
-    return String("[UserData1 a=") + String::number(value.a) + " b=" + String::number(value.b) + "]";
-}
-
 } // anonymous namespace
 
+#ifndef NDEBUG
+template<>
+struct ValueToString<UserData1> {
+    static String string(const UserData1& value)
+    {
+        return String("[UserData1 a=") + String::number(value.a) + " b=" + String::number(value.b) + "]";
+    }
+};
+#endif
+
 TEST(PODIntervalTreeTest, TestInsertionOfComplexUserData)
 {
     PODIntervalTree<float, UserData1> tree;
@@ -165,13 +185,18 @@ private:
     bool operator!=(const EndpointType1& other);
 };
 
-inline String valueToString(const EndpointType1& value)
-{
-    return String("[EndpointType1 value=") + String::number(value.value()) + "]";
-}
-
 } // anonymous namespace
 
+#ifndef NDEBUG
+template<>
+struct ValueToString<EndpointType1> {
+    static String string(const EndpointType1& value)
+    {
+        return String("[EndpointType1 value=") + String::number(value.value()) + "]";
+    }
+};
+#endif
+
 TEST(PODIntervalTreeTest, TestTreeDoesNotRequireMostOperators)
 {
     PODIntervalTree<EndpointType1> tree;
@@ -179,9 +204,17 @@ TEST(PODIntervalTreeTest, TestTreeDoesNotRequireMostOperators)
     ASSERT_TRUE(tree.checkInvariants());
 }
 
-// Uncomment to debug a failure of the insertion and deletion test.
+// Uncomment to debug a failure of the insertion and deletion test. Won't work
+// in release builds.
 // #define DEBUG_INSERTION_AND_DELETION_TEST
 
+#ifndef NDEBUG
+template<>
+struct ValueToString<int> {
+    static String string(const int& value) { return String::number(value); }
+};
+#endif
+
 namespace {
 
 void InsertionAndDeletionTest(int32_t seed, int treeSize)
@@ -198,7 +231,7 @@ void InsertionAndDeletionTest(int32_t seed, int treeSize)
         PODInterval<int> interval(left, left + length);
         tree.add(interval);
 #ifdef DEBUG_INSERTION_AND_DELETION_TEST
-        LOG_ERROR("*** Adding element %s", valueToString(interval).ascii().data());
+        LOG_ERROR("*** Adding element %s", ValueToString<PODInterval<int> >::string(interval).ascii().data());
 #endif
         addedElements.append(interval);
     }
@@ -207,7 +240,7 @@ void InsertionAndDeletionTest(int32_t seed, int treeSize)
     for (int i = 0; i < treeSize / 2; i++) {
         int index = nextRandom(addedElements.size());
 #ifdef DEBUG_INSERTION_AND_DELETION_TEST
-        LOG_ERROR("*** Removing element %s", valueToString(addedElements[index]).ascii().data());
+        LOG_ERROR("*** Removing element %s", ValueToString<PODInterval<int> >::string(addedElements[index]).ascii().data());
 #endif
         ASSERT_TRUE(tree.contains(addedElements[index])) << "Test failed for seed " << seed;
         tree.remove(addedElements[index]);
@@ -227,7 +260,7 @@ void InsertionAndDeletionTest(int32_t seed, int treeSize)
         if (add) {
             int index = nextRandom(removedElements.size());
 #ifdef DEBUG_INSERTION_AND_DELETION_TEST
-            LOG_ERROR("*** Adding element %s", valueToString(removedElements[index]).ascii().data());
+            LOG_ERROR("*** Adding element %s", ValueToString<PODInterval<int> >::string(removedElements[index]).ascii().data());
 #endif
             tree.add(removedElements[index]);
             addedElements.append(removedElements[index]);
@@ -235,7 +268,7 @@ void InsertionAndDeletionTest(int32_t seed, int treeSize)
         } else {
             int index = nextRandom(addedElements.size());
 #ifdef DEBUG_INSERTION_AND_DELETION_TEST
-            LOG_ERROR("*** Removing element %s", valueToString(addedElements[index]).ascii().data());
+            LOG_ERROR("*** Removing element %s", ValueToString<PODInterval<int> >::string(addedElements[index]).ascii().data());
 #endif
             ASSERT_TRUE(tree.contains(addedElements[index])) << "Test failed for seed " << seed;
             ASSERT_TRUE(tree.remove(addedElements[index])) << "Test failed for seed " << seed;
diff --git a/WebKit/chromium/tests/RunAllTests.cpp b/WebKit/chromium/tests/RunAllTests.cpp
index cfcfbee..b213de7 100644
--- a/WebKit/chromium/tests/RunAllTests.cpp
+++ b/WebKit/chromium/tests/RunAllTests.cpp
@@ -35,13 +35,25 @@
 #include "WebKitClient.h"
 #include <webkit/support/webkit_support.h>
 
+#if defined(WIN32) && defined(WEBKIT_DLL_UNITTEST)
+#include "WebUnitTests.h"
+#endif
+
 int main(int argc, char** argv)
 {
     TestSuite testSuite(argc, argv);
     // TestSuite must be created before SetUpTestEnvironment so it performs
     // initializations needed by WebKit support.
     webkit_support::SetUpTestEnvironmentForUnitTests();
+
+#if defined(WIN32) && defined(WEBKIT_DLL_UNITTEST)
+    // For chromium multi-dll build, need to call webkit api to create a
+    // TestSuite instance in webkit.dll and run all tests from there.
+    int result = WebKit::RunAllUnitTests(argc, argv);
+#else
     int result = testSuite.Run();
+#endif
+
     webkit_support::TearDownTestEnvironment();
     return result;
 }
diff --git a/WebKit/chromium/tests/TransparencyWinTest.cpp b/WebKit/chromium/tests/TransparencyWinTest.cpp
index b83c2a9..ed7f12f 100644
--- a/WebKit/chromium/tests/TransparencyWinTest.cpp
+++ b/WebKit/chromium/tests/TransparencyWinTest.cpp
@@ -103,7 +103,7 @@ static std::ostream& operator<<(std::ostream& out, const Color& c)
 
 TEST(TransparencyWin, NoLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(17, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(17, 16), ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -142,7 +142,7 @@ TEST(TransparencyWin, NoLayer)
 
 TEST(TransparencyWin, WhiteLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -194,7 +194,7 @@ TEST(TransparencyWin, WhiteLayer)
 
 TEST(TransparencyWin, TextComposite)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // KeepTransform is the only valid transform mode for TextComposite.
     {
@@ -213,7 +213,7 @@ TEST(TransparencyWin, TextComposite)
 
 TEST(TransparencyWin, OpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // KeepTransform
     {
@@ -283,7 +283,7 @@ TEST(TransparencyWin, OpaqueCompositeLayer)
 TEST(TransparencyWin, WhiteLayerPixelTest)
 {
     // Make a total transparent buffer, and draw the white layer inset by 1 px.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     {
         TransparencyWin helper;
@@ -312,13 +312,13 @@ TEST(TransparencyWin, OpaqueCompositeLayerPixel)
     Color green(0xFF00FF00);
 
     // Make a red bottom layer, followed by a half green next layer @ 50%.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     FloatRect fullRect(0, 0, 16, 16);
-    src->context()->fillRect(fullRect, red, DeviceColorSpace);
+    src->context()->fillRect(fullRect, red, ColorSpaceDeviceRGB);
     src->context()->beginTransparencyLayer(0.5);
     FloatRect rightHalf(8, 0, 8, 16);
-    src->context()->fillRect(rightHalf, green, DeviceColorSpace);
+    src->context()->fillRect(rightHalf, green, ColorSpaceDeviceRGB);
 
     // Make a transparency layer inset by one pixel, and fill it inset by
     // another pixel with 50% black.
@@ -330,7 +330,7 @@ TEST(TransparencyWin, OpaqueCompositeLayerPixel)
                     IntRect(1, 1, 14, 14));
 
         FloatRect inner(2, 2, 12, 12);
-        helper.context()->fillRect(inner, Color(0x7f000000), DeviceColorSpace);
+        helper.context()->fillRect(inner, Color(0x7f000000), ColorSpaceDeviceRGB);
         // These coordinates are relative to the layer, whish is inset by 1x1
         // pixels from the top left. So we're actually clearing (2, 2) and
         // (13,13), which are the extreme corners of the black area (and which
@@ -365,10 +365,10 @@ TEST(TransparencyWin, OpaqueCompositeLayerPixel)
 TEST(TransparencyWin, TranslateOpaqueCompositeLayer)
 {
     // Fill with white.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
     Color white(0xFFFFFFFF);
     FloatRect fullRect(0, 0, 16, 16);
-    src->context()->fillRect(fullRect, white, DeviceColorSpace);
+    src->context()->fillRect(fullRect, white, ColorSpaceDeviceRGB);
 
     // Scroll down by 8 (coordinate system goes up).
     src->context()->save();
@@ -388,7 +388,7 @@ TEST(TransparencyWin, TranslateOpaqueCompositeLayer)
         // Draw a red pixel at (15, 15). This should be the at (15, 7) after
         // the transform.
         FloatRect bottomRight(15, 15, 1, 1);
-        helper.context()->fillRect(bottomRight, green, DeviceColorSpace);
+        helper.context()->fillRect(bottomRight, green, ColorSpaceDeviceRGB);
         helper.composite();
     }
 
@@ -402,12 +402,12 @@ TEST(TransparencyWin, TranslateOpaqueCompositeLayer)
 // tests that the propert transform is applied to the copied layer.
 TEST(TransparencyWin, RotateOpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // The background is white.
     Color white(0xFFFFFFFF);
     FloatRect fullRect(0, 0, 16, 16);
-    src->context()->fillRect(fullRect, white, DeviceColorSpace);
+    src->context()->fillRect(fullRect, white, ColorSpaceDeviceRGB);
 
     // Rotate the image by 90 degrees. This matrix is the same as
     // cw90.rotate(90); but avoids rounding errors. Rounding errors can cause
@@ -425,7 +425,7 @@ TEST(TransparencyWin, RotateOpaqueCompositeLayer)
     src->context()->beginTransparencyLayer(0.5);
     FloatRect blackRect(0, -9, 16, 2);
     Color black(0xFF000000);
-    src->context()->fillRect(blackRect, black, DeviceColorSpace);
+    src->context()->fillRect(blackRect, black, ColorSpaceDeviceRGB);
 
     // Now draw 50% red square.
     {
@@ -439,7 +439,7 @@ TEST(TransparencyWin, RotateOpaqueCompositeLayer)
                     IntRect(1, -15, 14, 14));
 
         // Fill with red.
-        helper.context()->fillRect(helper.drawRect(), Color(0x7f7f0000), DeviceColorSpace);
+        helper.context()->fillRect(helper.drawRect(), Color(0x7f7f0000), ColorSpaceDeviceRGB);
         clearTopLayerAlphaChannel(helper.context());
         helper.composite();
     }
@@ -481,15 +481,15 @@ TEST(TransparencyWin, RotateOpaqueCompositeLayer)
 
 TEST(TransparencyWin, TranslateScaleOpaqueCompositeLayer)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // The background is white on top with red on bottom.
     Color white(0xFFFFFFFF);
     FloatRect topRect(0, 0, 16, 8);
-    src->context()->fillRect(topRect, white, DeviceColorSpace);
+    src->context()->fillRect(topRect, white, ColorSpaceDeviceRGB);
     Color red(0xFFFF0000);
     FloatRect bottomRect(0, 8, 16, 8);
-    src->context()->fillRect(bottomRect, red, DeviceColorSpace);
+    src->context()->fillRect(bottomRect, red, ColorSpaceDeviceRGB);
 
     src->context()->save();
 
@@ -519,7 +519,7 @@ TEST(TransparencyWin, TranslateScaleOpaqueCompositeLayer)
                     IntRect(1, -15, 14, 14));
 
         // Fill with red.
-        helper.context()->fillRect(helper.drawRect(), Color(0x7f7f0000), DeviceColorSpace);
+        helper.context()->fillRect(helper.drawRect(), Color(0x7f7f0000), ColorSpaceDeviceRGB);
         clearTopLayerAlphaChannel(helper.context());
         helper.composite();
     }
@@ -529,9 +529,9 @@ TEST(TransparencyWin, TranslateScaleOpaqueCompositeLayer)
 TEST(TransparencyWin, Scale)
 {
     // Create an opaque white buffer.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
     FloatRect fullBuffer(0, 0, 16, 16);
-    src->context()->fillRect(fullBuffer, Color::white, DeviceColorSpace);
+    src->context()->fillRect(fullBuffer, Color::white, ColorSpaceDeviceRGB);
 
     // Scale by 2x.
     src->context()->save();
@@ -584,15 +584,15 @@ TEST(TransparencyWin, Scale)
 TEST(TransparencyWin, ScaleTransparency)
 {
     // Create an opaque white buffer.
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
     FloatRect fullBuffer(0, 0, 16, 16);
-    src->context()->fillRect(fullBuffer, Color::white, DeviceColorSpace);
+    src->context()->fillRect(fullBuffer, Color::white, ColorSpaceDeviceRGB);
 
     // Make another layer (which duplicates how WebKit will make this). We fill
     // the top half with red, and have the layer be 50% opaque.
     src->context()->beginTransparencyLayer(0.5);
     FloatRect topHalf(0, 0, 16, 8);
-    src->context()->fillRect(topHalf, Color(0xFFFF0000), DeviceColorSpace);
+    src->context()->fillRect(topHalf, Color(0xFFFF0000), ColorSpaceDeviceRGB);
 
     // Scale by 2x.
     src->context()->save();
@@ -609,7 +609,7 @@ TEST(TransparencyWin, ScaleTransparency)
                     TransparencyWin::ScaleTransform,
                     IntRect(1, 1, 6, 6));
 
-        helper.context()->fillRect(helper.drawRect(), Color(0x7f000000), DeviceColorSpace);
+        helper.context()->fillRect(helper.drawRect(), Color(0x7f000000), ColorSpaceDeviceRGB);
         clearTopLayerAlphaChannel(helper.context());
         helper.composite();
     }
@@ -642,7 +642,7 @@ TEST(TransparencyWin, ScaleTransparency)
 
 TEST(TransparencyWin, Text)
 {
-    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), DeviceRGB));
+    OwnPtr<ImageBuffer> src(ImageBuffer::create(IntSize(16, 16), ColorSpaceDeviceRGB));
 
     // Our text should end up 50% transparent blue-green.
     Color fullResult(0x80008080);
@@ -658,21 +658,21 @@ TEST(TransparencyWin, Text)
         // Write several different squares to simulate ClearType. These should
         // all reduce to 2/3 coverage.
         FloatRect pixel(0, 0, 1, 1);
-        helper.context()->fillRect(pixel, 0xFFFF0000, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFFFF0000, ColorSpaceDeviceRGB);
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF00FF00, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF00FF00, ColorSpaceDeviceRGB);
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF0000FF, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF0000FF, ColorSpaceDeviceRGB);
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF008080, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF008080, ColorSpaceDeviceRGB);
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF800080, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF800080, ColorSpaceDeviceRGB);
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF808000, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF808000, ColorSpaceDeviceRGB);
 
         // Try one with 100% coverage (opaque black).
         pixel.move(1.0f, 0.0f);
-        helper.context()->fillRect(pixel, 0xFF000000, DeviceColorSpace);
+        helper.context()->fillRect(pixel, 0xFF000000, ColorSpaceDeviceRGB);
 
         // Now mess with the alpha channel.
         clearTopLayerAlphaChannel(helper.context());
diff --git a/WebKit/chromium/tests/WebUnitTests.cpp b/WebKit/chromium/tests/WebUnitTests.cpp
new file mode 100644
index 0000000..5e207f3
--- /dev/null
+++ b/WebKit/chromium/tests/WebUnitTests.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "config.h"
+#include "WebUnitTests.h"
+
+#include <base/test/test_suite.h>
+
+namespace WebKit {
+
+int RunAllUnitTests(int argc, char** argv)
+{
+    TestSuite testSuite(argc, argv);
+    return testSuite.Run();
+}
+
+} // namespace WebKit
diff --git a/WebKit/chromium/tests/WebUnitTests.h b/WebKit/chromium/tests/WebUnitTests.h
new file mode 100644
index 0000000..3add1c2
--- /dev/null
+++ b/WebKit/chromium/tests/WebUnitTests.h
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebUnitTests_h
+#define WebUnitTests_h
+
+#include "WebCommon.h"
+
+namespace WebKit {
+
+// In chromium multi-dll build, webkit unittest code are compiled in webkit.dll.
+// This is the API to run all unittests inside webkit.dll.
+WEBKIT_API int RunAllUnitTests(int argc, char** argv);
+
+} // namespace WebKit
+
+#endif
diff --git a/WebKit/efl/CMakeListsEfl.txt b/WebKit/efl/CMakeListsEfl.txt
index c154b66..1964d15 100644
--- a/WebKit/efl/CMakeListsEfl.txt
+++ b/WebKit/efl/CMakeListsEfl.txt
@@ -92,10 +92,15 @@ SET(BUILD_DATA_DIR ${CMAKE_BINARY_DIR}/WebKit/efl/DefaultTheme)
 SET(BUILD_DATA_DIR ${BUILD_DATA_DIR} PARENT_SCOPE)
 FILE(MAKE_DIRECTORY ${BUILD_DATA_DIR})
 
+SET(WebKit_THEME_DEFINITION "")
+IF (ENABLE_PROGRESS_TAG)
+  LIST(APPEND WebKit_THEME_DEFINITION "-DENABLE_PROGRESS_TAG")
+ENDIF ()
+
 SET(WebKit_THEME ${BUILD_DATA_DIR}/default.edj)
 ADD_CUSTOM_COMMAND(
   OUTPUT ${WebKit_THEME}
-  COMMAND ${EDJE_CC_EXECUTABLE} -v -id ${WEBKIT_DIR}/efl/DefaultTheme ${WEBKIT_DIR}/efl/DefaultTheme/default.edc ${WebKit_THEME}
+  COMMAND ${EDJE_CC_EXECUTABLE} -v -id ${WEBKIT_DIR}/efl/DefaultTheme ${WebKit_THEME_DEFINITION} ${WEBKIT_DIR}/efl/DefaultTheme/default.edc ${WebKit_THEME}
   DEPENDS
     ${WEBKIT_DIR}/efl/DefaultTheme/default.edc
     ${WEBKIT_DIR}/efl/DefaultTheme/widget/slider/slider_knob_v.png
@@ -159,6 +164,9 @@ ADD_CUSTOM_COMMAND(
     ${WEBKIT_DIR}/efl/DefaultTheme/widget/file/file_hover.png
     ${WEBKIT_DIR}/efl/DefaultTheme/widget/file/file_focus.png
     ${WEBKIT_DIR}/efl/DefaultTheme/widget/file/file.edc
+    ${WEBKIT_DIR}/efl/DefaultTheme/widget/progressbar/progressbar.edc
+    ${WEBKIT_DIR}/efl/DefaultTheme/widget/progressbar/shelf_inset.png
+    ${WEBKIT_DIR}/efl/DefaultTheme/widget/progressbar/bt_base.png
   VERBATIM
 )
 
diff --git a/WebKit/efl/ChangeLog b/WebKit/efl/ChangeLog
index 7c6afe9..1795645 100644
--- a/WebKit/efl/ChangeLog
+++ b/WebKit/efl/ChangeLog
@@ -1,3 +1,236 @@
+2010-10-19  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Add setting api for disabling auto resize window
+        https://bugs.webkit.org/show_bug.cgi?id=47787
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::setWindowRect): Return when
+        auto_resize_window was disabled.
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+        (ewk_view_setting_enable_auto_resize_window_get): Added.
+        (ewk_view_setting_enable_auto_resize_window_set): Added.
+        * ewk/ewk_view.h:
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::agentOS):
+
+2010-10-14  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Use data_set after data_get to keep refcount correct.
+        https://bugs.webkit.org/show_bug.cgi?id=47110
+
+        The call to evas_object_image_data_set was missed in this function,
+        which caused the refcount of the data being always increased on every
+        scroll.
+
+        * ewk/ewk_view_single.c:
+        (_ewk_view_single_smart_scrolls_process):
+
+2010-10-14  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Eric Seidel.
+
+        [EFL] Add setting api for enabling encoding detector
+        https://bugs.webkit.org/show_bug.cgi?id=45427
+
+        Add settings api for enabling encoding detector.
+
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+        (ewk_view_setting_encoding_detector_set):
+        (ewk_view_setting_encoding_detector_get):
+        * ewk/ewk_view.h:
+
+2010-10-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        [EFL] Unreviewed. Build fix.
+
+        * WebCoreSupport/FrameLoaderClientEfl.h: Use String instead of
+        WebCore::String.
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidLoadResourceByXMLHttpRequest):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2010-10-13  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Support viewport configuration and add new arguments for WebKit EFL
+        https://bugs.webkit.org/show_bug.cgi?id=47084
+
+        Opera spec regarding to viewport meta tag was adjusted to WebCore. So, EFL port 
+        needs to be modified according to the changes.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::dispatchViewportDataDidChange):
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::dispatchDidCommitLoad):
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_priv_new):
+        (_ewk_view_viewport_attributes_compute):
+        (ewk_view_viewport_attributes_set):
+        (ewk_view_viewport_attributes_get):
+        (ewk_view_device_pixel_ratio_get):
+        * ewk/ewk_view.h:
+
+2010-10-12  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Add a method to get target's dpi value
+        https://bugs.webkit.org/show_bug.cgi?id=47537
+
+        Add a method to get target dpi value using Ecore_X.
+        When we set layout size, we need to use the dpi value.
+
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (ewk_view_page_rect_get):
+        (ewk_view_dpi_get):
+
+2010-10-07  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Implement pageRect() function
+        https://bugs.webkit.org/show_bug.cgi?id=47395
+
+        Implement pageRect() in ChromeClientEfl using frameRect().
+
+        * CMakeListsEfl.txt:
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::pageRect):
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (ewk_view_page_rect_get): Added.
+
+2010-10-06  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Support Progress Tag
+        https://bugs.webkit.org/show_bug.cgi?id=45951
+
+        Implement progressbar.edc to support progress tag
+
+        * CMakeListsEfl.txt:
+        * DefaultTheme/default.edc:
+        * DefaultTheme/widget/progressbar: Added.
+        * DefaultTheme/widget/progressbar/bt_base.png: Added.
+        * DefaultTheme/widget/progressbar/progressbar.edc: Added.
+        * DefaultTheme/widget/progressbar/shelf_inset.png: Added.
+
+2010-10-05  Ryuan Choi  <ryuan.choi@samsung.com>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] Remove strdup in ewk_setting.cpp using eina_stringshare
+        https://bugs.webkit.org/show_bug.cgi?id=46613
+
+        Add variables shared by eina_stringshare and remove strdup.
+
+        * ewk/ewk_main.cpp:
+        (_ewk_init_body):
+        * ewk/ewk_settings.cpp:
+        (ewk_settings_web_database_path_set):
+        (ewk_settings_web_database_path_get):
+        (ewk_settings_icon_database_path_set):
+        (ewk_settings_icon_database_path_get):
+        * ewk/ewk_settings.h:
+
+2010-10-04  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Viewport data change notification by Bug 46755
+        https://bugs.webkit.org/show_bug.cgi?id=46772
+
+        Bug 46755 changes virtual function regarding to viewport metatag. Thus, EFL port 
+        should change the function as well in order to get viewport arguments.
+
+        And, setInitLayoutCompleted / getInitLayoutCompleted() are removed because these functions
+        aren't needed anymore.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::dispatchViewportDataDidChange):
+        * WebCoreSupport/ChromeClientEfl.h:
+        * WebCoreSupport/FrameLoaderClientEfl.cpp:
+        (WebCore::FrameLoaderClientEfl::FrameLoaderClientEfl):
+        (WebCore::FrameLoaderClientEfl::dispatchDidCommitLoad):
+        (WebCore::FrameLoaderClientEfl::dispatchDidFirstLayout):
+        * WebCoreSupport/FrameLoaderClientEfl.h:
+
+2010-10-01  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Remove check for InitLayoutCompleted on fixed_layout_size_set.
+        https://bugs.webkit.org/show_bug.cgi?id=47006
+
+        This check isn't needed and isn't done on the other ports. The fixed
+        layout property can be set before we have the first layout.
+
+        * ewk/ewk_view.cpp:
+        (ewk_view_fixed_layout_size_set):
+
+2010-10-01  Rafael Antognolli  <antognolli@profusion.mobi>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Call contents_resize when the main frame gets resized.
+        https://bugs.webkit.org/show_bug.cgi?id=47004
+
+        The previous implementation was just calling contents_resize when the
+        viewport size had changed. That's not enough, and contents_resize
+        shouldn't be called if the contents size didn't change.
+
+        Now the contents_size_changed function is called directly from the
+        ChromeClientEfl.
+
+        * WebCoreSupport/ChromeClientEfl.cpp:
+        (WebCore::ChromeClientEfl::contentsSizeChanged):
+        * ewk/ewk_private.h:
+        * ewk/ewk_view.cpp:
+        (_ewk_view_smart_calculate):
+        (ewk_view_fixed_layout_size_set):
+        (ewk_view_contents_size_changed):
+
+2010-09-29  João Paulo Rechi Vita  <jprvita@profusion.mobi>
+
+        Reviewed by Antonio Gomes.
+
+        [EFL] General small fixes.
+        https://bugs.webkit.org/show_bug.cgi?id=46813
+
+        This commit spots a comparison between signed and unsigned integer
+        expressions, a missing return and a never-called function.
+
+        * WebCoreSupport/FullscreenVideoControllerEfl.cpp:
+        (FullscreenVideoController::canPlay):
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/efl/DefaultTheme/default.edc b/WebKit/efl/DefaultTheme/default.edc
index 0496a24..7d750f4 100644
--- a/WebKit/efl/DefaultTheme/default.edc
+++ b/WebKit/efl/DefaultTheme/default.edc
@@ -68,6 +68,9 @@ collections {
 #include "widget/check/check.edc"
 #include "widget/entry/entry.edc"
 #include "widget/combo/combo.edc"
+#ifdef ENABLE_PROGRESS_TAG
+#include "widget/progressbar/progressbar.edc"
+#endif
 #include "widget/file/file.edc"
 #include "widget/search/field/search_field.edc"
 #include "widget/search/cancel/search_cancel.edc"
diff --git a/WebKit/efl/DefaultTheme/widget/progressbar/bt_base.png b/WebKit/efl/DefaultTheme/widget/progressbar/bt_base.png
new file mode 100644
index 0000000..2d1f179
--- /dev/null
+++ b/WebKit/efl/DefaultTheme/widget/progressbar/bt_base.png
diff --git a/WebKit/efl/DefaultTheme/widget/progressbar/progressbar.edc b/WebKit/efl/DefaultTheme/widget/progressbar/progressbar.edc
new file mode 100644
index 0000000..2a34d54
--- /dev/null
+++ b/WebKit/efl/DefaultTheme/widget/progressbar/progressbar.edc
@@ -0,0 +1,108 @@
+/*
+    Copyright (C) 2010 Samsung Electronics
+
+    This file is free software; you can redistribute it and/or
+    modify it under the terms of the GNU Library General Public
+    License as published by the Free Software Foundation; either
+    version 2 of the License, or (at your option) any later version.
+
+    This file is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+    Library General Public License for more details.
+
+    You should have received a copy of the GNU Library General Public License
+    along with this library; see the file COPYING.LIB.  If not, write to
+    the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+    Boston, MA 02110-1301, USA.
+*/
+group {
+    name: "webkit/widget/progressbar";
+    min: 0 11; /* if > 0, this is the minimum size that will be allocated.
+                * If wants to draw on top, just overflow usign edje's rel1/rel2
+                */
+    max: 999999 999999;
+
+    images {
+        image: "widget/progressbar/shelf_inset.png" COMP;
+        image: "widget/progressbar/bt_base.png" COMP;
+    }
+
+    script {
+        public message(Msg_Type:type, id, ...) {
+            if ((id == 0) && (type == MSG_FLOAT_SET)) {
+                new Float:x, Float:sx;
+                x = getfarg(2);
+                sx = getfarg(3);
+
+                if (sx >= 0.0) {
+                    set_drag_size(PART:"img.progressbar_fill", sx, 1.0);
+                    set_drag(PART:"img.progressbar_fill", x, 0.0);
+                }
+            }
+        }
+    }
+
+    parts {
+        part {
+           name: "rect.base";
+           type: RECT;
+           description {
+              state: "default" 0.0;
+              min: 29 11;
+              max: 999999 99999;
+              color: 255 255 255 0;
+           }
+        }
+        part {
+           name: "rect.clipper";
+           type: RECT;
+           description {
+              state: "default" 0.0;
+              color: 255 255 255 255;
+           }
+           description {
+              state: "hidden" 0.0;
+              color: 255 255 255 128;
+           }
+        }
+
+        part {
+           name: "img.progressbar";
+           type: IMAGE;
+           mouse_events: 0;
+           clip_to: "rect.clipper";
+           description {
+              state: "default" 0.0;
+              min: 29 5;
+              rel1.to: "rect.base";
+              rel2.to: "rect.base";
+              align: 0.5 0.5;
+              image {
+                 normal: "widget/progressbar/shelf_inset.png";
+                 border: 8 8 8 8;
+              }
+           }
+        }
+        part {
+           name: "img.progressbar_fill";
+           type: IMAGE;
+           mouse_events: 0;
+           clip_to: "rect.clipper";
+           dragable {
+               x: 1 1 0;
+               y: 0 0 0;
+               confine: "rect.base";
+           }
+           description {
+              state: "default" 0.0;
+              min: 0 5;
+              align: 0.5 0.5;
+              image {
+                 normal: "widget/progressbar/bt_base.png";
+                 border: 7 7 0 0;
+              }
+           }
+        }
+    }
+}
diff --git a/WebKit/efl/DefaultTheme/widget/progressbar/shelf_inset.png b/WebKit/efl/DefaultTheme/widget/progressbar/shelf_inset.png
new file mode 100644
index 0000000..bb1989d
--- /dev/null
+++ b/WebKit/efl/DefaultTheme/widget/progressbar/shelf_inset.png
diff --git a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
index 21747a1..257e824 100644
--- a/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/ChromeClientEfl.cpp
@@ -111,6 +111,9 @@ void ChromeClientEfl::setWindowRect(const FloatRect& rect)
     if (!m_view)
         return;
 
+    if (!ewk_view_setting_enable_auto_resize_window_get(m_view))
+        return;
+
     ee = ecore_evas_ecore_evas_get(evas_object_evas_get(m_view));
     ecore_evas_move(ee, intrect.x(), intrect.y());
     ecore_evas_resize(ee, intrect.width(), intrect.height());
@@ -118,8 +121,10 @@ void ChromeClientEfl::setWindowRect(const FloatRect& rect)
 
 FloatRect ChromeClientEfl::pageRect()
 {
-    notImplemented();
-    return FloatRect();
+    if (!m_view)
+        return FloatRect();
+
+    return ewk_view_page_rect_get(m_view);
 }
 
 float ChromeClientEfl::scaleFactor()
@@ -319,6 +324,8 @@ IntRect ChromeClientEfl::windowResizerRect() const
 void ChromeClientEfl::contentsSizeChanged(Frame* frame, const IntSize& size) const
 {
     ewk_frame_contents_size_changed(kit(frame), size.width(), size.height());
+    if (ewk_view_frame_main_get(m_view) == kit(frame))
+        ewk_view_contents_size_changed(m_view, size.width(), size.height());
 }
 
 IntRect ChromeClientEfl::windowToScreen(const IntRect& rect) const
@@ -513,13 +520,9 @@ void ChromeClientEfl::chooseIconForFiles(const Vector<String>&, FileChooser*)
     notImplemented();
 }
 
-void ChromeClientEfl::didReceiveViewportArguments(Frame* frame, const ViewportArguments& arguments) const
+void ChromeClientEfl::dispatchViewportDataDidChange(const ViewportArguments& arguments) const
 {
-    FrameLoaderClientEfl* client = static_cast<FrameLoaderClientEfl*>(frame->loader()->client());
-    if (client->getInitLayoutCompleted())
-        return;
-
-    ewk_view_viewport_set(m_view, arguments.width, arguments.height, arguments.initialScale, arguments.minimumScale, arguments.maximumScale, arguments.userScalable);
+    ewk_view_viewport_attributes_set(m_view, arguments);
 }
 
 bool ChromeClientEfl::selectItemWritingDirectionIsNatural()
diff --git a/WebKit/efl/WebCoreSupport/ChromeClientEfl.h b/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
index d939ae6..4339b9a 100644
--- a/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
+++ b/WebKit/efl/WebCoreSupport/ChromeClientEfl.h
@@ -137,7 +137,7 @@ public:
     virtual void cancelGeolocationPermissionRequestForFrame(Frame*);
     virtual void iconForFiles(const Vector<String, 0u>&, PassRefPtr<FileChooser>);
 
-    virtual void didReceiveViewportArguments(Frame* frame, const ViewportArguments& arguments) const;
+    virtual void dispatchViewportDataDidChange(const ViewportArguments&) const;
 
     virtual bool selectItemWritingDirectionIsNatural();
     virtual PassRefPtr<PopupMenu> createPopupMenu(PopupMenuClient*) const;
diff --git a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
index 2d452d8..1b82239 100644
--- a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.cpp
@@ -54,6 +54,7 @@
 #include "ViewportArguments.h"
 #include "ewk_private.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #if PLATFORM(UNIX)
 #include <sys/utsname.h>
@@ -72,7 +73,6 @@ FrameLoaderClientEfl::FrameLoaderClientEfl(Evas_Object *view)
     , m_customUserAgent("")
     , m_pluginView(0)
     , m_hasSentResponseToPlugin(false)
-    , m_initLayoutCompleted(false)
 {
 }
 
@@ -93,7 +93,7 @@ static String agentOS()
 #elif PLATFORM(UNIX)
     struct utsname name;
     if (uname(&name) != -1)
-        return String::format("%s %s", name.sysname, name.machine);
+        return makeString(name.sysname, ' ', name.machine);
 
     return "Unknown";
 #elif PLATFORM(WIN_OS)
@@ -615,8 +615,6 @@ void FrameLoaderClientEfl::dispatchDidChangeIcons()
 
 void FrameLoaderClientEfl::dispatchDidCommitLoad()
 {
-    m_initLayoutCompleted = false;
-
     ewk_frame_uri_changed(m_frame);
     if (ewk_view_frame_main_get(m_view) != m_frame)
         return;
@@ -624,7 +622,7 @@ void FrameLoaderClientEfl::dispatchDidCommitLoad()
     ewk_view_uri_changed(m_view);
 
     ViewportArguments arguments;
-    ewk_view_viewport_set(m_view, arguments.width, arguments.height, arguments.initialScale, arguments.minimumScale, arguments.maximumScale, arguments.userScalable);
+    ewk_view_viewport_attributes_set(m_view, arguments);
 }
 
 void FrameLoaderClientEfl::dispatchDidFinishDocumentLoad()
@@ -634,7 +632,6 @@ void FrameLoaderClientEfl::dispatchDidFinishDocumentLoad()
 
 void FrameLoaderClientEfl::dispatchDidFirstLayout()
 {
-    m_initLayoutCompleted = true;
     ewk_frame_load_firstlayout_finished(m_frame);
 }
 
@@ -763,7 +760,7 @@ bool FrameLoaderClientEfl::dispatchDidLoadResourceFromMemoryCache(DocumentLoader
     return false;
 }
 
-void FrameLoaderClientEfl::dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const ScriptString&)
+void FrameLoaderClientEfl::dispatchDidLoadResourceByXMLHttpRequest(unsigned long, const String&)
 {
     notImplemented();
 }
diff --git a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
index 2b4414a..1b880e6 100644
--- a/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
+++ b/WebKit/efl/WebCoreSupport/FrameLoaderClientEfl.h
@@ -55,9 +55,6 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     void setCustomUserAgent(const String &agent);
     const String& customUserAgent() const;
 
-    void setInitLayoutCompleted(bool completed) { m_initLayoutCompleted = completed; }
-    bool getInitLayoutCompleted() { return m_initLayoutCompleted; }
-
     virtual bool hasWebView() const;
     virtual bool hasFrameView() const;
 
@@ -94,7 +91,7 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     virtual void dispatchDidFinishLoading(DocumentLoader*, unsigned long  identifier);
     virtual void dispatchDidFailLoading(DocumentLoader*, unsigned long  identifier, const ResourceError&);
     virtual bool dispatchDidLoadResourceFromMemoryCache(DocumentLoader*, const ResourceRequest&, const ResourceResponse&, int length);
-    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const WebCore::ScriptString& sourceString);
+    virtual void dispatchDidLoadResourceByXMLHttpRequest(unsigned long identifier, const String& sourceString);
 
     virtual void dispatchDidHandleOnloadEvents();
     virtual void dispatchDidReceiveServerRedirectForProvisionalLoad();
@@ -218,8 +215,6 @@ class FrameLoaderClientEfl : public FrameLoaderClient {
     // Plugin view to redirect data to
     PluginView* m_pluginView;
     bool m_hasSentResponseToPlugin;
-
-    bool m_initLayoutCompleted;
 };
 
 }
diff --git a/WebKit/efl/WebCoreSupport/FullscreenVideoControllerEfl.cpp b/WebKit/efl/WebCoreSupport/FullscreenVideoControllerEfl.cpp
index 6e5d599..70deaef 100644
--- a/WebKit/efl/WebCoreSupport/FullscreenVideoControllerEfl.cpp
+++ b/WebKit/efl/WebCoreSupport/FullscreenVideoControllerEfl.cpp
@@ -91,6 +91,7 @@ void FullscreenVideoController::exitFullscreen()
 bool FullscreenVideoController::canPlay() const
 {
     notImplemented();
+    return false;
 }
 
 void FullscreenVideoController::play()
@@ -178,11 +179,6 @@ void FullscreenVideoController::endSeek()
     notImplemented();
 }
 
-static String timeToString(float time)
-{
-    notImplemented();
-}
-
 bool FullscreenVideoController::updateHudProgressBar()
 {
     notImplemented();
diff --git a/WebKit/efl/ewk/ewk_main.cpp b/WebKit/efl/ewk/ewk_main.cpp
index 8c27478..26dec81 100644
--- a/WebKit/efl/ewk/ewk_main.cpp
+++ b/WebKit/efl/ewk/ewk_main.cpp
@@ -175,6 +175,7 @@ Eina_Bool _ewk_init_body(void)
 
     WTF::String wkdir = WTF::String(home) + "/.webkit";
     ewk_settings_web_database_path_set(wkdir.utf8().data());
+    ewk_settings_icon_database_path_set(wkdir.utf8().data());
 
     WebCore::cacheStorage().setCacheDirectory(wkdir);
 
diff --git a/WebKit/efl/ewk/ewk_private.h b/WebKit/efl/ewk/ewk_private.h
index eaad13c..e2624a3 100644
--- a/WebKit/efl/ewk/ewk_private.h
+++ b/WebKit/efl/ewk/ewk_private.h
@@ -102,10 +102,12 @@ WTF::PassRefPtr<WebCore::Frame> ewk_view_frame_create(Evas_Object *o, Evas_Objec
 WTF::PassRefPtr<WebCore::Widget> ewk_view_plugin_create(Evas_Object* o, Evas_Object* frame, const WebCore::IntSize& pluginSize, WebCore::HTMLPlugInElement* element, const WebCore::KURL& url, const WTF::Vector<WTF::String>& paramNames, const WTF::Vector<WTF::String>& paramValues, const WTF::String& mimeType, bool loadManually);
 
 void ewk_view_popup_new(Evas_Object *o, WebCore::PopupMenuClient* client, int selected, const WebCore::IntRect& rect);
-void ewk_view_viewport_set(Evas_Object *o, float w, float h, float init_scale, float max_scale, float min_scale, float user_scalable);
+void ewk_view_viewport_attributes_set(Evas_Object *o, const WebCore::ViewportArguments& arguments);
 
 void ewk_view_download_request(Evas_Object *o, Ewk_Download *download);
 
+int ewk_view_dpi_get();
+
 Ewk_History *ewk_history_new(WebCore::BackForwardList *history);
 void ewk_history_free(Ewk_History *history);
 
@@ -150,6 +152,10 @@ WTF::PassRefPtr<WebCore::Widget> ewk_frame_plugin_create(Evas_Object* o, const W
 
 Eina_Bool ewk_view_navigation_policy_decision(Evas_Object* o, Ewk_Frame_Resource_Request* request);
 
+void ewk_view_contents_size_changed(Evas_Object *o, Evas_Coord w, Evas_Coord h);
+
+WebCore::FloatRect ewk_view_page_rect_get(Evas_Object *o);
+
 #ifdef __cplusplus
 
 }
diff --git a/WebKit/efl/ewk/ewk_settings.cpp b/WebKit/efl/ewk/ewk_settings.cpp
index 6d2be05..f2651a1 100644
--- a/WebKit/efl/ewk/ewk_settings.cpp
+++ b/WebKit/efl/ewk/ewk_settings.cpp
@@ -44,6 +44,8 @@
 #include <libsoup/soup.h>
 #endif
 
+static const char* _ewk_default_web_database_path = 0;
+static const char* _ewk_icon_database_path = 0;
 static uint64_t _ewk_default_web_database_quota = 1 * 1024 * 1024;
 
 /**
@@ -69,21 +71,27 @@ void ewk_settings_web_database_path_set(const char *path)
 #if ENABLE(DATABASE)
     WTF::String corePath = WTF::String::fromUTF8(path);
     WebCore::DatabaseTracker::tracker().setDatabaseDirectoryPath(corePath);
+    if (!_ewk_default_web_database_path)
+        _ewk_default_web_database_path = eina_stringshare_add(corePath.utf8().data());
+    else
+        eina_stringshare_replace(&_ewk_default_web_database_path, corePath.utf8().data());
+
 #endif
 }
 
 /**
  * Return directory path where web database is stored.
  *
- * @return newly allocated string with database path. Note that return must be
- * freed with free() as it's a strdup()ed copy of the string due reference
- * counting.
+ * @return database path or NULL if none or web database is not supported.
+ *         This is guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
  */
 const char *ewk_settings_web_database_path_get()
 {
 #if ENABLE(DATABASE)
-    WTF::String path = WebCore::DatabaseTracker::tracker().databaseDirectoryPath();
-    return strdup(path.utf8().data());
+    return _ewk_default_web_database_path;
 #else
     return 0;
 #endif
@@ -122,9 +130,17 @@ Eina_Bool ewk_settings_icon_database_path_set(const char *directory)
 
         WebCore::iconDatabase()->setEnabled(true);
         WebCore::iconDatabase()->open(WTF::String::fromUTF8(directory));
+        if (!_ewk_icon_database_path)
+            _ewk_icon_database_path = eina_stringshare_add(directory);
+        else
+            eina_stringshare_replace(&_ewk_icon_database_path, directory);
     } else {
         WebCore::iconDatabase()->setEnabled(false);
         WebCore::iconDatabase()->close();
+        if (_ewk_icon_database_path) {
+            eina_stringshare_del(_ewk_icon_database_path);
+            _ewk_icon_database_path = 0;
+        }
     }
     return EINA_TRUE;
 }
@@ -132,22 +148,20 @@ Eina_Bool ewk_settings_icon_database_path_set(const char *directory)
 /**
  * Return directory path where icon database is stored.
  *
- * @return newly allocated string with database path or @c NULL if
- *         none is set or database is closed. Note that return must be
- *         freed with free() as it's a strdup()ed copy of the string
- *         due reference counting.
+ * @return database path or @c NULL if none is set or database is closed.
+ *         This is guaranteed to be eina_stringshare, so whenever possible
+ *         save yourself some cpu cycles and use
+ *         eina_stringshare_ref() instead of eina_stringshare_add() or
+ *         strdup().
  */
-char* ewk_settings_icon_database_path_get(void)
+const char* ewk_settings_icon_database_path_get(void)
 {
     if (!WebCore::iconDatabase()->isEnabled())
         return 0;
     if (!WebCore::iconDatabase()->isOpen())
         return 0;
 
-    WTF::String path = WebCore::iconDatabase()->databasePath();
-    if (path.isEmpty())
-        return 0;
-    return strdup(path.utf8().data());
+    return _ewk_icon_database_path;
 }
 
 /**
diff --git a/WebKit/efl/ewk/ewk_settings.h b/WebKit/efl/ewk/ewk_settings.h
index f2d77f7..3c1668f 100644
--- a/WebKit/efl/ewk/ewk_settings.h
+++ b/WebKit/efl/ewk/ewk_settings.h
@@ -42,7 +42,7 @@ EAPI void             ewk_settings_web_database_path_set(const char *path);
 EAPI const char      *ewk_settings_web_database_path_get();
 
 EAPI Eina_Bool        ewk_settings_icon_database_path_set(const char *path);
-EAPI char            *ewk_settings_icon_database_path_get(void);
+EAPI const char      *ewk_settings_icon_database_path_get(void);
 EAPI Eina_Bool        ewk_settings_icon_database_clear(void);
 
 EAPI cairo_surface_t *ewk_settings_icon_database_icon_surface_get(const char *url);
diff --git a/WebKit/efl/ewk/ewk_view.cpp b/WebKit/efl/ewk/ewk_view.cpp
index 19efbfa..f1ca733 100644
--- a/WebKit/efl/ewk/ewk_view.cpp
+++ b/WebKit/efl/ewk/ewk_view.cpp
@@ -22,7 +22,7 @@
 #include "config.h"
 #include "ewk_view.h"
 
-#include "appcache/ApplicationCacheStorage.h"
+#include "Chrome.h"
 #include "ChromeClientEfl.h"
 #include "ContextMenuClientEfl.h"
 #include "ContextMenuController.h"
@@ -42,6 +42,7 @@
 #include "PlatformMouseEvent.h"
 #include "PopupMenuClient.h"
 #include "ProgressTracker.h"
+#include "appcache/ApplicationCacheStorage.h"
 #include "ewk_private.h"
 
 #include <Ecore.h>
@@ -51,9 +52,15 @@
 #include <inttypes.h>
 #include <sys/time.h>
 
+#ifdef HAVE_ECORE_X
+#include <Ecore_X.h>
+#endif
+
 #define ZOOM_MIN (0.05)
 #define ZOOM_MAX (4.0)
 
+#define DEVICE_PIXEL_RATIO (1.0)
+
 static const char EWK_VIEW_TYPE_STR[] = "EWK_View";
 
 static const size_t EWK_VIEW_REPAINTS_SIZE_INITIAL = 32;
@@ -68,6 +75,7 @@ struct _Ewk_View_Private_Data {
     WebCore::Page* page;
     WebCore::Settings* page_settings;
     WebCore::Frame* main_frame;
+    WebCore::ViewportArguments viewport_arguments;
     Ewk_History* history;
     struct {
         Ewk_Menu menu;
@@ -104,9 +112,11 @@ struct _Ewk_View_Private_Data {
         const char* font_sans_serif;
         Eina_Bool auto_load_images:1;
         Eina_Bool auto_shrink_images:1;
+        Eina_Bool enable_auto_resize_window:1;
         Eina_Bool enable_scripts:1;
         Eina_Bool enable_plugins:1;
         Eina_Bool enable_frame_flattening:1;
+        Eina_Bool encoding_detector:1;
         Eina_Bool scripts_window_open:1;
         Eina_Bool resizable_textareas:1;
         Eina_Bool private_browsing:1;
@@ -116,18 +126,11 @@ struct _Ewk_View_Private_Data {
         Eina_Bool offline_app_cache: 1;
         Eina_Bool page_cache: 1;
         struct {
-            float w;
-            float h;
-            float init_scale;
-            float min_scale;
-            float max_scale;
-            float user_scalable;
-        } viewport;
-        struct {
             float min_scale;
             float max_scale;
             Eina_Bool user_scalable:1;
         } zoom_range;
+        float device_pixel_ratio;
     } settings;
     struct {
         struct {
@@ -569,6 +572,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
     priv->page_settings->setLocalStorageEnabled(true);
     priv->page_settings->setOfflineWebApplicationCacheEnabled(true);
     priv->page_settings->setUsesPageCache(true);
+    priv->page_settings->setUsesEncodingDetector(true);
 
     url = priv->page_settings->userStyleSheetLocation();
     priv->settings.user_stylesheet = eina_stringshare_add(url.prettyURL().utf8().data());
@@ -603,6 +607,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
 
     priv->settings.auto_load_images = priv->page_settings->loadsImagesAutomatically();
     priv->settings.auto_shrink_images = priv->page_settings->shrinksStandaloneImagesToFit();
+    priv->settings.enable_auto_resize_window = EINA_TRUE;
     priv->settings.enable_scripts = priv->page_settings->isJavaScriptEnabled();
     priv->settings.enable_plugins = priv->page_settings->arePluginsEnabled();
     priv->settings.enable_frame_flattening = priv->page_settings->frameFlatteningEnabled();
@@ -613,6 +618,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
     priv->settings.local_storage = priv->page_settings->localStorageEnabled();
     priv->settings.offline_app_cache = true; // XXX no function to read setting; this keeps the original setting
     priv->settings.page_cache = priv->page_settings->usesPageCache();
+    priv->settings.encoding_detector = priv->page_settings->usesEncodingDetector();
 
     // Since there's no scale separated from zooming in webkit-efl, this functionality of
     // viewport meta tag is implemented using zoom. When scale zoom is supported by webkit-efl,
@@ -620,6 +626,7 @@ static Ewk_View_Private_Data* _ewk_view_priv_new(Ewk_View_Smart_Data* sd)
     priv->settings.zoom_range.min_scale = ZOOM_MIN;
     priv->settings.zoom_range.max_scale = ZOOM_MAX;
     priv->settings.zoom_range.user_scalable = EINA_TRUE;
+    priv->settings.device_pixel_ratio = DEVICE_PIXEL_RATIO;
 
     priv->main_frame = _ewk_view_core_frame_new(sd, priv, 0).get();
     if (!priv->main_frame) {
@@ -805,10 +812,6 @@ static void _ewk_view_smart_calculate(Evas_Object* o)
             view->resize(w, h);
             view->forceLayout();
             view->adjustViewSize();
-            IntSize size = view->contentsSize();
-            if (!sd->api->contents_resize(sd, size.width(), size.height()))
-                ERR("failed to resize contents to %dx%d",
-                    size.width(), size.height());
         }
         evas_object_resize(sd->main_frame, w, h);
         sd->changed.frame_rect = EINA_TRUE;
@@ -967,6 +970,26 @@ static void _ewk_view_zoom_animation_start(Ewk_View_Smart_Data* sd)
         (_ewk_view_zoom_animator_cb, sd);
 }
 
+static WebCore::ViewportAttributes _ewk_view_viewport_attributes_compute(Evas_Object* o)
+{
+    EWK_VIEW_SD_GET(o, sd);
+    EWK_VIEW_PRIV_GET(sd, priv);
+
+    int desktop_width = 980;
+    int device_dpi = 160;
+
+    int available_width = (int) priv->page->chrome()->client()->pageRect().width();
+    int available_height = (int) priv->page->chrome()->client()->pageRect().height();
+
+    int device_width = (int) priv->page->chrome()->client()->windowRect().width();
+    int device_height = (int) priv->page->chrome()->client()->windowRect().height();
+
+    IntSize available_size = IntSize(available_width, available_height);
+    WebCore::ViewportAttributes attributes = WebCore::computeViewportAttributes(priv->viewport_arguments, desktop_width, device_width, device_height, device_dpi, available_size);
+
+    return attributes;
+}
+
 /**
  * Sets the smart class api without any backing store, enabling view
  * to be inherited.
@@ -1052,10 +1075,6 @@ void ewk_view_fixed_layout_size_set(Evas_Object* o, Evas_Coord w, Evas_Coord h)
     EWK_VIEW_SD_GET_OR_RETURN(o, sd);
     EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv);
 
-    WebCore::FrameLoaderClientEfl* client = static_cast<WebCore::FrameLoaderClientEfl*>(priv->main_frame->loader()->client());
-    if (!client->getInitLayoutCompleted())
-        return;
-
     WebCore::FrameView* view = sd->_priv->main_frame->view();
     if (w <= 0 && h <= 0) {
         if (!priv->fixed_layout.use)
@@ -2282,6 +2301,39 @@ Eina_Bool ewk_view_setting_auto_shrink_images_set(Evas_Object* o, Eina_Bool auto
     return EINA_TRUE;
 }
 
+/**
+ * Gets if view can be resized automatically.
+ *
+ * @param o view to check status
+ *
+ * @return EINA_TRUE if view can be resized, EINA_FALSE
+ *         otherwise (errors, cannot be resized).
+ */
+Eina_Bool ewk_view_setting_enable_auto_resize_window_get(const Evas_Object* o)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
+    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
+    return priv->settings.enable_auto_resize_window;
+}
+
+/**
+ * Sets if view can be resized automatically.
+ *
+ * @param o View.
+ * @param resizable @c EINA_TRUE if we want to resize automatically;
+ * @c EINA_FALSE otherwise. It defaults to @c EINA_TRUE
+ *
+ * @return EINA_TRUE if auto_resize_window status set, EINA_FALSE
+ *         otherwise (errors).
+ */
+Eina_Bool ewk_view_setting_enable_auto_resize_window_set(Evas_Object* o, Eina_Bool resizable)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
+    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
+    priv->settings.enable_auto_resize_window = resizable;
+    return EINA_TRUE;
+}
+
 Eina_Bool ewk_view_setting_enable_scripts_get(const Evas_Object* o)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
@@ -2512,6 +2564,37 @@ Eina_Bool ewk_view_setting_encoding_default_set(Evas_Object* o, const char* enco
     return EINA_TRUE;
 }
 
+/**
+ * Sets the encoding detector.
+ *
+ * @param o view object to set if encoding detector is enabled.
+ * @return @c EINA_TRUE on success and @c EINA_FALSE on failure
+ */
+Eina_Bool ewk_view_setting_encoding_detector_set(Evas_Object* o, Eina_Bool enable)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
+    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
+    enable = !!enable;
+    if (priv->settings.encoding_detector != enable) {
+        priv->page_settings->setUsesEncodingDetector(enable);
+        priv->settings.encoding_detector = enable;
+    }
+    return EINA_TRUE;
+}
+
+/**
+ * Gets if the encoding detector is enabled.
+ *
+ * @param o view object to get if encoding detector is enabled.
+ * @return @c EINA_TRUE if encoding detector is enabled, @c EINA_FALSE if not or on errors.
+ */
+Eina_Bool ewk_view_setting_encoding_detector_get(Evas_Object* o)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd, EINA_FALSE);
+    EWK_VIEW_PRIV_GET_OR_RETURN(sd, priv, EINA_FALSE);
+    return priv->settings.encoding_detector;
+}
+
 const char* ewk_view_setting_cache_directory_get(const Evas_Object* o)
 {
     EWK_VIEW_SD_GET_OR_RETURN(o, sd, 0);
@@ -2730,8 +2813,8 @@ Eina_Bool ewk_view_setting_spatial_navigation_set(Evas_Object* o, Eina_Bool enab
 /**
  * Gets if the local storage is enabled.
  *
- * @param o view object to set if local storage is enabled.
- * @return @c EINA_TRUE if local storage is enabled, @c EINA_FALSE if not.
+ * @param o view object to get if local storage is enabled.
+ * @return @c EINA_TRUE if local storage is enabled, @c EINA_FALSE if not or on errors.
  */
 Eina_Bool ewk_view_setting_local_storage_get(Evas_Object* o)
 {
@@ -4053,33 +4136,21 @@ void ewk_view_download_request(Evas_Object* o, Ewk_Download* download)
  * @internal
  * Reports the viewport has changed.
  *
- * @param o view.
- * @param w width.
- * @param h height.
- * @param init_scale initialScale value.
- * @param max_scale maximumScale value.
- * @param min_scale minimumScale value.
- * @param user_scalable userscalable flag.
+ * @param arguments viewport argument.
  *
  * Emits signal: "viewport,changed" with no parameters.
  */
-void ewk_view_viewport_set(Evas_Object *o, float w, float h, float init_scale, float max_scale, float min_scale, float user_scalable)
+void ewk_view_viewport_attributes_set(Evas_Object *o, const WebCore::ViewportArguments& arguments)
 {
     EWK_VIEW_SD_GET(o, sd);
     EWK_VIEW_PRIV_GET(sd, priv);
-
-    priv->settings.viewport.w = w;
-    priv->settings.viewport.h = h;
-    priv->settings.viewport.init_scale = init_scale;
-    priv->settings.viewport.min_scale = min_scale;
-    priv->settings.viewport.max_scale = max_scale;
-    priv->settings.viewport.user_scalable = user_scalable;
-
+    
+    priv->viewport_arguments = arguments;
     evas_object_smart_callback_call(o, "viewport,changed", 0);
 }
 
 /**
- * Gets data of viewport meta tag.
+ * Gets attributes of viewport meta tag.
  *
  * @param o view.
  * @param w width.
@@ -4087,25 +4158,27 @@ void ewk_view_viewport_set(Evas_Object *o, float w, float h, float init_scale, f
  * @param init_scale initial Scale value.
  * @param max_scale maximum Scale value.
  * @param min_scale minimum Scale value.
+ * @param device_pixel_ratio value.
  * @param user_scalable user Scalable value.
  */
-void ewk_view_viewport_get(Evas_Object *o, float* w, float* h, float* init_scale, float* max_scale, float* min_scale, float* user_scalable)
+void ewk_view_viewport_attributes_get(Evas_Object *o, float* w, float* h, float* init_scale, float* max_scale, float* min_scale, float* device_pixel_ratio, Eina_Bool* user_scalable)
 {
-    EWK_VIEW_SD_GET(o, sd);
-    EWK_VIEW_PRIV_GET(sd, priv);
+    WebCore::ViewportAttributes attributes = _ewk_view_viewport_attributes_compute(o);
 
     if (w)
-        *w = priv->settings.viewport.w;
+        *w = attributes.layoutSize.width();
     if (h)
-        *h = priv->settings.viewport.h;
+        *h = attributes.layoutSize.height();
     if (init_scale)
-        *init_scale = priv->settings.viewport.init_scale;
+        *init_scale = attributes.initialScale;
     if (max_scale)
-        *max_scale = priv->settings.viewport.max_scale;
+        *max_scale = attributes.maximumScale;
     if (min_scale)
-        *min_scale = priv->settings.viewport.min_scale;
+        *min_scale = attributes.minimumScale;
+    if (device_pixel_ratio)
+        *device_pixel_ratio = attributes.devicePixelRatio;
     if (user_scalable)
-        *user_scalable = priv->settings.viewport.user_scalable;
+        *user_scalable = attributes.userScalable;
 }
 
 /**
@@ -4195,6 +4268,22 @@ Eina_Bool ewk_view_user_scalable_get(Evas_Object* o)
 }
 
 /**
+ * Gets device pixel ratio value.
+ *
+ * @param o view.
+ * @param user_scalable where to return the current user scalable value.
+ *
+ * @return @c EINA_TRUE if zoom is enabled, @c EINA_FALSE if not.
+ */
+float ewk_view_device_pixel_ratio_get(Evas_Object* o)
+{
+    EWK_VIEW_SD_GET(o, sd);
+    EWK_VIEW_PRIV_GET(sd, priv);
+
+    return priv->settings.device_pixel_ratio;
+}
+
+/**
  * @internal
  * Reports a requeset will be loaded. It's client responsibility to decide if
  * request would be used. If @return is true, loader will try to load. Else,
@@ -4213,3 +4302,54 @@ Eina_Bool ewk_view_navigation_policy_decision(Evas_Object* o, Ewk_Frame_Resource
 
     return sd->api->navigation_policy_decision(sd, request);
 }
+
+/**
+ * @internal
+ * Reports that the contents have resized. The ewk_view calls contents_resize,
+ * which can be reimplemented as needed.
+ *
+ * @param o view.
+ * @param w new content width.
+ * @param h new content height.
+ */
+void ewk_view_contents_size_changed(Evas_Object *o, int w, int h)
+{
+    EWK_VIEW_SD_GET_OR_RETURN(o, sd);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api);
+    EINA_SAFETY_ON_NULL_RETURN(sd->api->contents_resize);
+
+    if (!sd->api->contents_resize(sd, w, h))
+        ERR("failed to resize contents to %dx%d", w, h);
+}
+
+/**
+ * @internal
+ * Gets page size from frameview. 
+ *
+ * @param o view.
+ *
+ * @return page size.
+ */
+WebCore::FloatRect ewk_view_page_rect_get(Evas_Object *o)
+{
+    EWK_VIEW_SD_GET(o, sd);
+    EWK_VIEW_PRIV_GET(sd, priv);
+
+    WebCore::Frame* main_frame = priv->page->mainFrame();
+    return main_frame->view()->frameRect();
+} 
+
+/**
+ * @internal
+ * Gets dpi value.
+ *
+ * @return device's dpi value.
+ */
+int ewk_view_dpi_get()
+{
+#ifdef HAVE_ECORE_X
+     return ecore_x_dpi_get();
+#else
+     return 160;
+#endif
+}
diff --git a/WebKit/efl/ewk/ewk_view.h b/WebKit/efl/ewk/ewk_view.h
index 26bf97c..1c4de34 100644
--- a/WebKit/efl/ewk/ewk_view.h
+++ b/WebKit/efl/ewk/ewk_view.h
@@ -384,6 +384,8 @@ EAPI Eina_Bool    ewk_view_setting_auto_load_images_set(Evas_Object *o, Eina_Boo
 EAPI Eina_Bool    ewk_view_setting_auto_shrink_images_get(const Evas_Object *o);
 EAPI Eina_Bool    ewk_view_setting_auto_shrink_images_set(Evas_Object *o, Eina_Bool automatic);
 
+EAPI Eina_Bool    ewk_view_setting_enable_auto_resize_window_get(const Evas_Object *o);
+EAPI Eina_Bool    ewk_view_setting_enable_auto_resize_window_set(Evas_Object *o, Eina_Bool resizable);
 EAPI Eina_Bool    ewk_view_setting_enable_scripts_get(const Evas_Object *o);
 EAPI Eina_Bool    ewk_view_setting_enable_scripts_set(Evas_Object *o, Eina_Bool enable);
 
@@ -455,6 +457,9 @@ EAPI Eina_Bool    ewk_view_setting_local_storage_database_path_set(Evas_Object *
 EAPI Eina_Bool    ewk_view_setting_page_cache_get(Evas_Object* o);
 EAPI Eina_Bool    ewk_view_setting_page_cache_set(Evas_Object* o, Eina_Bool enable);
 
+EAPI Eina_Bool    ewk_view_setting_encoding_detector_get(Evas_Object* o);
+EAPI Eina_Bool    ewk_view_setting_encoding_detector_set(Evas_Object* o, Eina_Bool enable);
+
 /* to be used by subclass implementations */
 EAPI Ewk_View_Smart_Data *ewk_view_smart_data_get(const Evas_Object *o);
 
@@ -489,12 +494,13 @@ EAPI void ewk_view_paint_context_translate(Ewk_View_Paint_Context *ctxt, float x
 EAPI Eina_Bool ewk_view_paint(Ewk_View_Private_Data *priv, cairo_t *cr, const Eina_Rectangle *area);
 EAPI Eina_Bool ewk_view_paint_contents(Ewk_View_Private_Data *priv, cairo_t *cr, const Eina_Rectangle *area);
 
-EAPI void ewk_view_viewport_get(Evas_Object *o, float* w, float* h, float* init_scale, float* max_scale, float* min_scale, float* user_scalable);
+EAPI void ewk_view_viewport_attributes_get(Evas_Object *o, float* w, float* h, float* init_scale, float* max_scale, float* min_scale, float* device_pixel_ratio , Eina_Bool* user_scalable);
 EAPI Eina_Bool ewk_view_zoom_range_set(Evas_Object* o, float min_scale, float max_scale);
 EAPI float ewk_view_zoom_range_min_get(Evas_Object* o);
 EAPI float ewk_view_zoom_range_max_get(Evas_Object* o);
 EAPI void ewk_view_user_scalable_set(Evas_Object* o, Eina_Bool user_scalable);
 EAPI Eina_Bool ewk_view_user_scalable_get(Evas_Object* o);
+EAPI float ewk_view_device_pixel_ratio_get(Evas_Object* o);
 
 #ifdef __cplusplus
 }
diff --git a/WebKit/efl/ewk/ewk_view_single.c b/WebKit/efl/ewk/ewk_view_single.c
index 803b219..85e5339 100644
--- a/WebKit/efl/ewk/ewk_view_single.c
+++ b/WebKit/efl/ewk/ewk_view_single.c
@@ -348,6 +348,8 @@ static Eina_Bool _ewk_view_single_smart_scrolls_process(Ewk_View_Smart_Data *sd)
     for (; sr < sr_end; sr++)
         _ewk_view_single_scroll_process_single(sd, pixels, ow, oh, sr);
 
+    evas_object_image_data_set(sd->backing_store, pixels);
+
     return EINA_TRUE;
 }
 
diff --git a/WebKit/gtk/ChangeLog b/WebKit/gtk/ChangeLog
index c602ac1..cde04c9 100644
--- a/WebKit/gtk/ChangeLog
+++ b/WebKit/gtk/ChangeLog
@@ -1,3 +1,303 @@
+2010-10-20  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] use gtk_widget_hide instead of gtk_widget_hide_all in the fullscreen video conroller
+        https://bugs.webkit.org/show_bug.cgi?id=47972
+
+        * WebCoreSupport/FullscreenVideoController.cpp:
+        (FullscreenVideoController::hideHud):
+        (FullscreenVideoController::exitFullscreen):
+
+2010-10-19  Joone Hur  <joone@kldp.org>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Needs fixing mistyped comments in the API documentation
+        https://bugs.webkit.org/show_bug.cgi?id=47656
+
+        Fixed mistyped comments in the API documenentation.
+
+        * webkit/webkitwebsettings.cpp: Fixed a mistyped comment in the the section block.
+        * webkit/webkitwebwindowfeatures.cpp: Fixed a mistyped comment in the section block.
+
+2010-10-18  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        * NEWS: update for 1.3.5 release.
+        * docs/webkitgtk-sections.txt: add new APIs.
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: [crash] when Inspector Open in CSSStyleSelector::loadPendingImages().
+        https://bugs.webkit.org/show_bug.cgi?id=46224
+
+        * WebCoreSupport/InspectorClientGtk.cpp:
+        (WebKit::InspectorClient::sendMessageToFrontend):
+
+2010-10-14  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Martin Robinson and Xan Lopez.
+
+        [Gtk]: DRT does not support frame flattening testing
+        https://bugs.webkit.org/show_bug.cgi?id=38650
+
+        Implement enable-frame-flattening API for Gtk+.
+
+        * webkit/webkitwebsettings.cpp:
+        (webkit_web_settings_class_init):
+        (webkit_web_settings_set_property):
+        (webkit_web_settings_get_property):
+        (webkit_web_settings_copy):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_update_settings):
+        (webkit_web_view_settings_notify):
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::FrameLoaderClient::dispatchDidFailLoad):
+        * webkit/webkitwebsettings.cpp:
+        (webkitOSVersion):
+        (webkitUserAgent):
+
+2010-10-14  Joone Hur  <joone@kldp.org>
+
+        Reviewed by Andreas Kling.
+
+        [GTK] google.co.kr was missed when checking Google domains
+        https://bugs.webkit.org/show_bug.cgi?id=47652
+
+        WebKitGtk+ maintains a list of Google domains for working well with Google sites.
+        Add google.co.kr also to the list to be checked with other Google domains.
+
+        * WebCoreSupport/FrameLoaderClientGtk.cpp:
+        (WebKit::initializeDomainsList): Added google.co.kr.
+
+2010-10-13  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        WebKitGtk+ to use the new API from the imported SoupURILoader code
+
+        [GTK] Add HTTP caching support
+        https://bugs.webkit.org/show_bug.cgi?id=44261
+
+        ResourceHandleInternal m_msg is now called m_soupMessage.
+
+        * webkit/webkitdownload.cpp:
+        (webkit_download_new_with_handle):
+        (webkit_download_start):
+
+2010-10-13  Xan Lopez  <xlopez@igalia.com>
+
+        Reviewed by Gustavo Noronha.
+
+        [GTK] Remove more warnings from the g-i scanner run
+        https://bugs.webkit.org/show_bug.cgi?id=47255
+
+        Fixes almost all warnings coming from the g-i scanner.
+
+        * webkit/webkitsecurityorigin.cpp: Rename parameter names in
+        gtk-doc blurb to the actual name of the parameter.
+        * webkit/webkitsoupauthdialog.c: ditto.
+        (webkit_soup_auth_dialog_class_init): Write missing doc for the
+        'current-toplevel' signal.
+        * webkit/webkitsoupauthdialog.h: Rename signal parameter to its
+        actual name.
+        * webkit/webkitwebdatabase.cpp: Rename parameter names in
+        gtk-doc blurb to the actual name of the parameter.
+        * webkit/webkitwebinspector.cpp: ditto.
+        (webkit_web_inspector_class_init): ditto.
+        * webkit/webkitwebview.cpp: ditto.
+        (webkit_web_view_class_init): ditto.
+        * webkit/webkitwebview.h: Rename the parameter names to be in sync
+        with the ones we use in the function definition.
+
+2010-10-12  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69589.
+        http://trac.webkit.org/changeset/69589
+        https://bugs.webkit.org/show_bug.cgi?id=47547
+
+        Wrong patch landed from a bug with two patches (Requested by
+        mrobinson on #webkit).
+
+        * webkit/webkitdownload.cpp:
+        (webkit_download_new_with_handle):
+        (webkit_download_start):
+
+2010-10-12  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add HTTP caching support
+        https://bugs.webkit.org/show_bug.cgi?id=44261
+
+        ResourceHandle's m_msg renamed to m_soupMsg and it's also now a PlatformRefPtr
+
+        * webkit/webkitdownload.cpp:
+        (webkit_download_new_with_handle):
+        (webkit_download_start):
+
+2010-10-09  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Removed unused callback in webkitwebview
+        https://bugs.webkit.org/show_bug.cgi?id=47092
+
+        In webkit_web_view_forward_context_menu_event() a callback is
+        connected for the destroy signal of the popup menu, however we
+        reuse the same menu always, holding a ref to it, so it's not
+        destroyed when withdrawn by the user.
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_forward_context_menu_event):
+
+2010-10-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Remove duplicate code in WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
+        https://bugs.webkit.org/show_bug.cgi?id=47367
+
+        Remove as much duplicate code as possible from DragClientGtk. Most of this code
+        is GTK2/GTK3 independent, so only the bits that aren't should be protected by
+        #ifdefs.
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::dragIconWindowDrawEventCallback): Modified the name of this callback
+        so that it is shared between build types.
+        (WebKit::DragClient::DragClient): Updated the signal connectors to reflect the change above.
+        (WebKit::DragClient::~DragClient): The build types share the callback name, so remove
+        the #ifdef here.
+        (WebKit::DragClient::drawDragIconWindow): Changed the name of this method and make it
+        independent of the build type.
+        * WebCoreSupport/DragClientGtk.h: Update method declaration and remove #ifdefs.
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use draw instead of expose_event in WebView when building with gtk3
+        https://bugs.webkit.org/show_bug.cgi?id=47338
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_expose_event):
+        (webkit_web_view_draw):
+        (webkit_web_view_class_init):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Don't use GtkObject
+        https://bugs.webkit.org/show_bug.cgi?id=47090
+
+        GtkObject has been removed in gtk3.
+
+        * WebCoreSupport/EditorClientGtk.cpp:
+        (WebKit::EditorClient::generateEditorCommands):
+        * WebCoreSupport/FullscreenVideoController.cpp:
+        (FullscreenVideoController::createHud):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Use GdkVisual instead of GdkColormap. GdkColormap has been removed
+        in gtk3
+
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_realize):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Do not use GdkDrawable deprecated API. Some methods of GdkDrawable
+        are deprecated in gtk2 and have been removed in gtk3. Equivalent
+        API has been added to GdkWindow.
+
+        * tests/testcopyandpaste.c:
+        (runPasteTestCallback):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_button_press_event):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use draw signal instead of expose_event in DragClientGtk when building with gtk3
+        https://bugs.webkit.org/show_bug.cgi?id=47326
+
+        * WebCoreSupport/DragClientGtk.cpp:
+        (WebKit::dragIconWindowDrawCallback):
+        (WebKit::DragClient::DragClient):
+        (WebKit::DragClient::~DragClient):
+        (WebKit::DragClient::startDrag):
+        (WebKit::DragClient::dragIconWindowDraw):
+        * WebCoreSupport/DragClientGtk.h:
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Fix the build for GTK+ 3
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Don't use gtk_size_request_get_size(). It has been removed,
+        gtk_widget_get_preferred_size() should be used instead
+
+        * webkit/webkitwebview.cpp:
+        (PopupMenuPositionFunc):
+
+2010-10-06  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69201.
+        http://trac.webkit.org/changeset/69201
+        https://bugs.webkit.org/show_bug.cgi?id=47279
+
+        This change broke the WebKitGTK+ build for GTK+ 2.0.
+        (Requested by mrobinson on #webkit).
+
+        * tests/testcopyandpaste.c:
+        (runPasteTestCallback):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_button_press_event):
+
+2010-10-06  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        Port to gtk+3 (2.91.0)
+        https://bugs.webkit.org/show_bug.cgi?id=47249
+
+        Do not use GdkDrawable deprecated API
+
+        Some methods of GdkDrawable are deprecated in gtk2 and have been
+        remmoved in gtk3. Equivalent API has been added to GdkWindow.
+
+        * tests/testcopyandpaste.c:
+        (runPasteTestCallback):
+        * webkit/webkitwebview.cpp:
+        (webkit_web_view_button_press_event):
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/gtk/NEWS b/WebKit/gtk/NEWS
index ebeb699..ed4cd81 100644
--- a/WebKit/gtk/NEWS
+++ b/WebKit/gtk/NEWS
@@ -1,4 +1,18 @@
 ================
+WebKitGTK+ 1.3.5
+================
+
+What's new in WebKitGTK+ 1.3.5?
+
+  - Add a HTTP cache implementation. This will be eventually
+    integrated in libsoup itself, but for now it can be accessed from
+    WebKit through the WebKitSoupCache APIs.
+  - Updated to work with GTK+ 3.x 2.91.1.
+  - Add frame-flattening support, used by some mobile browser sto
+    merge all frames in a page into a continuous view.
+  - Many other bugfixes.
+
+================
 WebKitGTK+ 1.3.4
 ================
 
diff --git a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
index cc75d36..b850cec 100644
--- a/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/DragClientGtk.cpp
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) Igalia S.L.
+ * Copyright (C) 2009, 2010 Igalia S.L.
  *
  *  This library is free software; you can redistribute it and/or
  *  modify it under the terms of the GNU Lesser General Public
@@ -41,23 +41,38 @@ using namespace WebCore;
 
 namespace WebKit {
 
-static gboolean dragIconWindowExposeEventCallback(GtkWidget* widget, GdkEventExpose* event, DragClient* client)
+#ifdef GTK_API_VERSION_2
+static gboolean dragIconWindowDrawEventCallback(GtkWidget* widget, GdkEventExpose* event, DragClient* client)
 {
-    client->dragIconWindowExposeEvent(widget, event);
+    PlatformRefPtr<cairo_t> context = adoptPlatformRef(gdk_cairo_create(event->window));
+    client->drawDragIconWindow(widget, context.get());
     return TRUE;
 }
+#else
+static gboolean dragIconWindowDrawEventCallback(GtkWidget* widget, cairo_t* context, DragClient* client)
+{
+    if (!gdk_cairo_get_clip_rectangle(context, 0))
+        return FALSE;
+    client->drawDragIconWindow(widget, context);
+    return TRUE;
+}
+#endif // GTK_API_VERSION_2
 
 DragClient::DragClient(WebKitWebView* webView)
     : m_webView(webView)
     , m_startPos(0, 0)
     , m_dragIconWindow(gtk_window_new(GTK_WINDOW_POPUP))
 {
-    g_signal_connect(m_dragIconWindow.get(), "expose-event", G_CALLBACK(dragIconWindowExposeEventCallback), this);
+#ifdef GTK_API_VERSION_2
+    g_signal_connect(m_dragIconWindow.get(), "expose-event", G_CALLBACK(dragIconWindowDrawEventCallback), this);
+#else
+    g_signal_connect(m_dragIconWindow.get(), "draw", G_CALLBACK(dragIconWindowDrawEventCallback), this);
+#endif
 }
 
 DragClient::~DragClient()
 {
-    g_signal_handlers_disconnect_by_func(m_dragIconWindow.get(), (gpointer) dragIconWindowExposeEventCallback, this);
+    g_signal_handlers_disconnect_by_func(m_dragIconWindow.get(), (gpointer) dragIconWindowDrawEventCallback, this);
 }
 
 void DragClient::willPerformDragDestinationAction(DragDestinationAction, DragData*)
@@ -106,9 +121,16 @@ void DragClient::startDrag(DragImageRef image, const IntPoint& dragImageOrigin,
 
         if (!gtk_widget_get_realized(m_dragIconWindow.get())) {
             GdkScreen* screen = gtk_widget_get_screen(m_dragIconWindow.get());
+#ifdef GTK_API_VERSION_2
             GdkColormap* rgba = gdk_screen_get_rgba_colormap(screen);
             if (rgba)
                 gtk_widget_set_colormap(m_dragIconWindow.get(), rgba);
+#else
+            GdkVisual* visual = gdk_screen_get_rgba_visual(screen);
+            if (!visual)
+                visual = gdk_screen_get_system_visual(screen);
+            gtk_widget_set_visual(m_dragIconWindow.get(), visual);
+#endif // GTK_API_VERSION_2
         }
 
         IntSize origin = eventPos - dragImageOrigin;
@@ -118,15 +140,14 @@ void DragClient::startDrag(DragImageRef image, const IntPoint& dragImageOrigin,
         gtk_drag_set_icon_default(context);
 }
 
-void DragClient::dragIconWindowExposeEvent(GtkWidget* widget, GdkEventExpose* event)
+void DragClient::drawDragIconWindow(GtkWidget* widget, cairo_t* context)
 {
-    PlatformRefPtr<cairo_t> context = adoptPlatformRef(gdk_cairo_create(event->window));
-    cairo_rectangle(context.get(), 0, 0,
+    cairo_rectangle(context, 0, 0,
                     cairo_image_surface_get_width(m_dragImage.get()),
                     cairo_image_surface_get_height(m_dragImage.get()));
-    cairo_set_operator(context.get(), CAIRO_OPERATOR_SOURCE);
-    cairo_set_source_surface(context.get(), m_dragImage.get(), 0, 0);
-    cairo_fill(context.get());
+    cairo_set_operator(context, CAIRO_OPERATOR_SOURCE);
+    cairo_set_source_surface(context, m_dragImage.get(), 0, 0);
+    cairo_fill(context);
 }
 
 DragImageRef DragClient::createDragImageForLink(KURL&, const String&, Frame*)
diff --git a/WebKit/gtk/WebCoreSupport/DragClientGtk.h b/WebKit/gtk/WebCoreSupport/DragClientGtk.h
index 2ab7e2d..0d07c88 100644
--- a/WebKit/gtk/WebCoreSupport/DragClientGtk.h
+++ b/WebKit/gtk/WebCoreSupport/DragClientGtk.h
@@ -54,7 +54,7 @@ namespace WebKit {
 
         virtual void dragControllerDestroyed();
 
-        void dragIconWindowExposeEvent(GtkWidget*, GdkEventExpose*);
+        void drawDragIconWindow(GtkWidget*, cairo_t*);
 
     private:
         WebKitWebView* m_webView;
diff --git a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
index d4e70b6..749efe9 100644
--- a/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/EditorClientGtk.cpp
@@ -557,7 +557,11 @@ void EditorClient::generateEditorCommands(const KeyboardEvent* event)
     m_pendingEditorCommands.clear();
 
     // First try to interpret the command as a native GTK+ key binding.
+#ifdef GTK_API_VERSION_2
     gtk_bindings_activate_event(GTK_OBJECT(m_nativeWidget.get()), event->keyEvent()->gdkEventKey());
+#else
+    gtk_bindings_activate_event(G_OBJECT(m_nativeWidget.get()), event->keyEvent()->gdkEventKey());
+#endif
     if (m_pendingEditorCommands.size() > 0)
         return;
 
diff --git a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
index 13401f5..fa17632 100644
--- a/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/FrameLoaderClientGtk.cpp
@@ -50,7 +50,6 @@
 #include "MouseEvent.h"
 #include "NotImplemented.h"
 #include "Page.h"
-#include "PlatformString.h"
 #include "PluginDatabase.h"
 #include "RenderPart.h"
 #include "ResourceHandle.h"
@@ -67,6 +66,7 @@
 #include "webkitwebpolicydecision.h"
 #include "webkitwebview.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #include <JavaScriptCore/APICast.h>
 #include <gio/gio.h>
@@ -116,6 +116,7 @@ static void initializeDomainsList(HashSet<String>& googleDomains)
     googleDomains.add("cl");
     googleDomains.add("com.br");
     googleDomains.add("co.uk");
+    googleDomains.add("co.kr");
     googleDomains.add("co.jp");
     googleDomains.add("de");
     googleDomains.add("dj");
@@ -1119,13 +1120,13 @@ void FrameLoaderClient::dispatchDidFailLoad(const ResourceError& error)
     g_free(errorURI);
 
     if (!errorFile)
-        content = String::format("<html><body>%s</body></html>", webError->message);
+        content = makeString("<html><body>", webError->message, "</body></html>");
     else {
         gboolean loaded = g_file_load_contents(errorFile, 0, &fileContent, 0, 0, 0);
         if (!loaded)
-            content = String::format("<html><body>%s</body></html>", webError->message);
+            content = makeString("<html><body>", webError->message, "</body></html>");
         else
-            content = String::format(fileContent, error.failingURL().utf8().data(), webError->message);
+            content = makeString(fileContent, error.failingURL(), webError->message);
     }
 
     webkit_web_frame_load_alternate_string(m_frame, content.utf8().data(), 0, error.failingURL().utf8().data());
diff --git a/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp b/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
index 01bc03a..158a3b8 100644
--- a/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
+++ b/WebKit/gtk/WebCoreSupport/FullscreenVideoController.cpp
@@ -213,7 +213,7 @@ void FullscreenVideoController::hideHud()
     GdkCursor* cursor = blankCursor();
     gdk_window_set_cursor(window, cursor);
 
-    gtk_widget_hide_all(m_hudWindow);
+    gtk_widget_hide(m_hudWindow);
 
     if (m_progressBarUpdateId) {
         g_source_remove(m_progressBarUpdateId);
@@ -350,7 +350,7 @@ void FullscreenVideoController::exitFullscreen()
     if (m_mediaElement->platformMedia().type == WebCore::PlatformMedia::GStreamerGWorldType)
         m_mediaElement->platformMedia().media.gstreamerGWorld->exitFullscreen();
 
-    gtk_widget_hide_all(m_window);
+    gtk_widget_hide(m_window);
 
     gtk_widget_destroy(m_hudWindow);
     m_hudWindow = 0;
@@ -541,8 +541,8 @@ void FullscreenVideoController::createHud()
     GtkWidget* label = gtk_label_new(_("Time:"));
     gtk_box_pack_start(GTK_BOX(hbox), label, FALSE, TRUE, 0);
 
-    GtkObject* adjustment = gtk_adjustment_new(0.0, 0.0, 100.0, 0.1, 1.0, 1.0);
-    m_timeHScale = gtk_hscale_new(GTK_ADJUSTMENT(adjustment));
+    GtkAdjustment* adjustment = GTK_ADJUSTMENT(gtk_adjustment_new(0.0, 0.0, 100.0, 0.1, 1.0, 1.0));
+    m_timeHScale = gtk_hscale_new(adjustment);
     gtk_scale_set_draw_value(GTK_SCALE(m_timeHScale), FALSE);
     gtk_range_set_show_fill_level(GTK_RANGE(m_timeHScale), TRUE);
     gtk_range_set_update_policy(GTK_RANGE(m_timeHScale), GTK_UPDATE_CONTINUOUS);
diff --git a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
index c8b42d7..2c1ffab 100644
--- a/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
+++ b/WebKit/gtk/WebCoreSupport/InspectorClientGtk.cpp
@@ -222,22 +222,7 @@ void InspectorClient::storeSetting(const String&, const String&)
 
 bool InspectorClient::sendMessageToFrontend(const String& message)
 {
-    if (!m_frontendPage)
-        return false;
-
-    Frame* frame = m_frontendPage->mainFrame();
-    if (!frame)
-        return false;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController)
-        return false;
-
-    String dispatchToFrontend("WebInspector.dispatchMessageFromBackend(");
-    dispatchToFrontend += message;
-    dispatchToFrontend += ");";
-    scriptController->executeScript(dispatchToFrontend);
-    return true;
+    return doDispatchMessageOnFrontendPage(m_frontendPage, message);
 }
 
 const char* InspectorClient::inspectorFilesPath()
diff --git a/WebKit/gtk/docs/webkitgtk-sections.txt b/WebKit/gtk/docs/webkitgtk-sections.txt
index 35f9b40..0b185a0 100644
--- a/WebKit/gtk/docs/webkitgtk-sections.txt
+++ b/WebKit/gtk/docs/webkitgtk-sections.txt
@@ -573,6 +573,30 @@ WebKitWebResourceClass
 </SECTION>
 
 <SECTION>
+<FILE>soup-cache</FILE>
+<TITLE>WebKitSoupCache</TITLE>
+webkit_soup_cache_new
+webkit_soup_cache_flush
+webkit_soup_cache_clear
+webkit_soup_cache_dump
+webkit_soup_cache_load
+webkit_soup_cache_set_max_size
+webkit_soup_cache_get_max_size
+<SUBSECTION Standard>
+WEBKIT_IS_SOUP_CACHE
+WEBKIT_IS_SOUP_CACHE_CLASS
+WEBKIT_TYPE_SOUP_CACHE
+WEBKIT_SOUP_CACHE
+WEBKIT_SOUP_CACHE_CLASS
+WEBKIT_SOUP_CACHE_GET_CLASS
+<SUBSECTION Private>
+webkit_soup_cache_get_type
+WebKitSoupCachePrivate
+WebKitSoupCache
+WebKitSoupCacheClass
+</SECTION>
+
+<SECTION>
 <FILE>webkitprivate</FILE>
 getViewFromFrame
 kit
diff --git a/WebKit/gtk/po/ChangeLog b/WebKit/gtk/po/ChangeLog
index 19e86ae..29bef79 100644
--- a/WebKit/gtk/po/ChangeLog
+++ b/WebKit/gtk/po/ChangeLog
@@ -1,3 +1,22 @@
+2010-09-29  Gustavo Noronha Silva  <gustavo.noronha@collabora.co.uk>
+
+        Reviewed by Martin Robinson.
+
+        Avoid touching the po files automatically during the build
+        process. The maintainers still have the option of forcing an
+        update with make update-po.
+
+        * GNUmakefile.am:
+
+2010-09-29  Miloš Popović  <gpopac@gmail.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        Serbian translations update.
+
+        * sr.po:
+        * sr@latin.po:
+
 2010-09-29  Reinout van Schouwen  <reinouts@gnome.org>
 
         Reviewed by Gustavo Noronha.
diff --git a/WebKit/gtk/po/GNUmakefile.am b/WebKit/gtk/po/GNUmakefile.am
index 2c5ff94..4314573 100644
--- a/WebKit/gtk/po/GNUmakefile.am
+++ b/WebKit/gtk/po/GNUmakefile.am
@@ -95,19 +95,22 @@ $(srcdir)/WebKit/gtk/po/$(DOMAIN).pot:
 
 # This target rebuilds a PO file if $(DOMAIN).pot has changed.
 # Note that a PO file is not touched if it doesn't need to be changed.
-$(POFILES): $(srcdir)/WebKit/gtk/po/$(DOMAIN).pot
-	@lang=`echo $@ | sed -e 's,.*/,,' -e 's/\.po$$//'`; \
-	if test -f "$(srcdir)/WebKit/gtk/po/$${lang}.po"; then \
-	  test "$(srcdir)" = . && cdcmd="" || cdcmd="cd $(srcdir)/WebKit/gtk/po && "; \
-	  echo "$${cdcmd}$(MSGMERGE_UPDATE) $${lang}.po $(DOMAIN).pot"; \
-	  cd $(srcdir)/WebKit/gtk/po && $(MSGMERGE_UPDATE) $${lang}.po $(DOMAIN).pot; \
-	else \
-	  $(MAKE) $${lang}.po-create; \
-	fi
+update-po-files: $(srcdir)/WebKit/gtk/po/$(DOMAIN).pot
+	@for pofile in $(POFILES); do \
+	  lang=`echo $$pofile | sed -e 's,.*/,,' -e 's/\.po$$//'`; \
+	  if test -f "$(srcdir)/WebKit/gtk/po/$${lang}.po"; then \
+	    test "$(srcdir)" = . && cdcmd="" || cdcmd="cd $(srcdir)/WebKit/gtk/po && "; \
+	    echo "$${cdcmd}$(MSGMERGE_UPDATE) $${lang}.po $(DOMAIN).pot"; \
+	    pushd $(srcdir)/WebKit/gtk/po && $(MSGMERGE_UPDATE) $${lang}.po $(DOMAIN).pot; \
+	    popd; \
+	  else \
+	    $(MAKE) $${lang}.po-create; \
+	  fi; \
+	done
 
 update-po: GNUmakefile
 	$(MAKE) $(DOMAIN).pot-update
-	$(MAKE) $(POFILES)
+	$(MAKE) update-po-files
 	$(MAKE) $(MOFILES)
 
 .nop.po-create:
diff --git a/WebKit/gtk/po/sr.po b/WebKit/gtk/po/sr.po
index b4d3d55..b132c8d 100644
--- a/WebKit/gtk/po/sr.po
+++ b/WebKit/gtk/po/sr.po
@@ -3,21 +3,22 @@
 # 

 # This file is distributed under the same license as the webkit package.

 # 

-# Милош Поповић <gpopac@gmail.com>
 # Review by Бранко Кокановић <branko.kokanovic@gmail.com> (27.6.2009.)
+# Милош Поповић <gpopac@gmail.com>, 2010.
+#
 msgid ""
 msgstr ""
 "Project-Id-Version: webkit 1.1.10\n"
 "Report-Msgid-Bugs-To: http://bugs.webkit.org/\n"
 "POT-Creation-Date: 2010-02-25 15:53-0300\n"
-"PO-Revision-Date: 2009-06-19 02:35+100\n"
+"PO-Revision-Date: 2010-08-31 04:14+0200\n"
 "Last-Translator: Милош Поповић <gpopac@gmail.com>\n"
 "Language-Team: Serbian <gnom@prevod.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%"
-"10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"Plural-Forms: nplurals=4;    plural=n==1? 3 : n%10==1 && n%100!=11 ? 0 :    n"
+"%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
 
 #: WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:535
 msgid "Upload File"
@@ -54,9 +55,8 @@ msgstr "П_репи� � де�на на лево"
 
 # Ух, ух, ух... ~Милош :(
 #: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:84
-#, fuzzy
 msgid "PDF _Pop directional formatting"
-msgstr "И�качуће _дирекционо форматирање"
+msgstr "И�качуће ПДФ _дирекционо форматирање"
 
 #: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:85
 msgid "ZWS _Zero width space"
@@ -84,14 +84,12 @@ msgid "The network request for the URI that should be downloaded"
 msgstr "Захтевана адре�е датотеке коју желите да преузмете"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:281
-#, fuzzy
 msgid "Network Response"
-msgstr "Захтев на мрежи"
+msgstr "Мрежни одговор"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:282
-#, fuzzy
 msgid "The network response for the URI that should be downloaded"
-msgstr "Захтевана адре�е датотеке коју желите да преузмете"
+msgstr "Одговор на захтевану адре�у датотеке коју желите да преузмете"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:296
 msgid "Destination URI"
@@ -152,7 +150,7 @@ msgstr "Страница %s захтева кори�ничко име и лоз
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:278
 msgid "Server message:"
-msgstr ""
+msgstr "Порука �а �ервера:"
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:291
 msgid "Username:"
@@ -163,9 +161,8 @@ msgid "Password:"
 msgstr "Лозинка:"
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:302
-#, fuzzy
 msgid "_Remember password"
-msgstr "Упамти лозинку"
+msgstr "_Упамти лозинку"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:298
 msgid "Name"
@@ -197,34 +194,30 @@ msgstr "Ð�дреÑ�а Ñ�адржаја који је приказан унутаÑ
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:344
 msgid "Horizontal Scrollbar Policy"
-msgstr ""
+msgstr "Хоризонтални клизач"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:345
-#, fuzzy
 msgid ""
 "Determines the current policy for the horizontal scrollbar of the frame."
-msgstr "Показује тренутни напредак преузимања"
+msgstr "Одређује �мер хоризонталног клизача унутар оквира."
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:362
 msgid "Vertical Scrollbar Policy"
-msgstr ""
+msgstr "Вертикални клизач"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:363
-#, fuzzy
 msgid "Determines the current policy for the vertical scrollbar of the frame."
-msgstr "Показује тренутни напредак преузимања"
+msgstr "Одређује �мер вертикалног клизача унутар оквира."
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:147
 msgid "The title of the history item"
 msgstr "�а�лов за �тавке у и�торијату"
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:162
-#, fuzzy
 msgid "Alternate Title"
 msgstr "Променљив на�лов"
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:163
-#, fuzzy
 msgid "The alternate title of the history item"
 msgstr "Променљив на�лов �тавке у и�торијату"
 
@@ -258,12 +251,10 @@ msgid "The Web View that renders the Web Inspector itself"
 msgstr "Веб приказ кога и�цртава „Веб ин�пектор“"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:282
-#, fuzzy
 msgid "Inspected URI"
 msgstr "Ин�пекција адре�е"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:283
-#, fuzzy
 msgid "The URI that is currently being inspected"
 msgstr "�дре�а коју тренутно обрађује ин�пектор"
 
@@ -276,13 +267,12 @@ msgid "Profile the executed JavaScript."
 msgstr "Прави профил покренуте Јава �крипте."
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:315
-#, fuzzy
 msgid "Enable Timeline profiling"
-msgstr "Омогући учење Јава �крипте"
+msgstr "Омогући времен�ки профил"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:316
 msgid "Profile the WebCore instrumentation."
-msgstr ""
+msgstr "Прави профил WebCore алаки."
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:158
 msgid "Reason"
@@ -313,14 +303,12 @@ msgid "A bitmask representing the state of the modifier keys"
 msgstr "Ознака која одређује да ли је укључен та�тер за измену функције"
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:220
-#, fuzzy
 msgid "Target frame"
-msgstr "Име оквира"
+msgstr "Циљни оквир"
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:221
-#, fuzzy
 msgid "The target frame for the navigation"
-msgstr "Циљна адре�а коју захтева навигација"
+msgstr "Циљни оквир за навигацију"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:237
 msgid "Default Encoding"
@@ -501,155 +489,149 @@ msgstr "Укључује режим разгледања уз чување ваÑ
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:481
 msgid "Enable Spell Checking"
-msgstr ""
+msgstr "Омогући проверу пи�ања"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:482
-#, fuzzy
 msgid "Enables spell checking while typing"
-msgstr "Провери пи�ање _док куцам"
+msgstr "Укључује проверу пи�ања док куцате"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:505
 msgid "Languages to use for spell checking"
-msgstr ""
+msgstr "Језик за проверу пи�ања"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:506
 msgid "Comma separated list of languages to use for spell checking"
-msgstr ""
+msgstr "Спи�ак језика раздвојених тачком који �е кори�те за проверу пи�ања"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:520
-#, fuzzy
 msgid "Enable Caret Browsing"
-msgstr "Приватни режим"
+msgstr "Преглед �а показивачем"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:521
 msgid "Whether to enable accesibility enhanced keyboard navigation"
-msgstr ""
+msgstr "Одређује да ли да �е кори�ти при�тупачнија та�татура за навигацију"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:536
 msgid "Enable HTML5 Database"
-msgstr ""
+msgstr "Укључи ХТМЛ5 базу података"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:537
 msgid "Whether to enable HTML5 database support"
-msgstr ""
+msgstr "Одређује да ли је подржана ХТМЛ5 база података"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:552
 msgid "Enable HTML5 Local Storage"
-msgstr ""
+msgstr "Укључи ХТМЛ5 �кладиште"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:553
 msgid "Whether to enable HTML5 Local Storage support"
-msgstr ""
+msgstr "Одређује да ли је подржано локално ХТМЛ5 �кладиште"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:567
-#, fuzzy
 msgid "Enable XSS Auditor"
-msgstr "Омогући �крипте"
+msgstr "Омогући Ик�СС ревизију"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:568
 msgid "Whether to enable teh XSS auditor"
-msgstr ""
+msgstr "Одређује да ли је укључена Ик�СС ревизија"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:586
 msgid "User Agent"
-msgstr ""
+msgstr "Пред�тављање прегледника"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:587
 msgid "The User-Agent string used by WebKitGtk"
-msgstr ""
+msgstr "�и�ка за пред�тављање WebKitGtk прегледника (кори�нички агент)"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:602
 msgid "JavaScript can open windows automatically"
-msgstr ""
+msgstr "Дозволи Јава �криптама да отворе прозор"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:603
 msgid "Whether JavaScript can open windows automatically"
-msgstr ""
+msgstr "Одређује да ли Јава �крипте могу да отворе нове прозоре"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:618
 msgid "Enable offline web application cache"
-msgstr ""
+msgstr "Омогући о�таву за рад ван мређе"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:619
 msgid "Whether to enable offline web application cache"
-msgstr ""
+msgstr "Одређује да ли �е кори�ти о�тава за рад програма ван мреже"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:646
 msgid "Editing behavior"
-msgstr ""
+msgstr "Понашање уређивача"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:647
 msgid "The behavior mode to use in editing mode"
-msgstr ""
+msgstr "Понашање када �е кори�ти режим за уређивање"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:663
 msgid "Enable universal access from file URIs"
-msgstr ""
+msgstr "Универзални при�туп из адре�а датотеке"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:664
 msgid "Whether to allow universal access from file URIs"
-msgstr ""
+msgstr "Одређује да ли је укључен универзални при�туп из адре�а датотеке"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:679
-#, fuzzy
 msgid "Enable DOM paste"
-msgstr "Омогући �крипте"
+msgstr "Укључи ДОМ убацивање"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:680
 msgid "Whether to enable DOM paste"
-msgstr ""
+msgstr "Одређује да ли је омогућено ДОМ убацивање"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:698
 msgid "Tab key cycles through elements"
-msgstr ""
+msgstr "Tab та�тер ли�та делове �транице"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:699
 msgid "Whether the tab key cycles through elements on the page."
-msgstr ""
+msgstr "Одређује да ли да Tab та�тер ли�та елементе �транице."
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:719
 msgid "Enable Default Context Menu"
-msgstr ""
+msgstr "Подразумевани приручни мени"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:720
 msgid ""
 "Enables the handling of right-clicks for the creation of the default context "
 "menu"
-msgstr ""
+msgstr "Приказује подразумевани приручни мени при клику де�ног та�тера миша"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:740
 msgid "Enable Site Specific Quirks"
-msgstr ""
+msgstr "Прихвати ра�поред �а �транице"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:741
 msgid "Enables the site-specific compatibility workarounds"
-msgstr ""
+msgstr "Омогућава разне до�етке �ајтова за приказ �транице"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:763
 msgid "Enable page cache"
-msgstr ""
+msgstr "Укључи о�таву за �транице"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:764
-#, fuzzy
 msgid "Whether the page cache should be used"
-msgstr "Одређује да ли да �е приказују позадин�ке �лике."
+msgstr "Одређује да ли да �е чувају �транице у о�таву"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:784
 msgid "Auto Resize Window"
-msgstr ""
+msgstr "Сам промени величину прозора"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:785
 msgid "Automatically resize the toplevel window when a page requests it"
-msgstr ""
+msgstr "Сам повећава величину о�новног прозора када �транице то захтевају"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:817
-#, fuzzy
 msgid "Enable Java Applet"
-msgstr "Омогући учење Јава �крипте"
+msgstr "Омогући Јава програмчиће"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:818
 msgid "Whether Java Applet support through <applet> should be enabled"
-msgstr ""
+msgstr "Да ли да укључим подршку за Јава програмчиће кроз <applet>"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2319
 msgid "Returns the @web_view's document title"
@@ -741,11 +723,11 @@ msgstr "Произвољно кодирање веб �транице"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2520
 msgid "Icon URI"
-msgstr ""
+msgstr "�дре�а иконице"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2521
 msgid "The URI for the favicon for the #WebKitWebView."
-msgstr ""
+msgstr "�дре�а иконице за #WebKitWebView."
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:55
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:60
@@ -758,7 +740,7 @@ msgstr "Поништи"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:70
 msgid "This is a searchable index. Enter search keywords: "
-msgstr ""
+msgstr "Можете претражити индек�. Уне�ите речи за претрагу:"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:75
 msgid "Choose File"
@@ -861,7 +843,6 @@ msgid "_Outline"
 msgstr "_Оквир"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:271
-#, fuzzy
 msgid "Inspect _Element"
 msgstr "Ин�пекција _елемента"
 
@@ -919,189 +900,187 @@ msgstr "�епознато"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:364
 msgid "Loading..."
-msgstr ""
+msgstr "Учитавам..."
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:369
 msgid "Live Broadcast"
-msgstr ""
+msgstr "Прено� уживо"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:375
 msgid "audio element controller"
-msgstr ""
+msgstr "контрола звучног елемента"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
 msgid "video element controller"
-msgstr ""
+msgstr "контрола видео елемента"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:379
 msgid "mute"
-msgstr ""
+msgstr "утишај"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:381
 msgid "unmute"
-msgstr ""
+msgstr "појачај"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:383
 msgid "play"
-msgstr ""
+msgstr "пу�ти"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:385
 msgid "pause"
-msgstr ""
+msgstr "паузирај"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:387
 msgid "movie time"
-msgstr ""
+msgstr "трајање филма"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:389
 msgid "timeline slider thumb"
-msgstr ""
+msgstr "линија �а временом"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:391
 msgid "back 30 seconds"
-msgstr ""
+msgstr "назад за 30 s"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:393
 msgid "return to realtime"
-msgstr ""
+msgstr "врати у реално време"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:395
 msgid "elapsed time"
-msgstr ""
+msgstr "прегледано"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:397
 msgid "remaining time"
-msgstr ""
+msgstr "прео�тало"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:399
-#, fuzzy
 msgid "status"
-msgstr "Стање"
+msgstr "�тање"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:401
 msgid "fullscreen"
-msgstr ""
+msgstr "цео екран"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:403
 msgid "fast forward"
-msgstr ""
+msgstr "премотај унапред"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:405
 msgid "fast reverse"
-msgstr ""
+msgstr "премотај уназад"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:407
 msgid "show closed captions"
-msgstr ""
+msgstr "прикажи затворене наslove"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
 msgid "hide closed captions"
-msgstr ""
+msgstr "�акриј затворене наslove"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:418
 msgid "audio element playback controls and status display"
-msgstr ""
+msgstr "�тање и контрола пуштања звучних елемената"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:420
 msgid "video element playback controls and status display"
-msgstr ""
+msgstr "�тање и контрола пуштања видео елемената"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:422
 msgid "mute audio tracks"
-msgstr ""
+msgstr "утишај звук"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:424
 msgid "unmute audio tracks"
-msgstr ""
+msgstr "појачај звук"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
 msgid "begin playback"
-msgstr ""
+msgstr "пу�ти"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:428
 msgid "pause playback"
-msgstr ""
+msgstr "паузирај"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:430
 msgid "movie time scrubber"
-msgstr ""
+msgstr "и�пи�ано време филма"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:432
 msgid "movie time scrubber thumb"
-msgstr ""
+msgstr "клик за и�пи�ано време филма"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:434
 msgid "seek movie back 30 seconds"
-msgstr ""
+msgstr "премотај филм уназад за 30 s"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:436
 msgid "return streaming movie to real time"
-msgstr ""
+msgstr "на�тави приказ филма у реалном времену"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:438
 msgid "current movie time in seconds"
-msgstr ""
+msgstr "протекло трајање филма у �екундама"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:440
 msgid "number of seconds of movie remaining"
-msgstr ""
+msgstr "прео�тало трајање филма у �екундама"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:442
 msgid "current movie status"
-msgstr ""
+msgstr "�тање филма"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:444
 msgid "seek quickly back"
-msgstr ""
+msgstr "брзо премотај уназад"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:446
 msgid "seek quickly forward"
-msgstr ""
+msgstr "брзо премотај унапред"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:448
 msgid "Play movie in fullscreen mode"
-msgstr ""
+msgstr "Пушта филм преко целог екрана"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:450
 msgid "start displaying closed captions"
-msgstr ""
+msgstr "приказуј затворене опције"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:452
 msgid "stop displaying closed captions"
-msgstr ""
+msgstr "не приказуј затворене опције"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
-#, fuzzy
 msgid "indefinite time"
-msgstr "дефиниција"
+msgstr "бе�коначно трајање"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:491
 msgid "value missing"
-msgstr ""
+msgstr "недо�таје вредно�т"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:497
 msgid "type mismatch"
-msgstr ""
+msgstr "не поклапа �е вр�та"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
 msgid "pattern mismatch"
-msgstr ""
+msgstr "не поклапа �е шаблон"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:507
 msgid "too long"
-msgstr ""
+msgstr "предугачко"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
 msgid "range underflow"
-msgstr ""
+msgstr "оп�ег подкорачен"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:517
 msgid "range overflow"
-msgstr ""
+msgstr "оп�ег прекорачен"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:522
 msgid "step mismatch"
-msgstr ""
+msgstr "не поклапа �е корак"
 
 #~ msgid "_Searchable Index"
 #~ msgstr "_Претражив индек�"
diff --git a/WebKit/gtk/po/sr@latin.po b/WebKit/gtk/po/sr@latin.po
index d6a795a..7fb251d 100644
--- a/WebKit/gtk/po/sr@latin.po
+++ b/WebKit/gtk/po/sr@latin.po
@@ -3,21 +3,22 @@
 # 

 # This file is distributed under the same license as the webkit package.

 # 

-# Miloš Popović <gpopac@gmail.com>
 # Review by Branko Kokanović <branko.kokanovic@gmail.com> (27.6.2009.)
+# Miloš Popović <gpopac@gmail.com>, 2010.
+#
 msgid ""
 msgstr ""
 "Project-Id-Version: webkit 1.1.10\n"
 "Report-Msgid-Bugs-To: http://bugs.webkit.org/\n"
 "POT-Creation-Date: 2010-02-25 15:53-0300\n"
-"PO-Revision-Date: 2009-06-19 02:35+100\n"
+"PO-Revision-Date: 2010-08-31 04:14+0200\n"
 "Last-Translator: Miloš Popović <gpopac@gmail.com>\n"
 "Language-Team: Serbian <gnom@prevod.org>\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"Plural-Forms: nplurals=3; plural=(n%10==1 && n%100!=11 ? 0 : n%10>=2 && n%"
-"10<=4 && (n%100<10 || n%100>=20) ? 1 : 2);\n"
+"Plural-Forms: nplurals=4;    plural=n==1? 3 : n%10==1 && n%100!=11 ? 0 :    n"
+"%10>=2 && n%10<=4 && (n%100<10 || n%100>=20) ? 1 : 2;\n"
 
 #: WebKit/gtk/WebCoreSupport/ChromeClientGtk.cpp:535
 msgid "Upload File"
@@ -54,9 +55,8 @@ msgstr "P_repis s desna na levo"
 
 # Uh, uh, uh... ~Miloš :(
 #: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:84
-#, fuzzy
 msgid "PDF _Pop directional formatting"
-msgstr "Iska�uće _direkciono formatiranje"
+msgstr "Iska�uće PDF _direkciono formatiranje"
 
 #: WebKit/gtk/WebCoreSupport/ContextMenuClientGtk.cpp:85
 msgid "ZWS _Zero width space"
@@ -84,14 +84,12 @@ msgid "The network request for the URI that should be downloaded"
 msgstr "Zahtevana adrese datoteke koju želite da preuzmete"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:281
-#, fuzzy
 msgid "Network Response"
-msgstr "Zahtev na mreži"
+msgstr "Mrežni odgovor"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:282
-#, fuzzy
 msgid "The network response for the URI that should be downloaded"
-msgstr "Zahtevana adrese datoteke koju želite da preuzmete"
+msgstr "Odgovor na zahtevanu adresu datoteke koju želite da preuzmete"
 
 #: WebKit/gtk/webkit/webkitdownload.cpp:296
 msgid "Destination URI"
@@ -152,7 +150,7 @@ msgstr "Stranica %s zahteva korisni�ko ime i lozinku"
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:278
 msgid "Server message:"
-msgstr ""
+msgstr "Poruka sa servera:"
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:291
 msgid "Username:"
@@ -163,9 +161,8 @@ msgid "Password:"
 msgstr "Lozinka:"
 
 #: WebKit/gtk/webkit/webkitsoupauthdialog.c:302
-#, fuzzy
 msgid "_Remember password"
-msgstr "Upamti lozinku"
+msgstr "_Upamti lozinku"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:298
 msgid "Name"
@@ -197,34 +194,30 @@ msgstr "Adresa sadržaja koji je prikazan unutar okvira"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:344
 msgid "Horizontal Scrollbar Policy"
-msgstr ""
+msgstr "Horizontalni kliza�"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:345
-#, fuzzy
 msgid ""
 "Determines the current policy for the horizontal scrollbar of the frame."
-msgstr "Pokazuje trenutni napredak preuzimanja"
+msgstr "Određuje smer horizontalnog kliza�a unutar okvira."
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:362
 msgid "Vertical Scrollbar Policy"
-msgstr ""
+msgstr "Vertikalni kliza�"
 
 #: WebKit/gtk/webkit/webkitwebframe.cpp:363
-#, fuzzy
 msgid "Determines the current policy for the vertical scrollbar of the frame."
-msgstr "Pokazuje trenutni napredak preuzimanja"
+msgstr "Određuje smer vertikalnog kliza�a unutar okvira."
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:147
 msgid "The title of the history item"
 msgstr "Naslov za stavke u istorijatu"
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:162
-#, fuzzy
 msgid "Alternate Title"
 msgstr "Promenljiv naslov"
 
 #: WebKit/gtk/webkit/webkitwebhistoryitem.cpp:163
-#, fuzzy
 msgid "The alternate title of the history item"
 msgstr "Promenljiv naslov stavke u istorijatu"
 
@@ -258,12 +251,10 @@ msgid "The Web View that renders the Web Inspector itself"
 msgstr "Veb prikaz koga iscrtava „Veb inspektor“"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:282
-#, fuzzy
 msgid "Inspected URI"
 msgstr "Inspekcija adrese"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:283
-#, fuzzy
 msgid "The URI that is currently being inspected"
 msgstr "Adresa koju trenutno obrađuje inspektor"
 
@@ -276,13 +267,12 @@ msgid "Profile the executed JavaScript."
 msgstr "Pravi profil pokrenute Java skripte."
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:315
-#, fuzzy
 msgid "Enable Timeline profiling"
-msgstr "Omogući u�enje Java skripte"
+msgstr "Omogući vremenski profil"
 
 #: WebKit/gtk/webkit/webkitwebinspector.cpp:316
 msgid "Profile the WebCore instrumentation."
-msgstr ""
+msgstr "Pravi profil WebCore alaki."
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:158
 msgid "Reason"
@@ -313,14 +303,12 @@ msgid "A bitmask representing the state of the modifier keys"
 msgstr "Oznaka koja određuje da li je uklju�en taster za izmenu funkcije"
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:220
-#, fuzzy
 msgid "Target frame"
-msgstr "Ime okvira"
+msgstr "Ciljni okvir"
 
 #: WebKit/gtk/webkit/webkitwebnavigationaction.cpp:221
-#, fuzzy
 msgid "The target frame for the navigation"
-msgstr "Ciljna adresa koju zahteva navigacija"
+msgstr "Ciljni okvir za navigaciju"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:237
 msgid "Default Encoding"
@@ -473,8 +461,7 @@ msgstr "Adresa datoteke sa stilom"
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:410
 msgid "The URI of a stylesheet that is applied to every page."
 msgstr ""
-"Putanja do datoteke sa sopstvenim stilom koji se primenjuje na svaku "
-"stranicu."
+"Putanja do datoteke sa sopstvenim stilom koji se primenjuje na svaku stranicu."
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:425
 msgid "Zoom Stepping Value"
@@ -502,155 +489,149 @@ msgstr "Uklju�uje režim razgledanja uz �uvanje vaše privatnosti"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:481
 msgid "Enable Spell Checking"
-msgstr ""
+msgstr "Omogući proveru pisanja"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:482
-#, fuzzy
 msgid "Enables spell checking while typing"
-msgstr "Proveri pisanje _dok kucam"
+msgstr "Uklju�uje proveru pisanja dok kucate"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:505
 msgid "Languages to use for spell checking"
-msgstr ""
+msgstr "Jezik za proveru pisanja"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:506
 msgid "Comma separated list of languages to use for spell checking"
-msgstr ""
+msgstr "Spisak jezika razdvojenih ta�kom koji se koriste za proveru pisanja"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:520
-#, fuzzy
 msgid "Enable Caret Browsing"
-msgstr "Privatni režim"
+msgstr "Pregled sa pokaziva�em"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:521
 msgid "Whether to enable accesibility enhanced keyboard navigation"
-msgstr ""
+msgstr "Određuje da li da se koristi pristupa�nija tastatura za navigaciju"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:536
 msgid "Enable HTML5 Database"
-msgstr ""
+msgstr "Uklju�i HTML5 bazu podataka"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:537
 msgid "Whether to enable HTML5 database support"
-msgstr ""
+msgstr "Određuje da li je podržana HTML5 baza podataka"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:552
 msgid "Enable HTML5 Local Storage"
-msgstr ""
+msgstr "Uklju�i HTML5 skladište"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:553
 msgid "Whether to enable HTML5 Local Storage support"
-msgstr ""
+msgstr "Određuje da li je podržano lokalno HTML5 skladište"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:567
-#, fuzzy
 msgid "Enable XSS Auditor"
-msgstr "Omogući skripte"
+msgstr "Omogući IksSS reviziju"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:568
 msgid "Whether to enable teh XSS auditor"
-msgstr ""
+msgstr "Određuje da li je uklju�ena IksSS revizija"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:586
 msgid "User Agent"
-msgstr ""
+msgstr "Predstavljanje preglednika"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:587
 msgid "The User-Agent string used by WebKitGtk"
-msgstr ""
+msgstr "Niska za predstavljanje WebKitGtk preglednika (korisni�ki agent)"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:602
 msgid "JavaScript can open windows automatically"
-msgstr ""
+msgstr "Dozvoli Java skriptama da otvore prozor"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:603
 msgid "Whether JavaScript can open windows automatically"
-msgstr ""
+msgstr "Određuje da li Java skripte mogu da otvore nove prozore"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:618
 msgid "Enable offline web application cache"
-msgstr ""
+msgstr "Omogući ostavu za rad van mređe"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:619
 msgid "Whether to enable offline web application cache"
-msgstr ""
+msgstr "Određuje da li se koristi ostava za rad programa van mreže"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:646
 msgid "Editing behavior"
-msgstr ""
+msgstr "Ponašanje uređiva�a"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:647
 msgid "The behavior mode to use in editing mode"
-msgstr ""
+msgstr "Ponašanje kada se koristi režim za uređivanje"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:663
 msgid "Enable universal access from file URIs"
-msgstr ""
+msgstr "Univerzalni pristup iz adresa datoteke"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:664
 msgid "Whether to allow universal access from file URIs"
-msgstr ""
+msgstr "Određuje da li je uklju�en univerzalni pristup iz adresa datoteke"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:679
-#, fuzzy
 msgid "Enable DOM paste"
-msgstr "Omogući skripte"
+msgstr "Uklju�i DOM ubacivanje"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:680
 msgid "Whether to enable DOM paste"
-msgstr ""
+msgstr "Određuje da li je omogućeno DOM ubacivanje"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:698
 msgid "Tab key cycles through elements"
-msgstr ""
+msgstr "Tab taster lista delove stranice"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:699
 msgid "Whether the tab key cycles through elements on the page."
-msgstr ""
+msgstr "Određuje da li da Tab taster lista elemente stranice."
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:719
 msgid "Enable Default Context Menu"
-msgstr ""
+msgstr "Podrazumevani priru�ni meni"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:720
 msgid ""
 "Enables the handling of right-clicks for the creation of the default context "
 "menu"
-msgstr ""
+msgstr "Prikazuje podrazumevani priru�ni meni pri kliku desnog tastera miša"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:740
 msgid "Enable Site Specific Quirks"
-msgstr ""
+msgstr "Prihvati raspored sa stranice"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:741
 msgid "Enables the site-specific compatibility workarounds"
-msgstr ""
+msgstr "Omogućava razne dosetke sajtova za prikaz stranice"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:763
 msgid "Enable page cache"
-msgstr ""
+msgstr "Uklju�i ostavu za stranice"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:764
-#, fuzzy
 msgid "Whether the page cache should be used"
-msgstr "Određuje da li da se prikazuju pozadinske slike."
+msgstr "Određuje da li da se �uvaju stranice u ostavu"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:784
 msgid "Auto Resize Window"
-msgstr ""
+msgstr "Sam promeni veli�inu prozora"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:785
 msgid "Automatically resize the toplevel window when a page requests it"
-msgstr ""
+msgstr "Sam povećava veli�inu osnovnog prozora kada stranice to zahtevaju"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:817
-#, fuzzy
 msgid "Enable Java Applet"
-msgstr "Omogući u�enje Java skripte"
+msgstr "Omogući Java program�iće"
 
 #: WebKit/gtk/webkit/webkitwebsettings.cpp:818
 msgid "Whether Java Applet support through <applet> should be enabled"
-msgstr ""
+msgstr "Da li da uklju�im podršku za Java program�iće kroz <applet>"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2319
 msgid "Returns the @web_view's document title"
@@ -742,11 +723,11 @@ msgstr "Proizvoljno kodiranje veb stranice"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2520
 msgid "Icon URI"
-msgstr ""
+msgstr "Adresa ikonice"
 
 #: WebKit/gtk/webkit/webkitwebview.cpp:2521
 msgid "The URI for the favicon for the #WebKitWebView."
-msgstr ""
+msgstr "Adresa ikonice za #WebKitWebView."
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:55
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:60
@@ -759,7 +740,7 @@ msgstr "Poništi"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:70
 msgid "This is a searchable index. Enter search keywords: "
-msgstr ""
+msgstr "Možete pretražiti indeks. Unesite re�i za pretragu:"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:75
 msgid "Choose File"
@@ -862,7 +843,6 @@ msgid "_Outline"
 msgstr "_Okvir"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:271
-#, fuzzy
 msgid "Inspect _Element"
 msgstr "Inspekcija _elementa"
 
@@ -920,189 +900,187 @@ msgstr "Nepoznato"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:364
 msgid "Loading..."
-msgstr ""
+msgstr "U�itavam..."
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:369
 msgid "Live Broadcast"
-msgstr ""
+msgstr "Prenos uživo"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:375
 msgid "audio element controller"
-msgstr ""
+msgstr "kontrola zvu�nog elementa"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:377
 msgid "video element controller"
-msgstr ""
+msgstr "kontrola video elementa"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:379
 msgid "mute"
-msgstr ""
+msgstr "utišaj"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:381
 msgid "unmute"
-msgstr ""
+msgstr "poja�aj"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:383
 msgid "play"
-msgstr ""
+msgstr "pusti"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:385
 msgid "pause"
-msgstr ""
+msgstr "pauziraj"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:387
 msgid "movie time"
-msgstr ""
+msgstr "trajanje filma"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:389
 msgid "timeline slider thumb"
-msgstr ""
+msgstr "linija sa vremenom"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:391
 msgid "back 30 seconds"
-msgstr ""
+msgstr "nazad za 30 s"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:393
 msgid "return to realtime"
-msgstr ""
+msgstr "vrati u realno vreme"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:395
 msgid "elapsed time"
-msgstr ""
+msgstr "pregledano"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:397
 msgid "remaining time"
-msgstr ""
+msgstr "preostalo"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:399
-#, fuzzy
 msgid "status"
-msgstr "Stanje"
+msgstr "stanje"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:401
 msgid "fullscreen"
-msgstr ""
+msgstr "ceo ekran"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:403
 msgid "fast forward"
-msgstr ""
+msgstr "premotaj unapred"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:405
 msgid "fast reverse"
-msgstr ""
+msgstr "premotaj unazad"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:407
 msgid "show closed captions"
-msgstr ""
+msgstr "prikaži zatvorene naslove"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:409
 msgid "hide closed captions"
-msgstr ""
+msgstr "sakrij zatvorene naslove"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:418
 msgid "audio element playback controls and status display"
-msgstr ""
+msgstr "stanje i kontrola puštanja zvu�nih elemenata"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:420
 msgid "video element playback controls and status display"
-msgstr ""
+msgstr "stanje i kontrola puštanja video elemenata"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:422
 msgid "mute audio tracks"
-msgstr ""
+msgstr "utišaj zvuk"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:424
 msgid "unmute audio tracks"
-msgstr ""
+msgstr "poja�aj zvuk"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:426
 msgid "begin playback"
-msgstr ""
+msgstr "pusti"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:428
 msgid "pause playback"
-msgstr ""
+msgstr "pauziraj"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:430
 msgid "movie time scrubber"
-msgstr ""
+msgstr "ispisano vreme filma"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:432
 msgid "movie time scrubber thumb"
-msgstr ""
+msgstr "klik za ispisano vreme filma"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:434
 msgid "seek movie back 30 seconds"
-msgstr ""
+msgstr "premotaj film unazad za 30 s"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:436
 msgid "return streaming movie to real time"
-msgstr ""
+msgstr "nastavi prikaz filma u realnom vremenu"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:438
 msgid "current movie time in seconds"
-msgstr ""
+msgstr "proteklo trajanje filma u sekundama"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:440
 msgid "number of seconds of movie remaining"
-msgstr ""
+msgstr "preostalo trajanje filma u sekundama"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:442
 msgid "current movie status"
-msgstr ""
+msgstr "stanje filma"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:444
 msgid "seek quickly back"
-msgstr ""
+msgstr "brzo premotaj unazad"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:446
 msgid "seek quickly forward"
-msgstr ""
+msgstr "brzo premotaj unapred"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:448
 msgid "Play movie in fullscreen mode"
-msgstr ""
+msgstr "Pušta film preko celog ekrana"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:450
 msgid "start displaying closed captions"
-msgstr ""
+msgstr "prikazuj zatvorene opcije"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:452
 msgid "stop displaying closed captions"
-msgstr ""
+msgstr "ne prikazuj zatvorene opcije"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:461
-#, fuzzy
 msgid "indefinite time"
-msgstr "definicija"
+msgstr "beskona�no trajanje"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:491
 msgid "value missing"
-msgstr ""
+msgstr "nedostaje vrednost"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:497
 msgid "type mismatch"
-msgstr ""
+msgstr "ne poklapa se vrsta"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:502
 msgid "pattern mismatch"
-msgstr ""
+msgstr "ne poklapa se Å¡ablon"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:507
 msgid "too long"
-msgstr ""
+msgstr "preduga�ko"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:512
 msgid "range underflow"
-msgstr ""
+msgstr "opseg podkora�en"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:517
 msgid "range overflow"
-msgstr ""
+msgstr "opseg prekora�en"
 
 #: WebCore/platform/gtk/LocalizedStringsGtk.cpp:522
 msgid "step mismatch"
-msgstr ""
+msgstr "ne poklapa se korak"
 
 #~ msgid "_Searchable Index"
 #~ msgstr "_Pretraživ indeks"
diff --git a/WebKit/gtk/tests/testcopyandpaste.c b/WebKit/gtk/tests/testcopyandpaste.c
index 5e3f5e7..f7889bd 100644
--- a/WebKit/gtk/tests/testcopyandpaste.c
+++ b/WebKit/gtk/tests/testcopyandpaste.c
@@ -133,7 +133,7 @@ static JSValueRef runPasteTestCallback(JSContextRef context, JSObjectRef functio
     event->key.window = gtk_widget_get_window(GTK_WIDGET(currentFixture->webView));
     g_object_ref(event->key.window);
 #ifndef GTK_API_VERSION_2
-    GdkDeviceManager* manager =  gdk_display_get_device_manager(gdk_drawable_get_display(event->key.window));
+    GdkDeviceManager* manager =  gdk_display_get_device_manager(gdk_window_get_display(event->key.window));
     gdk_event_set_device(event, gdk_device_manager_get_client_pointer(manager));
 #endif
 
diff --git a/WebKit/gtk/webkit/webkitdownload.cpp b/WebKit/gtk/webkit/webkitdownload.cpp
index 1472cb5..18b64ab 100644
--- a/WebKit/gtk/webkit/webkitdownload.cpp
+++ b/WebKit/gtk/webkit/webkitdownload.cpp
@@ -419,8 +419,8 @@ WebKitDownload* webkit_download_new_with_handle(WebKitNetworkRequest* request, W
     g_return_val_if_fail(request, NULL);
 
     ResourceHandleInternal* d = handle->getInternal();
-    if (d->m_msg)
-        soup_session_pause_message(webkit_get_default_session(), d->m_msg);
+    if (d->m_soupMessage)
+        soup_session_pause_message(webkit_get_default_session(), d->m_soupMessage.get());
 
     WebKitDownload* download = WEBKIT_DOWNLOAD(g_object_new(WEBKIT_TYPE_DOWNLOAD, "network-request", request, NULL));
     WebKitDownloadPrivate* priv = download->priv;
@@ -492,8 +492,8 @@ void webkit_download_start(WebKitDownload* download)
         priv->resourceHandle->setClient(priv->downloadClient);
 
         ResourceHandleInternal* d = priv->resourceHandle->getInternal();
-        if (d->m_msg)
-            soup_session_unpause_message(webkit_get_default_session(), d->m_msg);
+        if (d->m_soupMessage)
+            soup_session_unpause_message(webkit_get_default_session(), d->m_soupMessage.get());
     }
 
     priv->timer = g_timer_new();
diff --git a/WebKit/gtk/webkit/webkitsecurityorigin.cpp b/WebKit/gtk/webkit/webkitsecurityorigin.cpp
index 67ad0cf..92d19e7 100644
--- a/WebKit/gtk/webkit/webkitsecurityorigin.cpp
+++ b/WebKit/gtk/webkit/webkitsecurityorigin.cpp
@@ -220,7 +220,7 @@ static void webkit_security_origin_init(WebKitSecurityOrigin* securityOrigin)
 
 /**
  * webkit_security_origin_get_protocol:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns the protocol for the security origin.
  *
@@ -243,7 +243,7 @@ G_CONST_RETURN gchar* webkit_security_origin_get_protocol(WebKitSecurityOrigin*
 
 /**
  * webkit_security_origin_get_host:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns the hostname for the security origin.
  *
@@ -266,7 +266,7 @@ G_CONST_RETURN gchar* webkit_security_origin_get_host(WebKitSecurityOrigin* secu
 
 /**
  * webkit_security_origin_get_port:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns the port for the security origin.
  *
@@ -284,7 +284,7 @@ guint webkit_security_origin_get_port(WebKitSecurityOrigin* securityOrigin)
 
 /**
  * webkit_security_origin_get_web_database_usage:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns the cumulative size of all Web Database database's in the origin
  * in bytes.
@@ -307,7 +307,7 @@ guint64 webkit_security_origin_get_web_database_usage(WebKitSecurityOrigin* secu
 
 /**
  * webkit_security_origin_get_web_database_quota:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns the quota for Web Database storage of the security origin
  * in bytes.
@@ -330,7 +330,7 @@ guint64 webkit_security_origin_get_web_database_quota(WebKitSecurityOrigin* secu
 
 /**
  * webkit_security_origin_set_web_database_quota:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  * @quota: a new Web Database quota in bytes
  *
  * Adjust the quota for Web Database storage of the security origin
@@ -349,7 +349,7 @@ void webkit_security_origin_set_web_database_quota(WebKitSecurityOrigin* securit
 
 /**
  * webkit_security_origin_get_all_web_databases:
- * @security_origin: a #WebKitSecurityOrigin
+ * @securityOrigin: a #WebKitSecurityOrigin
  *
  * Returns a list of all Web Databases in the security origin.
  *
diff --git a/WebKit/gtk/webkit/webkitsoupauthdialog.c b/WebKit/gtk/webkit/webkitsoupauthdialog.c
index 0cf1c23..2eefcc5 100644
--- a/WebKit/gtk/webkit/webkitsoupauthdialog.c
+++ b/WebKit/gtk/webkit/webkitsoupauthdialog.c
@@ -59,6 +59,19 @@ static void webkit_soup_auth_dialog_class_init(WebKitSoupAuthDialogClass* klass)
 {
     GObjectClass* object_class = G_OBJECT_CLASS(klass);
 
+    /**
+     * WebKitSoupAuthDialog::current-toplevel:
+     * @authDialog: the object on which the signal is emitted
+     * @message: the #SoupMessage being used in the authentication process
+     *
+     * This signal is emitted by the @authDialog when it needs to know
+     * the current toplevel widget in order to correctly set the
+     * transiency for the authentication dialog.
+     *
+     * Return value: (transfer none): the current toplevel #GtkWidget or %NULL if there's none
+     *
+     * Since: 1.1.1
+     */
     signals[CURRENT_TOPLEVEL] =
       g_signal_new("current-toplevel",
                    G_OBJECT_CLASS_TYPE(object_class),
diff --git a/WebKit/gtk/webkit/webkitsoupauthdialog.h b/WebKit/gtk/webkit/webkitsoupauthdialog.h
index 01ccfc8..db0ccb8 100644
--- a/WebKit/gtk/webkit/webkitsoupauthdialog.h
+++ b/WebKit/gtk/webkit/webkitsoupauthdialog.h
@@ -41,7 +41,7 @@ typedef struct {
 typedef struct {
     GObjectClass parent_class;
 
-    GtkWidget* (*current_toplevel) (WebKitSoupAuthDialog* feature, SoupMessage* message);
+    GtkWidget* (*current_toplevel) (WebKitSoupAuthDialog* authDialog, SoupMessage* message);
 } WebKitSoupAuthDialogClass;
 
 WEBKIT_API GType
diff --git a/WebKit/gtk/webkit/webkitwebdatabase.cpp b/WebKit/gtk/webkit/webkitwebdatabase.cpp
index cd85e73..680d9c9 100644
--- a/WebKit/gtk/webkit/webkitwebdatabase.cpp
+++ b/WebKit/gtk/webkit/webkitwebdatabase.cpp
@@ -280,7 +280,7 @@ static void webkit_web_database_set_name(WebKitWebDatabase* webDatabase, const g
 
 /**
  * webkit_web_database_get_security_origin:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the security origin of the #WebKitWebDatabase.
  *
@@ -298,7 +298,7 @@ WebKitSecurityOrigin* webkit_web_database_get_security_origin(WebKitWebDatabase*
 
 /**
  * webkit_web_database_get_name:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the canonical name of the #WebKitWebDatabase.
  *
@@ -316,7 +316,7 @@ G_CONST_RETURN gchar* webkit_web_database_get_name(WebKitWebDatabase* webDatabas
 
 /**
  * webkit_web_database_get_display_name:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the name of the #WebKitWebDatabase as seen by the user.
  *
@@ -346,7 +346,7 @@ G_CONST_RETURN gchar* webkit_web_database_get_display_name(WebKitWebDatabase* we
 
 /**
  * webkit_web_database_get_expected_size:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the expected size of the #WebKitWebDatabase in bytes as defined by the
  * web author. The Web Database standard allows web authors to specify an expected
@@ -371,7 +371,7 @@ guint64 webkit_web_database_get_expected_size(WebKitWebDatabase* webDatabase)
 
 /**
  * webkit_web_database_get_size:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the actual size of the #WebKitWebDatabase space on disk in bytes.
  *
@@ -394,7 +394,7 @@ guint64 webkit_web_database_get_size(WebKitWebDatabase* webDatabase)
 
 /**
  * webkit_web_database_get_filename:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Returns the absolute filename to the #WebKitWebDatabase file on disk.
  *
@@ -425,7 +425,7 @@ G_CONST_RETURN gchar* webkit_web_database_get_filename(WebKitWebDatabase* webDat
 
 /**
  * webkit_web_database_remove:
- * @web_database: a #WebKitWebDatabase
+ * @webDatabase: a #WebKitWebDatabase
  *
  * Removes the #WebKitWebDatabase from its security origin and destroys all data
  * stored in the database.
@@ -520,7 +520,7 @@ guint64 webkit_get_default_web_database_quota()
 
 /**
  * webkit_set_default_web_database_quota:
- * @default_quota: the new default database quota
+ * @defaultQuota: the new default database quota
  *
  * Sets the current path to the directory WebKit will write Web 
  * Database databases. 
diff --git a/WebKit/gtk/webkit/webkitwebinspector.cpp b/WebKit/gtk/webkit/webkitwebinspector.cpp
index ee3c8cd..f207906 100644
--- a/WebKit/gtk/webkit/webkitwebinspector.cpp
+++ b/WebKit/gtk/webkit/webkitwebinspector.cpp
@@ -127,7 +127,6 @@ static void webkit_web_inspector_class_init(WebKitWebInspectorClass* klass)
      * WebKitWebInspector::inspect-web-view:
      * @web_inspector: the object on which the signal is emitted
      * @web_view: the #WebKitWebView which will be inspected
-     * @return: a newly allocated #WebKitWebView or %NULL
      *
      * Emitted when the user activates the 'inspect' context menu item
      * to inspect a web view. The application which is interested in
@@ -138,6 +137,8 @@ static void webkit_web_inspector_class_init(WebKitWebInspectorClass* klass)
      * #WebKitWebView instance you create; the widget to which you add
      * it will do that.
      *
+     * Return value: (transfer none): a newly allocated #WebKitWebView or %NULL
+     *
      * Since: 1.0.3
      */
     webkit_web_inspector_signals[INSPECT_WEB_VIEW] = g_signal_new("inspect-web-view",
@@ -476,7 +477,7 @@ webkit_web_inspector_set_inspector_client(WebKitWebInspector* web_inspector, Web
 
 /**
  * webkit_web_inspector_show:
- * @web_inspector: the #WebKitWebInspector that will be shown
+ * @webInspector: the #WebKitWebInspector that will be shown
  *
  * Causes the Web Inspector to be shown.
  *
@@ -537,7 +538,7 @@ void webkit_web_inspector_inspect_coordinates(WebKitWebInspector* webInspector,
 
 /**
  * webkit_web_inspector_close:
- * @web_inspector: the #WebKitWebInspector that will be closed
+ * @webInspector: the #WebKitWebInspector that will be closed
  *
  * Causes the Web Inspector to be closed.
  *
diff --git a/WebKit/gtk/webkit/webkitwebnavigationaction.cpp b/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
index f421f40..ce5dd92 100644
--- a/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
+++ b/WebKit/gtk/webkit/webkitwebnavigationaction.cpp
@@ -177,8 +177,8 @@ static void webkit_web_navigation_action_class_init(WebKitWebNavigationActionCla
     /**
      * WebKitWebNavigationAction:button:
      *
-     * The DOM identifier for the mouse button used to click. DOM button values
-     * are 0, 1 and 2 for left, middle and right buttons. If the action was not
+     * The GTK+ identifier for the mouse button used to click. Notice that GTK+ button values
+     * are 1, 2 and 3 for left, middle and right buttons, so they are DOM button values +1. If the action was not
      * initiated by a mouse click the value will be -1.
      *
      * Since: 1.0.3
@@ -310,9 +310,9 @@ void webkit_web_navigation_action_set_original_uri(WebKitWebNavigationAction* na
  * webkit_web_navigation_action_get_button:
  * @navigationAction: a #WebKitWebNavigationAction
  *
- * Returns the DOM identifier for the mouse button used to click.
- * DOM button values are 0, 1 and 2 for left, middle and right buttons.
- * If the action was not initiated by a mouse click, returns -1.
+ * The GTK+ identifier for the mouse button used to click. Notice that GTK+ button values
+ * are 1, 2 and 3 for left, middle and right buttons, so they are DOM button values +1. If the action was not
+ * initiated by a mouse click the value will be -1.
  *
  * Return value: the mouse button used to click
  *
diff --git a/WebKit/gtk/webkit/webkitwebsettings.cpp b/WebKit/gtk/webkit/webkitwebsettings.cpp
index 8a207d9..cd59bdb 100644
--- a/WebKit/gtk/webkit/webkitwebsettings.cpp
+++ b/WebKit/gtk/webkit/webkitwebsettings.cpp
@@ -33,8 +33,8 @@
 #include "FileSystem.h"
 #include "PluginDatabase.h"
 #include "Language.h"
-#include "PlatformString.h"
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 #include <glib/gi18n-lib.h>
 #if OS(UNIX)
@@ -45,9 +45,9 @@
  * SECTION:webkitwebsettings
  * @short_description: Control the behaviour of a #WebKitWebView
  *
- * #WebKitWebSettings can be applied to a #WebKitWebView to control
- * the to be used text encoding, color, font sizes, printing mode,
- * script support, loading of images and various other things.
+ * #WebKitWebSettings can be applied to a #WebKitWebView to control text encoding, 
+ * color, font sizes, printing mode, script support, loading of images and various other things. 
+ * After creation, a #WebKitWebSettings object contains default settings. 
  *
  * <informalexample><programlisting>
  * /<!-- -->* Create a new websettings and disable java script *<!-- -->/
@@ -94,6 +94,7 @@ struct _WebKitWebSettingsPrivate {
     gboolean enable_html5_local_storage;
     gboolean enable_xss_auditor;
     gboolean enable_spatial_navigation;
+    gboolean enable_frame_flattening;
     gchar* user_agent;
     gboolean javascript_can_open_windows_automatically;
     gboolean javascript_can_access_clipboard;
@@ -145,6 +146,7 @@ enum {
     PROP_ENABLE_HTML5_LOCAL_STORAGE,
     PROP_ENABLE_XSS_AUDITOR,
     PROP_ENABLE_SPATIAL_NAVIGATION,
+    PROP_ENABLE_FRAME_FLATTENING,
     PROP_USER_AGENT,
     PROP_JAVASCRIPT_CAN_OPEN_WINDOWS_AUTOMATICALLY,
     PROP_JAVASCRIPT_CAN_ACCESS_CLIPBOARD,
@@ -201,7 +203,7 @@ static String webkitOSVersion()
 
     struct utsname name;
     if (uname(&name) != -1)
-        uaOSVersion = String::format("%s %s", name.sysname, name.machine);
+        uaOSVersion = makeString(name.sysname, ' ', name.machine);
     else
         uaOSVersion = String("Unknown");
 #elif OS(WINDOWS)
@@ -218,9 +220,9 @@ String webkitUserAgent()
     // We mention Safari since many broken sites check for it (OmniWeb does this too)
     // We re-use the WebKit version, though it doesn't seem to matter much in practice
 
-    DEFINE_STATIC_LOCAL(const String, uaVersion, (String::format("%d.%d+", WEBKIT_USER_AGENT_MAJOR_VERSION, WEBKIT_USER_AGENT_MINOR_VERSION)));
-    DEFINE_STATIC_LOCAL(const String, staticUA, (String::format("Mozilla/5.0 (%s; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko) Version/5.0 Safari/%s",
-                                                                webkitPlatform().utf8().data(), webkitOSVersion().utf8().data(), defaultLanguage().utf8().data(), uaVersion.utf8().data(), uaVersion.utf8().data())));
+    DEFINE_STATIC_LOCAL(const String, uaVersion, (makeString(String::number(WEBKIT_USER_AGENT_MAJOR_VERSION), '.', String::number(WEBKIT_USER_AGENT_MINOR_VERSION), '+')));
+    DEFINE_STATIC_LOCAL(const String, staticUA, (makeString("Mozilla/5.0 (", webkitPlatform(), "; U; ", webkitOSVersion(), "; ", defaultLanguage(), ") AppleWebKit/", uaVersion) +
+                                                 makeString(" (KHTML, like Gecko) Version/5.0 Safari/", uaVersion)));
 
     return staticUA;
 }
@@ -600,6 +602,25 @@ static void webkit_web_settings_class_init(WebKitWebSettingsClass* klass)
                                                          FALSE,
                                                          flags));
     /**
+    * WebKitWebSettings:enable-frame-flattening
+    *
+    * Whether to enable the Frame Flattening. With this setting each subframe is expanded
+    * to its contents, which will flatten all the frames to become one scrollable page.
+    * On touch devices, it is desired to not have any scrollable sub parts of the page as
+    * it results in a confusing user experience, with scrolling sometimes scrolling sub parts
+    * and at other times scrolling the page itself. For this reason iframes and framesets are
+    * barely usable on touch devices.
+    *
+    * Since: 1.3.5
+    */
+    g_object_class_install_property(gobject_class,
+                                    PROP_ENABLE_FRAME_FLATTENING,
+                                    g_param_spec_boolean("enable-frame-flattening",
+                                                         _("Enable Frame Flattening"),
+                                                         _("Whether to enable Frame Flattening"),
+                                                         FALSE,
+                                                         flags));
+    /**
      * WebKitWebSettings:user-agent:
      *
      * The User-Agent string used by WebKitGtk.
@@ -1054,6 +1075,9 @@ static void webkit_web_settings_set_property(GObject* object, guint prop_id, con
     case PROP_ENABLE_SPATIAL_NAVIGATION:
         priv->enable_spatial_navigation = g_value_get_boolean(value);
         break;
+    case PROP_ENABLE_FRAME_FLATTENING:
+        priv->enable_frame_flattening = g_value_get_boolean(value);
+        break;
     case PROP_USER_AGENT:
         g_free(priv->user_agent);
         if (!g_value_get_string(value) || !strlen(g_value_get_string(value)))
@@ -1202,6 +1226,9 @@ static void webkit_web_settings_get_property(GObject* object, guint prop_id, GVa
     case PROP_ENABLE_SPATIAL_NAVIGATION:
         g_value_set_boolean(value, priv->enable_spatial_navigation);
         break;
+    case PROP_ENABLE_FRAME_FLATTENING:
+        g_value_set_boolean(value, priv->enable_frame_flattening);
+        break;
     case PROP_USER_AGENT:
         g_value_set_string(value, priv->user_agent);
         break;
@@ -1306,6 +1333,7 @@ WebKitWebSettings* webkit_web_settings_copy(WebKitWebSettings* web_settings)
                  "enable-html5-local-storage", priv->enable_html5_local_storage,
                  "enable-xss-auditor", priv->enable_xss_auditor,
                  "enable-spatial-navigation", priv->enable_spatial_navigation,
+                 "enable-frame-flattening", priv->enable_frame_flattening,
                  "user-agent", webkit_web_settings_get_user_agent(web_settings),
                  "javascript-can-open-windows-automatically", priv->javascript_can_open_windows_automatically,
                  "javascript-can-access-clipboard", priv->javascript_can_access_clipboard,
diff --git a/WebKit/gtk/webkit/webkitwebview.cpp b/WebKit/gtk/webkit/webkitwebview.cpp
index 762888a..f5d0ef6 100644
--- a/WebKit/gtk/webkit/webkitwebview.cpp
+++ b/WebKit/gtk/webkit/webkitwebview.cpp
@@ -208,11 +208,6 @@ static void webkit_web_view_set_window_features(WebKitWebView* webView, WebKitWe
 
 static GtkIMContext* webkit_web_view_get_im_context(WebKitWebView*);
 
-static void destroy_menu_cb(GtkObject* object, gpointer data)
-{
-    WEBKIT_WEB_VIEW(data)->priv->currentMenu = 0;
-}
-
 static void PopupMenuPositionFunc(GtkMenu* menu, gint *x, gint *y, gboolean *pushIn, gpointer userData)
 {
     WebKitWebView* view = WEBKIT_WEB_VIEW(userData);
@@ -223,7 +218,7 @@ static void PopupMenuPositionFunc(GtkMenu* menu, gint *x, gint *y, gboolean *pus
 #ifdef GTK_API_VERSION_2
     gtk_widget_size_request(GTK_WIDGET(menu), &menuSize);
 #else
-    gtk_size_request_get_size(GTK_SIZE_REQUEST(menu), &menuSize, NULL);
+    gtk_widget_get_preferred_size(GTK_WIDGET(menu), &menuSize, NULL);
 #endif
 
     *x = priv->lastPopupXPosition;
@@ -308,10 +303,6 @@ static gboolean webkit_web_view_forward_context_menu_event(WebKitWebView* webVie
     priv->lastPopupXPosition = event.globalX();
     priv->lastPopupYPosition = event.globalY();
 
-    g_signal_connect(menu, "destroy",
-                     G_CALLBACK(destroy_menu_cb),
-                     NULL);
-
     gtk_menu_popup(menu, NULL, NULL,
                    &PopupMenuPositionFunc,
                    webView, event.button() + 1, gtk_get_current_event_time());
@@ -492,26 +483,56 @@ static void webkit_web_view_set_property(GObject* object, guint prop_id, const G
     }
 }
 
-static bool shouldCoalesce(GdkRectangle rect, GdkRectangle* rects, int count)
+static bool shouldCoalesce(const IntRect& rect, const Vector<IntRect>& rects)
 {
-    const int cRectThreshold = 10;
+    const unsigned int cRectThreshold = 10;
     const float cWastedSpaceThreshold = 0.75f;
-    bool useUnionedRect = (count <= 1) || (count > cRectThreshold);
-    if (!useUnionedRect) {
-        // Attempt to guess whether or not we should use the unioned rect or the individual rects.
-        // We do this by computing the percentage of "wasted space" in the union.  If that wasted space
-        // is too large, then we will do individual rect painting instead.
-        float unionPixels = (rect.width * rect.height);
-        float singlePixels = 0;
-        for (int i = 0; i < count; ++i)
-            singlePixels += rects[i].width * rects[i].height;
-        float wastedSpace = 1 - (singlePixels / unionPixels);
-        if (wastedSpace <= cWastedSpaceThreshold)
-            useUnionedRect = true;
-    }
+    bool useUnionedRect = (rects.size() <= 1) || (rects.size() > cRectThreshold);
+    if (useUnionedRect)
+        return true;
+    // Attempt to guess whether or not we should use the unioned rect or the individual rects.
+    // We do this by computing the percentage of "wasted space" in the union.  If that wasted space
+    // is too large, then we will do individual rect painting instead.
+    float unionPixels = (rect.width() * rect.height());
+    float singlePixels = 0;
+    for (size_t i = 0; i < rects.size(); ++i)
+        singlePixels += rects[i].width() * rects[i].height();
+    float wastedSpace = 1 - (singlePixels / unionPixels);
+    if (wastedSpace <= cWastedSpaceThreshold)
+        useUnionedRect = true;
     return useUnionedRect;
 }
 
+static void paintWebView(Frame* frame, gboolean transparent, GraphicsContext& context, const IntRect& clipRect, const Vector<IntRect>& rects)
+{
+    bool coalesce = true;
+
+    if (rects.size() > 0)
+        coalesce = shouldCoalesce(clipRect, rects);
+
+    if (coalesce) {
+        context.clip(clipRect);
+        if (transparent)
+            context.clearRect(clipRect);
+        frame->view()->paint(&context, clipRect);
+    } else {
+        for (size_t i = 0; i < rects.size(); i++) {
+            IntRect rect = rects[i];
+            context.save();
+            context.clip(rect);
+            if (transparent)
+                context.clearRect(rect);
+            frame->view()->paint(&context, rect);
+            context.restore();
+        }
+    }
+
+    context.save();
+    context.clip(clipRect);
+    frame->page()->inspectorController()->drawNodeHighlight(context);
+    context.restore();
+}
+#ifdef GTK_API_VERSION_2
 static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose* event)
 {
     WebKitWebView* webView = WEBKIT_WEB_VIEW(widget);
@@ -527,44 +548,48 @@ static gboolean webkit_web_view_expose_event(GtkWidget* widget, GdkEventExpose*
         ctx.setGdkExposeEvent(event);
 
         int rectCount;
-#ifdef GTK_API_VERSION_2
         GOwnPtr<GdkRectangle> rects;
         gdk_region_get_rectangles(event->region, &rects.outPtr(), &rectCount);
-#else
-        rectCount = cairo_region_num_rectangles(event->region);
-        GOwnPtr<GdkRectangle> rects(g_new(GdkRectangle, rectCount));
+        Vector<IntRect> paintRects;
         for (int i = 0; i < rectCount; i++)
-            cairo_region_get_rectangle(event->region, i, rects.get()+i);
-#endif
-        // Avoid recursing into the render tree excessively
-        bool coalesce = shouldCoalesce(event->area, rects.get(), rectCount);
-
-        if (coalesce) {
-            IntRect rect = event->area;
-            ctx.clip(rect);
-            if (priv->transparent)
-                ctx.clearRect(rect);
-            frame->view()->paint(&ctx, rect);
-        } else {
-            for (int i = 0; i < rectCount; i++) {
-                IntRect rect = rects.get()[i];
-                ctx.save();
-                ctx.clip(rect);
-                if (priv->transparent)
-                    ctx.clearRect(rect);
-                frame->view()->paint(&ctx, rect);
-                ctx.restore();
-            }
+            paintRects.append(IntRect(rects.get()[i]));
+
+        paintWebView(frame, priv->transparent, ctx, static_cast<IntRect>(event->area), paintRects);
+    }
+
+    return FALSE;
+}
+#else
+static gboolean webkit_web_view_draw(GtkWidget* widget, cairo_t* cr)
+{
+    WebKitWebView* webView = WEBKIT_WEB_VIEW(widget);
+    WebKitWebViewPrivate* priv = webView->priv;
+    GdkRectangle clipRect;
+
+    if (!gdk_cairo_get_clip_rectangle(cr, &clipRect))
+        return FALSE;
+
+    Frame* frame = core(webView)->mainFrame();
+    if (frame->contentRenderer() && frame->view()) {
+        GraphicsContext ctx(cr);
+        IntRect rect = clipRect;
+        cairo_rectangle_list_t* rectList = cairo_copy_clip_rectangle_list(cr);
+
+        frame->view()->updateLayoutAndStyleIfNeededRecursive();
+
+        Vector<IntRect> rects;
+        if (!rectList->status && rectList->num_rectangles > 0) {
+            for (int i = 0; i < rectList->num_rectangles; i++)
+                rects.append(enclosingIntRect(FloatRect(rectList->rectangles[i])));
         }
+        paintWebView(frame, priv->transparent, ctx, rect, rects);
 
-        ctx.save();
-        ctx.clip(static_cast<IntRect>(event->area));
-        frame->page()->inspectorController()->drawNodeHighlight(ctx);
-        ctx.restore();
+        cairo_rectangle_list_destroy(rectList);
     }
 
     return FALSE;
 }
+#endif // GTK_API_VERSION_2
 
 static gboolean webkit_web_view_key_press_event(GtkWidget* widget, GdkEventKey* event)
 {
@@ -641,7 +666,7 @@ static gboolean webkit_web_view_button_press_event(GtkWidget* widget, GdkEventBu
 
     gint doubleClickDistance = 250;
     gint doubleClickTime = 5;
-    GtkSettings* settings = gtk_settings_get_for_screen(gdk_drawable_get_screen(gtk_widget_get_window(widget)));
+    GtkSettings* settings = gtk_settings_get_for_screen(gtk_widget_get_screen(widget));
     g_object_get(settings, 
         "gtk-double-click-distance", &doubleClickDistance,
         "gtk-double-click-time", &doubleClickTime, NULL);
@@ -848,7 +873,9 @@ static void webkit_web_view_realize(GtkWidget* widget)
     attributes.height = allocation.height;
     attributes.wclass = GDK_INPUT_OUTPUT;
     attributes.visual = gtk_widget_get_visual(widget);
+#ifdef GTK_API_VERSION_2
     attributes.colormap = gtk_widget_get_colormap(widget);
+#endif
     attributes.event_mask = GDK_VISIBILITY_NOTIFY_MASK
                             | GDK_EXPOSURE_MASK
                             | GDK_BUTTON_PRESS_MASK
@@ -861,7 +888,10 @@ static void webkit_web_view_realize(GtkWidget* widget)
                             | GDK_BUTTON2_MOTION_MASK
                             | GDK_BUTTON3_MOTION_MASK;
 
-    gint attributes_mask = GDK_WA_X | GDK_WA_Y | GDK_WA_VISUAL | GDK_WA_COLORMAP;
+    gint attributes_mask = GDK_WA_X | GDK_WA_Y | GDK_WA_VISUAL;
+#ifdef GTK_API_VERSION_2
+    attributes_mask |= GDK_WA_COLORMAP;
+#endif
     GdkWindow* window = gdk_window_new(gtk_widget_get_parent_window(widget), &attributes, attributes_mask);
     gtk_widget_set_window(widget, window);
     gdk_window_set_user_data(window, widget);
@@ -1489,7 +1519,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::create-web-view:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame
      *
      * Emitted when the creation of a new window is requested.
@@ -1519,7 +1549,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::web-view-ready:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      *
      * Emitted after #WebKitWebView::create-web-view when the new #WebKitWebView
      * should be displayed to the user. When this signal is emitted
@@ -1548,7 +1578,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::close-web-view:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      *
      * Emitted when closing a #WebKitWebView is requested. This occurs when a
      * call is made from JavaScript's window.close function. The default
@@ -1571,7 +1601,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::navigation-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame that required the navigation
      * @request: a #WebKitNetworkRequest
      *
@@ -1595,7 +1625,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::new-window-policy-decision-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame that required the navigation
      * @request: a #WebKitNetworkRequest
      * @navigation_action: a #WebKitWebNavigationAction
@@ -1642,7 +1672,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::navigation-policy-decision-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame that required the navigation
      * @request: a #WebKitNetworkRequest
      * @navigation_action: a #WebKitWebNavigationAction
@@ -1679,7 +1709,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::mime-type-policy-decision-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame that required the policy decision
      * @request: a WebKitNetworkRequest
      * @mimetype: the MIME type attempted to load
@@ -1721,7 +1751,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::window-object-cleared:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the #WebKitWebFrame to which @window_object belongs
      * @context: the #JSGlobalContextRef holding the global object and other
      * execution state; equivalent to the return value of
@@ -1747,7 +1777,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::download-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @download: a #WebKitDownload object that lets you control the
      * download process
      *
@@ -1789,7 +1819,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::load-started:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the frame going to do the load
      *
      * When a #WebKitWebFrame begins to load this signal is emitted.
@@ -1808,7 +1838,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::load-committed:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the main frame that received the first data
      *
      * When a #WebKitWebFrame loaded the first data this signal is emitted.
@@ -1828,7 +1858,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::load-progress-changed:
-     * @web_view: the #WebKitWebView
+     * @webView: the #WebKitWebView
      * @progress: the global progress
      *
      * Deprecated: Use the "progress" property instead.
@@ -1845,7 +1875,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::load-error
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @web_frame: the #WebKitWebFrame
      * @uri: the URI that triggered the error
      * @web_error: the #GError that was triggered
@@ -1873,7 +1903,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::load-finished:
-     * @web_view: the #WebKitWebView
+     * @webView: the #WebKitWebView
      * @frame: the #WebKitWebFrame
      *
      * Deprecated: Use the "load-status" property instead.
@@ -1890,7 +1920,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::onload-event:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the frame
      *
      * When a #WebKitWebFrame receives an onload event this signal is emitted.
@@ -1907,7 +1937,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::title-changed:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the main frame
      * @title: the new title
      *
@@ -1928,7 +1958,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::hovering-over-link:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @title: the link's title
      * @uri: the URI the link points to
      *
@@ -1947,7 +1977,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::populate-popup:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @menu: the context menu
      *
      * When a context menu is about to be displayed this signal is emitted.
@@ -1966,7 +1996,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::print-requested
-     * @web_view: the object in which the signal is emitted
+     * @webView: the object in which the signal is emitted
      * @web_frame: the frame that is requesting to be printed
      *
      * Emitted when printing is requested by the frame, usually
@@ -2006,7 +2036,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::icon-loaded:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @icon_uri: the URI for the icon
      *
      * This signal is emitted when the main frame has got a favicon.
@@ -2034,7 +2064,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::console-message:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @message: the message text
      * @line: the line where the error occured
      * @source_id: the source id
@@ -2056,7 +2086,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::script-alert:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the relevant frame
      * @message: the message text
      *
@@ -2077,7 +2107,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::script-confirm:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the relevant frame
      * @message: the message text
      * @confirmed: whether the dialog has been confirmed
@@ -2099,7 +2129,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::script-prompt:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the relevant frame
      * @message: the message text
      * @default: the default value
@@ -2122,7 +2152,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::select-all:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::select-all signal is a keybinding signal which gets emitted to
      * select the complete contents of the text view.
@@ -2139,7 +2169,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::cut-clipboard:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::cut-clipboard signal is a keybinding signal which gets emitted to
      * cut the selection to the clipboard.
@@ -2156,7 +2186,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::copy-clipboard:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::copy-clipboard signal is a keybinding signal which gets emitted to
      * copy the selection to the clipboard.
@@ -2173,7 +2203,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::paste-clipboard:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::paste-clipboard signal is a keybinding signal which gets emitted to
      * paste the contents of the clipboard into the Web view.
@@ -2190,7 +2220,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::undo
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::undo signal is a keybinding signal which gets emitted to
      * undo the last editing command.
@@ -2209,7 +2239,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::redo
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      *
      * The #WebKitWebView::redo signal is a keybinding signal which gets emitted to
      * redo the last editing command.
@@ -2228,7 +2258,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::move-cursor:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @step: the type of movement, one of #GtkMovementStep
      * @count: an integer indicating the subtype of movement. Currently
      *         the permitted values are '1' = forward, '-1' = backwards.
@@ -2252,7 +2282,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::create-plugin-widget:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @mime_type: the mimetype of the requested object
      * @uri: the URI to load
      * @param: a #GHashTable with additional attributes (strings)
@@ -2280,7 +2310,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::database-quota-exceeded
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @frame: the relevant frame
      * @database: the #WebKitWebDatabase which exceeded the quota of its #WebKitSecurityOrigin
      *
@@ -2302,7 +2332,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::resource-request-starting:
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @web_frame: the #WebKitWebFrame whose load dispatched this request
      * @web_resource: an empty #WebKitWebResource object
      * @request: the #WebKitNetworkRequest that will be dispatched
@@ -2343,7 +2373,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::geolocation-policy-decision-requested:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the frame that requests permission
      * @policy_decision: a WebKitGeolocationPolicyDecision
      *
@@ -2368,7 +2398,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /**
      * WebKitWebView::geolocation-policy-decision-cancelled:
-     * @web_view: the object on which the signal is emitted
+     * @webView: the object on which the signal is emitted
      * @frame: the frame that cancels geolocation request.
      *
      * When a @frame wants to cancel geolocation permission it had requested
@@ -2393,7 +2423,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /*
      * WebKitWebView::document-load-finished
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @web_frame: the #WebKitWebFrame whose load dispatched this request
      *
      * Emitted when the DOM document object load is finished for the
@@ -2410,7 +2440,7 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     /*
      * WebKitWebView::frame-created
-     * @web_view: the object which received the signal
+     * @webView: the object which received the signal
      * @web_frame: the #WebKitWebFrame which was just created.
      *
      * Emitted when a WebKitWebView has created a new frame. This signal will
@@ -2458,7 +2488,11 @@ static void webkit_web_view_class_init(WebKitWebViewClass* webViewClass)
 
     GtkWidgetClass* widgetClass = GTK_WIDGET_CLASS(webViewClass);
     widgetClass->realize = webkit_web_view_realize;
+#ifdef GTK_API_VERSION_2
     widgetClass->expose_event = webkit_web_view_expose_event;
+#else
+    widgetClass->draw = webkit_web_view_draw;
+#endif
     widgetClass->key_press_event = webkit_web_view_key_press_event;
     widgetClass->key_release_event = webkit_web_view_key_release_event;
     widgetClass->button_press_event = webkit_web_view_button_press_event;
@@ -2849,7 +2883,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     gboolean autoLoadImages, autoShrinkImages, printBackgrounds,
         enableScripts, enablePlugins, enableDeveloperExtras, resizableTextAreas,
         enablePrivateBrowsing, enableCaretBrowsing, enableHTML5Database, enableHTML5LocalStorage,
-        enableXSSAuditor, enableSpatialNavigation, javascriptCanOpenWindows,
+        enableXSSAuditor, enableSpatialNavigation, enableFrameFlattening, javascriptCanOpenWindows,
         javaScriptCanAccessClipboard, enableOfflineWebAppCache,
         enableUniversalAccessFromFileURI, enableFileAccessFromFileURI,
         enableDOMPaste, tabKeyCyclesThroughElements,
@@ -2879,6 +2913,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
                  "enable-html5-local-storage", &enableHTML5LocalStorage,
                  "enable-xss-auditor", &enableXSSAuditor,
                  "enable-spatial-navigation", &enableSpatialNavigation,
+                 "enable-frame-flattening", &enableFrameFlattening,
                  "javascript-can-open-windows-automatically", &javascriptCanOpenWindows,
                  "javascript-can-access-clipboard", &javaScriptCanAccessClipboard,
                  "enable-offline-web-application-cache", &enableOfflineWebAppCache,
@@ -2916,6 +2951,7 @@ static void webkit_web_view_update_settings(WebKitWebView* webView)
     settings->setLocalStorageEnabled(enableHTML5LocalStorage);
     settings->setXSSAuditorEnabled(enableXSSAuditor);
     settings->setSpatialNavigationEnabled(enableSpatialNavigation);
+    settings->setFrameFlatteningEnabled(enableFrameFlattening);
     settings->setJavaScriptCanOpenWindowsAutomatically(javascriptCanOpenWindows);
     settings->setJavaScriptCanAccessClipboard(javaScriptCanAccessClipboard);
     settings->setOfflineWebApplicationCacheEnabled(enableOfflineWebAppCache);
@@ -3014,6 +3050,8 @@ static void webkit_web_view_settings_notify(WebKitWebSettings* webSettings, GPar
         settings->setXSSAuditorEnabled(g_value_get_boolean(&value));
     else if (name == g_intern_string("enable-spatial-navigation"))
         settings->setSpatialNavigationEnabled(g_value_get_boolean(&value));
+    else if (name == g_intern_string("enable-frame-flattening"))
+        settings->setFrameFlatteningEnabled(g_value_get_boolean(&value));
     else if (name == g_intern_string("javascript-can-open-windows-automatically"))
         settings->setJavaScriptCanOpenWindowsAutomatically(g_value_get_boolean(&value));
     else if (name == g_intern_string("javascript-can-access-clipboard"))
@@ -3148,7 +3186,7 @@ bool webkit_web_view_use_primary_for_paste(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_settings:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @settings: (transfer none): the #WebKitWebSettings to be set
  *
  * Replaces the #WebKitWebSettings instance that is currently attached
@@ -3173,7 +3211,7 @@ void webkit_web_view_set_settings(WebKitWebView* webView, WebKitWebSettings* web
 
 /**
  * webkit_web_view_get_settings:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Obtains the #WebKitWebSettings associated with the
  * #WebKitWebView. The #WebKitWebView always has an associated
@@ -3192,7 +3230,7 @@ WebKitWebSettings* webkit_web_view_get_settings(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_inspector:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Obtains the #WebKitWebInspector associated with the
  * #WebKitWebView. Every #WebKitWebView object has a
@@ -3222,7 +3260,7 @@ static void webkit_web_view_set_window_features(WebKitWebView* webView, WebKitWe
 
 /**
  * webkit_web_view_get_window_features:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the instance of #WebKitWebWindowFeatures held by the given
  * #WebKitWebView.
@@ -3239,7 +3277,7 @@ WebKitWebWindowFeatures* webkit_web_view_get_window_features(WebKitWebView* webV
 
 /**
  * webkit_web_view_get_title:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the @web_view's document title
  *
@@ -3257,7 +3295,7 @@ G_CONST_RETURN gchar* webkit_web_view_get_title(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_uri:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the current URI of the contents displayed by the @web_view
  *
@@ -3275,7 +3313,7 @@ G_CONST_RETURN gchar* webkit_web_view_get_uri(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_maintains_back_forward_list:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @flag: to tell the view to maintain a back or forward list
  *
  * Set the view to maintain a back or forward list of history items.
@@ -3289,7 +3327,7 @@ void webkit_web_view_set_maintains_back_forward_list(WebKitWebView* webView, gbo
 
 /**
  * webkit_web_view_get_back_forward_list:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Obtains the #WebKitWebBackForwardList associated with the given #WebKitWebView. The
  * #WebKitWebBackForwardList is owned by the #WebKitWebView.
@@ -3306,7 +3344,7 @@ WebKitWebBackForwardList* webkit_web_view_get_back_forward_list(WebKitWebView* w
 
 /**
  * webkit_web_view_go_to_back_forward_item:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @item: a #WebKitWebHistoryItem*
  *
  * Go to the specified #WebKitWebHistoryItem
@@ -3328,7 +3366,7 @@ gboolean webkit_web_view_go_to_back_forward_item(WebKitWebView* webView, WebKitW
 
 /**
  * webkit_web_view_go_back:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Loads the previous history item.
  */
@@ -3341,7 +3379,7 @@ void webkit_web_view_go_back(WebKitWebView* webView)
 
 /**
  * webkit_web_view_go_back_or_forward:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @steps: the number of steps
  *
  * Loads the history item that is the number of @steps away from the current
@@ -3357,7 +3395,7 @@ void webkit_web_view_go_back_or_forward(WebKitWebView* webView, gint steps)
 
 /**
  * webkit_web_view_go_forward:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Loads the next history item.
  */
@@ -3370,7 +3408,7 @@ void webkit_web_view_go_forward(WebKitWebView* webView)
 
 /**
  * webkit_web_view_can_go_back:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether #web_view has a previous history item.
  *
@@ -3388,7 +3426,7 @@ gboolean webkit_web_view_can_go_back(WebKitWebView* webView)
 
 /**
  * webkit_web_view_can_go_back_or_forward:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @steps: the number of steps
  *
  * Determines whether #web_view has a history item of @steps. Negative values
@@ -3406,7 +3444,7 @@ gboolean webkit_web_view_can_go_back_or_forward(WebKitWebView* webView, gint ste
 
 /**
  * webkit_web_view_can_go_forward:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether #web_view has a next history item.
  *
@@ -3429,7 +3467,7 @@ gboolean webkit_web_view_can_go_forward(WebKitWebView* webView)
 
 /**
  * webkit_web_view_open:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @uri: an URI
  *
  * Requests loading of the specified URI string.
@@ -3461,7 +3499,7 @@ void webkit_web_view_reload(WebKitWebView* webView)
 
 /**
  * webkit_web_view_reload_bypass_cache:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Reloads the @web_view without using any cached data.
  *
@@ -3476,7 +3514,7 @@ void webkit_web_view_reload_bypass_cache(WebKitWebView* webView)
 
 /**
  * webkit_web_view_load_uri:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @uri: an URI string
  *
  * Requests loading of the specified URI string.
@@ -3493,20 +3531,20 @@ void webkit_web_view_load_uri(WebKitWebView* webView, const gchar* uri)
 }
 
 /**
-+  * webkit_web_view_load_string:
-+  * @web_view: a #WebKitWebView
-+  * @content: an URI string
-+  * @mime_type: the MIME type, or %NULL
-+  * @encoding: the encoding, or %NULL
-+  * @base_uri: the base URI for relative locations
-+  *
-+  * Requests loading of the given @content with the specified @mime_type,
-+  * @encoding and @base_uri.
-+  *
-+  * If @mime_type is %NULL, "text/html" is assumed.
-+  *
-+  * If @encoding is %NULL, "UTF-8" is assumed.
-+  */
+  * webkit_web_view_load_string:
+  * @webView: a #WebKitWebView
+  * @content: an URI string
+  * @mime_type: the MIME type, or %NULL
+  * @encoding: the encoding, or %NULL
+  * @base_uri: the base URI for relative locations
+  *
+  * Requests loading of the given @content with the specified @mime_type,
+  * @encoding and @base_uri.
+  *
+  * If @mime_type is %NULL, "text/html" is assumed.
+  *
+  * If @encoding is %NULL, "UTF-8" is assumed.
+  */
 void webkit_web_view_load_string(WebKitWebView* webView, const gchar* content, const gchar* mimeType, const gchar* encoding, const gchar* baseUri)
 {
     g_return_if_fail(WEBKIT_IS_WEB_VIEW(webView));
@@ -3517,7 +3555,7 @@ void webkit_web_view_load_string(WebKitWebView* webView, const gchar* content, c
 }
 /**
  * webkit_web_view_load_html_string:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @content: an URI string
  * @base_uri: the base URI for relative locations
  *
@@ -3535,7 +3573,7 @@ void webkit_web_view_load_html_string(WebKitWebView* webView, const gchar* conte
 
 /**
  * webkit_web_view_load_request:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @request: a #WebKitNetworkRequest
  *
  * Requests loading of the specified asynchronous client request.
@@ -3573,7 +3611,7 @@ void webkit_web_view_stop_loading(WebKitWebView* webView)
 
 /**
  * webkit_web_view_search_text:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @text: a string to look for
  * @forward: whether to find forward or not
  * @case_sensitive: whether to respect the case of text
@@ -3596,7 +3634,7 @@ gboolean webkit_web_view_search_text(WebKitWebView* webView, const gchar* string
 
 /**
  * webkit_web_view_mark_text_matches:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @string: a string to look for
  * @case_sensitive: whether to respect the case of text
  * @limit: the maximum number of strings to look for or 0 for all
@@ -3617,7 +3655,7 @@ guint webkit_web_view_mark_text_matches(WebKitWebView* webView, const gchar* str
 
 /**
  * webkit_web_view_set_highlight_text_matches:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @highlight: whether to highlight text matches
  *
  * Highlights text matches previously marked by webkit_web_view_mark_text_matches.
@@ -3635,7 +3673,7 @@ void webkit_web_view_set_highlight_text_matches(WebKitWebView* webView, gboolean
 
 /**
  * webkit_web_view_unmark_text_matches:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Removes highlighting previously set by webkit_web_view_mark_text_matches.
  */
@@ -3663,7 +3701,7 @@ WebKitWebFrame* webkit_web_view_get_main_frame(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_focused_frame:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the frame that has focus or an active text selection.
  *
@@ -3687,7 +3725,7 @@ void webkit_web_view_execute_script(WebKitWebView* webView, const gchar* script)
 
 /**
  * webkit_web_view_cut_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether or not it is currently possible to cut to the clipboard.
  *
@@ -3703,7 +3741,7 @@ gboolean webkit_web_view_can_cut_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_copy_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether or not it is currently possible to copy to the clipboard.
  *
@@ -3719,7 +3757,7 @@ gboolean webkit_web_view_can_copy_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_paste_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether or not it is currently possible to paste from the clipboard.
  *
@@ -3735,7 +3773,7 @@ gboolean webkit_web_view_can_paste_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_cut_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Cuts the current selection inside the @web_view to the clipboard.
  */
@@ -3749,7 +3787,7 @@ void webkit_web_view_cut_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_copy_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Copies the current selection inside the @web_view to the clipboard.
  */
@@ -3763,7 +3801,7 @@ void webkit_web_view_copy_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_paste_clipboard:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Pastes the current contents of the clipboard to the @web_view.
  */
@@ -3777,7 +3815,7 @@ void webkit_web_view_paste_clipboard(WebKitWebView* webView)
 
 /**
  * webkit_web_view_delete_selection:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Deletes the current selection inside the @web_view.
  */
@@ -3791,7 +3829,7 @@ void webkit_web_view_delete_selection(WebKitWebView* webView)
 
 /**
  * webkit_web_view_has_selection:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether text was selected.
  *
@@ -3806,7 +3844,7 @@ gboolean webkit_web_view_has_selection(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_selected_text:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Retrieves the selected text if any.
  *
@@ -3822,7 +3860,7 @@ gchar* webkit_web_view_get_selected_text(WebKitWebView* webView)
 
 /**
  * webkit_web_view_select_all:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Attempts to select everything inside the @web_view.
  */
@@ -3835,7 +3873,7 @@ void webkit_web_view_select_all(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_editable:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns whether the user is allowed to edit the document.
  *
@@ -3856,7 +3894,7 @@ gboolean webkit_web_view_get_editable(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_editable:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @flag: a #gboolean indicating the editable state
  *
  * Sets whether @web_view allows the user to edit its HTML document.
@@ -3899,7 +3937,7 @@ void webkit_web_view_set_editable(WebKitWebView* webView, gboolean flag)
 
 /**
  * webkit_web_view_get_copy_target_list:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * This function returns the list of targets this #WebKitWebView can
  * provide for clipboard copying and as DND source. The targets in the list are
@@ -3916,7 +3954,7 @@ GtkTargetList* webkit_web_view_get_copy_target_list(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_paste_target_list:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * This function returns the list of targets this #WebKitWebView can
  * provide for clipboard pasting and as DND destination. The targets in the list are
@@ -3933,7 +3971,7 @@ GtkTargetList* webkit_web_view_get_paste_target_list(WebKitWebView* webView)
 
 /**
  * webkit_web_view_can_show_mime_type:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @mime_type: a MIME type
  *
  * This functions returns whether or not a MIME type can be displayed using this view.
@@ -3956,7 +3994,7 @@ gboolean webkit_web_view_can_show_mime_type(WebKitWebView* webView, const gchar*
 
 /**
  * webkit_web_view_get_transparent:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns whether the #WebKitWebView has a transparent background.
  *
@@ -3973,7 +4011,7 @@ gboolean webkit_web_view_get_transparent(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_transparent:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Sets whether the #WebKitWebView has a transparent background.
  *
@@ -3997,7 +4035,7 @@ void webkit_web_view_set_transparent(WebKitWebView* webView, gboolean flag)
 
 /**
  * webkit_web_view_get_zoom_level:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the zoom level of @web_view, i.e. the factor by which elements in
  * the page are scaled with respect to their original size.
@@ -4036,7 +4074,7 @@ static void webkit_web_view_apply_zoom_level(WebKitWebView* webView, gfloat zoom
 
 /**
  * webkit_web_view_set_zoom_level:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @zoom_level: the new zoom level
  *
  * Sets the zoom level of @web_view, i.e. the factor by which elements in
@@ -4057,7 +4095,7 @@ void webkit_web_view_set_zoom_level(WebKitWebView* webView, gfloat zoomLevel)
 
 /**
  * webkit_web_view_zoom_in:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Increases the zoom level of @web_view. The current zoom
  * level is incremented by the value of the "zoom-step"
@@ -4078,7 +4116,7 @@ void webkit_web_view_zoom_in(WebKitWebView* webView)
 
 /**
  * webkit_web_view_zoom_out:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Decreases the zoom level of @web_view. The current zoom
  * level is decremented by the value of the "zoom-step"
@@ -4099,7 +4137,7 @@ void webkit_web_view_zoom_out(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_full_content_zoom:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns whether the zoom level affects only text or all elements.
  *
@@ -4118,7 +4156,7 @@ gboolean webkit_web_view_get_full_content_zoom(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_full_content_zoom:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @full_content_zoom: %FALSE if only text should be scaled (the default),
  * %TRUE if the full content of the view should be scaled.
  *
@@ -4151,7 +4189,7 @@ void webkit_web_view_set_full_content_zoom(WebKitWebView* webView, gboolean zoom
 
 /**
  * webkit_web_view_get_load_status:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines the current status of the load.
  *
@@ -4167,7 +4205,7 @@ WebKitLoadStatus webkit_web_view_get_load_status(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_progress:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines the current progress of the load.
  *
@@ -4182,7 +4220,7 @@ gdouble webkit_web_view_get_progress(WebKitWebView* webView)
 
 /**
  * webkit_web_view_get_encoding:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the default encoding of the #WebKitWebView.
  *
@@ -4202,7 +4240,7 @@ const gchar* webkit_web_view_get_encoding(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_custom_encoding:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @encoding: the new encoding, or %NULL to restore the default encoding
  *
  * Sets the current #WebKitWebView encoding, without modifying the default one,
@@ -4219,7 +4257,7 @@ void webkit_web_view_set_custom_encoding(WebKitWebView* webView, const char* enc
 
 /**
  * webkit_web_view_get_custom_encoding:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Returns the current encoding of the #WebKitWebView, not the default-encoding
  * of WebKitWebSettings.
@@ -4240,7 +4278,7 @@ const char* webkit_web_view_get_custom_encoding(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_view_mode:
- * @web_view: the #WebKitWebView that will have its view mode set
+ * @webView: the #WebKitWebView that will have its view mode set
  * @mode: the %WebKitWebViewViewMode to be set
  *
  * Sets the view-mode property of the #WebKitWebView. Check the
@@ -4275,7 +4313,7 @@ void webkit_web_view_set_view_mode(WebKitWebView* webView, WebKitWebViewViewMode
 
 /**
  * webkit_web_view_get_view_mode:
- * @web_view: the #WebKitWebView to obtain the view mode from
+ * @webView: the #WebKitWebView to obtain the view mode from
  *
  * Gets the value of the view-mode property of the
  * #WebKitWebView. Check the property's documentation for more
@@ -4310,7 +4348,7 @@ WebKitWebViewViewMode webkit_web_view_get_view_mode(WebKitWebView* webView)
 
 /**
  * webkit_web_view_move_cursor:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @step: a #GtkMovementStep
  * @count: integer describing the direction of the movement. 1 for forward, -1 for backwards.
  *
@@ -4345,7 +4383,7 @@ void webkit_web_view_set_group_name(WebKitWebView* webView, const gchar* groupNa
 
 /**
  * webkit_web_view_can_undo:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether or not it is currently possible to undo the last
  * editing command in the view.
@@ -4364,7 +4402,7 @@ gboolean webkit_web_view_can_undo(WebKitWebView* webView)
 
 /**
  * webkit_web_view_undo:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Undoes the last editing command in the view, if possible.
  *
@@ -4380,7 +4418,7 @@ void webkit_web_view_undo(WebKitWebView* webView)
 
 /**
  * webkit_web_view_can_redo:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Determines whether or not it is currently possible to redo the last
  * editing command in the view.
@@ -4399,7 +4437,7 @@ gboolean webkit_web_view_can_redo(WebKitWebView* webView)
 
 /**
  * webkit_web_view_redo:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Redoes the last editing command in the view, if possible.
  *
@@ -4416,7 +4454,7 @@ void webkit_web_view_redo(WebKitWebView* webView)
 
 /**
  * webkit_web_view_set_view_source_mode:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  * @view_source_mode: the mode to turn on or off view source mode
  *
  * Set whether the view should be in view source mode. Setting this mode to
@@ -4435,7 +4473,7 @@ void webkit_web_view_set_view_source_mode (WebKitWebView* webView, gboolean mode
 
 /**
  * webkit_web_view_get_view_source_mode:
- * @web_view: a #WebKitWebView
+ * @webView: a #WebKitWebView
  *
  * Return value: %TRUE if @web_view is in view source mode, %FALSE otherwise.
  *
@@ -4564,7 +4602,7 @@ WebKitHitTestResult* webkit_web_view_get_hit_test_result(WebKitWebView* webView,
 
 /**
  * webkit_web_view_get_icon_uri:
- * @web_view: the #WebKitWebView object
+ * @webView: the #WebKitWebView object
  *
  * Obtains the URI for the favicon for the given #WebKitWebView, or
  * %NULL if there is none.
@@ -4622,7 +4660,7 @@ webkit_web_view_get_dom_document(WebKitWebView* webView)
  * so if you insert your own #SoupCookieJar before any network
  * traffic occurs, WebKit will use it instead of the default.
  *
- * Return value: the default #SoupSession
+ * Return value: (transfer none): the default #SoupSession
  *
  * Since: 1.1.1
  */
diff --git a/WebKit/gtk/webkit/webkitwebview.h b/WebKit/gtk/webkit/webkitwebview.h
index a320131..9dfb654 100644
--- a/WebKit/gtk/webkit/webkitwebview.h
+++ b/WebKit/gtk/webkit/webkitwebview.h
@@ -152,187 +152,187 @@ WEBKIT_API GtkWidget *
 webkit_web_view_new (void);
 
 WEBKIT_API G_CONST_RETURN gchar *
-webkit_web_view_get_title                       (WebKitWebView        *web_view);
+webkit_web_view_get_title                       (WebKitWebView        *webView);
 
 WEBKIT_API G_CONST_RETURN gchar *
-webkit_web_view_get_uri                         (WebKitWebView        *web_view);
+webkit_web_view_get_uri                         (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_maintains_back_forward_list (WebKitWebView        *web_view,
+webkit_web_view_set_maintains_back_forward_list (WebKitWebView        *webView,
                                                  gboolean              flag);
 
 WEBKIT_API WebKitWebBackForwardList *
-webkit_web_view_get_back_forward_list           (WebKitWebView        *web_view);
+webkit_web_view_get_back_forward_list           (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_go_to_back_forward_item         (WebKitWebView        *web_view,
+webkit_web_view_go_to_back_forward_item         (WebKitWebView        *webView,
                                                  WebKitWebHistoryItem *item);
 
 WEBKIT_API gboolean
-webkit_web_view_can_go_back                     (WebKitWebView        *web_view);
+webkit_web_view_can_go_back                     (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_can_go_back_or_forward          (WebKitWebView        *web_view,
+webkit_web_view_can_go_back_or_forward          (WebKitWebView        *webView,
                                                  gint                  steps);
 
 WEBKIT_API gboolean
-webkit_web_view_can_go_forward                  (WebKitWebView        *web_view);
+webkit_web_view_can_go_forward                  (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_go_back                         (WebKitWebView        *web_view);
+webkit_web_view_go_back                         (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_go_back_or_forward              (WebKitWebView        *web_view,
+webkit_web_view_go_back_or_forward              (WebKitWebView        *webView,
                                                  gint                  steps);
 
 WEBKIT_API void
-webkit_web_view_go_forward                      (WebKitWebView        *web_view);
+webkit_web_view_go_forward                      (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_stop_loading                    (WebKitWebView        *web_view);
+webkit_web_view_stop_loading                    (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_open                            (WebKitWebView        *web_view,
+webkit_web_view_open                            (WebKitWebView        *webView,
                                                  const gchar          *uri);
 
 WEBKIT_API void
-webkit_web_view_reload                          (WebKitWebView        *web_view);
+webkit_web_view_reload                          (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_reload_bypass_cache             (WebKitWebView        *web_view);
+webkit_web_view_reload_bypass_cache             (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_load_uri                        (WebKitWebView        *web_view,
+webkit_web_view_load_uri                        (WebKitWebView        *webView,
                                                  const gchar          *uri);
 
 WEBKIT_API void
-webkit_web_view_load_string                     (WebKitWebView        *web_view,
+webkit_web_view_load_string                     (WebKitWebView        *webView,
                                                  const gchar          *content,
                                                  const gchar          *mime_type,
                                                  const gchar          *encoding,
                                                  const gchar          *base_uri);
 
 WEBKIT_API void
-webkit_web_view_load_html_string                (WebKitWebView        *web_view,
+webkit_web_view_load_html_string                (WebKitWebView        *webView,
                                                  const gchar          *content,
                                                  const gchar          *base_uri);
 
 WEBKIT_API void
-webkit_web_view_load_request                    (WebKitWebView        *web_view,
+webkit_web_view_load_request                    (WebKitWebView        *webView,
                                                  WebKitNetworkRequest *request);
 
 WEBKIT_API gboolean
-webkit_web_view_search_text                     (WebKitWebView        *web_view,
+webkit_web_view_search_text                     (WebKitWebView        *webView,
                                                  const gchar          *text,
                                                  gboolean              case_sensitive,
                                                  gboolean              forward,
                                                  gboolean              wrap);
 
 WEBKIT_API guint
-webkit_web_view_mark_text_matches               (WebKitWebView        *web_view,
+webkit_web_view_mark_text_matches               (WebKitWebView        *webView,
                                                  const gchar          *string,
                                                  gboolean              case_sensitive,
                                                  guint                 limit);
 
 WEBKIT_API void
-webkit_web_view_set_highlight_text_matches      (WebKitWebView        *web_view,
+webkit_web_view_set_highlight_text_matches      (WebKitWebView        *webView,
                                                  gboolean              highlight);
 
 WEBKIT_API void
-webkit_web_view_unmark_text_matches             (WebKitWebView        *web_view);
+webkit_web_view_unmark_text_matches             (WebKitWebView        *webView);
 
 WEBKIT_API WebKitWebFrame *
-webkit_web_view_get_main_frame                  (WebKitWebView        *web_view);
+webkit_web_view_get_main_frame                  (WebKitWebView        *webView);
 
 WEBKIT_API WebKitWebFrame *
-webkit_web_view_get_focused_frame               (WebKitWebView        *web_view);
+webkit_web_view_get_focused_frame               (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_execute_script                  (WebKitWebView        *web_view,
+webkit_web_view_execute_script                  (WebKitWebView        *webView,
                                                  const gchar          *script);
 
 WEBKIT_API gboolean
-webkit_web_view_can_cut_clipboard               (WebKitWebView        *web_view);
+webkit_web_view_can_cut_clipboard               (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_can_copy_clipboard              (WebKitWebView        *web_view);
+webkit_web_view_can_copy_clipboard              (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_can_paste_clipboard             (WebKitWebView        *web_view);
+webkit_web_view_can_paste_clipboard             (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_cut_clipboard                   (WebKitWebView        *web_view);
+webkit_web_view_cut_clipboard                   (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_copy_clipboard                  (WebKitWebView        *web_view);
+webkit_web_view_copy_clipboard                  (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_paste_clipboard                 (WebKitWebView        *web_view);
+webkit_web_view_paste_clipboard                 (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_delete_selection                (WebKitWebView        *web_view);
+webkit_web_view_delete_selection                (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_has_selection                   (WebKitWebView        *web_view);
+webkit_web_view_has_selection                   (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_select_all                      (WebKitWebView        *web_view);
+webkit_web_view_select_all                      (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_get_editable                    (WebKitWebView        *web_view);
+webkit_web_view_get_editable                    (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_editable                    (WebKitWebView        *web_view,
+webkit_web_view_set_editable                    (WebKitWebView        *webView,
                                                  gboolean              flag);
 
 WEBKIT_API GtkTargetList *
-webkit_web_view_get_copy_target_list            (WebKitWebView        *web_view);
+webkit_web_view_get_copy_target_list            (WebKitWebView        *webView);
 
 WEBKIT_API GtkTargetList *
-webkit_web_view_get_paste_target_list           (WebKitWebView        *web_view);
+webkit_web_view_get_paste_target_list           (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_settings                    (WebKitWebView        *web_view,
+webkit_web_view_set_settings                    (WebKitWebView        *webView,
                                                  WebKitWebSettings    *settings);
 
 WEBKIT_API WebKitWebSettings *
-webkit_web_view_get_settings                    (WebKitWebView        *web_view);
+webkit_web_view_get_settings                    (WebKitWebView        *webView);
 
 WEBKIT_API WebKitWebInspector *
-webkit_web_view_get_inspector                   (WebKitWebView        *web_view);
+webkit_web_view_get_inspector                   (WebKitWebView        *webView);
 
 WEBKIT_API WebKitWebWindowFeatures*
-webkit_web_view_get_window_features             (WebKitWebView        *web_view);
+webkit_web_view_get_window_features             (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_can_show_mime_type              (WebKitWebView        *web_view,
+webkit_web_view_can_show_mime_type              (WebKitWebView        *webView,
                                                  const gchar          *mime_type);
 
 WEBKIT_API gboolean
-webkit_web_view_get_transparent                 (WebKitWebView        *web_view);
+webkit_web_view_get_transparent                 (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_transparent                 (WebKitWebView        *web_view,
+webkit_web_view_set_transparent                 (WebKitWebView        *webView,
                                                  gboolean              flag);
 
 WEBKIT_API gfloat
-webkit_web_view_get_zoom_level                  (WebKitWebView        *web_view);
+webkit_web_view_get_zoom_level                  (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_zoom_level                  (WebKitWebView        *web_view,
+webkit_web_view_set_zoom_level                  (WebKitWebView        *webView,
                                                  gfloat                zoom_level);
 
 WEBKIT_API void
-webkit_web_view_zoom_in                         (WebKitWebView        *web_view);
+webkit_web_view_zoom_in                         (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_zoom_out                        (WebKitWebView        *web_view);
+webkit_web_view_zoom_out                        (WebKitWebView        *webView);
 
 WEBKIT_API gboolean
-webkit_web_view_get_full_content_zoom           (WebKitWebView        *web_view);
+webkit_web_view_get_full_content_zoom           (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_full_content_zoom           (WebKitWebView        *web_view,
+webkit_web_view_set_full_content_zoom           (WebKitWebView        *webView,
                                                  gboolean              full_content_zoom);
 
 WEBKIT_API SoupSession*
@@ -349,11 +349,11 @@ WEBKIT_API const char*
 webkit_web_view_get_custom_encoding             (WebKitWebView        * webView);
 
 WEBKIT_API void
-webkit_web_view_set_view_mode                   (WebKitWebView        *web_view,
+webkit_web_view_set_view_mode                   (WebKitWebView        *webView,
                                                  WebKitWebViewViewMode mode);
 
 WEBKIT_API WebKitWebViewViewMode
-webkit_web_view_get_view_mode                   (WebKitWebView        *web_view);
+webkit_web_view_get_view_mode                   (WebKitWebView        *webView);
 
 WEBKIT_API void
 webkit_web_view_move_cursor                     (WebKitWebView        * webView,
@@ -361,10 +361,10 @@ webkit_web_view_move_cursor                     (WebKitWebView        * webView,
                                                  gint                   count);
 
 WEBKIT_API WebKitLoadStatus
-webkit_web_view_get_load_status                 (WebKitWebView        *web_view);
+webkit_web_view_get_load_status                 (WebKitWebView        *webView);
 
 WEBKIT_API gdouble
-webkit_web_view_get_progress                    (WebKitWebView        *web_view);
+webkit_web_view_get_progress                    (WebKitWebView        *webView);
 
 WEBKIT_API void
 webkit_web_view_undo                            (WebKitWebView        *webView);
@@ -379,11 +379,11 @@ WEBKIT_API gboolean
 webkit_web_view_can_redo                        (WebKitWebView        *webView);
 
 WEBKIT_API void
-webkit_web_view_set_view_source_mode            (WebKitWebView        *web_view,
+webkit_web_view_set_view_source_mode            (WebKitWebView        *webView,
                                                  gboolean             view_source_mode);
 
 WEBKIT_API gboolean
-webkit_web_view_get_view_source_mode            (WebKitWebView        *web_view);
+webkit_web_view_get_view_source_mode            (WebKitWebView        *webView);
 
 WEBKIT_API WebKitHitTestResult*
 webkit_web_view_get_hit_test_result             (WebKitWebView        *webView,
diff --git a/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp b/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
index a6fe1df..e5d65bd 100644
--- a/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
+++ b/WebKit/gtk/webkit/webkitwebwindowfeatures.cpp
@@ -38,7 +38,7 @@
  * In the normal case one will use #webkit_web_view_get_window_features
  * to get the #WebKitWebWindowFeatures and then monitor the property
  * changes. Be aware that the #WebKitWebWindowFeatures might change
- * change before #WebKitWebView::web-view-ready signal is emitted.
+ * before #WebKitWebView::web-view-ready signal is emitted.
  * To be safe listen to the notify::window-features signal of the #WebKitWebView
  * and reconnect the signals whenever the #WebKitWebWindowFeatures of
  * a #WebKitWebView changes.
diff --git a/WebKit/mac/ChangeLog b/WebKit/mac/ChangeLog
index d707720..8f1ea42 100644
--- a/WebKit/mac/ChangeLog
+++ b/WebKit/mac/ChangeLog
@@ -1,3 +1,399 @@
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Composited elements drawn twice when WebView is layer-backed
+        https://bugs.webkit.org/show_bug.cgi?id=48024
+        <rdar://problem/7916580>
+        
+        When drawing content in a layer-backed WebView, WebFrame's test
+        for drawing to a bitmap succeeded, causing us to paint flattened
+        compositing layers into the view. They would also be rendered
+        by the normal compositing path, resulting in double rendering.
+        
+        Fix this by detecting when the WebHTMLView is being drawn into
+        a layer, and avoiding flattening in that case.
+
+        * WebView/WebFrame.mm:
+        (-[WebFrame _showFlattenedCompositingLayers:]):
+        (-[WebFrame _drawRect:contentsOnly:]):
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawLayer:inContext:]):
+        (-[WebHTMLView _web_isDrawingIntoLayer]):
+        * WebView/WebHTMLViewInternal.h:
+
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Repost the DatabaseTracker notifications to the main thread, if needed.
+        https://bugs.webkit.org/show_bug.cgi?id=40655
+
+        * Storage/WebDatabaseTrackerClient.mm:
+        (DidModifyOriginData::dispatchToMainThread):
+        (DidModifyOriginData::DidModifyOriginData):
+        (DidModifyOriginData::dispatchDidModifyOriginOnMainThread):
+        (WebDatabaseTrackerClient::dispatchDidModifyOrigin):
+        (WebDatabaseTrackerClient::dispatchDidModifyDatabase):
+
+2010-10-20  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION(r67568-r67643): Some HTML/CSS renders upside down and backwards on Leopard
+        https://bugs.webkit.org/show_bug.cgi?id=47369
+        
+        r46947 added code that limits the size of the layer-backed view on Leopard when
+        the page height exceeds 4096px (later adjusted to 2048px in r48401).
+        
+        Later, r67576 altered the geometry flipping behavior to push the geometry flipping
+        down into WebKit. However, the code that adjusts the hosting layer's sublayer transform
+        to account for layer-backed view size-limiting was not fixed at the same time.
+        This change corrects that.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _updateLayerHostingViewPosition]):
+
+2010-10-19  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        <rdar://problem/8508422> Compositing layers aren't always displayed correctly in layer-backed WebViews
+        
+        AppKit has some special code to prevent it meddling with view's layers
+        under layer-backed WebViews. When a layer-backed WebView became composited,
+        this caused our layer to remain zero-sized. Fix this by manually
+        setting the geometry for our layer, if the WebHTMLView has a layer.
+        
+        This does not seem to be a problem if the WebView becomes layer-backed, or
+        stops being layer-backed after the WebView starts using compositing.
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView attachRootLayer:]):
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Merge ColorSpace and ImageColorSpace enums
+        https://bugs.webkit.org/show_bug.cgi?id=47922
+
+        Renamed ColorSpace enum entries DeviceColorSpace and sRGBColorSpace to ColorSpaceDeviceRGB and ColorSpaceSRGB
+        to follow webkit style rules.
+
+        * Misc/WebKitNSStringExtras.mm:
+        (-[NSString _web_drawAtPoint:font:textColor:allowingFontSmoothing:]):
+
+2010-10-19  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by Anders Carlsson.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47933
+        <rdar://problem/8494337> navigator.language doesn't work in WebKit2
+
+        * Misc/WebNSUserDefaultsExtras.mm: Moved code for computing default language to WebCore.
+        We need to keep _webkit_preferredLanguageCode for Safari.
+
+        * WebCoreSupport/WebSystemInterface.mm: (InitWebCoreSystemInterface):
+        Initialize wkCopyCFLocalizationPreferredName.
+
+        * WebCoreSupport/WebViewFactory.mm: Removed defaultLanguage. WebCore was the only caller.
+
+2010-10-18  Alexey Proskuryakov  <ap@apple.com>
+
+        Reviewed by David Kilzer.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47864
+        Convert WebNSUserDefaultsExtras.m to .mm
+
+        Also, fixed some issues in the process:
+        - removed locking, which was only necessary when this code was in Foundation;
+        - fixed notification center observer to actually work (previously, it picked up changes
+        when application preferences changed, not when system language did);
+        - removed unused NSString category;
+        - updated style.
+
+        * Misc/WebNSUserDefaultsExtras.m: Removed.
+        * Misc/WebNSUserDefaultsExtras.mm: Copied from WebKit/mac/Misc/WebNSUserDefaultsExtras.m.
+        (createHTTPStyleLanguageCode):
+        (+[NSUserDefaults _webkit_defaultsDidChange]):
+        (addLanguageChangeObserver):
+        (+[NSUserDefaults _webkit_preferredLanguageCode]):
+
+2010-10-18  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch to using the new Carbon NPAPI event declarations, and remove
+        the old ones.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40784
+
+        * Plugins/WebNetscapePluginEventHandlerCarbon.mm:
+        (WebNetscapePluginEventHandlerCarbon::mouseEntered):
+        (WebNetscapePluginEventHandlerCarbon::mouseExited):
+        (WebNetscapePluginEventHandlerCarbon::mouseMoved):
+        (WebNetscapePluginEventHandlerCarbon::focusChanged):
+
+2010-10-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: disable private browsing for inspector
+        https://bugs.webkit.org/show_bug.cgi?id=47827
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController init]):
+
+2010-10-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: inspector settings/properties/states management
+        should be extracted into separate class.
+
+        We have a lot of flags/values in InspectorController.
+        Some flags are persisting into profile.
+        Others are part of inspector state for frontend.
+        All these flags should keep their values after navigation.
+        It'd be better to extract these flags/values into separate
+        class which will care about theirs lifetime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47275
+
+        * WebCoreSupport/WebInspectorClient.mm:
+        (-[WebInspectorWindowController showWindow:]):
+        (-[WebInspectorWindowController attach]):
+        (-[WebInspectorWindowController detach]):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+
+2010-10-12  Andy Estes  <aestes@apple.com>
+
+        Rubber-stamped by Darin Adler.
+
+        Check in some cleanup from the previous commit.
+
+        * WebView/WebView.mm:
+        (leakMailQuirksUserScriptPath): Renamed to indicate that this function
+        leaks an NSString.
+        (-[WebView _injectMailQuirksScript]): Moved a static initialization from
+        a separate class method into the only method that used it and removed
+        the now-unnecessary class method.
+
+2010-10-12  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        REGRESSION (new parser): Leopard/Tiger Mail <head>/<body> quirk is gone
+        https://bugs.webkit.org/show_bug.cgi?id=45693
+
+        Re-implement this former WebCore parser quirk as a
+        Mac-only userscript-based quirk.  As far as I can tell
+        from Darin's description this should satisfy Mail's needs.
+
+        * Misc/MailQuirksUserScript.js: Added.
+        * WebView/WebView.mm:
+        (+[WebView _mailQuirksUserScript]):
+        (-[WebView _injectMailQuirksScript]):
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+
+2010-10-12  Simon Fraser  <simon.fraser@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add 'didDraw' callback for framerate tracking
+        https://bugs.webkit.org/show_bug.cgi?id=47478
+
+        Add a callback at the end of -[WebHTMLView drawRect:] so
+        a delegate can get notified when a draw happens.
+        
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView drawRect:]):
+        * WebView/WebUIDelegatePrivate.h:
+
+2010-10-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WebIconFetcher from WebKit and IconFetcher from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=47523
+
+        Remove all traces of the WebKit WebIconFetcher class. It's SPI that nobody uses.
+
+        * Misc/WebIconFetcher.h: Removed.
+        * Misc/WebIconFetcher.mm: Removed.
+        * Misc/WebIconFetcherInternal.h: Removed.
+        * WebView/WebFrame.mm:
+        * WebView/WebFramePrivate.h:
+
+2010-10-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add Private API for creating a WebKit2 WebSerializedScriptValue from the internal
+        representation of a WebKit1 WebSerializedJSValue.
+        https://bugs.webkit.org/show_bug.cgi?id=47439
+
+        * WebView/WebSerializedJSValue.mm:
+        (-[WebSerializedJSValue internalRepresentation]):
+        * WebView/WebSerializedJSValuePrivate.h:
+
+2010-10-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add Private API for creating a WebKit1 WebSerializedJSValue from the internal
+        representation of a WebKit2 WebSerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=47390
+
+        * WebView/WebSerializedJSValue.mm:
+        (-[WebSerializedJSValue initWithInternalRepresentation:]):
+        Set the WebSerializedJSValuePrivate's WebCore::SerializedScriptValue to be the passed in
+        internal representation.
+        * WebView/WebSerializedJSValuePrivate.h: Added.
+
+2010-10-07  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        [Mac] [DRT] implement setSpatialNavigationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=47291
+
+        Added the needed bits to make it possible to enabled spatial navigation
+        for the Mac port. For now it is being only used by DRT.
+
+        * WebView/WebPreferenceKeysPrivate.h:
+        * WebView/WebPreferences.mm:
+        (+[WebPreferences initialize]):
+        (-[WebPreferences isSpatialNavigationEnabled]):
+        (-[WebPreferences setSpatialNavigationEnabled:]):
+        * WebView/WebPreferencesPrivate.h:
+        * WebView/WebView.mm:
+        (-[WebView _preferencesChangedNotification:]):
+
+2010-10-07  Jer Noble  <jer.noble@apple.com>
+
+        Fix the Leopard 64-bit build.
+
+        * Configurations/WebKit.xcconfig: Add CoreServices.framework/Frameworks to the 
+            framework search path.
+        * WebView/WebVideoFullscreenController.mm: Explicitly import <OSStatus/Power.h>.
+
+2010-10-06  Jer Noble  <jer.noble@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Screensaver starts while watching fullscreen playback.
+        https://bugs.webkit.org/show_bug.cgi?id=47299
+        <rdar://problem/8478956>
+
+        To disable the Screen Saver, we need to periodically call UpdateSystemActivity().  
+
+        * WebView/WebVideoFullscreenController.h: Added _tickleTimer.
+        * WebView/WebVideoFullscreenController.mm:
+        (-[WebVideoFullscreenController dealloc]): Invalidate _tickleTimer.
+        (-[WebVideoFullscreenController _enableTickleTimer]): Create _tickleTimer. 
+        (-[WebVideoFullscreenController _disableTickleTimer]): Invalidate _tickleTimer.
+        (-[WebVideoFullscreenController _tickleTimerFired]): Call UpdateSystemActivity().
+        (-[WebVideoFullscreenController updatePowerAssertions]): Call _enableTickleTimer 
+            or _disableTickleTimer.
+
+2010-10-05  Philippe Normand  <pnormand@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        check for ENABLE(GLIB_SUPPORT) in WebView
+        https://bugs.webkit.org/show_bug.cgi?id=46788
+
+        Use ENABLE(GLIB_SUPPORT) in WebView to guard the glib runloop observer.
+
+        * WebView/WebView.mm:
+        (-[WebView _commonInitializationWithFrameName:groupName:usesDocumentViews:]):
+        (-[WebView _close]):
+        * WebView/WebViewData.h:
+        * WebView/WebViewInternal.h:
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Fix Snow Leopard build.
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::getProxy):
+
+2010-10-01  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Dan Bernstein.
+
+        Add proxy server query function proxyServersForURL and change the Mac plug-in code to use it
+        https://bugs.webkit.org/show_bug.cgi?id=47022
+        <rdar://problem/8504712>
+
+        * Plugins/Hosted/NetscapePluginInstanceProxy.mm:
+        (WebKit::NetscapePluginInstanceProxy::getProxy):
+        * Plugins/WebBaseNetscapePluginView.h:
+        * Plugins/WebBaseNetscapePluginView.mm:
+        * Plugins/WebNetscapePluginView.mm:
+        (-[WebNetscapePluginView getVariable:forURL:value:length:]):
+
+2010-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove remaining calls to deprecatedParseURL
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        * DOM/WebDOMOperations.mm:
+        (-[DOMDocument URLWithAttributeString:]):
+        * WebCoreSupport/WebFrameLoaderClient.mm:
+        (WebFrameLoaderClient::createPlugin):
+        Call stripLeadingAndTrailingHTMLSpaces instead of deprecatedParseURL.
+
+2010-09-30  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        -[DOMDocument _documentRange] throws an exception if there is no document element
+        https://bugs.webkit.org/show_bug.cgi?id=46934
+        <rdar://problem/8169260>
+
+        If there is no document element, just return an empty range. Otherwise we'll try to call
+        Range::selectNode with a null Node which will throw a NOT_FOUND exception.
+
+        * DOM/WebDOMOperations.mm:
+        (-[DOMDocument _documentRange]):
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+        
+        Added ACCELERATED_2D_CANVAS to FeatureDefines
+
+        * Configurations/FeatureDefines.xcconfig:
+
+2010-09-30  Dan Bernstein  <mitz@apple.com>
+
+        Reviewed by John Sullivan.
+
+        Add printing SPI allowing full control over shrink-to-fit
+        https://bugs.webkit.org/show_bug.cgi?id=46877
+
+        * WebView/WebHTMLView.mm:
+        (-[WebHTMLView _beginPrintModeWithMinimumPageWidth:height:maximumPageWidth:]): Added.
+        * WebView/WebHTMLViewPrivate.h:
+
 2010-09-28  Johnny Ding  <jnd@chromium.org>
 
         Reviewed by Adam Barth.
diff --git a/WebKit/mac/Configurations/FeatureDefines.xcconfig b/WebKit/mac/Configurations/FeatureDefines.xcconfig
index 81d912f..8732c18 100644
--- a/WebKit/mac/Configurations/FeatureDefines.xcconfig
+++ b/WebKit/mac/Configurations/FeatureDefines.xcconfig
@@ -33,6 +33,11 @@
 
 ENABLE_LINK_PREFETCH = ;
 
+ENABLE_ACCELERATED_2D_CANVAS = $(ENABLE_ACCELERATED_2D_CANVAS_$(REAL_PLATFORM_NAME));
+ENABLE_ACCELERATED_2D_CANVAS_macosx = $(ENABLE_ACCELERATED_2D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1060 = ;
+ENABLE_ACCELERATED_2D_CANVAS_macosx_1070 = ;
+
 ENABLE_3D_CANVAS = $(ENABLE_3D_CANVAS_$(REAL_PLATFORM_NAME));
 ENABLE_3D_CANVAS_macosx = $(ENABLE_3D_CANVAS_macosx_$(TARGET_MAC_OS_X_VERSION_MAJOR));
 ENABLE_3D_CANVAS_macosx_1060 = ENABLE_3D_CANVAS;
@@ -120,4 +125,4 @@ ENABLE_XHTMLMP = ;
 ENABLE_XPATH = ENABLE_XPATH;
 ENABLE_XSLT = ENABLE_XSLT;
 
-FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
+FEATURE_DEFINES = $(ENABLE_LINK_PREFETCH) $(ENABLE_ACCELERATED_2D_CANVAS) $(ENABLE_3D_CANVAS) $(ENABLE_3D_RENDERING) $(ENABLE_BLOB) $(ENABLE_CHANNEL_MESSAGING) $(ENABLE_CLIENT_BASED_GEOLOCATION) $(ENABLE_DATABASE) $(ENABLE_DATAGRID) $(ENABLE_DATALIST) $(ENABLE_DEVICE_ORIENTATION) $(ENABLE_DIRECTORY_UPLOAD) $(ENABLE_DOM_STORAGE) $(ENABLE_EVENTSOURCE) $(ENABLE_FILTERS) $(ENABLE_FILE_SYSTEM) $(ENABLE_FULLSCREEN_API) $(ENABLE_GEOLOCATION) $(ENABLE_ICONDATABASE) $(ENABLE_IMAGE_RESIZER) $(ENABLE_INDEXED_DATABASE) $(ENABLE_INPUT_SPEECH) $(ENABLE_JAVASCRIPT_DEBUGGER) $(ENABLE_MATHML) $(ENABLE_METER_TAG) $(ENABLE_NOTIFICATIONS) $(ENABLE_OFFLINE_WEB_APPLICATIONS) $(ENABLE_PROGRESS_TAG) $(ENABLE_RUBY) $(ENABLE_SANDBOX) $(ENABLE_SHARED_WORKERS) $(ENABLE_SVG) $(ENABLE_SVG_ANIMATION) $(ENABLE_SVG_AS_IMAGE) $(ENABLE_SVG_DOM_OBJC_BINDINGS) $(ENABLE_SVG_FONTS) $(ENABLE_SVG_FOREIGN_OBJECT) $(ENABLE_SVG_USE) $(ENABLE_VIDEO) $(ENABLE_WEB_SOCKETS) $(ENABLE_WEB_TIMING) $(ENABLE_WML) $(ENABLE_WORKERS) $(ENABLE_XHTMLMP) $(ENABLE_XPATH) $(ENABLE_XSLT);
diff --git a/WebKit/mac/Configurations/Version.xcconfig b/WebKit/mac/Configurations/Version.xcconfig
index 13dd8c0..8739787 100644
--- a/WebKit/mac/Configurations/Version.xcconfig
+++ b/WebKit/mac/Configurations/Version.xcconfig
@@ -22,7 +22,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
 MAJOR_VERSION = 534;
-MINOR_VERSION = 10;
+MINOR_VERSION = 11;
 TINY_VERSION = 0;
 FULL_VERSION = $(MAJOR_VERSION).$(MINOR_VERSION);
 
diff --git a/WebKit/mac/Configurations/WebKit.xcconfig b/WebKit/mac/Configurations/WebKit.xcconfig
index def76fd..6b8ae6f 100644
--- a/WebKit/mac/Configurations/WebKit.xcconfig
+++ b/WebKit/mac/Configurations/WebKit.xcconfig
@@ -44,7 +44,7 @@ FRAMEWORK_SEARCH_PATHS_iphoneos_Debug = $(BUILT_PRODUCTS_DIR) $(PRODUCTION_FRAME
 FRAMEWORK_SEARCH_PATHS_iphoneos_Release = $(FRAMEWORK_SEARCH_PATHS_iphoneos_Debug);
 FRAMEWORK_SEARCH_PATHS_iphoneos_Production = $(PRODUCTION_FRAMEWORKS_DIR);
 FRAMEWORK_SEARCH_PATHS_iphonesimulator = $(FRAMEWORK_SEARCH_PATHS_iphoneos_$(CONFIGURATION));
-FRAMEWORK_SEARCH_PATHS_macosx = $(UMBRELLA_FRAMEWORKS_DIR) $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/Carbon.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks $(FRAMEWORK_SEARCH_PATHS);
+FRAMEWORK_SEARCH_PATHS_macosx = $(UMBRELLA_FRAMEWORKS_DIR) $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/Carbon.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/PrivateFrameworks $(FRAMEWORK_SEARCH_PATHS);
 
 GCC_PREFIX_HEADER = mac/WebKitPrefix.h;
 GCC_PREPROCESSOR_DEFINITIONS = $(DEBUG_DEFINES) $(FEATURE_DEFINES) FRAMEWORK_NAME=WebKit WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST $(GCC_PREPROCESSOR_DEFINITIONS);
diff --git a/WebKit/mac/DOM/WebDOMOperations.mm b/WebKit/mac/DOM/WebDOMOperations.mm
index 3d69836..5e09308 100644
--- a/WebKit/mac/DOM/WebDOMOperations.mm
+++ b/WebKit/mac/DOM/WebDOMOperations.mm
@@ -38,8 +38,8 @@
 #import "WebFramePrivate.h"
 #import "WebKitNSStringExtras.h"
 #import <JavaScriptCore/APICast.h>
-#import <WebCore/CSSHelper.h>
 #import <WebCore/Document.h>
+#import <WebCore/HTMLParserIdioms.h>
 #import <WebCore/JSElement.h>
 #import <WebCore/LegacyWebArchive.h>
 #import <WebCore/markup.h>
@@ -129,24 +129,21 @@ using namespace JSC;
 
 - (NSURL *)URLWithAttributeString:(NSString *)string
 {
-    return core(self)->completeURL(deprecatedParseURL(string));
+    return core(self)->completeURL(stripLeadingAndTrailingHTMLSpaces(string));
 }
 
 @end
 
 @implementation DOMDocument (WebDOMDocumentOperationsInternal)
 
-/* This doesn't appear to be used by anyone.  We should consider removing this. */
-- (DOMRange *)_createRangeWithNode:(DOMNode *)node
+- (DOMRange *)_documentRange
 {
     DOMRange *range = [self createRange];
-    [range selectNode:node];
-    return range;
-}
 
-- (DOMRange *)_documentRange
-{
-    return [self _createRangeWithNode:[self documentElement]];
+    if (DOMNode* documentElement = [self documentElement])
+        [range selectNode:documentElement];
+
+    return range;
 }
 
 @end
diff --git a/WebKit/mac/Misc/MailQuirksUserScript.js b/WebKit/mac/Misc/MailQuirksUserScript.js
new file mode 100644
index 0000000..e36c21b
--- /dev/null
+++ b/WebKit/mac/Misc/MailQuirksUserScript.js
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Google Inc. All rights reserved.
+ * 
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ * 
+ *     * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *     * Redistributions in binary form must reproduce the above
+ * copyright notice, this list of conditions and the following disclaimer
+ * in the documentation and/or other materials provided with the
+ * distribution.
+ *     * Neither the name of Google Inc. nor the names of its
+ * contributors may be used to endorse or promote products derived from
+ * this software without specific prior written permission.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+(function() {
+    function childrenBefore(parent, stopAt)
+    {
+        var children = [];
+        for (var child = parent.firstChild; child != stopAt; child = child.nextSibling)
+            children.push(child);
+        return children;
+    }
+
+    // If html or body is missing, Mail.app's assumption that
+    // document.firstChild.firstChild == document.body is wrong anyway,
+    // so return null to not move anything.
+    if (!document.documentElement || !document.body)
+        return;
+
+    var children = childrenBefore(document, document.documentElement);
+    children = children.concat(childrenBefore(document.documentElement, document.body));
+
+    for (var i = children.length - 1; i >= 0; i--) {
+        var child = children[i];
+        // It's not possible to move doctype nodes into the body, so just remove them.
+        if (child.nodeType == child.DOCUMENT_TYPE_NODE)
+            child.parentNode.removeChild(child);
+        else
+            document.body.insertBefore(child, document.body.firstChild);
+    }
+})();
diff --git a/WebKit/mac/Misc/WebIconFetcher.mm b/WebKit/mac/Misc/WebIconFetcher.mm
deleted file mode 100644
index a31ab7d..0000000
--- a/WebKit/mac/Misc/WebIconFetcher.mm
+++ /dev/null
@@ -1,128 +0,0 @@
-/*
- * Copyright (C) 2008 Apple Inc. All Rights Reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- * 1. Redistributions of source code must retain the above copyright
- *    notice, this list of conditions and the following disclaimer.
- * 2. Redistributions in binary form must reproduce the above copyright
- *    notice, this list of conditions and the following disclaimer in the
- *    documentation and/or other materials provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
- */
-
-#import "WebIconFetcher.h"
-
-#import "WebFrameInternal.h"
-#import "WebIconFetcherInternal.h"
-
-#import <WebCore/Frame.h>
-#import <WebCore/IconFetcher.h>
-#import <WebCore/SharedBuffer.h>
-#import <wtf/PassRefPtr.h>
-
-using namespace WebCore;
-
-class WebIconFetcherClient : public IconFetcherClient {
-public:
-    WebIconFetcherClient(id target, SEL selector)
-        : m_target(target)
-        , m_selector(selector)
-    {
-    }
-
-    virtual void finishedFetchingIcon(PassRefPtr<SharedBuffer> iconData)
-    {
-        RetainPtr<NSData> data;
-        if (iconData)
-            data = iconData->createNSData();
-        
-        [m_target performSelector:m_selector withObject:m_fetcher.get() withObject:data.get()];
-
-        delete this;
-    }
-
-    void setFetcher(WebIconFetcher *fetcher) { m_fetcher = fetcher; }
-    
-private:
-    RetainPtr<WebIconFetcher> m_fetcher;
-    id m_target;
-    SEL m_selector;
-};
-
-@implementation WebIconFetcher
-
-- (id)init
-{
-    return nil;
-}
-
-- (void)dealloc
-{
-    if (_private)
-        reinterpret_cast<IconFetcher*>(_private)->deref();
-    
-    [super dealloc];
-}
-
-- (void)finalize
-{
-    if (_private)
-        reinterpret_cast<IconFetcher*>(_private)->deref();
-    
-    [super finalize];
-}
-
-- (void)cancel
-{
-    reinterpret_cast<IconFetcher*>(_private)->cancel();
-}
-
-@end
-
-@implementation WebIconFetcher (WebInternal)
-
-- (id)_initWithIconFetcher:(PassRefPtr<IconFetcher>)iconFetcher client:(WebIconFetcherClient *)client
-{
-    ASSERT(iconFetcher);
-    
-    self = [super init];
-    if (!self)
-        return nil;
-
-    client->setFetcher(self);
-    _private = reinterpret_cast<WebIconFetcherPrivate*>(iconFetcher.releaseRef());
-
-    return self;
-}
-
-+ (WebIconFetcher *)_fetchApplicationIconForFrame:(WebFrame *)webFrame
-                                           target:(id)target
-                                         selector:(SEL)selector
-{
-    Frame* frame = core(webFrame);
-    
-    WebIconFetcherClient* client = new WebIconFetcherClient(target, selector);
-    
-    RefPtr<IconFetcher> fetcher = IconFetcher::create(frame, client);
-    
-    if (!fetcher)
-        return nil;
-    
-    return [[[WebIconFetcher alloc] _initWithIconFetcher:fetcher.release() client:client] autorelease];
-}
-
-@end
-
diff --git a/WebKit/mac/Misc/WebKitNSStringExtras.mm b/WebKit/mac/Misc/WebKitNSStringExtras.mm
index 8fc12bd..4785de5 100644
--- a/WebKit/mac/Misc/WebKitNSStringExtras.mm
+++ b/WebKit/mac/Misc/WebKitNSStringExtras.mm
@@ -97,7 +97,7 @@ static BOOL canUseFastRenderer(const UniChar *buffer, unsigned length)
         CGFloat blue;
         CGFloat alpha;
         [[textColor colorUsingColorSpaceName:NSDeviceRGBColorSpace] getRed:&red green:&green blue:&blue alpha:&alpha];
-        graphicsContext.setFillColor(makeRGBA(red * 255, green * 255, blue * 255, alpha * 255), DeviceColorSpace);
+        graphicsContext.setFillColor(makeRGBA(red * 255, green * 255, blue * 255, alpha * 255), ColorSpaceDeviceRGB);
 
         webCoreFont.drawText(&graphicsContext, run, FloatPoint(point.x, (flipped ? point.y : (-1 * point.y))));
 
diff --git a/WebKit/mac/Misc/WebNSUserDefaultsExtras.m b/WebKit/mac/Misc/WebNSUserDefaultsExtras.m
deleted file mode 100644
index 383d202..0000000
--- a/WebKit/mac/Misc/WebNSUserDefaultsExtras.m
+++ /dev/null
@@ -1,131 +0,0 @@
-/*
- * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
- *
- * Redistribution and use in source and binary forms, with or without
- * modification, are permitted provided that the following conditions
- * are met:
- *
- * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer. 
- * 2.  Redistributions in binary form must reproduce the above copyright
- *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
- *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission. 
- *
- * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
- * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
- * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
- * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
- * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
- * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
- * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#import "WebNSUserDefaultsExtras.h"
-
-#import "WebNSObjectExtras.h"
-#import <WebKitSystemInterface.h>
-#import <wtf/Assertions.h>
-
-@implementation NSString (WebNSUserDefaultsPrivate)
-
-- (NSString *)_webkit_HTTPStyleLanguageCode
-{
-    // Look up the language code using CFBundle.
-    NSString *languageCode = self;
-    NSString *preferredLanguageCode = WebCFAutorelease(WKCopyCFLocalizationPreferredName((CFStringRef)self));
-
-    if (preferredLanguageCode)
-        languageCode = preferredLanguageCode;
-    
-    // Make the string lowercase.
-    NSString *lowercaseLanguageCode = [languageCode lowercaseString];
-    
-    // Turn a '_' into a '-' if it appears after a 2-letter language code.
-    if ([lowercaseLanguageCode length] < 3 || [lowercaseLanguageCode characterAtIndex:2] != '_') {
-        return lowercaseLanguageCode;
-    }
-    NSMutableString *result = [lowercaseLanguageCode mutableCopy];
-    [result replaceCharactersInRange:NSMakeRange(2, 1) withString:@"-"];
-    return [result autorelease];
-}
-
-@end
-
-@implementation NSUserDefaults (WebNSUserDefaultsExtras)
-
-static NSString *preferredLanguageCode = nil;
-static NSLock *preferredLanguageLock = nil;
-static pthread_once_t preferredLanguageLockOnce = PTHREAD_ONCE_INIT;
-static pthread_once_t addDefaultsChangeObserverOnce = PTHREAD_ONCE_INIT;
-
-static void makeLock(void)
-{
-    preferredLanguageLock = [[NSLock alloc] init]; 
-}
-
-+ (void)_webkit_ensureAndLockPreferredLanguageLock
-{
-    pthread_once(&preferredLanguageLockOnce, makeLock);
-    [preferredLanguageLock lock];
-}
-
-+ (void)_webkit_defaultsDidChange
-{
-    [self _webkit_ensureAndLockPreferredLanguageLock];
-
-    [preferredLanguageCode release];
-    preferredLanguageCode = nil;
-
-    [preferredLanguageLock unlock];
-}
-
-static void addDefaultsChangeObserver(void)
-{
-    [[NSNotificationCenter defaultCenter] addObserver:[NSUserDefaults class]
-                                             selector:@selector(_webkit_defaultsDidChange)
-                                                 name:NSUserDefaultsDidChangeNotification
-                                               object:[NSUserDefaults standardUserDefaults]];
-}
-
-+ (void)_webkit_addDefaultsChangeObserver
-{
-    pthread_once(&addDefaultsChangeObserverOnce, addDefaultsChangeObserver);
-}
-
-+ (NSString *)_webkit_preferredLanguageCode
-{
-    // Get this outside the lock since it might block on the defaults lock, while we are inside registerDefaults:.
-    NSUserDefaults *standardDefaults = [self standardUserDefaults];
-
-    BOOL addObserver = NO;
-
-    [self _webkit_ensureAndLockPreferredLanguageLock];
-
-    if (!preferredLanguageCode) {
-        NSArray *languages = [standardDefaults stringArrayForKey:@"AppleLanguages"];
-        if ([languages count] == 0) {
-            preferredLanguageCode = [@"en" retain];
-        } else {
-            preferredLanguageCode = [[[languages objectAtIndex:0] _webkit_HTTPStyleLanguageCode] copy];
-        }
-        addObserver = YES;
-    }
-
-    NSString *code = [[preferredLanguageCode retain] autorelease];
-    
-    [preferredLanguageLock unlock];
-
-    if (addObserver) {
-        [self _webkit_addDefaultsChangeObserver];
-    }
-
-    return code;
-}
-
-@end
diff --git a/WebKit/mac/Misc/WebNSUserDefaultsExtras.mm b/WebKit/mac/Misc/WebNSUserDefaultsExtras.mm
new file mode 100644
index 0000000..a255935
--- /dev/null
+++ b/WebKit/mac/Misc/WebNSUserDefaultsExtras.mm
@@ -0,0 +1,43 @@
+/*
+ * Copyright (C) 2005, 2010 Apple, Inc.  All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebNSUserDefaultsExtras.h"
+
+#import <WebCore/Language.h>
+#import <wtf/text/WTFString.h>
+
+using namespace WebCore;
+
+@implementation NSUserDefaults (WebNSUserDefaultsExtras)
+
++ (NSString *)_webkit_preferredLanguageCode
+{
+    return defaultLanguage();
+}
+
+@end
diff --git a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
index e03bc27..0b9036a 100644
--- a/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
+++ b/WebKit/mac/Plugins/Hosted/NetscapePluginInstanceProxy.mm
@@ -50,6 +50,7 @@
 #import <WebCore/FrameLoader.h>
 #import <WebCore/FrameTree.h>
 #import <WebCore/KURL.h>
+#import <WebCore/ProxyServer.h>
 #import <WebCore/SecurityOrigin.h>
 #import <WebCore/ScriptController.h>
 #import <WebCore/ScriptValue.h>
@@ -1557,7 +1558,8 @@ bool NetscapePluginInstanceProxy::getProxy(data_t urlData, mach_msg_type_number_
     if (!url)
         return false;
 
-    WTF::CString proxyStringUTF8 = proxiesForURL(url);
+    Vector<ProxyServer> proxyServers = proxyServersForURL(url, 0);
+    WTF::CString proxyStringUTF8 = toString(proxyServers).utf8();
 
     proxyLength = proxyStringUTF8.length();
     mig_allocate(reinterpret_cast<vm_address_t*>(&proxyData), proxyLength);
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
index 9a29cc2..1a4b6bb 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.h
@@ -145,10 +145,6 @@ class WebHaltablePlugin;
 
 
 namespace WebKit {
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-WTF::CString proxiesForURL(NSURL *);
-#endif
-    
 bool getAuthenticationInfo(const char* protocolStr, const char* hostStr, int32_t port, const char* schemeStr, const char* realmStr,
                            WTF::CString& username, WTF::CString& password);
 } 
diff --git a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
index 4966716..708b017 100644
--- a/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebBaseNetscapePluginView.mm
@@ -960,66 +960,6 @@ String WebHaltablePlugin::pluginName() const
 
 namespace WebKit {
 
-#if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-CString proxiesForURL(NSURL *url)
-{
-    RetainPtr<CFDictionaryRef> systemProxies(AdoptCF, CFNetworkCopySystemProxySettings());
-    if (!systemProxies)
-        return "DIRECT";
-    
-    RetainPtr<CFArrayRef> proxiesForURL(AdoptCF, CFNetworkCopyProxiesForURL((CFURLRef)url, systemProxies.get()));
-    CFIndex proxyCount = proxiesForURL ? CFArrayGetCount(proxiesForURL.get()) : 0;
-    if (!proxyCount)
-        return "DIRECT";
- 
-    // proxiesForURL is a CFArray of CFDictionaries. Each dictionary represents a proxy.
-    // The format of the result should be:
-    // "PROXY host[:port]" (for HTTP proxy) or
-    // "SOCKS host[:port]" (for SOCKS proxy) or
-    // A combination of the above, separated by semicolon, in the order that they should be tried.
-    String proxies;
-    for (CFIndex i = 0; i < proxyCount; ++i) {
-        CFDictionaryRef proxy = static_cast<CFDictionaryRef>(CFArrayGetValueAtIndex(proxiesForURL.get(), i));
-        if (!proxy)
-            continue;
-
-        CFStringRef type = static_cast<CFStringRef>(CFDictionaryGetValue(proxy, kCFProxyTypeKey));
-        bool isHTTP = type == kCFProxyTypeHTTP || type == kCFProxyTypeHTTPS;
-        bool isSOCKS = type == kCFProxyTypeSOCKS;
-        
-        // We can only report HTTP and SOCKS proxies.
-        if (!isHTTP && !isSOCKS)
-            continue;
-        
-        CFStringRef host = static_cast<CFStringRef>(CFDictionaryGetValue(proxy, kCFProxyHostNameKey));
-        CFNumberRef port = static_cast<CFNumberRef>(CFDictionaryGetValue(proxy, kCFProxyPortNumberKey));
-        
-        // If we are inserting multiple entries, add a separator
-        if (!proxies.isEmpty())
-            proxies += ";";
-        
-        if (isHTTP)
-            proxies += "PROXY ";
-        else if (isSOCKS)
-            proxies += "SOCKS ";
-        
-        proxies += host;
-
-        if (port) {
-            SInt32 intPort;
-            CFNumberGetValue(port, kCFNumberSInt32Type, &intPort);
-            
-            proxies += ":" + String::number(intPort);
-        }
-    }
-    
-    if (proxies.isEmpty())
-        return "DIRECT";
-    
-    return proxies.utf8();
-}
-#endif
-
 bool getAuthenticationInfo(const char* protocolStr, const char* hostStr, int32_t port, const char* schemeStr, const char* realmStr,
                            CString& username, CString& password)
 {
diff --git a/WebKit/mac/Plugins/WebNetscapePluginEventHandlerCarbon.mm b/WebKit/mac/Plugins/WebNetscapePluginEventHandlerCarbon.mm
index a5e8f73..3d2b68e 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginEventHandlerCarbon.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginEventHandlerCarbon.mm
@@ -174,7 +174,7 @@ void WebNetscapePluginEventHandlerCarbon::mouseEntered(NSEvent* theEvent)
     EventRecord event;
     
     getCarbonEvent(&event, theEvent);
-    event.what = adjustCursorEvent;
+    event.what = NPEventType_AdjustCursorEvent;
     
     BOOL acceptedEvent;
     acceptedEvent = sendEvent(&event);
@@ -187,7 +187,7 @@ void WebNetscapePluginEventHandlerCarbon::mouseExited(NSEvent* theEvent)
     EventRecord event;
     
     getCarbonEvent(&event, theEvent);
-    event.what = adjustCursorEvent;
+    event.what = NPEventType_AdjustCursorEvent;
     
     BOOL acceptedEvent;
     acceptedEvent = sendEvent(&event);
@@ -204,7 +204,7 @@ void WebNetscapePluginEventHandlerCarbon::mouseMoved(NSEvent* theEvent)
     EventRecord event;
     
     getCarbonEvent(&event, theEvent);
-    event.what = adjustCursorEvent;
+    event.what = NPEventType_AdjustCursorEvent;
     
     BOOL acceptedEvent;
     acceptedEvent = sendEvent(&event);
@@ -271,14 +271,14 @@ void WebNetscapePluginEventHandlerCarbon::focusChanged(bool hasFocus)
     getCarbonEvent(&event);
     bool acceptedEvent;
     if (hasFocus) {
-        event.what = getFocusEvent;
+        event.what = NPEventType_GetFocusEvent;
         acceptedEvent = sendEvent(&event);
-        LOG(PluginEvents, "NPP_HandleEvent(getFocusEvent): %d", acceptedEvent);
+        LOG(PluginEvents, "NPP_HandleEvent(NPEventType_GetFocusEvent): %d", acceptedEvent);
         installKeyEventHandler();
     } else {
-        event.what = loseFocusEvent;
+        event.what = NPEventType_LoseFocusEvent;
         acceptedEvent = sendEvent(&event);
-        LOG(PluginEvents, "NPP_HandleEvent(loseFocusEvent): %d", acceptedEvent);
+        LOG(PluginEvents, "NPP_HandleEvent(NPEventType_LoseFocusEvent): %d", acceptedEvent);
         removeKeyEventHandler();
     }
 }
diff --git a/WebKit/mac/Plugins/WebNetscapePluginView.mm b/WebKit/mac/Plugins/WebNetscapePluginView.mm
index ff0ca77..48574bf 100644
--- a/WebKit/mac/Plugins/WebNetscapePluginView.mm
+++ b/WebKit/mac/Plugins/WebNetscapePluginView.mm
@@ -66,6 +66,7 @@
 #import <WebCore/HTMLPlugInElement.h>
 #import <WebCore/Page.h> 
 #import <WebCore/PluginMainThreadScheduler.h>
+#import <WebCore/ProxyServer.h>
 #import <WebCore/ScriptController.h>
 #import <WebCore/SecurityOrigin.h>
 #import <WebCore/SoftLinking.h> 
@@ -2239,7 +2240,8 @@ static inline void getNPRect(const NSRect& nr, NPRect& npr)
             if (!URL)
                 break;
 
-            CString proxiesUTF8 = proxiesForURL(URL);
+            Vector<ProxyServer> proxyServers = proxyServersForURL(URL, 0);
+            CString proxiesUTF8 = toString(proxyServers).utf8();
             
             *value = static_cast<char*>(NPN_MemAlloc(proxiesUTF8.length()));
             memcpy(*value, proxiesUTF8.data(), proxiesUTF8.length());
diff --git a/WebKit/mac/Storage/WebDatabaseTrackerClient.mm b/WebKit/mac/Storage/WebDatabaseTrackerClient.mm
index 89626fb..2913739 100644
--- a/WebKit/mac/Storage/WebDatabaseTrackerClient.mm
+++ b/WebKit/mac/Storage/WebDatabaseTrackerClient.mm
@@ -32,6 +32,7 @@
 
 #import "WebDatabaseManagerPrivate.h"
 #import "WebSecurityOriginInternal.h"
+#import <wtf/MainThread.h>
 #import <wtf/RetainPtr.h>
 #import <WebCore/SecurityOrigin.h>
 
@@ -50,10 +51,42 @@ WebDatabaseTrackerClient::WebDatabaseTrackerClient()
 WebDatabaseTrackerClient::~WebDatabaseTrackerClient()
 {
 }
-    
+
+class DidModifyOriginData : public Noncopyable {
+public:
+    static void dispatchToMainThread(WebDatabaseTrackerClient* client, SecurityOrigin* origin)
+    {
+        DidModifyOriginData* context = new DidModifyOriginData(client, origin->threadsafeCopy());
+        callOnMainThread(&DidModifyOriginData::dispatchDidModifyOriginOnMainThread, context);
+    }
+
+private:
+    DidModifyOriginData(WebDatabaseTrackerClient* client, PassRefPtr<SecurityOrigin> origin)
+        : client(client)
+        , origin(origin)
+    {
+    }
+
+    static void dispatchDidModifyOriginOnMainThread(void* context)
+    {
+        ASSERT(isMainThread());
+        DidModifyOriginData* info = static_cast<DidModifyOriginData*>(context);
+        info->client->dispatchDidModifyOrigin(info->origin.get());
+        delete info;
+    }
+
+    WebDatabaseTrackerClient* client;
+    RefPtr<SecurityOrigin> origin;
+};
+
 void WebDatabaseTrackerClient::dispatchDidModifyOrigin(SecurityOrigin* origin)
 {
-     RetainPtr<WebSecurityOrigin> webSecurityOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:origin]);
+    if (!isMainThread()) {
+        DidModifyOriginData::dispatchToMainThread(this, origin);
+        return;
+    }
+
+    RetainPtr<WebSecurityOrigin> webSecurityOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:origin]);
 
     [[NSNotificationCenter defaultCenter] postNotificationName:WebDatabaseDidModifyOriginNotification 
                                                         object:webSecurityOrigin.get()];
@@ -61,6 +94,11 @@ void WebDatabaseTrackerClient::dispatchDidModifyOrigin(SecurityOrigin* origin)
 
 void WebDatabaseTrackerClient::dispatchDidModifyDatabase(SecurityOrigin* origin, const String& databaseIdentifier)
 {
+    if (!isMainThread()) {
+        DidModifyOriginData::dispatchToMainThread(this, origin);
+        return;
+    }
+
     RetainPtr<WebSecurityOrigin> webSecurityOrigin(AdoptNS, [[WebSecurityOrigin alloc] _initWithWebCoreSecurityOrigin:origin]);
     RetainPtr<NSDictionary> userInfo(AdoptNS, [[NSDictionary alloc] 
                                                initWithObjectsAndKeys:(NSString *)databaseIdentifier, WebDatabaseIdentifierKey, nil]);
diff --git a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
index cef552b..c3fd457 100644
--- a/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebFrameLoaderClient.mm
@@ -94,10 +94,8 @@
 #import <WebCore/HTMLFrameElement.h>
 #import <WebCore/HTMLFrameOwnerElement.h>
 #import <WebCore/HTMLHeadElement.h>
-#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
-#import <WebCore/HTMLMediaElement.h>
-#endif
 #import <WebCore/HTMLNames.h>
+#import <WebCore/HTMLParserIdioms.h>
 #import <WebCore/HTMLPlugInElement.h>
 #import <WebCore/HistoryItem.h>
 #import <WebCore/HitTestResult.h>
@@ -113,7 +111,6 @@
 #import <WebCore/ResourceLoader.h>
 #import <WebCore/ResourceRequest.h>
 #import <WebCore/ScriptController.h>
-#import <WebCore/ScriptString.h>
 #import <WebCore/SharedBuffer.h>
 #import <WebCore/WebCoreObjCExtras.h>
 #import <WebCore/Widget.h>
@@ -124,6 +121,10 @@
 #import <wtf/PassRefPtr.h>
 #import <wtf/Threading.h>
 
+#if ENABLE(PLUGIN_PROXY_FOR_VIDEO)
+#import <WebCore/HTMLMediaElement.h>
+#endif
+
 #if ENABLE(JAVA_BRIDGE)
 #import "WebJavaPlugIn.h"
 #endif
@@ -1668,7 +1669,7 @@ PassRefPtr<Widget> WebFrameLoaderClient::createPlugin(const IntSize& size, HTMLP
     if (errorCode && m_webFrame) {
         WebResourceDelegateImplementationCache* implementations = WebViewGetResourceLoadDelegateImplementations(webView);
         if (implementations->plugInFailedWithErrorFunc) {
-            KURL pluginPageURL = document->completeURL(deprecatedParseURL(parameterValue(paramNames, paramValues, "pluginspage")));
+            KURL pluginPageURL = document->completeURL(stripLeadingAndTrailingHTMLSpaces(parameterValue(paramNames, paramValues, "pluginspage")));
             if (!pluginPageURL.protocolInHTTPFamily())
                 pluginPageURL = KURL();
             NSString *pluginName = pluginPackage ? (NSString *)[pluginPackage pluginInfo].name : nil;
diff --git a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
index d4d0213..b08c161 100644
--- a/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
+++ b/WebKit/mac/WebCoreSupport/WebInspectorClient.mm
@@ -217,11 +217,9 @@ void WebInspectorFrontendClient::updateWindowTitle() const
         return nil;
 
     // Keep preferences separate from the rest of the client, making sure we are using expected preference values.
-    // One reason this is good is that it keeps the inspector out of history via "private browsing".
 
     WebPreferences *preferences = [[WebPreferences alloc] init];
     [preferences setAutosaves:NO];
-    [preferences setPrivateBrowsingEnabled:YES];
     [preferences setLoadsImagesAutomatically:YES];
     [preferences setAuthorAndUserStylesEnabled:YES];
     [preferences setJavaScriptEnabled:YES];
@@ -358,8 +356,8 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     _visible = YES;
     
     // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
-    String shouldAttach = [_inspectedWebView page]->inspectorController()->setting(InspectorController::inspectorStartsAttachedSettingName());
-    _shouldAttach = shouldAttach != "false";
+    // FIXME: This flag can be fetched directly from the flags storage.
+    _shouldAttach = [_inspectedWebView page]->inspectorController()->inspectorStartsAttached();
     
     if (_shouldAttach && !_frontendClient->canAttachWindow())
         _shouldAttach = NO;
@@ -394,7 +392,8 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     if (_attachedToInspectedWebView)
         return;
 
-    [_inspectedWebView page]->inspectorController()->setSetting(InspectorController::inspectorStartsAttachedSettingName(), "true");
+    // FIXME: This flag can be saved directly to the flags storage.
+    [_inspectedWebView page]->inspectorController()->setInspectorStartsAttached(true);
 
     [self close];
     [self showWindow:nil];
@@ -405,7 +404,8 @@ void WebInspectorFrontendClient::updateWindowTitle() const
     if (!_attachedToInspectedWebView)
         return;
 
-    [_inspectedWebView page]->inspectorController()->setSetting(InspectorController::inspectorStartsAttachedSettingName(), "false");
+    // FIXME: This flag can be saved to the flags storage directly.
+    [_inspectedWebView page]->inspectorController()->setInspectorStartsAttached(false);
 
     [self close];
     [self showWindow:nil];
diff --git a/WebKit/mac/WebCoreSupport/WebSystemInterface.mm b/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
index 47b16b2..03cb33f 100644
--- a/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
+++ b/WebKit/mac/WebCoreSupport/WebSystemInterface.mm
@@ -44,6 +44,7 @@ void InitWebCoreSystemInterface(void)
 
     INIT(AdvanceDefaultButtonPulseAnimation);
     INIT(CGContextGetShouldSmoothFonts);
+    INIT(CopyCFLocalizationPreferredName);
     INIT(CopyCONNECTProxyResponse);
     INIT(CopyNSURLResponseStatusLine);
     INIT(CreateCustomCFReadStream);
diff --git a/WebKit/mac/WebCoreSupport/WebViewFactory.mm b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
index 6c7347f..055e3b4 100644
--- a/WebKit/mac/WebCoreSupport/WebViewFactory.mm
+++ b/WebKit/mac/WebCoreSupport/WebViewFactory.mm
@@ -63,11 +63,6 @@
     ASSERT([[self sharedFactory] isKindOfClass:self]);
 }
 
-- (NSString *)defaultLanguageCode
-{
-    return [NSUserDefaults _webkit_preferredLanguageCode];
-}
-
 - (BOOL)objectIsTextMarker:(id)object
 {
     return object != nil && CFGetTypeID(object) == WKGetAXTextMarkerTypeID();
diff --git a/WebKit/mac/WebView/WebFrame.mm b/WebKit/mac/WebView/WebFrame.mm
index 02696f4..4f8c1ba 100644
--- a/WebKit/mac/WebView/WebFrame.mm
+++ b/WebKit/mac/WebView/WebFrame.mm
@@ -44,7 +44,6 @@
 #import "WebFrameViewInternal.h"
 #import "WebHTMLView.h"
 #import "WebHTMLViewInternal.h"
-#import "WebIconFetcherInternal.h"
 #import "WebKitStatisticsPrivate.h"
 #import "WebKitVersionChecks.h"
 #import "WebNSObjectExtras.h"
@@ -530,6 +529,26 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return [[[NSString alloc] initWithCharactersNoCopy:buf length:length freeWhenDone:YES] autorelease];
 }
 
+- (BOOL)_shouldFlattenCompositingLayers:(CGContextRef)context
+{
+    // -currentContextDrawingToScreen returns YES for bitmap contexts.
+    BOOL isPrinting = ![NSGraphicsContext currentContextDrawingToScreen];
+    if (isPrinting)
+        return YES;
+
+    if (!WKCGContextIsBitmapContext(context))
+        return NO;
+
+    // If we're drawing into a bitmap, we might be snapshotting, or drawing into a layer-backed view.
+    if ([getWebView(self) _usesDocumentViews]) {
+        id documentView = [_private->webFrameView documentView];
+        if ([documentView isKindOfClass:[WebHTMLView class]] && [(WebHTMLView *)documentView _web_isDrawingIntoLayer])
+            return NO;
+    }
+
+    return [getWebView(self) _includesFlattenedCompositingLayersWhenDrawingToBitmap];
+}
+
 - (void)_drawRect:(NSRect)rect contentsOnly:(BOOL)contentsOnly
 {
     ASSERT([[NSGraphicsContext currentContext] isFlipped]);
@@ -546,7 +565,7 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
         if (parentView)
             shouldFlatten = parentView->paintBehavior() & PaintBehaviorFlattenCompositingLayers;
     } else
-        shouldFlatten = WKCGContextIsBitmapContext(ctx) && [getWebView(self) _includesFlattenedCompositingLayersWhenDrawingToBitmap];
+        shouldFlatten = [self _shouldFlattenCompositingLayers:ctx];
 
     PaintBehavior oldBehavior = PaintBehaviorNormal;
     if (shouldFlatten) {
@@ -1008,14 +1027,6 @@ static inline WebDataSource *dataSource(DocumentLoader* loader)
     return _private->coreFrame->domWindow()->pendingUnloadEventListeners();
 }
 
-- (WebIconFetcher *)fetchApplicationIcon:(id)target
-                                selector:(SEL)selector
-{
-    return [WebIconFetcher _fetchApplicationIconForFrame:self
-                                                  target:target
-                                                selector:selector];
-}
-
 - (void)_setIsDisconnected:(bool)isDisconnected
 {
     _private->coreFrame->setIsDisconnected(isDisconnected);
diff --git a/WebKit/mac/WebView/WebFramePrivate.h b/WebKit/mac/WebView/WebFramePrivate.h
index 9cb6232..b0cb0f3 100644
--- a/WebKit/mac/WebView/WebFramePrivate.h
+++ b/WebKit/mac/WebView/WebFramePrivate.h
@@ -38,7 +38,6 @@
 @class DOMDocumentFragment;
 @class DOMNode;
 @class DOMRange;
-@class WebIconFetcher;
 @class WebScriptObject;
 @class WebScriptWorld;
 
@@ -87,9 +86,6 @@ typedef enum {
 
 - (unsigned)_pendingFrameUnloadEventCount;
 
-- (WebIconFetcher *)fetchApplicationIcon:(id)target
-                                selector:(SEL)selector;
-
 - (void)_setIsDisconnected:(bool)isDisconnected;
 - (void)_setExcludeFromTextSearch:(bool)exclude;
 
diff --git a/WebKit/mac/WebView/WebHTMLView.mm b/WebKit/mac/WebView/WebHTMLView.mm
index 02d32d9..ec2473f 100644
--- a/WebKit/mac/WebView/WebHTMLView.mm
+++ b/WebKit/mac/WebView/WebHTMLView.mm
@@ -456,6 +456,7 @@ struct WebHTMLViewInterpretKeyEventsParameters {
     
 #if USE(ACCELERATED_COMPOSITING)
     NSView *layerHostingView;
+    BOOL drawingIntoLayer;
 #endif
 
     NSEvent *mouseDownEvent; // Kept after handling the event.
@@ -2232,6 +2233,22 @@ static void _updateMouseoverTimerCallback(CFRunLoopTimerRef timer, void *info)
     return _private->printing;
 }
 
+- (BOOL)_beginPrintModeWithMinimumPageWidth:(CGFloat)minimumPageWidth height:(CGFloat)minimumPageHeight maximumPageWidth:(CGFloat)maximumPageWidth
+{
+    Frame* frame = core([self _frame]);
+    if (!frame)
+        return NO;
+
+    if (frame->document() && frame->document()->isFrameSet()) {
+        minimumPageWidth = 0;
+        minimumPageHeight = 0;
+        maximumPageWidth = 0;
+    }
+
+    [self _setPrinting:YES minimumPageWidth:minimumPageWidth height:minimumPageHeight maximumPageWidth:maximumPageWidth adjustViewSize:YES paginateScreenContent:[self _isInScreenPaginationMode]];
+    return YES;
+}
+
 - (BOOL)_beginPrintModeWithPageWidth:(float)pageWidth height:(float)pageHeight shrinkToFit:(BOOL)shrinkToFit
 {
     Frame* frame = core([self _frame]);
@@ -3401,6 +3418,9 @@ WEBCORE_COMMAND(yankAndSelect)
         [webView _setNeedsOneShotDrawingSynchronization:NO];
     }
 #endif
+
+    if (webView)
+        CallUIDelegate(webView, @selector(webView:didDrawFrame:), [self _frame]);
 }
 
 // Turn off the additional clip while computing our visibleRect.
@@ -5552,6 +5572,14 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     [viewLayer setTransform:CATransform3DMakeScale(scaleFactor, scaleFactor, 1)];
 #endif
 
+    if ([self layer]) {
+        // If we are in a layer-backed view, we need to manually initialize the geometry for our layer.
+        [viewLayer setBounds:NSRectToCGRect([_private->layerHostingView bounds])];
+        [viewLayer setAnchorPoint:CGPointMake(0, [self isFlipped] ? 1 : 0)];
+        CGPoint layerPosition = NSPointToCGPoint([self convertPointToBase:[_private->layerHostingView frame].origin]);
+        [viewLayer setPosition:layerPosition];
+    }
+    
     [_private->layerHostingView setLayer:viewLayer];
     [_private->layerHostingView setWantsLayer:YES];
     
@@ -5591,8 +5619,6 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
     NSRect layerViewFrame = [self bounds];
 
     if (layerViewFrame.size.height > maxHeight) {
-        CGFloat documentHeight = layerViewFrame.size.height;
-            
         // Clamp the size of the view to <= maxHeight to avoid the bug.
         layerViewFrame.size.height = maxHeight;
         NSRect visibleRect = [[self enclosingScrollView] documentVisibleRect];
@@ -5602,14 +5628,34 @@ static CGPoint coreGraphicsScreenPointForAppKitScreenPoint(NSPoint point)
         layerViewFrame.origin.y = topOffset;
 
         // Compensate for the moved view by adjusting the sublayer transform on the view's layer (using flipped coords).
-        CGFloat bottomOffset = documentHeight - layerViewFrame.size.height - topOffset;
-        [[_private->layerHostingView layer] setSublayerTransform:CATransform3DMakeTranslation(0, -bottomOffset, 0)];
+        CATransform3D flipTransform = CATransform3DMakeTranslation(0, topOffset, 0);
+        flipTransform = CATransform3DScale(flipTransform, 1, -1, 1);
+        [[_private->layerHostingView layer] setSublayerTransform:flipTransform];
     }
 
     [_private->layerHostingView _updateLayerGeometryFromView];  // Workaround for <rdar://problem/7071636>
     [_private->layerHostingView setFrame:layerViewFrame];
 }
 #endif // defined(BUILDING_ON_LEOPARD)
+
+- (void)drawLayer:(CALayer *)layer inContext:(CGContextRef)ctx
+{
+    if (_private) {
+        ASSERT(!_private->drawingIntoLayer);
+        _private->drawingIntoLayer = YES;
+    }
+
+    [super drawLayer:layer inContext:ctx];
+
+    if (_private)
+        _private->drawingIntoLayer = NO;
+}
+
+- (BOOL)_web_isDrawingIntoLayer
+{
+    return _private->drawingIntoLayer;
+}
+
 #endif // USE(ACCELERATED_COMPOSITING)
 
 @end
diff --git a/WebKit/mac/WebView/WebHTMLViewInternal.h b/WebKit/mac/WebView/WebHTMLViewInternal.h
index 2d9e2a9..07a782a 100644
--- a/WebKit/mac/WebView/WebHTMLViewInternal.h
+++ b/WebKit/mac/WebView/WebHTMLViewInternal.h
@@ -66,6 +66,7 @@ namespace WebCore {
 #if USE(ACCELERATED_COMPOSITING)
 - (void)attachRootLayer:(CALayer*)layer;
 - (void)detachRootLayer;
+- (BOOL)_web_isDrawingIntoLayer;
 #endif
 
 #if USE(ACCELERATED_COMPOSITING) && defined(BUILDING_ON_LEOPARD)
diff --git a/WebKit/mac/WebView/WebHTMLViewPrivate.h b/WebKit/mac/WebView/WebHTMLViewPrivate.h
index e1d15dc..1218efc 100644
--- a/WebKit/mac/WebView/WebHTMLViewPrivate.h
+++ b/WebKit/mac/WebView/WebHTMLViewPrivate.h
@@ -136,6 +136,9 @@ extern const float _WebHTMLViewPrintingMaximumShrinkFactor;
 - (WebCGFloat)_adjustedBottomOfPageWithTop:(WebCGFloat)top bottom:(WebCGFloat)bottom limit:(WebCGFloat)bottomLimit;
 - (BOOL)_isInPrintMode;
 - (BOOL)_beginPrintModeWithPageWidth:(float)pageWidth height:(float)pageHeight shrinkToFit:(BOOL)shrinkToFit;
+// Lays out to pages of the given minimum width and height or more (increasing both dimensions proportionally)
+// as needed for the content to fit, but no more than the given maximum width.
+- (BOOL)_beginPrintModeWithMinimumPageWidth:(WebCGFloat)minimumPageWidth height:(WebCGFloat)minimumPageHeight maximumPageWidth:(WebCGFloat)maximumPageWidth;
 - (void)_endPrintMode;
 
 - (BOOL)_isInScreenPaginationMode;
diff --git a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
index 8119649..cd9ed8f 100644
--- a/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
+++ b/WebKit/mac/WebView/WebPreferenceKeysPrivate.h
@@ -96,6 +96,7 @@
 #define WebKitUsesProxiedOpenPanelPreferenceKey @"WebKitUsesProxiedOpenPanel"
 #define WebKitPluginAllowedRunTimePreferenceKey @"WebKitPluginAllowedRunTime"
 #define WebKitFrameFlatteningEnabledPreferenceKey @"WebKitFrameFlatteningEnabled"
+#define WebKitSpatialNavigationEnabledPreferenceKey @"WebKitSpatialNavigationEnabled"
 #define WebKitPaginateDuringLayoutEnabledPreferenceKey @"WebKitPaginateDuringLayoutEnabled"
 #define WebKitDNSPrefetchingEnabledPreferenceKey @"WebKitDNSPrefetchingEnabled"
 #define WebKitFullScreenEnabledPreferenceKey @"WebKitFullScreenEnabled"
diff --git a/WebKit/mac/WebView/WebPreferences.mm b/WebKit/mac/WebView/WebPreferences.mm
index 2ddd8b3..ccfb632 100644
--- a/WebKit/mac/WebView/WebPreferences.mm
+++ b/WebKit/mac/WebView/WebPreferences.mm
@@ -365,6 +365,7 @@ static WebCacheModel cacheModelForMainBundle(void)
         [NSNumber numberWithBool:NO],   WebKitUsesProxiedOpenPanelPreferenceKey,
         [NSNumber numberWithUnsignedInt:4], WebKitPluginAllowedRunTimePreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitFrameFlatteningEnabledPreferenceKey,
+        [NSNumber numberWithBool:NO],   WebKitSpatialNavigationEnabledPreferenceKey,
         [NSNumber numberWithBool:YES],  WebKitDNSPrefetchingEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitFullScreenEnabledPreferenceKey,
         [NSNumber numberWithBool:NO],   WebKitMemoryInfoEnabledPreferenceKey,
@@ -1313,6 +1314,16 @@ static NSString *classIBCreatorID = nil;
     [self _setBoolValue:flag forKey:WebKitFrameFlatteningEnabledPreferenceKey];
 }
 
+- (BOOL)isSpatialNavigationEnabled
+{
+    return [self _boolValueForKey:WebKitSpatialNavigationEnabledPreferenceKey];
+}
+
+- (void)setSpatialNavigationEnabled:(BOOL)flag
+{
+    [self _setBoolValue:flag forKey:WebKitSpatialNavigationEnabledPreferenceKey];
+}
+
 - (BOOL)paginateDuringLayoutEnabled
 {
     return [self _boolValueForKey:WebKitPaginateDuringLayoutEnabledPreferenceKey];
diff --git a/WebKit/mac/WebView/WebPreferencesPrivate.h b/WebKit/mac/WebView/WebPreferencesPrivate.h
index bb525cd..47e6d71 100644
--- a/WebKit/mac/WebView/WebPreferencesPrivate.h
+++ b/WebKit/mac/WebView/WebPreferencesPrivate.h
@@ -130,6 +130,9 @@ extern NSString *WebPreferencesRemovedNotification;
 - (BOOL)isFrameFlatteningEnabled;
 - (void)setFrameFlatteningEnabled:(BOOL)flag;
 
+- (BOOL)isSpatialNavigationEnabled;
+- (void)setSpatialNavigationEnabled:(BOOL)flag;
+
 // zero means do AutoScale
 - (float)PDFScaleFactor;
 - (void)setPDFScaleFactor:(float)scale;
diff --git a/WebKit/mac/WebView/WebSerializedJSValue.mm b/WebKit/mac/WebView/WebSerializedJSValue.mm
index 05a316b..d993790 100644
--- a/WebKit/mac/WebView/WebSerializedJSValue.mm
+++ b/WebKit/mac/WebView/WebSerializedJSValue.mm
@@ -22,7 +22,7 @@
  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#import "WebSerializedJSValue.h"
+#import "WebSerializedJSValuePrivate.h"
 
 #import <WebCore/SerializedScriptValue.h>
 #import <wtf/RefPtr.h>
@@ -65,6 +65,30 @@ using namespace WebCore;
     return self;
 }
 
+- (id)initWithInternalRepresentation:(void *)internalRepresenatation
+{
+    ASSERT_ARG(internalRepresenatation, internalRepresenatation);
+
+    if (!internalRepresenatation) {
+        [self release];
+        return nil;
+    }
+
+    self = [super init];
+    if (!self)
+        return nil;
+    
+    _private = [[WebSerializedJSValuePrivate alloc] init];
+
+    _private->value = ((SerializedScriptValue*)internalRepresenatation);
+    if (!_private->value) {
+        [self release];
+        return nil;
+    }
+    
+    return self;
+}
+
 - (JSValueRef)deserialize:(JSContextRef)destinationContext
 {
     if (!_private || !_private->value)
@@ -79,5 +103,12 @@ using namespace WebCore;
     [super dealloc];
 }
 
+- (void*)internalRepresentation
+{
+    if (!_private)
+        return 0;
+    return _private->value.get();
+}
+
 @end
 
diff --git a/WebCore/platform/text/StringBuffer.h b/WebKit/mac/WebView/WebSerializedJSValuePrivate.h
index 3a753b4..217fe44 100644
--- a/WebCore/platform/text/StringBuffer.h
+++ b/WebKit/mac/WebView/WebSerializedJSValuePrivate.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2005 Apple Computer, Inc.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -10,8 +10,8 @@
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
  *     documentation and/or other materials provided with the distribution. 
- * 3.  Neither the name of Apple Inc. ("Apple") nor the names of its
- *     contributors may be used to endorse or promote products derived
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
  *     from this software without specific prior written permission. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
@@ -26,10 +26,9 @@
  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
-#ifndef WebCoreStringBuffer_h
-#define WebCoreStringBuffer_h
+#import <WebKit/WebSerializedJSValue.h>
 
-// FIXME: remove this header, use the forward from wtf directly.
-#include <wtf/text/StringBuffer.h>
-
-#endif // StringBuffer_h
+@interface WebSerializedJSValue(WebPrivate)
+- (id)initWithInternalRepresentation:(void*)internalRepresenatation;
+- (void*)internalRepresentation;
+@end
diff --git a/WebKit/mac/WebView/WebUIDelegatePrivate.h b/WebKit/mac/WebView/WebUIDelegatePrivate.h
index 4565a4e..0b62bcb 100644
--- a/WebKit/mac/WebView/WebUIDelegatePrivate.h
+++ b/WebKit/mac/WebView/WebUIDelegatePrivate.h
@@ -183,4 +183,6 @@ enum {
 - (void)webView:(WebView *)sender exitFullScreenForElement:(DOMElement *)element;
 #endif
 
+- (void)webView:(WebView *)sender didDrawFrame:(WebFrame *)frame;
+
 @end
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.h b/WebKit/mac/WebView/WebVideoFullscreenController.h
index 3e7b6cf..69ba9f4 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.h
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.h
@@ -49,7 +49,8 @@ namespace WebCore {
     BOOL _isWindowLoaded;
     BOOL _forceDisableAnimation;
     uint32_t _idleDisplaySleepAssertion;
-    uint32_t _idleSystemSleepAssertion;    
+    uint32_t _idleSystemSleepAssertion;
+    NSTimer *_tickleTimer;
     SystemUIMode _savedUIMode;
     SystemUIOptions _savedUIOptions;
 }
diff --git a/WebKit/mac/WebView/WebVideoFullscreenController.mm b/WebKit/mac/WebView/WebVideoFullscreenController.mm
index 69ded78..1efb93f 100644
--- a/WebKit/mac/WebView/WebVideoFullscreenController.mm
+++ b/WebKit/mac/WebView/WebVideoFullscreenController.mm
@@ -31,6 +31,7 @@
 #import "WebVideoFullscreenHUDWindowController.h"
 #import "WebWindowAnimation.h"
 #import <IOKit/pwr_mgt/IOPMLib.h>
+#import <OSServices/Power.h>
 #import <QTKit/QTKit.h>
 #import <WebCore/HTMLMediaElement.h>
 #import <WebCore/SoftLinking.h>
@@ -43,6 +44,7 @@ SOFT_LINK_CLASS(QTKit, QTMovieLayer)
 SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 
 #define QTMovieRateDidChangeNotification getQTMovieRateDidChangeNotification()
+static const NSTimeInterval tickleTimerInterval = 1.0;
 
 @interface WebVideoFullscreenWindow : NSWindow
 #if !defined(BUILDING_ON_LEOPARD) && !defined(BUILDING_ON_TIGER)
@@ -82,6 +84,9 @@ SOFT_LINK_POINTER(QTKit, QTMovieRateDidChangeNotification, NSString *)
 {
     ASSERT(!_backgroundFullscreenWindow);
     ASSERT(!_fadeAnimation);
+    [_tickleTimer invalidate];
+    [_tickleTimer release];
+    _tickleTimer = nil;
     [[NSNotificationCenter defaultCenter] removeObserver:self];
     [super dealloc];
 }
@@ -378,6 +383,25 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
         _idleSystemSleepAssertion = kIOPMNullAssertionID;
     }
 }
+
+- (void)_enableTickleTimer
+{
+    [_tickleTimer invalidate];
+    [_tickleTimer release];
+    _tickleTimer = [[NSTimer scheduledTimerWithTimeInterval:tickleTimerInterval target:self selector:@selector(_tickleTimerFired) userInfo:nil repeats:YES] retain];
+}
+
+- (void)_disableTickleTimer
+{
+    [_tickleTimer invalidate];
+    [_tickleTimer release];
+    _tickleTimer = nil;
+}
+
+- (void)_tickleTimerFired
+{
+    UpdateSystemActivity(OverallAct);
+}
 #endif
 
 - (void)updatePowerAssertions
@@ -390,9 +414,11 @@ static NSWindow *createBackgroundFullscreenWindow(NSRect frame, int level)
     if (rate && !_isEndingFullscreen) {
         [self _disableIdleSystemSleep];
         [self _disableIdleDisplaySleep];
+        [self _disableTickleTimer];
     } else {
         [self _enableIdleSystemSleep];
         [self _enableIdleDisplaySleep];
+        [self _enableTickleTimer];
     }
 #endif
 }
diff --git a/WebKit/mac/WebView/WebView.mm b/WebKit/mac/WebView/WebView.mm
index 1fca8d1..9b267ef 100644
--- a/WebKit/mac/WebView/WebView.mm
+++ b/WebKit/mac/WebView/WebView.mm
@@ -190,7 +190,7 @@
 #import <WebCore/GeolocationError.h>
 #endif
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
 #import <glib.h>
 #endif
 
@@ -385,7 +385,7 @@ static const char webViewIsOpen[] = "At least one WebView is still open.";
 #if USE(ACCELERATED_COMPOSITING)
 - (void)_clearLayerSyncLoopObserver;
 #endif
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
 - (void)_clearGlibLoopObserver;
 #endif
 @end
@@ -637,6 +637,19 @@ static bool shouldEnableLoadDeferring()
     return _private->usesDocumentViews;
 }
 
+static NSString *leakMailQuirksUserScriptPath()
+{
+    NSString *scriptPath = [[NSBundle bundleForClass:[WebView class]] pathForResource:@"MailQuirksUserScript" ofType:@"js"];
+    return [[NSString alloc] initWithContentsOfFile:scriptPath];
+}
+
+- (void)_injectMailQuirksScript
+{
+    static NSString *mailQuirksScriptPath = leakMailQuirksUserScriptPath();
+    core(self)->group().addUserScriptToWorld(core([WebScriptWorld world]),
+        mailQuirksScriptPath, KURL(), 0, 0, InjectAtDocumentEnd, InjectInAllFrames);
+}
+
 - (void)_commonInitializationWithFrameName:(NSString *)frameName groupName:(NSString *)groupName usesDocumentViews:(BOOL)usesDocumentViews
 {
     WebCoreThreadViolationCheckRoundTwo();
@@ -750,10 +763,12 @@ static bool shouldEnableLoadDeferring()
     if (!WebKitLinkedOnOrAfter(WEBKIT_FIRST_VERSION_WITHOUT_CONTENT_SNIFFING_FOR_FILE_URLS))
         ResourceHandle::forceContentSniffing();
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
     [self _scheduleGlibContextIterations];
 #endif
 
+    if (runningTigerMail() || runningLeopardMail())
+        [self _injectMailQuirksScript];
 }
 
 - (id)_initWithFrame:(NSRect)f frameName:(NSString *)frameName groupName:(NSString *)groupName usesDocumentViews:(BOOL)usesDocumentViews
@@ -1151,7 +1166,7 @@ static bool fastDocumentTeardownEnabled()
     [self _clearLayerSyncLoopObserver];
 #endif
     
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
     [self _clearGlibLoopObserver];
 #endif
 
@@ -1472,6 +1487,7 @@ static bool fastDocumentTeardownEnabled()
     settings->setAccelerated2dCanvasEnabled([preferences accelerated2dCanvasEnabled]);
     settings->setLoadDeferringEnabled(shouldEnableLoadDeferring());
     settings->setFrameFlatteningEnabled([preferences isFrameFlatteningEnabled]);
+    settings->setSpatialNavigationEnabled([preferences isSpatialNavigationEnabled]);
     settings->setPaginateDuringLayoutEnabled([preferences paginateDuringLayoutEnabled]);
 #if ENABLE(FULLSCREEN_API)
     settings->setFullScreenEnabled([preferences fullScreenEnabled]);
@@ -5632,7 +5648,7 @@ static WebFrameView *containingFrameView(NSView *view)
 }
 #endif
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
 - (void)_clearGlibLoopObserver
 {
     if (!_private->glibRunLoopObserver)
@@ -5955,7 +5971,7 @@ static void layerSyncRunLoopObserverCallBack(CFRunLoopObserverRef, CFRunLoopActi
 
 #endif
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
 
 static void glibContextIterationCallback(CFRunLoopObserverRef, CFRunLoopActivity, void*)
 {
diff --git a/WebKit/mac/WebView/WebViewData.h b/WebKit/mac/WebView/WebViewData.h
index 9aa91dc..639c3e0 100644
--- a/WebKit/mac/WebView/WebViewData.h
+++ b/WebKit/mac/WebView/WebViewData.h
@@ -172,7 +172,7 @@ extern int pluginDatabaseClientCount;
     WebVideoFullscreenController *fullscreenController;
 #endif
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
     CFRunLoopObserverRef glibRunLoopObserver;
 #endif
     id<WebGeolocationProvider> _geolocationProvider;
diff --git a/WebKit/mac/WebView/WebViewInternal.h b/WebKit/mac/WebView/WebViewInternal.h
index 71a2660..0a6f462 100644
--- a/WebKit/mac/WebView/WebViewInternal.h
+++ b/WebKit/mac/WebView/WebViewInternal.h
@@ -88,7 +88,7 @@ namespace WebCore {
 - (void)_scheduleCompositingLayerSync;
 #endif
 
-#if ENABLE(VIDEO) && USE(GSTREAMER)
+#if ENABLE(GLIB_SUPPORT)
 - (void)_scheduleGlibContextIterations;
 #endif
 
diff --git a/WebKit/qt/Api/DerivedSources.pro b/WebKit/qt/Api/DerivedSources.pro
index d8bd1db..8084242 100644
--- a/WebKit/qt/Api/DerivedSources.pro
+++ b/WebKit/qt/Api/DerivedSources.pro
@@ -10,7 +10,9 @@ DESTDIR = ../../../include/QtWebKit
 QUOTE = ""
 DOUBLE_ESCAPED_QUOTE = ""
 ESCAPE = ""
-win32-msvc* | wince* | contains(QMAKE_HOST.os, "Windows"):isEmpty(QMAKE_SH) {
+win32-msvc* | wince* {
+    ESCAPE = "^"
+} else:contains(QMAKE_HOST.os, "Windows"):isEmpty(QMAKE_SH) {
     # MinGW's make will run makefile commands using sh, even if make
     #  was run from the Windows shell, if it finds sh in the path.
     ESCAPE = "^"
diff --git a/WebKit/qt/Api/qgraphicswebview.cpp b/WebKit/qt/Api/qgraphicswebview.cpp
index 36d4326..df28626 100644
--- a/WebKit/qt/Api/qgraphicswebview.cpp
+++ b/WebKit/qt/Api/qgraphicswebview.cpp
@@ -76,8 +76,12 @@ public:
     QWebPage* page;
     bool resizesToContents;
 
-    // Just a convenience to avoid using page->client->overlay always
-    QSharedPointer<QGraphicsItemOverlay> overlay;
+    QGraphicsItemOverlay* overlay() const
+    {
+        if (!page || !page->d->client)
+            return 0;
+        return static_cast<PageClientQGraphicsWidget*>(page->d->client)->overlay;
+    }
 };
 
 QGraphicsWebViewPrivate::~QGraphicsWebViewPrivate()
@@ -293,8 +297,8 @@ void QGraphicsWebView::paint(QPainter* painter, const QStyleOptionGraphicsItem*
         return;
     } 
 #endif
-#if USE(ACCELERATED_COMPOSITING)
-    page()->mainFrame()->render(painter, d->overlay ? QWebFrame::ContentsLayer : QWebFrame::AllLayers, option->exposedRect.toAlignedRect());
+#if USE(ACCELERATED_COMPOSITING) && !USE(TEXTURE_MAPPER)
+    page()->mainFrame()->render(painter, d->overlay() ? QWebFrame::ContentsLayer : QWebFrame::AllLayers, option->exposedRect.toAlignedRect());
 #else
     page()->mainFrame()->render(painter, QWebFrame::AllLayers, option->exposedRect.toRect());
 #endif
@@ -445,10 +449,9 @@ void QGraphicsWebView::setPage(QWebPage* page)
         return;
 
     d->page->d->client = new PageClientQGraphicsWidget(this, page); // set the page client
-    d->overlay = static_cast<PageClientQGraphicsWidget*>(d->page->d->client)->overlay;
 
-    if (d->overlay)
-        d->overlay->prepareGraphicsItemGeometryChange();
+    if (d->overlay())
+        d->overlay()->prepareGraphicsItemGeometryChange();
 
     QSize size = geometry().size().toSize();
     page->setViewportSize(size);
@@ -560,8 +563,8 @@ qreal QGraphicsWebView::zoomFactor() const
 */
 void QGraphicsWebView::updateGeometry()
 {
-    if (d->overlay)
-        d->overlay->prepareGraphicsItemGeometryChange();
+    if (d->overlay())
+        d->overlay()->prepareGraphicsItemGeometryChange();
 
     QGraphicsWidget::updateGeometry();
 
@@ -578,8 +581,8 @@ void QGraphicsWebView::setGeometry(const QRectF& rect)
 {
     QGraphicsWidget::setGeometry(rect);
 
-    if (d->overlay)
-        d->overlay->prepareGraphicsItemGeometryChange();
+    if (d->overlay())
+        d->overlay()->prepareGraphicsItemGeometryChange();
 
     if (!d->page)
         return;
diff --git a/WebKit/qt/Api/qwebframe.cpp b/WebKit/qt/Api/qwebframe.cpp
index 1791096..39e74d9 100644
--- a/WebKit/qt/Api/qwebframe.cpp
+++ b/WebKit/qt/Api/qwebframe.cpp
@@ -96,6 +96,9 @@
 #include "runtime_object.h"
 #include "runtime_root.h"
 #endif
+#if USE(TEXTURE_MAPPER)
+#include "texmap/TextureMapperPlatformLayer.h"
+#endif
 #include "wtf/HashMap.h"
 #include <QMultiMap>
 #include <qdebug.h>
@@ -230,14 +233,6 @@ void QWebFramePrivate::init(QWebFrame *qframe, QWebFrameData *frameData)
     frame->init();
 }
 
-WebCore::ViewportArguments QWebFramePrivate::viewportArguments()
-{
-    if (!frame || !frame->document())
-        return WebCore::ViewportArguments();
-
-    return frame->document()->viewportArguments();
-}
-
 void QWebFramePrivate::setPage(QWebPage* newPage)
 {
     if (page == newPage)
@@ -299,6 +294,16 @@ void QWebFramePrivate::renderFromTiledBackingStore(GraphicsContext* context, con
 
         painter->restore();
     }
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+    // TextureMapper might use raw OpenGL or some other backend that requires native painting. On raster this doesn't have any effect.
+    if (rootGraphicsLayer) {
+        painter->beginNativePainting();
+        rootGraphicsLayer->paint(context, view->size(), view->frameRect(), IntRect(clip.boundingRect()), TransformationMatrix(), painter->opacity());
+        painter->endNativePainting();
+    }
+
+    renderRelativeCoords(context, (QWebFrame::RenderLayer)(QWebFrame::ScrollBarLayer | QWebFrame::PanIconLayer), clip);
+#endif
 }
 #endif
 
@@ -316,19 +321,18 @@ void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame:
     WebCore::FrameView* view = frame->view();
     view->updateLayoutAndStyleIfNeededRecursive();
 
-    for (int i = 0; i < vector.size(); ++i) {
-        const QRect& clipRect = vector.at(i);
-
-        QRect intersectedRect = clipRect.intersected(view->frameRect());
-
+    if (layer & QWebFrame::ContentsLayer) {
         painter->save();
-        painter->setClipRect(clipRect, Qt::IntersectClip);
+        for (int i = 0; i < vector.size(); ++i) {
+            const QRect& clipRect = vector.at(i);
 
-        int x = view->x();
-        int y = view->y();
+            QRect intersectedRect = clipRect.intersected(view->frameRect());
 
-        if (layer & QWebFrame::ContentsLayer) {
             context->save();
+            painter->setClipRect(clipRect, Qt::IntersectClip);
+
+            int x = view->x();
+            int y = view->y();
 
             int scrollX = view->scrollX();
             int scrollY = view->scrollY();
@@ -344,27 +348,52 @@ void QWebFramePrivate::renderRelativeCoords(GraphicsContext* context, QWebFrame:
 
             context->restore();
         }
+        painter->restore();
 
-        if (layer & QWebFrame::ScrollBarLayer
-            && !view->scrollbarsSuppressed()
-            && (view->horizontalScrollbar() || view->verticalScrollbar())) {
-            context->save();
+#if USE(ACCELERATED_COMPOSITING) && USE(TEXTURE_MAPPER)
+        if (rootGraphicsLayer) {
+            painter->save();
+            painter->beginNativePainting();
+            rootGraphicsLayer->paint(context, view->size(), view->frameRect(), IntRect(clip.boundingRect()),
+                                     TransformationMatrix(), context->platformContext()->opacity());
+            painter->endNativePainting();
+            painter->restore();
+        }
+#endif
+    }
+    if (layer & (QWebFrame::PanIconLayer | QWebFrame::ScrollBarLayer)) {
+        for (int i = 0; i < vector.size(); ++i) {
+            const QRect& clipRect = vector.at(i);
 
-            QRect rect = intersectedRect;
-            context->translate(x, y);
-            rect.translate(-x, -y);
+            QRect intersectedRect = clipRect.intersected(view->frameRect());
 
-            view->paintScrollbars(context, rect);
+            painter->save();
+            painter->setClipRect(clipRect, Qt::IntersectClip);
 
-            context->restore();
-        }
+            int x = view->x();
+            int y = view->y();
+
+            if (layer & QWebFrame::ScrollBarLayer
+                && !view->scrollbarsSuppressed()
+                && (view->horizontalScrollbar() || view->verticalScrollbar())) {
+                context->save();
+
+                QRect rect = intersectedRect;
+                context->translate(x, y);
+                rect.translate(-x, -y);
+
+                view->paintScrollbars(context, rect);
+
+                context->restore();
+            }
 
 #if ENABLE(PAN_SCROLLING)
-        if (layer & QWebFrame::PanIconLayer)
-            view->paintPanScrollIcon(context);
+            if (layer & QWebFrame::PanIconLayer)
+                view->paintPanScrollIcon(context);
 #endif
 
-        painter->restore();
+            painter->restore();
+        }
     }
 }
 
diff --git a/WebKit/qt/Api/qwebframe_p.h b/WebKit/qt/Api/qwebframe_p.h
index 5ba3f52..79187ab 100644
--- a/WebKit/qt/Api/qwebframe_p.h
+++ b/WebKit/qt/Api/qwebframe_p.h
@@ -90,8 +90,6 @@ public:
     void renderFromTiledBackingStore(WebCore::GraphicsContext*, const QRegion& clip);
 #endif
 
-    WebCore::ViewportArguments viewportArguments();
-
     QWebFrame *q;
     Qt::ScrollBarPolicy horizontalScrollBarPolicy;
     Qt::ScrollBarPolicy verticalScrollBarPolicy;
diff --git a/WebKit/qt/Api/qwebhistory.cpp b/WebKit/qt/Api/qwebhistory.cpp
index 1d9935d..25d77a4 100644
--- a/WebKit/qt/Api/qwebhistory.cpp
+++ b/WebKit/qt/Api/qwebhistory.cpp
@@ -103,7 +103,7 @@ QWebHistoryItem::~QWebHistoryItem()
 QUrl QWebHistoryItem::originalUrl() const
 {
     if (d->item)
-        return QUrl(d->item->originalURL().string());
+        return d->item->originalURL();
     return QUrl();
 }
 
@@ -116,7 +116,7 @@ QUrl QWebHistoryItem::originalUrl() const
 QUrl QWebHistoryItem::url() const
 {
     if (d->item)
-        return QUrl(d->item->url().string());
+        return d->item->url();
     return QUrl();
 }
 
diff --git a/WebKit/qt/Api/qwebpage.cpp b/WebKit/qt/Api/qwebpage.cpp
index 932103d..454376c 100644
--- a/WebKit/qt/Api/qwebpage.cpp
+++ b/WebKit/qt/Api/qwebpage.cpp
@@ -45,6 +45,8 @@
 #include "ChromeClientQt.h"
 #include "ContextMenu.h"
 #include "ContextMenuClientQt.h"
+#include "DeviceMotionClientQt.h"
+#include "DeviceOrientationClientQt.h"
 #include "DocumentLoader.h"
 #include "DragClientQt.h"
 #include "DragController.h"
@@ -91,6 +93,9 @@
 #include "PlatformTouchEvent.h"
 #include "WorkerThread.h"
 #include "wtf/Threading.h"
+#include "MIMETypeRegistry.h"
+#include "PluginDatabase.h"
+#include "PluginPackage.h"
 
 #include <QApplication>
 #include <QBasicTimer>
@@ -298,6 +303,10 @@ QWebPagePrivate::QWebPagePrivate(QWebPage *qq)
     pageClients.editorClient = new EditorClientQt(q);
     pageClients.dragClient = new DragClientQt(q);
     pageClients.inspectorClient = new InspectorClientQt(q);
+#if ENABLE(DEVICE_ORIENTATION)
+    pageClients.deviceOrientationClient = new DeviceOrientationClientQt(q);
+    pageClients.deviceMotionClient = new DeviceMotionClientQt(q);
+#endif
     page = new Page(pageClients);
 
     settings = new QWebSettings(page->settings());
@@ -328,6 +337,11 @@ QWebPagePrivate::~QWebPagePrivate()
 #endif
 }
 
+WebCore::ViewportArguments QWebPagePrivate::viewportArguments()
+{
+    return page ? page->viewportArguments() : WebCore::ViewportArguments();
+}
+
 WebCore::Page* QWebPagePrivate::core(const QWebPage* page)
 {
     return page->d->page;
@@ -602,17 +616,8 @@ void QWebPagePrivate::timerEvent(QTimerEvent *ev)
         q->timerEvent(ev);
 }
 
-void QWebPagePrivate::mouseMoveEvent(QGraphicsSceneMouseEvent* ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    bool accepted = frame->eventHandler()->mouseMoved(PlatformMouseEvent(ev, 0));
-    ev->setAccepted(accepted);
-}
-
-void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
+template<class T>
+void QWebPagePrivate::mouseMoveEvent(T* ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -622,41 +627,8 @@ void QWebPagePrivate::mouseMoveEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 }
 
-void QWebPagePrivate::mousePressEvent(QGraphicsSceneMouseEvent* ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    RefPtr<WebCore::Node> oldNode;
-    Frame* focusedFrame = page->focusController()->focusedFrame();
-    if (Document* focusedDocument = focusedFrame ? focusedFrame->document() : 0)
-        oldNode = focusedDocument->focusedNode();
-
-    if (tripleClickTimer.isActive()
-            && (ev->pos().toPoint() - tripleClick).manhattanLength()
-                < QApplication::startDragDistance()) {
-        mouseTripleClickEvent(ev);
-        return;
-    }
-
-    bool accepted = false;
-    PlatformMouseEvent mev(ev, 1);
-    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
-    if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMousePressEvent(mev);
-    ev->setAccepted(accepted);
-
-    RefPtr<WebCore::Node> newNode;
-    focusedFrame = page->focusController()->focusedFrame();
-    if (Document* focusedDocument = focusedFrame ? focusedFrame->document() : 0)
-        newNode = focusedDocument->focusedNode();
-
-    if (newNode && oldNode != newNode)
-        clickCausedFocus = true;
-}
-
-void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
+template<class T>
+void QWebPagePrivate::mousePressEvent(T* ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -690,24 +662,8 @@ void QWebPagePrivate::mousePressEvent(QMouseEvent *ev)
         clickCausedFocus = true;
 }
 
-void QWebPagePrivate::mouseDoubleClickEvent(QGraphicsSceneMouseEvent *ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    bool accepted = false;
-    PlatformMouseEvent mev(ev, 2);
-    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
-    if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMousePressEvent(mev);
-    ev->setAccepted(accepted);
-
-    tripleClickTimer.start(QApplication::doubleClickInterval(), q);
-    tripleClick = ev->pos().toPoint();
-}
-
-void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
+template<class T>
+void QWebPagePrivate::mouseDoubleClickEvent(T *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -721,24 +677,11 @@ void QWebPagePrivate::mouseDoubleClickEvent(QMouseEvent *ev)
     ev->setAccepted(accepted);
 
     tripleClickTimer.start(QApplication::doubleClickInterval(), q);
-    tripleClick = ev->pos();
-}
-
-void QWebPagePrivate::mouseTripleClickEvent(QGraphicsSceneMouseEvent *ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    bool accepted = false;
-    PlatformMouseEvent mev(ev, 3);
-    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
-    if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMousePressEvent(mev);
-    ev->setAccepted(accepted);
+    tripleClick = QPointF(ev->pos()).toPoint();
 }
 
-void QWebPagePrivate::mouseTripleClickEvent(QMouseEvent *ev)
+template<class T>
+void QWebPagePrivate::mouseTripleClickEvent(T *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -775,7 +718,8 @@ void QWebPagePrivate::handleClipboard(QEvent* ev, Qt::MouseButton button)
 #endif
 }
 
-void QWebPagePrivate::mouseReleaseEvent(QGraphicsSceneMouseEvent* ev)
+template<class T>
+void QWebPagePrivate::mouseReleaseEvent(T *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -812,23 +756,6 @@ void QWebPagePrivate::handleSoftwareInputPanel(Qt::MouseButton button)
     clickCausedFocus = false;
 }
 
-void QWebPagePrivate::mouseReleaseEvent(QMouseEvent *ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    bool accepted = false;
-    PlatformMouseEvent mev(ev, 0);
-    // ignore the event if we can't map Qt's mouse buttons to WebCore::MouseButton
-    if (mev.button() != NoButton)
-        accepted = frame->eventHandler()->handleMouseReleaseEvent(mev);
-    ev->setAccepted(accepted);
-
-    handleClipboard(ev, ev->button());
-    handleSoftwareInputPanel(ev->button());
-}
-
 #ifndef QT_NO_CONTEXTMENU
 void QWebPagePrivate::contextMenuEvent(const QPoint& globalPos)
 {
@@ -859,18 +786,8 @@ QMenu *QWebPage::createStandardContextMenu()
 }
 
 #ifndef QT_NO_WHEELEVENT
-void QWebPagePrivate::wheelEvent(QGraphicsSceneWheelEvent* ev)
-{
-    WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
-    if (!frame->view())
-        return;
-
-    WebCore::PlatformWheelEvent pev(ev);
-    bool accepted = frame->eventHandler()->handleWheelEvent(pev);
-    ev->setAccepted(accepted);
-}
-
-void QWebPagePrivate::wheelEvent(QWheelEvent *ev)
+template<class T>
+void QWebPagePrivate::wheelEvent(T *ev)
 {
     WebCore::Frame* frame = QWebFramePrivate::core(mainFrame);
     if (!frame->view())
@@ -1007,10 +924,11 @@ void QWebPagePrivate::focusOutEvent(QFocusEvent*)
     focusController->setActive(false);
 }
 
-void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
+template<class T>
+void QWebPagePrivate::dragEnterEvent(T* ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+    DragData dragData(ev->mimeData(), QPointF(ev->pos()).toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
     Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
     ev->setDropAction(action);
@@ -1019,29 +937,8 @@ void QWebPagePrivate::dragEnterEvent(QGraphicsSceneDragDropEvent* ev)
 #endif
 }
 
-void QWebPagePrivate::dragEnterEvent(QDragEnterEvent* ev)
-{
-#ifndef QT_NO_DRAGANDDROP
-    DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
-                      dropActionToDragOp(ev->possibleActions()));
-    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragEntered(&dragData));
-    ev->setDropAction(action);
-    // We must accept this event in order to receive the drag move events that are sent
-    // while the drag and drop action is in progress.
-    ev->acceptProposedAction();
-#endif
-}
-
-void QWebPagePrivate::dragLeaveEvent(QGraphicsSceneDragDropEvent* ev)
-{
-#ifndef QT_NO_DRAGANDDROP
-    DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
-    page->dragController()->dragExited(&dragData);
-    ev->accept();
-#endif
-}
-
-void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
+template<class T>
+void QWebPagePrivate::dragLeaveEvent(T *ev)
 {
 #ifndef QT_NO_DRAGANDDROP
     DragData dragData(0, IntPoint(), QCursor::pos(), DragOperationNone);
@@ -1050,10 +947,11 @@ void QWebPagePrivate::dragLeaveEvent(QDragLeaveEvent* ev)
 #endif
 }
 
-void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
+template<class T>
+void QWebPagePrivate::dragMoveEvent(T *ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+    DragData dragData(ev->mimeData(), QPointF(ev->pos()).toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
     Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
     ev->setDropAction(action);
@@ -1062,42 +960,17 @@ void QWebPagePrivate::dragMoveEvent(QGraphicsSceneDragDropEvent* ev)
 #endif
 }
 
-void QWebPagePrivate::dragMoveEvent(QDragMoveEvent* ev)
+template<class T>
+void QWebPagePrivate::dropEvent(T *ev)
 {
 #ifndef QT_NO_DRAGANDDROP
-    DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
-                      dropActionToDragOp(ev->possibleActions()));
-    Qt::DropAction action = dragOpToDropAction(page->dragController()->dragUpdated(&dragData));
-    m_lastDropAction = action;
-    ev->setDropAction(action);
-    // We must accept this event in order to receive the drag move events that are sent
-    // while the drag and drop action is in progress.
-    ev->acceptProposedAction();
-#endif
-}
-
-void QWebPagePrivate::dropEvent(QGraphicsSceneDragDropEvent* ev)
-{
-#ifndef QT_NO_DRAGANDDROP
-    DragData dragData(ev->mimeData(), ev->pos().toPoint(),
+    DragData dragData(ev->mimeData(), QPointF(ev->pos()).toPoint(),
             QCursor::pos(), dropActionToDragOp(ev->possibleActions()));
     if (page->dragController()->performDrag(&dragData))
         ev->acceptProposedAction();
 #endif
 }
 
-void QWebPagePrivate::dropEvent(QDropEvent* ev)
-{
-#ifndef QT_NO_DRAGANDDROP
-    // Overwrite the defaults set by QDragManager::defaultAction()
-    ev->setDropAction(m_lastDropAction);
-    DragData dragData(ev->mimeData(), ev->pos(), QCursor::pos(),
-                      dropActionToDragOp(Qt::DropAction(ev->dropAction())));
-    if (page->dragController()->performDrag(&dragData))
-        ev->acceptProposedAction();
-#endif
-}
-
 void QWebPagePrivate::leaveEvent(QEvent*)
 {
     // Fake a mouse move event just outside of the widget, since all
@@ -1702,15 +1575,15 @@ quint16 QWebPagePrivate::inspectorServerPort()
 
 
 /*!
-    \class QWebPage::ViewportConfiguration
+    \class QWebPage::ViewportAttributes
     \since 4.7
-    \brief The QWebPage::ViewportConfiguration class describes hints that can be applied to a viewport.
+    \brief The QWebPage::ViewportAttributes class describes hints that can be applied to a viewport.
 
-    QWebPage::ViewportConfiguration provides a description of a viewport, such as viewport geometry,
+    QWebPage::ViewportAttributes provides a description of a viewport, such as viewport geometry,
     initial scale factor with limits, plus information about whether a user should be able
     to scale the contents in the viewport or not, ie. by zooming.
 
-    ViewportConfiguration can be set by a web author using the viewport meta tag extension, documented
+    ViewportAttributes can be set by a web author using the viewport meta tag extension, documented
     at \l{http://developer.apple.com/safari/library/documentation/appleapplications/reference/safariwebcontent/usingtheviewport/usingtheviewport.html}{Safari Reference Library: Using the Viewport Meta Tag}.
 
     All values might not be set, as such when dealing with the hints, the developer needs to
@@ -1720,9 +1593,9 @@ quint16 QWebPagePrivate::inspectorServerPort()
 */
 
 /*!
-    Constructs an empty QWebPage::ViewportConfiguration.
+    Constructs an empty QWebPage::ViewportAttributes.
 */
-QWebPage::ViewportConfiguration::ViewportConfiguration()
+QWebPage::ViewportAttributes::ViewportAttributes()
     : d(0)
     , m_initialScaleFactor(-1.0)
     , m_minimumScaleFactor(-1.0)
@@ -1735,9 +1608,9 @@ QWebPage::ViewportConfiguration::ViewportConfiguration()
 }
 
 /*!
-    Constructs a QWebPage::ViewportConfiguration which is a copy from \a other .
+    Constructs a QWebPage::ViewportAttributes which is a copy from \a other .
 */
-QWebPage::ViewportConfiguration::ViewportConfiguration(const QWebPage::ViewportConfiguration& other)
+QWebPage::ViewportAttributes::ViewportAttributes(const QWebPage::ViewportAttributes& other)
     : d(other.d)
     , m_initialScaleFactor(other.m_initialScaleFactor)
     , m_minimumScaleFactor(other.m_minimumScaleFactor)
@@ -1751,18 +1624,18 @@ QWebPage::ViewportConfiguration::ViewportConfiguration(const QWebPage::ViewportC
 }
 
 /*!
-    Destroys the QWebPage::ViewportConfiguration.
+    Destroys the QWebPage::ViewportAttributes.
 */
-QWebPage::ViewportConfiguration::~ViewportConfiguration()
+QWebPage::ViewportAttributes::~ViewportAttributes()
 {
 
 }
 
 /*!
-    Assigns the given QWebPage::ViewportConfiguration to this viewport hints and returns a
+    Assigns the given QWebPage::ViewportAttributes to this viewport hints and returns a
     reference to this.
 */
-QWebPage::ViewportConfiguration& QWebPage::ViewportConfiguration::operator=(const QWebPage::ViewportConfiguration& other)
+QWebPage::ViewportAttributes& QWebPage::ViewportAttributes::operator=(const QWebPage::ViewportAttributes& other)
 {
     if (this != &other) {
         d = other.d;
@@ -1777,30 +1650,30 @@ QWebPage::ViewportConfiguration& QWebPage::ViewportConfiguration::operator=(cons
     return *this;
 }
 
-/*! \fn inline bool QWebPage::ViewportConfiguration::isValid() const
-    Returns whether this is a valid ViewportConfiguration or not.
+/*! \fn inline bool QWebPage::ViewportAttributes::isValid() const
+    Returns whether this is a valid ViewportAttributes or not.
 
-    An invalid ViewportConfiguration will have an empty QSize, negative values for scale factors and
+    An invalid ViewportAttributes will have an empty QSize, negative values for scale factors and
     true for the boolean isUserScalable.
 */
 
-/*! \fn inline QSize QWebPage::ViewportConfiguration::size() const
+/*! \fn inline QSize QWebPage::ViewportAttributes::size() const
     Returns the size of the viewport.
 */
 
-/*! \fn inline qreal QWebPage::ViewportConfiguration::initialScaleFactor() const
+/*! \fn inline qreal QWebPage::ViewportAttributes::initialScaleFactor() const
     Returns the initial scale of the viewport as a multiplier.
 */
 
-/*! \fn inline qreal QWebPage::ViewportConfiguration::minimumScaleFactor() const
+/*! \fn inline qreal QWebPage::ViewportAttributes::minimumScaleFactor() const
     Returns the minimum scale value of the viewport as a multiplier.
 */
 
-/*! \fn inline qreal QWebPage::ViewportConfiguration::maximumScaleFactor() const
+/*! \fn inline qreal QWebPage::ViewportAttributes::maximumScaleFactor() const
     Returns the maximum scale value of the viewport as a multiplier.
 */
 
-/*! \fn inline bool QWebPage::ViewportConfiguration::isUserScalable() const
+/*! \fn inline bool QWebPage::ViewportAttributes::isUserScalable() const
     Determines whether or not the scale can be modified by the user.
 */
 
@@ -2149,6 +2022,63 @@ QObject *QWebPage::createPlugin(const QString &classid, const QUrl &url, const Q
     return 0;
 }
 
+static void extractContentTypeFromHash(const HashSet<String>& types, QStringList* list)
+{
+    if (!list)
+        return;
+
+    HashSet<String>::const_iterator endIt = types.end();
+    for (HashSet<String>::const_iterator it = types.begin(); it != endIt; ++it)
+        *list << *it;
+}
+
+static void extractContentTypeFromPluginVector(const Vector<PluginPackage*>& plugins, QStringList* list)
+{
+    if (!list)
+        return;
+
+    for (unsigned int i = 0; i < plugins.size(); ++i) {
+        MIMEToDescriptionsMap::const_iterator map_it = plugins[i]->mimeToDescriptions().begin();
+        MIMEToDescriptionsMap::const_iterator map_end = plugins[i]->mimeToDescriptions().end();
+        for (; map_it != map_end; ++map_it)
+            *list << map_it->first;
+    }
+}
+
+/*!
+ *  Returns the list of all content types supported by QWebPage.
+ */
+QStringList QWebPage::supportedContentTypes() const
+{
+    QStringList mimeTypes;
+
+    extractContentTypeFromHash(MIMETypeRegistry::getSupportedImageMIMETypes(), &mimeTypes);
+    extractContentTypeFromHash(MIMETypeRegistry::getSupportedNonImageMIMETypes(), &mimeTypes);
+    if (d->page->settings() && d->page->settings()->arePluginsEnabled())
+        extractContentTypeFromPluginVector(PluginDatabase::installedPlugins()->plugins(), &mimeTypes);
+
+    return mimeTypes;
+}
+
+/*!
+ *  Returns true if QWebPage can handle the given \a mimeType; otherwise, returns false.
+ */
+bool QWebPage::supportsContentType(const QString& mimeType) const
+{
+    const String type = mimeType.toLower();
+    if (MIMETypeRegistry::isSupportedImageMIMEType(type))
+        return true;
+
+    if (MIMETypeRegistry::isSupportedNonImageMIMEType(type))
+        return true;
+
+    if (d->page->settings() && d->page->settings()->arePluginsEnabled()
+        && PluginDatabase::installedPlugins()->isMIMETypeRegistered(type))
+        return true;
+
+    return false;
+}
+
 static WebCore::FrameLoadRequest frameLoadRequest(const QUrl &url, WebCore::Frame *frame)
 {
     WebCore::ResourceRequest rr(url, frame->loader()->outgoingReferrer());
@@ -2244,6 +2174,7 @@ void QWebPage::triggerAction(WebAction action, bool)
             break;
         case Stop:
             mainFrame()->d->frame->loader()->stopForUserCancel();
+            d->updateNavigationActions();
             break;
         case Reload:
             mainFrame()->d->frame->loader()->reload(/*endtoendreload*/false);
@@ -2272,12 +2203,12 @@ void QWebPage::triggerAction(WebAction action, bool)
         }
         case StopScheduledPageRefresh: {
             QWebFrame* topFrame = mainFrame();
-            topFrame->d->frame->redirectScheduler()->cancel();
+            topFrame->d->frame->navigationScheduler()->cancel();
             QList<QWebFrame*> childFrames;
             collectChildFrames(topFrame, childFrames);
             QListIterator<QWebFrame*> it(childFrames);
             while (it.hasNext())
-                it.next()->d->frame->redirectScheduler()->cancel();
+                it.next()->d->frame->navigationScheduler()->cancel();
             break;
         }
         default:
@@ -2363,12 +2294,12 @@ static QSize queryDeviceSizeForScreenContainingWidget(const QWidget* widget)
     both needs to be set.
 */
 
-QWebPage::ViewportConfiguration QWebPage::viewportConfigurationForSize(const QSize& availableSize) const
+QWebPage::ViewportAttributes QWebPage::viewportAttributesForSize(const QSize& availableSize) const
 {
     static int desktopWidth = 980;
     static int deviceDPI = 160;
 
-    ViewportConfiguration result;
+    ViewportAttributes result;
 
     int deviceWidth = getintenv("QTWEBKIT_DEVICE_WIDTH");
     int deviceHeight = getintenv("QTWEBKIT_DEVICE_HEIGHT");
@@ -2380,15 +2311,15 @@ QWebPage::ViewportConfiguration QWebPage::viewportConfigurationForSize(const QSi
         deviceHeight = size.height();
     }
 
-    WebCore::ViewportConfiguration conf = WebCore::findConfigurationForViewportData(mainFrame()->d->viewportArguments(),
-            desktopWidth, deviceWidth, deviceHeight, deviceDPI, availableSize);
+    WebCore::ViewportAttributes conf = WebCore::computeViewportAttributes(d->viewportArguments(), desktopWidth, deviceWidth, deviceHeight, deviceDPI, availableSize);
 
     result.m_isValid = true;
-    result.m_size = conf.layoutViewport;
+    result.m_size = conf.layoutSize;
     result.m_initialScaleFactor = conf.initialScale;
     result.m_minimumScaleFactor = conf.minimumScale;
     result.m_maximumScaleFactor = conf.maximumScale;
     result.m_devicePixelRatio = conf.devicePixelRatio;
+    result.m_isUserScalable = conf.userScalable;
 
     return result;
 }
@@ -3777,7 +3708,7 @@ quint64 QWebPage::bytesReceived() const
     Page authors can provide the supplied values by using the viewport meta tag. More information
     about this can be found at \l{http://developer.apple.com/safari/library/documentation/appleapplications/reference/safariwebcontent/usingtheviewport/usingtheviewport.html}{Safari Reference Library: Using the Viewport Meta Tag}.
 
-    \sa QWebPage::ViewportConfiguration, setPreferredContentsSize(), QGraphicsWebView::setScale()
+    \sa QWebPage::ViewportAttributes, setPreferredContentsSize(), QGraphicsWebView::setScale()
 */
 
 /*!
diff --git a/WebKit/qt/Api/qwebpage.h b/WebKit/qt/Api/qwebpage.h
index e71e3da..15d2432 100644
--- a/WebKit/qt/Api/qwebpage.h
+++ b/WebKit/qt/Api/qwebpage.h
@@ -48,7 +48,7 @@ class QWebHitTestResult;
 class QWebNetworkInterface;
 class QWebPagePrivate;
 class QWebPluginFactory;
-class QtViewportConfigurationPrivate;
+class QtViewportAttributesPrivate;
 
 namespace WebCore {
     class ChromeClientQt;
@@ -208,14 +208,14 @@ public:
         GeolocationPermissionDomain
     };
 
-    class ViewportConfiguration {
+    class QWEBKIT_EXPORT ViewportAttributes {
     public:
-        ViewportConfiguration();
-        ViewportConfiguration(const QWebPage::ViewportConfiguration& other);
+        ViewportAttributes();
+        ViewportAttributes(const QWebPage::ViewportAttributes& other);
 
-        ~ViewportConfiguration();
+        ~ViewportAttributes();
 
-        QWebPage::ViewportConfiguration& operator=(const QWebPage::ViewportConfiguration& other);
+        QWebPage::ViewportAttributes& operator=(const QWebPage::ViewportAttributes& other);
 
         inline qreal initialScaleFactor() const { return m_initialScaleFactor; }
         inline qreal minimumScaleFactor() const { return m_minimumScaleFactor; }
@@ -226,7 +226,7 @@ public:
         inline QSize size() const { return m_size; }
 
     private:
-        QSharedDataPointer<QtViewportConfigurationPrivate> d;
+        QSharedDataPointer<QtViewportAttributesPrivate> d;
         qreal m_initialScaleFactor;
         qreal m_minimumScaleFactor;
         qreal m_maximumScaleFactor;
@@ -276,7 +276,7 @@ public:
 
     QSize viewportSize() const;
     void setViewportSize(const QSize &size) const;
-    ViewportConfiguration viewportConfigurationForSize(const QSize& availableSize) const;
+    ViewportAttributes viewportAttributesForSize(const QSize& availableSize) const;
 
     QSize preferredContentsSize() const;
     void setPreferredContentsSize(const QSize &size) const;
@@ -309,6 +309,9 @@ public:
 
     void setUserPermission(QWebFrame* frame, PermissionDomain domain, PermissionPolicy policy);
 
+    QStringList supportedContentTypes() const;
+    bool supportsContentType(const QString& mimeType) const;
+
     enum Extension {
         ChooseMultipleFilesExtension,
         ErrorPageExtension
diff --git a/WebKit/qt/Api/qwebpage_p.h b/WebKit/qt/Api/qwebpage_p.h
index 12716f9..1f70293 100644
--- a/WebKit/qt/Api/qwebpage_p.h
+++ b/WebKit/qt/Api/qwebpage_p.h
@@ -36,6 +36,8 @@
 
 #include <wtf/RefPtr.h>
 
+#include "ViewportArguments.h"
+
 namespace WebCore {
     class ChromeClientQt;
     class ContextMenuClientQt;
@@ -58,13 +60,13 @@ QT_END_NAMESPACE
 class QWebInspector;
 class QWebPageClient;
 
-class QtViewportConfigurationPrivate : public QSharedData {
+class QtViewportAttributesPrivate : public QSharedData {
 public:
-    QtViewportConfigurationPrivate(QWebPage::ViewportConfiguration* qq)
+    QtViewportAttributesPrivate(QWebPage::ViewportAttributes* qq)
         : q(qq)
     { }
 
-    QWebPage::ViewportConfiguration* q;
+    QWebPage::ViewportAttributes* q;
 };
 
 class QWebPagePrivate {
@@ -88,36 +90,26 @@ public:
 
     void timerEvent(QTimerEvent*);
 
-    void mouseMoveEvent(QMouseEvent*);
-    void mouseMoveEvent(QGraphicsSceneMouseEvent*);
-    void mousePressEvent(QMouseEvent*);
-    void mousePressEvent(QGraphicsSceneMouseEvent*);
-    void mouseDoubleClickEvent(QMouseEvent*);
-    void mouseDoubleClickEvent(QGraphicsSceneMouseEvent*);
-    void mouseTripleClickEvent(QMouseEvent*);
-    void mouseTripleClickEvent(QGraphicsSceneMouseEvent*);
-    void mouseReleaseEvent(QMouseEvent*);
-    void mouseReleaseEvent(QGraphicsSceneMouseEvent*);
+    template<class T> void mouseMoveEvent(T*);
+    template<class T> void mousePressEvent(T*);
+    template<class T> void mouseDoubleClickEvent(T*);
+    template<class T> void mouseTripleClickEvent(T*);
+    template<class T> void mouseReleaseEvent(T*);
 #ifndef QT_NO_CONTEXTMENU
     void contextMenuEvent(const QPoint& globalPos);
 #endif
 #ifndef QT_NO_WHEELEVENT
-    void wheelEvent(QWheelEvent*);
-    void wheelEvent(QGraphicsSceneWheelEvent*);
+    template<class T> void wheelEvent(T*);
 #endif
     void keyPressEvent(QKeyEvent*);
     void keyReleaseEvent(QKeyEvent*);
     void focusInEvent(QFocusEvent*);
     void focusOutEvent(QFocusEvent*);
 
-    void dragEnterEvent(QDragEnterEvent*);
-    void dragEnterEvent(QGraphicsSceneDragDropEvent*);
-    void dragLeaveEvent(QDragLeaveEvent*);
-    void dragLeaveEvent(QGraphicsSceneDragDropEvent*);
-    void dragMoveEvent(QDragMoveEvent*);
-    void dragMoveEvent(QGraphicsSceneDragDropEvent*);
-    void dropEvent(QDropEvent*);
-    void dropEvent(QGraphicsSceneDragDropEvent*);
+    template<class T> void dragEnterEvent(T*);
+    template<class T> void dragLeaveEvent(T*);
+    template<class T> void dragMoveEvent(T*);
+    template<class T> void dropEvent(T*);
 
     void inputMethodEvent(QInputMethodEvent*);
 
@@ -139,6 +131,8 @@ public:
     WebCore::InspectorController* inspectorController();
     quint16 inspectorServerPort();
 
+    WebCore::ViewportArguments viewportArguments();
+
 #ifndef QT_NO_SHORTCUT
     static QWebPage::WebAction editorActionForKeyEvent(QKeyEvent* event);
 #endif
diff --git a/WebKit/qt/Api/qwebsettings.cpp b/WebKit/qt/Api/qwebsettings.cpp
index 6b36522..3cd36f2 100644
--- a/WebKit/qt/Api/qwebsettings.cpp
+++ b/WebKit/qt/Api/qwebsettings.cpp
@@ -184,6 +184,10 @@ void QWebSettingsPrivate::apply()
                                       global->attributes.value(QWebSettings::JavascriptCanOpenWindows));
         settings->setJavaScriptCanOpenWindowsAutomatically(value);
 
+        value = attributes.value(QWebSettings::JavascriptCanCloseWindows,
+                                      global->attributes.value(QWebSettings::JavascriptCanCloseWindows));
+        settings->setAllowScriptsToCloseWindows(value);
+
         value = attributes.value(QWebSettings::JavaEnabled,
                                       global->attributes.value(QWebSettings::JavaEnabled));
         settings->setJavaEnabled(value);
@@ -389,6 +393,8 @@ QWebSettings* QWebSettings::globalSettings()
         recording visited pages in the history and storing web page icons. This is disabled by default.
     \value JavascriptCanOpenWindows Specifies whether JavaScript programs
         can open new windows. This is disabled by default.
+    \value JavascriptCanCloseWindows Specifies whether JavaScript programs
+        can close windows. This is disabled by default.
     \value JavascriptCanAccessClipboard Specifies whether JavaScript programs
         can read or write to the clipboard. This is disabled by default.
     \value DeveloperExtrasEnabled Enables extra tools for Web developers.
@@ -1076,12 +1082,12 @@ QString QWebSettings::localStoragePath() const
 */
 void QWebSettings::enablePersistentStorage(const QString& path)
 {
+#ifndef QT_NO_DESKTOPSERVICES
     QString storagePath;
 
     if (path.isEmpty()) {
-#ifndef QT_NO_DESKTOPSERVICES
+
         storagePath = QDesktopServices::storageLocation(QDesktopServices::DataLocation);
-#endif
         if (storagePath.isEmpty())
             storagePath = WebCore::pathByAppendingComponent(QDir::homePath(), QCoreApplication::applicationName());
     } else
@@ -1098,12 +1104,18 @@ void QWebSettings::enablePersistentStorage(const QString& path)
     QWebSettings::globalSettings()->setAttribute(QWebSettings::OfflineWebApplicationCacheEnabled, true);
 
 #if ENABLE(NETSCAPE_PLUGIN_METADATA_CACHE)
-    QFileInfo info(storagePath);
+    // All applications can share the common QtWebkit cache file(s).
+    // Path is not configurable and uses QDesktopServices::CacheLocation by default.
+    QString cachePath = QDesktopServices::storageLocation(QDesktopServices::CacheLocation);
+    WebCore::makeAllDirectories(cachePath);
+
+    QFileInfo info(cachePath);
     if (info.isDir() && info.isWritable()) {
         WebCore::PluginDatabase::setPersistentMetadataCacheEnabled(true);
-        WebCore::PluginDatabase::setPersistentMetadataCachePath(storagePath);
+        WebCore::PluginDatabase::setPersistentMetadataCachePath(cachePath);
     }
 #endif
+#endif
 }
 
 /*!
diff --git a/WebKit/qt/Api/qwebsettings.h b/WebKit/qt/Api/qwebsettings.h
index d5e0ef6..7dad72f 100644
--- a/WebKit/qt/Api/qwebsettings.h
+++ b/WebKit/qt/Api/qwebsettings.h
@@ -76,7 +76,8 @@ public:
         FrameFlatteningEnabled,
         SiteSpecificQuirksEnabled,
         WebGLEnabled,
-        HyperlinkAuditingEnabled
+        HyperlinkAuditingEnabled,
+        JavascriptCanCloseWindows
     };
     enum WebGraphic {
         MissingImageGraphic,
diff --git a/WebKit/qt/ChangeLog b/WebKit/qt/ChangeLog
index 7a2c064..c1bf664 100644
--- a/WebKit/qt/ChangeLog
+++ b/WebKit/qt/ChangeLog
@@ -1,3 +1,584 @@
+2010-10-20  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Wrong null check in PopupMenuQt
+        https://bugs.webkit.org/show_bug.cgi?id=47945
+
+        Wrong null check in PopupMenuQt.
+
+        * WebCoreSupport/PopupMenuQt.cpp:
+        (WebCore::PopupMenuQt::hide):
+
+2010-10-18  Viatcheslav Ostapenko  <ostapenko.viatcheslav@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Export QWebPage::ViewportAttributes class.
+        https://bugs.webkit.org/show_bug.cgi?id=47845
+
+        * Api/qwebpage.h:
+        * symbian/eabi/QtWebKitu.def:
+
+2010-10-18  Pavel Feldman  <pfeldman@chromium.org>
+
+        Reviewed by Simon Fraser.
+
+        Web Inspector: [crash] when Inspector Open in CSSStyleSelector::loadPendingImages().
+        https://bugs.webkit.org/show_bug.cgi?id=46224
+
+        * WebCoreSupport/InspectorClientQt.cpp:
+        (WebCore::InspectorClientQt::sendMessageToFrontend):
+
+2010-10-18  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] AC rendering bugs
+
+        This fixes a regression that was introduced by making scrolling in accelerated compositing automatic,
+        which made our explicit function to scroll the compositing layers superfluous, making the scrolling behavior
+        when graphics layers are present incorrect. The fix simply removes those redundant functions.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47571
+
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::PageClientQGraphicsWidget::scroll):
+        (WebCore::PageClientQGraphicsWidget::update):
+        (WebCore::PageClientQGraphicsWidget::setRootGraphicsLayer):
+        * WebCoreSupport/PageClientQt.h:
+
+2010-10-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by nobody, build fix.
+
+        [Qt] Fix the build with MSVC.
+
+        Splitting the condition in two to prevent qmake parentheses issues.
+
+        * Api/DerivedSources.pro:
+
+2010-10-18  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [QT] Unable to load pages on QtTestBrowser after canceling a page load. 
+        https://bugs.webkit.org/show_bug.cgi?id=43827
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2010-10-15  Qi Zhang  <qi.2.zhang@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] window.close() doesn't work in qt
+        https://bugs.webkit.org/show_bug.cgi?id=46186
+
+        Introduce new attribute in QWebSettings to trigger "setAllowScriptsToCloseWindow"
+
+        * Api/qwebsettings.cpp:
+        (QWebSettingsPrivate::apply):
+        * Api/qwebsettings.h:
+
+2010-10-15  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Unbreak scrolling the ContentsLayer with QWebView
+
+        r69777 broke scrolling the contents layer in QWebView by not restoring
+        the painter clip after painting each part of the dirty region.
+
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderRelativeCoords):
+
+2010-09-27 Dawit Alemayehu  <adawit@kde.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Added functions for obtaining and checking the supported content types.
+        http://webkit.org/b/37880
+
+        * Api/qwebpage.cpp:
+        (extractContentTypeFromHash):
+        (extractContentTypeFromPluginVector):
+        (QWebPage::supportedContentTypes):
+        (QWebPage::supportsContentType):
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::supportedContentType):
+
+2010-10-14  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69795.
+        http://trac.webkit.org/changeset/69795
+        https://bugs.webkit.org/show_bug.cgi?id=47687
+
+        'See discussion at webkit.org/b/47609' (Requested by mwenge on
+        #webkit).
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::canHandleRequest):
+        (WebCore::FrameLoaderClientQt::dispatchUnableToImplementPolicy):
+
+2010-10-14  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix http/tests/misc/redirect-to-external-url.html
+
+        Support the test in FrameLoaderClientQt and unskip.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47609
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::canHandleRequest):
+        (WebCore::FrameLoaderClientQt::dispatchUnableToImplementPolicy):
+
+2010-10-14  No'am Rosenthal  <noam.rosenthal@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Texmap] [Qt] Texture mapper initial implementation
+        https://bugs.webkit.org/show_bug.cgi?id=47070
+
+        Allow rendering of accelerated-compositing with TextureMapper, inside a QWebFrame. The frame will render the regular content,
+        either normally or through tiled backingstore, then let the TextureMapper layer render itself to the active context, and
+        then render the scrollbar and pan icon. This is different from the current implementation, which uses additional QGraphicsItems for AC
+        and the scrollbar overlay.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebView::paint):
+        * Api/qwebframe.cpp:
+        (QWebFramePrivate::renderFromTiledBackingStore):
+        (QWebFramePrivate::renderRelativeCoords):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+
+2010-10-13  Dinu Jacob  <dinu.jacob@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Update .def file for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=47540
+
+        Updated symbols for Symbian - added viewportAttributesForSize and
+        made viewportConfigurationForSize absent based on the API change in
+        47325
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-10-12  David Leong  <david.leong@nokia.com>
+
+        Reviewed by Laszlo Gombos.
+
+        [Qt] Enable Netscape plugin metadata caching on Linux 
+        https://bugs.webkit.org/show_bug.cgi?id=46287
+        
+        QWebSettings::enablePersistentStorage will now store the netscape
+        plugin cache to QDesktopServices::CacheLocation.
+        
+        * Api/qwebsettings.cpp:
+        (QWebSettings::enablePersistentStorage):
+
+2010-10-12  Yael Aharon  <yael.aharon@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Editing commands should not be executed on non-editable content.
+        https://bugs.webkit.org/show_bug.cgi?id=47426
+
+        Remove calls to editor()->command() when we are not in editable content.
+        There is no value in doing that, and in some cases, it prevents scrolling.
+
+        * WebCoreSupport/EditorClientQt.cpp:
+        (WebCore::EditorClientQt::handleKeyboardEvent):
+
+2010-10-08  Hui Huang  <hui.2.huang@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        ifdef out code that rewrites Flash Plug-in wmode for Symbian build
+        https://bugs.webkit.org/show_bug.cgi?id=43484
+
+        * WebCoreSupport/FrameLoaderClientQt.cpp:
+        (WebCore::FrameLoaderClientQt::createPlugin):
+
+2010-10-07  Andreas Kling  <kling@webkit.org>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] API: ViewportConfiguration => ViewportArguments
+        https://bugs.webkit.org/show_bug.cgi?id=47325
+
+        * Api/qwebpage.cpp:
+        (QWebPage::ViewportAttributes::ViewportAttributes):
+        (QWebPage::ViewportAttributes::~ViewportAttributes):
+        (QWebPage::ViewportAttributes::operator=):
+        (QWebPage::viewportAttributesForSize):
+        * Api/qwebpage.h:
+        * Api/qwebpage_p.h:
+        (QtViewportAttributesPrivate::QtViewportAttributesPrivate):
+
+2010-10-07  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Fixing viewport meta tag user-scalable handling
+        https://bugs.webkit.org/show_bug.cgi?id=47330
+
+        user-scalable attribute was not considered in viewport meta tag handling.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportConfigurationForSize):
+
+2010-10-05  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Hook up accelerometer data via Qt DeviceMotion
+        https://bugs.webkit.org/show_bug.cgi?id=47105
+
+        Get accelerometer necessary data via Qt mobility library using a
+        provider class. Enable, also the RotationRate using the current device
+        orientation provider.
+
+        * WebCoreSupport/DeviceMotionClientQt.cpp:
+        (WebCore::DeviceMotionClientQt::DeviceMotionClientQt):
+        (WebCore::DeviceMotionClientQt::~DeviceMotionClientQt):
+        (WebCore::DeviceMotionClientQt::startUpdating):
+        (WebCore::DeviceMotionClientQt::stopUpdating):
+        (WebCore::DeviceMotionClientQt::currentDeviceMotion):
+        (WebCore::DeviceMotionClientQt::changeDeviceMotion):
+        * WebCoreSupport/DeviceMotionClientQt.h:
+        * WebCoreSupport/DeviceMotionProviderQt.cpp: Added.
+        (WebCore::DeviceMotionProviderQt::DeviceMotionProviderQt):
+        (WebCore::DeviceMotionProviderQt::~DeviceMotionProviderQt):
+        (WebCore::DeviceMotionProviderQt::start):
+        (WebCore::DeviceMotionProviderQt::stop):
+        (WebCore::DeviceMotionProviderQt::filter):
+        * WebCoreSupport/DeviceMotionProviderQt.h: Added.
+        (WebCore::DeviceMotionProviderQt::currentDeviceMotion):
+
+2010-10-07  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Some viewport meta tag api refactoring
+        https://bugs.webkit.org/show_bug.cgi?id=47334
+
+        WebCore::findConfigurationForViewportData renamed to computeViewportAttributes.
+        WebCore::ViewportAttributes::layoutViewport renamed to layoutSize.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportConfigurationForSize):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::viewportAsText):
+
+2010-10-07  Keith Kyzivat  <keith.kyzivat@nokia.com>
+
+        Reviewed by Simon Hausmann.
+
+        [Qt] Update .def file for Symbian
+        https://bugs.webkit.org/show_bug.cgi?id=47336
+        Fix and re-freeze symbols for symbian - viewportConfigurationForSize
+        API changed, allowGeolocationRequest removed from API, several
+        DumpRenderTree support calls added.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-10-06  Ragner Magalhaes  <ragner.magalhaes@openbossa.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Duplicated code in QWebPagePrivate
+        https://bugs.webkit.org/show_bug.cgi?id=47195
+
+        Remove duplicated code from QWebPagePrivate class for QGraphicsView and QWidget's mouse events.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::mouseMoveEvent):
+        (QWebPagePrivate::mousePressEvent):
+        (QWebPagePrivate::mouseDoubleClickEvent):
+        (QWebPagePrivate::mouseTripleClickEvent):
+        (QWebPagePrivate::mouseReleaseEvent):
+        (QWebPagePrivate::wheelEvent):
+        (QWebPagePrivate::dragEnterEvent):
+        (QWebPagePrivate::dragLeaveEvent):
+        (QWebPagePrivate::dragMoveEvent):
+        (QWebPagePrivate::dropEvent):
+        * Api/qwebpage_p.h:
+
+2010-10-06  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Renaming WebCore::ViewportConfiguration to WebCore::ViewportAttributes
+        https://bugs.webkit.org/show_bug.cgi?id=47268
+
+        Renaming WebCore::ViewportConfiguration to WebCore::ViewportAttributes
+
+        * Api/qwebpage.cpp:
+        (QWebPage::viewportConfigurationForSize):
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::viewportAsText):
+
+2010-10-05  Andrew Wilson  <atwilson@chromium.org>
+
+        Reviewed by Andreas Kling.
+
+        Notification onclick() events don't act like user gestures
+        https://bugs.webkit.org/show_bug.cgi?id=47137
+
+        * WebCoreSupport/NotificationPresenterClientQt.cpp:
+        (WebCore::NotificationPresenterClientQt::notificationClicked):
+        Use UserGestureIndicator to make sure click events are treated like user gestures.
+
+2010-10-05  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix url conversion in QWebHistory
+
+        Converting from KURL to WFT::String to QUrl does not
+        permit proper percent encoding later.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47048
+
+        * Api/qwebhistory.cpp:
+        (QWebHistoryItem::originalUrl):
+        (QWebHistoryItem::url):
+
+2010-10-05  Jakob Petsovits  <jpetsovits@rim.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Make build work with QT_NO_CURSOR
+        https://bugs.webkit.org/show_bug.cgi?id=46097
+
+        Add a missing semicolon.
+
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::setCursor):
+
+2010-10-05  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Unreviewed build fix.
+
+        [Symbian] Fix build issue due to gaps in ordinals in the def file
+
+        Restore previously removed symbols and mark them absent instead. We must
+        not remove symbols from this file, because it breaks binary compatibility
+        (when re-assigning the ordinals of the following symbols) or it causes build
+        breakage when instead having a gap in the ordinal sequence. Instead removing
+        a symbol is done by marking it as absent.
+
+        * symbian/eabi/QtWebKitu.def:
+
+2010-10-04  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Darin Adler.
+
+        Rename RedirectScheduler to NavigationScheduler
+        https://bugs.webkit.org/show_bug.cgi?id=47037
+
+        Update for name change.
+
+        * Api/qwebpage.cpp:
+        (QWebPage::triggerAction):
+
+2010-10-04  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Hook up DeviceOrientation data for Qt support
+        https://bugs.webkit.org/show_bug.cgi?id=47052
+
+        Get DeviceOrientation necessary data via Qt mobility library
+        using a provider class.
+
+        * WebCoreSupport/DeviceOrientationClientQt.cpp:
+        (WebCore::DeviceOrientationClientQt::DeviceOrientationClientQt):
+        (WebCore::DeviceOrientationClientQt::~DeviceOrientationClientQt):
+        (WebCore::DeviceOrientationClientQt::startUpdating):
+        (WebCore::DeviceOrientationClientQt::stopUpdating):
+        (WebCore::DeviceOrientationClientQt::lastOrientation):
+        (WebCore::DeviceOrientationClientQt::changeDeviceOrientation):
+        * WebCoreSupport/DeviceOrientationClientQt.h:
+        * WebCoreSupport/DeviceOrientationProviderQt.cpp: Added.
+        (WebCore::DeviceOrientationProviderQt::DeviceOrientationProviderQt):
+        (WebCore::DeviceOrientationProviderQt::~DeviceOrientationProviderQt):
+        (WebCore::DeviceOrientationProviderQt::start):
+        (WebCore::DeviceOrientationProviderQt::stop):
+        (WebCore::DeviceOrientationProviderQt::filter):
+        * WebCoreSupport/DeviceOrientationProviderQt.h: Added.
+        (WebCore::DeviceOrientationProviderQt::isActive):
+        (WebCore::DeviceOrientationProviderQt::orientation):
+        (WebCore::DeviceOrientationProviderQt::hasAlpha):
+
+2010-09-28  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Viewport data change notifications
+        https://bugs.webkit.org/show_bug.cgi?id=46755
+
+        Regarding viewport meta tags, what matters for browser developers is to know when the viewport data has
+        changed and its current value. Viewport data belongs to the document, but it is useful to keep the current
+        viewport data in Page as a reference, to be able to send notifications only when the current viewport
+        has changed.
+
+        * Api/qwebframe.cpp:
+        * Api/qwebframe_p.h:
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::viewportArguments):
+        (QWebPage::viewportConfigurationForSize):
+        * Api/qwebpage_p.h:
+        * WebCoreSupport/ChromeClientQt.cpp:
+        (WebCore::ChromeClientQt::viewportDataChanged):
+        * WebCoreSupport/ChromeClientQt.h:
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::viewportAsText):
+
+2010-10-04  Simon Hausmann  <simon.hausmann@nokia.com>
+
+        Rubber-stamped by Tor Arne Vestbø.
+
+        [Qt] Fix platform plugin support after r68128
+
+        Replaced the qobject_cast from the QObject derived extension to a
+        static_cast. qobject_cast works by comparing pointers to meta-object
+        instances, of which there are two each: one compiled into WebKit and
+        one compiled into the plugin.
+
+        The platform plugin ensures the validity of the interface contract
+        through its version and the initial safe qobject_cast from QObject
+        to QWebKitPlatformPlugin. After that it is safe to use static_cast,
+        and with the recent changes even required.
+
+        * WebCoreSupport/QtPlatformPlugin.cpp:
+        (WebCore::QtPlatformPlugin::createSelectInputMethod):
+        (WebCore::QtPlatformPlugin::createNotificationPresenter):
+        (WebCore::QtPlatformPlugin::createHapticFeedbackPlayer):
+
+2010-10-02  Diego Gonzalez  <diegohcg@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Provide Qt support for DeviceMotion/Orientation clients
+        https://bugs.webkit.org/show_bug.cgi?id=47051
+
+        Dummy implementation of DeviceMotion/Orientation client classes
+        to make possible to hook up motion/orientation data
+        in further implementations.
+
+        * Api/qwebpage.cpp:
+        (QWebPagePrivate::QWebPagePrivate):
+        * WebCoreSupport/DeviceMotionClientQt.cpp: Added.
+        (WebCore::DeviceMotionClientQt::DeviceMotionClientQt):
+        (WebCore::DeviceMotionClientQt::setController):
+        (WebCore::DeviceMotionClientQt::startUpdating):
+        (WebCore::DeviceMotionClientQt::stopUpdating):
+        (WebCore::DeviceMotionClientQt::currentDeviceMotion):
+        (WebCore::DeviceMotionClientQt::deviceMotionControllerDestroyed):
+        * WebCoreSupport/DeviceMotionClientQt.h: Added.
+        (WebCore::DeviceMotionClientQt::~DeviceMotionClientQt):
+        * WebCoreSupport/DeviceOrientationClientQt.cpp: Added.
+        (WebCore::DeviceOrientationClientQt::DeviceOrientationClientQt):
+        (WebCore::DeviceOrientationClientQt::setController):
+        (WebCore::DeviceOrientationClientQt::startUpdating):
+        (WebCore::DeviceOrientationClientQt::stopUpdating):
+        (WebCore::DeviceOrientationClientQt::lastOrientation):
+        (WebCore::DeviceOrientationClientQt::deviceOrientationControllerDestroyed):
+        * WebCoreSupport/DeviceOrientationClientQt.h: Added.
+        (WebCore::DeviceOrientationClientQt::~DeviceOrientationClientQt):
+
+2010-09-30  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Support for PlainTextController
+
+        Unskip editing/text-iterator/basic-iteration.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=38805
+
+        * WebCoreSupport/DumpRenderTreeSupportQt.cpp:
+        (DumpRenderTreeSupportQt::plainText):
+        * WebCoreSupport/DumpRenderTreeSupportQt.h:
+
+2010-09-30  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Tor Arne Vestbø.
+
+        [Qt] V8 port: Unbreak build
+
+        Add missing <wtf/text/CString.h> include.
+
+        * WebCoreSupport/InspectorServerQt.cpp:
+
+2010-09-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Crash if an scene with accelerated compositing layout during the paint event
+        https://bugs.webkit.org/show_bug.cgi?id=46812
+
+        Delay the deletion of the overlay after the current event is processed.
+
+        Removing the overlay can sometimes be done inside the rendering code of
+        the overlay itself. When the rendering code is using the reference after
+        the deletion of the overlay, WebKit crashes.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::overlay):
+        * WebCoreSupport/PageClientQt.cpp:
+        (WebCore::PageClientQGraphicsWidget::~PageClientQGraphicsWidget):
+        (WebCore::PageClientQGraphicsWidget::createOrDeleteOverlay):
+        * WebCoreSupport/PageClientQt.h:
+        (WebCore::PageClientQGraphicsWidget::PageClientQGraphicsWidget):
+
+2010-09-30  Benjamin Poulain  <benjamin.poulain@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix tst_QWebPage::geolocationRequestJS()
+        https://bugs.webkit.org/show_bug.cgi?id=46814
+
+        Disable the test. This test cannot pass with a
+        standard build of WebKit, it is disabled until the API is finilized.
+
+        * tests/qwebpage/tst_qwebpage.cpp:
+        (tst_QWebPage::geolocationRequestJS):
+
+2010-09-29  Andreas Kling  <andreas.kling@nokia.com>
+
+        Reviewed by Ariya Hidayat.
+
+        [Qt] Don't keep local reference to QGraphicsItemOverlay in QGWVPrivate
+        https://bugs.webkit.org/show_bug.cgi?id=46812
+
+        Get the QGraphicsItemOverlay* via the QWebPageClient (d->page->d->client)
+        instead of keeping a local pointer to it.
+
+        This is cleanup for a follow-up patch.
+
+        * Api/qgraphicswebview.cpp:
+        (QGraphicsWebViewPrivate::overlay):
+        (QGraphicsWebView::paint):
+        (QGraphicsWebView::setPage):
+        (QGraphicsWebView::updateGeometry):
+        (QGraphicsWebView::setGeometry):
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
@@ -216,7 +797,6 @@
         (QWebSettings::QWebSettings):
         * Api/qwebsettings.h:
 
-
 2010-09-23  Tor Arne Vestbø  <tor.arne.vestbo@nokia.com>
 
         Reviewed by Simon Hausmann.
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
index 9fbc5e5..3bcc8f8 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.cpp
@@ -566,7 +566,7 @@ void ChromeClientQt::setCursor(const Cursor& cursor)
         return;
     pageClient->setCursor(*cursor.platformCursor());
 #else
-    UNUSED_PARAM(cursor)
+    UNUSED_PARAM(cursor);
 #endif
 }
 
@@ -642,7 +642,7 @@ QWebSelectMethod* ChromeClientQt::createSelectPopup() const
 #endif
 }
 
-void ChromeClientQt::didReceiveViewportArguments(Frame* frame, const ViewportArguments& arguments) const
+void ChromeClientQt::dispatchViewportDataDidChange(const ViewportArguments&) const
 {
     emit m_webPage->viewportChangeRequested();
 }
diff --git a/WebKit/qt/WebCoreSupport/ChromeClientQt.h b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
index 56801aa..0a449f6 100644
--- a/WebKit/qt/WebCoreSupport/ChromeClientQt.h
+++ b/WebKit/qt/WebCoreSupport/ChromeClientQt.h
@@ -177,7 +177,7 @@ namespace WebCore {
 
         QWebSelectMethod* createSelectPopup() const;
 
-        virtual void didReceiveViewportArguments(Frame*, const ViewportArguments&) const;
+        virtual void dispatchViewportDataDidChange(const ViewportArguments&) const;
 
         QWebPage* m_webPage;
         WebCore::KURL lastHoverURL;
diff --git a/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.cpp b/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.cpp
new file mode 100644
index 0000000..4761514
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "DeviceMotionClientQt.h"
+
+#include "DeviceMotionController.h"
+#include "DeviceMotionProviderQt.h"
+
+#include "qwebpage.h"
+
+namespace WebCore {
+
+DeviceMotionClientQt::DeviceMotionClientQt(QWebPage* page)
+    : m_page(page)
+    , m_controller(0)
+    , m_provider(new DeviceMotionProviderQt())
+{
+
+    connect(m_provider, SIGNAL(deviceMotionChanged()), SLOT(changeDeviceMotion()));
+}
+
+DeviceMotionClientQt::~DeviceMotionClientQt()
+{
+    disconnect();
+    delete m_provider;
+}
+
+void DeviceMotionClientQt::setController(DeviceMotionController* controller)
+{
+    m_controller = controller;
+}
+
+void DeviceMotionClientQt::startUpdating()
+{
+    m_provider->start();
+}
+
+void DeviceMotionClientQt::stopUpdating()
+{
+    m_provider->stop();
+}
+
+DeviceMotionData* DeviceMotionClientQt::currentDeviceMotion() const
+{
+    return m_provider->currentDeviceMotion();
+}
+
+void DeviceMotionClientQt::deviceMotionControllerDestroyed()
+{
+    delete this;
+}
+
+void DeviceMotionClientQt::changeDeviceMotion()
+{
+    if (!m_controller)
+        return;
+
+    m_controller->didChangeDeviceMotion(currentDeviceMotion());
+}
+
+} // namespace WebCore
+
+#include "moc_DeviceMotionClientQt.cpp"
diff --git a/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.h b/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.h
new file mode 100644
index 0000000..ea843e2
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceMotionClientQt.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef DeviceMotionClientQt_h
+#define DeviceMotionClientQt_h
+
+#include "DeviceMotionClient.h"
+#include "DeviceMotionData.h"
+
+#include <QObject>
+
+class QWebPage;
+
+namespace WebCore {
+
+class DeviceMotionProviderQt;
+
+class DeviceMotionClientQt : public QObject, public DeviceMotionClient {
+    Q_OBJECT
+public:
+    DeviceMotionClientQt(QWebPage*);
+    virtual ~DeviceMotionClientQt();
+
+    virtual void setController(DeviceMotionController*);
+    virtual void startUpdating();
+    virtual void stopUpdating();
+    virtual DeviceMotionData* currentDeviceMotion() const;
+    virtual void deviceMotionControllerDestroyed();
+
+public Q_SLOTS:
+    void changeDeviceMotion();
+
+private:
+    QWebPage* m_page;
+    DeviceMotionController* m_controller;
+    DeviceMotionProviderQt* m_provider;
+};
+
+} // namespece WebCore
+
+#endif // DeviceMotionClientQt_h
diff --git a/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.cpp b/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.cpp
new file mode 100644
index 0000000..ccf7697
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.cpp
@@ -0,0 +1,75 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "DeviceMotionProviderQt.h"
+
+#include "DeviceOrientationProviderQt.h"
+
+namespace WebCore {
+
+DeviceMotionProviderQt::DeviceMotionProviderQt()
+{
+    m_acceleration.addFilter(this);
+    m_motion = DeviceMotionData::create();
+    m_deviceOrientation = new DeviceOrientationProviderQt();
+}
+
+DeviceMotionProviderQt::~DeviceMotionProviderQt()
+{
+    delete m_deviceOrientation;
+}
+
+void DeviceMotionProviderQt::start()
+{
+    m_acceleration.start();
+    m_deviceOrientation->start();
+}
+
+void DeviceMotionProviderQt::stop()
+{
+    m_acceleration.stop();
+    m_deviceOrientation->stop();
+}
+
+bool DeviceMotionProviderQt::filter(QAccelerometerReading* reading)
+{
+    RefPtr<DeviceMotionData::Acceleration> accel = DeviceMotionData::Acceleration::create(
+            /* x available */ true, reading->x(),
+            /* y available */ true, reading->y(),
+            /* z available */ true, reading->z());
+
+    RefPtr<DeviceMotionData::RotationRate> rotation = DeviceMotionData::RotationRate::create(
+            m_deviceOrientation->hasAlpha(), m_deviceOrientation->orientation()->alpha(),
+            /* beta available */ true, m_deviceOrientation->orientation()->beta(),
+            /* gamma available */ true, m_deviceOrientation->orientation()->gamma());
+
+    m_motion = DeviceMotionData::create(accel,
+            accel, /* FIXME: Needs to provide acceleration include gravity. */
+            rotation,
+            false, 0 /* The interval is treated internally by Qt mobility */);
+
+    emit deviceMotionChanged();
+
+    return false;
+}
+
+} // namespace WebCore
+
+#include "moc_DeviceMotionProviderQt.cpp"
diff --git a/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.h b/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.h
new file mode 100644
index 0000000..f3200d5
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceMotionProviderQt.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef DeviceMotionProviderQt_h
+#define DeviceMotionProviderQt_h
+
+#include "DeviceMotionData.h"
+#include "RefPtr.h"
+
+#include <QAccelerometerFilter>
+#include <QObject>
+
+QTM_USE_NAMESPACE
+
+namespace WebCore {
+
+class DeviceOrientationProviderQt;
+
+class DeviceMotionProviderQt : public QObject, public QAccelerometerFilter {
+    Q_OBJECT
+public:
+    DeviceMotionProviderQt();
+    ~DeviceMotionProviderQt();
+
+    bool filter(QAccelerometerReading*);
+    void start();
+    void stop();
+    DeviceMotionData* currentDeviceMotion() const { return m_motion.get(); }
+
+Q_SIGNALS:
+    void deviceMotionChanged();
+
+private:
+    RefPtr<DeviceMotionData> m_motion;
+    QAccelerometer m_acceleration;
+    DeviceOrientationProviderQt* m_deviceOrientation;
+};
+
+} // namespace WebCore
+
+#endif // DeviceMotionProviderQt_h
diff --git a/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.cpp b/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.cpp
new file mode 100644
index 0000000..1d0c6d1
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.cpp
@@ -0,0 +1,78 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "DeviceOrientationClientQt.h"
+
+#include "DeviceOrientationController.h"
+#include "DeviceOrientationProviderQt.h"
+#include "qwebpage.h"
+
+namespace WebCore {
+
+DeviceOrientationClientQt::DeviceOrientationClientQt(QWebPage* page)
+    : m_page(page)
+    , m_controller(0)
+    , m_provider(new DeviceOrientationProviderQt())
+{
+    connect(m_provider, SIGNAL(deviceOrientationChanged(DeviceOrientation*)), SLOT(changeDeviceOrientation(DeviceOrientation*)));
+}
+
+DeviceOrientationClientQt::~DeviceOrientationClientQt()
+{
+    disconnect();
+    delete m_provider;
+}
+
+void DeviceOrientationClientQt::setController(DeviceOrientationController* controller)
+{
+    m_controller = controller;
+}
+
+void DeviceOrientationClientQt::startUpdating()
+{
+    m_provider->start();
+}
+
+void DeviceOrientationClientQt::stopUpdating()
+{
+    m_provider->stop();
+}
+
+DeviceOrientation* DeviceOrientationClientQt::lastOrientation() const
+{
+    return m_provider->orientation();
+}
+
+void DeviceOrientationClientQt::deviceOrientationControllerDestroyed()
+{
+    delete this;
+}
+
+void DeviceOrientationClientQt::changeDeviceOrientation(DeviceOrientation* orientation)
+{
+    if (!m_controller)
+        return;
+
+    m_controller->didChangeDeviceOrientation(orientation);
+}
+
+} // namespace WebCore
+
+#include "moc_DeviceOrientationClientQt.cpp"
diff --git a/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.h b/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.h
new file mode 100644
index 0000000..61968c4
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceOrientationClientQt.h
@@ -0,0 +1,57 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef DeviceOrientationClientQt_h
+#define DeviceOrientationClientQt_h
+
+#include "DeviceOrientation.h"
+#include "DeviceOrientationClient.h"
+
+#include <QObject>
+
+class QWebPage;
+
+namespace WebCore {
+
+class DeviceOrientationProviderQt;
+
+class DeviceOrientationClientQt : public QObject, public DeviceOrientationClient {
+    Q_OBJECT
+public:
+    DeviceOrientationClientQt(QWebPage*);
+    virtual ~DeviceOrientationClientQt();
+
+    virtual void setController(DeviceOrientationController*);
+    virtual void startUpdating();
+    virtual void stopUpdating();
+    virtual DeviceOrientation* lastOrientation() const;
+    virtual void deviceOrientationControllerDestroyed();
+
+public Q_SLOTS:
+    void changeDeviceOrientation(DeviceOrientation*);
+
+private:
+    QWebPage* m_page;
+    DeviceOrientationController* m_controller;
+    DeviceOrientationProviderQt* m_provider;
+};
+
+} // namespace WebCore
+
+#endif // DeviceOrientationClientQt_h
diff --git a/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.cpp b/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.cpp
new file mode 100644
index 0000000..051eba0
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.cpp
@@ -0,0 +1,68 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#include "config.h"
+#include "DeviceOrientationProviderQt.h"
+
+namespace WebCore {
+
+DeviceOrientationProviderQt::DeviceOrientationProviderQt()
+{
+    m_rotation.addFilter(this);
+    m_orientation = DeviceOrientation::create();
+}
+
+DeviceOrientationProviderQt::~DeviceOrientationProviderQt()
+{
+}
+
+void DeviceOrientationProviderQt::start()
+{
+    m_rotation.start();
+}
+
+void DeviceOrientationProviderQt::stop()
+{
+    m_rotation.stop();
+}
+
+bool DeviceOrientationProviderQt::filter(QRotationReading* reading)
+{
+    // Provide device orientation data according W3C spec:
+    // http://dev.w3.org/geo/api/spec-source-orientation.html
+    // Qt mobility provide these data via QRotationSensor using the
+    // QRotationReading class:
+    //  - the rotation around z axis (alpha) is given as z in QRotationReading;
+    //  - the rotation around x axis (beta) is given as x in QRotationReading;
+    //  - the rotation around y axis (gamma) is given as y in QRotationReading;
+    // See: http://doc.qt.nokia.com/qtmobility-1.0/qrotationreading.html
+    // The Z (alpha) rotation angle is checked via hasAlpha() private method,
+    // depending if the device is able do detect the alpha rotation. X (beta) and
+    // Y (gamma) axis are availble in this context.
+    m_orientation = DeviceOrientation::create(hasAlpha(), reading->z(),
+            /* x available */ true, reading->x(),
+            /* y available */ true, reading->y());
+    emit deviceOrientationChanged(m_orientation.get());
+
+    return false;
+}
+
+}
+
+#include "moc_DeviceOrientationProviderQt.cpp"
diff --git a/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.h b/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.h
new file mode 100644
index 0000000..86c224e
--- /dev/null
+++ b/WebKit/qt/WebCoreSupport/DeviceOrientationProviderQt.h
@@ -0,0 +1,58 @@
+/*
+ * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Library General Public
+ * License as published by the Free Software Foundation; either
+ * version 2 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Library General Public License for more details.
+ *
+ * You should have received a copy of the GNU Library General Public License
+ * along with this library; see the file COPYING.LIB.  If not, write to
+ * the Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
+ * Boston, MA 02110-1301, USA.
+ *
+ */
+#ifndef DeviceOrientationProviderQt_h
+#define DeviceOrientationProviderQt_h
+
+#include "DeviceOrientation.h"
+#include "RefPtr.h"
+
+#include <QObject>
+#include <QRotationFilter>
+
+QTM_USE_NAMESPACE
+
+namespace WebCore {
+
+class DeviceOrientationClientQt;
+
+class DeviceOrientationProviderQt : public QObject, public QRotationFilter {
+    Q_OBJECT
+public:
+    DeviceOrientationProviderQt();
+    ~DeviceOrientationProviderQt();
+
+    bool filter(QRotationReading*);
+    void start();
+    void stop();
+    bool isActive() const { return m_rotation.isActive(); }
+    DeviceOrientation* orientation() const { return m_orientation.get(); }
+    bool hasAlpha() const { return m_rotation.property("hasZ").toBool(); }
+
+Q_SIGNALS:
+    void deviceOrientationChanged(DeviceOrientation*);
+
+private:
+    RefPtr<DeviceOrientation> m_orientation;
+    QRotationSensor m_rotation;
+};
+
+}
+
+#endif // DeviceOrientationProviderQt_h
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
index 836df49..28f6810 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.cpp
@@ -631,8 +631,8 @@ void DumpRenderTreeSupportQt::dumpNotification(bool b)
 
 QString DumpRenderTreeSupportQt::viewportAsText(QWebPage* page, const QSize& availableSize)
 {
-    WebCore::ViewportArguments args = page->mainFrame()->d->viewportArguments();
-    WebCore::ViewportConfiguration conf = WebCore::findConfigurationForViewportData(args,
+    WebCore::ViewportArguments args = page->d->viewportArguments();
+    WebCore::ViewportAttributes conf = WebCore::computeViewportAttributes(args,
         /* desktop-width */ 980,
         /* device-width  */ 320,
         /* device-height */ 480,
@@ -641,8 +641,8 @@ QString DumpRenderTreeSupportQt::viewportAsText(QWebPage* page, const QSize& ava
 
     QString res;
     res = res.sprintf("viewport size %dx%d scale %f with limits [%f, %f]\n",
-            conf.layoutViewport.width(),
-            conf.layoutViewport.height(),
+            conf.layoutSize.width(),
+            conf.layoutSize.height(),
             conf.initialScale,
             conf.minimumScale,
             conf.maximumScale);
@@ -764,6 +764,15 @@ void DumpRenderTreeSupportQt::simulateDesktopNotificationClick(const QString& ti
 #endif
 }
 
+QString DumpRenderTreeSupportQt::plainText(const QVariant& range)
+{
+    QMap<QString, QVariant> map = range.toMap();
+    QVariant startContainer  = map.value("startContainer");
+    map = startContainer.toMap();
+
+    return map.value("innerText").toString();
+}
+
 // Provide a backward compatibility with previously exported private symbols as of QtWebKit 4.6 release
 
 void QWEBKIT_EXPORT qt_resumeActiveDOMObjects(QWebFrame* frame)
diff --git a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
index 5a59475..0e76f04 100644
--- a/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
+++ b/WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h
@@ -98,6 +98,7 @@ public:
 
     static QString markerTextForListItem(const QWebElement& listItem);
     static QVariantMap computedStyleIncludingVisitedInfo(const QWebElement& element);
+    static QString plainText(const QVariant& rng);
 
     static void dumpFrameLoader(bool b);
     static void dumpResourceLoadCallbacks(bool b);
diff --git a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
index 9db4333..2dd3b37 100644
--- a/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/EditorClientQt.cpp
@@ -457,39 +457,7 @@ void EditorClientQt::handleKeyboardEvent(KeyboardEvent* event)
             m_page->triggerAction(QWebPage::Copy);
         else
 #endif // QT_NO_SHORTCUT
-        switch (kevent->windowsVirtualKeyCode()) {
-        case VK_UP:
-            frame->editor()->command("MoveUp").execute();
-            break;
-        case VK_DOWN:
-            frame->editor()->command("MoveDown").execute();
-            break;
-        case VK_PRIOR: // PageUp
-            frame->editor()->command("MovePageUp").execute();
-            break;
-        case VK_NEXT: // PageDown
-            frame->editor()->command("MovePageDown").execute();
-            break;
-        case VK_HOME:
-            if (kevent->ctrlKey())
-                frame->editor()->command("MoveToBeginningOfDocument").execute();
-            break;
-        case VK_END:
-            if (kevent->ctrlKey())
-                frame->editor()->command("MoveToEndOfDocument").execute();
-            break;
-        default:
-            if (kevent->ctrlKey()) {
-                switch (kevent->windowsVirtualKeyCode()) {
-                case VK_A:
-                    frame->editor()->command("SelectAll").execute();
-                    break;
-                default:
-                    return;
-                }
-            } else
-                return;
-        }
+            return;
     }
     event->setDefaultHandled();
 }
diff --git a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
index 41bcb3c..4ebc7e1 100644
--- a/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/FrameLoaderClientQt.cpp
@@ -64,7 +64,6 @@
 #include "ResourceHandleInternal.h"
 #include "ResourceHandle.h"
 #include "ScriptController.h"
-#include "ScriptString.h"
 #include "Settings.h"
 #include "QWebPageClient.h"
 #include "ViewportArguments.h"
@@ -1505,6 +1504,7 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
     else { // NPAPI Plugins
         Vector<String> params = paramNames;
         Vector<String> values = paramValues;
+#if !OS(SYMBIAN)
         if (mimeType == "application/x-shockwave-flash") {
             QWebPageClient* client = m_webFrame->page()->d->client;
             const bool isQWebView = client && qobject_cast<QWidget*>(client->pluginParent());
@@ -1530,6 +1530,7 @@ PassRefPtr<Widget> FrameLoaderClientQt::createPlugin(const IntSize& pluginSize,
             }
 #endif
         }
+#endif
 
         RefPtr<PluginView> pluginView = PluginView::create(m_frame, pluginSize, element, url,
             params, values, mimeType, loadManually);
diff --git a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
index b6673e6..e596870 100644
--- a/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/InspectorClientQt.cpp
@@ -39,7 +39,6 @@
 #include "NotImplemented.h"
 #include "Page.h"
 #include "PlatformString.h"
-#include "ScriptController.h"
 #include "ScriptDebugServer.h"
 #include "qwebinspector.h"
 #include "qwebinspector_p.h"
@@ -266,22 +265,7 @@ bool InspectorClientQt::sendMessageToFrontend(const String& message)
         return false;
 
     Page* frontendPage = QWebPagePrivate::core(m_frontendWebPage);
-    if (!frontendPage)
-        return false;
-
-    Frame* frame = frontendPage->mainFrame();
-    if (!frame)
-        return false;
-
-    ScriptController* scriptController = frame->script();
-    if (!scriptController)
-        return false;
-
-    String dispatchToFrontend("WebInspector.dispatchMessageFromBackend(");
-    dispatchToFrontend += message;
-    dispatchToFrontend += ");";
-    scriptController->executeScript(dispatchToFrontend);
-    return true;
+    return doDispatchMessageOnFrontendPage(frontendPage, message);
 }
 
 static String variantToSetting(const QVariant& qvariant)
diff --git a/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp b/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
index fad7247..a6dda58 100644
--- a/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
+++ b/WebKit/qt/WebCoreSupport/InspectorServerQt.cpp
@@ -37,6 +37,7 @@
 #include <QUrl>
 #include <QWidget>
 #include <qendian.h>
+#include <wtf/text/CString.h>
 
 namespace WebCore {
 
diff --git a/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp b/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
index 7b33d9e..0324c0d 100644
--- a/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/NotificationPresenterClientQt.cpp
@@ -40,6 +40,7 @@
 #include "QtPlatformPlugin.h"
 #include "ScriptExecutionContext.h"
 #include "SecurityOrigin.h"
+#include "UserGestureIndicator.h"
 
 #include "qwebframe_p.h"
 #include "qwebkitglobal.h"
@@ -262,8 +263,11 @@ void NotificationPresenterClientQt::cancel(NotificationWrapper* wrapper)
 void NotificationPresenterClientQt::notificationClicked(NotificationWrapper* wrapper)
 {
     Notification* notification =  notificationForWrapper(wrapper);
-    if (notification)
+    if (notification) {
+        // Make sure clicks on notifications are treated as user gestures.
+        UserGestureIndicator gestureIndicator(DefinitelyProcessingUserGesture);
         sendEvent(notification, eventNames().clickEvent);
+    }
 }
 
 void NotificationPresenterClientQt::notificationClicked(const QString& title)
diff --git a/WebKit/qt/WebCoreSupport/PageClientQt.cpp b/WebKit/qt/WebCoreSupport/PageClientQt.cpp
index ea209d9..9aa01a2 100644
--- a/WebKit/qt/WebCoreSupport/PageClientQt.cpp
+++ b/WebKit/qt/WebCoreSupport/PageClientQt.cpp
@@ -105,6 +105,7 @@ QRectF PageClientQWidget::windowRect() const
 
 PageClientQGraphicsWidget::~PageClientQGraphicsWidget()
 {
+    delete overlay;
 #if USE(ACCELERATED_COMPOSITING)
     if (!rootGraphicsLayer)
         return;
@@ -117,10 +118,6 @@ PageClientQGraphicsWidget::~PageClientQGraphicsWidget()
 void PageClientQGraphicsWidget::scroll(int dx, int dy, const QRect& rectToScroll)
 {
     view->scroll(qreal(dx), qreal(dy), rectToScroll);
-
-#if USE(ACCELERATED_COMPOSITING)
-    updateCompositingScrollPosition();
-#endif
 }
 
 void PageClientQGraphicsWidget::update(const QRect& dirtyRect)
@@ -132,8 +129,6 @@ void PageClientQGraphicsWidget::update(const QRect& dirtyRect)
         overlay->update(QRectF(dirtyRect));
 #if USE(ACCELERATED_COMPOSITING)
     syncLayers();
-    // This might be a slow-scroll. We ensure that the compositing layers are in the right position.
-    updateCompositingScrollPosition();
 #endif
 }
 
@@ -150,11 +145,15 @@ void PageClientQGraphicsWidget::createOrDeleteOverlay()
     }
     if (useOverlay == !!overlay)
         return;
+
     if (useOverlay) {
-        overlay = QSharedPointer<QGraphicsItemOverlay>(new QGraphicsItemOverlay(view, page));
+        overlay = new QGraphicsItemOverlay(view, page);
         overlay->setZValue(OverlayZValue);
-    } else
-        overlay.clear();
+    } else {
+        // Changing the overlay might be done inside paint events.
+        overlay->deleteLater();
+        overlay = 0;
+    }
 }
 
 #if USE(ACCELERATED_COMPOSITING)
@@ -180,7 +179,6 @@ void PageClientQGraphicsWidget::setRootGraphicsLayer(QGraphicsItem* layer)
         layer->setFlag(QGraphicsItem::ItemClipsChildrenToShape, true);
         layer->setParentItem(view);
         layer->setZValue(RootGraphicsLayerZValue);
-        updateCompositingScrollPosition();
     }
     createOrDeleteOverlay();
 }
@@ -192,13 +190,6 @@ void PageClientQGraphicsWidget::markForSync(bool scheduleSync)
         syncMetaMethod.invoke(view, Qt::QueuedConnection);
 }
 
-void PageClientQGraphicsWidget::updateCompositingScrollPosition()
-{
-    if (rootGraphicsLayer && page && page->mainFrame()) {
-        const QPoint scrollPosition = page->mainFrame()->scrollPosition();
-        rootGraphicsLayer.data()->setPos(-scrollPosition);
-    }
-}
 #endif
 
 #if ENABLE(TILED_BACKING_STORE)
diff --git a/WebKit/qt/WebCoreSupport/PageClientQt.h b/WebKit/qt/WebCoreSupport/PageClientQt.h
index eea7f40..7014fd2 100644
--- a/WebKit/qt/WebCoreSupport/PageClientQt.h
+++ b/WebKit/qt/WebCoreSupport/PageClientQt.h
@@ -32,7 +32,6 @@
 #include "qwebpage.h"
 #include "qwebpage_p.h"
 #include <QtCore/qmetaobject.h>
-#include <QtCore/qsharedpointer.h>
 #include <QtGui/qgraphicsscene.h>
 #include <QtGui/qgraphicsview.h>
 #include <QtGui/qgraphicswidget.h>
@@ -83,10 +82,10 @@ public:
 
 // the overlay is here for one reason only: to have the scroll-bars and other
 // extra UI elements appear on top of any QGraphicsItems created by CSS compositing layers
-class QGraphicsItemOverlay : public QGraphicsItem {
+class QGraphicsItemOverlay : public QGraphicsObject {
     public:
     QGraphicsItemOverlay(QGraphicsWidget* view, QWebPage* p)
-            :QGraphicsItem(view)
+            :QGraphicsObject(view)
             , q(view)
             , page(p)
     {
@@ -124,6 +123,7 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
         , shouldSync(false)
 #endif
+        , overlay(0)
     {
        Q_ASSERT(view);
 #if USE(ACCELERATED_COMPOSITING)
@@ -170,7 +170,6 @@ public:
 #if USE(ACCELERATED_COMPOSITING)
     virtual void setRootGraphicsLayer(QGraphicsItem* layer);
     virtual void markForSync(bool scheduleSync);
-    void updateCompositingScrollPosition();
     void syncLayers();
 
     // QGraphicsWebView can render composited layers
@@ -194,7 +193,7 @@ public:
     bool shouldSync;
 #endif
     // the overlay gets instantiated when the root layer is attached, and get deleted when it's detached
-    QSharedPointer<QGraphicsItemOverlay> overlay;
+    QGraphicsItemOverlay* overlay;
 
     // we need to put the root graphics layer behind the overlay (which contains the scrollbar)
     enum { RootGraphicsLayerZValue, OverlayZValue };
diff --git a/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp b/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
index 56a0fac..9b34955 100644
--- a/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
+++ b/WebKit/qt/WebCoreSupport/PopupMenuQt.cpp
@@ -127,7 +127,7 @@ void PopupMenuQt::didHide()
 
 void PopupMenuQt::hide()
 {
-    if (!m_popup)
+    if (m_popup)
         m_popup->hide();
 }
 
diff --git a/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp b/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
index 1f91d8c..9786967 100644
--- a/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
+++ b/WebKit/qt/WebCoreSupport/QtPlatformPlugin.cpp
@@ -91,20 +91,20 @@ QWebKitPlatformPlugin* QtPlatformPlugin::plugin()
 QWebSelectMethod* QtPlatformPlugin::createSelectInputMethod()
 {
     QWebKitPlatformPlugin* p = plugin();
-    return p ? qobject_cast<QWebSelectMethod*>(p->createExtension(QWebKitPlatformPlugin::MultipleSelections)) : 0;
+    return p ? static_cast<QWebSelectMethod*>(p->createExtension(QWebKitPlatformPlugin::MultipleSelections)) : 0;
 }
 
 
 QWebNotificationPresenter* QtPlatformPlugin::createNotificationPresenter()
 {
     QWebKitPlatformPlugin* p = plugin();
-    return p ? qobject_cast<QWebNotificationPresenter*>(p->createExtension(QWebKitPlatformPlugin::Notifications)) : 0;
+    return p ? static_cast<QWebNotificationPresenter*>(p->createExtension(QWebKitPlatformPlugin::Notifications)) : 0;
 }
 
 QWebHapticFeedbackPlayer* QtPlatformPlugin::createHapticFeedbackPlayer()
 {
     QWebKitPlatformPlugin* p = plugin();
-    return p ? qobject_cast<QWebHapticFeedbackPlayer*>(p->createExtension(QWebKitPlatformPlugin::Haptics)) : 0;
+    return p ? static_cast<QWebHapticFeedbackPlayer*>(p->createExtension(QWebKitPlatformPlugin::Haptics)) : 0;
 }
 
 }
diff --git a/WebKit/qt/symbian/eabi/QtWebKitu.def b/WebKit/qt/symbian/eabi/QtWebKitu.def
index 2b917e1..2aa30cc 100644
--- a/WebKit/qt/symbian/eabi/QtWebKitu.def
+++ b/WebKit/qt/symbian/eabi/QtWebKitu.def
@@ -796,9 +796,10 @@ EXPORTS
 	_ZN23DumpRenderTreeSupportQtC2Ev @ 795 NONAME
 	_ZN23DumpRenderTreeSupportQtD1Ev @ 796 NONAME
 	_ZN23DumpRenderTreeSupportQtD2Ev @ 797 NONAME
-	_ZN8QWebPage23allowGeolocationRequestEP9QWebFrame @ 798 NONAME
+	_ZN8QWebPage23allowGeolocationRequestEP9QWebFrame @ 798 NONAME ABSENT
 	_ZN8QWebPage23viewportChangeRequestedERKNS_13ViewportHintsE @ 799 NONAME ABSENT
 	_ZNK15QWebScriptWorld5worldEv @ 800 NONAME
+	_ZN16QGraphicsWebView13setDeviceSizeERK5QSize @ 801 NONAME ABSENT
 	_ZN23DumpRenderTreeSupportQt12pagePropertyEP9QWebFrameRK7QStringi @ 802 NONAME
 	_ZN23DumpRenderTreeSupportQt16isPageBoxVisibleEP9QWebFramei @ 803 NONAME
 	_ZN23DumpRenderTreeSupportQt16resumeAnimationsEP9QWebFrame @ 804 NONAME
@@ -810,8 +811,20 @@ EXPORTS
 	_ZN8QWebPage23checkPermissionFromUserEP9QWebFrameNS_16PermissionDomainERNS_16PermissionPolicyE @ 810 NONAME
 	_ZN8QWebPage25requestPermissionFromUserEP9QWebFrameNS_16PermissionDomainE @ 811 NONAME
 	_ZN8QWebPage27cancelRequestsForPermissionEP9QWebFrameNS_16PermissionDomainE @ 812 NONAME
+	_ZNK16QGraphicsWebView10deviceSizeEv @ 813 NONAME ABSENT
 	_ZN23DumpRenderTreeSupportQt14viewportAsTextEP8QWebPageRK5QSize @ 814 NONAME
 	_ZN23DumpRenderTreeSupportQt32simulateDesktopNotificationClickERK7QString @ 815 NONAME
 	_ZN8QWebPage23viewportChangeRequestedEv @ 816 NONAME
-	_ZNK8QWebPage28viewportConfigurationForSizeE5QSize @ 817 NONAME
+	_ZNK8QWebPage28viewportConfigurationForSizeERK5QSize @ 817 NONAME ABSENT
+	_ZN23DumpRenderTreeSupportQt20dumpHistoryCallbacksEb @ 818 NONAME
+	_ZN23DumpRenderTreeSupportQt25dumpVisitedLinksCallbacksEb @ 819 NONAME
+	_ZN23DumpRenderTreeSupportQt9plainTextERK8QVariant @ 820 NONAME
+	_ZNK8QWebPage25viewportAttributesForSizeERK5QSize @ 821 NONAME
+	_ZN8QWebPage18ViewportAttributesC1ERKS0_ @ 822 NONAME
+	_ZN8QWebPage18ViewportAttributesC1Ev @ 823 NONAME
+	_ZN8QWebPage18ViewportAttributesC2ERKS0_ @ 824 NONAME
+	_ZN8QWebPage18ViewportAttributesC2Ev @ 825 NONAME
+	_ZN8QWebPage18ViewportAttributesD1Ev @ 826 NONAME
+	_ZN8QWebPage18ViewportAttributesD2Ev @ 827 NONAME
+	_ZN8QWebPage18ViewportAttributesaSERKS0_ @ 828 NONAME
 
diff --git a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
index 36fa050..0462953 100644
--- a/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
+++ b/WebKit/qt/tests/qwebpage/tst_qwebpage.cpp
@@ -41,6 +41,7 @@
 #include <qwebpage.h>
 #include <qwebsecurityorigin.h>
 #include <qwebview.h>
+#include <qimagewriter.h>
 
 class EventSpy : public QObject, public QList<QEvent::Type>
 {
@@ -126,6 +127,7 @@ private slots:
     void showModalDialog();
     void testStopScheduledPageRefresh();
     void findText();
+    void supportedContentType();
     
 private:
     QWebView* m_view;
@@ -247,6 +249,12 @@ void tst_QWebPage::infiniteLoopJS()
 
 void tst_QWebPage::geolocationRequestJS()
 {
+    /*
+      This test is disabled because it can only succeed if ENABLE(GEOLOCATION) is true.
+      The code needs to be updated when the API of requestPermissionFromUser is updated.
+    */
+    QSKIP("Test disabled as long as geolocation is disabled from the build.", SkipSingle);
+
     JSTestPage* newPage = new JSTestPage(m_view);
     connect(newPage, SIGNAL(requestPermissionFromUser(QWebFrame*, QWebPage::PermissionDomain)), 
             newPage, SLOT(requestPermission(QWebFrame*, QWebPage::PermissionDomain)));
@@ -2197,5 +2205,80 @@ void tst_QWebPage::findText()
     }
 }
 
+struct ImageExtensionMap {
+    const char* extension;
+    const char* mimeType;
+};
+
+static const ImageExtensionMap extensionMap[] = {
+    { "bmp", "image/bmp" },
+    { "css", "text/css" },
+    { "gif", "image/gif" },
+    { "html", "text/html" },
+    { "htm", "text/html" },
+    { "ico", "image/x-icon" },
+    { "jpeg", "image/jpeg" },
+    { "jpg", "image/jpeg" },
+    { "js", "application/x-javascript" },
+    { "mng", "video/x-mng" },
+    { "pbm", "image/x-portable-bitmap" },
+    { "pgm", "image/x-portable-graymap" },
+    { "pdf", "application/pdf" },
+    { "png", "image/png" },
+    { "ppm", "image/x-portable-pixmap" },
+    { "rss", "application/rss+xml" },
+    { "svg", "image/svg+xml" },
+    { "text", "text/plain" },
+    { "tif", "image/tiff" },
+    { "tiff", "image/tiff" },
+    { "txt", "text/plain" },
+    { "xbm", "image/x-xbitmap" },
+    { "xml", "text/xml" },
+    { "xpm", "image/x-xpm" },
+    { "xsl", "text/xsl" },
+    { "xhtml", "application/xhtml+xml" },
+    { "wml", "text/vnd.wap.wml" },
+    { "wmlc", "application/vnd.wap.wmlc" },
+    { 0, 0 }
+};
+
+static QString getMimeTypeForExtension(const QString &ext)
+{
+    const ImageExtensionMap *e = extensionMap;
+    while (e->extension) {
+        if (ext.compare(QLatin1String(e->extension), Qt::CaseInsensitive) == 0)
+            return QLatin1String(e->mimeType);
+        ++e;
+    }
+
+    return QString();
+}
+
+void tst_QWebPage::supportedContentType()
+{
+   QStringList contentTypes;
+
+   // Add supported non image types...
+   contentTypes << "text/html" << "text/xml" << "text/xsl" << "text/plain" << "text/"
+                << "application/xml" << "application/xhtml+xml" << "application/vnd.wap.xhtml+xml"
+                << "application/rss+xml" << "application/atom+xml" << "application/json";
+
+   // Add supported image types...
+   Q_FOREACH(const QByteArray& imageType, QImageWriter::supportedImageFormats()) {
+      const QString mimeType = getMimeTypeForExtension(imageType);
+      if (!mimeType.isEmpty())
+          contentTypes << mimeType;
+   }
+
+   // Get the mime types supported by webkit...
+   const QStringList supportedContentTypes = m_page->supportedContentTypes();
+
+   Q_FOREACH(const QString& mimeType, contentTypes)
+      QVERIFY2(supportedContentTypes.contains(mimeType), QString("'%1' is not a supported content type!").arg(mimeType).toLatin1());
+      
+   Q_FOREACH(const QString& mimeType, contentTypes)
+      QVERIFY2(m_page->supportsContentType(mimeType), QString("Cannot handle content types '%1'!").arg(mimeType).toLatin1());
+}
+
 QTEST_MAIN(tst_QWebPage)
 #include "tst_qwebpage.moc"
diff --git a/WebKit/win/ChangeLog b/WebKit/win/ChangeLog
index 4933b24..0f4c32c 100644
--- a/WebKit/win/ChangeLog
+++ b/WebKit/win/ChangeLog
@@ -1,3 +1,248 @@
+2010-10-20  Dumitru Daniliuc  <dumi@chromium.org>
+
+        Reviewed by David Levin.
+
+        Repost the DatabaseTracker notifications to the main thread, if needed.
+        https://bugs.webkit.org/show_bug.cgi?id=40655
+
+        * WebDatabaseManager.cpp:
+        (DidModifyOriginData::dispatchToMainThread):
+        (DidModifyOriginData::DidModifyOriginData):
+        (DidModifyOriginData::dispatchDidModifyOriginOnMainThread):
+        (WebDatabaseManager::dispatchDidModifyOrigin):
+        (WebDatabaseManager::dispatchDidModifyDatabase):
+
+2010-10-20  Dirk Schulze  <krit@webkit.org>
+
+        Reviewed by Nikolas Zimmermann.
+
+        Merge ColorSpace and ImageColorSpace enums
+        https://bugs.webkit.org/show_bug.cgi?id=47922
+
+        Renamed ColorSpace enum entries DeviceColorSpace and sRGBColorSpace to ColorSpaceDeviceRGB and ColorSpaceSRGB
+        to follow webkit style rules.
+
+        * FullscreenVideoController.cpp:
+        (HUDButton::draw):
+        (HUDSlider::draw):
+        (FullscreenVideoController::draw):
+        * WebCoreSupport/WebDragClient.cpp:
+        (WebDragClient::createDragImageForLink):
+        * WebKitGraphics.cpp:
+        (WebDrawText):
+
+2010-10-18  Pavel Podivilov  <podivilov@chromium.org>
+
+        Reviewed by Timothy Hatcher.
+
+        Web Inspector: disable private browsing for inspector
+        https://bugs.webkit.org/show_bug.cgi?id=47827
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorClient::openInspectorFrontend):
+
+2010-10-17  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Dimitri Glazkov.
+
+        FrameLoader doesn't need an explicit userGesture parameter
+        https://bugs.webkit.org/show_bug.cgi?id=47777
+
+        Update for the new API.
+
+        * WebCoreSupport/WebContextMenuClient.cpp:
+        (WebContextMenuClient::searchWithGoogle):
+
+2010-10-15  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION(r69850) Loading apple.com/startpage in WebKit on Windows gets a bad request.
+        https://bugs.webkit.org/show_bug.cgi?id=47753
+        <rdar://problem/8558242>
+        
+        VerQueryValue returns a null terminated string, but we need to strip off the null terminating character
+        when we turn it into a WebCore string, or else concatenation using this string will break.
+
+        * WebView.cpp:
+
+2010-10-15  Jessie Berlin  <jberlin@apple.com>
+
+        Windows build fix. Unreviewed.
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        Add a missing include.
+
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorFrontendClient::updateWindowTitle):
+        * WebView.cpp:
+        (WebView::standardUserAgentWithApplicationName):
+        (osVersion):
+
+2010-10-14  Ilya Tikhonovsky  <loislo@chromium.org>
+
+        Reviewed by Pavel Feldman.
+
+        Web Inspector: inspector settings/properties/states management
+        should be extracted into separate class.
+
+        We have a lot of flags/values in InspectorController.
+        Some flags are persisting into profile.
+        Others are part of inspector state for frontend.
+        All these flags should keep their values after navigation.
+        It'd be better to extract these flags/values into separate
+        class which will care about theirs lifetime.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47275
+
+        * WebCoreSupport/WebInspectorClient.cpp:
+        (WebInspectorFrontendClient::attachWindow):
+        (WebInspectorFrontendClient::detachWindow):
+        (WebInspectorFrontendClient::showWindowWithoutNotifications):
+
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+
+2010-10-12  Adam Roben  <aroben@apple.com>
+
+        Build TestWebKitAPI on Windows
+
+        Fixes <http://webkit.org/b/47552> <rdar://problem/8541708> Make
+        TestWebKitAPI work on Windows
+
+        Reviewed by Sam Weinig.
+
+        * WebKit.vcproj/WebKit.sln: Added TestWebKitAPI and
+        TestWebKitAPIGenerated and made them build just after
+        WebKitTestRunner.
+
+2010-10-11  Shinichiro Hamaji  <hamaji@chromium.org>
+
+        Attempt to fix windows build failure.
+
+        Remove WebIconFetcher from WebKit and IconFetcher from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=47523
+
+        * Interfaces/IWebFramePrivate.idl: s/unused1/unused2/
+        * Interfaces/WebKit.idl: Touched.
+        * WebFrame.cpp: s/unused1/unused2/
+        (WebFrame::unused2):
+        * WebFrame.h: s/unused1/unused2/
+
+2010-10-11  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Remove WebIconFetcher from WebKit and IconFetcher from WebCore
+        https://bugs.webkit.org/show_bug.cgi?id=47523
+
+        Remove all traces of the WebKit WebIconFetcher class. It's SPI that nobody uses.
+
+        * Interfaces/IWebFramePrivate.idl:
+        * Interfaces/IWebIconFetcher.idl: Removed.
+        * Interfaces/WebKit.idl:
+        * WebFrame.cpp:
+        (WebFrame::unused1):
+        * WebFrame.h:
+        * WebIconFetcher.cpp: Removed.
+        * WebIconFetcher.h: Removed.
+        * WebKit.vcproj/Interfaces.vcproj:
+        * WebKit.vcproj/WebKit.vcproj:
+
+2010-10-11  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Add Private API for creating a WebKit2 WebSerializedScriptValue from the internal
+        representation of a WebKit1 WebSerializedJSValue.
+        https://bugs.webkit.org/show_bug.cgi?id=47439
+
+        * Interfaces/IWebSerializedJSValuePrivate.idl:
+        Because it is taking a void** parameter, getInternalRepresentation must be declared [local].
+
+        * WebSerializedJSValue.cpp:
+        (WebSerializedJSValue::getInternalRepresentation):
+        * WebSerializedJSValue.h:
+
+2010-10-07  Jessie Berlin  <jberlin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add Private API for creating a WebKit1 WebSerializedJSValue from the internal
+        representation of a WebKit2 WebSerializedScriptValue.
+        https://bugs.webkit.org/show_bug.cgi?id=47390
+
+        * Interfaces/WebKit.idl:
+        Generate IWebSerializedJSValuePrivate.
+        
+        * Interfaces/IWebSerializedJSValuePrivate.idl: Added.
+        Because it is taking a void* parameter, setInternalRepresentation must be declared [local].
+
+        * WebKit.vcproj/Interfaces.vcproj:
+        Add IWebSerializedJSValue.idl and IWebSerializedJSValuePrivate.idl.
+
+        * WebSerializedJSValue.cpp:
+        (WebSerializedJSValue::QueryInterface):
+        Since there are now two interfaces that inherit from IUnknown, do not try to cast to
+        IUnknown* anymore. Cast to IWebSerializedJSValue* instead.
+        (WebSerializedJSValue::setInternalRepresentation):
+        Only set the internal representation if it hasn't already been set.
+        * WebSerializedJSValue.h:
+
+2010-10-04  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        Prevent an assertion failure when trying to create a protection space
+        for file/data URLs.
+
+        Reviewed by Sam Weinig.
+
+        * WebURLProtectionSpace.cpp:
+        (WebURLProtectionSpace::initWithHost):
+        Remove the ASSERT_NOT_REACHED().
+
+2010-10-05  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * WebKit.vcproj/WebKit.sln: Turn the QTMovieWin project
+        off for WinCairo release builds.  Somehow this was
+        incorrectly turned on.
+
+2010-10-01  Mark Rowe  <mrowe@apple.com>
+
+        Build fix.
+
+        Clear the executable bit from a number of source files.
+
+        * WebView.cpp:
+        * WebView.h:
+
+2010-09-30  Darin Adler  <darin@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Remove remaining calls to deprecatedParseURL
+        https://bugs.webkit.org/show_bug.cgi?id=26599
+
+        * WebCoreSupport/WebFrameLoaderClient.cpp:
+        (WebFrameLoaderClient::dispatchDidFailToStartPlugin):
+        Call stripLeadingAndTrailingHTMLSpaces instead of deprecatedParseURL.
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/win/FullscreenVideoController.cpp b/WebKit/win/FullscreenVideoController.cpp
index 696aaa5..5f9b959 100644
--- a/WebKit/win/FullscreenVideoController.cpp
+++ b/WebKit/win/FullscreenVideoController.cpp
@@ -116,7 +116,7 @@ HUDButton::HUDButton(HUDButtonType type, const IntPoint& position)
 void HUDButton::draw(GraphicsContext& context)
 {
     Image* image = (m_showAltButton && m_buttonImageAlt) ? m_buttonImageAlt.get() : m_buttonImage.get();
-    context.drawImage(image, DeviceColorSpace, m_rect.location());
+    context.drawImage(image, ColorSpaceDeviceRGB, m_rect.location());
 }
 
 HUDSlider::HUDSlider(HUDSliderButtonShape shape, int buttonSize, const IntRect& rect)
@@ -132,11 +132,11 @@ void HUDSlider::draw(GraphicsContext& context)
 {
     // Draw gutter
     IntSize radius(m_rect.height() / 2, m_rect.height() / 2);
-    context.fillRoundedRect(m_rect, radius, radius, radius, radius, Color(sliderGutterColor), DeviceColorSpace);
+    context.fillRoundedRect(m_rect, radius, radius, radius, radius, Color(sliderGutterColor), ColorSpaceDeviceRGB);
 
     // Draw button
-    context.setStrokeColor(Color(sliderButtonColor), DeviceColorSpace);
-    context.setFillColor(Color(sliderButtonColor), DeviceColorSpace);
+    context.setStrokeColor(Color(sliderButtonColor), ColorSpaceDeviceRGB);
+    context.setFillColor(Color(sliderButtonColor), ColorSpaceDeviceRGB);
 
     if (m_buttonShape == RoundButton) {
         context.drawEllipse(IntRect(m_rect.location().x() + m_buttonPosition, m_rect.location().y() - (m_buttonSize - m_rect.height()) / 2, m_buttonSize, m_buttonSize));
@@ -489,9 +489,9 @@ void FullscreenVideoController::draw()
     IntSize innerRadius(borderRadius - borderThickness, borderRadius - borderThickness);
     IntRect innerRect(borderThickness, borderThickness, windowWidth - borderThickness * 2, windowHeight - borderThickness * 2);
 
-    context.fillRoundedRect(outerRect, outerRadius, outerRadius, outerRadius, outerRadius, Color(borderColor), DeviceColorSpace);
+    context.fillRoundedRect(outerRect, outerRadius, outerRadius, outerRadius, outerRadius, Color(borderColor), ColorSpaceDeviceRGB);
     context.setCompositeOperation(CompositeCopy);
-    context.fillRoundedRect(innerRect, innerRadius, innerRadius, innerRadius, innerRadius, Color(backgroundColor), DeviceColorSpace);
+    context.fillRoundedRect(innerRect, innerRadius, innerRadius, innerRadius, innerRadius, Color(backgroundColor), ColorSpaceDeviceRGB);
 
     // Draw the widgets
     m_playPauseButton.draw(context);
@@ -526,13 +526,13 @@ void FullscreenVideoController::draw()
     // Left string
     s = timeToString(currentTime());
     TextRun leftText(s);
-    context.setFillColor(Color(textColor), DeviceColorSpace);
+    context.setFillColor(Color(textColor), ColorSpaceDeviceRGB);
     context.drawText(font, leftText, IntPoint(windowWidth / 2 - timeSliderWidth / 2 - margin - font.width(leftText), windowHeight - margin - sliderHeight / 2 + font.height() / 4));
 
     // Right string
     s = timeToString(currentTime() - duration());
     TextRun rightText(s);
-    context.setFillColor(Color(textColor), DeviceColorSpace);
+    context.setFillColor(Color(textColor), ColorSpaceDeviceRGB);
     context.drawText(font, rightText, IntPoint(windowWidth / 2 + timeSliderWidth / 2 + margin, windowHeight - margin - sliderHeight / 2 + font.height() / 4));
 
     // Copy to the window
diff --git a/WebKit/win/Interfaces/IWebFramePrivate.idl b/WebKit/win/Interfaces/IWebFramePrivate.idl
index 499aa03..190681c 100755
--- a/WebKit/win/Interfaces/IWebFramePrivate.idl
+++ b/WebKit/win/Interfaces/IWebFramePrivate.idl
@@ -30,8 +30,6 @@ import "IWebFrame.idl";
 #endif
 
 interface IWebFrame;
-interface IWebIconFetcher;
-interface IWebIconFetcherDelegate;
 interface IWebScriptWorld;
 
 typedef enum {
@@ -81,7 +79,7 @@ interface IWebFramePrivate : IUnknown
 
     HRESULT pendingFrameUnloadEventCount([out, retval] UINT* result);
 
-    HRESULT fetchApplicationIcon([in] IWebIconFetcherDelegate* delegate, [out, retval] IWebIconFetcher** result);
+    HRESULT unused2();
 
     HRESULT paintDocumentRectToContext([in] RECT rect, [in] OLE_HANDLE deviceContext);
 
diff --git a/WebKit/win/Interfaces/IWebIconFetcher.idl b/WebKit/win/Interfaces/IWebSerializedJSValuePrivate.idl
index 1486687..847dd76 100644
--- a/WebKit/win/Interfaces/IWebIconFetcher.idl
+++ b/WebKit/win/Interfaces/IWebSerializedJSValuePrivate.idl
@@ -1,18 +1,18 @@
 /*
- * Copyright (C) 2007, 2008 Apple Inc. All rights reserved.
+ * Copyright (C) 2007, 2008, 2009 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
- *     notice, this list of conditions and the following disclaimer.
+ *     notice, this list of conditions and the following disclaimer. 
  * 2.  Redistributions in binary form must reproduce the above copyright
  *     notice, this list of conditions and the following disclaimer in the
- *     documentation and/or other materials provided with the distribution.
+ *     documentation and/or other materials provided with the distribution. 
  * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
  *     its contributors may be used to endorse or promote products derived
- *     from this software without specific prior written permission.
+ *     from this software without specific prior written permission. 
  *
  * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
  * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
@@ -31,26 +31,15 @@ import "oaidl.idl";
 import "ocidl.idl";
 #endif
 
-interface IWebIconFetcher;
-
-[
-    object,
-    oleautomation,
-    uuid(9d27e503-1e0e-458e-bc66-ffa9fa64600e),
-    pointer_default(unique)
-]
-interface IWebIconFetcherDelegate : IUnknown
-{
-    HRESULT finishedLoadingIcon([in] IWebIconFetcher* fetcher, [in] IStream* data);
-}
-
 [
     object,
     oleautomation,
-    uuid(54f50460-8ffa-442c-b5Ab-5422e1fcc973),
+    hidden,
+    uuid(F695AF5F-35FE-44fb-9EC6-23ABCAC8C515),
     pointer_default(unique)
 ]
-interface IWebIconFetcher : IUnknown
+interface IWebSerializedJSValuePrivate : IUnknown
 {
-    HRESULT cancel();
+    [local] HRESULT setInternalRepresentation([in] void* internalRepresentation);
+    [local] HRESULT getInternalRepresentation([out, retval] void** internalRepresentation);
 }
diff --git a/WebKit/win/Interfaces/WebKit.idl b/WebKit/win/Interfaces/WebKit.idl
index 8938501..470b052 100644
--- a/WebKit/win/Interfaces/WebKit.idl
+++ b/WebKit/win/Interfaces/WebKit.idl
@@ -100,7 +100,6 @@ import "ocidl.idl";
 #include "IWebHistoryItemPrivate.idl"
 #include "IWebHistoryPrivate.idl"
 #include "IWebIconDatabase.idl"
-#include "IWebIconFetcher.idl"
 #include "IWebInspector.idl"
 #include "IWebInspectorPrivate.idl"
 #include "IWebJavaScriptCollector.idl"
@@ -123,6 +122,7 @@ import "ocidl.idl";
 #include "IWebScrollBarPrivate.idl"
 #include "IWebSecurityOrigin.idl"
 #include "IWebSerializedJSValue.idl"
+#include "IWebSerializedJSValuePrivate.idl"
 #include "IWebTextRenderer.idl"
 #include "IWebUIDelegate.idl"
 #include "IWebUIDelegate2.idl"
@@ -300,3 +300,4 @@ library WebKit
         [default] interface IWebUserContentURLPattern;
     }
 }
+
diff --git a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
index ca0374a..ab1f79e 100644
--- a/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebContextMenuClient.cpp
@@ -26,6 +26,7 @@
 #include "config.h"
 #include "WebContextMenuClient.h"
 
+#include "UserGestureIndicator.h"
 #include "WebElementPropertyBag.h"
 #include "WebLocalizableStrings.h"
 #include "WebView.h"
@@ -140,8 +141,10 @@ void WebContextMenuClient::searchWithGoogle(const Frame* frame)
     url.append(encoded);
     url.append("&ie=UTF-8&oe=UTF-8");
 
-    if (Page* page = frame->page())
-        page->mainFrame()->loader()->urlSelected(KURL(ParsedURLString, url), String(), 0, false, false, true, SendReferrer);
+    if (Page* page = frame->page()) {
+        UserGestureIndicator indicator(DefinitelyProcessingUserGesture);
+        page->mainFrame()->loader()->urlSelected(KURL(ParsedURLString, url), String(), 0, false, false, SendReferrer);
+    }
 }
 
 void WebContextMenuClient::lookUpInDictionary(Frame*)
diff --git a/WebKit/win/WebCoreSupport/WebDragClient.cpp b/WebKit/win/WebCoreSupport/WebDragClient.cpp
index 773e392..f4d9842 100644
--- a/WebKit/win/WebCoreSupport/WebDragClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebDragClient.cpp
@@ -295,7 +295,7 @@ DragImageRef WebDragClient::createDragImageForLink(KURL& url, const String& inLa
     static const Color backgroundColor(140, 140, 140);
     static const IntSize radii(DRAG_LABEL_RADIUS, DRAG_LABEL_RADIUS);
     IntRect rect(0, 0, imageSize.width(), imageSize.height());
-    context.fillRoundedRect(rect, radii, radii, radii, radii, backgroundColor, DeviceColorSpace);
+    context.fillRoundedRect(rect, radii, radii, radii, radii, backgroundColor, ColorSpaceDeviceRGB);
  
     // Draw the text
     static const Color topColor(0, 0, 0, 255); //original alpha = 0.75
diff --git a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
index 4b05338..ffc41b2 100644
--- a/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebFrameLoaderClient.cpp
@@ -59,6 +59,7 @@
 #include <WebCore/HTMLFrameElement.h>
 #include <WebCore/HTMLFrameOwnerElement.h>
 #include <WebCore/HTMLNames.h>
+#include <WebCore/HTMLParserIdioms.h>
 #include <WebCore/HTMLPlugInElement.h>
 #include <WebCore/HistoryItem.h>
 #include <WebCore/Page.h>
@@ -66,7 +67,6 @@
 #include <WebCore/PluginView.h>
 #include <WebCore/RenderPart.h>
 #include <WebCore/ResourceHandle.h>
-#include <WebCore/ScriptString.h>
 #pragma warning(pop)
 
 using namespace WebCore;
@@ -768,7 +768,7 @@ void WebFrameLoaderClient::dispatchDidFailToStartPlugin(const PluginView* plugin
     ASSERT(frame == pluginView->parentFrame());
 
     if (!pluginView->pluginsPage().isNull()) {
-        KURL pluginPageURL = frame->document()->completeURL(deprecatedParseURL(pluginView->pluginsPage()));
+        KURL pluginPageURL = frame->document()->completeURL(stripLeadingAndTrailingHTMLSpaces(pluginView->pluginsPage()));
         if (pluginPageURL.protocolInHTTPFamily()) {
             static CFStringRef key = MarshallingHelpers::LPCOLESTRToCFStringRef(WebKitErrorPlugInPageURLStringKey);
             RetainPtr<CFStringRef> str(AdoptCF, pluginPageURL.string().createCFString());
diff --git a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
index 1b79dde..76ebc8f 100644
--- a/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
+++ b/WebKit/win/WebCoreSupport/WebInspectorClient.cpp
@@ -49,6 +49,7 @@
 
 #include <tchar.h>
 #include <wtf/RetainPtr.h>
+#include <wtf/text/StringConcatenate.h>
 
 using namespace WebCore;
 
@@ -111,7 +112,6 @@ void WebInspectorClient::openInspectorFrontend(InspectorController* inspectorCon
         return;
 
     // Keep preferences separate from the rest of the client, making sure we are using expected preference values.
-    // One reason this is good is that it keeps the inspector out of history via "private browsing".
     // FIXME: It's crazy that we have to do this song and dance to end up with
     // a private WebPreferences object, even within WebKit. We should make this
     // process simpler, and consider whether we can make it simpler for WebKit
@@ -125,8 +125,6 @@ void WebInspectorClient::openInspectorFrontend(InspectorController* inspectorCon
         return;
     if (FAILED(preferences->setAutosaves(FALSE)))
         return;
-    if (FAILED(preferences->setPrivateBrowsingEnabled(TRUE)))
-        return;
     if (FAILED(preferences->setLoadsImagesAutomatically(TRUE)))
         return;
     if (FAILED(preferences->setAuthorAndUserStylesEnabled(TRUE)))
@@ -273,7 +271,8 @@ void WebInspectorFrontendClient::attachWindow()
     if (m_attached)
         return;
 
-    m_inspectedWebView->page()->inspectorController()->setSetting(InspectorController::inspectorStartsAttachedSettingName(), "true");
+    // FIXME: This flag can be saved to the flags storage directly.
+    m_inspectedWebView->page()->inspectorController()->setInspectorStartsAttached(true);
 
     closeWindowWithoutNotifications();
     showWindowWithoutNotifications();
@@ -284,7 +283,8 @@ void WebInspectorFrontendClient::detachWindow()
     if (!m_attached)
         return;
 
-    m_inspectedWebView->page()->inspectorController()->setSetting(InspectorController::inspectorStartsAttachedSettingName(), "false");
+    // FIXME: This flag can be saved to the flags storage directly.
+    m_inspectedWebView->page()->inspectorController()->setInspectorStartsAttached(false);
 
     closeWindowWithoutNotifications();
     showWindowWithoutNotifications();
@@ -364,8 +364,8 @@ void WebInspectorFrontendClient::showWindowWithoutNotifications()
         shouldAttach = true;
     else {
         // If no preference is set - default to an attached window. This is important for inspector LayoutTests.
-        String shouldAttachPref = m_inspectedWebView->page()->inspectorController()->setting(InspectorController::inspectorStartsAttachedSettingName());
-        shouldAttach = shouldAttachPref != "false";
+        // FIXME: This flag can be fetched directly from the flags storage.
+        shouldAttach = m_inspectedWebView->page()->inspectorController()->inspectorStartsAttached();
 
         if (shouldAttach && !canAttachWindow())
             shouldAttach = false;
@@ -419,12 +419,7 @@ void WebInspectorFrontendClient::destroyInspectorView(bool notifyInspectorContro
 
 void WebInspectorFrontendClient::updateWindowTitle()
 {
-    // FIXME: The series of appends should be replaced with a call to String::format()
-    // when it can be figured out how to get the unicode em-dash to show up.
-    String title = "Web Inspector ";
-    title.append((UChar)0x2014); // em-dash
-    title.append(' ');
-    title.append(m_inspectedURL);
+    String title = makeString("Web Inspector ", static_cast<UChar>(0x2014), ' ', m_inspectedURL);
     ::SetWindowText(m_frontendHwnd, title.charactersWithNullTermination());
 }
 
diff --git a/WebKit/win/WebDatabaseManager.cpp b/WebKit/win/WebDatabaseManager.cpp
index 4c23d6c..bdcb549 100644
--- a/WebKit/win/WebDatabaseManager.cpp
+++ b/WebKit/win/WebDatabaseManager.cpp
@@ -38,6 +38,7 @@
 #include "WebNotificationCenter.h"
 #include "WebSecurityOrigin.h"
 
+#include <JavaScriptCore/MainThread.h>
 #include <WebCore/BString.h>
 #include <WebCore/COMPtr.h>
 #include <WebCore/DatabaseTracker.h>
@@ -327,8 +328,40 @@ HRESULT STDMETHODCALLTYPE WebDatabaseManager::deleteDatabase(
     return S_OK;
 }
 
+class DidModifyOriginData : public Noncopyable {
+public:
+    static void dispatchToMainThread(WebDatabaseManager* databaseManager, SecurityOrigin* origin)
+    {
+        DidModifyOriginData* context = new DidModifyOriginData(databaseManager, origin->threadsafeCopy());
+        callOnMainThread(&DidModifyOriginData::dispatchDidModifyOriginOnMainThread, context);
+    }
+
+private:
+    DidModifyOriginData(WebDatabaseManager* databaseManager, PassRefPtr<SecurityOrigin> origin)
+        : databaseManager(databaseManager)
+        , origin(origin)
+    {
+    }
+
+    static void dispatchDidModifyOriginOnMainThread(void* context)
+    {
+        ASSERT(isMainThread());
+        DidModifyOriginData* info = static_cast<DidModifyOriginData*>(context);
+        info->databaseManager->dispatchDidModifyOrigin(info->origin.get());
+        delete info;
+    }
+
+    WebDatabaseManager* databaseManager;
+    RefPtr<SecurityOrigin> origin;
+};
+
 void WebDatabaseManager::dispatchDidModifyOrigin(SecurityOrigin* origin)
 {
+    if (!isMainThread()) {
+        DidModifyOriginData::dispatchToMainThread(this, origin);
+        return;
+    }
+
     static BSTR databaseDidModifyOriginName = SysAllocString(WebDatabaseDidModifyOriginNotification);
     IWebNotificationCenter* notifyCenter = WebNotificationCenter::defaultCenterInternal();
 
@@ -353,6 +386,11 @@ HRESULT STDMETHODCALLTYPE WebDatabaseManager::setQuota(
 
 void WebDatabaseManager::dispatchDidModifyDatabase(SecurityOrigin* origin, const String& databaseName)
 {
+    if (!isMainThread()) {
+        DidModifyOriginData::dispatchToMainThread(this, origin);
+        return;
+    }
+
     static BSTR databaseDidModifyOriginName = SysAllocString(WebDatabaseDidModifyDatabaseNotification);
     IWebNotificationCenter* notifyCenter = WebNotificationCenter::defaultCenterInternal();
 
diff --git a/WebKit/win/WebFrame.cpp b/WebKit/win/WebFrame.cpp
index 27da1f4..8dfe8bb 100644
--- a/WebKit/win/WebFrame.cpp
+++ b/WebKit/win/WebFrame.cpp
@@ -46,7 +46,6 @@
 #include "WebFramePolicyListener.h"
 #include "WebHistory.h"
 #include "WebHistoryItem.h"
-#include "WebIconFetcher.h"
 #include "WebKit.h"
 #include "WebKitStatisticsPrivate.h"
 #include "WebMutableURLRequest.h"
@@ -1015,27 +1014,9 @@ HRESULT STDMETHODCALLTYPE WebFrame::pendingFrameUnloadEventCount(
     return S_OK;
 }
 
-HRESULT STDMETHODCALLTYPE WebFrame::fetchApplicationIcon( 
-    /* [in] */ IWebIconFetcherDelegate *delegate,
-    /* [retval][out] */ IWebIconFetcher **result)
+HRESULT STDMETHODCALLTYPE WebFrame::unused2()
 {
-    if (!result)
-        return E_POINTER;
-
-    *result = 0;
-
-    if (!delegate)
-        return E_FAIL;
-
-    Frame* coreFrame = core(this);
-    if (!coreFrame)
-        return E_FAIL;
-
-    *result = WebIconFetcher::fetchApplicationIcon(coreFrame, delegate);
-    if (!*result)
-        return E_FAIL;
-
-    return S_OK;
+    return E_NOTIMPL;
 }
 
 // IWebDocumentText -----------------------------------------------------------
diff --git a/WebKit/win/WebFrame.h b/WebKit/win/WebFrame.h
index 21c3027..147daa8 100644
--- a/WebKit/win/WebFrame.h
+++ b/WebKit/win/WebFrame.h
@@ -187,9 +187,7 @@ public:
     virtual HRESULT STDMETHODCALLTYPE pendingFrameUnloadEventCount( 
         /* [retval][out] */ UINT* result);
 
-    virtual HRESULT STDMETHODCALLTYPE fetchApplicationIcon( 
-        /* [in] */ IWebIconFetcherDelegate *delegate,
-        /* [retval][out] */ IWebIconFetcher **result);
+    virtual HRESULT STDMETHODCALLTYPE unused2();
     
     virtual HRESULT STDMETHODCALLTYPE setInPrintingMode( 
         /* [in] */ BOOL value,
diff --git a/WebKit/win/WebIconFetcher.cpp b/WebKit/win/WebIconFetcher.cpp
deleted file mode 100644
index fbc46af..0000000
--- a/WebKit/win/WebIconFetcher.cpp
+++ /dev/null
@@ -1,129 +0,0 @@
-/*

- * Copyright (C) 2008 Apple Inc. All Rights Reserved.

- *

- * Redistribution and use in source and binary forms, with or without

- * modification, are permitted provided that the following conditions

- * are met:

- * 1. Redistributions of source code must retain the above copyright

- *    notice, this list of conditions and the following disclaimer.

- * 2. Redistributions in binary form must reproduce the above copyright

- *    notice, this list of conditions and the following disclaimer in the

- *    documentation and/or other materials provided with the distribution.

- *

- * THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY

- * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

- * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

- * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR

- * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,

- * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,

- * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR

- * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY

- * OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT

- * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE

- * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 

- */

-

-#include "config.h"

-#include "WebKitDLL.h"

-#include "WebIconFetcher.h"

-

-#include "MemoryStream.h"

-#include <WebCore/COMPtr.h>

-#include <WebCore/SharedBuffer.h>

-#include <wtf/PassRefPtr.h>

-

-using namespace WebCore;

-

-class WebIconFetcherClient : public IconFetcherClient {

-public:

-    WebIconFetcherClient(IWebIconFetcherDelegate* delegate)

-        : m_fetcher(0)

-        , m_delegate(delegate)

-    {

-    }

-

-    virtual void finishedFetchingIcon(PassRefPtr<SharedBuffer> iconData)

-    {

-        COMPtr<MemoryStream> memoryStream;

-        if (iconData)

-            memoryStream = MemoryStream::createInstance(iconData);

-

-        m_delegate->finishedLoadingIcon(m_fetcher, memoryStream.get());

-

-        delete this;

-    }

-

-   void setFetcher(WebIconFetcher *fetcher) { m_fetcher = fetcher; }

-    

-private:

-    WebIconFetcher* m_fetcher;

-    COMPtr<IWebIconFetcherDelegate> m_delegate;

-};

-

-// WebIconFetcher -------------------------------------------------------------------

-

-WebIconFetcher* WebIconFetcher::fetchApplicationIcon(Frame* frame, IWebIconFetcherDelegate* delegate)

-{

-    WebIconFetcherClient* client = new WebIconFetcherClient(delegate);

-    

-    RefPtr<IconFetcher> fetcher = IconFetcher::create(frame, client);

-    

-    if (!fetcher)

-        return 0;

-    

-    COMPtr<WebIconFetcher> iconFetcher = new WebIconFetcher(fetcher.release());

-    client->setFetcher(iconFetcher.get());

-

-    return iconFetcher.releaseRef();

-}

-

-WebIconFetcher::WebIconFetcher(PassRefPtr<IconFetcher> iconFetcher)

-    : m_refCount(0)

-    , m_iconFetcher(iconFetcher)

-{

-    gClassCount++;

-}

-

-WebIconFetcher::~WebIconFetcher()

-{

-    gClassCount--;

-}

-

-// IUnknown -------------------------------------------------------------------

-

-HRESULT STDMETHODCALLTYPE WebIconFetcher::QueryInterface(REFIID riid, void** ppvObject)

-{

-    *ppvObject = 0;

-    if (IsEqualGUID(riid, IID_IUnknown))

-        *ppvObject = static_cast<IUnknown*>(this);

-    else if (IsEqualGUID(riid, IID_IWebIconFetcher))

-        *ppvObject = static_cast<IWebIconFetcher*>(this);

-    else

-        return E_NOINTERFACE;

-

-    AddRef();

-    return S_OK;

-}

-

-ULONG STDMETHODCALLTYPE WebIconFetcher::AddRef()

-{

-    return ++m_refCount;

-}

-

-ULONG STDMETHODCALLTYPE WebIconFetcher::Release()

-{

-    ULONG newRef = --m_refCount;

-    if (!newRef)

-        delete this;

-

-    return newRef;

-}

-

-// IUnknown -------------------------------------------------------------------

-

-HRESULT STDMETHODCALLTYPE WebIconFetcher::cancel()

-{

-    m_iconFetcher->cancel();

-

-    return S_OK;

-}

diff --git a/WebKit/win/WebKit.vcproj/Interfaces.vcproj b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
index 0dab8a8..0f3b6a7 100644
--- a/WebKit/win/WebKit.vcproj/Interfaces.vcproj
+++ b/WebKit/win/WebKit.vcproj/Interfaces.vcproj
@@ -1004,26 +1004,6 @@
 			</FileConfiguration>

 		</File>

 		<File

-			RelativePath="..\Interfaces\IWebIconFetcher.idl"

-			>

-			<FileConfiguration

-				Name="Debug|Win32"

-				ExcludedFromBuild="true"

-				>

-				<Tool

-					Name="VCMIDLTool"

-				/>

-			</FileConfiguration>

-			<FileConfiguration

-				Name="Release|Win32"

-				ExcludedFromBuild="true"

-				>

-				<Tool

-					Name="VCMIDLTool"

-				/>

-			</FileConfiguration>

-		</File>

-		<File

 			RelativePath="..\Interfaces\IWebInspector.idl"

 			>

 			<FileConfiguration

@@ -1484,6 +1464,46 @@
 			</FileConfiguration>

 		</File>

 		<File

+			RelativePath="..\Interfaces\IWebSerializedJSValue.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

+			RelativePath="..\Interfaces\IWebSerializedJSValuePrivate.idl"

+			>

+			<FileConfiguration

+				Name="Debug|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+			<FileConfiguration

+				Name="Release|Win32"

+				ExcludedFromBuild="true"

+				>

+				<Tool

+					Name="VCMIDLTool"

+				/>

+			</FileConfiguration>

+		</File>

+		<File

 			RelativePath="..\Interfaces\IWebTextRenderer.idl"

 			>

 			<FileConfiguration

diff --git a/WebKit/win/WebKit.vcproj/WebKit.sln b/WebKit/win/WebKit.vcproj/WebKit.sln
index 504bae3..787650f 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.sln
+++ b/WebKit/win/WebKit.vcproj/WebKit.sln
@@ -135,11 +135,22 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "WebKitTestRunner", "..\..\.
 EndProject

 Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MiniBrowser", "..\..\..\WebKitTools\MiniBrowser\MiniBrowser.vcproj", "{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}"

 	ProjectSection(ProjectDependencies) = postProject

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28} = {3E48AB23-D249-488F-A1C4-43CDF52FBD28}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestWebKitAPI", "..\..\..\WebKitTools\TestWebKitAPI\win\TestWebKitAPI.vcproj", "{3E48AB23-D249-488F-A1C4-43CDF52FBD28}"

+	ProjectSection(ProjectDependencies) = postProject

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86} = {45C45411-7F0E-404D-919A-4EE9BB60BE86}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestWebKitAPIGenerated", "..\..\..\WebKitTools\TestWebKitAPI\win\TestWebKitAPIGenerated.vcproj", "{45C45411-7F0E-404D-919A-4EE9BB60BE86}"

+	ProjectSection(ProjectDependencies) = postProject

 		{3B99669B-1817-443B-BCBE-835580146668} = {3B99669B-1817-443B-BCBE-835580146668}

 	EndProjectSection

 EndProject

 Global

 	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		all|Win32 = all|Win32

 		Debug_All|Win32 = Debug_All|Win32

 		Debug_Cairo|Win32 = Debug_Cairo|Win32

 		Debug_Internal|Win32 = Debug_Internal|Win32

@@ -148,6 +159,8 @@ Global
 		Release|Win32 = Release|Win32

 	EndGlobalSection

 	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.all|Win32.ActiveCfg = Debug_All|Win32

+		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.all|Win32.Build.0 = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -160,6 +173,8 @@ Global
 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.ActiveCfg = Release|Win32

 		{011D10F1-B656-4A1B-A0C3-3842F02122C5}.Release|Win32.Build.0 = Release|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.all|Win32.ActiveCfg = Debug_All|Win32

+		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.all|Win32.Build.0 = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -172,6 +187,8 @@ Global
 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.ActiveCfg = Release|Win32

 		{1C16337B-ACF3-4D03-AA90-851C5B5EADA6}.Release|Win32.Build.0 = Release|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.all|Win32.ActiveCfg = Debug_All|Win32

+		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.all|Win32.Build.0 = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

@@ -184,6 +201,8 @@ Global
 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.ActiveCfg = Release|Win32

 		{AA8A5A85-592B-4357-BC60-E0E91E026AF6}.Release|Win32.Build.0 = Release|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.all|Win32.ActiveCfg = Debug_All|Win32

+		{C59E5129-B453-49B7-A52B-1E104715F76E}.all|Win32.Build.0 = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -196,6 +215,8 @@ Global
 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.ActiveCfg = Release|Win32

 		{C59E5129-B453-49B7-A52B-1E104715F76E}.Release|Win32.Build.0 = Release|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.all|Win32.ActiveCfg = all|Win32

+		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.all|Win32.Build.0 = all|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.ActiveCfg = all|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_All|Win32.Build.0 = all|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Debug_Cairo|Win32.ActiveCfg = all|Win32

@@ -208,6 +229,8 @@ Global
 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release_Cairo|Win32.Build.0 = all|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.ActiveCfg = all|Win32

 		{4FF5BA11-59EC-4C24-8F52-F235C2E7D43A}.Release|Win32.Build.0 = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.all|Win32.ActiveCfg = all|Win32

+		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.all|Win32.Build.0 = all|Win32

 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.ActiveCfg = cairo|Win32

 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_All|Win32.Build.0 = cairo|Win32

 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Debug_Cairo|Win32.ActiveCfg = cairo|Win32

@@ -220,6 +243,8 @@ Global
 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release_Cairo|Win32.Build.0 = cairo|Win32

 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.ActiveCfg = all|Win32

 		{0A324352-B3B6-496C-9E5B-4C7E923E628B}.Release|Win32.Build.0 = all|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.all|Win32.ActiveCfg = Debug_All|Win32

+		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.all|Win32.Build.0 = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

@@ -228,9 +253,10 @@ Global
 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.ActiveCfg = Debug|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Debug|Win32.Build.0 = Debug|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_Cairo|Win32.ActiveCfg = Release|Win32

-		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.ActiveCfg = Release|Win32

 		{E498CA9D-3BD2-4D52-8E37-C8DC76526325}.Release|Win32.Build.0 = Release|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.all|Win32.ActiveCfg = Debug_All|Win32

+		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.all|Win32.Build.0 = Debug_All|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -243,6 +269,8 @@ Global
 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.ActiveCfg = Release|Win32

 		{1AFD081F-1AC7-4A97-8EFA-6DF97761A3A2}.Release|Win32.Build.0 = Release|Win32

+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.all|Win32.ActiveCfg = Debug_All|Win32

+		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.all|Win32.Build.0 = Debug_All|Win32

 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -255,6 +283,8 @@ Global
 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.ActiveCfg = Release|Win32

 		{2E51ABE8-76CB-485B-A66C-46AEF4DF8ACD}.Release|Win32.Build.0 = Release|Win32

+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.all|Win32.ActiveCfg = all|Win32

+		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.all|Win32.Build.0 = all|Win32

 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_All|Win32.ActiveCfg = all|Win32

 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_All|Win32.Build.0 = all|Win32

 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Debug_Cairo|Win32.ActiveCfg = all|Win32

@@ -267,6 +297,8 @@ Global
 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release_Cairo|Win32.Build.0 = all|Win32

 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.ActiveCfg = all|Win32

 		{2EDAD637-CBA8-4E55-97ED-7D2BBC336FDB}.Release|Win32.Build.0 = all|Win32

+		{AAE88FEF-509E-4D49-870B-7357922C276F}.all|Win32.ActiveCfg = Debug_CFLite|Win32

+		{AAE88FEF-509E-4D49-870B-7357922C276F}.all|Win32.Build.0 = Debug_CFLite|Win32

 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -279,6 +311,8 @@ Global
 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.ActiveCfg = Release|Win32

 		{AAE88FEF-509E-4D49-870B-7357922C276F}.Release|Win32.Build.0 = Release|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.all|Win32.ActiveCfg = Release|Win32

+		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.all|Win32.Build.0 = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.ActiveCfg = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_All|Win32.Build.0 = Debug|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

@@ -291,6 +325,8 @@ Global
 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.ActiveCfg = Release|Win32

 		{91762BE2-87EF-4F5A-A480-48B90EB3F406}.Release|Win32.Build.0 = Release|Win32

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.all|Win32.ActiveCfg = Debug_All|Win32

+		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.all|Win32.Build.0 = Debug_All|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -303,6 +339,8 @@ Global
 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.ActiveCfg = Release|Win32

 		{0662A8A9-82A3-4638-97D8-EC425D8D87C9}.Release|Win32.Build.0 = Release|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.all|Win32.ActiveCfg = Debug_All|Win32

+		{B8437A41-67BC-4769-9452-45203827F821}.all|Win32.Build.0 = Debug_All|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

@@ -315,6 +353,8 @@ Global
 		{B8437A41-67BC-4769-9452-45203827F821}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.ActiveCfg = Release|Win32

 		{B8437A41-67BC-4769-9452-45203827F821}.Release|Win32.Build.0 = Release|Win32

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.all|Win32.ActiveCfg = Debug_All|Win32

+		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.all|Win32.Build.0 = Debug_All|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -327,10 +367,12 @@ Global
 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release_Cairo|Win32.Build.0 = Release_Cairo|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.ActiveCfg = Release|Win32

 		{6567DFD4-D6DE-4CD5-825D-17E353D160E1}.Release|Win32.Build.0 = Release|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.all|Win32.ActiveCfg = Debug_Cairo|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.all|Win32.Build.0 = Debug_Cairo|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_All|Win32.Build.0 = Debug_All|Win32

-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.ActiveCfg = Debug|Win32

-		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.Build.0 = Debug|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

+		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Debug|Win32.ActiveCfg = Debug|Win32

@@ -339,6 +381,8 @@ Global
 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.ActiveCfg = Release|Win32

 		{59CC0547-70AC-499C-9B19-EC01C6F61137}.Release|Win32.Build.0 = Release|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.all|Win32.ActiveCfg = all|Win32

+		{DA31DA52-6675-48D4-89E0-333A7144397C}.all|Win32.Build.0 = all|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.ActiveCfg = all|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_All|Win32.Build.0 = all|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Debug_Cairo|Win32.ActiveCfg = all|Win32

@@ -351,6 +395,8 @@ Global
 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release_Cairo|Win32.Build.0 = all|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.ActiveCfg = all|Win32

 		{DA31DA52-6675-48D4-89E0-333A7144397C}.Release|Win32.Build.0 = all|Win32

+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.all|Win32.ActiveCfg = Release|Win32

+		{44B9C152-1870-4035-B94D-7B3285AA0C12}.all|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_All|Win32.ActiveCfg = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_All|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

@@ -363,6 +409,8 @@ Global
 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release|Win32.ActiveCfg = Release|Win32

 		{44B9C152-1870-4035-B94D-7B3285AA0C12}.Release|Win32.Build.0 = Release|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.all|Win32.ActiveCfg = Debug_All|Win32

+		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.all|Win32.Build.0 = Debug_All|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -375,6 +423,8 @@ Global
 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.ActiveCfg = Release|Win32

 		{C0737398-3565-439E-A2B8-AB2BE4D5430C}.Release|Win32.Build.0 = Release|Win32

+		{626089A3-25D3-4883-A96C-B8C66E036397}.all|Win32.ActiveCfg = Debug_Cairo|Win32

+		{626089A3-25D3-4883-A96C-B8C66E036397}.all|Win32.Build.0 = Debug_Cairo|Win32

 		{626089A3-25D3-4883-A96C-B8C66E036397}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{626089A3-25D3-4883-A96C-B8C66E036397}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{626089A3-25D3-4883-A96C-B8C66E036397}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -387,6 +437,8 @@ Global
 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release_Cairo|Win32.Build.0 = Debug_Cairo|Win32

 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release|Win32.ActiveCfg = Debug|Win32

 		{626089A3-25D3-4883-A96C-B8C66E036397}.Release|Win32.Build.0 = Debug|Win32

+		{D09806DB-E58B-4646-8C9B-61101906C1E2}.all|Win32.ActiveCfg = Release|Win32

+		{D09806DB-E58B-4646-8C9B-61101906C1E2}.all|Win32.Build.0 = Release|Win32

 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Debug_All|Win32.ActiveCfg = Release|Win32

 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Debug_All|Win32.Build.0 = Release|Win32

 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Debug_Cairo|Win32.ActiveCfg = Release|Win32

@@ -399,6 +451,8 @@ Global
 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release|Win32.ActiveCfg = Release|Win32

 		{D09806DB-E58B-4646-8C9B-61101906C1E2}.Release|Win32.Build.0 = Release|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.all|Win32.ActiveCfg = Debug_All|Win32

+		{114FCA11-216B-4C8C-957E-30A75AE80443}.all|Win32.Build.0 = Debug_All|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Debug_Cairo|Win32.ActiveCfg = Debug_Cairo|Win32

@@ -411,6 +465,8 @@ Global
 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release_Cairo|Win32.Build.0 = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.ActiveCfg = Release|Win32

 		{114FCA11-216B-4C8C-957E-30A75AE80443}.Release|Win32.Build.0 = Release|Win32

+		{CBC3391C-F060-4BF5-A66E-81404168816B}.all|Win32.ActiveCfg = Release_CFLite|Win32

+		{CBC3391C-F060-4BF5-A66E-81404168816B}.all|Win32.Build.0 = Release_CFLite|Win32

 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -423,6 +479,8 @@ Global
 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.ActiveCfg = Release|Win32

 		{CBC3391C-F060-4BF5-A66E-81404168816B}.Release|Win32.Build.0 = Release|Win32

+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.all|Win32.ActiveCfg = all|Win32

+		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.all|Win32.Build.0 = all|Win32

 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_All|Win32.ActiveCfg = all|Win32

 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_All|Win32.Build.0 = all|Win32

 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Debug_Cairo|Win32.ActiveCfg = all|Win32

@@ -435,6 +493,8 @@ Global
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release_Cairo|Win32.Build.0 = all|Win32

 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.ActiveCfg = all|Win32

 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD}.Release|Win32.Build.0 = all|Win32

+		{3B99669B-1817-443B-BCBE-835580146668}.all|Win32.ActiveCfg = Release_CFLite|Win32

+		{3B99669B-1817-443B-BCBE-835580146668}.all|Win32.Build.0 = Release_CFLite|Win32

 		{3B99669B-1817-443B-BCBE-835580146668}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{3B99669B-1817-443B-BCBE-835580146668}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{3B99669B-1817-443B-BCBE-835580146668}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -447,6 +507,8 @@ Global
 		{3B99669B-1817-443B-BCBE-835580146668}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.ActiveCfg = Release|Win32

 		{3B99669B-1817-443B-BCBE-835580146668}.Release|Win32.Build.0 = Release|Win32

+		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.all|Win32.ActiveCfg = Release_CFLite|Win32

+		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.all|Win32.Build.0 = Release_CFLite|Win32

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Debug_All|Win32.Build.0 = Debug_All|Win32

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

@@ -459,6 +521,34 @@ Global
 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release|Win32.ActiveCfg = Release|Win32

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5}.Release|Win32.Build.0 = Release|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.all|Win32.ActiveCfg = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.all|Win32.Build.0 = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Cairo|Win32.ActiveCfg = Debug_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Cairo|Win32.Build.0 = Debug_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.ActiveCfg = Debug|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.Build.0 = Debug|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo|Win32.ActiveCfg = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_Cairo|Win32.Build.0 = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.ActiveCfg = Release|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.Build.0 = Release|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.all|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.all|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Cairo|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Cairo|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Internal|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_Cairo|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.Build.0 = all|Win32

 	EndGlobalSection

 	GlobalSection(SolutionProperties) = preSolution

 		HideSolutionNode = FALSE

@@ -490,5 +580,7 @@ Global
 		{4343BC0B-A2E0-4B48-8277-F33CFBFA83CD} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}

 		{3B99669B-1817-443B-BCBE-835580146668} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}

 		{1480CF5F-4160-47B5-A0E6-96AEC8258FB5} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86} = {62DCDFE4-EAD2-48E1-A2BD-BD54AD3C7459}

 	EndGlobalSection

 EndGlobal

diff --git a/WebKit/win/WebKit.vcproj/WebKit.vcproj b/WebKit/win/WebKit.vcproj/WebKit.vcproj
index 822e13c..9740947 100644
--- a/WebKit/win/WebKit.vcproj/WebKit.vcproj
+++ b/WebKit/win/WebKit.vcproj/WebKit.vcproj
@@ -612,10 +612,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\WebIconFetcher.h"

-				>

-			</File>

-			<File

 				RelativePath="..\WebInspector.h"

 				>

 			</File>

@@ -1036,10 +1032,6 @@
 				>

 			</File>

 			<File

-				RelativePath="..\WebIconFetcher.cpp"

-				>

-			</File>

-			<File

 				RelativePath="..\WebInspector.cpp"

 				>

 			</File>

diff --git a/WebKit/win/WebKitGraphics.cpp b/WebKit/win/WebKitGraphics.cpp
index e9e25ab..5343608 100644
--- a/WebKit/win/WebKitGraphics.cpp
+++ b/WebKit/win/WebKitGraphics.cpp
@@ -112,7 +112,7 @@ void WebDrawText(WebTextRenderInfo* info)
         // Set shadow setting
         if (info->structSize == sizeof(WebTextRenderInfo) &&
             (info->shadowOffset.cx || info->shadowOffset.cy || info->shadowBlur || info->shadowColor))
-            context.setShadow(FloatSize(info->shadowOffset.cx, info->shadowOffset.cy), info->shadowBlur, info->shadowColor, DeviceColorSpace);
+            context.setShadow(FloatSize(info->shadowOffset.cx, info->shadowOffset.cy), info->shadowBlur, info->shadowColor, ColorSpaceDeviceRGB);
 
         WebCoreDrawTextAtPoint(context, drawString, info->pt, makeFont(*(info->description)), info->color, info->underlinedIndex);
         context.restore();
diff --git a/WebKit/win/WebSerializedJSValue.cpp b/WebKit/win/WebSerializedJSValue.cpp
index 307df90..7f6e3b0 100644
--- a/WebKit/win/WebSerializedJSValue.cpp
+++ b/WebKit/win/WebSerializedJSValue.cpp
@@ -69,10 +69,12 @@ HRESULT WebSerializedJSValue::QueryInterface(REFIID riid, void** ppvObject)
 
     if (IsEqualIID(riid, __uuidof(WebSerializedJSValue)))
         *ppvObject = this;
+    else if (IsEqualGUID(riid, IID_IUnknown))
+        *ppvObject = static_cast<IWebSerializedJSValue*>(this);
     else if (IsEqualIID(riid, __uuidof(IWebSerializedJSValue)))
         *ppvObject = static_cast<IWebSerializedJSValue*>(this);
-    else if (IsEqualIID(riid, IID_IUnknown))
-        *ppvObject = static_cast<IUnknown*>(this);
+    else if (IsEqualIID(riid, __uuidof(IWebSerializedJSValuePrivate)))
+        *ppvObject = static_cast<IWebSerializedJSValuePrivate*>(this);
     else
         return E_NOINTERFACE;
 
@@ -105,3 +107,23 @@ HRESULT WebSerializedJSValue::deserialize(JSContextRef destinationContext, JSVal
 
     return S_OK;
 }
+
+HRESULT WebSerializedJSValue::setInternalRepresentation(void* internalRepresentation)
+{
+    if (!internalRepresentation || m_value)
+        return E_POINTER;
+
+    m_value = reinterpret_cast<SerializedScriptValue*>(internalRepresentation);
+
+    return S_OK;
+}
+
+HRESULT WebSerializedJSValue::getInternalRepresentation(void** internalRepresentation)
+{
+    if (!m_value)
+        return E_POINTER;
+
+    *internalRepresentation = m_value.get();
+    return S_OK;
+}
+
diff --git a/WebKit/win/WebSerializedJSValue.h b/WebKit/win/WebSerializedJSValue.h
index d39323c..a2d6d56 100644
--- a/WebKit/win/WebSerializedJSValue.h
+++ b/WebKit/win/WebSerializedJSValue.h
@@ -34,7 +34,7 @@ namespace WebCore {
     class SerializedScriptValue;
 }
 
-class WebSerializedJSValue : public Noncopyable, public IWebSerializedJSValue {
+class WebSerializedJSValue : public Noncopyable, public IWebSerializedJSValue, public IWebSerializedJSValuePrivate {
 public:
     static COMPtr<WebSerializedJSValue> createInstance();
 
@@ -43,6 +43,8 @@ public:
 
     virtual HRESULT STDMETHODCALLTYPE serialize(JSContextRef, JSValueRef value, JSValueRef* exception);
     virtual HRESULT STDMETHODCALLTYPE deserialize(JSContextRef, JSValueRef* result);
+    virtual HRESULT STDMETHODCALLTYPE setInternalRepresentation(void* internalRepresentation);
+    virtual HRESULT STDMETHODCALLTYPE getInternalRepresentation(void** internalRepresentation);
 
 private:
     WebSerializedJSValue();
diff --git a/WebKit/win/WebURLProtectionSpace.cpp b/WebKit/win/WebURLProtectionSpace.cpp
index c3d78bb..6086abb 100644
--- a/WebKit/win/WebURLProtectionSpace.cpp
+++ b/WebKit/win/WebURLProtectionSpace.cpp
@@ -166,8 +166,6 @@ HRESULT STDMETHODCALLTYPE WebURLProtectionSpace::initWithHost(
         serverType = ProtectionSpaceServerFTP;
     else if (BString(protocol) == webURLProtectionSpaceFTPSBString)
         serverType = ProtectionSpaceServerFTPS;
-    else
-        ASSERT_NOT_REACHED();
 
     m_protectionSpace = ProtectionSpace(String(host, SysStringLen(host)), port, serverType, 
         String(realm, SysStringLen(realm)), coreScheme(authenticationMethod));
diff --git a/WebKit/win/WebView.cpp b/WebKit/win/WebView.cpp
index 547daf8..b57e06a 100755..100644
--- a/WebKit/win/WebView.cpp
+++ b/WebKit/win/WebView.cpp
@@ -159,6 +159,7 @@
 #include <windowsx.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
 // Soft link functions for gestures and panning feedback
 SOFT_LINK_LIBRARY(USER32);
@@ -1200,7 +1201,9 @@ bool WebView::canHandleRequest(const WebCore::ResourceRequest& request)
 
 String WebView::standardUserAgentWithApplicationName(const String& applicationName)
 {
-    return String::format("Mozilla/5.0 (Windows; U; %s; %s) AppleWebKit/%s (KHTML, like Gecko)%s%s", osVersion().latin1().data(), defaultLanguage().latin1().data(), webKitVersion().latin1().data(), (applicationName.length() ? " " : ""), applicationName.latin1().data());
+    if (applicationName.isEmpty())
+        return makeString("Mozilla/5.0 (Windows; U; ", osVersion(), "; ", defaultLanguage(), ") AppleWebKit/", webKitVersion(), " (KHTML, like Gecko)");
+    return makeString("Mozilla/5.0 (Windows; U; ", osVersion(), "; ", defaultLanguage(), ") AppleWebKit/", webKitVersion(), " (KHTML, like Gecko) ", applicationName);
 }
 
 Page* WebView::page()
@@ -2310,11 +2313,10 @@ static String osVersion()
                 osVersion = "Windows 98; Win 9x 4.90";
         }
     } else if (versionInfo.dwPlatformId == VER_PLATFORM_WIN32_NT)
-        osVersion = String::format("Windows NT %d.%d", versionInfo.dwMajorVersion, versionInfo.dwMinorVersion);
+        osVersion = makeString("Windows NT ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
 
     if (!osVersion.length())
-        osVersion = String::format("Windows %d.%d", versionInfo.dwMajorVersion, versionInfo.dwMinorVersion);
-
+        osVersion = makeString("Windows ", String::number(versionInfo.dwMajorVersion), '.', String::number(versionInfo.dwMinorVersion));
     return osVersion;
 }
 
@@ -2348,7 +2350,7 @@ static String webKitVersion()
     UINT productVersionLength;
     if (!VerQueryValue(data, (LPTSTR)(LPCTSTR)key, (void**)&productVersion, &productVersionLength))
         goto exit;
-    versionStr = String(productVersion, productVersionLength);
+    versionStr = String(productVersion, productVersionLength - 1);
 
 exit:
     if (data)
diff --git a/WebKit/win/WebView.h b/WebKit/win/WebView.h
index 61eb946..61eb946 100755..100644
--- a/WebKit/win/WebView.h
+++ b/WebKit/win/WebView.h
diff --git a/WebKit/wince/ChangeLog b/WebKit/wince/ChangeLog
index c85f902..8d99b5c 100644
--- a/WebKit/wince/ChangeLog
+++ b/WebKit/wince/ChangeLog
@@ -1,3 +1,14 @@
+2010-10-15  Nikolas Zimmermann  <nzimmermann@rim.com>
+
+        Reviewed by Dirk Schulze.
+
+        Replace some String::format() usages by StringConcatenate in WebKit
+        https://bugs.webkit.org/show_bug.cgi?id=47714
+
+        * WebCoreSupport/PlatformStrategiesWinCE.cpp:
+        (PlatformStrategiesWinCE::imageTitle):
+        (PlatformStrategiesWinCE::multipleFileUploadText):
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp b/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
index 514fdf4..557d899 100644
--- a/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
+++ b/WebKit/wince/WebCoreSupport/PlatformStrategiesWinCE.cpp
@@ -27,14 +27,16 @@
 #include "PlatformStrategiesWinCE.h"
 
 #include "IntSize.h"
-#include "MathExtras.h"
 #include "Page.h"
 #include "PageGroup.h"
 #include "PluginDatabase.h"
+
+#include <wtf/MathExtras.h>
 #include <wtf/text/CString.h>
+#include <wtf/text/StringConcatenate.h>
 
-#define UI_STRING(text, desciprion) text
-#define UI_STRING_KEY(text, key, desciprion) text
+#define UI_STRING(text, description) text
+#define UI_STRING_KEY(text, key, description) text
 
 using namespace WebCore;
 
@@ -489,13 +491,13 @@ String PlatformStrategiesWinCE::crashedPluginText()
 
 String PlatformStrategiesWinCE::imageTitle(const String& filename, const IntSize& size) 
 {
-    CString filenameCString = filename.utf8();
-    return String::format(UI_STRING("%s %d\xC3\x97%d pixels", "window title for a standalone image (uses multiplication symbol, not x)"), filenameCString.data(), size.width(), size.height());
+    return UI_STRING(makeString(filename, ' ', String::number(size.width()), "\xC3\x97", String::number(size.height()), " pixels"),
+                     "window title for a standalone image (uses multiplication symbol, not x)");
 }
 
 String PlatformStrategiesWinCE::multipleFileUploadText(unsigned numberOfFiles)
 {
-    return String::format(UI_STRING("%d files", "Label to describe the number of files selected in a file upload control that allows multiple files"), numberOfFiles);
+    return UI_STRING(makeString(String::number(numberOfFiles), " files"), "Label to describe the number of files selected in a file upload control that allows multiple files");
 }
 
 String PlatformStrategiesWinCE::mediaElementLoadingStateText()
diff --git a/WebKit/wx/ChangeLog b/WebKit/wx/ChangeLog
index abbc87b..b7ec1f6 100644
--- a/WebKit/wx/ChangeLog
+++ b/WebKit/wx/ChangeLog
@@ -1,3 +1,14 @@
+2010-10-13  Gavin Barraclough  <barraclough@apple.com>
+
+        Reviewed by Oliver Hunt.
+
+        https://bugs.webkit.org/show_bug.cgi?id=43987
+        Switch XMLHttpRequest, FileReader, and FileReaderSync to use a Stringbuilder
+        to construct their internal result string.  Remove ScriptString (this is now
+        redundant).
+
+        * WebKitSupport/FrameLoaderClientWx.cpp:
+
 2010-09-28  Jenn Braithwaite  <jennb@chromium.org>
 
         Reviewed by Dmitry Titov.
diff --git a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
index 93a62ca..7963ef9 100644
--- a/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
+++ b/WebKit/wx/WebKitSupport/FrameLoaderClientWx.cpp
@@ -49,7 +49,6 @@
 #include "ResourceError.h"
 #include "ResourceResponse.h"
 #include "ScriptController.h"
-#include "ScriptString.h"
 #include <wtf/PassRefPtr.h>
 #include <wtf/RefPtr.h>
 
diff --git a/WebKitLibraries/ChangeLog b/WebKitLibraries/ChangeLog
index bcd8fab..e15958d 100644
--- a/WebKitLibraries/ChangeLog
+++ b/WebKitLibraries/ChangeLog
@@ -1,3 +1,72 @@
+2010-10-20  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+        Use a WKCFURLCredentialRef type to protect against changes to the
+        definition of CFURLCredentialRef.
+
+2010-10-19  Adam Roben  <aroben@apple.com>
+
+        Windows build fix
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h: Check in
+        this file that I meant to check in in r70129.
+
+2010-10-19  Adam Roben  <aroben@apple.com>
+
+        Add WKCACFContext and related functions
+
+        Fixes <http://webkit.org/b/43244>.
+
+        Reviewed by Sam Weinig.
+
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+
+2010-10-14  Ada Chan  <adachan@apple.com>
+
+        Rubber-stamped by Adam Roben.
+
+        Fix Windows build.
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+
+2010-10-14  Ada Chan  <adachan@apple.com>
+
+        Reviewed by Steve Falkenburg.
+
+        Add wkGetSSLCertificateChainContext for fetching the certificate chain.
+        Needed for https://bugs.webkit.org/show_bug.cgi?id=47603.
+
+        * win/include/WebKitSystemInterface/WebKitSystemInterface.h:
+        * win/lib/WebKitSystemInterface.lib:
+        * win/lib/WebKitSystemInterface_debug.lib:
+
+2010-10-11  Mike Thole  <mthole@apple.com>
+
+        Reviewed by Darin Adler.
+
+        Rename WKCertificateInfoGetPeerCertificates() to WKCertificateInfoGetCertificateChain()
+        https://bugs.webkit.org/show_bug.cgi?id=47495
+
+        * WebKitSystemInterface.h: 
+        * libWebKitSystemInterfaceLeopard.a:
+        * libWebKitSystemInterfaceSnowLeopard.a:
+
+2010-10-03  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build fix.
+
+        WinCairo also needs access to the <inttypes.h> header requirement
+        introduced by Bug 46357.
+
+        * win/tools/vsprops/WinCairo.vsprops:
+
 2010-09-17  Sam Weinig  <sam@webkit.org>
 
         Reviewed, tweaked, and landed by Anders Carlsson.
diff --git a/WebKitLibraries/WebKitSystemInterface.h b/WebKitLibraries/WebKitSystemInterface.h
index 8cb0770..b67906d 100644
--- a/WebKitLibraries/WebKitSystemInterface.h
+++ b/WebKitLibraries/WebKitSystemInterface.h
@@ -34,7 +34,7 @@ NSTimeInterval WKGetNSURLResponseFreshnessLifetime(NSURLResponse *response);
 NSString *WKCopyNSURLResponseStatusLine(NSURLResponse *response);
 
 #if !defined(BUILDING_ON_TIGER) && !defined(BUILDING_ON_LEOPARD)
-CFArrayRef WKCopyNSURLResponsePeerCertificates(NSURLResponse *response);
+CFArrayRef WKCopyNSURLResponseCertificateChain(NSURLResponse *response);
 #endif
 
 CFStringEncoding WKGetWebDefaultCFStringEncoding(void);
diff --git a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
index b3a7ebc..87e9b2d 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceLeopard.a
diff --git a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
index aefd269..7ac0fcb 100644
--- a/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
+++ b/WebKitLibraries/libWebKitSystemInterfaceSnowLeopard.a
diff --git a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
index 80830a7..a87cfb6 100644
--- a/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
+++ b/WebKitLibraries/win/include/WebKitSystemInterface/WebKitSystemInterface.h
@@ -30,9 +30,14 @@ struct CGAffineTransform;
 struct CGPoint;
 struct CGRect;
 struct CGSize;
+struct IDirect3DDevice9;
+struct WKCACFContext;
+struct WKCACFUpdateRectEnumerator;
 
+typedef struct _CACFLayer* CACFLayerRef;
 typedef const struct __CFData* CFDataRef;
 typedef const struct __CFString* CFStringRef;
+typedef double CFTimeInterval;
 typedef struct CGColor* CGColorRef;
 typedef struct CGContext* CGContextRef;
 typedef unsigned short CGFontIndex;
@@ -43,7 +48,6 @@ typedef struct _CFURLResponse* CFURLResponseRef;
 typedef struct OpaqueCFHTTPCookieStorage*  CFHTTPCookieStorageRef;
 typedef struct _CFURLRequest* CFMutableURLRequestRef;
 typedef const struct _CFURLRequest* CFURLRequestRef;
-typedef struct _CFURLCredential* CFURLCredentialRef;
 typedef struct __CFHTTPMessage* CFHTTPMessageRef;
 typedef const struct __CFNumber* CFNumberRef;
 typedef struct __CFReadStream* CFReadStreamRef;
@@ -51,6 +55,13 @@ typedef const struct __CFURL* CFURLRef;
 typedef struct _CFURLProtectionSpace* CFURLProtectionSpaceRef;
 typedef struct tagLOGFONTW LOGFONTW;
 typedef LOGFONTW LOGFONT;
+typedef struct _CACFLayer *CACFLayerRef;
+typedef struct __CVBuffer *CVBufferRef;
+typedef CVBufferRef CVImageBufferRef;
+typedef CVImageBufferRef CVPixelBufferRef;
+typedef struct _CAImageQueue *CAImageQueueRef;
+typedef unsigned long CFTypeID;
+typedef struct _CFURLCredential* WKCFURLCredentialRef;
 
 void wkSetFontSmoothingLevel(int type);
 int wkGetFontSmoothingLevel();
@@ -72,6 +83,7 @@ void wkDrawFocusRing(CGContextRef, CGColorRef, float radius);
 
 CFDictionaryRef wkGetSSLCertificateInfo(CFURLResponseRef);
 void* wkGetSSLPeerCertificateData(CFDictionaryRef);
+void* wkGetSSLCertificateChainContext(CFDictionaryRef);
 CFHTTPCookieStorageRef wkGetDefaultHTTPCookieStorage();
 void wkSetCFURLRequestShouldContentSniff(CFMutableURLRequestRef, bool);
 CFStringRef wkCopyFoundationCacheDirectory();
@@ -86,10 +98,63 @@ void wkSetCONNECTProxyForStream(CFReadStreamRef, CFStringRef proxyHost, CFNumber
 void wkSetCONNECTProxyAuthorizationForStream(CFReadStreamRef, CFStringRef proxyAuthorizationString);
 CFHTTPMessageRef wkCopyCONNECTProxyResponse(CFReadStreamRef, CFURLRef responseURL);
 
-CFURLCredentialRef wkCopyCredentialFromCFPersistentStorage(CFURLProtectionSpaceRef protectionSpace);
+WKCFURLCredentialRef wkCopyCredentialFromCFPersistentStorage(CFURLProtectionSpaceRef protectionSpace);
 
 CFStringRef wkCFNetworkErrorGetLocalizedDescription(CFIndex errorCode);
 
+
+enum wkCAImageQueueFlags {
+    kWKCAImageQueueAsync = 1U << 0,
+    kWKCAImageQueueFill = 1U << 1,
+    kWKCAImageQueueProtected = 1U << 2,
+    kWKCAImageQueueUseCleanAperture = 1U << 3,
+    kWKCAImageQueueUseAspectRatio = 1U << 4,
+    kWKCAImageQueueLowQualityColor = 1U << 5,
+};
+
+enum wkWKCAImageQueueImageType {
+    kWKCAImageQueueNil = 1,
+    kWKCAImageQueueSurface,
+    kWKCAImageQueueBuffer,
+    kWKCAImageQueueIOSurface,
+};
+
+enum wkWKCAImageQueueImageFlags {
+    kWKCAImageQueueOpaque = 1U << 0,
+    kWKCAImageQueueFlush = 1U << 1,
+    kWKCAImageQueueWillFlush = 1U << 2,
+    kWKCAImageQueueFlipped = 1U << 3,
+    kWKCAImageQueueWaitGPU = 1U << 4,
+};
+
+typedef void (*wkCAImageQueueReleaseCallback)(unsigned int type, uint64_t id, void *info);
+CAImageQueueRef wkCAImageQueueCreate(uint32_t width, uint32_t height, uint32_t capacity);
+void wkCAImageQueueInvalidate(CAImageQueueRef iq);
+size_t wkCAImageQueueCollect(CAImageQueueRef iq);
+bool wkCAImageQueueInsertImage(CAImageQueueRef iq, CFTimeInterval t, unsigned int type, uint64_t id, uint32_t flags, wkCAImageQueueReleaseCallback release, void *info);
+uint64_t wkCAImageQueueRegisterPixelBuffer(CAImageQueueRef iq, void *data, size_t data_size, size_t rowbytes, size_t width, size_t height, OSType pixel_format, CFDictionaryRef attachments, uint32_t flags);
+void wkCAImageQueueSetFlags(CAImageQueueRef iq, uint32_t mask, uint32_t flags);
+uint32_t wkCAImageQueueGetFlags(CAImageQueueRef iq);
+CFTypeID wkCAImageQueueGetTypeID(void);
+
+WKCACFContext* wkCACFContextCreate();
+void wkCACFContextDestroy(WKCACFContext*);
+
+void wkCACFContextSetLayer(WKCACFContext*, CACFLayerRef);
+void wkCACFContextFlush(WKCACFContext*);
+
+void wkCACFContextInitializeD3DDevice(WKCACFContext*, IDirect3DDevice9*);
+void wkCACFContextReleaseD3DResources(WKCACFContext*);
+
+bool wkCACFContextBeginUpdate(WKCACFContext*, void* buffer, size_t bufferSize, CFTimeInterval time, const CGRect& bounds, const CGRect dirtyRects[], size_t dirtyRectCount);
+void wkCACFContextRenderUpdate(WKCACFContext*);
+void wkCACFContextFinishUpdate(WKCACFContext*);
+void wkCACFContextAddUpdateRect(WKCACFContext*, const CGRect&);
+
+WKCACFUpdateRectEnumerator* wkCACFContextCopyUpdateRectEnumerator(WKCACFContext*);
+const CGRect* wkCACFUpdateRectEnumeratorNextRect(WKCACFUpdateRectEnumerator*);
+void wkCACFUpdateRectEnumeratorRelease(WKCACFUpdateRectEnumerator*);
+
 typedef enum {
     WKMediaUIPartFullscreenButton   = 0,
     WKMediaUIPartMuteButton,
@@ -126,10 +191,18 @@ typedef enum {
     WKMediaControllerFlagFocused = 1 << 4
 } WKMediaControllerThemeState;
 
+#ifdef __cplusplus
+extern "C" {
+#endif
+
 bool WKMediaControllerThemeAvailable(int themeStyle);
 bool WKHitTestMediaUIPart(int part, int themeStyle, CGRect bounds, CGPoint point);
 void WKMeasureMediaUIPart(int part, int themeStyle, CGRect *bounds, CGSize *naturalSize);
 void WKDrawMediaUIPart(int part, int themeStyle, CGContextRef context, CGRect rect, unsigned state);
 void WKDrawMediaSliderTrack(int themeStyle, CGContextRef context, CGRect rect, float timeLoaded, float currentTime, float duration, unsigned state);
 
+#ifdef __cplusplus
+}
+#endif
+
 #endif // WebKitSystemInterface_h
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface.lib b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
index 40513e6..6e2018b 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface.lib
diff --git a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
index 124c241..b9f1433 100644
--- a/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
+++ b/WebKitLibraries/win/lib/WebKitSystemInterface_debug.lib
diff --git a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
index 60873a3..9710568 100644
--- a/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
+++ b/WebKitLibraries/win/tools/vsprops/WinCairo.vsprops
@@ -4,10 +4,10 @@
 	Version="8.00"

 	Name="WinCairo"

 	>

-  <Tool

+	<Tool

 		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;;&quot;$(SolutionDir)\..\..\..\JavaScriptCore\os-win32&quot;"

 		PreprocessorDefinitions="WIN_CAIRO=1"

-		AdditionalIncludeDirectories="&quot;$(WebKitLibrariesDir)\include\cairo&quot;"

 	/>

 	<Tool

 		Name="VCLinkerTool"

diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
index 2a4a351..91a13e7 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/config.json
@@ -45,7 +45,11 @@
                     { "name": "google-windows-2", "platform": "chromium-win" },
                     { "name": "google-mac-2", "platform": "chromium-mac" },
                     { "name": "google-linux-2", "platform": "chromium-linux" },
-                    { "name": "google-new-tests", "platform": "mac-leopard" }
+                    { "name": "google-new-tests", "platform": "mac-leopard" },
+
+                    { "name": "wincairo-1", "platform": "wincairo" },
+                    
+                    { "name": "efl-linux-slave-1", "platform": "efl" }
                   ],
 
     "builders":   [ { "name": "Leopard Intel Release (Build)", "type": "Build", "builddir": "leopard-intel-release",
@@ -93,7 +97,7 @@
                     {
                       "name": "Windows Release (Tests)", "type": "Test", "builddir": "win-release-tests",
                       "platform": "win", "configuration": "release", "architectures": ["i386"],
-                      "slavenames": ["apple-windows-4", "apple-windows-3", "apple-windows-5", "apple-windows-6", "test-slave"]
+                      "slavenames": ["apple-windows-3", "apple-windows-5", "test-slave"]
                     },
                     {
                       "name": "Windows Debug (Build)", "type": "Build", "builddir": "win-debug",
@@ -104,7 +108,7 @@
                     {
                       "name": "Windows Debug (Tests)", "type": "Test", "builddir": "win-debug-tests",
                       "platform": "win", "configuration": "debug", "architectures": ["i386"],
-                      "slavenames": ["apple-windows-4", "apple-windows-3", "apple-windows-5", "apple-windows-6", "test-slave"]
+                      "slavenames": ["apple-windows-4", "apple-windows-6", "test-slave"]
                     },
                     { "name": "Windows Debug (WebKit2 Tests)", "type": "TestWebKit2", "builddir": "win-debug-tests-wk2",
                       "platform": "win", "configuration": "debug", "architectures": ["i386"],
@@ -194,6 +198,16 @@
                       "name": "New run-webkit-tests", "type": "NewBuildAndTest", "builddir": "google-new-tests",
                       "platform": "mac-leopard", "configuration": "release", "architectures": ["i386"],
                       "slavenames": ["google-new-tests"]
+                    },
+                    {
+                      "name": "WinCairo Debug (Build)", "type": "Build", "builddir": "win-cairo-debug",
+                      "platform": "wincairo", "configuration": "debug", "architectures": ["i386"],
+                      "slavenames": ["wincairo-1"]
+                    },
+                    {
+                      "name": "EFL Linux Release (Build)", "type": "Build", "builddir": "efl-linux-release",
+                      "platform": "efl", "configuration": "release", "architectures": ["i386"],
+                      "slavenames": ["efl-linux-slave-1"]
                     }
                   ],
 
@@ -205,7 +219,8 @@
                                        "Qt Linux Release", "Qt Linux Release minimal", "Qt Linux ARMv5 Release", "Qt Linux ARMv7 Release", 
                                        "Qt Windows 32-bit Release", "Qt Windows 32-bit Debug",
                                        "Chromium Win Release", "Chromium Mac Release", "Chromium Linux Release",
-                                       "Chromium Win Release (Tests)", "Chromium Mac Release (Tests)", "Chromium Linux Release (Tests)"]
+                                       "Chromium Win Release (Tests)", "Chromium Mac Release (Tests)", "Chromium Linux Release (Tests)",
+                                       "WinCairo Debug (Build)", "EFL Linux Release (Build)"]
                     },
                     { "type": "Triggerable", "name": "leopard-intel-release-tests",
                       "builderNames": ["Leopard Intel Release (Tests)"]
diff --git a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
index d5cd6fb..47af8d2 100644
--- a/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
+++ b/WebKitTools/BuildSlaveSupport/build.webkit.org-config/master.cfg
@@ -78,7 +78,7 @@ class CleanupChromiumLinuxCrashLogs(shell.ShellCommand):
 
 
 def appendCustomBuildFlags(step, platform):
-    if platform in ('gtk', 'wx', 'qt', 'chromium'):
+    if platform in ('gtk', 'wx', 'qt', 'chromium', 'wincairo', 'efl'):
         step.setCommand(step.command + ['--' + platform])
 
 
@@ -487,3 +487,8 @@ c['slavePortnum'] = 17000
 c['projectName'] = "WebKit"
 c['projectURL'] = "http://webkit.org"
 c['buildbotURL'] = "http://build.webkit.org/"
+
+c['buildHorizon'] = 1000
+c['logHorizon'] = 500
+c['eventHorizon'] = 200
+c['buildCacheSize'] = 60
diff --git a/WebKitTools/CSSTestSuiteHarness/harness/harness.css b/WebKitTools/CSSTestSuiteHarness/harness/harness.css
index 8c0e7d1..3f4c97d 100644
--- a/WebKitTools/CSSTestSuiteHarness/harness/harness.css
+++ b/WebKitTools/CSSTestSuiteHarness/harness/harness.css
@@ -49,6 +49,15 @@ body {
   margin: 4px 0;
 }
 
+.test-type {
+  float: left;
+}
+
+.name > button {
+  margin-top: 20px;
+  float: right;
+}
+
 .actions {
   margin-left: 320px;
   border: 1px solid black;
@@ -64,7 +73,9 @@ body {
 }
 
 .note {
+  display: inline-block;
   font-size: 10px;
+  margin-left: 5px;
   color: gray;
 }
 .action-buttons {
@@ -96,6 +107,28 @@ body {
   font-size: smaller;
 }
 
+#warning {
+  padding-left: 1em;
+  color: red;
+  display: none;
+}
+
+#print-button {
+  float: right;
+  display: none;
+}
+
+#test-content.print {
+}
+
+#test-content.print #print-button {
+  display: inline;
+}
+
+#test-content.warn #warning {
+  display: inline;
+}
+
 #test-content iframe {
   border: 1px solid gray;
   margin: 2px;
@@ -108,11 +141,18 @@ body {
 }
 
 #test-list > option.untested {
-  
 }
 
-#test-list > option.completed {
-  color: gray;
+#test-list > option.pass {
+  color: rgba(0, 128, 0, 0.6);
+}
+
+#test-list > option.fail {
+  color: rgba(255, 0, 0, 0.6);
+}
+
+#test-list > option.skipped {
+  color: rgba(255, 128, 0, 0.6);
 }
 
 #test-content.with-ref {
@@ -218,3 +258,51 @@ body {
   text-align: right;
   padding: 4px;
 }
+
+.custom button {
+  display: block;
+  margin: 12px 0;
+}
+
+/* Overlay */
+
+#overlay {
+  position: fixed;
+  top: 0;
+  left: 0;
+  bottom: 0;
+  right: 0;
+  background-color: rgba(0, 0, 0, 0.6);
+  display: none;
+}
+
+#overlay.visible {
+  display: block;
+}
+
+.overlay-contents {
+  position: relative;
+  background-color: white;
+  margin: 50px auto;
+  width: 1000px;
+  padding: 20px;
+}
+
+.overlay-contents textarea {
+  width: 90em;
+  height: 50em;
+}
+.overlay-contents .buttons {
+  text-align: right;
+}
+
+.overlay-contents .note {
+  float: left;
+}
+
+.overlay-contents .buttons button {
+  font-size: 13px;
+  width: 6em;
+  margin: 12px 8px;
+}
+
diff --git a/WebKitTools/CSSTestSuiteHarness/harness/harness.html b/WebKitTools/CSSTestSuiteHarness/harness/harness.html
index 6bd47e5..3877f49 100644
--- a/WebKitTools/CSSTestSuiteHarness/harness/harness.html
+++ b/WebKitTools/CSSTestSuiteHarness/harness/harness.html
@@ -63,7 +63,26 @@
     {
       gTestSuite.passTest();
     }
+    
+    function goToNextUntested()
+    {
+      gTestSuite.goToNextIncompleteTest();
+    }
 
+    function goToTest()
+    {
+      var testName = prompt('Go to test:', '');
+      
+      // This accepts any of the following:
+      // at-charset-010
+      // at-charset-010.xht
+      // xhtml1/at-charset-010
+      // xhtml1/at-charset-010.xht
+      // and will choose the format if specified.
+      if (!gTestSuite.goToTestByName(testName))
+        alert('Failed to find test ' + testName);
+    }
+    
     function formatChanged()
     {
       var newFormat;
@@ -92,37 +111,48 @@
     {
       gTestSuite.exportResults(document.getElementById('results-popup').selectedIndex);
     }
+    
+    function printTestIframe()
+    {
+      var testFrame = document.getElementById('test-frame');
+      testFrame.contentWindow.print();
+    }
 
-    /*
-    This conflicts badly with key handling in selects.
-    function keyHandler(event)
-    {
-      var charCode = String.fromCharCode(event.keyCode);
-      window.console.log('keyHandler')
-      switch (charCode) {
-        case 'P':
-          passTest();
-          break;
-
-        case 'F':
-          failTest();
-          break;
+    var gOverlayConfirmCallback;
+    function showOverlay(overlayConfirmCallback)
+    {
+      document.getElementById('overlay-data').value = '';
+      gOverlayConfirmCallback = overlayConfirmCallback;
+      $('#overlay').addClass('visible');
+    }
 
-        case 'I':
-          invalidTest();
-          break;
-          
-        case 'S':
-          skipTest();
-          break;
-      }
-      
-      event.stopPropagation();
-      event.preventDefault();
+    function overlayCancel()
+    {
+      $('#overlay').removeClass('visible');
+    }
+    
+    function overlayConfirm()
+    {
+      var data = document.getElementById('overlay-data').value;
+      gOverlayConfirmCallback(data);
+      $('#overlay').removeClass('visible');
     }
     
-    document.addEventListener('keyup', keyHandler, false);
-    */
+    function doImport()
+    {
+      document.getElementById('overlay-action').innerText = 'Enter results to import (in the same format as the exported results):';
+      showOverlay(function(data) {
+        gTestSuite.importResults(data);
+      });
+    }
+    
+    function doClear()
+    {
+      document.getElementById('overlay-action').innerText = 'Enter list of tests for which to clear results (so they can be re-tested):';
+      showOverlay(function(data) {
+        gTestSuite.clearResults(data);
+      });
+    }
   </script>
 
 </head>
@@ -137,11 +167,13 @@
       <div><span id="test-index">1</span> of <span id="chapter-test-count">200</span> unique tests</div>
     </div>
     <div class="details">
-      <div class="name">        
+      <div class="name">
         <div class="test-type">
           <input type="radio" name="format" id="html4" onchange="formatChanged()" checked><label for="html4">HTML4</label><br>
           <input type="radio" name="format" id="xhtml1" onchange="formatChanged()"><label for="xhtml1">XHTML1</label>
         </div>
+        <button onclick="goToNextUntested()" accesskey="n"><strong>N</strong>ext Untested</button>
+        <button onclick="goToTest()" accesskey="g">Go to Test...</button>
       </div>
     </div>
     
@@ -153,12 +185,12 @@
   
   <div class="actions">
     <span>Skip reason:</span> <input type="text" id="skip-reason" size="50">
-    <button onclick="skipTest()" accesskey="s">Skip</button>
-    <span class="note">Use <i>Control-Option-letter</i> to trigger buttons via the keyboard.</span>
+    <button onclick="skipTest()" accesskey="s"><strong>S</strong>kip</button>
+    <div class="note">Use <i>Control-Option-letter</i> to<br> trigger buttons via the keyboard.</div>
     <div class="action-buttons">
       <button onclick="invalidTest()" accesskey="i">Invalid</button>
-      <button onclick="failTest()" accesskey="f">Fail</button>
-      <button onclick="passTest()" accesskey="p">Pass</button>
+      <button onclick="failTest()" accesskey="f"><strong>F</strong>ail</button>
+      <button onclick="passTest()" accesskey="p"><strong>P</strong>ass</button>
     </div>
   </div>
   <div id="test-content">
@@ -166,7 +198,10 @@
       <div class="title">Title: <span id="test-title"></span></div>
       <div class="url">URL: <span id="test-url"></span></div>
       <div class="assertion">Assertion: <span id="test-assertion"></span></div>
-      <div class="flags">Flags: <span id="test-flags"></span></div>
+      <div class="flags">Flags: <span id="test-flags"></span>
+        <span id="warning">This test must be run over HTTP.</span>
+        <button id="print-button" onclick="printTestIframe()">Print Preview</button>
+      </div>
     </div>
     
     <div id="test-wrapper" class="frame-wrapper">
@@ -180,12 +215,21 @@
   </div>
 
   <div class="results">
+
     <div class="output-options">
       <p>Show results for:</p>
       <select id="results-popup" onchange="resultsPopupChanged(this)">
       </select>
-      <button id="export-button" onclick="doExport()">Export...</button>
+      <div>
+        <button id="export-button" onclick="doExport()">Export...</button>
+      </div>
+
+      <div class="custom">
+        <button id="import-button" onclick="doImport()">Import...</button>
+        <button id="import-button" onclick="doClear()">Clear Results...</button>
+      </div>
     </div>
+
     <div id="output"></div>
     <div class="summary">
       <table>
@@ -202,5 +246,17 @@
     </div>
   </div>
 
+  <div id="overlay">
+    
+    <div class="overlay-contents">
+      <p id="overlay-action"></p>
+      <textarea id="overlay-data"></textarea>
+      <p class="note">Pasting many lines of text here can be very slow in Safari 5. You can quit Safari and use a <a href="http://nightly.webkit.org/" title="WebKit Nightly Builds">WebKit nightly build</a> for importing or clearing.</p>
+      <div class="buttons">
+        <button onclick="overlayCancel()">Cancel</button><button onclick="overlayConfirm()">OK</button>
+      </div>
+    </div>
+    
+  </div>
 </body>
 </html>
\ No newline at end of file
diff --git a/WebKitTools/CSSTestSuiteHarness/harness/harness.js b/WebKitTools/CSSTestSuiteHarness/harness/harness.js
index 95262af..ed7cb7d 100644
--- a/WebKitTools/CSSTestSuiteHarness/harness/harness.js
+++ b/WebKitTools/CSSTestSuiteHarness/harness/harness.js
@@ -25,7 +25,7 @@
 
 // requires jQuery
 
-const kTestSuiteVersion = '20100917';
+const kTestSuiteVersion = '20101001';
 const kTestSuiteHome = '../' + kTestSuiteVersion + '/';
 const kTestInfoDataFile = 'testinfo.data';
 
@@ -201,13 +201,64 @@ function Test(testInfoLine)
   this.flags = fields[3];
   this.links = fields[4];
   this.assertion = fields[5];
+
+  this.paged = false;
+  this.testHTML = true;
+  this.testXHTML = true;
+
+  if (this.flags) {
+    this.paged = this.flags.indexOf('paged') != -1;
+  
+    if (this.flags.indexOf('nonHTML') != -1)
+      this.testHTML = false;
+
+    if (this.flags.indexOf('HTMLonly') != -1)
+      this.testXHTML = false;
+  }
   
-  this.completed = false; // true if this test has a result (pass, fail or skip)
+  this.completedHTML = false; // true if this test has a result (pass, fail or skip)
+  this.completedXHTML = false; // true if this test has a result (pass, fail or skip)
+
+  this.statusHTML = '';
+  this.statusXHTML = '';
   
   if (!this.links)
     this.links = "other.html"
 }
 
+Test.prototype.runForFormat = function(format)
+{
+  if (format == 'html4')
+    return this.testHTML;
+
+  if (format == 'xhtml1')
+    return this.testXHTML;
+
+  return true;
+}
+
+Test.prototype.completedForFormat = function(format)
+{
+  if (format == 'html4')
+    return this.completedHTML;
+
+  if (format == 'xhtml1')
+    return this.completedXHTML;
+
+  return true;
+}
+
+Test.prototype.statusForFormat = function(format)
+{
+  if (format == 'html4')
+    return this.statusHTML;
+
+  if (format == 'xhtml1')
+    return this.statusXHTML;
+
+  return true;
+}
+
 function ChapterSection(link)
 {
   var result= link.match(/^([.\w]+)(#.+)?$/);
@@ -215,21 +266,84 @@ function ChapterSection(link)
     this.file = result[1];
     this.anchor = result[2];
   }
-  
+
+  this.testCountHTML = 0;
+  this.testCountXHTML = 0;
+
   this.tests = [];
 }
 
+ChapterSection.prototype.countTests = function()
+{
+  this.testCountHTML = 0;
+  this.testCountXHTML = 0;
+
+  for (var i = 0; i < this.tests.length; ++i) {
+    var currTest = this.tests[i];
+
+    if (currTest.testHTML)
+      ++this.testCountHTML;
+
+    if (currTest.testXHTML)
+      ++this.testCountXHTML;
+  }
+}
+
 function Chapter(chapterInfo)
 {
   this.file = chapterInfo.file;
   this.title = chapterInfo.title;
-  this.testCount = 0;
+  this.testCountHTML = 0;
+  this.testCountXHTML = 0;
   this.sections = []; // array of ChapterSection
 }
 
-Chapter.prototype.description = function()
+Chapter.prototype.description = function(format)
 {
-  return this.title + ' (' + this.testCount + ' tests)';
+  
+  
+  return this.title + ' (' + this.testCount(format) + ' tests, ' + this.untestedCount(format) + ' untested)';
+}
+
+Chapter.prototype.countTests = function()
+{
+  this.testCountHTML = 0;
+  this.testCountXHTML = 0;
+
+  for (var i = 0; i < this.sections.length; ++i) {
+    var currSection = this.sections[i];
+
+    currSection.countTests();
+
+    this.testCountHTML += currSection.testCountHTML;
+    this.testCountXHTML += currSection.testCountXHTML;
+  }
+}
+
+Chapter.prototype.testCount = function(format)
+{
+  if (format == 'html4')
+    return this.testCountHTML;
+
+  if (format == 'xhtml1')
+    return this.testCountXHTML;
+
+  return 0;
+}
+
+Chapter.prototype.untestedCount = function(format)
+{
+  var completedProperty = format == 'html4' ? 'completedHTML' : 'completedXHTML';
+  
+  var count = 0;
+  for (var i = 0; i < this.sections.length; ++i) {
+    var currSection = this.sections[i];
+    for (var j = 0; j < currSection.tests.length; ++j) {
+      count += currSection.tests[j].completedForFormat(format) ? 0 : 1;
+    }
+  }
+  return count;
+  
 }
 
 // Utils
@@ -277,7 +391,7 @@ TestSuite.prototype.testInfoDataLoaded = function(data, status)
 
   this.testInfoLoaded = true;
   
-  this.fillChapterPopup(document.getElementById('chapters'));
+  this.fillChapterPopup();
 
   this.initializeControls();
 
@@ -335,12 +449,7 @@ TestSuite.prototype.buildChapters = function()
   for (var chapterName in this.chapters) {
     var currChapter = this.chapters[chapterName];
     currChapter.sections.sort();
-    
-    var testCount = 0;
-    for (var s = 0; s < currChapter.sections.length; ++s)
-      testCount += currChapter.sections[s].tests.length;
-      
-    currChapter.testCount = testCount;
+    currChapter.countTests();
   }
 }
 
@@ -363,8 +472,9 @@ TestSuite.prototype.chapterAtIndex = function(index)
   return this.chapters[kChapterData[index].file];
 }
 
-TestSuite.prototype.fillChapterPopup = function(select)
+TestSuite.prototype.fillChapterPopup = function()
 {
+  var select = document.getElementById('chapters')
   select.innerHTML = ''; // Remove all children.
   
   for (var i = 0; i < kChapterData.length; ++i) {
@@ -372,27 +482,53 @@ TestSuite.prototype.fillChapterPopup = function(select)
     var chapter = this.chapters[chapterData.file];
     
     var option = document.createElement('option');
-    option.innerText = chapter.description();
+    option.innerText = chapter.description(this.format);
     option._chapter = chapter;
     
     select.appendChild(option);
   }
 }
 
+TestSuite.prototype.updateChapterPopup = function()
+{
+  var select = document.getElementById('chapters')
+  var currOption = select.firstChild;
+  
+  for (var i = 0; i < kChapterData.length; ++i) {
+    var chapterData = kChapterData[i];
+    var chapter = this.chapters[chapterData.file];
+    if (!chapter)
+      continue;
+    currOption.innerText = chapter.description(this.format);
+    currOption = currOption.nextSibling;
+  }
+}
+
 TestSuite.prototype.buildTestListForChapter = function(chapter)
 {
-  this.currentChapterTests = [];
+  this.currentChapterTests = this.testListForChapter(chapter);
+}
+
+TestSuite.prototype.testListForChapter = function(chapter)
+{
+  var testList = [];
   
   for (var i in chapter.sections) {
     var currSection = chapter.sections[i];
-    // FIXME: why do I need the assignment?
-    this.currentChapterTests = this.currentChapterTests.concat(currSection.tests);
+    
+    for (var j = 0; j < currSection.tests.length; ++j) {
+      var currTest = currSection.tests[j];
+      if (currTest.runForFormat(this.format))
+        testList.push(currTest);
+    }
   }
   
   // FIXME: test may occur more than once.
-  this.currentChapterTests.sort(function(a, b) {
+  testList.sort(function(a, b) {
     return a.id.localeCompare(b.id);
   });
+  
+  return testList;
 }
 
 TestSuite.prototype.initializeControls = function()
@@ -428,6 +564,8 @@ TestSuite.prototype.chapterPopupChanged = function()
 
 TestSuite.prototype.fillTestList = function()
 {
+  var statusProperty = this.format == 'html4' ? 'statusHTML' : 'statusXHTML';
+
   var testList = document.getElementById('test-list');
   testList.innerHTML = '';
   
@@ -436,7 +574,7 @@ TestSuite.prototype.fillTestList = function()
 
     var option = document.createElement('option');
     option.innerText = currTest.id;
-    option.className = currTest.completed ? 'completed' : 'untested';
+    option.className = currTest[statusProperty];
     option._test = currTest;
     testList.appendChild(option);
   }
@@ -444,12 +582,13 @@ TestSuite.prototype.fillTestList = function()
 
 TestSuite.prototype.updateTestList = function()
 {
+  var statusProperty = this.format == 'html4' ? 'statusHTML' : 'statusXHTML';
   var testList = document.getElementById('test-list');
   
   var options = testList.getElementsByTagName('option');
   for (var i = 0; i < options.length; ++i) {
     var currOption = options[i];
-    currOption.className = currOption._test.completed ? 'completed' : 'untested';
+    currOption.className = currOption._test[statusProperty];
   }
 }
 
@@ -513,8 +652,105 @@ TestSuite.prototype.previousTest = function()
   }
 }
 
+TestSuite.prototype.goToNextIncompleteTest = function()
+{
+  var completedProperty = this.format == 'html4' ? 'completedHTML' : 'completedXHTML';
+
+  // Look to the end of this chapter.
+  for (var i = this.currChapterTestIndex + 1; i < this.currentChapterTests.length; ++i) {
+    if (!this.currentChapterTests[i][completedProperty]) {
+      this.goToTestIndex(i);
+      return;
+    }
+  }
+
+  // Start looking through later chapter
+  var currChapterIndex = this.indexOfChapter(this.currentChapter);
+  for (var c = currChapterIndex + 1; c < kChapterData.length; ++c) {
+    var chapterData = this.chapterAtIndex(c);
+    
+    var testIndex = this.firstIncompleteTestIndex(chapterData);
+    if (testIndex != -1) {
+      this.goToChapterIndex(c);
+      this.goToTestIndex(testIndex);
+      break;
+    }
+  }
+}
+
+TestSuite.prototype.firstIncompleteTestIndex = function(chapter)
+{
+  var completedProperty = this.format == 'html4' ? 'completedHTML' : 'completedXHTML';
+
+  var chapterTests = this.testListForChapter(chapter);
+  for (var i = 0; i < chapterTests.length; ++i) {
+    if (!chapterTests[i][completedProperty])
+      return i;
+  }
+  
+  return -1;
+}
+
 /* ------------------------------------------------------- */
 
+TestSuite.prototype.goToTestByName = function(testName)
+{
+  var match = testName.match(/^(?:(html4|xhtml1)\/)?([\w-_]+)(\.xht|\.htm)?/);
+  if (!match)
+    return false;
+
+  var prefix = match[1];
+  var testId = match[2];
+  var extension = match[3];
+  
+  var format = this.format;
+  if (prefix)
+    format = prefix;
+  else if (extension) {
+    if (extension == kXHTML1Data.suffix)
+      format = kXHTML1Data.path;
+    else if (extension == kHTML4Data.suffix)
+      format = kHTML4Data.path;
+  }
+  
+  this.switchToFormat(format);
+  
+  var test = this.tests[testId];
+  if (!test)
+    return false;
+
+  // Find the first chapter.
+  var links = test.links.split(',');
+  if (links.length == 0) {
+    window.console.log('test ' + test.id + 'had no links.');
+    return false;
+  }
+
+  var firstLink = links[0];
+  var result = firstLink.match(/^([.\w]+)(#.+)?$/);
+  if (result)
+    firstLink = result[1];
+
+  // Find the chapter and index of the test.
+  for (var i = 0; i < kChapterData.length; ++i) {
+    var chapterData = kChapterData[i];
+    if (chapterData.file == firstLink) {
+
+      this.goToChapterIndex(i);
+      
+      for (var j = 0; j < this.currentChapterTests.length; ++j) {
+        var currTest = this.currentChapterTests[j];
+        if (currTest.id == testId) {
+          this.goToTestIndex(j);
+          return true;
+        }
+      }
+    }
+  }
+
+  return false;
+}
+
 TestSuite.prototype.goToTestIndex = function(index)
 {
   if (index >= 0 && index < this.currentChapterTests.length) {
@@ -557,12 +793,17 @@ TestSuite.prototype.loadCurrentTest = function()
 
   this.loadTest(theTest);
 
-  document.getElementById('test-index').innerText = this.currChapterTestIndex + 1;
-  document.getElementById('chapter-test-count').innerText = this.currentChapterTests.length;
+  this.updateProgressLabel();
   
   document.getElementById('test-list').selectedIndex = this.currChapterTestIndex;
 }
 
+TestSuite.prototype.updateProgressLabel = function()
+{
+  document.getElementById('test-index').innerText = this.currChapterTestIndex + 1;
+  document.getElementById('chapter-test-count').innerText = this.currentChapterTests.length;
+}
+
 TestSuite.prototype.configureForRefTest = function()
 {
   $('#test-content').addClass('with-ref');
@@ -576,12 +817,52 @@ TestSuite.prototype.configureForManualTest = function()
 TestSuite.prototype.loadTest = function(test)
 {
   var iframe = document.getElementById('test-frame');
-  iframe.src = this.urlForTest(test.id);
+  iframe.src = 'about:blank';
+  
+  var url = this.urlForTest(test.id);
+  window.setTimeout(function() {
+    iframe.src = url;
+  }, 0);
   
   document.getElementById('test-title').innerText = test.title;
   document.getElementById('test-url').innerText = this.pathForTest(test.id);
   document.getElementById('test-assertion').innerText = test.assertion;
   document.getElementById('test-flags').innerText = test.flags;
+  
+  this.processFlags(test);
+}
+
+TestSuite.prototype.processFlags = function(test)
+{ 
+  if (test.paged)
+    $('#test-content').addClass('print');
+  else
+    $('#test-content').removeClass('print');
+
+  var showWarning = false;
+  var warning = '';
+  if (test.flags.indexOf('font') != -1)
+    warning = 'Requires a specific font to be installed.';
+  
+  if (test.flags.indexOf('http') != -1) {
+    if (warning != '')
+      warning += ' ';
+    warning += 'Must be tested over HTTP, with custom HTTP headers.';
+  }
+  
+  if (test.paged) {
+    if (warning != '')
+      warning += ' ';
+    warning += 'Test via the browser\'s Print Preview.';
+  }
+
+  document.getElementById('warning').innerText = warning;
+
+  if (warning.length > 0)
+    $('#test-content').addClass('warn');
+  else
+    $('#test-content').removeClass('warn');
+
 }
 
 TestSuite.prototype.clearTest = function()
@@ -593,21 +874,20 @@ TestSuite.prototype.clearTest = function()
   document.getElementById('test-url').innerText = '';
   document.getElementById('test-assertion').innerText = '';
   document.getElementById('test-flags').innerText = '';
+
+  $('#test-content').removeClass('print');
+  $('#test-content').removeClass('warn');
+  document.getElementById('warning').innerText = '';
 }
 
 TestSuite.prototype.loadRef = function(test)
 {
+  // Suites 20101001 and earlier used .xht refs, even for HTML tests, so strip off
+  // the extension and use the same format as the test.
+  var ref = test.reference.replace(/(\.xht)?$/, '');
+  
   var iframe = document.getElementById('ref-frame');
-  iframe.src = this.urlForTest(testInfo.reference);
-}
-
-TestSuite.prototype.loadTestByName = function(testName)
-{
-  var currChapterInfo = this.chapterInfoMap[this.currChapterName];
-
-  var testIndex = currChapterInfo.testNames.indexOf(testName);
-  if (testIndex >= 0 && testIndex < currChapterInfo.testNames.length)
-    this.goToTestIndex(testIndex);
+  iframe.src = this.urlForTest(ref);
 }
 
 TestSuite.prototype.pathForTest = function(testName)
@@ -638,10 +918,19 @@ TestSuite.prototype.recordResult = function(testName, resolution, comment)
     comment = '';
   
   this.storeTestResult(testName, this.format, resolution, comment, navigator.userAgent);
-  this.markTestCompleted(testName);
+  
+  var htmlStatus = null;
+  var xhtmlStatus = null;
+  if (this.format == 'html4')
+    htmlStatus = resolution;
+  if (this.format == 'xhtml1')
+    xhtmlStatus = resolution;
+
+  this.markTestCompleted(testName, htmlStatus, xhtmlStatus);
   this.updateTestList();
 
   this.updateSummaryData();
+  this.updateChapterPopup();
 }
 
 TestSuite.prototype.beginAppendingOutput = function()
@@ -675,6 +964,16 @@ TestSuite.prototype.clearOutput = function()
 
 /* ------------------------------------------------------- */
 
+TestSuite.prototype.switchToFormat = function(formatString)
+{
+  if (formatString == 'html4')
+    document.harness.format.html4.checked = true;
+  else
+    document.harness.format.xhtml1.checked = true;
+
+  this.formatChanged(formatString);
+}
+
 TestSuite.prototype.formatChanged = function(formatString)
 {
   if (this.format == formatString)
@@ -687,7 +986,20 @@ TestSuite.prototype.formatChanged = function(formatString)
   else
     this.formatInfo = kXHTML1Data;
 
-    this.loadCurrentTest();
+  // try to keep the current test selected
+  var selectedTestName;
+  if (this.currChapterTestIndex >= 0 && this.currChapterTestIndex < this.currentChapterTests.length)
+    selectedTestName = this.currentChapterTests[this.currChapterTestIndex].id;
+  
+  if (this.currentChapter) {
+    this.buildTestListForChapter(this.currentChapter);
+    this.fillTestList();
+    this.goToTestByName(selectedTestName);
+  }
+
+  this.updateChapterPopup();
+  this.updateTestList();
+  this.updateProgressLabel();
 }
 
 /* ------------------------------------------------------- */
@@ -744,11 +1056,97 @@ TestSuite.prototype.resultsPopupChanged = function(index)
   document.getElementById('export-button').disabled = !enableExport;
 }
 
+/* ------------------------- Import ------------------------------- */
+/*
+  Import format is the same as the export format, namely:
+  
+  testname<tab>result
+
+  with optional trailing <tab>comment.
+
+html4/absolute-non-replaced-height-002<tab>pass
+xhtml1/absolute-non-replaced-height-002<tab>?
+  
+  Lines starting with # are ignored.
+  The "testname<tab>result" line is ignored.
+*/
+TestSuite.prototype.importResults = function(data)
+{
+  var testsToImport = [];
+
+  var lines = data.split('\n');
+  for (var i = 0; i < lines.length; ++i) {
+    var currLine = lines[i];
+    if (currLine.length == 0 || currLine.charAt(0) == '#')
+      continue;
+
+    var match = currLine.match(/^(html4|xhtml1)\/([\w-_]+)\t([\w?]+)\t?(.+)?$/);
+    if (match) {
+      var test = { 'id' : match[2] };
+      test.format =  match[1];
+      test.result = match[3];
+      test.comment = match[4];
+      
+      if (test.result != '?')
+        testsToImport.push(test);
+    } else {
+      window.console.log('failed to match line \'' + currLine + '\'');
+    }
+  }
+
+  this.importTestResults(testsToImport);
+  
+  this.resetTestStatus();
+  this.updateSummaryData();
+}
+
+
+
+/* --------------------- Clear Results --------------------------- */
+/*
+  Clear results format is either same as the export format, or
+  a list of bare test IDs (e.g. absolute-non-replaced-height-001)
+  in which case both HTML4 and XHTML1 results are cleared.
+*/
+TestSuite.prototype.clearResults = function(data)
+{
+  var testsToClear = [];
+
+  var lines = data.split('\n');
+  for (var i = 0; i < lines.length; ++i) {
+    var currLine = lines[i];
+    if (currLine.length == 0 || currLine.charAt(0) == '#')
+      continue;
+
+    // Look for format/test with possible extension
+    var result = currLine.match(/^((html4|xhtml1)?)\/?([\w-_]+)/);
+    if (result) {
+      var testId = result[3];
+      var format = result[1];
+      
+      var clearHTML = format.length == 0 || format == 'html4';
+      var clearXHTML = format.length == 0 || format == 'xhtml1';
+      
+      var result = { 'id' : testId };
+      result.clearHTML = clearHTML;
+      result.clearXHTML = clearXHTML;
+
+      testsToClear.push(result);
+    } else {
+      window.console.log('failed to match line ' + currLine);
+    }
+  }
+  
+  this.clearTestResults(testsToClear);
+  
+  this.resetTestStatus();
+  this.updateSummaryData();
+}
+
 /* -------------------------------------------------------- */
 
 TestSuite.prototype.exportResultsCompletion = function(exportTests)
 {
-  window.console.log('exportResultsCompletion')
   // Lame workaround for ORDER BY not working
   exportTests.sort(function(a, b) {
       return a.test.localeCompare(b.test);
@@ -839,8 +1237,8 @@ TestSuite.prototype.exportResultsForAllTests = function()
   var _self = this;
   this.queryDatabaseForAllTests('test',
       function(item) {
-        var htmlLine= _self.createExportLine(kHTML4Data, item.test, item.hstatus, item.hcomment);
-        var xhtmlLine = _self.createExportLine(kXHTML1Data, item.test, item.xstatus, item.xcomment);
+        var htmlLine= _self.createExportLine(kHTML4Data, item.test, item.hstatus ? item.hstatus : '?', item.hcomment);
+        var xhtmlLine = _self.createExportLine(kXHTML1Data, item.test, item.xstatus ? item.xstatus : '?', item.xcomment);
         exportTests.push({
           'test' : item.test,
           'html4' : htmlLine,
@@ -969,8 +1367,8 @@ TestSuite.prototype.exportResultsForTestsWithMismatchedResults = function()
   var _self = this;
   this.queryDatabaseForTestsWithMixedStatus(
       function(item) {
-        var htmlLine= _self.createExportLine(kHTML4Data, item.test, item.hstatus, item.hcomment);
-        var xhtmlLine = _self.createExportLine(kXHTML1Data, item.test, item.xstatus, item.xcomment);
+        var htmlLine= _self.createExportLine(kHTML4Data, item.test, item.hstatus ? item.hstatus : '?', item.hcomment);
+        var xhtmlLine = _self.createExportLine(kXHTML1Data, item.test, item.xstatus ? item.xstatus : '?', item.xcomment);
         exportTests.push({
           'test' : item.test,
           'html4' : htmlLine,
@@ -984,21 +1382,28 @@ TestSuite.prototype.exportResultsForTestsWithMismatchedResults = function()
 
 /* -------------------------------------------------------- */
 
-TestSuite.prototype.markTestCompleted = function(testID)
+TestSuite.prototype.markTestCompleted = function(testID, htmlStatus, xhtmlStatus)
 {
   var test = this.tests[testID];
   if (!test) {
-    window.console.log('markTestCompleted to find test ' + testID);
+    window.console.log('markTestCompleted failed to find test ' + testID);
     return;
   }
-  
-  test.completed = true;
+
+  if (htmlStatus) {
+    test.completedHTML = true;
+    test.statusHTML = htmlStatus;
+  }
+  if (xhtmlStatus) {
+    test.completedXHTML = true;
+    test.statusXHTML = xhtmlStatus;
+  }
 }
 
 TestSuite.prototype.testCompletionStateChanged = function()
 {
-  // update the test list
   this.updateTestList();
+  this.updateChapterPopup();
 }
 
 TestSuite.prototype.loadTestStatus = function()
@@ -1006,12 +1411,24 @@ TestSuite.prototype.loadTestStatus = function()
   var _self = this;
   this.queryDatabaseForCompletedTests(
       function(item) {
-        _self.markTestCompleted(item.test);
+      _self.markTestCompleted(item.test, item.hstatus, item.xstatus);
       },
       function() {
         _self.testCompletionStateChanged();
       }
     );
+    
+    this.updateChapterPopup();
+}
+
+TestSuite.prototype.resetTestStatus = function()
+{
+  for (var testID in this.tests) {
+    var currTest = this.tests[testID];
+    currTest.completedHTML = false;
+    currTest.completedXHTML = false;
+  }
+  this.loadTestStatus();
 }
 
 /* -------------------------------------------------------- */
@@ -1063,27 +1480,61 @@ TestSuite.prototype.openDatabase = function()
   }
   
   var _self = this;
-  this.db = window.openDatabase('css21testsuite', '1.0', 'CSS 2.1 test suite results', 10 * 1024 * 1024, function() {
-    _self.databaseCreated();
-  }, errorHandler);
+  this.db = window.openDatabase('css21testsuite', '', 'CSS 2.1 test suite results', 10 * 1024 * 1024);
 
-  this.updateSummaryData();
-  this.loadTestStatus();
+  // Migration handling. We assume migration will happen whenever the suite version changes,
+  // so that we can check for new or obsoleted tests.
+  function creation(tx) {
+    _self.databaseCreated(tx);
+  }
+
+  function migration1_0To1_1(tx) {
+    window.console.log('updating 1.0 to 1.1');
+    // We'll use the 'seen' column to cross-check with testinfo.data.
+    tx.executeSql('ALTER TABLE tests ADD COLUMN seen BOOLEAN DEFAULT \"FALSE\"', null, function() {
+      _self.syncDatabaseWithTestInfoData();
+    }, errorHandler);
+  }
+
+  if (this.db.version == '') {
+    _self.db.changeVersion('', '1.0', creation, null, function() {
+      _self.db.changeVersion('1.0', '1.1', migration1_0To1_1, null, function() {
+        _self.databaseReady();
+      }, errorHandler);
+    }, errorHandler);
+
+    return;
+  }
+
+  if (this.db.version == '1.0') {
+    _self.db.changeVersion('1.0', '1.1', migration1_0To1_1, null, function() {
+      window.console.log('ready')
+      _self.databaseReady();
+    }, errorHandler);
+    return;
+  }
+
+  this.databaseReady();
 }
 
-TestSuite.prototype.databaseCreated = function(db)
+TestSuite.prototype.databaseCreated = function(tx)
 {
+  window.console.log('databaseCreated');
   this.populatingDatabase = true;
 
+  // hstatus: HTML4 result
+  // xstatus: XHTML1 result
   var _self = this;
-  this.db.transaction(function (tx) {
-    // hstatus: HTML4 result
-    // xstatus: XHTML1 result
-    tx.executeSql('CREATE TABLE tests (test PRIMARY KEY UNIQUE, ref, title, flags, links, assertion, hstatus, hcomment, xstatus, xcomment)', null,
-      function(tx, results) {
-        _self.populateDatabaseFromTestInfoData();
-      }, errorHandler);
-  });
+  tx.executeSql('CREATE TABLE tests (test PRIMARY KEY UNIQUE, ref, title, flags, links, assertion, hstatus, hcomment, xstatus, xcomment)', null,
+    function(tx, results) {
+      _self.populateDatabaseFromTestInfoData();
+    }, errorHandler);
+}
+
+TestSuite.prototype.databaseReady = function()
+{
+  this.updateSummaryData();
+  this.loadTestStatus();
 }
 
 TestSuite.prototype.storeTestResult = function(test, format, result, comment, useragent)
@@ -1096,28 +1547,134 @@ TestSuite.prototype.storeTestResult = function(test, format, result, comment, us
       tx.executeSql('UPDATE tests SET hstatus=?, hcomment=? WHERE test=?\n', [result, comment, test], null, errorHandler);
     else if (format == 'xhtml1')
       tx.executeSql('UPDATE tests SET xstatus=?, xcomment=? WHERE test=?\n', [result, comment, test], null, errorHandler);
-  });  
+  });
 }
 
-TestSuite.prototype.populateDatabaseFromTestInfoData = function(testInfoURL)
+TestSuite.prototype.importTestResults = function(results)
+{
+  if (!this.db)
+    return;
+
+  this.db.transaction(function (tx) {
+
+    for (var i = 0; i < results.length; ++i) {
+      var currResult = results[i];
+
+      var query;
+      if (currResult.format == 'html4')
+        query = 'UPDATE tests SET hstatus=?, hcomment=? WHERE test=?\n';
+      else if (currResult.format == 'xhtml1')
+        query = 'UPDATE tests SET xstatus=?, xcomment=? WHERE test=?\n';
+
+      tx.executeSql(query, [currResult.result, currResult.comment, currResult.id], null, errorHandler);
+    }
+  });
+}
+
+TestSuite.prototype.clearTestResults = function(results)
+{
+  if (!this.db)
+    return;
+
+  this.db.transaction(function (tx) {
+    
+    for (var i = 0; i < results.length; ++i) {
+      var currResult = results[i];
+
+      if (currResult.clearHTML)
+        tx.executeSql('UPDATE tests SET hstatus=NULL, hcomment=NULL WHERE test=?\n', [currResult.id], null, errorHandler);
+
+      if (currResult.clearXHTML)
+        tx.executeSql('UPDATE tests SET xstatus=NULL, xcomment=NULL WHERE test=?\n', [currResult.id], null, errorHandler);
+      
+    }
+  });
+}
+
+TestSuite.prototype.populateDatabaseFromTestInfoData = function()
 {
   if (!this.testInfoLoaded) {
     window.console.log('Tring to populate database before testinfo.data has been loaded');
     return;
   }
   
+  window.console.log('populateDatabaseFromTestInfoData')
   var _self = this;
   this.db.transaction(function (tx) {
     for (var testID in _self.tests) {
-      var currTest = _self.tests[testID];
-      tx.executeSql('INSERT INTO tests (test, ref, title, flags, links, assertion) VALUES (?, ?, ?, ?, ?, ?)', [currTest.id, currTest.reference, currTest.title, currTest.flags, currTest.links, currTest.assertion], null, errorHandler);
+      var test = _self.tests[testID];
+      // Version 1.0, so no 'seen' column.
+      tx.executeSql('INSERT INTO tests (test, ref, title, flags, links, assertion) VALUES (?, ?, ?, ?, ?, ?)',
+        [test.id, test.reference, test.title, test.flags, test.links, test.assertion], null, errorHandler);
     }
-
     _self.populatingDatabase = false;
   });
 
 }
 
+TestSuite.prototype.insertTest = function(tx, test)
+{
+  tx.executeSql('INSERT INTO tests (test, ref, title, flags, links, assertion, seen) VALUES (?, ?, ?, ?, ?, ?, ?)',
+    [test.id, test.reference, test.title, test.flags, test.links, test.assertion, 'TRUE'], null, errorHandler);
+}
+
+// Deal with removed/renamed tests in a new version of the suite.
+// self.tests is canonical; the database may contain stale entries.
+TestSuite.prototype.syncDatabaseWithTestInfoData = function()
+{
+  if (!this.testInfoLoaded) {
+    window.console.log('Trying to sync database before testinfo.data has been loaded');
+    return;
+  }
+
+  // Make an object with all tests that we'll use to track new tests.
+  var testsToInsert = {};
+  for (var testId in this.tests) {
+    var currTest = this.tests[testId];
+    testsToInsert[currTest.id] = currTest;
+  }
+  
+  var _self = this;
+  this.db.transaction(function (tx) {
+    // Find tests that are not in the database yet.
+    // (Wasn't able to get INSERT ... IF NOT working.)
+    tx.executeSql('SELECT * FROM tests', [], function(tx, results) {
+      var len = results.rows.length;
+      for (var i = 0; i < len; ++i) {
+        var item = results.rows.item(i);
+        delete testsToInsert[item.test];
+      }
+    }, errorHandler);
+  });
+
+  this.db.transaction(function (tx) {
+    for (var testId in testsToInsert) {
+      var currTest = testsToInsert[testId];
+      window.console.log(currTest.id + ' is new; inserting');
+      _self.insertTest(tx, currTest);
+    }
+  });
+    
+  this.db.transaction(function (tx) {
+    for (var testID in _self.tests)
+      tx.executeSql('UPDATE tests SET seen=\"TRUE\" WHERE test=?\n', [testID], null, errorHandler);
+
+    tx.executeSql('SELECT * FROM tests WHERE seen=\"FALSE\"', [], function(tx, results) {
+      var len = results.rows.length;
+      for (var i = 0; i < len; ++i) {
+        var item = results.rows.item(i);
+        window.console.log('Test ' + item.test + ' was in the database but is no longer in the suite; deleting.');
+      }
+    }, errorHandler);
+
+    // Delete rows for disappeared tests.
+    tx.executeSql('DELETE FROM tests WHERE seen=\"FALSE\"', [], function(tx, results) {
+      _self.populatingDatabase = false;
+      _self.databaseReady();
+    }, errorHandler);
+  });
+}
+
 TestSuite.prototype.queryDatabaseForAllTests = function(sortKey, perRowHandler, completionHandler)
 {
   if (this.populatingDatabase)
@@ -1269,28 +1826,58 @@ TestSuite.prototype.countTestsWithColumnValue = function(tx, completionHandler,
   }, errorHandler);
 }
 
+TestSuite.prototype.countTestsWithFlag = function(tx, completionHandler, flag)
+{  
+  var allRowsCount = 'COUNT(*)';
+
+  tx.executeSql('SELECT COUNT(*) FROM tests WHERE flags LIKE \"%' + flag + '%\"', [], function(tx, results) {
+    var rowCount = 0;
+    if (results.rows.length > 0)
+      rowCount = results.rows.item(0)[allRowsCount];
+    completionHandler(rowCount);
+  }, errorHandler);
+}
+
 TestSuite.prototype.queryDatabaseForSummary = function(completionHandler)
 {
   if (!this.db || this.populatingDatabase)
     return;
 
   var _self = this;
+
+  var htmlOnlyTestCount = 0;
+  var xHtmlOnlyTestCount = 0;
+
   this.db.transaction(function (tx) {
+    if (_self.populatingDatabase)
+      return;
 
+    var allRowsCount = 'COUNT(*)';
+      
+    _self.countTestsWithFlag(tx, function(count) {
+      htmlOnlyTestCount = count;
+    }, 'htmlOnly');
+
+    _self.countTestsWithFlag(tx, function(count) {
+      xHtmlOnlyTestCount = count;
+    }, 'nonHTML');
+  });
+  
+  this.db.transaction(function (tx) {
     if (_self.populatingDatabase)
       return;
 
     var allRowsCount = 'COUNT(*)';
     var html4RowsCount = 'COUNT(hstatus)';
     var xhtml1RowsCount = 'COUNT(xstatus)';
-
+    
     tx.executeSql('SELECT COUNT(*), COUNT(hstatus), COUNT(xstatus) FROM tests', [], function(tx, results) {
 
       var data = [];
       if (results.rows.length > 0) {
         var rowItem = results.rows.item(0);
-        data.push({ 'name' : 'h-total' , 'count' : rowItem[allRowsCount] })
-        data.push({ 'name' : 'x-total' , 'count' : rowItem[allRowsCount] })
+        data.push({ 'name' : 'h-total' , 'count' : rowItem[allRowsCount] - xHtmlOnlyTestCount })
+        data.push({ 'name' : 'x-total' , 'count' : rowItem[allRowsCount] - htmlOnlyTestCount })
         data.push({ 'name' : 'h-tested', 'count' : rowItem[html4RowsCount] })
         data.push({ 'name' : 'x-tested', 'count' : rowItem[xhtml1RowsCount] })
       }
@@ -1298,6 +1885,7 @@ TestSuite.prototype.queryDatabaseForSummary = function(completionHandler)
       
     }, errorHandler);
 
+
     _self.countTestsWithColumnValue(tx, completionHandler, 'hstatus', 'pass', 'h-passed');
     _self.countTestsWithColumnValue(tx, completionHandler, 'xstatus', 'pass', 'x-passed');
 
diff --git a/WebKitTools/ChangeLog b/WebKitTools/ChangeLog
index b2a3791..d138f3d 100644
--- a/WebKitTools/ChangeLog
+++ b/WebKitTools/ChangeLog
@@ -1,3 +1,3513 @@
+2010-10-20  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/47754> New script to verify explicit source file types in Xcode project files
+
+        Reviewed by Darin Adler.
+
+        The script parses an Xcode project file and makes sure the file
+        extension matches the explicit file type set for all source
+        files.  Note that the majority of source files will have their
+        type set by Xcode, so the script doesn't check them since there
+        is no need to second-guess Xcode.
+
+        * Scripts/check-Xcode-source-file-types: Added.  Code borrowed
+        heavily from sort-Xcode-project-file.
+
+2010-10-20  Adam Roben  <aroben@apple.com>
+        
+        Windows build fix
+
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp: Added missing #include.
+
+2010-10-20  Adam Roben  <aroben@apple.com>
+
+        Qt test fix
+
+        * DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro: Added
+        PassDifferentNPPStruct.cpp.
+
+2010-10-20  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        https://bugs.webkit.org/show_bug.cgi?id=48027
+        Add ability to test injected bundle API using TestWebKitAPI
+
+        * TestWebKitAPI/InjectedBundleController.cpp: Added.
+        * TestWebKitAPI/InjectedBundleController.h: Added.
+        Shared main object for bundle functionality.
+
+        * TestWebKitAPI/InjectedBundleMain.cpp: Added.
+        Bundle entry point.
+
+        * TestWebKitAPI/InjectedBundleTest.h: Added.
+        Base class for which the bundle portion of a test derives from. 
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        * TestWebKitAPI/PlatformUtilities.cpp: Added.
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp:
+        (TestWebKitAPI::Util::createInjectedBundlePath):
+        (TestWebKitAPI::Util::createURLForResource):
+        (TestWebKitAPI::Util::URLForNonExistentResource):
+        Add helper to create a context with the shared injected bundle,
+        and send the initial message to set up the test.
+
+        * TestWebKitAPI/Configurations/InjectedBundle.xcconfig: Added.
+        * TestWebKitAPI/InjectedBundle-Info.plist: Added.
+        Add mac configuration files.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        Add the new files.
+
+        * TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic.cpp: Added.
+        * TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic_Bundle.cpp: Added.
+        Add a simple initial bundle test.
+
+2010-10-20  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Fixing /release-patch url used by the EWS bots.
+
+        EWS should test patches with r+
+        https://bugs.webkit.org/show_bug.cgi?id=35460
+
+        * Scripts/webkitpy/common/net/statusserver.py:
+         - I changed the URL during development, and 404s are
+         intentionally silenced during release_patch.
+
+2010-10-14  Adam Roben  <aroben@apple.com>
+
+        Test that passing a different NPP struct back to the browser doesn't
+        cause an assertion failure
+
+        Test for <http://webkit.org/b/47690> <rdar://problem/8553020>
+        Assertion failure in NetscapePlugin::fromNPP when using Shockwave in
+        WebKit2
+
+        Reviewed by John Sullivan.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/PassDifferentNPPStruct.cpp: Copied from WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/GetValueNetscapeWindow.cpp.
+        (PassDifferentNPPStruct::PassDifferentNPPStruct): Initialize our
+        members.
+        (PassDifferentNPPStruct::NPP_SetWindow): Pass a different NPP to the
+        browser than the one it gave us in NPP_New and see if it works.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj:
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        Added PassDifferentNPPStruct.
+
+2010-10-19  Adam Roben  <aroben@apple.com>
+
+        Gently nudge old-run-webkit-tests toward working with Win32 Perl
+
+        This makes old-run-webkit-tests able to build DRT and find all the
+        tests to run. It even invokes DRT and passes it the list of tests. But
+        DRT ends up hung blocking on I/O.
+
+        Fixes <http://webkit.org/b/47961> Get old-run-webkit-tests mostly
+        working with Win32 Perl
+
+        Reviewed by David Kilzer.
+
+        * Scripts/old-run-webkit-tests:
+          - Use File::Spec instead of manually concatenating paths
+          - Use dirname instead of manually stripping off the base name
+          - Use isCygwin/isWindows/isAppleWinWebKit more judiciously
+          - Explicitly invoke Perl when running Perl scripts
+          - Quote paths when using them in regular expressions to allow them
+            to include characters that have special meanings in regular
+            expressions
+
+        * Scripts/run-webkit-tests: Use File::Spec instead of manually
+        concatenating paths.
+
+        * Scripts/webkitdirs.pm:
+          - Remove the unused $windowsTmpPath variable
+          - Use isCygwin/isWindows/isAppleWinWebKit more judiciously
+          - Only pass paths to cygpath when using Cygwin Perl
+          - Only use pdevenv when using Cygwin Perl, for now
+
+2010-10-20  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by Martin Robinson.
+
+        Add Git-support to do-file-rename
+        https://bugs.webkit.org/show_bug.cgi?id=48015
+
+        Also, abstracts the SCM move/rename functionality in do-file-rename and
+        do-webcore-rename into a common function VCSUtils::scmMoveOrRenameFile().
+
+        Currently, do-file-rename is hard coded to assume the SCM is Subversion.
+        Instead, we should abstract the rename logic to be SCM-independent. This
+        will allow us to add Git support as well move such functionality into
+        our SCM library VCSUtils, where it can be shared by do-webcore-rename.
+
+        * Scripts/VCSUtils.pm:
+          - Added function scmMoveOrRenameFile.
+        * Scripts/do-file-rename: Modified to call VCSUtils::scmMoveOrRenameFile().
+        * Scripts/do-webcore-rename: Ditto.
+
+2010-10-20  Adam Roben  <aroben@apple.com>
+
+        Fix old-run-webkit-tests when there's a space in the path to DRT
+
+        Reviewed by Jon Honeycutt.
+
+        * Scripts/old-run-webkit-tests: Quote the path to DRT before executing
+        it.
+
+2010-10-20  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        Regression in chromium_gpu_unittests after r70175
+        https://bugs.webkit.org/show_bug.cgi?id=48008
+
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py:
+
+2010-10-20  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by James Robinson.
+
+        chromium_gpu port of new-run-webkit-tests must do Linux -> Win expectations fallback
+        https://bugs.webkit.org/show_bug.cgi?id=48005
+
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu.py:
+
+2010-10-20  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        webkit-patch doesn't get along with git rm
+        https://bugs.webkit.org/show_bug.cgi?id=47940
+
+        Turns out we need to pass "--" to tell git this is a path.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+
+2010-10-20  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Fix layoutTestController.getJsObjectCount
+
+        Qt Bridge doesn't know size_t so pass result as unsigned int.
+
+        Unskip fast/dom/gc-10.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=47931
+
+        * DumpRenderTree/qt/GCControllerQt.cpp:
+        (GCController::getJSObjectCount):
+        * DumpRenderTree/qt/GCControllerQt.h:
+
+2010-10-20  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r70149.
+        http://trac.webkit.org/changeset/70149
+        https://bugs.webkit.org/show_bug.cgi?id=47989
+
+        "Build breaks in mac and win" (Requested by satish on
+        #webkit).
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setMockSpeechInputResultCallback):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::setMockSpeechInputResult):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setMockSpeechInputResult):
+
+2010-10-19  Leandro Gracia Gil  <leandrogracia@google.com>
+
+        Reviewed by Jeremy Orlow.
+
+        Added a second parameter to setMockSpeechInputResult for
+        the language used in speech input.
+        https://bugs.webkit.org/show_bug.cgi?id=47089
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (setMockSpeechInputResultCallback):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::setMockSpeechInputResult):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setMockSpeechInputResult):
+
+2010-10-19  Adam Roben  <aroben@apple.com>
+
+        Teach update-webkit-support-libs about the new versioning of
+        WebKitSupportLibrary
+
+        Fixes <http://webkit.org/b/47915> update-webkit-support-libs should
+        check version numbers instead of modification times
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/update-webkit-support-libs: Fetch the expected version
+        number from developer.apple.com, then compare with the version number
+        of the extracted library and of the zipped library to see if anything
+        needs to be done. Removed code that tracked the modified timestamp of
+        the library, as it is no longer needed.
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        EWS should test patches with r+
+        https://bugs.webkit.org/show_bug.cgi?id=35460
+
+        * QueueStatusServer/handlers/submittoews.py:
+        * QueueStatusServer/model/queues.py:
+        * Scripts/webkitpy/tool/bot/patchcollection.py: Removed.
+        * Scripts/webkitpy/tool/bot/patchcollection_unittest.py: Removed.
+        * Scripts/webkitpy/tool/commands/queues.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Teach feeder-queue how to feed the EWS bots
+        https://bugs.webkit.org/show_bug.cgi?id=47943
+
+        queues.webkit.org already knew how to accept EWS submissions
+        via /submit-to-ews.  This teaches the feeder queue how to post
+        to that page with any new r? patches it sees.
+
+        * QueueStatusServer/model/activeworkitems_unitest.py: Added.
+         - More unit testing is always a good thing.
+        * Scripts/webkitpy/common/net/bugzilla.py:
+        * Scripts/webkitpy/common/net/statusserver.py:
+        * Scripts/webkitpy/tool/bot/feeders.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed, just fixing test-webkitpy.  I'm really on a roll today.
+
+        commit-queue gets stuck when release-patch returns 404
+        https://bugs.webkit.org/show_bug.cgi?id=47935
+
+        Fix test-webkitpy and unittest NetworkTransaction.
+
+        * Scripts/webkitpy/common/net/networktransaction.py:
+        * Scripts/webkitpy/common/net/networktransaction_unittest.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.
+
+        commit-queue gets stuck when release-patch returns 404
+        https://bugs.webkit.org/show_bug.cgi?id=47935
+
+        Turns out ClientForm gets upset if passed an int() instead of a string type.
+        Yay for untestable code.
+
+        * Scripts/webkitpy/common/net/statusserver.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Will get Adam's commentary after his meeting
+        for now this gets the commit-cluster back running.
+
+        commit-queue gets stuck when release-patch returns 404
+        https://bugs.webkit.org/show_bug.cgi?id=47935
+
+        I taught NetworkTransaction the basics of 404 handling.
+        We'll want to go back and teach it how to handle urllib2 404's too
+        and then deploy it to the places that want it.
+
+        * QueueStatusServer/handlers/releasepatch.py:
+        * Scripts/webkitpy/common/net/buildbot.py:
+        * Scripts/webkitpy/common/net/networktransaction.py:
+        * Scripts/webkitpy/common/net/statusserver.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed.  Fixing typos in my previous commit.
+
+        Make patch release explicit and not a magic part of "retry" status
+        https://bugs.webkit.org/show_bug.cgi?id=47909
+
+        All of these typos again due to our inability to unit
+        test much of this code.  I added one unit test where
+        possible.  activeworkitems_unittest.py will be in a separate patch.
+
+        * QueueStatusServer/handlers/releasepatch.py:
+        * QueueStatusServer/main.py:
+        * QueueStatusServer/model/activeworkitems.py:
+        * QueueStatusServer/model/workitems.py:
+        * QueueStatusServer/model/workitems_unittest.py:
+        * QueueStatusServer/templates/releasepatch.html:
+        * Scripts/webkitpy/common/net/statusserver.py:
+
+2010-10-19  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] Use webkit's TestNetscapePlugIn in DRT mac
+        https://bugs.webkit.org/show_bug.cgi?id=47850
+
+        * DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist: Added. Forked
+            because we're going to name our plugin WebKitTestNetscapePlugIn
+            temporarily until the chromium forked plugin goes away.
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make patch release explicit and not a magic part of "retry" status
+        https://bugs.webkit.org/show_bug.cgi?id=47909
+
+        This moves us another step closer to running r+ patches on the EWS bots.
+        Currently all bots just spam /update-work-items with their list of current
+        work items.  queues.webkit.org uses that data for display.  As part of making
+        the EWS run r+ patches, we're moving the official list of patches-to-process
+        into the server, and feeding them out to bots one at a time.  We need to be
+        able to remove patches from the queues one at a time instead of just spamming
+        /update-work-items with a new complete list.  That's what this patch adds.
+
+        * QueueStatusServer/handlers/nextpatch.py:
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/handlers/releasepatch.py: Added.
+        * QueueStatusServer/handlers/statusbubble_unittest.py:
+         - Fix a typo causing test failure.  This was not caught by the bots
+           because they don't have AppEngineLauncher installed and thus don't run
+           the QueueStatusServer tests.
+        * QueueStatusServer/handlers/updatestatus.py:
+        * QueueStatusServer/model/activeworkitems.py:
+        * QueueStatusServer/templates/releasepatch.html: Added.
+        * Scripts/webkitpy/common/net/statusserver.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-10-19  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        cr-mac bubble has caused status bubbles to wrap
+        https://bugs.webkit.org/show_bug.cgi?id=47928
+
+        We now have too many EWSes to fit in the bugs.webkit.org
+        status-bubble iframe when more than a couple EWS builds are pending.
+        To fix this I've reduced the space taken up by queue position,
+        and also moved cr-mac to the end of the list (since it's going to be
+        triple-digits for a while).
+
+        * QueueStatusServer/model/queues.py:
+        * QueueStatusServer/templates/statusbubble.html:
+
+2010-10-19  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by David Levin.
+
+        chromium_gpu port of new-run-webkit-tests must search chromium-gpu directory for expectations
+        https://bugs.webkit.org/show_bug.cgi?id=47874
+
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py:
+
+2010-10-19  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] DumpRenderTree shouldn't put '.' in include path
+        https://bugs.webkit.org/show_bug.cgi?id=47877
+
+        Fix include paths.
+
+        * DumpRenderTree/chromium/AccessibilityController.cpp:
+        * DumpRenderTree/chromium/AccessibilityUIElement.cpp:
+        * DumpRenderTree/chromium/AccessibilityUIElement.h:
+        * DumpRenderTree/chromium/CppBoundClass.cpp:
+        * DumpRenderTree/chromium/CppVariant.cpp:
+        * DumpRenderTree/chromium/CppVariant.h:
+        * DumpRenderTree/chromium/DRTDevToolsAgent.cpp:
+        * DumpRenderTree/chromium/DRTDevToolsAgent.h:
+        * DumpRenderTree/chromium/DRTDevToolsCallArgs.h:
+        * DumpRenderTree/chromium/DRTDevToolsClient.cpp:
+        * DumpRenderTree/chromium/DRTDevToolsClient.h:
+        * DumpRenderTree/chromium/EventSender.cpp:
+        * DumpRenderTree/chromium/EventSender.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/chromium/MockSpellCheck.cpp:
+        * DumpRenderTree/chromium/NotificationPresenter.cpp:
+        * DumpRenderTree/chromium/NotificationPresenter.h:
+        * DumpRenderTree/chromium/PlainTextController.cpp:
+        * DumpRenderTree/chromium/Task.cpp:
+        * DumpRenderTree/chromium/TestNavigationController.h:
+        * DumpRenderTree/chromium/TestShell.cpp:
+        * DumpRenderTree/chromium/TestWebWorker.h:
+        * DumpRenderTree/chromium/TextInputController.cpp:
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        * DumpRenderTree/chromium/WebPreferences.h:
+        * DumpRenderTree/chromium/WebThemeEngineDRT.cpp:
+        * DumpRenderTree/chromium/WebThemeEngineDRT.h:
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        * DumpRenderTree/chromium/WebViewHost.h:
+
+2010-10-19  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Need to include WKErrorRef in the WKPageDidFail... functions
+        https://bugs.webkit.org/show_bug.cgi?id=47871
+
+        Update tools for new parameter in failure callbacks.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (didFailProvisionalLoadWithErrorForFrame):
+        (didFailLoadWithErrorForFrame):
+        (-[BrowserWindowController updateProvisionalURLForFrame:]):
+        * TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp:
+        (TestWebKitAPI::didFailProvisionalLoadWithErrorForFrame):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        (WTR::InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame):
+        (WTR::InjectedBundlePage::didFailLoadWithErrorForFrame):
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.h:
+
+2010-10-19  Luiz Agostini  <luiz.agostini@openbossa.org>
+
+        Reviewed by Antti Koivisto.
+
+        [Qt] WebKit2 MacOS build fix
+        https://bugs.webkit.org/show_bug.cgi?id=47897
+
+        Qt WebKit2 MacOS build fix.
+
+        * WebKitTestRunner/PlatformWebView.h:
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+
+2010-10-19  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        webkit-patch stats the filesystem too many times
+        https://bugs.webkit.org/show_bug.cgi?id=47883
+
+        This patch attempts to cache the list of changed files more agressively
+        and to use that list to compute the diff instead of stating the file
+        system again.
+
+        * Scripts/webkitpy/common/checkout/api.py:
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+        * Scripts/webkitpy/tool/steps/abstractstep.py:
+        * Scripts/webkitpy/tool/steps/editchangelog.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+
+2010-10-19  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/47741> Make sort-Xcode-project-file a little more friendly
+
+        Reviewed by Darin Adler.
+
+        * Scripts/sort-Xcode-project-file:
+        - Don't print an error message about missing arguments when
+          -h|--help is used.
+        - Allow Xcode project files to be specified as Project.xcodeproj
+          instead of Project.xcodeproj/project.pbxproj.
+
+2010-10-18  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] QtTestBrowser: Prevent calling load() directly from loadFinished() in robot mode.
+        https://bugs.webkit.org/show_bug.cgi?id=47809
+
+        Connecting a call to load from the loadFinished signal can cause
+        re-entrance crashes in WebCore. This patch uses a timer to do so,
+        also giving some time to subsequent frames to finish loading.
+
+        * QtTestBrowser/urlloader.cpp:
+        (UrlLoader::UrlLoader):
+        (UrlLoader::loadNext):
+        (UrlLoader::checkIfFinished):
+        (UrlLoader::frameLoadStarted):
+        (UrlLoader::frameLoadFinished):
+        * QtTestBrowser/urlloader.h:
+
+2010-10-19  Sergio Villar Senín  <svillar@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] http/history tests are failing
+        https://bugs.webkit.org/show_bug.cgi?id=36173
+
+        Clear the history each time a test is run. Return the actual
+        history item count when calling
+        LayoutTestController::webHistoryItemCount
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::webHistoryItemCount):
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add Chromium Mac EWS to the list of queues at queues.webkit.org
+        https://bugs.webkit.org/show_bug.cgi?id=47878
+
+        * QueueStatusServer/model/queues.py:
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        queues.webkit.org/next_patch is always 404
+        https://bugs.webkit.org/show_bug.cgi?id=47881
+
+        With the addition of the Queue class, I changed most of the
+        code to lookup WorkItems using get_or_insert with a key_name
+        instead of WorkItems.all().filter(queue_name=).
+        Because the new get_or_insert code uses an explicit key_name
+        (which is obviously different from the previously autogenerated
+        ones), there were new WorkItem records created for each queue.
+        However, some parts of the code still use WorkItems.all().filter,
+        thus some parts were getting the new record and some parts the old record.
+
+        The same basic bug was occurring with ActiveWorkItems, because I
+        changed the key_name for that class as well.
+
+        To fix this I've moved more of the code over to using Queue.*work_items.
+        I've also enabled the datastore_admin (new in GAE 1.3.8) so that
+        we can go delete the old WorkItems records.
+        I also changed remote_api to use the new builtin: syntax (also added in GAE 1.3.8).
+
+        * QueueStatusServer/app.yaml:
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/handlers/recentstatus.py:
+        * QueueStatusServer/handlers/updatestatus.py:
+        * QueueStatusServer/handlers/updateworkitems.py:
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Correct a bunch of typos in QueueStatusServer
+        https://bugs.webkit.org/show_bug.cgi?id=47880
+
+        These are all due to our complete lack of unit testing in QueueStatusServer.
+        I added a couple unit tests to cover a few of these fixes, but most of these
+        are still only caught by actually running the application.
+
+        * QueueStatusServer/handlers/nextpatch.py:
+        * QueueStatusServer/handlers/statusbubble.py:
+        * QueueStatusServer/handlers/statusbubble_unittest.py: Added.
+        * QueueStatusServer/handlers/updateworkitems.py:
+        * QueueStatusServer/model/attachment.py:
+        * QueueStatusServer/model/queuepropertymixin.py:
+        * QueueStatusServer/model/queuepropertymixin_unittest.py:
+        * QueueStatusServer/model/workitems.py:
+        * QueueStatusServer/model/workitems_unittest.py: Added.
+
+2010-10-18  Adam Barth  <abarth@webkit.org>
+
+        Disable this test because it's failing on the bots and the authors
+        aren't around to fix it.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        CC authors of flaky tests when the commit-queue hits a flaky test
+        https://bugs.webkit.org/show_bug.cgi?id=47872
+
+        * Scripts/webkitpy/common/checkout/api.py:
+        * Scripts/webkitpy/common/net/layouttestresults.py:
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to run a chromium-mac-ews builder
+        https://bugs.webkit.org/show_bug.cgi?id=47876
+
+        Since we can't run Mac OS X in a VM, we need to only run committer patches.
+        There was a multiple inheritance problem which was holding this patch back,
+        but I decided to just ignore the problem and go with a functional hack for now.
+
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+
+2010-10-18  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Tony Chang.
+
+        Regression in run_webkit_tests_unittest from r70017
+        https://bugs.webkit.org/show_bug.cgi?id=47875
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Implement webkit-patch suggest-reviewers
+        https://bugs.webkit.org/show_bug.cgi?id=47866
+
+        * Scripts/webkitpy/common/checkout/api.py:
+            - The main logic.  We look at the last five changes to each
+              modified (non-ChangeLog) file and collect up the reviewers of
+              those changes as well as the authors of those changes who are
+              reviewers.
+        * Scripts/webkitpy/common/checkout/api_unittest.py:
+            - Test the logic with some fun mocks.
+        * Scripts/webkitpy/common/checkout/scm.py:
+            - Fix a bug when you have local git commits.
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+            - Test that the bug is fixed.
+        * Scripts/webkitpy/tool/commands/queries.py:
+            - Add the query.
+
+2010-10-18  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Eric Seidel.
+
+        new-run-webkit-tests produces corrupt PNG baselines on Windows
+        https://bugs.webkit.org/show_bug.cgi?id=47867
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Make it possible to submit patches to the EWS bots
+        https://bugs.webkit.org/show_bug.cgi?id=47869
+
+        * QueueStatusServer/handlers/nextpatch.py:
+         - Move more logic into Queue, so that it can be shared with SubmitToEWS.
+        * QueueStatusServer/handlers/queuestatus.py:
+         - Fix two typos from a previous commit.
+        * QueueStatusServer/handlers/submittoews.py: Added.
+        * QueueStatusServer/handlers/updatestatus.py:
+         - Use the new is_retry_request method to share this (hacky) code with SubmitToEWS
+        * QueueStatusServer/main.py:
+         - Add /submit-to-ews
+        * QueueStatusServer/model/queuepropertymixin.py:
+         - Fix circular imports caused by adding Queue.work_items()
+        * QueueStatusServer/model/queues.py:
+         - Add work_items() and active_work_items()
+        * QueueStatusServer/model/queuestatus.py:
+        * QueueStatusServer/model/workitems.py:
+         - Add transaction-safe add/remove methods.
+        * QueueStatusServer/templates/submittoews.html: Added.
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Deploy Queue class in more places throughout QueueStatusServer
+        https://bugs.webkit.org/show_bug.cgi?id=47855
+
+        I also caught two typos from the previous change.  Unfortunately
+        I don't yet know how to unittest request handlers yet.
+
+        * QueueStatusServer/handlers/dashboard.py:
+        * QueueStatusServer/handlers/statusbubble.py:
+        * QueueStatusServer/handlers/updateworkitems.py:
+        * QueueStatusServer/model/activeworkitems.py:
+        * QueueStatusServer/model/attachment.py:
+        * QueueStatusServer/model/queuepropertymixin.py: Added.
+        * QueueStatusServer/model/queuepropertymixin_unittest.py: Added.
+        * QueueStatusServer/model/queuestatus.py:
+        * QueueStatusServer/model/workitems.py:
+
+2010-10-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        scm.py should be able tell us what revisions made changes to a given file
+        https://bugs.webkit.org/show_bug.cgi?id=47863
+
+        Look again, your SCM.py can now log files.
+
+        * Scripts/webkitpy/common/checkout/scm.py:
+        * Scripts/webkitpy/common/checkout/scm_unittest.py:
+
+2010-10-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Siedel.
+
+        new-run-webkit-tests: clean up the options-parsing code in the port
+        classes.
+        
+        This change modifies the Port interface to have a get_option() and
+        set_option_default() method for accessing the options argument
+        passed to the constructor. If the constructor is not passed an
+        options argument, we default to a MockOptions() argument from
+        mocktool, which has the same semantics we want.
+
+        Note that there is a disadvantage to port.get_option('foo') over
+        port._options.foo, which is that you lose some of the checking
+        for whether 'foo' is set (typos result in the default value, not
+        an exception being raised. This is desired in this case, since the
+        Port class is not allowed to assume that options does have any
+        particular values set, and so this change ensures that all of
+        the subclasses are following the same, intended, logic.
+
+        Arguably this is the wrong semantics to have, and the Port
+        classes should be able to assume a default set of
+        attributes/arguments, but that change will need to wait for a
+        different CL where we can modify new-run-webkit-tests to pull a
+        list of arguments from the port factory routines.
+
+        Also, add unit tests for webkitpy.tool.mocktool.MockOptions .
+
+        https://bugs.webkit.org/show_bug.cgi?id=47510
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_linux.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_mac.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/port/dryrun.py:
+        * Scripts/webkitpy/layout_tests/port/factory_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/mac_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/port_testcase.py:
+        * Scripts/webkitpy/layout_tests/port/test.py:
+        * Scripts/webkitpy/layout_tests/port/webkit.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+        * Scripts/webkitpy/tool/mocktool_unittest.py: Added.
+
+2010-10-18  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Re-submit a revised version of r69638 - enabling new-run-webkit-tests
+        under cygwin. The initial version had a bug in base:uri_to_test_name
+        that was causing tests to fail. This version corrects that bug, but
+        also makes the code safer by calling cygpath more reliably, and
+        leaving a long-running cygpath process open.
+
+        This patch also corrects a couple of minor bugs in http_lock_unittest,
+        chromium_unittest, and dedpulicate_tests_unittest that showed up
+        while testing this.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47220
+
+        * Scripts/webkitpy/common/system/path.py:
+        * Scripts/webkitpy/common/system/path_unittest.py:
+        * Scripts/webkitpy/layout_tests/deduplicate_tests_unittest.py:
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/http_lock_unittest.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2010-10-18  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Add Queue class and add minimal unittesting of QueueStatusServer code
+        https://bugs.webkit.org/show_bug.cgi?id=47847
+
+        * QueueStatusServer/handlers/dashboard.py:
+        * QueueStatusServer/handlers/queuestatus.py:
+        * QueueStatusServer/handlers/recentstatus.py:
+        * QueueStatusServer/handlers/statusbubble.py:
+        * QueueStatusServer/handlers/updateworkitems.py:
+        * QueueStatusServer/model/attachment.py:
+        * QueueStatusServer/model/queues.py:
+        * QueueStatusServer/model/queues_unittest.py: Added.
+        * QueueStatusServer/model/svnrevision.py:
+        * Scripts/test-webkitpy:
+        * Scripts/webkitpy/test/main.py:
+
+2010-10-18  Anders Carlsson  <andersca@apple.com>
+
+        Fix build.
+
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (handleEventCarbon):
+
+2010-10-18  Stuart Morgan  <stuartmorgan@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        Switch to using the new Carbon NPAPI event declarations, and remove
+        the old ones.
+
+        https://bugs.webkit.org/show_bug.cgi?id=40784
+
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (handleEventCarbon):
+
+2010-10-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        check-webkit-style should treat the GObject binding directory like other GTK directories.
+        https://bugs.webkit.org/show_bug.cgi?id=47796
+
+        * Scripts/webkitpy/style/checker.py: Added the GObject binding directory
+        with the other gtk directories (and fixed typo).
+
+2010-10-18  David Levin  <levin@chromium.org>
+
+        Reviewed by Oliver Hunt.
+
+        check-webkit-style needs to ignore underscores in opcode names and vm_throw
+        https://bugs.webkit.org/show_bug.cgi?id=47789
+
+        * Scripts/webkitpy/style/checker.py: Added the exception for the assembler directory.
+        * Scripts/webkitpy/style/checkers/cpp.py: Added special cased names.
+        * Scripts/webkitpy/style/checkers/cpp_unittest.py: Added unit tests for the special cases.
+
+2010-10-18  MORITA Hajime  <morrita@google.com>
+
+        Reviewed by Kent Tamura.
+
+        TextInputController.hasSpellingMarkers() should be owned by LayoutTestController
+        https://bugs.webkit.org/show_bug.cgi?id=47659
+        
+        Moved hasSpellingMarkers() from TextInputController to
+        LayoutTestController.  Currently the implementation is available
+        only for Mac and for Chromium.
+
+        * DumpRenderTree/LayoutTestController.cpp:
+        (hasSpellingMarkerCallback):
+        (LayoutTestController::staticFunctions):
+        * DumpRenderTree/LayoutTestController.h:
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::hasSpellingMarker):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+        * DumpRenderTree/chromium/TextInputController.cpp:
+        (TextInputController::TextInputController):
+        (TextInputController::makeAttributedString):
+        * DumpRenderTree/chromium/TextInputController.h:
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::hasSpellingMarker):
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::hasSpellingMarker):
+        * DumpRenderTree/mac/TextInputController.m:
+        (+[TextInputController isSelectorExcludedFromWebScript:]):
+        (+[TextInputController webScriptNameForSelector:]):
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::hasSpellingMarker):
+        * DumpRenderTree/qt/LayoutTestControllerQt.h:
+        * DumpRenderTree/win/LayoutTestControllerWin.cpp:
+        (LayoutTestController::hasSpellingMarker):
+        * DumpRenderTree/wx/LayoutTestControllerWx.cpp:
+        (LayoutTestController::hasSpellingMarker):
+
+2010-10-18  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by David Levin.
+
+        commit-queue's flaky test notice is very Pythony
+        https://bugs.webkit.org/show_bug.cgi?id=47790
+
+        This patch make the list of tests delimted by \n instead of just
+        converting the array to a string.
+
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2010-10-14  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Martin Robinson and Xan Lopez.
+
+        [Gtk]: DRT does not support frame flattening testing
+        https://bugs.webkit.org/show_bug.cgi?id=38650
+
+        Implement DRT's support for toggling on/off frame flattening
+        support.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues):
+        * DumpRenderTree/gtk/LayoutTestControllerGtk.cpp:
+        (LayoutTestController::setFrameFlatteningEnabled):
+
+2010-10-15  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Siedel.
+
+        mocktool.MockOptions is inheriting from Mock, which has the side
+        effect of defaulting any attribute to another MockObject. So,
+        MockOptions().foo would always evaluate to true. This was
+        covering over bugs in the unit tests, and is probably the wrong
+        default behavior for anything attempting to mock out the options
+        argument returned from optparse.parse_args().
+
+        This patch changes the default behavior. The new MockOptions()
+        class takes an optional list of keyword parameters to set; this
+        patch doesn't use that feature but the fix for bug 47510 will.
+
+        Also, this patch just fills in the default values necessary to
+        get all of the tests to pass; I didn't stare at each test by
+        hand to determine the "right" values. We can either fix that in
+        subsequent patches or let me know if we want to do that now (and
+        give me some guidance on what those values might want to be).
+
+        https://bugs.webkit.org/show_bug.cgi?id=47709
+
+        * Scripts/webkitpy/tool/commands/commandtest.py:
+        * Scripts/webkitpy/tool/commands/download_unittest.py:
+        * Scripts/webkitpy/tool/commands/upload_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+        * Scripts/webkitpy/tool/steps/steps_unittest.py:
+        * Scripts/webkitpy/tool/steps/updatechangelogswithreview_unittest.py:
+
+2010-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix the build; need to add new slot to PageUIClient callbacks.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController awakeFromNib]):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::createOtherPage):
+        (WTR::TestController::initialize):
+
+2010-10-15  Simon Fraser  <simon.fraser@apple.com>
+
+        Add Matt Delaney to committers.py.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-10-15  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] compile TestNetscapePlugIn on Chromium mac
+        https://bugs.webkit.org/show_bug.cgi?id=47633
+
+        * DumpRenderTree/DumpRenderTree.gypi: files to compile
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp: Use ifdef because gcc was complaining
+        (NP_GetEntryPoints):
+        (NPP_New):
+        (NPP_Destroy):
+        (NPP_HandleEvent):
+        (NPP_GetValue):
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h: Added.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h: Added.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h: Added.
+
+2010-10-15  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        build-webkit: Should die when make fails when build a CMake project
+        https://bugs.webkit.org/show_bug.cgi?id=47726
+
+        * Scripts/webkitdirs.pm: If make fails, die immediately.
+
+2010-10-15  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69809.
+        http://trac.webkit.org/changeset/69809
+        https://bugs.webkit.org/show_bug.cgi?id=47725
+
+        Broke chromium mac compile (Requested by japhet on #webkit).
+
+        * DumpRenderTree/DumpRenderTree.gypi:
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp:
+        (NP_GetEntryPoints):
+        (NPP_New):
+        (NPP_Destroy):
+        (NPP_HandleEvent):
+        (NPP_GetValue):
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h: Removed.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h: Removed.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h: Removed.
+
+2010-10-15  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        test-webkitpy fails on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=47713
+
+        The old code failed on Linux because the MacPort tries to read
+        something out of platform that doesn't make sense on Linux.
+
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-10-14  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WTR is sloooow
+        https://bugs.webkit.org/show_bug.cgi?id=47695
+
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        Change the timer interval of RunUntilConditionLoop from
+        50 milliseconds to 1 to avoid wasting time after the 
+        test had been finished.
+
+2010-10-14  Eric Seidel  <eric@webkit.org>
+
+        Unreviewed, just fixing an exception seen on the commit-queue.
+
+        I should have unit tested this function before.
+
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2010-10-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        commit-queue should not fail patches due to flaky tests
+        https://bugs.webkit.org/show_bug.cgi?id=47647
+
+        This patch makes it so that the *same* flaky test has to fail
+        twice in a row to have a false negative from a flaky test.
+
+        If different flaky tests fail (or if a test fails and then passes
+        in a second run) then we will warn in the bug that we encountered
+        a flaky test.
+
+        This patch grew to include moving port off of steps onto tool
+        (which Adam wrote and then I integrated), as well as removing the
+        use of tool from CommitQueueTask.
+
+        * Scripts/webkitpy/common/config/ports.py:
+         - Added a layout_test_results_path method.  This covers old-run-webkit-tests
+           but doesn't cover NRWT.  This is probably not the long term solution, but
+           putting this knowledge on port makes more sense than in LayoutTestResults.
+        * Scripts/webkitpy/common/net/buildbot.py:
+         - LayoutTestResults shouldn't know how to fetch from the network, make
+           the Build code do that instead.
+        * Scripts/webkitpy/common/net/buildbot_unittest.py:
+         - Code style fix.
+        * Scripts/webkitpy/common/net/layouttestresults.py:
+         - Remove code for reading from the network.
+        * Scripts/webkitpy/common/net/layouttestresults_unittest.py:
+         - Test the new entrypoint.
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+         - Make the delegate interface explicit.
+         - Remove the _tool member, since using the delegate for
+           everything is cleaner.
+         - Teach the testing logic how to deal with flaky tests.
+        * Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py:
+         - Update to match the CommitQueueTask changes.
+        * Scripts/webkitpy/tool/commands/queues.py:
+         - Use the new CommitQueueTaskDelegate interface.
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+         - Fix the SecondThoughtsCommitQueue test which was broken.
+         - Add a new test to make sure the flaky test reporting works.
+        * Scripts/webkitpy/tool/main.py:
+         - Store the port on the tool object.
+        * Scripts/webkitpy/tool/mocktool.py:
+         - Add a port() accessor to MockTool
+        * Scripts/webkitpy/tool/steps/abstractstep.py:
+         - Move port() off of Step and onto Tool.
+        * Scripts/webkitpy/tool/steps/build.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+        * Scripts/webkitpy/tool/steps/runtests.py:
+        * Scripts/webkitpy/tool/steps/steps_unittest.py:
+         - Two tests with the same name!  only the latter was being run.
+        * Scripts/webkitpy/tool/steps/update.py:
+
+2010-10-14  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        new-run-webkit-tests will now handle missing Ruby installs (or
+        missing PrettyPatch scripts) more cleanly - previously this
+        would be detected when we actually tried to create the diff, and
+        the error message was obscure. Now we'll log a warning up front
+        and otherwise be silent.
+
+        This change also refactors some global variables to be class or
+        instance variables to be slightly more testable and more
+        modular. There are no cases where we create lots of port objects
+        and can't afford to test for configurations repeatedly, so
+        there's no performance concern here.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47466
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2010-10-08  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Form controls do not respect GTK+ font size
+        https://bugs.webkit.org/show_bug.cgi?id=47134
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGtkFontSettings): Initialize the font control size when running
+        DumpRenderTree to a standard value.
+
+2010-10-14  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] compile TestNetscapePlugIn on Chromium mac
+        https://bugs.webkit.org/show_bug.cgi?id=47633
+
+        * DumpRenderTree/DumpRenderTree.gypi: files to compile
+        * DumpRenderTree/TestNetscapePlugIn/main.cpp: Use ifdef because gcc was complaining
+        (NP_GetEntryPoints):
+        (NPP_New):
+        (NPP_Destroy):
+        (NPP_HandleEvent):
+        (NPP_GetValue):
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h: Added.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h: Added.
+        * DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h: Added.
+
+2010-10-14  Victor Wang  <victorw@chromium.org>
+
+        Reviewed by Nate Chapin.
+
+        [Chromium] Fix rebaseline_chromium_webkit_tests to use 0 tolerance image diff.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47686
+
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+
+2010-10-14  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        test-webkitpy spews Delegate terminated queue messages
+        https://bugs.webkit.org/show_bug.cgi?id=47678
+
+        * Scripts/webkitpy/tool/bot/queueengine_unittest.py:
+
+2010-10-14  Adam Roben  <aroben@apple.com>
+
+        Test that pressing the Alt key generates a WM_SYSCOMMAND message
+
+        Test for <http://webkit.org/b/47671> <rdar://problem/8435594> Pressing
+        the Alt key when MiniBrowser's WKView is focused doesn't send focus to
+        the menu bar
+
+        Reviewed by Steve Falkenburg.
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICommon.vsprops: Added
+        TestWebKitAPI/win to the include path so that WindowMessageObserver
+        can be found.
+
+        * TestWebKitAPI/PlatformWebView.h: Added simulateAltKeyPress and
+        Windows-specific members.
+        (TestWebKitAPI::PlatformWebView::setParentWindowMessageObserver):
+        Added this simple setter.
+
+        * TestWebKitAPI/Tests/WebKit2/win/AltKeyGeneratesWMSysCommand.cpp: Added.
+        (TestWebKitAPI::WMSysCommandObserver::WMSysCommandObserver):
+        Initialize our lone data member.
+        (TestWebKitAPI::WMSysCommandObserver::windowDidReceiveWMSysCommand):
+        Simple getter.
+        (TestWebKitAPI::WMSysCommandObserver::windowReceivedMessage): Record
+        when a WM_SYSCOMMAND message is received.
+        (TestWebKitAPI::didNotHandleKeyEventCallback): Record when a
+        WM_SYSKEYUP message is not handled.
+        (TestWebKitAPI::WebKit2_AltKeyGeneratesWMSysCommand): Simulate
+        pressing the Alt key and check that a WM_SYSCOMMAND message got sent
+        to the WKView's parent window.
+
+        * TestWebKitAPI/win/PlatformWebViewWin.cpp:
+        (TestWebKitAPI::PlatformWebView::registerWindowClass): Made this a
+        member function so it could access PlatformWebView::wndProc. Use
+        PlatformWebView::wndProc as the WNDPROC.
+        (TestWebKitAPI::PlatformWebView::PlatformWebView): Initialize our new
+        data member and pass the this pointer to CreateWindowEx so we can
+        store it on the HWND.
+        (TestWebKitAPI::PlatformWebView::simulateSpacebarKeyPress): Moved some
+        constants from here to the top of the file.
+        (TestWebKitAPI::PlatformWebView::simulateAltKeyPress): Added. Sends
+        the same messages that Notepad receives when you press the Alt key.
+        (TestWebKitAPI::PlatformWebView::wndProc): Added.
+          - When WM_CREATE is received, we set the PlatformWebView instance
+            pointer as a property on the HWND so we can access it later.
+          - For other messages, we try to get the PlatformWebView instance
+            pointer from the HWND property.
+          - When WM_NCDESTROY is received (which is the last message we will
+            receive), we remove the PlatformWebView instance property.
+          - Pass messages to the parent window's message observer, if there is
+            one.
+          - Pass all messages through to ::DefWindowProcW.
+
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj: Added WindowMessageObserver
+        and AltKeyGeneratesWMSysCommand.
+
+        * TestWebKitAPI/win/WindowMessageObserver.h: Added. This class can be
+        used to observe messages sent to one or more windows.
+
+2010-10-01  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Holger Freyther.
+
+        [GTK] REGRESSION: FreeType backend does not respect XSettings font settings after r68558
+        https://bugs.webkit.org/show_bug.cgi?id=47033
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeGtkFontSettings): Added this method which initializes XSettings
+        font settings to consistent values before running a test. For the one test
+        in which we need subpixel aliasing turned on, do that.
+        (initializeFonts): Accepts a testURL parameter now and delegates to initializeGtkFontSettings.
+        (runTest): Pass the testURL to initializeFonts.
+
+2010-10-14  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        ChromiumXVFBPort.run_webkit_tests_command has infinite recursion
+        https://bugs.webkit.org/show_bug.cgi?id=47655
+
+        * Scripts/webkitpy/common/config/ports.py:
+        * Scripts/webkitpy/common/config/ports_unittest.py:
+
+2010-10-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        beat diff_parser with the ugly stick
+        https://bugs.webkit.org/show_bug.cgi?id=47626
+
+        * Scripts/webkitpy/common/checkout/diff_parser.py:
+        * Scripts/webkitpy/style/patchreader.py:
+        * Scripts/webkitpy/style/patchreader_unittest.py:
+
+2010-10-13  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        Break LayoutTestResults out into its own file
+        https://bugs.webkit.org/show_bug.cgi?id=47637
+
+        * Scripts/webkitpy/common/net/buildbot.py:
+        * Scripts/webkitpy/common/net/buildbot_unittest.py:
+        * Scripts/webkitpy/common/net/layouttestresults.py: Added.
+        * Scripts/webkitpy/common/net/layouttestresults_unittest.py: Added.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Chromium port can't run JavaScriptCore tests
+        https://bugs.webkit.org/show_bug.cgi?id=47654
+
+        This lets webkit-patch build-and-test work on Chromium.
+
+        * Scripts/webkitpy/common/config/ports.py:
+        * Scripts/webkitpy/tool/steps/runtests.py:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Make --port a global option and pass the port information to the commit-queue subprocess
+        https://bugs.webkit.org/show_bug.cgi?id=47650
+
+        This patch paves the way to run the commit-queue on a non-Mac port.
+
+        * Scripts/webkitpy/tool/commands/queues.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/commands/queuestest.py:
+        * Scripts/webkitpy/tool/main.py:
+        * Scripts/webkitpy/tool/steps/options.py:
+        * Scripts/webkitpy/tool/steps/preparechangelog.py:
+        * Scripts/webkitpy/tool/steps/runtests.py:
+        * Scripts/webkitpy/tool/steps/update.py:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Introduce the ChromiumXVFBPort for running commit-queue on EC2
+        https://bugs.webkit.org/show_bug.cgi?id=47653
+
+        I'm not entirely sure this is the best way to do this, but we need to
+        run the tests under XVFB on EC2 because the EC2 instances don't have a
+        real monitor hooked up.  This patch adds a ChromiumXVFBPort that runs
+        that way.  The idea is that XVFB is like a platform for the Chromium
+        port, but we don't have a real notion of platform separate from port.
+
+        * Scripts/webkitpy/common/config/ports.py:
+
+2010-10-13  Sergio Villar Senin  <svillar@igalia.com>
+
+        Reviewed by Martin Robinson.
+
+        [GTK] Add HTTP caching support
+        https://bugs.webkit.org/show_bug.cgi?id=44261
+
+        Add include paths for the new soup HTTP cache code.
+
+        * GNUmakefile.am: Add paths for the new soup HTTP cache code.
+
+2010-10-13  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] QtTestBrowser shows two Url input fields
+        https://bugs.webkit.org/show_bug.cgi?id=47613
+
+        * QtTestBrowser/mainwindow.cpp:
+        (MainWindow::MainWindow):
+        (MainWindow::buildUI):
+
+2010-10-13  Yi Shen  <yi.4.shen@nokia.com>
+
+        Reviewed by Tony Chang.
+
+        [gdb] Add pretty-print supports for UString, Identifier and JSString
+        https://bugs.webkit.org/show_bug.cgi?id=47601
+
+        * gdb/webkit.py:
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Add list of Ubuntu packages needed by the EWS bots
+        https://bugs.webkit.org/show_bug.cgi?id=47628
+
+        I've been copy/pasting this list between bots, but it's better to have
+        this checked in.
+
+        * EWSTools/ubuntu-ews-packages: Added.
+
+2010-10-13  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [EFL] Adds a build slave.
+        https://bugs.webkit.org/show_bug.cgi?id=47290
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json: Add an
+        entry for a release build of the EFL port.
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Add platform
+        flag to build the EFL port.
+
+2010-10-13  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        webkit-patch build shouldn't need --build to actually build!
+        https://bugs.webkit.org/show_bug.cgi?id=47438
+
+        Yeah, requiring --build for the build command is really dumb.  We did
+        this originally because the build step is usually optional in other
+        commands.  We don't have a good way of reversing the default for an
+        option in one command.  This approach is slightly hacky since --build
+        still shows up as an option on the help page, but at least it makes
+        progress.  Passing --build is harmless, so the EWS bots shouldn't
+        explode because of this change.
+
+        * Scripts/webkitpy/tool/bot/commitqueuetask.py:
+        * Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py:
+        * Scripts/webkitpy/tool/commands/download.py:
+        * Scripts/webkitpy/tool/commands/earlywarningsystem.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+
+2010-10-13  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69638.
+        http://trac.webkit.org/changeset/69638
+        https://bugs.webkit.org/show_bug.cgi?id=47595
+
+        "Broke win and chromium-win bots" (Requested by dglazkov on
+        #webkit).
+
+        * Scripts/webkitpy/common/system/path.py:
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2010-10-13  John Knottenbelt  <jknotten@chromium.org>
+
+        Reviewed by Steve Block.
+
+        First step towards client-based Geolocation in Chromium. Build
+        fixes for CLIENT_BASED_GEOLOCATION preprocessor feature define.
+        https://bugs.webkit.org/show_bug.cgi?id=47586
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        * DumpRenderTree/chromium/WebViewHost.h:
+
+2010-10-13  Adam Roben  <aroben@apple.com>
+
+        Test that pressing the spacebar in a text field does not scroll the
+        document
+
+        Test for <http://webkit.org/b/47544> <rdar://problem/8540645>
+        REGRESSION: Pressing spacebar in a text field in WebKit2 does not
+        insert a space, scrolls the page instead
+
+        Reviewed by Sam Weinig.
+
+        * TestWebKitAPI/PlatformUtilities.h: Added isKeyDown.
+
+        * TestWebKitAPI/PlatformWebView.h: Added simulateSpacebarKeyPress.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj:
+        * TestWebKitAPI/win/copy-resources.cmd:
+        Added new files.
+
+        * TestWebKitAPI/Tests/WebKit2/SpacebarScrolling.cpp: Added.
+        (TestWebKitAPI::JavaScriptCallbackContext::JavaScriptCallbackContext):
+        We use this to track what the result of calling into JavaScript was.
+        (TestWebKitAPI::didFinishLoadForFrame): Records when the page
+        finishes loading.
+        (TestWebKitAPI::didNotHandleKeyEventCallback): Records when a key down
+        event is not handled.
+        (TestWebKitAPI::javaScriptCallback): Records that JavaScript finished
+        executing and whether the result matched our expectation.
+        (TestWebKitAPI::wk): Turns a UTF-8 C string into a WKStringRef.
+        (TestWebKitAPI::runJSTest): Calls into JS, waits for the call to
+        complete, and returns whether we got back the expected result.
+        (TestWebKitAPI::WebKit2_SpacebarScrolling): Tests that pressing
+        spacebar inside a text field does not scroll the document and that
+        pressing it outside the text field does scroll the document.
+
+        * TestWebKitAPI/Tests/WebKit2/spacebar-scrolling.html: Added.
+
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
+        (TestWebKitAPI::Util::isKeyDown): Checks the event's type.
+
+        * TestWebKitAPI/mac/PlatformWebViewMac.mm:
+        (TestWebKitAPI::PlatformWebView::simulateSpacebarKeyPress): Copied
+        code from DRT's EventSendingController.
+
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp:
+        (TestWebKitAPI::Util::isKeyDown): Checks the message's type.
+
+        * TestWebKitAPI/win/PlatformWebViewWin.cpp:
+        (TestWebKitAPI::PlatformWebView::simulateSpacebarKeyPress): Send the
+        same messages that get sent when you press spacebar in Notepad.
+
+2010-10-13  Adam Roben  <aroben@apple.com>
+
+        Fix a couple of issues with the TestWebKitAPI build
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICFLite.vsprops:
+        * TestWebKitAPI/Configurations/TestWebKitAPICoreFoundation.vsprops:
+        Fixed a typo.
+
+        * TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj: Use common.vsprops
+        to set our output and intermediate directories so that we don't spew
+        files into the source tree.
+
+2010-10-13  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        WTR should accept relative paths
+        https://bugs.webkit.org/show_bug.cgi?id=47486
+
+        * WebKitTestRunner/StringFunctions.h:
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::createWKURL): Moved from StringFunctions.h since it is
+        used only here. Extend relative paths to absolute.
+
+2010-10-12  Adam Roben  <aroben@apple.com>
+
+        Make TestWebKitAPI work on Windows
+
+        Fixes <http://webkit.org/b/47552> <rdar://problem/8541708>.
+
+        Reviewed by Sam Weinig.
+
+        * Scripts/build-api-tests: Build TestWebKitAPI.sln on Windows.
+
+        * Scripts/run-api-tests: Fix the PATH so that TestWebKitAPI can be
+        run on Windows.
+        (runTest): Added code to run TestWebKitAPI.exe on Windows and to die
+        on unsupported platforms.
+        (populateTests): Added code to run TestWebKitAPI.exe on Windows and to
+        die on other platforms. Extracted some formerly-Mac-specific code to
+        be cross-platform and made it handle any style of line-endings.
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICFLite.vsprops: Added.
+        Links against CFLite.
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICommon.vsprops: Added.
+        Contains most properties for the project.
+
+        * TestWebKitAPI/Configurations/TestWebKitAPICoreFoundation.vsprops:
+        Added. Links against CoreFoundation.
+
+        * TestWebKitAPI/TestWebKitAPIPrefix.h: Added a Windows-specific
+        section and moved the cross-platform section after the
+        platform-specific parts.
+
+        * TestWebKitAPI/win/PlatformUtilitiesWin.cpp: Added.
+        (TestWebKitAPI::Util::run): Runs a normal message pump until we're
+        done.
+        (TestWebKitAPI::Util::cf): Turns a UTF-8 C string into a CFString.
+        (TestWebKitAPI::Util::createURLForResource): Uses CFBundle to get the
+        resource path.
+        (TestWebKitAPI::Util::URLForNonExistentResource): Creates a bogus
+        WKURL.
+
+        * TestWebKitAPI/win/PlatformWebViewWin.cpp: Added.
+        (TestWebKitAPI::registerWindowClass):
+        (TestWebKitAPI::PlatformWebView::PlatformWebView):
+        (TestWebKitAPI::PlatformWebView::~PlatformWebView):
+        (TestWebKitAPI::PlatformWebView::page):
+        This was mostly copied from WebKitTestRunner's PlatformWebView.
+
+        * TestWebKitAPI/win/TestWebKitAPI.sln: Added. Builds both
+        TestWebKitAPI and TestWebKitAPIGeneratd. This is used by the
+        build-api-tests script.
+
+        * TestWebKitAPI/win/TestWebKitAPI.vcproj: Added. Builds
+        TestWebKitAPI.exe.
+
+        * TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj: Added. Just calls
+        through to copy-resources.cmd.
+
+        * TestWebKitAPI/win/copy-resources.cmd: Added. Copies resources into
+        or deletes resources from TestWebKitAPI.resources.
+
+        * TestWebKitAPI/win/main.cpp: Added.
+        (main): Calls through to TestsController.
+
+2010-10-13  Gyuyoung Kim  <gyuyoung.kim@samsung.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [EFL] Support viewport configuration and add new arguments for WebKit EFL
+        https://bugs.webkit.org/show_bug.cgi?id=47084
+
+        Opera spec regarding to viewport meta tag was adjusted to WebCore. So, EFL port
+        needs to be modified according to the changes.
+
+        * EWebLauncher/main.c:
+        (on_viewport_changed):
+
+2010-10-12  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Eric Seidel.
+
+        This patch enables new-run-webkit-tests (in particular the
+        chromium-win port) to run under Cygwin as well as Win32. Mostly
+        this just required some conversions from cygwin paths to Win32
+        paths when we spawn off Win32 binaries like test_shell.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47220
+
+        * Scripts/webkitpy/common/system/path.py:
+        - Expose the cygpath() function for path conversion
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        - shift filename->uri conversion in the TestInfo objects to the
+          dump_render_tree thread
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        - use cygpath()
+
+2010-10-12  Yuta Kitamura  <yutak@chromium.org>
+
+        Unreviewed. Add Yuta Kitamura (yutak) to the committers list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-10-12  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        When a provisional load fails, the provisional URL returned
+        from WKFrameCopyProvisionalURL should be empty
+        <rdar://problem/8540878>
+        https://bugs.webkit.org/show_bug.cgi?id=47546
+
+        Add test.
+
+        * TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp:
+        (TestWebKitAPI::didFailProvisionalLoadWithErrorForFrame):
+
+2010-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Start fleshing out find page overlays
+        https://bugs.webkit.org/show_bug.cgi?id=47559
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController find:]):
+        Pass kWKFindOptionsShowOverlay to WKPageFindString.
+
+2010-10-12  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] editing/input/emacs-ctrl-o.html
+
+        ctrl-o is bound to a sequence of commands on Mac, namely:
+        insertParagraphSeparator then moveLeft. In the DRT, we just interpret
+        ctrl-o in EventSenderQt as '\n', i.e. insertParagraphSeparator. As a
+        result we only issue one command, so don't generate the change in caret
+        position that results in the extra editing delegate messages.
+
+        So for the sake of not managing suspicious-looking differences, just
+        make DRT issue the appropriate edit commands to pass the test.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47548
+
+        * DumpRenderTree/qt/EventSenderQt.cpp:
+        (EventSender::keyDown):
+
+2010-10-12  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a simple Find UI to MiniBrowser
+        https://bugs.webkit.org/show_bug.cgi?id=47553
+
+        * MiniBrowser/mac/BrowserWindow.xib:
+        Add Find panel.
+
+        * MiniBrowser/mac/BrowserWindowController.h:
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (-[BrowserWindowController performFindPanelAction:]):
+        Show the find panel.
+
+        (-[BrowserWindowController find:]):
+        Tell the WKPageRef to find the given string.
+
+2010-10-12  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, fixing DRT compile on Windows after r69586.
+
+        * DumpRenderTree/chromium/WebThemeEngineDRT.h:
+
+2010-10-12  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, trying to fix NRWT on Windows.
+
+        * Scripts/webkitpy/layout_tests/port/http_lock.py:
+
+2010-10-12  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt][WTR] Checking the path of the injected bundle is bogus
+        https://bugs.webkit.org/show_bug.cgi?id=47541
+
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        (WTR::isExistingLibrary): Added (static helper).
+        Extend the path with the appropriate suffix(es) on the
+        platform and check that the file exists.
+        (WTR::TestController::initializeInjectedBundlePath):
+        There were two bugs with the path checking:
+            - the condition should have been inverted
+            - QLibrary::fileName does not give back the filename
+              with the library suffix so we cannot check
+              that existance of the file this way.
+
+2010-10-12  Gabor Rapcsanyi  <rgabor@inf.u-szeged.hu>
+
+        Reviewed by Tony Chang.
+
+        Implement http locking in NRWT.
+        https://bugs.webkit.org/show_bug.cgi?id=47072
+
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/http_lock.py: Added.
+        * Scripts/webkitpy/layout_tests/port/http_lock_unittest.py: Added.
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2010-10-12  Mark Rowe  <mrowe@apple.com>
+
+        Fix the 32-bit WebKit2 build.
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (getWindowFrame): Use NSRect rather than CGRect since that's what -frame returns.
+        (setWindowFrame): Use NSMakeRect rather than CGRectMake since that's what -setFrame:display: expects.
+
+2010-10-11  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        change the order of mrobinson's email addresses so bugs.webkit.org suggests the right one
+        https://bugs.webkit.org/show_bug.cgi?id=47513
+
+        bugs.webkit.org suggests mrobinson@igalia.com as an autocomplete,
+        which doesn't actually work.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-10-11  Prasad Tammana  <prasadt@chromium.org>
+
+        Reviewed by Dmitry Titov.
+
+        Added support for showModalDialog on chromium port.
+
+        Implement showModalDialog for Layout tests for chromium port
+        https://bugs.webkit.org/show_bug.cgi?id=46759
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::closeWidgetSoon): Quit current message loop if in a modal loop.
+        (WebViewHost::runModal):  Start a nested message loop and remember that.
+        (WebViewHost::WebViewHost):  Initialize m_inModalLoop.
+        * DumpRenderTree/chromium/WebViewHost.h:  Add m_inModalLoop.
+
+2010-10-11  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] Cleanup font selection code for the Freetype backend
+        https://bugs.webkit.org/show_bug.cgi?id=47503
+
+        Update DRT to set values for the cursive and fantasy font families, so
+        that we can generate consistent results for tests that use these families.
+        Add some missing information to fonts.conf.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (resetDefaultsToConsistentValues): Always set the fantasy and cursive font
+        family names.
+        * DumpRenderTree/gtk/fonts/fonts.conf: Add aliases for cursive and fantasy fonts
+        to our default serif font. Eventually we may want to import or require some "real"
+        fonts, but this should at least ensure consistent rendering during test runs. Also
+        add aliases for some other commonly used fonts in tests (Arial and Lucida Grande).
+        Finally, add a missing oblique specification for DejaVu Serif, which was resulting
+        in some incorrect baselines for the synthetic oblique test.
+
+2010-10-11  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        Fix sheriffbot not to crash when there are failing tests.  It turns out
+        Python sets don't support the + operator.  We need to use union
+        instead.  There's a more elegant way to do this in Python 2.6, but we
+        need this code to work in 2.5.
+
+        * Scripts/webkitpy/common/net/failuremap.py:
+        * Scripts/webkitpy/common/net/failuremap_unittest.py:
+
+2010-10-10  Robert Hogan  <robert@webkit.org>
+
+        Unreviewed, fix failing test from r69468.
+
+        [Qt] Put all DRT-created pages in a page group
+
+        Fix on r69468.
+
+        Because we don't delete closed pages immediately in DRT we need
+        to remove them from the page group explicitly instead.
+
+        Fixes failure of fast/events/popup-blocked-from-fake-user-gesture.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=47469
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::windowCloseRequested):
+
+2010-10-10  Leandro Pereira  <leandro@profusion.mobi>
+
+        Reviewed by Adam Barth.
+
+        commit-queue: Add EFL-EWS status bubble to Bugzilla, now that the
+        EFL-EWS bot is up and running.
+        https://bugs.webkit.org/show_bug.cgi?id=47277
+
+        * QueueStatusServer/handlers/statusbubble.py:
+
+2010-10-10  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Antonio Gomes.
+
+        [Qt] Put all DRT-created pages in a page group
+
+        https://bugs.webkit.org/show_bug.cgi?id=47469
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::createWindow):
+
+2010-10-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        WKFrameGetFrameLoadState() returns kWKFrameLoadStateCommitted after the load has been stopped
+        <rdar://problem/8173667>
+        https://bugs.webkit.org/show_bug.cgi?id=47461
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        * TestWebKitAPI/Test.h:
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp: Added.
+        (TestWebKitAPI::didFailProvisionalLoadWithErrorForFrame):
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
+        (TestWebKitAPI::Util::URLForNonExistentResource):
+        Adds a test for the frame load state after a failed provisional load. I wanted to test
+        the frame load state after a committed load failed, but I don't believe that is possible
+        to do without hooking up the http server to serve a long loading page.
+
+2010-10-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add WebKit2 version of runBeforeUnloadConfirmPanelWithMessage
+        <rdar://problem/8447690>
+        https://bugs.webkit.org/show_bug.cgi?id=47459
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (runBeforeUnloadConfirmPanel):
+        (-[BrowserWindowController awakeFromNib]):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::createOtherPage):
+        (WTR::TestController::initialize):
+
+2010-10-09  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Need implementation of ChromeClient windowRect related functions.
+        <rdar://problem/8469476>
+        https://bugs.webkit.org/show_bug.cgi?id=47386
+
+        * MiniBrowser/mac/BrowserWindowController.m:
+        (getWindowFrame):
+        (setWindowFrame):
+        (-[BrowserWindowController awakeFromNib]):
+        * WebKitTestRunner/PlatformWebView.h:
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::initialize):
+        * WebKitTestRunner/mac/PlatformWebViewMac.mm:
+        (WTR::PlatformWebView::windowFrame):
+        (WTR::PlatformWebView::setWindowFrame):
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::PlatformWebView::windowFrame):
+        (WTR::PlatformWebView::setWindowFrame):
+        * WebKitTestRunner/win/PlatformWebViewWin.cpp:
+        (WTR::PlatformWebView::windowFrame):
+        (WTR::PlatformWebView::setWindowFrame):
+
+2010-10-08  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed (Eric is on vacation in this change is trivial).
+
+        Add a "clean" command to webkit-patch to clean the working directory
+        https://bugs.webkit.org/show_bug.cgi?id=47436
+
+        This command is useful when using SVN because "svn revert" leaves
+        unversioned files behind.
+
+        * Scripts/webkitpy/tool/commands/download.py:
+
+2010-10-08  Andras Becsi  <abecsi@webkit.org>
+
+        Unreviewed build fix.
+
+        [Qt] Add missing limits.h include since the Qt version currently
+        ran on the bot does need that.
+
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp:
+
+2010-10-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Turn on building WTR
+        https://bugs.webkit.org/show_bug.cgi?id=47349
+
+        * Scripts/webkitdirs.pm:
+
+2010-10-08  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] TestController needs its platform dependent methods
+        https://bugs.webkit.org/show_bug.cgi?id=47413
+
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        (WTR::TestController::initializeInjectedBundlePath):
+        If the WTR_INJECTEDBUNDLE_PATH environmental variable is
+        set then use that otherwise use the path where the bundle
+        lives in a normal trunk build.
+        (WTR::TestController::initializeTestPluginDirectory):
+        Set the bundle's value. It is not used currently.
+        (WTR::TestController::platformInitializeContext):
+        * WebKitTestRunner/qt/WebKitTestRunner.pro:
+
+2010-10-08  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WTR: Prevent sending the Done message twice on test timeout.
+        https://bugs.webkit.org/show_bug.cgi?id=47410
+
+        When InjectedBundle::done() calls stopLoading, this may trigger
+        InjectedBundlePage::didFailLoadWithErrorForFrame which calls
+        InjectedBundle::done() itself later in the stack.
+        This would output the timeout failure message twice and confuse
+        the run-webkit-tests script.
+
+        This patch adds a third state, Stopping, which prevents WebCore
+        errors to trigger done() when testing is over.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::done):
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.h:
+
+2010-10-08  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add an activateFonts() implementation similar to DRT's initializeFonts().
+        Original code by Simon Hausmann.
+        https://bugs.webkit.org/show_bug.cgi?id=47402
+
+        * WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp: Added.
+        (WTR::activateFonts):
+
+2010-10-08  Andras Becsi  <abecsi@webkit.org>
+
+        Reviewed by Csaba Osztrogonác.
+
+        [Qt] Add support for Qt's WebKitTestRunner to old-run-webkit-tests.
+        https://bugs.webkit.org/show_bug.cgi?id=47401
+
+        * Scripts/build-webkittestrunner:
+        * Scripts/old-run-webkit-tests:
+
+2010-10-07  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] WTR first compile: fix compile issues.
+        https://bugs.webkit.org/show_bug.cgi?id=47343
+
+        * WebKitTestRunner/InjectedBundle/Bindings/JSWrappable.h:
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        * WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp:
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h:
+        * WebKitTestRunner/TestController.cpp:
+        * WebKitTestRunner/TestInvocation.cpp:
+
+2010-10-07  Antonio Gomes  <agomes@rim.com>
+
+        Reviewed by Simon Fraser.
+
+        [Mac] [DRT] implement setSpatialNavigationEnabled
+        https://bugs.webkit.org/show_bug.cgi?id=47291
+
+        Implemented LayoutTestController::setSpatialNavigationEnabled for Mac's DRT
+        so it can track regression on the existing implementation and future improvements
+        we are making.
+
+        * DumpRenderTree/mac/LayoutTestControllerMac.mm:
+        (LayoutTestController::setSpatialNavigationEnabled):
+
+2010-10-07  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        rebaseline-chromium-webkit-tests relied on the filename_to_uri()
+        hook in the Port infrastructure to generate URIs for the files
+        in its summary HTML report; however, that method is supposed to only
+        be used for test files (and should really be renamed), so this would
+        crash.
+
+        This change adds a new "path" module to the system package with a
+        routine called abspath_to_uri() that handles converting paths to
+        file: URIs independently of anything in the layout_tests package,
+        and changes the code to use this. At some point in the near future
+        the layout_tests/port/* code should use this as well.
+
+        This change also deletes a bunch of unused code and fixes some
+        comments in rebaseline_chromium_webkit_tests.py.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47319
+
+        * Scripts/webkitpy/common/system/path.py: Added.
+        * Scripts/webkitpy/common/system/path_unittest.py: Added.
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py:
+
+2010-10-07  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Gustavo Noronha Silva.
+
+        [GTK] The FreeType backend does not respect the FC_EMBOLDEN property
+        https://bugs.webkit.org/show_bug.cgi?id=46216
+
+        Fix my latest commit, as it contained some bad changes from a merge gone wrong.
+
+        * DumpRenderTree/gtk/DumpRenderTree.cpp:
+        (initializeFonts): Also initialize the DevaVu Sans font.
+
+2010-10-07  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Minor naming cleanup in WebDragData, part 2
+        https://bugs.webkit.org/show_bug.cgi?id=47227
+
+        Update DRT to use the renamed methods.
+
+        * DumpRenderTree/chromium/EventSender.cpp:
+        (EventSender::beginDragWithFiles):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (addDRTFakeFileToDataObject):
+
+2010-10-07  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        Add a WKPageFindClient, hook up WKPageCountStringMatches
+        https://bugs.webkit.org/show_bug.cgi?id=47373
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        Remove hard coded paths.
+
+        * TestWebKitAPI/Tests/WTF/VectorBasic.cpp:
+        (TestWebKitAPI::TEST):
+        Fix expected result.
+
+        * TestWebKitAPI/Tests/WebKit2/Find.cpp: Added.
+        (TestWebKitAPI::didFinishLoadForFrame):
+        (TestWebKitAPI::didCountStringMatches):
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/find.html: Added.
+        Add test for WKPageCountStringMatches.
+
+2010-09-21  Martin Robinson  <mrobinson@igalia.com>
+
+        Reviewed by Chris Fleizach.
+
+        [GTK] The FreeType backend does not respect the FC_EMBOLDEN property
+        https://bugs.webkit.org/show_bug.cgi?id=46216
+
+        * DumpRenderTree/gtk/fonts/fonts.conf: Add a setting which enables FC_EMBOLDEN
+        for DejaVu Serif when there is no bold version available. This is necessary to
+        properly test the property in layout tests.
+
+2010-10-07  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>, Andras Becsi  <abecsi@webkit.org>, Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add WTR's InjectedBundle build files.
+        https://bugs.webkit.org/show_bug.cgi?id=47333
+
+        * Scripts/webkitdirs.pm:
+        * WebKitTestRunner/DerivedSources.pro: Added.
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro: Added.
+        * WebKitTestRunner/WebKitTestRunner.pro: Added.
+        * WebKitTestRunner/qt/DerivedSources.pro: Removed.
+        Content merged in ../DerivedSources.pro
+
+2010-10-07  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69315.
+        http://trac.webkit.org/changeset/69315
+        https://bugs.webkit.org/show_bug.cgi?id=47363
+
+        Forgot to add the new files (Requested by kbalazs on #webkit).
+
+        * Scripts/webkitdirs.pm:
+        * WebKitTestRunner/qt/DerivedSources.pro: Added.
+
+2010-10-07  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Change API tester to ask the executable for the list of all
+        tests instead of relying on the directory structure.
+        https://bugs.webkit.org/show_bug.cgi?id=47359
+
+        * Scripts/run-test-webkit-api: Added.
+        * Scripts/webkitdirs.pm:
+        Add additional script to just launch the api tester with the correct settings.
+
+        * Scripts/run-api-tests:
+        Change to use the new --dump-tests options to build the list of tests and change
+        output to reflect a (suite, testcase) tuple for each test. Also adds some color.
+
+        * TestWebKitAPI/Test.h:
+        (TestWebKitAPI::Test::Register::Register):
+        * TestWebKitAPI/Tests/WTF/VectorBasic.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/WKString.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/WKStringJSString.cpp:
+        (TestWebKitAPI::TEST):
+        Give each test a suite name in addition to the test name.
+
+        * TestWebKitAPI/TestsController.cpp:
+        (TestWebKitAPI::TestsController::dumpTestNames):
+        (TestWebKitAPI::TestsController::runTestNamed):
+        * TestWebKitAPI/TestsController.h:
+        * TestWebKitAPI/mac/main.mm:
+        (main):
+        Add option to print all registered tests.
+
+2010-10-07  Jocelyn Turcotte  <jocelyn.turcotte@nokia.com>, Andras Becsi  <abecsi@webkit.org>, Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add WTR's InjectedBundle build files.
+        https://bugs.webkit.org/show_bug.cgi?id=47333
+
+        * Scripts/webkitdirs.pm:
+        * WebKitTestRunner/DerivedSources.pro: Added.
+        * WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro: Added.
+        * WebKitTestRunner/WebKitTestRunner.pro: Added.
+        * WebKitTestRunner/qt/DerivedSources.pro: Removed.
+        Content merged in ../DerivedSources.pro
+
+2010-10-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Unreviewed. Do a renaming that was recommended by the reviewer
+        (Kenneth) but I forgot to do before landing (http://trac.webkit.org/changeset/69253)
+
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        (WTR::RunUntilConditionLoop::start):
+        (WTR::RunUntilConditionLoop::RunUntilConditionLoop):
+        (WTR::TestController::runUntil):
+
+2010-10-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Watchdog timer implementation for WTR
+        https://bugs.webkit.org/show_bug.cgi?id=47337
+
+        * WebKitTestRunner/InjectedBundle/LayoutTestController.h: Factor out
+        the definition of the timer type to a typedef.
+        * WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp: Added.
+        Timer implementation with QTimer and a helper QObject class.
+        (WTR::WatchdogTimerHelper::instance):
+        (WTR::WatchdogTimerHelper::timerFired):
+        (WTR::WatchdogTimerHelper::WatchdogTimerHelper):
+        (WTR::LayoutTestController::platformInitialize):
+        (WTR::LayoutTestController::invalidateWaitToDumpWatchdogTimer):
+        (WTR::LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded):
+
+2010-10-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Unreviewed buildfix for 69297 again
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::blankURL):
+
+2010-10-07  Balazs Kelemen  <Balazs Kelemen>
+
+        Unreviewed trivial build fix for r69297
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::blankURL):
+
+2010-10-07  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        WebKitTestRunner should be portable
+        https://bugs.webkit.org/show_bug.cgi?id=45393
+
+        Use only the WebKit API for working with urls.
+        * WebKitTestRunner/StringFunctions.h:
+        (WTR::createWKURL):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::blankURL):
+        (WTR::TestController::resetStateToConsistentValues):
+        (WTR::TestController::didFinishLoadForFrame):
+
+2010-10-07  Carlos Garcia Campos  <cgarcia@igalia.com>
+
+        Reviewed by Xan Lopez.
+
+        [GTK] Use gtk_widget_draw() instead of gtk_widget_get_snapshot() in PixelDumpSupportGtk when building with gtk3
+        https://bugs.webkit.org/show_bug.cgi?id=47332
+
+        * DumpRenderTree/gtk/PixelDumpSupportGtk.cpp:
+        (createBitmapContextFromWebView):
+
+2010-10-06  Chris Guillory  <chris.guillory@google.com>
+
+        Reviewed by Chris Fleizach.
+
+        Remove unused accessibility functions from webkit.
+        https://bugs.webkit.org/attachment.cgi?bugid=46707
+
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::postAccessibilityNotification):
+        * DumpRenderTree/chromium/WebViewHost.h:
+
+2010-10-06  Lucas Forschler  <lforschler@apple.com>
+
+        Reviewed by Adam Roben.
+
+        Fix the sunspider-compare-results to actually use the passed in value for $root.
+
+        * Scripts/sunspider-compare-results:
+
+2010-10-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Runloop implementation for WTR
+        https://bugs.webkit.org/show_bug.cgi?id=47280
+
+        * WebKitTestRunner/qt/TestControllerQt.cpp:
+        Implemented TestController::runUntil by a timerEvent
+        and a QEventLoop. We step into the event loop from runUntil.
+        While we are waiting in the loop a timerEvent is periodically
+        checking the value of the condition. Once the condition has
+        becoming true the timerEvent wakes us up.
+        (WTR::RunUntilLoop::start):
+        (WTR::RunUntilLoop::RunUntilLoop):
+        (WTR::RunUntilLoop::run):
+        (WTR::RunUntilLoop::timerEvent):
+        (WTR::TestController::platformInitialize):
+        (WTR::TestController::runUntil):
+        * WebKitTestRunner/qt/main.cpp:
+        Start the main event loop first and creating the TestController later.
+        (Launcher::Launcher):
+        (Launcher::~Launcher):
+        (Launcher::launch): Creating the TestController.
+        (main): Setting up a timer for calling Launcher::launch from
+        the main event loop.
+
+2010-10-06  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Kenneth Russell.
+
+        new-run-webkit-tests: fix typo in chromium-gpu that was trying to
+        enable 'accelerated-composting' instead of 'accelerated-compositing'.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47312
+
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py:
+
+2010-10-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] PlatformWebView implementation for WebKitTestRunner
+        https://bugs.webkit.org/show_bug.cgi?id=47276
+
+        The implementation follows the way how
+        we use the API in MiniBrowser.
+        * WebKitTestRunner/PlatformWebView.h:
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp:
+        (WTR::WebView::wkView):
+        (WTR::WebView::~WebView):
+        (WTR::WebView::WebView):
+        (WTR::PlatformWebView::PlatformWebView):
+        (WTR::PlatformWebView::~PlatformWebView):
+        (WTR::PlatformWebView::resizeTo):
+        (WTR::PlatformWebView::page):
+        (WTR::PlatformWebView::focus):
+        * WebKitTestRunner/qt/WebKitTestRunner.pro:
+
+2010-10-06  Balazs Kelemen  <kbalazs@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        [Qt] Add WebKitTestRunner's build files
+        https://bugs.webkit.org/show_bug.cgi?id=44155
+
+        Parts was taken by Zoltan Horvath's patch.
+
+        * Scripts/generate-forwarding-headers.pl: Moved from WebKit2.
+        * Scripts/webkitdirs.pm: Make the generated files needed by WTR.
+        * WebKitTestRunner/PlatformWebView.h: Addeed typedefs for
+        PlatformWKView and PlatformWindow (void* for now).
+        Buildfix the case when __APPLE__ is not defined.
+        * WebKitTestRunner/qt/DerivedSources.pro: Added.
+        * WebKitTestRunner/qt/PlatformWebViewQt.cpp: Added.
+        Empty stub implementation.
+        (WTR::registerWindowClass):
+        (WTR::PlatformWebView::PlatformWebView):
+        (WTR::PlatformWebView::~PlatformWebView):
+        (WTR::PlatformWebView::resizeTo):
+        (WTR::PlatformWebView::page):
+        (WTR::PlatformWebView::focus):
+        * WebKitTestRunner/qt/TestControllerQt.cpp: Added.
+        Empty stub implementation.
+        (WTR::registerWindowClass):
+        (WTR::TestController::runUntil):
+        (WTR::TestController::platformInitialize):
+        (WTR::TestController::initializeInjectedBundlePath):
+        (WTR::TestController::initializeTestPluginDirectory):
+        (WTR::TestController::platformInitializeContext):
+        * WebKitTestRunner/qt/WebKitTestRunner.pro: Added.
+        * WebKitTestRunner/qt/main.cpp: Added.
+        (main):
+
+2010-10-06  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, rolling out r69202.
+        http://trac.webkit.org/changeset/69202
+        https://bugs.webkit.org/show_bug.cgi?id=46937
+
+        Broke compile of test_shell
+
+        * DumpRenderTree/chromium/EventSender.cpp:
+        (EventSender::beginDragWithFiles):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (addDRTFakeFileToDataObject):
+
+2010-10-06  Daniel Cheng  <dcheng@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Minor naming cleanup in WebDragData, part 2
+        https://bugs.webkit.org/show_bug.cgi?id=46937
+
+        Update DRT to use the renamed methods.
+
+        * DumpRenderTree/chromium/EventSender.cpp:
+        (EventSender::beginDragWithFiles):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (addDRTFakeFileToDataObject):
+
+2010-10-06  David Kilzer  <ddkilzer@apple.com>
+
+        <http://webkit.org/b/47270> Move WebArchive serialization code into its own file
+
+        Reviewed by Adam Roben.
+
+        This is the first step in making webarchive tests work on
+        Windows.
+
+        * DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj: Added
+        new files to the project.
+        * DumpRenderTree/mac/DumpRenderTree.mm: Removed code that moved
+        to WebArchiveDumpSupport.mm.
+        * DumpRenderTree/mac/WebArchiveDumpSupport.h: Added.
+        * DumpRenderTree/mac/WebArchiveDumpSupport.mm: Copied from WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm.
+        (serializeWebArchiveToXML):
+
+2010-10-05  Daniel Bates  <dbates@rim.com>
+
+        Reviewed by David Kilzer.
+
+        Add infrastructure to towards detecting change log diffs that aren't at the top of the ChangeLog
+        https://bugs.webkit.org/show_bug.cgi?id=46058
+
+        Make VCSUtils::fixChangeLogPatch() return a reference to a hash
+        structure so as to support returning additional information
+        about a change log diff.
+
+        Currently, VCSUtils::fixChangeLogPatch() returns a string that
+        represents the change log diff. Towards supporting the return
+        of additional information, such as whether the change log diff
+        inserts an entry at the top of the ChangeLog file, we need to
+        make VCSUtils::fixChangeLogPatch() return a reference to hash
+        structure.
+
+        * Scripts/VCSUtils.pm:
+          - Modified fixChangeLogPatch() to return a reference to a
+            hash structure.
+          - Added documentation to fixChangeLogPatch().
+          - Modified call site in mergeChangeLogs() as necessary.
+        * Scripts/svn-apply:
+          - Modified call site in patch() as necessary.
+        * Scripts/svn-create-patch:
+          - Modified call site in generateDiff() as necessary.
+        * Scripts/svn-unapply:
+          - Modified call site in patch() as necessary.
+        * Scripts/webkitperl/VCSUtils_unittest/fixChangeLogPatch.pl:
+          - Modified the unit tests as necessary.
+
+2010-10-05  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Darin Adler.
+
+        fix the link to the expected image on windows
+        https://bugs.webkit.org/show_bug.cgi?id=47228
+
+        * Scripts/webkitpy/layout_tests/test_types/test_type_base.py: On
+            windows, the file must be opened in binary mode when writing
+            binary data.
+
+2010-10-05  Adam Barth  <abarth@webkit.org>
+
+        Update expected result of unittest to match Tony's change below.
+
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+
+2010-10-05  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai (over the shoulder).
+
+        Paper over errors in image_diff so we don't crash the whole test run.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2010-10-05  Tony Chang  <tony@chromium.org>
+
+        Unreviewed, make shutil.rmtree more resiliant to errors
+        since windows was raising WindowsError: The process cannot access the file because it
+        is being used by another process.
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+
+2010-10-05  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Ojan Vafai.
+
+        [chromium] fix image diffing in NRWT
+        https://bugs.webkit.org/show_bug.cgi?id=47128
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py: Stop using
+            NamedTemporaryFile since it doesn't work on Windows.
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+
+2010-10-05  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Tony Chang.
+
+        [chromium] Implement layerTreeAsText in DumpRenderTree
+        https://bugs.webkit.org/show_bug.cgi?id=47216
+
+        Plumbed Frame::layerTreeAsText through Chromium's WebKit API to
+        make it callable from DumpRenderTree.
+
+        No new tests; verified with existing compositor layout tests.
+
+        * DumpRenderTree/chromium/LayoutTestController.cpp:
+        (LayoutTestController::LayoutTestController):
+        (LayoutTestController::layerTreeAsText):
+        * DumpRenderTree/chromium/LayoutTestController.h:
+
+2010-10-05  Brent Fulgham  <bfulgham@webkit.org>
+
+        Unreviewed build correction.
+
+        * DumpRenderTree/win/ImageDiff.vcproj: Use WinCairo debug
+        property sheet so proper libraries are linked.
+
+2010-10-05  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix url conversion in QWebHistory
+
+        Converting from KURL to WFT::String to QUrl does not
+        permit proper percent encoding later.
+
+        https://bugs.webkit.org/show_bug.cgi?id=47048
+
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::dumpHistoryItem):
+
+2010-10-05  Anders Carlsson  <andersca@apple.com>
+
+        Reviewed by Sam Weinig.
+
+        REGRESSION (r68966?): All dumpAsText test fail on WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=47188
+        <rdar://problem/8514104>
+
+        When constructing the std::string, use the real string length instead of the maximum buffer size.
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        (TestWebKitAPI::Util::toSTD):
+        * WebKitTestRunner/StringFunctions.h:
+        (WTR::toSTD):
+
+2010-10-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Mark Rowe.
+
+        Add MIMEType accessor to WKFrame
+        <rdar://problem/8347683>
+        https://bugs.webkit.org/show_bug.cgi?id=47138
+
+        * TestWebKitAPI/PlatformUtilities.h:
+        (TestWebKitAPI::Util::toSTD):
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp: Added.
+        (TestWebKitAPI::didStartProvisionalLoadForFrame):
+        (TestWebKitAPI::didCommitLoadForFrame):
+        (TestWebKitAPI::didFinishLoadForFrame):
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp: Added.
+        (TestWebKitAPI::didStartProvisionalLoadForFrame):
+        (TestWebKitAPI::didCommitLoadForFrame):
+        (TestWebKitAPI::didFinishLoadForFrame):
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/basic-1.html: Removed.
+        * TestWebKitAPI/Tests/WebKit2/icon.png: Added.
+        * TestWebKitAPI/Tests/WebKit2/simple.html: Added.
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm:
+        (TestWebKitAPI::Util::createURLForResource):
+
+2010-10-05  Gabor Rapcsanyi  <rgabor@inf.u-szeged.hu>
+
+        Reviewed by Ojan Vafai.
+
+        [NRWT] Rename current_dir to current_group because it's not a directory
+        https://bugs.webkit.org/show_bug.cgi?id=47169
+
+        * Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2010-10-04  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, build fix.
+
+        r69065 broke test-webkitpy by trying to create a '/tmp-X' directory,
+        which can't always be done. This test uses tempfile.mkdtemp(), which
+        should be safe.
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-04  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, build fix.
+
+        Add missing "from __future__ import with_statement" that was
+        breaking test-webkitpy on the Leopard bots (broke in r69040).
+
+        * Scripts/webkitpy/layout_tests/port/google_chrome.py:
+
+2010-10-04  Sheriff Bot  <webkit.review.bot@gmail.com>
+
+        Unreviewed, rolling out r69066.
+        http://trac.webkit.org/changeset/69066
+        https://bugs.webkit.org/show_bug.cgi?id=47163
+
+        Made NRWT reliability worse. (Requested by tkent on #webkit).
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+
+2010-10-04  Gabor Rapcsanyi  <rgabor@inf.u-szeged.hu>
+
+        Reviewed by Tony Chang.
+
+        [NRWT] Reverse the http tests to alphabetical order.
+        https://bugs.webkit.org/show_bug.cgi?id=47075
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+
+2010-10-04  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Fix timeout on http/tests/navigation/post-goback2.html and postredirect-goback2.html
+
+        We need to queue back and forward navigations in the DRT from the
+        LayoutTestController so that maybeDump() knows about them.
+
+        * DumpRenderTree/qt/LayoutTestControllerQt.cpp:
+        (LayoutTestController::queueBackNavigation):
+        (LayoutTestController::queueForwardNavigation):
+
+2010-10-04  Tony Chang  <tony@chromium.org>
+
+        Reviewed by Kent Tamura.
+
+        [chromium] fix image diffing in NRWT
+        https://bugs.webkit.org/show_bug.cgi?id=47128
+
+        * Scripts/webkitpy/layout_tests/port/chromium.py: Flush data to the
+              temp file and check the image_diff error code more carefully
+        * Scripts/webkitpy/layout_tests/port/chromium_unittest.py:
+
+2010-10-04  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        aroben's change in r68792 actually broke new-run-webkit-tests when
+        running the DRT code path. His change was intended to fix the
+        way we were converting windows paths to URIs when running under
+        Cygwin (the paths were getting one too many "/" on the front).
+        However, the change ended up breaking the chromium_win port, which
+        had slightly different logic.
+
+        This patch removes the port-specific code and adds tests to make
+        sure we're getting the behavior we expect. The Port object no longer
+        exposes a get_absolute_path() method that can be used outside of
+        of converting test filenames, because it's unreliable otherwise
+        (we don't have the right context to know which conversion is intended).
+
+        https://bugs.webkit.org/show_bug.cgi?id=47140
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/base_unittest.py:
+        * Scripts/webkitpy/layout_tests/port/chromium_win.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-04  Dirk Pranke  <dpranke@chromium.org>
+
+        Unreviewed, build fix.
+
+        Handle crash introduced in r69040 if we are not running in a
+        Chromium checkout.
+
+        * Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py:
+
+2010-10-04  Dirk Pranke  <dpranke@chromium.org>
+
+        Reviewed by Tony Chang.
+
+        Add a way for us to have test expectations that are specific to the
+        official builds of Google Chrome (as opposed to Chromium). This change
+        looks for an additional "test_expectations_chrome.txt" file in
+        Chromium's repository (webkit/tools/layout_tests), and uses the
+        concatenation of that file and the regular test_expectations.txt
+        file for test overrides.
+
+        https://bugs.webkit.org/show_bug.cgi?id=46854
+
+        * Scripts/webkitpy/layout_tests/port/google_chrome.py:
+        * Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py:
+
+2010-10-04  Simon Fraser  <simon.fraser@apple.com>
+
+        Color tests in the list based on existing pass/fail result.
+        
+        Fix the summary data to account for htmlOnly and nonHTML tests.
+
+        * CSSTestSuiteHarness/harness/harness.css:
+        (#test-list > option.pass):
+        (#test-list > option.fail):
+        (#test-list > option.skipped):
+        * CSSTestSuiteHarness/harness/harness.js:
+        (Test):
+        (Test.prototype.statusForFormat):
+        (TestSuite.prototype.fillTestList):
+        (TestSuite.prototype.updateTestList):
+        (TestSuite.prototype.recordResult):
+        (TestSuite.prototype.markTestCompleted):
+        (TestSuite.prototype.countTestsWithFlag):
+        (TestSuite.prototype.queryDatabaseForSummary.this.db.transaction):
+        (TestSuite.prototype.queryDatabaseForSummary):
+
+2010-10-04  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Beth Dakin.
+
+        AX: doAXRangeForLine does not work
+        https://bugs.webkit.org/show_bug.cgi?id=47101
+
+        DRT support to handle NSAccessibilityRangeForLineParameterizedAttribute.
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (rangeForLineCallback):
+        (AccessibilityUIElement::rangeForLine):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::rangeForLine):
+
+2010-10-04  Andrey Kosyakov  <caseq@chromium.org>
+
+        Unreviewed. Adding myself to the committers list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-10-04  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add ability to set the CacheModel in Webkit2
+        https://bugs.webkit.org/show_bug.cgi?id=47066
+
+        * MiniBrowser/mac/AppDelegate.m:
+        (-[BrowserAppDelegate init]): Opt minibrowser into
+        a PrimaryWebBrowser cache model.
+
+2010-10-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Make sure to enter all tests when creating the database
+        for the first time.
+        
+        When migrating to a new version of the suite, be sure to
+        sync up the database and testinfo.data by removing old
+        tests, and inserting new ones.
+
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.openDatabase.creation):
+        (TestSuite.prototype.databaseCreated):
+        (TestSuite.prototype.populateDatabaseFromTestInfoData):
+        (TestSuite.prototype.insertTest):
+
+2010-10-03  Simon Fraser  <simon.fraser@apple.com>
+
+        More work on treating HTML4 and XHTML1 independently; when 
+        changing the format, rebuild the test list, and update the 
+        numbers in the chapter popup.
+
+        * CSSTestSuiteHarness/harness/harness.js:
+        (Test):
+        (Test.prototype.runForFormat):
+        (Test.prototype.completedForFormat):
+        (ChapterSection):
+        (ChapterSection.prototype.countTests):
+        (Chapter):
+        (Chapter.prototype.description):
+        (Chapter.prototype.countTests):
+        (Chapter.prototype.testCount):
+        (Chapter.prototype.untestedCount):
+        (TestSuite.prototype.buildChapters):
+        (TestSuite.prototype.loadCurrentTest):
+        (TestSuite.prototype.updateProgressLabel):
+        (TestSuite.prototype.processFlags):
+        (TestSuite.prototype.formatChanged):
+
+2010-10-03  Simon Fraser  <simon.fraser@apple.com>
+
+        Update test suite version 20101001.
+        
+        Handle database migration, and delete tests from the db that are
+        not present in testinfo.data.
+        
+        Load about:blank into the test frame before the test url, to make
+        missing tests more obvious.
+        
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.loadTest):
+        (TestSuite.prototype.openDatabase.creation):
+        (TestSuite.prototype.openDatabase.migration1_0To1_1):
+        (TestSuite.prototype.openDatabase.if.return):
+        (TestSuite.prototype.databaseReady):
+        (TestSuite.prototype.populateDatabaseFromTestInfoData):
+        (TestSuite.prototype.syncDatabaseWithTestInfoData.this.db.transaction):
+        (TestSuite.prototype.syncDatabaseWithTestInfoData):
+
+2010-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Add the ability to jump to a specific test.
+
+        * CSSTestSuiteHarness/harness/harness.html:
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.goToTestByName):
+        (TestSuite.prototype.switchToFormat):
+
+2010-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        For a ref test, load the ref in the same format (HTML4 vs XHTML1)
+        as the test.
+
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.loadRef):
+
+2010-10-02  Simon Fraser  <simon.fraser@apple.com>
+
+        Update the UI to reflect the fact that each test needs to be tested
+        in both HTML4 and XHTML1 format.
+        
+        * CSSTestSuiteHarness/harness/harness.js:
+        (Test):
+        (Chapter.prototype.description):
+        (Chapter.prototype.untestedCount):
+        (TestSuite.prototype.fillChapterPopup):
+        (TestSuite.prototype.updateChapterPopup):
+        (TestSuite.prototype.fillTestList):
+        (TestSuite.prototype.updateTestList):
+        (TestSuite.prototype.goToNextIncompleteTest):
+        (TestSuite.prototype.firstIncompleteTestIndex):
+        (TestSuite.prototype.recordResult):
+        (TestSuite.prototype.formatChanged):
+        (TestSuite.prototype.markTestCompleted):
+        (TestSuite.prototype.resetTestStatus):
+
+2010-10-01  Simon Fraser  <simon.fraser@apple.com>
+
+        Add the ability to remove results for re-testing, and
+        to import results.
+
+        * CSSTestSuiteHarness/harness/harness.css:
+        (.custom button):
+        (#overlay):
+        (#overlay.visible):
+        (.overlay-contents):
+        (.overlay-contents textarea):
+        (.overlay-contents .buttons):
+        (.overlay-contents .note):
+        (.overlay-contents .buttons button):
+        * CSSTestSuiteHarness/harness/harness.html:
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.importResults):
+        (TestSuite.prototype.clearResults):
+        (TestSuite.prototype.markTestCompleted):
+        (TestSuite.prototype.resetTestStatus):
+        (TestSuite.prototype.storeTestResult):
+        (TestSuite.prototype.importTestResults):
+        (TestSuite.prototype.clearTestResults):
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Jon Honeycutt.
+
+        Deploy the new WKString functions to remove most uses of CF from
+        the WebKitTestRunner.
+
+        * WebKitTestRunner/InjectedBundle/InjectedBundle.cpp:
+        (WTR::InjectedBundle::didReceiveMessage):
+        (WTR::InjectedBundle::done):
+        * WebKitTestRunner/StringFunctions.h:
+        (WTR::toWK):
+        (WTR::toJS):
+        (WTR::toSTD):
+        (WTR::operator<<):
+        (WTR::copyURLString):
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        (WTR::TestController::didFinishLoadForFrame):
+        * WebKitTestRunner/TestInvocation.cpp:
+        (WTR::TestInvocation::invoke):
+        (WTR::TestInvocation::didReceiveMessageFromInjectedBundle):
+
+2010-10-01  Mihai Parparita  <mihaip@chromium.org>
+
+        Unreviewed TestResultsServer change.
+
+        Add files introduced by http://crrev.com/61273 to the list of dashboard 
+        files to update.
+
+        * TestResultServer/handlers/dashboardhandler.py:
+
+2010-10-01  Brian Weinstein  <bweinstein@apple.com>
+
+        Build Fix for Windows.
+
+        * WebKitTestRunner/win/WebKitTestRunner.vcproj: Don't copy ForwardingHeaders from
+            WebKitTestRunner/ForwardingHeaders, instead, add $(WebKitOutputDir)/include/WebCore/
+            ForwardingHeaders to the include path.
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Anders Carlsson.
+
+        Add SPI to convert a WKStringRef to a JSStringRef and vice-versa.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/WKString.cpp:
+        (TestWebKitAPI::TEST):
+        * TestWebKitAPI/Tests/WebKit2/WKStringJSString.cpp: Added.
+        (TestWebKitAPI::TEST):
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Kenneth Rohde Christiansen.
+
+        Add additional WKString API
+        https://bugs.webkit.org/show_bug.cgi?id=46958
+
+        Add basic WKStringRef tests.
+
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj:
+        * TestWebKitAPI/Tests/WebKit2/WKString.cpp: Added.
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Dan Bernstein.
+
+        Add makefile for TestWebKitAPI and call it from the base makefile.
+
+        * Makefile:
+        * TestWebKitAPI/Makefile: Added.
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Remove unnecessary ForwardingHeaders from test runners.
+        https://bugs.webkit.org/show_bug.cgi?id=47010
+
+        * TestWebKitAPI/Configurations/Base.xcconfig:
+        * TestWebKitAPI/ForwardingHeaders: Removed.
+        * WebKitTestRunner/Configurations/Base.xcconfig:
+        * WebKitTestRunner/ForwardingHeaders: Removed.
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        WebSocket tests are flaky
+        https://bugs.webkit.org/show_bug.cgi?id=46956
+
+        Update these tools to understand how to run the WebSocket tests off the
+        Apache server.
+
+        * Scripts/old-run-webkit-tests:
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        * Scripts/webkitpy/layout_tests/port/websocket_server.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-01  Adam Roben  <aroben@apple.com>
+
+        Encode Executive command arguments using UTF-8 on Cygwin
+
+        Cygwin's Python's os.execv doesn't support unicode command arguments.
+        Cygwin's execv expects arguments to be encoded using the current code
+        page. But code pages are limited in what characters they can handle,
+        and our tests include characters that the English code page can't
+        handle.  So for now we'll just encode everything in UTF-8 on Cygwin,
+        which can handle all characters but might confuse some commands, for
+        expediency's sake. I'm sure we'll run into cases where UTF-8 isn't
+        good enough, but we can deal with that when the problem arises.
+
+        Reviewed by Adam Barth.
+
+        Fixes <http://webkit.org/b/46892> <rdar://problem/8496639>
+        webkitpy.common.system.executive_unittest.ExecutiveTest.test_run_command_with_unicode
+        fails on Windows
+
+        * Scripts/webkitpy/common/system/executive.py:
+        (Executive._run_command_with_teed_output):
+        (Executive.run_command):
+        On Cygwin, encode arguments using UTF-8.
+
+2010-10-01  Sam Weinig  <sam@webkit.org>
+
+        Reviewed by Adam Roben.
+
+        Add simple API tester for WebKit2
+        https://bugs.webkit.org/show_bug.cgi?id=46953
+
+        This adds a very simple testing infrastructure for testing APIs exposed
+        through the WebKit project. It consists of two parts: 1) a project that
+        builds the all the tests 2) a script that searches the tests directory and
+        calls the tester once for each test.
+
+        This adds the infrastructure and two tests:
+        - Tests/WTF/Vector1.cpp - A proof of concept test of WTF data-structures.
+        - Tests/WebKit2/BasicTest1.cpp - A proof of concept test of WebKit2 API.
+
+        This currently only works on the mac, but is designed to be easily ported 
+        to any platform.
+
+        * Scripts/run-api-tests: Added.
+        * Scripts/build-api-tests: Added.
+        Scripts to build/run the tests.
+
+        * TestWebKitAPI: Added.
+        * TestWebKitAPI/Configurations: Added.
+        * TestWebKitAPI/Configurations/Base.xcconfig: Added.
+        * TestWebKitAPI/Configurations/DebugRelease.xcconfig: Added.
+        * TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig: Added.
+        * TestWebKitAPI/ForwardingHeaders: Added.
+        * TestWebKitAPI/ForwardingHeaders/wtf: Added.
+        * TestWebKitAPI/PlatformUtilities.h: Added.
+        * TestWebKitAPI/PlatformWebView.h: Added.
+        (TestWebKitAPI::PlatformWebView::platformView):
+        * TestWebKitAPI/StringFunctions.h: Added.
+        * TestWebKitAPI/Test.h: Added.
+        (TestWebKitAPI::Test::~Test):
+        (TestWebKitAPI::Test::name):
+        (TestWebKitAPI::Test::Register::Register):
+        (TestWebKitAPI::Test::Register::create):
+        (TestWebKitAPI::Test::Test):
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj: Added.
+        * TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj: Added.
+        * TestWebKitAPI/TestWebKitAPIPrefix.h: Added.
+        * TestWebKitAPI/TestsController.cpp: Added.
+        (TestWebKitAPI::TestsController::shared):
+        (TestWebKitAPI::TestsController::TestsController):
+        (TestWebKitAPI::TestsController::runTestNamed):
+        (TestWebKitAPI::TestsController::testFailed):
+        (TestWebKitAPI::TestsController::registerCreateTestFunction):
+        * TestWebKitAPI/TestsController.h: Added.
+        * TestWebKitAPI/mac: Added.
+        * TestWebKitAPI/mac/PlatformUtilitiesMac.mm: Added.
+        (TestWebKitAPI::Util::run):
+        (TestWebKitAPI::Util::createURLForResource):
+        * TestWebKitAPI/mac/PlatformWebViewMac.mm: Added.
+        (TestWebKitAPI::PlatformWebView::PlatformWebView):
+        (TestWebKitAPI::PlatformWebView::resizeTo):
+        (TestWebKitAPI::PlatformWebView::~PlatformWebView):
+        (TestWebKitAPI::PlatformWebView::page):
+        (TestWebKitAPI::PlatformWebView::focus):
+        * TestWebKitAPI/mac/main.mm: Added.
+        Infrastructure.
+
+        * TestWebKitAPI/Tests: Added.
+        * TestWebKitAPI/Tests/WTF: Added.
+        * TestWebKitAPI/Tests/WTF/Vector1.cpp: Added.
+        * TestWebKitAPI/Tests/WebKit2: Added.
+        * TestWebKitAPI/Tests/WebKit2/BasicTest1.cpp: Added.
+        (TestWebKitAPI::State::State):
+        * TestWebKitAPI/Tests/WebKit2/basic-1.html: Added.
+        Proof of concept tests.
+
+2010-10-01  Adam Roben  <aroben@apple.com>
+
+        Don't assume AccessibleObjectFromEvent succeeds
+
+        Fixes <http://webkit.org/b/44136> <rdar://problem/8321684> Crash in
+        DumpRenderTree!notificationListenerProc when running
+        plugins/access-after-page-destroyed.html
+
+        Reviewed by Sam Weinig.
+
+        * DumpRenderTree/win/AccessibilityControllerWin.cpp:
+        (notificationListenerProc): Check both the return value of
+        AccessibleObjectFromEvent and the object it returns, as MSDN
+        recommends.
+
+2010-10-01  Gabor Rapcsanyi  <rgabor@inf.u-szeged.hu>
+
+        Reviewed by Tony Chang.
+
+        [NRWT] Put the http and websocket tests first in the test list.
+        https://bugs.webkit.org/show_bug.cgi?id=46453
+
+        * Scripts/webkitpy/layout_tests/run_webkit_tests.py:
+        * Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py:
+
+2010-10-01  Fady Samuel  <fsamuel@chromium.org>
+
+        Unreviewed, adding myself to the committer list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-10-01  Adam Roben  <aroben@apple.com>
+
+        Test NPN_GetValue(NPNVnetscapeWindow)
+
+        Test for <http://webkit.org/b/46726> <rdar://problem/8486319>
+        Right-clicking on windowless Flash plugin in WebKit2 makes a context
+        menu appear in the bottom-right corner of the screen
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp:
+        (PluginTest::NPN_GetValue): Added. Calls through to the browser.
+
+        * DumpRenderTree/TestNetscapePlugIn/PluginTest.h: Added NPN_GetValue.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/win/GetValueNetscapeWindow.cpp: Added.
+        (GetValueNetscapeWindow::GetValueNetscapeWindow): Initialize members.
+        (GetValueNetscapeWindow::NPP_SetWindow): Test that
+        NPN_GetValue(NPNVnetscapeWindow) returns a valid HWND and that it
+        isn't our HWND.
+
+        * DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj:
+        Added GetValueNetscapeWindow.
+
+2010-10-01  Andreas Kling  <andreas.kling@nokia.com>
+
+        Unreviewed, adding my webkit.org identity to reviewer list.
+
+        * Scripts/webkitpy/common/config/committers.py:
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        The WebSocket server should flush its logs
+        https://bugs.webkit.org/show_bug.cgi?id=46946
+
+        The WebSocket server logs are truncated because the driver just
+        terminates the child.  It should run Python without buffering so we can
+        see the end of the log.
+
+        * Scripts/webkitpy/layout_tests/port/websocket_server.py:
+
+2010-09-30  Simon Fraser  <simon.fraser@apple.com>
+
+        Add a button to jump to the next untested test.
+        
+        * CSSTestSuiteHarness/harness/harness.css:
+        (.test-type):
+        (.name > button):
+        * CSSTestSuiteHarness/harness/harness.html:
+        * CSSTestSuiteHarness/harness/harness.js:
+        (Chapter.prototype.description):
+        (Chapter.prototype.untestedCount):
+        (TestSuite.prototype.testInfoDataLoaded):
+        (TestSuite.prototype.fillChapterPopup):
+        (TestSuite.prototype.updateChapterPopup):
+        (TestSuite.prototype.buildTestListForChapter):
+        (TestSuite.prototype.goToNextIncompleteTest):
+        (TestSuite.prototype.firstIncompleteTestIndex):
+        (TestSuite.prototype.testCompletionStateChanged):
+
+2010-09-29  Jon Honeycutt  <jhoneycutt@apple.com>
+
+        WebKit2 on Windows should use Windows fonts for the various standard
+        font families
+        https://bugs.webkit.org/show_bug.cgi?id=43499
+        <rdar://problem/8272758>
+
+        Reviewed by Adam Roben.
+
+        * WebKitTestRunner/TestController.cpp:
+        (WTR::TestController::resetStateToConsistentValues):
+        Use the Mac fonts for running tests. This matches DRT behavior.
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Third attempt.  We need a better integration test environment.
+
+        * Scripts/webkitpy/common/net/failuremap.py:
+        * Scripts/webkitpy/common/net/failuremap_unittest.py:
+
+2010-09-30  Robert Hogan  <robert@webkit.org>
+
+        Reviewed by Andreas Kling.
+
+        [Qt] Support for PlainTextController
+
+        Unskip editing/text-iterator/basic-iteration.html
+
+        https://bugs.webkit.org/show_bug.cgi?id=38805
+
+        * DumpRenderTree/qt/DumpRenderTree.pro:
+        * DumpRenderTree/qt/DumpRenderTreeQt.cpp:
+        (WebCore::DumpRenderTree::DumpRenderTree):
+        (WebCore::DumpRenderTree::initJSObjects):
+        * DumpRenderTree/qt/DumpRenderTreeQt.h:
+        * DumpRenderTree/qt/PlainTextControllerQt.cpp: Added.
+        (PlainTextController::PlainTextController):
+        (PlainTextController::plainText):
+        * DumpRenderTree/qt/PlainTextControllerQt.h: Added.
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.  Second attempt to fix sheriffbot.
+
+        * Scripts/webkitpy/common/net/buildbot.py:
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Unreviewed.
+
+        This patch should stop the sheriffbot from throwing an exception.
+
+        * Scripts/webkitpy/common/net/buildbot.py:
+
+2010-09-30  Brian Weinstein  <bweinstein@apple.com>
+
+        Reviewed by Adam Roben.
+
+        The same bots shouldn't run both Windows Debug Tests and Windows Release Tests.
+        https://bugs.webkit.org/show_bug.cgi?id=46926
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json: Have two bots running Windows 
+            Release Tests, and two bots running Windows Debug Tests, instead of four running both.
+
+2010-09-30  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        webkit-patch find-flaky-tests should print results URLs
+        https://bugs.webkit.org/show_bug.cgi?id=46917
+
+        Printing out the results URL makes find-flaky-tests more actionable
+        because you can see what happens when a test fails.  The output from
+        the script is still pretty noisy, but it seems useful.
+
+        * Scripts/webkitpy/tool/commands/queries.py:
+
+2010-09-30  Chris Marrin  <cmarrin@apple.com>
+
+        Reviewed by Simon Fraser.
+
+        Make 2D accelerated canvas rendering build on Mac
+        https://bugs.webkit.org/show_bug.cgi?id=46007
+        
+        Added ACCELERATED_2D_CANVAS to build-webkit
+
+        * Scripts/build-webkit:
+
+2010-09-29  Kenneth Russell  <kbr@google.com>
+
+        Reviewed by Dimitri Glazkov.
+
+        [chromium] Add accelerated compositing support to DumpRenderTree and test_shell
+        https://bugs.webkit.org/show_bug.cgi?id=46849
+
+        Added offscreen code path for WebGraphicsContext3DDefaultImpl which
+        works with the compositor integration in both DumpRenderTree and
+        test_shell, since both pass a non-null WebCanvas* to WebViewImpl::paint
+        and thereby trigger the compositor's readback code path. Added support
+        for --enable-accelerated-compositing to DumpRenderTree.
+
+        Tested in both test_shell and DumpRenderTree on Linux, the latter by
+        modifying a compositing layout test, dumping the pixels and verifying
+        that they matched the output when the compositor was active.
+
+        * DumpRenderTree/chromium/DumpRenderTree.cpp:
+        (main):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        (TestShell::resetWebSettings):
+        * DumpRenderTree/chromium/TestShell.h:
+        (TestShell::setAcceleratedCompositingEnabled):
+        * DumpRenderTree/chromium/WebPreferences.cpp:
+        (WebPreferences::reset):
+        (WebPreferences::applyTo):
+        * DumpRenderTree/chromium/WebPreferences.h:
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::scheduleComposite):
+        * DumpRenderTree/chromium/WebViewHost.h:
+
+2010-09-30  Adam Roben  <aroben@apple.com>
+
+        Ensure that QueueEngine cleans up its log files when its delegate
+        tells it to stop processing work
+
+        Reviewed by Adam Barth.
+
+        Fixes <http://webkit.org/b/46891> <rdar://problem/8496638> Many tests
+        in webkitpy.tool.bot.queueengine_unittest.QueueEngineTest crash on
+        Windows
+
+        * Scripts/webkitpy/tool/bot/queueengine.py:
+        (QueueEngine.run): Stop ourselves normally (including cleaning up log
+        files) when the delegate tells us to stop processing work.
+
+        * Scripts/webkitpy/tool/bot/queueengine_unittest.py:
+        (LoggingDelegate.__init__): Moved code here from
+        RaisingDelegate.__init__.
+        (LoggingDelegate.expeced_callbacks): Added the stop_work_queue
+        callback.
+        (LoggingDelegate.stop_work_queue): Moved here from RaisingDelegate.
+        (RaisingDelegate.__init__): Removed code that LoggingDelegate takes
+        care of for us now.
+        (QueueEngineTest.test_trivial): Make sure we got the expected stop
+        message.
+        (QueueEngineTest.test_not_safe_to_proceed): Changed to explicitly
+        remove the callbacks that are related to processing a single work
+        item, rather than removing all callbacks after a certain point, as
+        there are now more callbacks we expect to receive at the end.
+
+2010-09-30  Adam Roben  <aroben@apple.com>
+
+        Fix path -> URL conversion on Cygwin
+
+        Reviewed by Adam Barth.
+
+        Fixes <http://webkit.org/b/46890> <rdar://problem/8496637> Many tests
+        in webkitpy.layout_tests.run_webkit_tests_unittest assert on Windows
+
+        * Scripts/webkitpy/layout_tests/port/base.py:
+        (Port.filename_to_uri): Treat Cygwin like other UNIX-y platforms by
+        assuming paths already have a leading slash.
+
+2010-09-30  Adam Roben  <aroben@apple.com>
+
+        Teach WindowGeometryInitializedBeforeSetWindow that NPP_SetWindow can
+        be called more than once
+
+        The NPP_SetWindow call made when the plugin is torn down was confusing
+        us, and was causing us to spew an error into the next test.
+
+        Fixes <http://webkit.org/b/46900> <rdar://problem/8496888> REGRESSION
+        (r68520): plugins/access-after-page-destroyed.html failing on Windows
+
+        Reviewed by Anders Carlsson.
+
+        * DumpRenderTree/TestNetscapePlugIn/Tests/win/WindowGeometryInitializedBeforeSetWindow.cpp:
+        (WindowGeometryInitializedBeforeSetWindow::WindowGeometryInitializedBeforeSetWindow):
+        Initialize member.
+        (WindowGeometryInitializedBeforeSetWindow::NPP_SetWindow): Bail if
+        this isn't the first time this is called.
+
+2010-09-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        webkit-patch upload warns that I'm using Xcode when I'm not
+        https://bugs.webkit.org/show_bug.cgi?id=46869
+
+        String.find returns -1 when not found, so switched to "in".
+
+        * Scripts/webkitpy/common/system/user.py:
+        * Scripts/webkitpy/common/system/user_unittest.py:
+
+2010-09-30  Eric Seidel  <eric@webkit.org>
+
+        Reviewed by Adam Barth.
+
+        webkit-patch failure-reason dies if non-trunk commits are in the blame range
+        https://bugs.webkit.org/show_bug.cgi?id=46866
+
+        I also made failure-reason use RegressionWindow in a cleaner way.
+
+        * Scripts/webkitpy/tool/commands/queries.py:
+
+2010-09-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        webkit-patch find-flaky-tests
+        https://bugs.webkit.org/show_bug.cgi?id=46876
+
+        This command helps us find flaky tests so we can squash them.
+
+        * Scripts/webkitpy/tool/commands/queries.py:
+
+2010-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Fix export to use '?' instead of 'null' for
+        tests with no results.
+        
+        * CSSTestSuiteHarness/harness/harness.js:
+
+2010-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        Add a warning when a test requires special steps.
+        Add a Print Preview button for 'paged' tests that
+        brings up the print dialog, allowing the user to 
+        judge paged media tests.
+
+        * CSSTestSuiteHarness/harness/harness.css:
+        * CSSTestSuiteHarness/harness/harness.html:
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.loadTest):
+        (TestSuite.prototype.processFlags):
+
+2010-09-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Remove revisions_casuing_failures
+        https://bugs.webkit.org/show_bug.cgi?id=46872
+
+        This function exists only to be unit tested.
+
+        * Scripts/webkitpy/common/net/failuremap.py:
+        * Scripts/webkitpy/common/net/failuremap_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-09-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        SheriffBot should post the list of failing tests to bugs
+        https://bugs.webkit.org/show_bug.cgi?id=46871
+
+        * Scripts/webkitpy/common/net/buildbot.py:
+        * Scripts/webkitpy/common/net/failuremap.py:
+        * Scripts/webkitpy/common/net/regressionwindow.py:
+        * Scripts/webkitpy/tool/bot/sheriff.py:
+        * Scripts/webkitpy/tool/bot/sheriff_unittest.py:
+        * Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py:
+        * Scripts/webkitpy/tool/commands/queues_unittest.py:
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        * Scripts/webkitpy/tool/commands/sheriffbot_unittest.py:
+        * Scripts/webkitpy/tool/commands/upload_unittest.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-09-29  Brent Fulgham  <bfulgham@webkit.org>
+
+        Reviewed by Martin Robinson, Eric Seidel, and Mark Rowe.
+
+        [WinCairo] Adds a build slave.
+        https://bugs.webkit.org/show_bug.cgi?id=46360
+
+        * BuildSlaveSupport/build.webkit.org-config/config.json: Add
+        entries for a debug build of the WinCairo port.
+        * BuildSlaveSupport/build.webkit.org-config/master.cfg: Add
+        platform flag to configuration for wincairo (like gtk, chromium, etc.)
+        * Scripts/build-webkit: Change 'cairo-win32' labeling to 'wincairo'
+        * Scripts/webkitdirs.pm: Change 'cairo-win32' labeling to 'wincairo'
+
+2010-09-29  Adam Barth  <abarth@webkit.org>
+
+        Reviewed by Eric Seidel.
+
+        Move more SheriffBot smarts into FailureMap
+        https://bugs.webkit.org/show_bug.cgi?id=46703
+
+        This patch pushes the FailureMap model object further into the
+        SheriffBot machine.  In addition, it moves a couple operations on this
+        object from SheriffBot itself to the model.
+
+        Eventually, FailureMap will be the canonical context object for
+        SheriffBot operations.  FailureMap represents a map of the current
+        failures on the bots that might require remediation.
+
+        * Scripts/webkitpy/common/net/failuremap.py:
+        * Scripts/webkitpy/common/net/regressionwindow.py:
+        * Scripts/webkitpy/tool/commands/queries.py:
+        * Scripts/webkitpy/tool/commands/sheriffbot.py:
+        * Scripts/webkitpy/tool/mocktool.py:
+
+2010-09-29  Tony Chang  <tony@chromium.org>
+
+        Reviewed by James Robinson.
+
+        [chromium] enable -Werror for DRT and webkit_unit_tests on Linux
+        https://bugs.webkit.org/show_bug.cgi?id=46829
+
+        * DumpRenderTree/chromium/DRTDevToolsClient.cpp:
+        (DRTDevToolsClient::DRTDevToolsClient):
+        * DumpRenderTree/chromium/TestShell.cpp:
+        (TestShell::TestShell):
+        * DumpRenderTree/chromium/WebViewHost.cpp:
+        (WebViewHost::postAccessibilityNotification):
+        (WebViewHost::WebViewHost):
+
+2010-09-29  Chris Fleizach  <cfleizach@apple.com>
+
+        Reviewed by Darin Adler.
+
+        AX: implement CSS3 Speech "speak"
+        https://bugs.webkit.org/show_bug.cgi?id=46827
+
+        * DumpRenderTree/AccessibilityUIElement.cpp:
+        (speakCallback):
+        (AccessibilityUIElement::speak):
+        (AccessibilityUIElement::getJSClass):
+        * DumpRenderTree/AccessibilityUIElement.h:
+        * DumpRenderTree/mac/AccessibilityUIElementMac.mm:
+        (AccessibilityUIElement::speak):
+
+2010-09-29  Mihai Parparita  <mihaip@chromium.org>
+
+        Reviewed by Adam Barth.
+
+        Record bot ID when updating queue status
+        https://bugs.webkit.org/show_bug.cgi?id=46764
+        
+        Since we now have multiple bots handling patches from the commit queue,
+        we need to differentiate status updates from them, so that we can group
+        the queue status page in a less confusing way.
+
+        * QueueStatusServer/handlers/updatestatus.py: Accept bot_id as input
+        * QueueStatusServer/model/queuestatus.py: Add bot_id property
+        * QueueStatusServer/templates/updatestatus.html: Add bot_id input
+        * Scripts/webkitpy/common/net/bugzilla_unittest.py: Extract MockBrowser
+        * Scripts/webkitpy/common/net/statusserver.py: Add bot_id
+        * Scripts/webkitpy/common/net/statusserver_unittest.py: Added.
+        * Scripts/webkitpy/tool/main.py: Add --bot-id
+        * Scripts/webkitpy/tool/mocktool.py: Add MockBrowser
+
+2010-09-29  Simon Fraser  <simon.fraser@apple.com>
+
+        No review.
+        
+        References always refert to a file in .xht format, even
+        for HTML tests, so fix their loading.
+
+        * CSSTestSuiteHarness/harness/harness.js:
+        (TestSuite.prototype.loadRef):
+
 2010-09-28  Johnny Ding  <jnd@chromium.org>
 
         Reviewed by Adam Barth.
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
index 13c642a..52d238d 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.cpp
@@ -128,6 +128,16 @@ static JSValueRef lineForIndexCallback(JSContextRef context, JSObjectRef functio
     return JSValueMakeNumber(context, toAXElement(thisObject)->lineForIndex(indexNumber));
 }
 
+static JSValueRef rangeForLineCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    int indexNumber = -1;
+    if (argumentCount == 1)
+        indexNumber = JSValueToNumber(context, arguments[0], exception);
+    
+    JSRetainPtr<JSStringRef> rangeLine(Adopt, toAXElement(thisObject)->rangeForLine(indexNumber));
+    return JSValueMakeString(context, rangeLine.get());
+}
+
 static JSValueRef boundsForRangeCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     unsigned location = UINT_MAX, length = 0;
@@ -679,6 +689,12 @@ static JSValueRef isIgnoredCallback(JSContextRef context, JSObjectRef thisObject
     return JSValueMakeBoolean(context, toAXElement(thisObject)->isIgnored());
 }
 
+static JSValueRef speakCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef, JSValueRef*)
+{
+    JSRetainPtr<JSStringRef> speakString(Adopt, toAXElement(thisObject)->speak());
+    return JSValueMakeString(context, speakString.get());
+}
+
 static JSValueRef getHasPopupCallback(JSContextRef context, JSObjectRef thisObject, JSStringRef, JSValueRef*)
 {
     return JSValueMakeBoolean(context, toAXElement(thisObject)->hasPopup());
@@ -737,6 +753,12 @@ static JSValueRef removeNotificationListenerCallback(JSContextRef context, JSObj
 
 // Implementation
 
+// Unsupported methods on various platforms.
+#if !PLATFORM(MAC)
+JSStringRef AccessibilityUIElement::speak() { return 0; }
+JSStringRef AccessibilityUIElement::rangeForLine(int line) { return 0; }
+#endif
+
 #if !SUPPORTS_AX_TEXTMARKERS
 
 AccessibilityTextMarkerRange AccessibilityUIElement::textMarkerRangeForElement(AccessibilityUIElement*)
@@ -837,6 +859,7 @@ JSClassRef AccessibilityUIElement::getJSClass()
         { "ariaIsGrabbed", getARIAIsGrabbedCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "ariaDropEffects", getARIADropEffectsCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isIgnored", isIgnoredCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "speak", speakCallback, 0, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { 0, 0, 0, 0 }
     };
 
@@ -847,6 +870,7 @@ JSClassRef AccessibilityUIElement::getJSClass()
         { "attributesOfChildren", attributesOfChildrenCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "parameterizedAttributeNames", parameterizedAttributeNamesCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "lineForIndex", lineForIndexCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
+        { "rangeForLine", rangeForLineCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "boundsForRange", boundsForRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "stringForRange", stringForRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "attributedStringForRange", attributedStringForRangeCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
index 5170f20..9311dfd 100644
--- a/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
+++ b/WebKitTools/DumpRenderTree/AccessibilityUIElement.h
@@ -147,6 +147,9 @@ public:
     JSStringRef documentURI();
     JSStringRef url();
 
+    // CSS3-speech properties.
+    JSStringRef speak();
+    
     // Table-specific attributes
     JSStringRef attributesOfColumnHeaders();
     JSStringRef attributesOfRowHeaders();
@@ -176,6 +179,7 @@ public:
     
     // Parameterized attributes
     int lineForIndex(int);
+    JSStringRef rangeForLine(int);
     JSStringRef boundsForRange(unsigned location, unsigned length);
     void setSelectedTextRange(unsigned location, unsigned length);
     JSStringRef stringForRange(unsigned location, unsigned length);
diff --git a/WebKitTools/DumpRenderTree/DumpRenderTree.gypi b/WebKitTools/DumpRenderTree/DumpRenderTree.gypi
index 58ccaae..b437eaf 100644
--- a/WebKitTools/DumpRenderTree/DumpRenderTree.gypi
+++ b/WebKitTools/DumpRenderTree/DumpRenderTree.gypi
@@ -44,6 +44,20 @@
             'chromium/WebViewHost.cpp',
             'chromium/WebViewHost.h',
         ],
+        'test_plugin_files': [
+            'TestNetscapePlugIn/PluginObject.cpp',
+            'TestNetscapePlugIn/PluginObject.h',
+            'TestNetscapePlugIn/PluginObjectMac.mm',
+            'TestNetscapePlugIn/PluginTest.cpp',
+            'TestNetscapePlugIn/PluginTest.h',
+            'TestNetscapePlugIn/TestObject.cpp',
+            'TestNetscapePlugIn/TestObject.h',
+            'TestNetscapePlugIn/Tests/DocumentOpenInDestroyStream.cpp',
+            'TestNetscapePlugIn/Tests/NPRuntimeObjectFromDestroyedPlugin.cpp',
+            'TestNetscapePlugIn/Tests/NPRuntimeRemoveProperty.cpp',
+            'TestNetscapePlugIn/Tests/PluginScriptableNPObjectInvokeDefault.cpp',
+            'TestNetscapePlugIn/main.cpp',
+        ],
         'conditions': [
             ['OS=="win"', {
                 'drt_files': [
diff --git a/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj b/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
index c01ca4e..51d8e7f 100644
--- a/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
+++ b/WebKitTools/DumpRenderTree/DumpRenderTree.xcodeproj/project.pbxproj
@@ -48,6 +48,8 @@
 		29CFBA2E12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = 29CFBA2D12273A1000BC30C0 /* AccessibilityTextMarkerMac.mm */; };
 		3713EDE2115BE19300705720 /* ColorBits-A.png in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 3713EDDF115BE16F00705720 /* ColorBits-A.png */; };
 		3713EDE3115BE19300705720 /* ColorBits.ttf in Copy Font Files */ = {isa = PBXBuildFile; fileRef = 3713EDE0115BE16F00705720 /* ColorBits.ttf */; };
+		4437730E125CBC3600AAE02C /* WebArchiveDumpSupport.mm in Sources */ = {isa = PBXBuildFile; fileRef = 44A997830FCDE86400580F10 /* WebArchiveDumpSupport.mm */; };
+		4437730F125CBC4D00AAE02C /* WebArchiveDumpSupport.h in Headers */ = {isa = PBXBuildFile; fileRef = 44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */; };
 		5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */ = {isa = PBXBuildFile; fileRef = 5185F69F10714A57007AA393 /* HistoryDelegate.mm */; };
 		5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */ = {isa = PBXBuildFile; fileRef = 5185F69E10714A57007AA393 /* HistoryDelegate.h */; };
 		5DB9AC970F722C3600684641 /* AHEM____.TTF in Copy Font Files */ = {isa = PBXBuildFile; fileRef = AA7F10C20CB3C1030003BDC9 /* AHEM____.TTF */; };
@@ -128,6 +130,7 @@
 		BCD08B3A0E1057EF00A7D0C1 /* AccessibilityController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCD08B390E1057EF00A7D0C1 /* AccessibilityController.cpp */; };
 		BCD08B710E1059D200A7D0C1 /* AccessibilityControllerMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BCD08B700E1059D200A7D0C1 /* AccessibilityControllerMac.mm */; };
 		BCF6C6500C98E9C000AC063E /* GCController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCF6C64F0C98E9C000AC063E /* GCController.cpp */; };
+		C06F9ABC1267A7060058E1F6 /* PassDifferentNPPStruct.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */; };
 		E1B7816511AF31B7007E1BC2 /* MockGeolocationProvider.mm in Sources */ = {isa = PBXBuildFile; fileRef = E1B7808711AF1669007E1BC2 /* MockGeolocationProvider.mm */; };
 		E1B7816711AF31C3007E1BC2 /* MockGeolocationProvider.h in Headers */ = {isa = PBXBuildFile; fileRef = E1B7808511AF1643007E1BC2 /* MockGeolocationProvider.h */; };
 /* End PBXBuildFile section */
@@ -220,6 +223,8 @@
 		375F09770DAC3CB600C8B4E5 /* WebKitWeightWatcher700.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher700.ttf; path = fonts/WebKitWeightWatcher700.ttf; sourceTree = "<group>"; };
 		375F09780DAC3CB600C8B4E5 /* WebKitWeightWatcher800.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher800.ttf; path = fonts/WebKitWeightWatcher800.ttf; sourceTree = "<group>"; };
 		375F09790DAC3CB600C8B4E5 /* WebKitWeightWatcher900.ttf */ = {isa = PBXFileReference; lastKnownFileType = file; name = WebKitWeightWatcher900.ttf; path = fonts/WebKitWeightWatcher900.ttf; sourceTree = "<group>"; };
+		44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = WebArchiveDumpSupport.h; path = mac/WebArchiveDumpSupport.h; sourceTree = "<group>"; };
+		44A997830FCDE86400580F10 /* WebArchiveDumpSupport.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = WebArchiveDumpSupport.mm; path = mac/WebArchiveDumpSupport.mm; sourceTree = "<group>"; };
 		5185F69E10714A57007AA393 /* HistoryDelegate.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = HistoryDelegate.h; path = mac/HistoryDelegate.h; sourceTree = "<group>"; };
 		5185F69F10714A57007AA393 /* HistoryDelegate.mm */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 4; name = HistoryDelegate.mm; path = mac/HistoryDelegate.mm; sourceTree = "<group>"; };
 		8465E2C60FFA8DF2003B8342 /* PixelDumpSupport.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 30; path = PixelDumpSupport.cpp; sourceTree = "<group>"; };
@@ -298,6 +303,7 @@
 		BCD08B390E1057EF00A7D0C1 /* AccessibilityController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = AccessibilityController.cpp; sourceTree = "<group>"; };
 		BCD08B700E1059D200A7D0C1 /* AccessibilityControllerMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = AccessibilityControllerMac.mm; path = mac/AccessibilityControllerMac.mm; sourceTree = "<group>"; };
 		BCF6C64F0C98E9C000AC063E /* GCController.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.objcpp; fileEncoding = 30; path = GCController.cpp; sourceTree = "<group>"; };
+		C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PassDifferentNPPStruct.cpp; sourceTree = "<group>"; };
 		E1B7808511AF1643007E1BC2 /* MockGeolocationProvider.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; name = MockGeolocationProvider.h; path = mac/MockGeolocationProvider.h; sourceTree = "<group>"; };
 		E1B7808711AF1669007E1BC2 /* MockGeolocationProvider.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; name = MockGeolocationProvider.mm; path = mac/MockGeolocationProvider.mm; sourceTree = "<group>"; };
 /* End PBXFileReference section */
@@ -358,6 +364,8 @@
 				BCA18B740C9B08F100114369 /* DumpRenderTreeDraggingInfo.mm */,
 				A8D79CE80FC28B2C004AC8FE /* DumpRenderTreeFileDraggingSource.h */,
 				A8D79CE90FC28B2C004AC8FE /* DumpRenderTreeFileDraggingSource.m */,
+				44A997820FCDE86400580F10 /* WebArchiveDumpSupport.h */,
+				44A997830FCDE86400580F10 /* WebArchiveDumpSupport.mm */,
 				BC9D90210C97472D0099A4A3 /* WorkQueue.cpp */,
 				BC9D90220C97472E0099A4A3 /* WorkQueue.h */,
 				BC9D90230C97472E0099A4A3 /* WorkQueueItem.h */,
@@ -451,6 +459,7 @@
 				1A215A7511F26072008AD0F5 /* DocumentOpenInDestroyStream.cpp */,
 				1A24BAA8120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp */,
 				1AC77DCE120605B6005C19EF /* NPRuntimeRemoveProperty.cpp */,
+				C06F9ABB1267A7060058E1F6 /* PassDifferentNPPStruct.cpp */,
 				1AD9D2FD12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp */,
 			);
 			path = Tests;
@@ -590,6 +599,7 @@
 				BCA18B670C9B08C200114369 /* ResourceLoadDelegate.h in Headers */,
 				BCA18B3C0C9B024900114369 /* TextInputController.h in Headers */,
 				BCA18B690C9B08C200114369 /* UIDelegate.h in Headers */,
+				4437730F125CBC4D00AAE02C /* WebArchiveDumpSupport.h in Headers */,
 				BC9D90250C97472E0099A4A3 /* WorkQueue.h in Headers */,
 				BC9D90260C97472E0099A4A3 /* WorkQueueItem.h in Headers */,
 				5185F6B310714E12007AA393 /* HistoryDelegate.h in Headers */,
@@ -726,6 +736,7 @@
 				1AD9D2FE12028409001A70D1 /* PluginScriptableNPObjectInvokeDefault.cpp in Sources */,
 				1AC77DCF120605B6005C19EF /* NPRuntimeRemoveProperty.cpp in Sources */,
 				1A24BAA9120734EE00FBB059 /* NPRuntimeObjectFromDestroyedPlugin.cpp in Sources */,
+				C06F9ABC1267A7060058E1F6 /* PassDifferentNPPStruct.cpp in Sources */,
 			);
 			runOnlyForDeploymentPostprocessing = 0;
 		};
@@ -764,6 +775,7 @@
 				BCA18B680C9B08C200114369 /* ResourceLoadDelegate.mm in Sources */,
 				BCA18B490C9B02C400114369 /* TextInputController.m in Sources */,
 				BCA18B6A0C9B08C200114369 /* UIDelegate.mm in Sources */,
+				4437730E125CBC3600AAE02C /* WebArchiveDumpSupport.mm in Sources */,
 				BC9D90240C97472E0099A4A3 /* WorkQueue.cpp in Sources */,
 				BCA18B260C9B015C00114369 /* WorkQueueItemMac.mm in Sources */,
 				5185F6B210714E07007AA393 /* HistoryDelegate.mm in Sources */,
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
index ee44325..b5cc874 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.cpp
@@ -1219,6 +1219,7 @@ static JSValueRef setXSSAuditorEnabledCallback(JSContextRef context, JSObjectRef
 
 static JSValueRef setSpatialNavigationEnabledCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
+    // Has mac implementation.
     if (argumentCount < 1)
         return JSValueMakeUndefined(context);
 
@@ -1722,6 +1723,19 @@ static JSValueRef abortModalCallback(JSContextRef context, JSObjectRef function,
     return JSValueMakeUndefined(context);
 }
 
+static JSValueRef hasSpellingMarkerCallback(JSContextRef context, JSObjectRef function, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
+{
+    if (argumentCount != 2)
+        return JSValueMakeUndefined(context);
+
+    int from = JSValueToNumber(context, arguments[0], 0);
+    int length = JSValueToNumber(context, arguments[1], 0);
+    LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
+    bool ok = controller->hasSpellingMarker(from, length);
+
+    return JSValueMakeBoolean(context, ok);
+}
+
 static JSValueRef markerTextForListItemCallback(JSContextRef context, JSObjectRef, JSObjectRef thisObject, size_t argumentCount, const JSValueRef arguments[], JSValueRef* exception)
 {
     LayoutTestController* controller = static_cast<LayoutTestController*>(JSObjectGetPrivate(thisObject));
@@ -1890,6 +1904,7 @@ JSStaticFunction* LayoutTestController::staticFunctions()
         { "execCommand", execCommandCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "counterValueForElementById", counterValueForElementByIdCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "grantDesktopNotificationPermission", grantDesktopNotificationPermissionCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete }, 
+        { "hasSpellingMarker", hasSpellingMarkerCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isCommandEnabled", isCommandEnabledCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "isPageBoxVisible", isPageBoxVisibleCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
         { "keepWebHistory", keepWebHistoryCallback, kJSPropertyAttributeReadOnly | kJSPropertyAttributeDontDelete },
diff --git a/WebKitTools/DumpRenderTree/LayoutTestController.h b/WebKitTools/DumpRenderTree/LayoutTestController.h
index 755a2b2..689e114 100644
--- a/WebKitTools/DumpRenderTree/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/LayoutTestController.h
@@ -279,6 +279,8 @@ public:
 
     void abortModal();
 
+    bool hasSpellingMarker(int from, int length);
+
     // The following API test functions should probably be moved to platform-specific 
     // unit tests outside of DRT once they exist.
     void apiTestNewWindowDataLoadBaseURL(JSStringRef utf8Data, JSStringRef baseURL);
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
index 83eda3a..d435a2e 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.cpp
@@ -75,6 +75,11 @@ NPIdentifier PluginTest::NPN_GetIntIdentifier(int32_t intid)
     return browser->getintidentifier(intid);
 }
 
+NPError PluginTest::NPN_GetValue(NPNVariable variable, void* value)
+{
+    return browser->getvalue(m_npp, variable, value);
+}
+
 NPObject* PluginTest::NPN_CreateObject(NPClass* npClass)
 {
     return browser->createobject(m_npp, npClass);
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
index 2e896a6..cbc7934 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/PluginTest.h
@@ -62,6 +62,7 @@ public:
     // NPN functions.
     NPIdentifier NPN_GetStringIdentifier(const NPUTF8* name);
     NPIdentifier NPN_GetIntIdentifier(int32_t intid);
+    NPError NPN_GetValue(NPNVariable, void* value);
     NPObject* NPN_CreateObject(NPClass*);
     bool NPN_RemoveProperty(NPObject*, NPIdentifier propertyName);
     
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/PassDifferentNPPStruct.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/PassDifferentNPPStruct.cpp
new file mode 100644
index 0000000..e464996
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/PassDifferentNPPStruct.cpp
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+#include "PluginObject.h"
+
+using namespace std;
+
+// Passing a different NPP struct that has the same ndata value as the one passed to NPP_New should
+// not trigger an assertion failure.
+
+class PassDifferentNPPStruct : public PluginTest {
+public:
+    PassDifferentNPPStruct(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
+        , m_didReceiveInitialSetWindowCall(false)
+    {
+    }
+
+private:
+    virtual NPError NPP_SetWindow(NPP instance, NPWindow* window)
+    {
+        if (m_didReceiveInitialSetWindowCall)
+            return NPERR_NO_ERROR;
+        m_didReceiveInitialSetWindowCall = true;
+
+        NPP oldNPP = m_npp;
+        NPP_t differentNPP = *m_npp;
+        m_npp = &differentNPP;
+
+        NPBool privateMode;
+        NPError error = NPN_GetValue(NPNVprivateModeBool, &privateMode);
+
+        m_npp = oldNPP;
+
+        if (error != NPERR_NO_ERROR) {
+            pluginLog(instance, "NPN_GetValue(NPNVprivateModeBool) with a different NPP struct failed with error %d", error);
+            return NPERR_GENERIC_ERROR;
+        }
+        pluginLog(instance, "NPN_GetValue(NPNVprivateModeBool) with a different NPP struct succeeded");
+        return NPERR_NO_ERROR;
+    }
+
+    bool m_didReceiveInitialSetWindowCall;
+};
+
+static PluginTest::Register<PassDifferentNPPStruct> getValueNetscapeWindow("pass-different-npp-struct");
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/GetValueNetscapeWindow.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/GetValueNetscapeWindow.cpp
new file mode 100644
index 0000000..32fd99b
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/GetValueNetscapeWindow.cpp
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PluginTest.h"
+
+#include "PluginObject.h"
+
+using namespace std;
+
+// NPN_GetValue(NPNVnetscapeWindow) should return a valid HWND.
+
+class GetValueNetscapeWindow : public PluginTest {
+public:
+    GetValueNetscapeWindow(NPP npp, const string& identifier)
+        : PluginTest(npp, identifier)
+        , m_didReceiveInitialSetWindowCall(false)
+    {
+    }
+
+private:
+    virtual NPError NPP_SetWindow(NPP instance, NPWindow* window)
+    {
+        if (m_didReceiveInitialSetWindowCall)
+            return NPERR_NO_ERROR;
+        m_didReceiveInitialSetWindowCall = true;
+
+        HWND hwnd;
+        NPError error = NPN_GetValue(NPNVnetscapeWindow, &hwnd);
+        if (error != NPERR_NO_ERROR) {
+            pluginLog(instance, "NPN_GetValue(NPNVnetscapeWindow) failed with error %d", error);
+            return NPERR_GENERIC_ERROR;
+        }
+
+        if (!::IsWindow(hwnd)) {
+            pluginLog(instance, "::IsWindow returned FALSE");
+            return NPERR_GENERIC_ERROR;
+        }
+
+        if (hwnd == window->window) {
+            pluginLog(instance, "NPN_GetValue(NPNVnetscapeWindow) returned the same value as NPWindow::window");
+            return NPERR_GENERIC_ERROR;
+        }
+
+        pluginLog(instance, "NPN_GetValue(NPNVnetscapeWindow) succeeded");
+        return NPERR_NO_ERROR;
+    }
+
+    bool m_didReceiveInitialSetWindowCall;
+};
+
+static PluginTest::Register<GetValueNetscapeWindow> getValueNetscapeWindow("get-value-netscape-window");
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/WindowGeometryInitializedBeforeSetWindow.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/WindowGeometryInitializedBeforeSetWindow.cpp
index 40bceb9..8054497 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/WindowGeometryInitializedBeforeSetWindow.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/Tests/win/WindowGeometryInitializedBeforeSetWindow.cpp
@@ -35,12 +35,17 @@ class WindowGeometryInitializedBeforeSetWindow : public PluginTest {
 public:
     WindowGeometryInitializedBeforeSetWindow(NPP npp, const string& identifier)
         : PluginTest(npp, identifier)
+        , m_didReceiveInitialSetWindowCall(false)
     {
     }
 
 private:
     virtual NPError NPP_SetWindow(NPP instance, NPWindow* window)
     {
+        if (m_didReceiveInitialSetWindowCall)
+            return NPERR_NO_ERROR;
+        m_didReceiveInitialSetWindowCall = true;
+
         if (window->type != NPWindowTypeWindow) {
             pluginLog(instance, "window->type should be NPWindowTypeWindow but was %d", window->type);
             return NPERR_GENERIC_ERROR;
@@ -77,7 +82,9 @@ private:
 
         pluginLog(instance, "Plugin's HWND has been sized and positioned before NPP_SetWindow was called");
         return NPERR_NO_ERROR;
-    }        
+    }
+
+    bool m_didReceiveInitialSetWindowCall;
 };
 
 static PluginTest::Register<WindowGeometryInitializedBeforeSetWindow> windowGeometryInitializedBeforeSetWindow("window-geometry-initialized-before-set-window");
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/main.cpp b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/main.cpp
index dd894f4..e240c42 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/main.cpp
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/main.cpp
@@ -75,7 +75,7 @@ NPError STDCALL NP_GetEntryPoints(NPPluginFuncs *pluginFuncs)
 {
     getEntryPointsWasCalled = true;
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
     // Simulate Silverlight's behavior of crashing when NP_GetEntryPoints is called before NP_Initialize.
     if (!initializeWasCalled)
         CRASH();
@@ -111,7 +111,7 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc
 {
     bool forceCarbon = false;
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
     NPEventModel eventModel;
     
     // Always turn on the CG model
@@ -158,7 +158,7 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc
     PluginObject* obj = (PluginObject*)browser->createobject(instance, getPluginClass());
     instance->pdata = obj;
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
     obj->eventModel = eventModel;
 #if !defined(BUILDING_ON_TIGER)
     obj->coreAnimationLayer = 0;
@@ -198,7 +198,7 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc
         else if (strcasecmp(argn[i], "testwindowopen") == 0)
             obj->testWindowOpen = TRUE;
         else if (strcasecmp(argn[i], "drawingmodel") == 0) {
-#if XP_MACOSX && !defined(BUILDING_ON_TIGER)
+#if defined(XP_MACOSX) && !defined(BUILDING_ON_TIGER)
             const char* value = argv[i];
             if (strcasecmp(value, "coreanimation") == 0) {
                 if (supportsCoreAnimation)
@@ -234,7 +234,7 @@ NPError NPP_New(NPMIMEType pluginType, NPP instance, uint16_t mode, int16_t argc
         }
     }
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
     browser->setvalue(instance, NPPVpluginDrawingModel, (void *)drawingModelToUse);
 #if !defined(BUILDING_ON_TIGER)
     if (drawingModelToUse == NPDrawingModelCoreAnimation)
@@ -276,7 +276,7 @@ NPError NPP_Destroy(NPP instance, NPSavedData **save)
         if (obj->logDestroy)
             pluginLog(instance, "NPP_Destroy");
 
-#if XP_MACOSX && !defined(BUILDING_ON_TIGER)
+#if defined(XP_MACOSX) && !defined(BUILDING_ON_TIGER)
         if (obj->coreAnimationLayer)
             CFRelease(obj->coreAnimationLayer);
 #endif
@@ -400,7 +400,7 @@ void NPP_Print(NPP instance, NPPrint *platformPrint)
 {
 }
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
 #ifndef NP_NO_CARBON
 static int16_t handleEventCarbon(NPP instance, PluginObject* obj, EventRecord* event)
 {
@@ -462,13 +462,13 @@ static int16_t handleEventCarbon(NPP instance, PluginObject* obj, EventRecord* e
             pluginLog(instance, "kHighLevelEvent");
             break;
         // NPAPI events
-        case getFocusEvent:
+        case NPEventType_GetFocusEvent:
             pluginLog(instance, "getFocusEvent");
             break;
-        case loseFocusEvent:
+        case NPEventType_LoseFocusEvent:
             pluginLog(instance, "loseFocusEvent");
             break;
-        case adjustCursorEvent:
+        case NPEventType_AdjustCursorEvent:
             pluginLog(instance, "adjustCursorEvent");
             break;
         default:
@@ -548,7 +548,7 @@ int16_t NPP_HandleEvent(NPP instance, void *event)
     if (!obj->eventLogging)
         return 0;
 
-#if XP_MACOSX
+#ifdef XP_MACOSX
 #ifndef NP_NO_CARBON
     if (obj->eventModel == NPEventModelCarbon)
         return handleEventCarbon(instance, obj, static_cast<EventRecord*>(event));
@@ -588,7 +588,7 @@ NPError NPP_GetValue(NPP instance, NPPVariable variable, void *value)
         return NPERR_NO_ERROR;
     }
     
-#if XP_MACOSX && !defined(BUILDING_ON_TIGER)
+#if defined(XP_MACOSX) && !defined(BUILDING_ON_TIGER)
     if (variable == NPPVpluginCoreAnimationLayer) {
         if (!obj->coreAnimationLayer)
             return NPERR_GENERIC_ERROR;
diff --git a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
index 5ffb832..cdd7729 100644
--- a/WebKitTools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
+++ b/WebKitTools/DumpRenderTree/TestNetscapePlugIn/win/TestNetscapePlugin.vcproj
@@ -383,6 +383,10 @@
 				>

 			</File>

 			<File

+				RelativePath="..\Tests\PassDifferentNPPStruct.cpp"

+				>

+			</File>

+			<File

 				RelativePath="..\Tests\PluginScriptableNPObjectInvokeDefault.cpp"

 				>

 			</File>

@@ -390,6 +394,10 @@
 				Name="win"

 				>

 				<File

+					RelativePath="..\Tests\win\GetValueNetscapeWindow.cpp"

+					>

+				</File>

+				<File

 					RelativePath="..\Tests\win\WindowGeometryInitializedBeforeSetWindow.cpp"

 					>

 				</File>

diff --git a/WebKitTools/DumpRenderTree/chromium/AccessibilityController.cpp b/WebKitTools/DumpRenderTree/chromium/AccessibilityController.cpp
index 2487e1a..5601d9d 100644
--- a/WebKitTools/DumpRenderTree/chromium/AccessibilityController.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/AccessibilityController.cpp
@@ -32,11 +32,11 @@
 #include "AccessibilityController.h"
 
 #include "TestShell.h"
-#include "public/WebAccessibilityCache.h"
-#include "public/WebAccessibilityObject.h"
-#include "public/WebFrame.h"
-#include "public/WebString.h"
-#include "public/WebView.h"
+#include "WebAccessibilityCache.h"
+#include "WebAccessibilityObject.h"
+#include "WebFrame.h"
+#include "WebString.h"
+#include "WebView.h"
 
 using namespace WebKit;
 
diff --git a/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.cpp b/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.cpp
index 8698e25..dbd025a 100644
--- a/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.cpp
@@ -31,9 +31,9 @@
 #include "config.h"
 #include "AccessibilityUIElement.h"
 
-#include "public/WebAccessibilityObject.h"
-#include "public/WebCString.h"
-#include "public/WebString.h"
+#include "WebAccessibilityObject.h"
+#include "WebCString.h"
+#include "WebString.h"
 #include <wtf/Assertions.h>
 
 using namespace WebKit;
diff --git a/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.h b/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.h
index df3f5b9..366ed42 100644
--- a/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.h
+++ b/WebKitTools/DumpRenderTree/chromium/AccessibilityUIElement.h
@@ -32,7 +32,7 @@
 #define AccessibilityUIElement_h
 
 #include "CppBoundClass.h"
-#include "public/WebAccessibilityObject.h"
+#include "WebAccessibilityObject.h"
 #include <wtf/Vector.h>
 
 class AccessibilityUIElement : public CppBoundClass {
diff --git a/WebKitTools/DumpRenderTree/chromium/CppBoundClass.cpp b/WebKitTools/DumpRenderTree/chromium/CppBoundClass.cpp
index 839787a..1348bbf 100644
--- a/WebKitTools/DumpRenderTree/chromium/CppBoundClass.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/CppBoundClass.cpp
@@ -42,9 +42,9 @@
 #include "config.h"
 #include "CppBoundClass.h"
 
-#include "public/WebBindings.h"
-#include "public/WebFrame.h"
-#include "public/WebString.h"
+#include "WebBindings.h"
+#include "WebFrame.h"
+#include "WebString.h"
 #include <wtf/Assertions.h>
 #include <wtf/OwnPtr.h>
 
diff --git a/WebKitTools/DumpRenderTree/chromium/CppVariant.cpp b/WebKitTools/DumpRenderTree/chromium/CppVariant.cpp
index 9539907..22e0013 100644
--- a/WebKitTools/DumpRenderTree/chromium/CppVariant.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/CppVariant.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "CppVariant.h"
 
-#include "public/WebBindings.h"
+#include "WebBindings.h"
 #include <limits>
 #include <wtf/Assertions.h>
 #include <wtf/StringExtras.h>
diff --git a/WebKitTools/DumpRenderTree/chromium/CppVariant.h b/WebKitTools/DumpRenderTree/chromium/CppVariant.h
index 3aa5abb..3032310 100644
--- a/WebKitTools/DumpRenderTree/chromium/CppVariant.h
+++ b/WebKitTools/DumpRenderTree/chromium/CppVariant.h
@@ -42,7 +42,7 @@
 #ifndef CppVariant_h
 #define CppVariant_h
 
-#include "public/WebBindings.h"
+#include "WebBindings.h"
 #include "webkit/support/webkit_support.h"
 #include <string>
 #include <wtf/Vector.h>
diff --git a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
index a9a891b..78c86e7 100644
--- a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.cpp
@@ -34,10 +34,10 @@
 #include "DRTDevToolsCallArgs.h"
 #include "DRTDevToolsClient.h"
 
-#include "public/WebCString.h"
-#include "public/WebDevToolsAgent.h"
-#include "public/WebString.h"
-#include "public/WebView.h"
+#include "WebCString.h"
+#include "WebDevToolsAgent.h"
+#include "WebString.h"
+#include "WebView.h"
 #include "webkit/support/webkit_support.h"
 
 using namespace WebKit;
diff --git a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.h b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.h
index c988fa1..e1478d0 100644
--- a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.h
+++ b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsAgent.h
@@ -33,7 +33,7 @@
 
 #include "DRTDevToolsCallArgs.h"
 #include "Task.h"
-#include "public/WebDevToolsAgentClient.h"
+#include "WebDevToolsAgentClient.h"
 #include <wtf/HashMap.h>
 #include <wtf/Noncopyable.h>
 
diff --git a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsCallArgs.h b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsCallArgs.h
index b1ac2ec..a548159 100644
--- a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsCallArgs.h
+++ b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsCallArgs.h
@@ -31,7 +31,7 @@
 #ifndef DRTDevToolsCallArgs_h
 #define DRTDevToolsCallArgs_h
 
-#include "public/WebString.h"
+#include "WebString.h"
 #include <wtf/Assertions.h>
 
 class DRTDevToolsCallArgs {
diff --git a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.cpp b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.cpp
index a53f0db..acccf18 100644
--- a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.cpp
@@ -34,19 +34,19 @@
 #include "DRTDevToolsAgent.h"
 #include "DRTDevToolsCallArgs.h"
 
-#include "public/WebDevToolsAgent.h"
-#include "public/WebDevToolsFrontend.h"
-#include "public/WebFrame.h"
-#include "public/WebScriptSource.h"
-#include "public/WebString.h"
-#include "public/WebView.h"
+#include "WebDevToolsAgent.h"
+#include "WebDevToolsFrontend.h"
+#include "WebFrame.h"
+#include "WebScriptSource.h"
+#include "WebString.h"
+#include "WebView.h"
 #include "webkit/support/webkit_support.h"
 
 using namespace WebKit;
 
 DRTDevToolsClient::DRTDevToolsClient(DRTDevToolsAgent* agent, WebView* webView)
-    : m_drtDevToolsAgent(agent)
-    , m_webView(webView)
+    : m_webView(webView)
+    , m_drtDevToolsAgent(agent)
 {
     m_webDevToolsFrontend.set(WebDevToolsFrontend::create(m_webView,
                                                           this,
diff --git a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.h b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.h
index f7c8fbf..9ca1402 100644
--- a/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.h
+++ b/WebKitTools/DumpRenderTree/chromium/DRTDevToolsClient.h
@@ -33,7 +33,7 @@
 
 #include "DRTDevToolsCallArgs.h"
 #include "Task.h"
-#include "public/WebDevToolsFrontendClient.h"
+#include "WebDevToolsFrontendClient.h"
 #include <wtf/Noncopyable.h>
 #include <wtf/OwnPtr.h>
 
diff --git a/WebKitTools/DumpRenderTree/chromium/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/chromium/DumpRenderTree.cpp
index b2e50f7..72c0c3c 100644
--- a/WebKitTools/DumpRenderTree/chromium/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/DumpRenderTree.cpp
@@ -48,6 +48,7 @@ static const char optionTestShell[] = "--test-shell";
 static const char optionAllowExternalPages[] = "--allow-external-pages";
 static const char optionStartupDialog[] = "--testshell-startup-dialog";
 static const char optionCheckLayoutTestSystemDeps[] = "--check-layout-test-sys-deps";
+static const char optionEnableAcceleratedCompositing[] = "--enable-accelerated-compositing";
 static const char optionEnableAccelerated2DCanvas[] = "--enable-accelerated-2d-canvas";
 
 static void runTest(TestShell& shell, TestParams& params, const string& testName, bool testShellMode)
@@ -93,6 +94,7 @@ int main(int argc, char* argv[])
     bool testShellMode = false;
     bool allowExternalPages = false;
     bool startupDialog = false;
+    bool acceleratedCompositingEnabled = false;
     bool accelerated2DCanvasEnabled = false;
     for (int i = 1; i < argc; ++i) {
         string argument(argv[i]);
@@ -114,6 +116,8 @@ int main(int argc, char* argv[])
             startupDialog = true;
         else if (argument == optionCheckLayoutTestSystemDeps)
             exit(checkLayoutTestSystemDependencies() ? EXIT_SUCCESS : EXIT_FAILURE);
+        else if (argument == optionEnableAcceleratedCompositing)
+            acceleratedCompositingEnabled = true;
         else if (argument == optionEnableAccelerated2DCanvas)
             accelerated2DCanvasEnabled = true;
         else if (argument.size() && argument[0] == '-')
@@ -132,6 +136,7 @@ int main(int argc, char* argv[])
     { // Explicit scope for the TestShell instance.
         TestShell shell(testShellMode);
         shell.setAllowExternalPages(allowExternalPages);
+        shell.setAcceleratedCompositingEnabled(acceleratedCompositingEnabled);
         shell.setAccelerated2dCanvasEnabled(accelerated2DCanvasEnabled);
         if (serverMode && !tests.size()) {
             params.printSeparators = true;
diff --git a/WebKitTools/DumpRenderTree/chromium/EventSender.cpp b/WebKitTools/DumpRenderTree/chromium/EventSender.cpp
index 5f51553..e250dfc 100644
--- a/WebKitTools/DumpRenderTree/chromium/EventSender.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/EventSender.cpp
@@ -44,18 +44,18 @@
 #include "EventSender.h"
 
 #include "TestShell.h"
-#include "public/WebDragData.h"
-#include "public/WebDragOperation.h"
-#include "public/WebPoint.h"
-#include "public/WebString.h"
-#include "public/WebTouchPoint.h"
-#include "public/WebView.h"
+#include "WebDragData.h"
+#include "WebDragOperation.h"
+#include "WebPoint.h"
+#include "WebString.h"
+#include "WebTouchPoint.h"
+#include "WebView.h"
 #include "webkit/support/webkit_support.h"
 #include <wtf/Deque.h>
 #include <wtf/StringExtras.h>
 
 #if OS(WINDOWS)
-#include "public/win/WebInputEventFactory.h"
+#include "win/WebInputEventFactory.h"
 #endif
 
 // FIXME: layout before each event?
@@ -779,7 +779,7 @@ void EventSender::beginDragWithFiles(const CppArgumentList& arguments, CppVarian
     currentDragData.initialize();
     Vector<string> files = arguments[0].toStringVector();
     for (size_t i = 0; i < files.size(); ++i)
-        currentDragData.appendToFileNames(webkit_support::GetAbsoluteWebStringFromUTF8Path(files[i]));
+        currentDragData.appendToFilenames(webkit_support::GetAbsoluteWebStringFromUTF8Path(files[i]));
     currentDragEffectsAllowed = WebKit::WebDragOperationCopy;
 
     // Provide a drag source.
diff --git a/WebKitTools/DumpRenderTree/chromium/EventSender.h b/WebKitTools/DumpRenderTree/chromium/EventSender.h
index 399a132..118509b 100644
--- a/WebKitTools/DumpRenderTree/chromium/EventSender.h
+++ b/WebKitTools/DumpRenderTree/chromium/EventSender.h
@@ -39,9 +39,9 @@
 
 #include "CppBoundClass.h"
 #include "Task.h"
-#include "public/WebDragOperation.h"
-#include "public/WebInputEvent.h"
-#include "public/WebPoint.h"
+#include "WebDragOperation.h"
+#include "WebInputEvent.h"
+#include "WebPoint.h"
 
 class TestShell;
 
diff --git a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
index 3d3c204..82fd085 100644
--- a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.cpp
@@ -34,27 +34,27 @@
 
 #include "DRTDevToolsAgent.h"
 #include "TestShell.h"
+#include "WebAnimationController.h"
+#include "WebBindings.h"
+#include "WebConsoleMessage.h"
+#include "WebData.h"
+#include "WebDeviceOrientation.h"
+#include "WebDeviceOrientationClientMock.h"
+#include "WebDocument.h"
+#include "WebElement.h"
+#include "WebFrame.h"
+#include "WebGeolocationServiceMock.h"
+#include "WebInputElement.h"
+#include "WebKit.h"
+#include "WebNotificationPresenter.h"
+#include "WebScriptSource.h"
+#include "WebSecurityPolicy.h"
+#include "WebSettings.h"
+#include "WebSize.h"
+#include "WebSpeechInputControllerMock.h"
+#include "WebURL.h"
+#include "WebView.h"
 #include "WebViewHost.h"
-#include "public/WebAnimationController.h"
-#include "public/WebBindings.h"
-#include "public/WebConsoleMessage.h"
-#include "public/WebData.h"
-#include "public/WebDeviceOrientation.h"
-#include "public/WebDeviceOrientationClientMock.h"
-#include "public/WebDocument.h"
-#include "public/WebElement.h"
-#include "public/WebFrame.h"
-#include "public/WebGeolocationServiceMock.h"
-#include "public/WebInputElement.h"
-#include "public/WebKit.h"
-#include "public/WebNotificationPresenter.h"
-#include "public/WebScriptSource.h"
-#include "public/WebSecurityPolicy.h"
-#include "public/WebSettings.h"
-#include "public/WebSize.h"
-#include "public/WebSpeechInputControllerMock.h"
-#include "public/WebURL.h"
-#include "public/WebView.h"
 #include "webkit/support/webkit_support.h"
 #include <algorithm>
 #include <cstdlib>
@@ -106,7 +106,9 @@ LayoutTestController::LayoutTestController(TestShell* shell)
     bindMethod("forceRedSelectionColors", &LayoutTestController::forceRedSelectionColors);
     bindMethod("grantDesktopNotificationPermission", &LayoutTestController::grantDesktopNotificationPermission);
     bindMethod("isCommandEnabled", &LayoutTestController::isCommandEnabled);
+    bindMethod("layerTreeAsText", &LayoutTestController::layerTreeAsText);
     bindMethod("markerTextForListItem", &LayoutTestController::markerTextForListItem);
+    bindMethod("hasSpellingMarker", &LayoutTestController::hasSpellingMarker);
     bindMethod("notifyDone", &LayoutTestController::notifyDone);
     bindMethod("numberOfActiveAnimations", &LayoutTestController::numberOfActiveAnimations);
     bindMethod("numberOfPages", &LayoutTestController::numberOfPages);
@@ -1537,6 +1539,11 @@ WebKit::WebSpeechInputController* LayoutTestController::speechInputController(We
     return m_speechInputControllerMock.get();
 }
 
+void LayoutTestController::layerTreeAsText(const CppArgumentList& args, CppVariant* result)
+{
+    result->set(m_shell->webView()->mainFrame()->layerTreeAsText().utf8());
+}
+
 void LayoutTestController::markerTextForListItem(const CppArgumentList& args, CppVariant* result)
 {
     WebElement element;
@@ -1552,3 +1559,10 @@ WebDeviceOrientationClient* LayoutTestController::deviceOrientationClient()
         m_deviceOrientationClientMock.set(WebDeviceOrientationClientMock::create());
     return m_deviceOrientationClientMock.get();
 }
+
+void LayoutTestController::hasSpellingMarker(const CppArgumentList& arguments, CppVariant* result)
+{
+    if (arguments.size() < 2 || !arguments[0].isNumber() || !arguments[1].isNumber())
+        return;
+    result->set(m_shell->webView()->mainFrame()->selectionStartHasSpellingMarkerFor(arguments[0].toInt32(), arguments[1].toInt32()));
+}
diff --git a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
index 8467097..ae1a7a2 100644
--- a/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
+++ b/WebKitTools/DumpRenderTree/chromium/LayoutTestController.h
@@ -43,8 +43,8 @@
 
 #include "CppBoundClass.h"
 #include "Task.h"
-#include "public/WebString.h"
-#include "public/WebURL.h"
+#include "WebString.h"
+#include "WebURL.h"
 #include <wtf/Deque.h>
 #include <wtf/OwnPtr.h>
 
@@ -325,7 +325,10 @@ public:
     // Speech input related functions.
     void setMockSpeechInputResult(const CppArgumentList&, CppVariant*);
 
+    void layerTreeAsText(const CppArgumentList& args, CppVariant* result);
+
     void markerTextForListItem(const CppArgumentList&, CppVariant*);
+    void hasSpellingMarker(const CppArgumentList&, CppVariant*);
 
 public:
     // The following methods are not exposed to JavaScript.
diff --git a/WebKitTools/DumpRenderTree/chromium/MockSpellCheck.cpp b/WebKitTools/DumpRenderTree/chromium/MockSpellCheck.cpp
index 0bf3802..bf39f60 100644
--- a/WebKitTools/DumpRenderTree/chromium/MockSpellCheck.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/MockSpellCheck.cpp
@@ -31,12 +31,11 @@
 #include "config.h"
 #include "MockSpellCheck.h"
 
+#include "WebString.h"
 #include <wtf/ASCIICType.h>
 #include <wtf/Assertions.h>
 #include <wtf/text/WTFString.h>
 
-#include "public/WebString.h"
-
 using namespace WebKit;
 
 MockSpellCheck::MockSpellCheck()
diff --git a/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.cpp b/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.cpp
index 7d4cbe3..7e7053b 100644
--- a/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.cpp
@@ -31,14 +31,14 @@
 #include "config.h"
 #include "NotificationPresenter.h"
 
+#include "WebKit.h"
+#include "WebKitClient.h"
+#include "WebNotification.h"
+#include "WebNotificationPermissionCallback.h"
+#include "WebSecurityOrigin.h"
+#include "WebString.h"
+#include "WebURL.h"
 #include "googleurl/src/gurl.h"
-#include "public/WebKit.h"
-#include "public/WebKitClient.h"
-#include "public/WebNotification.h"
-#include "public/WebNotificationPermissionCallback.h"
-#include "public/WebSecurityOrigin.h"
-#include "public/WebString.h"
-#include "public/WebURL.h"
 #include <wtf/text/CString.h>
 #include <wtf/text/WTFString.h>
 
diff --git a/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.h b/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.h
index 896f345..689a908 100644
--- a/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.h
+++ b/WebKitTools/DumpRenderTree/chromium/NotificationPresenter.h
@@ -31,8 +31,8 @@
 #ifndef NotificationPresenter_h
 #define NotificationPresenter_h
 
-#include "public/WebNotification.h"
-#include "public/WebNotificationPresenter.h"
+#include "WebNotification.h"
+#include "WebNotificationPresenter.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/text/StringHash.h>
diff --git a/WebKitTools/DumpRenderTree/chromium/PlainTextController.cpp b/WebKitTools/DumpRenderTree/chromium/PlainTextController.cpp
index 6e6cf11..c8bdabd 100644
--- a/WebKitTools/DumpRenderTree/chromium/PlainTextController.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/PlainTextController.cpp
@@ -33,9 +33,9 @@
 #include "PlainTextController.h"
 
 #include "TestShell.h"
-#include "public/WebBindings.h"
-#include "public/WebRange.h"
-#include "public/WebString.h"
+#include "WebBindings.h"
+#include "WebRange.h"
+#include "WebString.h"
 
 using namespace WebKit;
 
diff --git a/WebKitTools/DumpRenderTree/chromium/Task.cpp b/WebKitTools/DumpRenderTree/chromium/Task.cpp
index 3f90d8c..5719bac 100644
--- a/WebKitTools/DumpRenderTree/chromium/Task.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/Task.cpp
@@ -31,8 +31,8 @@
 #include "config.h"
 #include "Task.h"
 
-#include "public/WebKit.h"
-#include "public/WebKitClient.h"
+#include "WebKit.h"
+#include "WebKitClient.h"
 #include "webkit/support/webkit_support.h"
 
 WebTask::WebTask(TaskList* list): m_taskList(list) { m_taskList->registerTask(this); }
diff --git a/WebKitTools/DumpRenderTree/chromium/TestNavigationController.h b/WebKitTools/DumpRenderTree/chromium/TestNavigationController.h
index d75c3bf..b671489 100644
--- a/WebKitTools/DumpRenderTree/chromium/TestNavigationController.h
+++ b/WebKitTools/DumpRenderTree/chromium/TestNavigationController.h
@@ -31,10 +31,10 @@
 #ifndef TestNavigationController_h
 #define TestNavigationController_h
 
-#include "public/WebDataSource.h"
-#include "public/WebHistoryItem.h"
-#include "public/WebString.h"
-#include "public/WebURL.h"
+#include "WebDataSource.h"
+#include "WebHistoryItem.h"
+#include "WebString.h"
+#include "WebURL.h"
 #include "webkit/support/webkit_support.h"
 #include <string>
 #include <wtf/RefCounted.h>
diff --git a/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h
new file mode 100644
index 0000000..49f72a6
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npapi.h
@@ -0,0 +1 @@
+#include "bindings/npapi.h"
diff --git a/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h
new file mode 100644
index 0000000..61588ca
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npfunctions.h
@@ -0,0 +1,7 @@
+#include "bindings/npfunctions.h"
+
+// Non-standard event types can be passed to HandleEvent.
+// npapi.h that comes with WebKit.framework adds these events.
+#define getFocusEvent       (osEvt + 16)
+#define loseFocusEvent      (osEvt + 17)
+#define adjustCursorEvent   (osEvt + 18)
diff --git a/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h
new file mode 100644
index 0000000..597d4ad
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/ForwardingHeaders/WebKit/npruntime.h
@@ -0,0 +1 @@
+#include "bindings/npruntime.h"
diff --git a/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist
new file mode 100644
index 0000000..663f058
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/chromium/TestNetscapePlugIn/Info.plist
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>WebKitTestNetscapePlugIn</string>
+	<key>CFBundleGetInfoString</key>
+	<string>420+, Copyright 2006-2009 Apple Inc.</string>
+	<key>CFBundleIconFile</key>
+	<string></string>
+	<key>CFBundleIdentifier</key>
+	<string>com.apple.testnetscapeplugin</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundlePackageType</key>
+	<string>BRPL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>1.0</string>
+	<key>CFPlugInDynamicRegisterFunction</key>
+	<string></string>
+	<key>CFPlugInDynamicRegistration</key>
+	<string>NO</string>
+	<key>CFPlugInFactories</key>
+	<dict>
+		<key>00000000-0000-0000-0000-000000000000</key>
+		<string>MyFactoryFunction</string>
+	</dict>
+	<key>CFPlugInTypes</key>
+	<dict>
+		<key>00000000-0000-0000-0000-000000000000</key>
+		<array>
+			<string>00000000-0000-0000-0000-000000000000</string>
+		</array>
+	</dict>
+	<key>CFPlugInUnloadFunction</key>
+	<string></string>
+	<key>WebPluginDescription</key>
+	<string>Simple Netscape plug-in that handles test content for WebKit</string>
+	<key>WebPluginMIMETypes</key>
+	<dict>
+		<key>application/x-webkit-test-netscape</key>
+		<dict>
+			<key>WebPluginExtensions</key>
+			<array>
+				<string>testnetscape</string>
+			</array>
+			<key>WebPluginTypeDescription</key>
+			<string>test netscape content</string>
+		</dict>
+	</dict>
+	<key>WebPluginName</key>
+	<string>WebKit Test PlugIn</string>
+</dict>
+</plist>
diff --git a/WebKitTools/DumpRenderTree/chromium/TestShell.cpp b/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
index 1a99b7d..0b27c78 100644
--- a/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/TestShell.cpp
@@ -34,22 +34,22 @@
 #include "DRTDevToolsAgent.h"
 #include "DRTDevToolsClient.h"
 #include "LayoutTestController.h"
+#include "WebDataSource.h"
+#include "WebDocument.h"
+#include "WebElement.h"
+#include "WebFrame.h"
+#include "WebHistoryItem.h"
+#include "WebKit.h"
+#include "WebRuntimeFeatures.h"
+#include "WebScriptController.h"
+#include "WebSettings.h"
+#include "WebSize.h"
+#include "WebSpeechInputControllerMock.h"
+#include "WebString.h"
+#include "WebURLRequest.h"
+#include "WebURLResponse.h"
+#include "WebView.h"
 #include "WebViewHost.h"
-#include "public/WebDataSource.h"
-#include "public/WebDocument.h"
-#include "public/WebElement.h"
-#include "public/WebFrame.h"
-#include "public/WebHistoryItem.h"
-#include "public/WebKit.h"
-#include "public/WebRuntimeFeatures.h"
-#include "public/WebScriptController.h"
-#include "public/WebSettings.h"
-#include "public/WebSize.h"
-#include "public/WebSpeechInputControllerMock.h"
-#include "public/WebString.h"
-#include "public/WebURLRequest.h"
-#include "public/WebURLResponse.h"
-#include "public/WebView.h"
 #include "skia/ext/bitmap_platform_device.h"
 #include "skia/ext/platform_canvas.h"
 #include "webkit/support/webkit_support.h"
@@ -82,9 +82,10 @@ TestShell::TestShell(bool testShellMode)
     , m_testIsPreparing(false)
     , m_focusedWidget(0)
     , m_testShellMode(testShellMode)
+    , m_devTools(0)
     , m_allowExternalPages(false)
+    , m_acceleratedCompositingEnabled(false)
     , m_accelerated2dCanvasEnabled(false)
-    , m_devTools(0)
 {
     WebRuntimeFeatures::enableGeolocation(true);
     WebRuntimeFeatures::enableIndexedDatabase(true);
@@ -156,6 +157,7 @@ void TestShell::closeDevTools()
 void TestShell::resetWebSettings(WebView& webView)
 {
     m_prefs.reset();
+    m_prefs.acceleratedCompositingEnabled = m_acceleratedCompositingEnabled;
     m_prefs.accelerated2dCanvasEnabled = m_accelerated2dCanvasEnabled;
     m_prefs.applyTo(&webView);
 }
diff --git a/WebKitTools/DumpRenderTree/chromium/TestShell.h b/WebKitTools/DumpRenderTree/chromium/TestShell.h
index 4d022dc..a15d9ec 100644
--- a/WebKitTools/DumpRenderTree/chromium/TestShell.h
+++ b/WebKitTools/DumpRenderTree/chromium/TestShell.h
@@ -123,6 +123,7 @@ public:
     bool allowExternalPages() const { return m_allowExternalPages; }
     void setAllowExternalPages(bool allowExternalPages) { m_allowExternalPages = allowExternalPages; }
 
+    void setAcceleratedCompositingEnabled(bool enabled) { m_acceleratedCompositingEnabled = enabled; }
     void setAccelerated2dCanvasEnabled(bool enabled) { m_accelerated2dCanvasEnabled = enabled; }
 
 #if defined(OS_WIN)
@@ -178,6 +179,7 @@ private:
     TestParams m_params;
     int m_timeout; // timeout value in millisecond
     bool m_allowExternalPages;
+    bool m_acceleratedCompositingEnabled;
     bool m_accelerated2dCanvasEnabled;
     WebPreferences m_prefs;
 
diff --git a/WebKitTools/DumpRenderTree/chromium/TestWebWorker.h b/WebKitTools/DumpRenderTree/chromium/TestWebWorker.h
index 9470804..a29e45f 100644
--- a/WebKitTools/DumpRenderTree/chromium/TestWebWorker.h
+++ b/WebKitTools/DumpRenderTree/chromium/TestWebWorker.h
@@ -31,9 +31,9 @@
 #ifndef TestWebWorker_h
 #define TestWebWorker_h
 
-#include "public/WebMessagePortChannel.h"
-#include "public/WebWorker.h"
-#include "public/WebWorkerClient.h"
+#include "WebMessagePortChannel.h"
+#include "WebWorker.h"
+#include "WebWorkerClient.h"
 #include <wtf/RefCounted.h>
 
 namespace WebKit {
diff --git a/WebKitTools/DumpRenderTree/chromium/TextInputController.cpp b/WebKitTools/DumpRenderTree/chromium/TextInputController.cpp
index 4f06874..7af4e9f 100644
--- a/WebKitTools/DumpRenderTree/chromium/TextInputController.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/TextInputController.cpp
@@ -32,11 +32,11 @@
 #include "TextInputController.h"
 
 #include "TestShell.h"
-#include "public/WebBindings.h"
-#include "public/WebFrame.h"
-#include "public/WebRange.h"
-#include "public/WebString.h"
-#include "public/WebView.h"
+#include "WebBindings.h"
+#include "WebFrame.h"
+#include "WebRange.h"
+#include "WebString.h"
+#include "WebView.h"
 #include <wtf/StringExtras.h>
 #include <string>
 
@@ -58,7 +58,6 @@ TextInputController::TextInputController(TestShell* shell)
     bindMethod("doCommand", &TextInputController::doCommand);
     bindMethod("firstRectForCharacterRange", &TextInputController::firstRectForCharacterRange);
     bindMethod("hasMarkedText", &TextInputController::hasMarkedText);
-    bindMethod("hasSpellingMarker", &TextInputController::hasSpellingMarker);
     bindMethod("insertText", &TextInputController::insertText);
     bindMethod("makeAttributedString", &TextInputController::makeAttributedString);
     bindMethod("markedRange", &TextInputController::markedRange);
@@ -233,14 +232,3 @@ void TextInputController::makeAttributedString(const CppArgumentList&, CppVarian
     // FIXME: Implement this.
     result->setNull();
 }
-
-void TextInputController::hasSpellingMarker(const CppArgumentList& arguments, CppVariant* result)
-{
-    if (arguments.size() < 2 || !arguments[0].isNumber() || !arguments[1].isNumber())
-        return;
-    WebFrame* mainFrame = getMainFrame();
-    if (!mainFrame)
-        return;
-    // Returns as a number for a compatibility reason.
-    result->set(mainFrame->selectionStartHasSpellingMarkerFor(arguments[0].toInt32(), arguments[1].toInt32()) ? 1 : 0);
-}
diff --git a/WebKitTools/DumpRenderTree/chromium/TextInputController.h b/WebKitTools/DumpRenderTree/chromium/TextInputController.h
index ddacefe..9896be5 100644
--- a/WebKitTools/DumpRenderTree/chromium/TextInputController.h
+++ b/WebKitTools/DumpRenderTree/chromium/TextInputController.h
@@ -61,7 +61,6 @@ public:
     void characterIndexForPoint(const CppArgumentList&, CppVariant*);
     void validAttributesForMarkedText(const CppArgumentList&, CppVariant*);
     void makeAttributedString(const CppArgumentList&, CppVariant*);
-    void hasSpellingMarker(const CppArgumentList&, CppVariant*);
 
 private:
     // Returns the test shell's main WebFrame.
diff --git a/WebKitTools/DumpRenderTree/chromium/WebPreferences.cpp b/WebKitTools/DumpRenderTree/chromium/WebPreferences.cpp
index 35247ef..948b448 100644
--- a/WebKitTools/DumpRenderTree/chromium/WebPreferences.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/WebPreferences.cpp
@@ -31,7 +31,7 @@
 #include "config.h"
 #include "WebPreferences.h"
 
-#include "public/WebView.h"
+#include "WebView.h"
 
 using namespace WebKit;
 
@@ -102,6 +102,7 @@ void WebPreferences::reset()
 
     tabsToLinks = false;
     hyperlinkAuditingEnabled = false;
+    acceleratedCompositingEnabled = false;
     accelerated2dCanvasEnabled = false;
 }
 
@@ -159,10 +160,7 @@ void WebPreferences::applyTo(WebView* webView)
     settings->setTextDirectionSubmenuInclusionBehaviorNeverIncluded();
     settings->setUsesEncodingDetector(false);
     settings->setImagesEnabled(true);
-
-    // FIXME: crbug.com/51879
-    settings->setAcceleratedCompositingEnabled(false);
-
+    settings->setAcceleratedCompositingEnabled(acceleratedCompositingEnabled);
     settings->setAccelerated2dCanvasEnabled(accelerated2dCanvasEnabled);
 }
 
diff --git a/WebKitTools/DumpRenderTree/chromium/WebPreferences.h b/WebKitTools/DumpRenderTree/chromium/WebPreferences.h
index c0ea70f..46877c0 100644
--- a/WebKitTools/DumpRenderTree/chromium/WebPreferences.h
+++ b/WebKitTools/DumpRenderTree/chromium/WebPreferences.h
@@ -31,9 +31,9 @@
 #ifndef WebPreferences_h
 #define WebPerferences_h
 
-#include "public/WebSettings.h"
-#include "public/WebString.h"
-#include "public/WebURL.h"
+#include "WebSettings.h"
+#include "WebString.h"
+#include "WebURL.h"
 
 namespace WebKit {
 class WebView;
@@ -77,6 +77,7 @@ struct WebPreferences {
     bool tabsToLinks;
     bool hyperlinkAuditingEnabled;
     bool caretBrowsingEnabled;
+    bool acceleratedCompositingEnabled;
     bool accelerated2dCanvasEnabled;
 
     WebPreferences() { reset(); }
diff --git a/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.cpp b/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.cpp
index ef6c26a..6a8af81 100755
--- a/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.cpp
@@ -31,8 +31,8 @@
 #include "config.h"
 #include "WebThemeEngineDRT.h"
 
+#include "WebRect.h"
 #include "WebThemeControlDRT.h"
-#include "public/WebRect.h"
 #include "third_party/skia/include/core/SkRect.h"
 
 // Although all this code is generic, we include these headers
diff --git a/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.h b/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.h
index c731540..e50886b 100644
--- a/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.h
+++ b/WebKitTools/DumpRenderTree/chromium/WebThemeEngineDRT.h
@@ -47,7 +47,7 @@
 #ifndef WebThemeEngineDRT_h
 #define WebThemeEngineDRT_h
 
-#include "public/WebThemeEngine.h"
+#include "win/WebThemeEngine.h"
 #include <wtf/Noncopyable.h>
 
 class WebThemeEngineDRT : public WebKit::WebThemeEngine, public Noncopyable {
diff --git a/WebKitTools/DumpRenderTree/chromium/WebViewHost.cpp b/WebKitTools/DumpRenderTree/chromium/WebViewHost.cpp
index 9a086e4..ab8dbf0 100644
--- a/WebKitTools/DumpRenderTree/chromium/WebViewHost.cpp
+++ b/WebKitTools/DumpRenderTree/chromium/WebViewHost.cpp
@@ -35,25 +35,25 @@
 #include "TestNavigationController.h"
 #include "TestShell.h"
 #include "TestWebWorker.h"
-#include "public/WebCString.h"
-#include "public/WebConsoleMessage.h"
-#include "public/WebContextMenuData.h"
-#include "public/WebDataSource.h"
-#include "public/WebDragData.h"
-#include "public/WebElement.h"
-#include "public/WebFrame.h"
-#include "public/WebGeolocationServiceMock.h"
-#include "public/WebHistoryItem.h"
-#include "public/WebNode.h"
-#include "public/WebRange.h"
-#include "public/WebRect.h"
-#include "public/WebScreenInfo.h"
-#include "public/WebSize.h"
-#include "public/WebStorageNamespace.h"
-#include "public/WebURLRequest.h"
-#include "public/WebURLResponse.h"
-#include "public/WebView.h"
-#include "public/WebWindowFeatures.h"
+#include "WebCString.h"
+#include "WebConsoleMessage.h"
+#include "WebContextMenuData.h"
+#include "WebDataSource.h"
+#include "WebDragData.h"
+#include "WebElement.h"
+#include "WebFrame.h"
+#include "WebGeolocationServiceMock.h"
+#include "WebHistoryItem.h"
+#include "WebNode.h"
+#include "WebRange.h"
+#include "WebRect.h"
+#include "WebScreenInfo.h"
+#include "WebSize.h"
+#include "WebStorageNamespace.h"
+#include "WebURLRequest.h"
+#include "WebURLResponse.h"
+#include "WebView.h"
+#include "WebWindowFeatures.h"
 #include "skia/ext/platform_canvas.h"
 #include "webkit/support/webkit_support.h"
 #include <wtf/Assertions.h>
@@ -124,7 +124,7 @@ static string descriptionSuitableForTestResult(const string& url)
 // dragging a file.
 static void addDRTFakeFileToDataObject(WebDragData* dragData)
 {
-    dragData->appendToFileNames(WebString::fromUTF8("DRTFakeFile"));
+    dragData->appendToFilenames(WebString::fromUTF8("DRTFakeFile"));
 }
 
 // Get a debugging string from a WebNavigationType.
@@ -485,13 +485,11 @@ int WebViewHost::historyForwardListCount()
     return navigationController()->entryCount() - currentIndex - 1;
 }
 
-void WebViewHost::focusAccessibilityObject(const WebAccessibilityObject& object)
-{
-    m_shell->accessibilityController()->setFocusedElement(object);
-}
-
 void WebViewHost::postAccessibilityNotification(const WebAccessibilityObject& obj, WebAccessibilityNotification notification)
 {
+    if (notification == WebAccessibilityNotificationFocusedUIElementChanged)
+        m_shell->accessibilityController()->setFocusedElement(obj);
+
     if (m_shell->accessibilityController()->shouldDumpAccessibilityNotifications()) {
         printf("AccessibilityNotification - ");
 
@@ -541,6 +539,8 @@ void WebViewHost::postAccessibilityNotification(const WebAccessibilityObject& ob
         case WebAccessibilityNotificationRowExpanded:
             printf("RowExpanded");
             break;
+        default:
+            break;
         }
 
         WebKit::WebNode node = obj.node();
@@ -559,12 +559,14 @@ WebNotificationPresenter* WebViewHost::notificationPresenter()
     return m_shell->notificationPresenter();
 }
 
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
 WebKit::WebGeolocationService* WebViewHost::geolocationService()
 {
     if (!m_geolocationServiceMock.get())
         m_geolocationServiceMock.set(WebGeolocationServiceMock::createWebGeolocationServiceMock());
     return m_geolocationServiceMock.get();
 }
+#endif
 
 WebSpeechInputController* WebViewHost::speechInputController(WebKit::WebSpeechInputListener* listener)
 {
@@ -592,6 +594,13 @@ void WebViewHost::didScrollRect(int, int, const WebRect& clipRect)
     didInvalidateRect(clipRect);
 }
 
+void WebViewHost::scheduleComposite()
+{
+    WebSize widgetSize = webWidget()->size();
+    WebRect clientRect(0, 0, widgetSize.width, widgetSize.height);
+    didInvalidateRect(clientRect);
+}
+
 void WebViewHost::didFocus()
 {
     m_shell->setFocus(webWidget(), true);
@@ -628,6 +637,10 @@ void WebViewHost::closeWidgetSoon()
 {
     m_hasWindow = false;
     m_shell->closeWindow(this);
+    if (m_inModalLoop) {
+      m_inModalLoop = false;
+      webkit_support::QuitMessageLoop();
+    }
 }
 
 void WebViewHost::didChangeCursor(const WebCursorInfo& cursorInfo)
@@ -670,7 +683,11 @@ WebRect WebViewHost::windowResizerRect()
 
 void WebViewHost::runModal()
 {
-    // FIXME: Should we implement this in DRT?
+    bool oldState = webkit_support::MessageLoopNestableTasksAllowed();
+    webkit_support::MessageLoopSetNestableTasksAllowed(true);
+    m_inModalLoop = true;
+    webkit_support::RunMessageLoop();
+    webkit_support::MessageLoopSetNestableTasksAllowed(oldState);
 }
 
 // WebFrameClient ------------------------------------------------------------
@@ -1041,10 +1058,12 @@ WebViewHost::WebViewHost(TestShell* shell)
     , m_policyDelegateIsPermissive(false)
     , m_policyDelegateShouldNotifyDone(false)
     , m_shell(shell)
+    , m_webWidget(0)
     , m_topLoadingFrame(0)
-    , m_hasWindow(false)
     , m_pageId(-1)
     , m_lastPageIdUpdated(-1)
+    , m_hasWindow(false)
+    , m_inModalLoop(false)
     , m_smartInsertDeleteEnabled(true)
 #if OS(WINDOWS)
     , m_selectTrailingWhitespaceEnabled(true)
@@ -1054,7 +1073,6 @@ WebViewHost::WebViewHost(TestShell* shell)
     , m_blocksRedirects(false)
     , m_requestReturnNull(false)
     , m_isPainting(false)
-    , m_webWidget(0)
 {
     m_navigationController.set(new TestNavigationController(this));
 }
diff --git a/WebKitTools/DumpRenderTree/chromium/WebViewHost.h b/WebKitTools/DumpRenderTree/chromium/WebViewHost.h
index bbb132d..429d3ab 100644
--- a/WebKitTools/DumpRenderTree/chromium/WebViewHost.h
+++ b/WebKitTools/DumpRenderTree/chromium/WebViewHost.h
@@ -33,10 +33,10 @@
 
 #include "MockSpellCheck.h"
 #include "TestNavigationController.h"
-#include "public/WebAccessibilityNotification.h"
-#include "public/WebCursorInfo.h"
-#include "public/WebFrameClient.h"
-#include "public/WebViewClient.h"
+#include "WebAccessibilityNotification.h"
+#include "WebCursorInfo.h"
+#include "WebFrameClient.h"
+#include "WebViewClient.h"
 #include <wtf/HashMap.h>
 #include <wtf/HashSet.h>
 #include <wtf/Vector.h>
@@ -127,16 +127,18 @@ class WebViewHost : public WebKit::WebViewClient, public WebKit::WebFrameClient,
     virtual void navigateBackForwardSoon(int offset);
     virtual int historyBackListCount();
     virtual int historyForwardListCount();
-    virtual void focusAccessibilityObject(const WebKit::WebAccessibilityObject&);
     virtual void postAccessibilityNotification(const WebKit::WebAccessibilityObject&, WebKit::WebAccessibilityNotification);
     virtual WebKit::WebNotificationPresenter* notificationPresenter();
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     virtual WebKit::WebGeolocationService* geolocationService();
+#endif
     virtual WebKit::WebSpeechInputController* speechInputController(WebKit::WebSpeechInputListener*);
     virtual WebKit::WebDeviceOrientationClient* deviceOrientationClient();
 
     // WebKit::WebWidgetClient
     virtual void didInvalidateRect(const WebKit::WebRect&);
     virtual void didScrollRect(int dx, int dy, const WebKit::WebRect&);
+    virtual void scheduleComposite();
     virtual void didFocus();
     virtual void didBlur();
     virtual void didChangeCursor(const WebKit::WebCursorInfo&);
@@ -257,6 +259,7 @@ private:
     WebKit::WebCursorInfo m_currentCursor;
 
     bool m_hasWindow;
+    bool m_inModalLoop;
     WebKit::WebRect m_windowRect;
 
     // true if we want to enable smart insert/delete.
@@ -286,8 +289,10 @@ private:
     WebKit::WebRect m_paintRect;
     bool m_isPainting;
 
+#if !ENABLE(CLIENT_BASED_GEOLOCATION)
     // Geolocation
     OwnPtr<WebKit::WebGeolocationServiceMock> m_geolocationServiceMock;
+#endif
 
     OwnPtr<TestNavigationController*> m_navigationController;
 };
diff --git a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
index 521a0e1..e115683 100644
--- a/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/DumpRenderTree.cpp
@@ -131,9 +131,29 @@ static void appendString(gchar*& target, gchar* string)
     g_free(oldString);
 }
 
-static void initializeFonts()
+static void initializeGtkFontSettings(const char* testURL)
+{
+    GtkSettings* settings = gtk_settings_get_default();
+    if (!settings)
+        return;
+    g_object_set(settings, "gtk-xft-antialias", 1, NULL);
+    g_object_set(settings, "gtk-xft-hinting", 1, NULL);
+    g_object_set(settings, "gtk-xft-hintstyle", "hintfull", NULL);
+    g_object_set(settings, "gtk-font-name", "Liberation Sans 16", NULL);
+
+    // One test needs subpixel anti-aliasing turned on, but generally we
+    // want all text in other tests to use to grayscale anti-aliasing.
+    if (testURL && strstr(testURL, "xsettings_antialias_settings.html"))
+        g_object_set(settings, "gtk-xft-rgba", "rgb", NULL);
+    else
+        g_object_set(settings, "gtk-xft-rgba", "none", NULL);
+}
+
+static void initializeFonts(const char* testURL = 0)
 {
 #if PLATFORM(X11)
+    initializeGtkFontSettings(testURL);
+
     FcInit();
 
     // If a test resulted a font being added or removed via the @font-face rule, then
@@ -177,6 +197,8 @@ static void initializeFonts()
           "/usr/share/fonts/liberation/LiberationSerif-Regular.ttf", },
         { "/usr/share/fonts/truetype/ttf-dejavu/DejaVuSans.ttf",
           "/usr/share/fonts/dejavu/DejaVuSans.ttf", },
+        { "/usr/share/fonts/truetype/ttf-dejavu/DejaVuSerif.ttf",
+          "/usr/share/fonts/dejavu/DejaVuSerif.ttf", },
     };
 
     // TODO: Some tests use Lucida. We should load these as well, once it becomes
@@ -363,6 +385,7 @@ static void resetDefaultsToConsistentValues()
                  "enable-html5-local-storage", TRUE,
                  "enable-xss-auditor", FALSE,
                  "enable-spatial-navigation", FALSE,
+                 "enable-frame-flattening", FALSE,
                  "javascript-can-access-clipboard", TRUE,
                  "javascript-can-open-windows-automatically", TRUE,
                  "enable-offline-web-application-cache", TRUE,
@@ -373,6 +396,8 @@ static void resetDefaultsToConsistentValues()
                  "monospace-font-family", "Courier",
                  "serif-font-family", "Times",
                  "sans-serif-font-family", "Helvetica",
+                 "cursive-font-family", "cursive",
+                 "fantasy-font-family", "fantasy",
                  "default-font-size", 16,
                  "default-monospace-font-size", 13,
                  "minimum-font-size", 1,
@@ -394,6 +419,9 @@ static void resetDefaultsToConsistentValues()
 
     webkit_reset_origin_access_white_lists();
 
+    WebKitWebBackForwardList* list = webkit_web_view_get_back_forward_list(webView);
+    webkit_web_back_forward_list_clear(list);
+
 #ifdef HAVE_LIBSOUP_2_29_90
     SoupSession* session = webkit_get_default_session();
     SoupCookieJar* jar = reinterpret_cast<SoupCookieJar*>(soup_session_get_feature(session, SOUP_TYPE_COOKIE_JAR));
@@ -610,7 +638,7 @@ static void runTest(const string& testPathOrURL)
     if (prevTestBFItem)
         g_object_ref(prevTestBFItem);
 
-    initializeFonts();
+    initializeFonts(testURL.c_str());
 
     // Focus the web view before loading the test to avoid focusing problems
     gtk_widget_grab_focus(GTK_WIDGET(webView));
diff --git a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
index d831076..181ef9f 100644
--- a/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/LayoutTestControllerGtk.cpp
@@ -183,8 +183,16 @@ JSRetainPtr<JSStringRef> LayoutTestController::pageSizeAndMarginsInPixels(int pa
 
 size_t LayoutTestController::webHistoryItemCount()
 {
-    // FIXME: implement
-    return 0;
+    WebKitWebView* webView = webkit_web_frame_get_web_view(mainFrame);
+    WebKitWebBackForwardList* list = webkit_web_view_get_back_forward_list(webView);
+
+    if (!list)
+        return -1;
+
+    // We do not add the current page to the total count as it's not
+    // considered in DRT tests
+    return webkit_web_back_forward_list_get_back_length(list) +
+            webkit_web_back_forward_list_get_forward_length(list);
 }
 
 unsigned LayoutTestController::workerThreadCount() const
@@ -423,7 +431,11 @@ void LayoutTestController::setXSSAuditorEnabled(bool flag)
 
 void LayoutTestController::setFrameFlatteningEnabled(bool flag)
 {
-    // FIXME: implement
+    WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
+    ASSERT(view);
+
+    WebKitWebSettings* settings = webkit_web_view_get_settings(view);
+    g_object_set(G_OBJECT(settings), "enable-frame-flattening", flag, NULL);
 }
 
 void LayoutTestController::setSpatialNavigationEnabled(bool flag)
@@ -804,3 +816,9 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
 void LayoutTestController::abortModal()
 {
 }
+
+bool LayoutTestController::hasSpellingMarker(int, int)
+{
+    // FIXME: Implement this.
+    return false;
+}
diff --git a/WebKitTools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp b/WebKitTools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
index f0f461c..4073403 100644
--- a/WebKitTools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
+++ b/WebKitTools/DumpRenderTree/gtk/PixelDumpSupportGtk.cpp
@@ -36,15 +36,24 @@
 PassRefPtr<BitmapContext> createBitmapContextFromWebView(bool, bool, bool, bool)
 {
     WebKitWebView* view = webkit_web_frame_get_web_view(mainFrame);
-    GdkPixmap* pixmap = gtk_widget_get_snapshot(GTK_WIDGET(view), 0);
     gint width, height;
+#ifdef GTK_API_VERSION_2
+    GdkPixmap* pixmap = gtk_widget_get_snapshot(GTK_WIDGET(view), 0);
     gdk_drawable_get_size(GDK_DRAWABLE(pixmap), &width, &height);
+#else
+    width = gtk_widget_get_allocated_width(GTK_WIDGET(view));
+    height = gtk_widget_get_allocated_height(GTK_WIDGET(view));
+#endif
 
     cairo_surface_t* imageSurface = cairo_image_surface_create(CAIRO_FORMAT_ARGB32, width, height);
     cairo_t* context = cairo_create(imageSurface);
+#ifdef GTK_API_VERSION_2
     gdk_cairo_set_source_pixmap(context, pixmap, 0, 0);
     cairo_paint(context);
     g_object_unref(pixmap);
+#else
+    gtk_widget_draw(GTK_WIDGET(view), context);
+#endif
 
     return BitmapContext::createByAdoptingBitmapAndContext(0, context);
 }
diff --git a/WebKitTools/DumpRenderTree/gtk/fonts/fonts.conf b/WebKitTools/DumpRenderTree/gtk/fonts/fonts.conf
index 520f96e..6eb057e 100644
--- a/WebKitTools/DumpRenderTree/gtk/fonts/fonts.conf
+++ b/WebKitTools/DumpRenderTree/gtk/fonts/fonts.conf
@@ -28,6 +28,25 @@
         </edit>
     </match>
 
+    <!-- Until we find good fonts to use for cursive and fantasy
+         just use our serif font. -->
+    <match target="pattern">
+        <test qual="any" name="family">
+            <string>cursive</string>
+        </test>
+        <edit name="family" mode="assign">
+            <string>Liberation Serif</string>
+        </edit>
+    </match>
+    <match target="pattern">
+        <test qual="any" name="family">
+            <string>fantasy</string>
+        </test>
+        <edit name="family" mode="assign">
+            <string>Liberation Serif</string>
+        </edit>
+    </match>
+
     <!-- The sans-serif font should be Liberation Sans -->
     <match target="pattern">
         <test qual="any" name="family">
@@ -55,6 +74,22 @@
         <string>Liberation Sans</string>
       </edit>
     </match>
+    <match target="pattern">
+      <test qual="any" name="family">
+        <string>Arial</string>
+      </test>
+      <edit name="family" mode="assign">
+        <string>Liberation Sans</string>
+      </edit>
+    </match>
+    <match target="pattern">
+      <test qual="any" name="family">
+        <string>Lucida Grande</string>
+      </test>
+      <edit name="family" mode="assign">
+        <string>Liberation Sans</string>
+      </edit>
+    </match>
 
     <!-- The Monospace font should be Liberation Mono -->
     <match target="pattern">
@@ -214,6 +249,54 @@
         </edit>
     </match>
 
+    <!-- We need to enable simulated bold to for DejaVu Serif to ensure that we interpret
+         this property correctly in: platform/gtk/fonts/fontconfig-synthetic-bold.html -->
+    <match target="font">
+        <test qual="any" name="family">
+            <string>DejaVu Serif</string>
+        </test>
+        <test name="weight" compare="less_eq">
+            <const>medium</const>
+        </test>
+        <test target="pattern" name="weight" compare="more">
+            <const>medium</const>
+        </test>
+        <edit name="embolden" mode="assign">
+            <bool>true</bool>
+        </edit>
+        <edit name="weight" mode="assign">
+            <const>bold</const>
+        </edit>
+    </match>
+
+    <!-- We need to enable simulated oblique to for DejaVu Serif to ensure that we interpret
+         this property correctly in: platform/gtk/fonts/fontconfig-synthetic-oblique.html -->
+    <match target="font">
+        <test qual="any" name="family">
+            <string>DejaVu Serif</string>
+        </test>
+        <test name="slant">
+            <const>roman</const>
+        </test>
+        <test target="pattern" name="slant" compare="not_eq">
+            <const>roman</const>
+        </test>
+        <edit name="matrix" mode="assign">
+            <times>
+                <name>matrix</name>
+                <matrix><double>1</double><double>0.2</double>
+                    <double>0</double><double>1</double>
+                </matrix>
+            </times>
+        </edit>
+        <edit name="slant" mode="assign">
+            <const>oblique</const>
+        </edit>
+        <edit name="embeddedbitmap" mode="assign">
+            <bool>false</bool>
+        </edit>
+    </match>
+
     <config>
         <!-- These are the default Unicode chars that are expected to be blank
              in fonts. All other blank chars are assumed to be broken and won't
diff --git a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
index 5f9705a..2ca5755 100644
--- a/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/AccessibilityUIElementMac.mm
@@ -780,6 +780,17 @@ int AccessibilityUIElement::hierarchicalLevel() const
     return 0;
 }
 
+JSStringRef AccessibilityUIElement::speak()
+{
+    BEGIN_AX_OBJC_EXCEPTIONS
+    id value = [m_element accessibilityAttributeValue:@"AXDRTSpeechAttribute"];
+    if ([value isKindOfClass:[NSString class]])
+        return [value createJSStringRef];
+    END_AX_OBJC_EXCEPTIONS
+        
+    return 0;
+}
+
 bool AccessibilityUIElement::ariaIsGrabbed() const
 {
     BEGIN_AX_OBJC_EXCEPTIONS
@@ -824,6 +835,18 @@ int AccessibilityUIElement::lineForIndex(int index)
     return -1;
 }
 
+JSStringRef AccessibilityUIElement::rangeForLine(int line)
+{
+    BEGIN_AX_OBJC_EXCEPTIONS
+    id value = [m_element accessibilityAttributeValue:NSAccessibilityRangeForLineParameterizedAttribute forParameter:[NSNumber numberWithInt:line]];
+    if ([value isKindOfClass:[NSValue class]]) {
+        return [NSStringFromRange([value rangeValue]) createJSStringRef];
+    }
+    END_AX_OBJC_EXCEPTIONS
+    
+    return 0;
+}
+
 JSStringRef AccessibilityUIElement::boundsForRange(unsigned location, unsigned length)
 {
     NSRange range = NSMakeRange(location, length);
diff --git a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
index 3732247..68765f6 100644
--- a/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
+++ b/WebKitTools/DumpRenderTree/mac/DumpRenderTree.mm
@@ -49,6 +49,7 @@
 #import "PolicyDelegate.h"
 #import "ResourceLoadDelegate.h"
 #import "UIDelegate.h"
+#import "WebArchiveDumpSupport.h"
 #import "WorkQueue.h"
 #import "WorkQueueItem.h"
 #import <Carbon/Carbon.h>
@@ -56,6 +57,7 @@
 #import <WebKit/DOMElement.h>
 #import <WebKit/DOMExtensions.h>
 #import <WebKit/DOMRange.h>
+#import <WebKit/WebArchive.h>
 #import <WebKit/WebBackForwardList.h>
 #import <WebKit/WebCache.h>
 #import <WebKit/WebCoreStatistics.h>
@@ -65,7 +67,6 @@
 #import <WebKit/WebDeviceOrientationProviderMock.h>
 #import <WebKit/WebEditingDelegate.h>
 #import <WebKit/WebFrameView.h>
-#import <WebKit/WebHTMLRepresentationInternal.h>
 #import <WebKit/WebHistory.h>
 #import <WebKit/WebHistoryItemPrivate.h>
 #import <WebKit/WebInspector.h>
@@ -822,176 +823,6 @@ static NSData *dumpFrameAsPDF(WebFrame *frame)
     return pdfData;
 }
 
-static void convertMIMEType(NSMutableString *mimeType)
-{
-#ifdef BUILDING_ON_LEOPARD
-    // Workaround for <rdar://problem/5539824> on Leopard
-    if ([mimeType isEqualToString:@"text/xml"])
-        [mimeType setString:@"application/xml"];
-#endif
-    // Workaround for <rdar://problem/6234318> with Dashcode 2.0
-    if ([mimeType isEqualToString:@"application/x-javascript"])
-        [mimeType setString:@"text/javascript"];
-}
-
-static void convertWebResourceDataToString(NSMutableDictionary *resource)
-{
-    NSMutableString *mimeType = [resource objectForKey:@"WebResourceMIMEType"];
-    convertMIMEType(mimeType);
-
-    if ([mimeType hasPrefix:@"text/"] || [[WebHTMLRepresentation supportedNonImageMIMETypes] containsObject:mimeType]) {
-        NSString *textEncodingName = [resource objectForKey:@"WebResourceTextEncodingName"];
-        NSStringEncoding stringEncoding;
-        if ([textEncodingName length] > 0)
-            stringEncoding = CFStringConvertEncodingToNSStringEncoding(CFStringConvertIANACharSetNameToEncoding((CFStringRef)textEncodingName));
-        else
-            stringEncoding = NSUTF8StringEncoding;
-
-        NSData *data = [resource objectForKey:@"WebResourceData"];
-        NSString *dataAsString = [[NSString alloc] initWithData:data encoding:stringEncoding];
-        if (dataAsString)
-            [resource setObject:dataAsString forKey:@"WebResourceData"];
-        [dataAsString release];
-    }
-}
-
-static void normalizeHTTPResponseHeaderFields(NSMutableDictionary *fields)
-{
-    // Normalize headers
-    if ([fields objectForKey:@"Date"])
-        [fields setObject:@"Sun, 16 Nov 2008 17:00:00 GMT" forKey:@"Date"];
-    if ([fields objectForKey:@"Last-Modified"])
-        [fields setObject:@"Sun, 16 Nov 2008 16:55:00 GMT" forKey:@"Last-Modified"];
-    if ([fields objectForKey:@"Etag"])
-        [fields setObject:@"\"301925-21-45c7d72d3e780\"" forKey:@"Etag"];
-    if ([fields objectForKey:@"Server"])
-        [fields setObject:@"Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7l PHP/5.2.6" forKey:@"Server"];
-
-    // Remove headers
-    if ([fields objectForKey:@"Connection"])
-        [fields removeObjectForKey:@"Connection"];
-    if ([fields objectForKey:@"Keep-Alive"])
-        [fields removeObjectForKey:@"Keep-Alive"];
-}
-
-static void normalizeWebResourceURL(NSMutableString *webResourceURL)
-{
-    static int fileUrlLength = [(NSString *)@"file://" length];
-    NSRange layoutTestsWebArchivePathRange = [webResourceURL rangeOfString:@"/LayoutTests/" options:NSBackwardsSearch];
-    if (layoutTestsWebArchivePathRange.location == NSNotFound)
-        return;
-    NSRange currentWorkingDirectoryRange = NSMakeRange(fileUrlLength, layoutTestsWebArchivePathRange.location - fileUrlLength);
-    [webResourceURL replaceCharactersInRange:currentWorkingDirectoryRange withString:@""];
-}
-
-static void convertWebResourceResponseToDictionary(NSMutableDictionary *propertyList)
-{
-    NSURLResponse *response = nil;
-    NSData *responseData = [propertyList objectForKey:@"WebResourceResponse"]; // WebResourceResponseKey in WebResource.m
-    if ([responseData isKindOfClass:[NSData class]]) {
-        // Decode NSURLResponse
-        NSKeyedUnarchiver *unarchiver = [[NSKeyedUnarchiver alloc] initForReadingWithData:responseData];
-        response = [unarchiver decodeObjectForKey:@"WebResourceResponse"]; // WebResourceResponseKey in WebResource.m
-        [unarchiver finishDecoding];
-        [unarchiver release];
-    }        
-
-    NSMutableDictionary *responseDictionary = [[NSMutableDictionary alloc] init];
-
-    NSMutableString *urlString = [[[response URL] description] mutableCopy];
-    normalizeWebResourceURL(urlString);
-    [responseDictionary setObject:urlString forKey:@"URL"];
-    [urlString release];
-
-    NSMutableString *mimeTypeString = [[response MIMEType] mutableCopy];
-    convertMIMEType(mimeTypeString);
-    [responseDictionary setObject:mimeTypeString forKey:@"MIMEType"];
-    [mimeTypeString release];
-
-    NSString *textEncodingName = [response textEncodingName];
-    if (textEncodingName)
-        [responseDictionary setObject:textEncodingName forKey:@"textEncodingName"];
-    [responseDictionary setObject:[NSNumber numberWithLongLong:[response expectedContentLength]] forKey:@"expectedContentLength"];
-
-    if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
-        NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
-
-        NSMutableDictionary *allHeaderFields = [[httpResponse allHeaderFields] mutableCopy];
-        normalizeHTTPResponseHeaderFields(allHeaderFields);
-        [responseDictionary setObject:allHeaderFields forKey:@"allHeaderFields"];
-        [allHeaderFields release];
-
-        [responseDictionary setObject:[NSNumber numberWithInt:[httpResponse statusCode]] forKey:@"statusCode"];
-    }
-
-    [propertyList setObject:responseDictionary forKey:@"WebResourceResponse"];
-    [responseDictionary release];
-}
-
-static NSInteger compareResourceURLs(id resource1, id resource2, void *context)
-{
-    NSString *url1 = [resource1 objectForKey:@"WebResourceURL"];
-    NSString *url2 = [resource2 objectForKey:@"WebResourceURL"];
- 
-    return [url1 compare:url2];
-}
-
-static NSString *serializeWebArchiveToXML(WebArchive *webArchive)
-{
-    NSString *errorString;
-    NSMutableDictionary *propertyList = [NSPropertyListSerialization propertyListFromData:[webArchive data]
-                                                                         mutabilityOption:NSPropertyListMutableContainersAndLeaves
-                                                                                   format:NULL
-                                                                         errorDescription:&errorString];
-    if (!propertyList)
-        return errorString;
-
-    NSMutableArray *resources = [NSMutableArray arrayWithCapacity:1];
-    [resources addObject:propertyList];
-
-    while ([resources count]) {
-        NSMutableDictionary *resourcePropertyList = [resources objectAtIndex:0];
-        [resources removeObjectAtIndex:0];
-
-        NSMutableDictionary *mainResource = [resourcePropertyList objectForKey:@"WebMainResource"];
-        normalizeWebResourceURL([mainResource objectForKey:@"WebResourceURL"]);
-        convertWebResourceDataToString(mainResource);
-
-        // Add subframeArchives to list for processing
-        NSMutableArray *subframeArchives = [resourcePropertyList objectForKey:@"WebSubframeArchives"]; // WebSubframeArchivesKey in WebArchive.m
-        if (subframeArchives)
-            [resources addObjectsFromArray:subframeArchives];
-
-        NSMutableArray *subresources = [resourcePropertyList objectForKey:@"WebSubresources"]; // WebSubresourcesKey in WebArchive.m
-        NSEnumerator *enumerator = [subresources objectEnumerator];
-        NSMutableDictionary *subresourcePropertyList;
-        while ((subresourcePropertyList = [enumerator nextObject])) {
-            normalizeWebResourceURL([subresourcePropertyList objectForKey:@"WebResourceURL"]);
-            convertWebResourceResponseToDictionary(subresourcePropertyList);
-            convertWebResourceDataToString(subresourcePropertyList);
-        }
-        
-        // Sort the subresources so they're always in a predictable order for the dump
-        if (NSArray *sortedSubresources = [subresources sortedArrayUsingFunction:compareResourceURLs context:nil])
-            [resourcePropertyList setObject:sortedSubresources forKey:@"WebSubresources"];
-    }
-
-    NSData *xmlData = [NSPropertyListSerialization dataFromPropertyList:propertyList
-                                                                 format:NSPropertyListXMLFormat_v1_0
-                                                       errorDescription:&errorString];
-    if (!xmlData)
-        return errorString;
-
-    NSMutableString *string = [[[NSMutableString alloc] initWithData:xmlData encoding:NSUTF8StringEncoding] autorelease];
-
-    // Replace "Apple Computer" with "Apple" in the DTD declaration.
-    NSRange range = [string rangeOfString:@"-//Apple Computer//"];
-    if (range.location != NSNotFound)
-        [string replaceCharactersInRange:range withString:@"-//Apple//"];
-    
-    return string;
-}
-
 static void dumpBackForwardListForWebView(WebView *view)
 {
     printf("\n============== Back Forward List ==============\n");
diff --git a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
index d2a6f79..c5d5a90 100644
--- a/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
+++ b/WebKitTools/DumpRenderTree/mac/LayoutTestControllerMac.mm
@@ -422,7 +422,7 @@ void LayoutTestController::setFrameFlatteningEnabled(bool enabled)
 
 void LayoutTestController::setSpatialNavigationEnabled(bool enabled)
 {
-    // FIXME: Implement for SpatialNavigation layout tests.
+    [[[mainFrame webView] preferences] setSpatialNavigationEnabled:enabled];
 }
 
 void LayoutTestController::setAllowUniversalAccessFromFileURLs(bool enabled)
@@ -944,3 +944,8 @@ void LayoutTestController::abortModal()
 {
     [NSApp abortModal];
 }
+
+bool LayoutTestController::hasSpellingMarker(int from, int length)
+{
+    return [mainFrame hasSpellingMarker:from length:length];
+}
diff --git a/WebKitTools/DumpRenderTree/mac/TextInputController.m b/WebKitTools/DumpRenderTree/mac/TextInputController.m
index a049ac5..f780794 100644
--- a/WebKitTools/DumpRenderTree/mac/TextInputController.m
+++ b/WebKitTools/DumpRenderTree/mac/TextInputController.m
@@ -170,8 +170,7 @@
             || aSelector == @selector(characterIndexForPointX:Y:)
             || aSelector == @selector(validAttributesForMarkedText)
             || aSelector == @selector(attributedStringWithString:)
-            || aSelector == @selector(setInputMethodHandler:)
-            || aSelector == @selector(hasSpellingMarker:length:))
+            || aSelector == @selector(setInputMethodHandler:))
         return NO;
     return YES;
 }
@@ -196,8 +195,6 @@
         return @"makeAttributedString"; // just a factory method, doesn't call into NSTextInput
     else if (aSelector == @selector(setInputMethodHandler:))
         return @"setInputMethodHandler"; 
-    else if (aSelector == @selector(hasSpellingMarker:length:))
-        return @"hasSpellingMarker";
 
     return nil;
 }
@@ -431,9 +428,4 @@
     return YES;
 }
 
-- (BOOL)hasSpellingMarker:(int)from length:(int)length
-{
-    return [[webView mainFrame] hasSpellingMarker:from length:length];
-}
-
 @end
diff --git a/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.h b/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.h
new file mode 100644
index 0000000..8654dd5
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.h
@@ -0,0 +1,34 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WebArchiveDumpSupport_h
+#define WebArchiveDumpSupport_h
+
+@class NSString;
+@class WebArchive;
+
+NSString *serializeWebArchiveToXML(WebArchive *webArchive);
+
+#endif /* WebArchiveDumpSupport_h */
diff --git a/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.mm b/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.mm
new file mode 100644
index 0000000..7c52c6a
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/mac/WebArchiveDumpSupport.mm
@@ -0,0 +1,200 @@
+/*
+ * Copyright (C) 2007, 2008, 2009, 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer. 
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution. 
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "WebArchiveDumpSupport.h"
+
+#import <Foundation/Foundation.h>
+#import <WebKit/WebArchive.h>
+#import <WebKit/WebHTMLRepresentationInternal.h>
+
+static void convertMIMEType(NSMutableString *mimeType)
+{
+#ifdef BUILDING_ON_LEOPARD
+    // Workaround for <rdar://problem/5539824> on Leopard
+    if ([mimeType isEqualToString:@"text/xml"])
+        [mimeType setString:@"application/xml"];
+#endif
+    // Workaround for <rdar://problem/6234318> with Dashcode 2.0
+    if ([mimeType isEqualToString:@"application/x-javascript"])
+        [mimeType setString:@"text/javascript"];
+}
+
+static void convertWebResourceDataToString(NSMutableDictionary *resource)
+{
+    NSMutableString *mimeType = [resource objectForKey:@"WebResourceMIMEType"];
+    convertMIMEType(mimeType);
+
+    if ([mimeType hasPrefix:@"text/"] || [[WebHTMLRepresentation supportedNonImageMIMETypes] containsObject:mimeType]) {
+        NSString *textEncodingName = [resource objectForKey:@"WebResourceTextEncodingName"];
+        NSStringEncoding stringEncoding;
+        if ([textEncodingName length] > 0)
+            stringEncoding = CFStringConvertEncodingToNSStringEncoding(CFStringConvertIANACharSetNameToEncoding((CFStringRef)textEncodingName));
+        else
+            stringEncoding = NSUTF8StringEncoding;
+
+        NSData *data = [resource objectForKey:@"WebResourceData"];
+        NSString *dataAsString = [[NSString alloc] initWithData:data encoding:stringEncoding];
+        if (dataAsString)
+            [resource setObject:dataAsString forKey:@"WebResourceData"];
+        [dataAsString release];
+    }
+}
+
+static void normalizeHTTPResponseHeaderFields(NSMutableDictionary *fields)
+{
+    // Normalize headers
+    if ([fields objectForKey:@"Date"])
+        [fields setObject:@"Sun, 16 Nov 2008 17:00:00 GMT" forKey:@"Date"];
+    if ([fields objectForKey:@"Last-Modified"])
+        [fields setObject:@"Sun, 16 Nov 2008 16:55:00 GMT" forKey:@"Last-Modified"];
+    if ([fields objectForKey:@"Etag"])
+        [fields setObject:@"\"301925-21-45c7d72d3e780\"" forKey:@"Etag"];
+    if ([fields objectForKey:@"Server"])
+        [fields setObject:@"Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7l PHP/5.2.6" forKey:@"Server"];
+
+    // Remove headers
+    if ([fields objectForKey:@"Connection"])
+        [fields removeObjectForKey:@"Connection"];
+    if ([fields objectForKey:@"Keep-Alive"])
+        [fields removeObjectForKey:@"Keep-Alive"];
+}
+
+static void normalizeWebResourceURL(NSMutableString *webResourceURL)
+{
+    static int fileUrlLength = [(NSString *)@"file://" length];
+    NSRange layoutTestsWebArchivePathRange = [webResourceURL rangeOfString:@"/LayoutTests/" options:NSBackwardsSearch];
+    if (layoutTestsWebArchivePathRange.location == NSNotFound)
+        return;
+    NSRange currentWorkingDirectoryRange = NSMakeRange(fileUrlLength, layoutTestsWebArchivePathRange.location - fileUrlLength);
+    [webResourceURL replaceCharactersInRange:currentWorkingDirectoryRange withString:@""];
+}
+
+static void convertWebResourceResponseToDictionary(NSMutableDictionary *propertyList)
+{
+    NSURLResponse *response = nil;
+    NSData *responseData = [propertyList objectForKey:@"WebResourceResponse"]; // WebResourceResponseKey in WebResource.m
+    if ([responseData isKindOfClass:[NSData class]]) {
+        // Decode NSURLResponse
+        NSKeyedUnarchiver *unarchiver = [[NSKeyedUnarchiver alloc] initForReadingWithData:responseData];
+        response = [unarchiver decodeObjectForKey:@"WebResourceResponse"]; // WebResourceResponseKey in WebResource.m
+        [unarchiver finishDecoding];
+        [unarchiver release];
+    }        
+
+    NSMutableDictionary *responseDictionary = [[NSMutableDictionary alloc] init];
+
+    NSMutableString *urlString = [[[response URL] description] mutableCopy];
+    normalizeWebResourceURL(urlString);
+    [responseDictionary setObject:urlString forKey:@"URL"];
+    [urlString release];
+
+    NSMutableString *mimeTypeString = [[response MIMEType] mutableCopy];
+    convertMIMEType(mimeTypeString);
+    [responseDictionary setObject:mimeTypeString forKey:@"MIMEType"];
+    [mimeTypeString release];
+
+    NSString *textEncodingName = [response textEncodingName];
+    if (textEncodingName)
+        [responseDictionary setObject:textEncodingName forKey:@"textEncodingName"];
+    [responseDictionary setObject:[NSNumber numberWithLongLong:[response expectedContentLength]] forKey:@"expectedContentLength"];
+
+    if ([response isKindOfClass:[NSHTTPURLResponse class]]) {
+        NSHTTPURLResponse *httpResponse = (NSHTTPURLResponse *)response;
+
+        NSMutableDictionary *allHeaderFields = [[httpResponse allHeaderFields] mutableCopy];
+        normalizeHTTPResponseHeaderFields(allHeaderFields);
+        [responseDictionary setObject:allHeaderFields forKey:@"allHeaderFields"];
+        [allHeaderFields release];
+
+        [responseDictionary setObject:[NSNumber numberWithInt:[httpResponse statusCode]] forKey:@"statusCode"];
+    }
+
+    [propertyList setObject:responseDictionary forKey:@"WebResourceResponse"];
+    [responseDictionary release];
+}
+
+static NSInteger compareResourceURLs(id resource1, id resource2, void *context)
+{
+    NSString *url1 = [resource1 objectForKey:@"WebResourceURL"];
+    NSString *url2 = [resource2 objectForKey:@"WebResourceURL"];
+ 
+    return [url1 compare:url2];
+}
+
+NSString *serializeWebArchiveToXML(WebArchive *webArchive)
+{
+    NSString *errorString;
+    NSMutableDictionary *propertyList = [NSPropertyListSerialization propertyListFromData:[webArchive data]
+                                                                         mutabilityOption:NSPropertyListMutableContainersAndLeaves
+                                                                                   format:NULL
+                                                                         errorDescription:&errorString];
+    if (!propertyList)
+        return errorString;
+
+    NSMutableArray *resources = [NSMutableArray arrayWithCapacity:1];
+    [resources addObject:propertyList];
+
+    while ([resources count]) {
+        NSMutableDictionary *resourcePropertyList = [resources objectAtIndex:0];
+        [resources removeObjectAtIndex:0];
+
+        NSMutableDictionary *mainResource = [resourcePropertyList objectForKey:@"WebMainResource"];
+        normalizeWebResourceURL([mainResource objectForKey:@"WebResourceURL"]);
+        convertWebResourceDataToString(mainResource);
+
+        // Add subframeArchives to list for processing
+        NSMutableArray *subframeArchives = [resourcePropertyList objectForKey:@"WebSubframeArchives"]; // WebSubframeArchivesKey in WebArchive.m
+        if (subframeArchives)
+            [resources addObjectsFromArray:subframeArchives];
+
+        NSMutableArray *subresources = [resourcePropertyList objectForKey:@"WebSubresources"]; // WebSubresourcesKey in WebArchive.m
+        NSEnumerator *enumerator = [subresources objectEnumerator];
+        NSMutableDictionary *subresourcePropertyList;
+        while ((subresourcePropertyList = [enumerator nextObject])) {
+            normalizeWebResourceURL([subresourcePropertyList objectForKey:@"WebResourceURL"]);
+            convertWebResourceResponseToDictionary(subresourcePropertyList);
+            convertWebResourceDataToString(subresourcePropertyList);
+        }
+        
+        // Sort the subresources so they're always in a predictable order for the dump
+        if (NSArray *sortedSubresources = [subresources sortedArrayUsingFunction:compareResourceURLs context:nil])
+            [resourcePropertyList setObject:sortedSubresources forKey:@"WebSubresources"];
+    }
+
+    NSData *xmlData = [NSPropertyListSerialization dataFromPropertyList:propertyList
+                                                                 format:NSPropertyListXMLFormat_v1_0
+                                                       errorDescription:&errorString];
+    if (!xmlData)
+        return errorString;
+
+    NSMutableString *string = [[[NSMutableString alloc] initWithData:xmlData encoding:NSUTF8StringEncoding] autorelease];
+
+    // Replace "Apple Computer" with "Apple" in the DTD declaration.
+    NSRange range = [string rangeOfString:@"-//Apple Computer//"];
+    if (range.location != NSNotFound)
+        [string replaceCharactersInRange:range withString:@"-//Apple//"];
+    
+    return string;
+}
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
index 801251d..54d5af7 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTree.pro
@@ -27,12 +27,14 @@ HEADERS = $$BASEDIR/WorkQueue.h \
     WorkQueueItemQt.h \
     LayoutTestControllerQt.h \
     GCControllerQt.h \
+    PlainTextControllerQt.h \
     testplugin.h
 SOURCES = ../../../JavaScriptCore/wtf/Assertions.cpp \
     $$BASEDIR/WorkQueue.cpp \
     DumpRenderTreeQt.cpp \
     EventSenderQt.cpp \
     TextInputControllerQt.cpp \
+    PlainTextControllerQt.cpp \
     WorkQueueItemQt.cpp \
     LayoutTestControllerQt.cpp \
     GCControllerQt.cpp \
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
index 80fa441..50ae605 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.cpp
@@ -37,6 +37,7 @@
 #include "GCControllerQt.h"
 #include "LayoutTestControllerQt.h"
 #include "TextInputControllerQt.h"
+#include "PlainTextControllerQt.h"
 #include "testplugin.h"
 #include "WorkQueue.h"
 
@@ -450,6 +451,9 @@ DumpRenderTree::DumpRenderTree()
         view->setPage(m_page);
         m_mainView = view;
     }
+    // Use a frame group name for all pages created by DumpRenderTree to allow
+    // testing of cross-page frame lookup.
+    DumpRenderTreeSupportQt::webPageSetGroupName(m_page, "org.webkit.qt.DumpRenderTree");
 
     m_mainView->setContextMenuPolicy(Qt::NoContextMenu);
     m_mainView->resize(QSize(LayoutTestController::maxViewWidth, LayoutTestController::maxViewHeight));
@@ -470,6 +474,7 @@ DumpRenderTree::DumpRenderTree()
     connect(m_controller, SIGNAL(done()), this, SLOT(dump()));
     m_eventSender = new EventSender(m_page);
     m_textInputController = new TextInputController(m_page);
+    m_plainTextController = new PlainTextController(m_page);
     m_gcController = new GCController(m_page);
 
     // now connect our different signals
@@ -752,6 +757,7 @@ void DumpRenderTree::initJSObjects()
     frame->addToJavaScriptWindowObject(QLatin1String("eventSender"), m_eventSender);
     frame->addToJavaScriptWindowObject(QLatin1String("textInputController"), m_textInputController);
     frame->addToJavaScriptWindowObject(QLatin1String("GCController"), m_gcController);
+    frame->addToJavaScriptWindowObject(QLatin1String("plainText"), m_plainTextController);
 }
 
 void DumpRenderTree::showPage()
@@ -827,7 +833,7 @@ static QString dumpHistoryItem(const QWebHistoryItem& item, int indent, bool cur
     for (int i = start; i < indent; i++)
         result.append(' ');
 
-    QString url = item.url().toString();
+    QString url = item.url().toEncoded();
     if (url.contains("file://")) {
         static QString layoutTestsString("/LayoutTests/");
         static QString fileTestString("(file test):");
@@ -1059,6 +1065,11 @@ QWebPage *DumpRenderTree::createWindow()
     connectFrame(page->mainFrame());
     connect(page, SIGNAL(loadFinished(bool)), m_controller, SLOT(maybeDump(bool)));
     connect(page, SIGNAL(windowCloseRequested()), this, SLOT(windowCloseRequested()));
+
+    // Use a frame group name for all pages created by DumpRenderTree to allow
+    // testing of cross-page frame lookup.
+    DumpRenderTreeSupportQt::webPageSetGroupName(page, "org.webkit.qt.DumpRenderTree");
+
     return page;
 }
 
@@ -1067,6 +1078,9 @@ void DumpRenderTree::windowCloseRequested()
     QWebPage* page = qobject_cast<QWebPage*>(sender());
     QObject* container = page->parent();
     windows.removeAll(container);
+    // Our use of container->deleteLater() means we need to remove closed pages
+    // from the org.webkit.qt.DumpRenderTree group explicitly.
+    DumpRenderTreeSupportQt::webPageSetGroupName(page, "");
     container->deleteLater();
 }
 
diff --git a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
index 3d34443..b3e4e32 100644
--- a/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
+++ b/WebKitTools/DumpRenderTree/qt/DumpRenderTreeQt.h
@@ -60,6 +60,7 @@ class DumpRenderTreeSupportQt;
 class EventSender;
 class TextInputController;
 class GCController;
+class PlainTextController;
 
 namespace WebCore {
 
@@ -148,6 +149,7 @@ private:
     EventSender *m_eventSender;
     TextInputController *m_textInputController;
     GCController* m_gcController;
+    PlainTextController* m_plainTextController;
     NetworkAccessManager* m_networkAccessManager;
 
     QFile *m_stdin;
diff --git a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
index fd7c925..6fb75a5 100644
--- a/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/EventSenderQt.cpp
@@ -254,9 +254,18 @@ void EventSender::keyDown(const QString& string, const QStringList& modifiers, u
                 modifs = Qt::ControlModifier;
             s = QString();
         } else if (code == 'o' && modifs == Qt::ControlModifier) {
+            // Mimic the emacs ctrl-o binding on Mac by inserting a paragraph
+            // separator and then putting the cursor back to its original
+            // position. Allows us to pass emacs-ctrl-o.html
             s = QLatin1String("\n");
             code = '\n';
             modifs = 0;
+            QKeyEvent event(QEvent::KeyPress, code, modifs, s);
+            sendEvent(m_page, &event);
+            QKeyEvent event2(QEvent::KeyRelease, code, modifs, s);
+            sendEvent(m_page, &event2);
+            s = QString();
+            code = Qt::Key_Left;
         } else if (code == 'y' && modifs == Qt::ControlModifier) {
             s = QLatin1String("c");
             code = 'c';
diff --git a/WebKitTools/DumpRenderTree/qt/GCControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/GCControllerQt.cpp
index ba7e2c3..3aa507f 100644
--- a/WebKitTools/DumpRenderTree/qt/GCControllerQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/GCControllerQt.cpp
@@ -48,7 +48,7 @@ void GCController::collectOnAlternateThread(bool waitUntilDone) const
     DumpRenderTreeSupportQt::garbageCollectorCollectOnAlternateThread(waitUntilDone);
 }
 
-size_t GCController::getJSObjectCount() const
+unsigned int GCController::getJSObjectCount() const
 {
     return DumpRenderTreeSupportQt::javaScriptObjectsCount();
 }
diff --git a/WebKitTools/DumpRenderTree/qt/GCControllerQt.h b/WebKitTools/DumpRenderTree/qt/GCControllerQt.h
index ed2a858..d3c83b9 100644
--- a/WebKitTools/DumpRenderTree/qt/GCControllerQt.h
+++ b/WebKitTools/DumpRenderTree/qt/GCControllerQt.h
@@ -43,7 +43,7 @@ public:
 public slots:
     void collect() const;
     void collectOnAlternateThread(bool waitUntilDone) const;
-    size_t getJSObjectCount() const;
+    unsigned int getJSObjectCount() const;
 
 };
 
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
index 90a04c4..d36a074 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.cpp
@@ -284,13 +284,15 @@ void LayoutTestController::setDeferMainResourceDataLoad(bool defer)
 void LayoutTestController::queueBackNavigation(int howFarBackward)
 {
     //qDebug() << ">>>queueBackNavigation" << howFarBackward;
-    WorkQueue::shared()->queue(new BackItem(howFarBackward, m_drt->webPage()));
+    for (int i = 0; i != howFarBackward; ++i)
+        WorkQueue::shared()->queue(new BackItem(1, m_drt->webPage()));
 }
 
 void LayoutTestController::queueForwardNavigation(int howFarForward)
 {
     //qDebug() << ">>>queueForwardNavigation" << howFarForward;
-    WorkQueue::shared()->queue(new ForwardItem(howFarForward, m_drt->webPage()));
+    for (int i = 0; i != howFarForward; ++i)
+        WorkQueue::shared()->queue(new ForwardItem(1, m_drt->webPage()));
 }
 
 void LayoutTestController::queueLoad(const QString& url, const QString& target)
@@ -796,5 +798,11 @@ void LayoutTestController::removeAllVisitedLinks()
     DumpRenderTreeSupportQt::dumpVisitedLinksCallbacks(true);
 }
 
+bool LayoutTestController::hasSpellingMarker(int, int)
+{
+    // FIXME: Implement.
+    return false;
+}
+
 const unsigned LayoutTestController::maxViewWidth = 800;
 const unsigned LayoutTestController::maxViewHeight = 600;
diff --git a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
index ec89acb..3684946 100644
--- a/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
+++ b/WebKitTools/DumpRenderTree/qt/LayoutTestControllerQt.h
@@ -219,6 +219,7 @@ public slots:
 
     // Empty stub method to keep parity with object model exposed by global LayoutTestController.
     void abortModal() {}
+    bool hasSpellingMarker(int from, int length);
 
     /*
         Policy values: 'on', 'auto' or 'off'.
diff --git a/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.cpp b/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.cpp
new file mode 100644
index 0000000..441a37c
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.cpp
@@ -0,0 +1,44 @@
+/*
+ * Copyright (C) 2010 Robert Hogan <robert@roberthogan.net>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#include "config.h"
+#include "PlainTextControllerQt.h"
+
+#include "../../../WebKit/qt/WebCoreSupport/DumpRenderTreeSupportQt.h"
+#include <QApplication>
+#include <QInputMethodEvent>
+#include <QKeyEvent>
+
+PlainTextController::PlainTextController(QWebPage* parent)
+    : QObject(parent)
+{
+}
+
+QString PlainTextController::plainText(const QVariant& range)
+{
+    return DumpRenderTreeSupportQt::plainText(range);
+}
diff --git a/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.h b/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.h
new file mode 100644
index 0000000..e78e110
--- /dev/null
+++ b/WebKitTools/DumpRenderTree/qt/PlainTextControllerQt.h
@@ -0,0 +1,47 @@
+/*
+ * Copyright (C) 2010 Robert Hogan <robert@roberthogan.net>
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+#ifndef PlainTextControllerQt_h
+#define PlainTextControllerQt_h
+
+#include <QList>
+#include <QObject>
+#include <QString>
+#include <QVariant>
+
+#include "qwebpage.h"
+
+class PlainTextController : public QObject {
+    Q_OBJECT
+public:
+    PlainTextController(QWebPage* parent);
+
+public slots:
+    QString plainText(const QVariant& range);
+};
+
+#endif // PlainTextControllerQt_h
diff --git a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
index e48b035..740ebb8 100644
--- a/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
+++ b/WebKitTools/DumpRenderTree/qt/TestNetscapePlugin/TestNetscapePlugin.pro
@@ -31,6 +31,7 @@ SOURCES = PluginObject.cpp \
           Tests/DocumentOpenInDestroyStream.cpp \
           Tests/NPRuntimeObjectFromDestroyedPlugin.cpp \
           Tests/NPRuntimeRemoveProperty.cpp \
+          Tests/PassDifferentNPPStruct.cpp \
           Tests/PluginScriptableNPObjectInvokeDefault.cpp
 
 mac {
diff --git a/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp b/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
index 255bfc3..f03c102 100644
--- a/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/AccessibilityControllerWin.cpp
@@ -232,7 +232,8 @@ static void CALLBACK notificationListenerProc(HWINEVENTHOOK, DWORD event, HWND h
     VariantInit(&vChild);
 
     HRESULT hr = AccessibleObjectFromEvent(hwnd, idObject, idChild, &parentObject, &vChild);
-    ASSERT(SUCCEEDED(hr));
+    if (FAILED(hr) || !parentObject)
+        return;
 
     COMPtr<IDispatch> childDispatch;
     if (FAILED(parentObject->get_accChild(vChild, &childDispatch))) {
diff --git a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
index 0a02110..fde5e47 100644
--- a/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
+++ b/WebKitTools/DumpRenderTree/win/ImageDiff.vcproj
@@ -287,6 +287,76 @@
 				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

 			/>

 		</Configuration>

+		<Configuration

+			Name="Debug_Cairo|Win32"

+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"

+			IntermediateDirectory="$(ConfigurationName)"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;..\..\..\WebKitLibraries\win\tools\vsprops\debug_wincairo.vsprops"

+			CharacterSet="2"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+				AdditionalIncludeDirectories="&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\include&quot;;&quot;$(WebKitLibrariesDir)\include\private&quot;"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+				AdditionalOptions="/NXCOMPAT"

+				AdditionalDependencies="JavaScriptCore$(WebKitDLLConfigSuffix).lib CoreGraphics$(LibraryConfigSuffix).lib CoreFoundation$(LibraryConfigSuffix).lib"

+				AdditionalLibraryDirectories=""

+				SubSystem="1"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+				CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;&#x0D;&#x0A;if not defined ARCHIVE_BUILD (if defined PRODUCTION exit /b)&#x0D;&#x0A;&#x0D;&#x0A;if not exist &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; exit /b&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreFoundation$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d /e /i &quot;$(WebKitLibrariesDir)\bin\CoreFoundation.resources&quot; &quot;$(WebKitOutputDir)\bin\CoreFoundation.resources&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).dll&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;xcopy /y /d &quot;$(WebKitLibrariesDir)\bin\CoreGraphics$(LibraryConfigSuffix).pdb&quot; &quot;$(WebKitOutputDir)\bin&quot;&#x0D;&#x0A;"

+			/>

+		</Configuration>

 	</Configurations>

 	<References>

 	</References>

diff --git a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
index 6dd609c..d2140d1 100644
--- a/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
+++ b/WebKitTools/DumpRenderTree/win/LayoutTestControllerWin.cpp
@@ -1390,3 +1390,9 @@ void LayoutTestController::setEditingBehavior(const char* editingBehavior)
 void LayoutTestController::abortModal()
 {
 }
+
+bool LayoutTestController::hasSpellingMarker(int, int)
+{
+    // FIXME: Implement this.
+    return false;
+}
diff --git a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
index 5fba1cf..eefc587 100644
--- a/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
+++ b/WebKitTools/DumpRenderTree/wx/LayoutTestControllerWx.cpp
@@ -505,6 +505,12 @@ void LayoutTestController::abortModal()
 {
 }
 
+bool LayoutTestController::hasSpellingMarker(int, int)
+{
+    // FIXME: Implement
+    return false;
+}
+
 JSRetainPtr<JSStringRef> LayoutTestController::pageProperty(const char* propertyName, int pageNumber) const
 {
     // FIXME: Implement
diff --git a/WebKitTools/EWSTools/create-webkit-git b/WebKitTools/EWSTools/create-webkit-git
index 0088a47..0088a47 100644..100755
--- a/WebKitTools/EWSTools/create-webkit-git
+++ b/WebKitTools/EWSTools/create-webkit-git
diff --git a/WebKitTools/EWSTools/start-queue.sh b/WebKitTools/EWSTools/start-queue.sh
index 1e0403f..1e0403f 100644..100755
--- a/WebKitTools/EWSTools/start-queue.sh
+++ b/WebKitTools/EWSTools/start-queue.sh
diff --git a/WebKitTools/EWSTools/ubuntu-ews-packages b/WebKitTools/EWSTools/ubuntu-ews-packages
new file mode 100644
index 0000000..a7917a0
--- /dev/null
+++ b/WebKitTools/EWSTools/ubuntu-ews-packages
@@ -0,0 +1,61 @@
+subversion
+git-core
+git-svn
+binutils-gold
+python-mechanize
+libqt4-dev
+gperf
+bison
+fakeroot
+flex
+g++
+g++-multilib
+gperf
+autoconf
+automake
+libapache2-mod-php5
+libasound2-dev
+libbz2-dev
+libicu-dev
+libphonon-dev
+libsqlite3-dev
+libcairo2-dev
+libdbus-glib-1-dev
+libgconf2-dev
+libgl1-mesa-dev
+libglu1-mesa-dev
+libglib2.0-dev
+libjpeg62-dev
+libnspr4-dev
+libnss3-dev
+libpam0g-dev
+libtool
+libgtk2.0-dev
+libpango1.0-dev
+libicu-dev
+libxslt-dev
+libxslt1-dev
+libxss-dev
+libsoup2.4-dev
+libsqlite3-dev
+mesa-common-dev
+patch
+perl
+pkg-config
+python
+libcupsys2-dev
+libgnome-keyring-dev
+libcurl4-gnutls-dev
+libcupsys2-dev
+gperf
+bison
+flex
+libjpeg62-dev
+libpng12-dev
+libxt-dev
+autotools-dev
+libgstreamer-plugins-base0.10-dev
+libenchant-dev
+libgail-dev
+gtk-doc-tools
+libgeoclue-dev
diff --git a/WebKitTools/EWebLauncher/main.c b/WebKitTools/EWebLauncher/main.c
index 8965c42..8ba58d8 100644
--- a/WebKitTools/EWebLauncher/main.c
+++ b/WebKitTools/EWebLauncher/main.c
@@ -132,6 +132,7 @@ typedef struct _Viewport {
     float initScale;
     float minScale;
     float maxScale;
+    float devicePixelRatio;
     Eina_Bool userScalable;
 } Viewport;
 
@@ -402,9 +403,10 @@ on_viewport_changed(void* user_data, Evas_Object* webview, void* event_info)
 {
     ELauncher *app = (ELauncher *)user_data;
 
-    float w, h, initScale, minScale, maxScale, userScalable;
+    float w, h, initScale, minScale, maxScale, devicePixelRatio;
+    Eina_Bool userScalable;
 
-    ewk_view_viewport_get(webview, &w, &h, &initScale, &maxScale, &minScale, &userScalable);
+    ewk_view_viewport_attributes_get(webview, &w, &h, &initScale, &maxScale, &minScale, &devicePixelRatio, &userScalable);
 
     /**
      * If there is no argument in viewport tag, argument's value is -1.
@@ -419,6 +421,8 @@ on_viewport_changed(void* user_data, Evas_Object* webview, void* event_info)
         minScale = ewk_view_zoom_range_min_get(webview);
     if ((int)maxScale == -1)
         maxScale = ewk_view_zoom_range_max_get(webview);
+    if ((int)devicePixelRatio == -1)
+        devicePixelRatio = ewk_view_device_pixel_ratio_get(webview);
     if ((int)userScalable == -1)
         userScalable = EINA_TRUE;
 
@@ -427,7 +431,8 @@ on_viewport_changed(void* user_data, Evas_Object* webview, void* event_info)
     app->viewport.initScale = initScale;
     app->viewport.minScale = minScale;
     app->viewport.maxScale = maxScale;
-    app->viewport.userScalable = (Eina_Bool)userScalable;
+    app->viewport.devicePixelRatio = devicePixelRatio;
+    app->viewport.userScalable = userScalable;
     viewport_set();
 }
 
diff --git a/WebKitTools/GNUmakefile.am b/WebKitTools/GNUmakefile.am
index 1599e89..5257ece 100644
--- a/WebKitTools/GNUmakefile.am
+++ b/WebKitTools/GNUmakefile.am
@@ -6,6 +6,7 @@ noinst_PROGRAMS += \
 # GtkLauncher
 Programs_GtkLauncher_CPPFLAGS = \
 	-I$(srcdir)/WebKit/gtk \
+	-I$(srcdir)/WebCore/platform/network/soup/cache/ \
 	-I$(top_builddir)/WebKit/gtk \
 	-I$(top_builddir)/DerivedSources \
 	$(global_cppflags) \
@@ -38,6 +39,7 @@ dumprendertree_cppflags := \
 	-I$(srcdir)/WebKitTools/DumpRenderTree/gtk \
 	-I$(srcdir)/WebKit/gtk \
 	-I$(srcdir)/WebCore/platform/gtk \
+	-I$(srcdir)/WebCore/platform/network/soup/cache/ \
 	-I$(top_builddir)/WebKit/gtk \
 	-I$(top_builddir)/DerivedSources \
 	$(global_cppflags) \
diff --git a/WebKitTools/Makefile b/WebKitTools/Makefile
index 57ea097..51ac703 100644
--- a/WebKitTools/Makefile
+++ b/WebKitTools/Makefile
@@ -1,4 +1,4 @@
-MODULES = DumpRenderTree WebKitTestRunner MiniBrowser
+MODULES = DumpRenderTree WebKitTestRunner MiniBrowser TestWebKitAPI
 
 all:
 	@for dir in $(MODULES); do ${MAKE} $@ -C $$dir; exit_status=$$?; \
diff --git a/WebKitTools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj b/WebKitTools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
index f05c351..1a7ccbb 100644
--- a/WebKitTools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
+++ b/WebKitTools/MiniBrowser/MiniBrowser.xcodeproj/project.pbxproj
@@ -256,7 +256,14 @@
 			isa = PBXProject;
 			buildConfigurationList = C01FCF4E08A954540054247B /* Build configuration list for PBXProject "MiniBrowser" */;
 			compatibilityVersion = "Xcode 3.1";
+			developmentRegion = English;
 			hasScannedForEncodings = 1;
+			knownRegions = (
+				English,
+				Japanese,
+				French,
+				German,
+			);
 			mainGroup = 29B97314FDCFA39411CA2CEA /* MiniBrowser */;
 			projectDirPath = "";
 			projectRoot = "";
diff --git a/WebKitTools/MiniBrowser/mac/AppDelegate.m b/WebKitTools/MiniBrowser/mac/AppDelegate.m
index 7098cea..3747e28 100644
--- a/WebKitTools/MiniBrowser/mac/AppDelegate.m
+++ b/WebKitTools/MiniBrowser/mac/AppDelegate.m
@@ -118,7 +118,6 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
         else
             currentProcessModel = kProcessModelSharedSecondaryProcess;
 
-        WKContextRef threadContext = WKContextGetSharedThreadContext();
         WKContextHistoryClient historyClient = {
             0,
             self,
@@ -128,8 +127,11 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
             didUpdateHistoryTitle,
             populateVisitedLinks
         };
+
+        WKContextRef threadContext = WKContextGetSharedThreadContext();
         WKContextSetHistoryClient(threadContext, &historyClient);
-    
+        WKContextSetCacheModel(threadContext, kWKCacheModelPrimaryWebBrowser);
+
         threadPageNamespace = WKPageNamespaceCreate(threadContext);
         WKRelease(threadContext);
 
@@ -146,7 +148,8 @@ static void populateVisitedLinks(WKContextRef context, const void *clientInfo)
         };
         WKContextSetInjectedBundleClient(processContext, &bundleClient);
         WKContextSetHistoryClient(processContext, &historyClient);
-        
+        WKContextSetCacheModel(processContext, kWKCacheModelPrimaryWebBrowser);
+
         processPageNamespace = WKPageNamespaceCreate(processContext);
         WKRelease(processContext);
 
diff --git a/WebKitTools/MiniBrowser/mac/BrowserWindow.xib b/WebKitTools/MiniBrowser/mac/BrowserWindow.xib
index 52558a7..5984fe5 100644
--- a/WebKitTools/MiniBrowser/mac/BrowserWindow.xib
+++ b/WebKitTools/MiniBrowser/mac/BrowserWindow.xib
@@ -2,17 +2,18 @@
 <archive type="com.apple.InterfaceBuilder3.Cocoa.XIB" version="7.10">
 	<data>
 		<int key="IBDocument.SystemTarget">1060</int>
-		<string key="IBDocument.SystemVersion">10F569</string>
-		<string key="IBDocument.InterfaceBuilderVersion">762</string>
-		<string key="IBDocument.AppKitVersion">1038.29</string>
+		<string key="IBDocument.SystemVersion">10H545</string>
+		<string key="IBDocument.InterfaceBuilderVersion">820</string>
+		<string key="IBDocument.AppKitVersion">1038.35</string>
 		<string key="IBDocument.HIToolboxVersion">461.00</string>
 		<object class="NSMutableDictionary" key="IBDocument.PluginVersions">
 			<string key="NS.key.0">com.apple.InterfaceBuilder.CocoaPlugin</string>
-			<string key="NS.object.0">762</string>
+			<string key="NS.object.0">820</string>
 		</object>
 		<object class="NSMutableArray" key="IBDocument.EditedObjectIDs">
 			<bool key="EncodedWithXMLCoder">YES</bool>
-			<integer value="2"/>
+			<integer value="9"/>
+			<integer value="71"/>
 		</object>
 		<object class="NSArray" key="IBDocument.PluginDependencies">
 			<bool key="EncodedWithXMLCoder">YES</bool>
@@ -92,7 +93,7 @@
 										</object>
 										<reference key="NSControlView" ref="690456651"/>
 										<bool key="NSDrawsBackground">YES</bool>
-										<object class="NSColor" key="NSBackgroundColor">
+										<object class="NSColor" key="NSBackgroundColor" id="1032961300">
 											<int key="NSColorSpace">6</int>
 											<string key="NSCatalogName">System</string>
 											<string key="NSColorName">textBackgroundColor</string>
@@ -317,6 +318,93 @@
 				<string key="NSMaxSize">{1.79769e+308, 1.79769e+308}</string>
 				<string key="NSFrameAutosaveName">Main Window</string>
 			</object>
+			<object class="NSWindowTemplate" id="833876351">
+				<int key="NSWindowStyleMask">147</int>
+				<int key="NSWindowBacking">2</int>
+				<string key="NSWindowRect">{{230, 479}, {452, 62}}</string>
+				<int key="NSWTFlags">-461897728</int>
+				<string key="NSWindowTitle">Find</string>
+				<string key="NSWindowClass">NSPanel</string>
+				<nil key="NSViewClass"/>
+				<string key="NSWindowContentMaxSize">{1.79769e+308, 1.79769e+308}</string>
+				<object class="NSView" key="NSWindowView" id="585866018">
+					<reference key="NSNextResponder"/>
+					<int key="NSvFlags">256</int>
+					<object class="NSMutableArray" key="NSSubviews">
+						<bool key="EncodedWithXMLCoder">YES</bool>
+						<object class="NSSearchField" id="841639270">
+							<reference key="NSNextResponder" ref="585866018"/>
+							<int key="NSvFlags">268</int>
+							<string key="NSFrame">{{20, 20}, {412, 22}}</string>
+							<reference key="NSSuperview" ref="585866018"/>
+							<bool key="NSEnabled">YES</bool>
+							<object class="NSSearchFieldCell" key="NSCell" id="41426839">
+								<int key="NSCellFlags">343014976</int>
+								<int key="NSCellFlags2">268436544</int>
+								<string key="NSContents"/>
+								<reference key="NSSupport" ref="1064395332"/>
+								<reference key="NSControlView" ref="841639270"/>
+								<bool key="NSDrawsBackground">YES</bool>
+								<int key="NSTextBezelStyle">1</int>
+								<reference key="NSBackgroundColor" ref="1032961300"/>
+								<object class="NSColor" key="NSTextColor">
+									<int key="NSColorSpace">6</int>
+									<string key="NSCatalogName">System</string>
+									<string key="NSColorName">controlTextColor</string>
+									<reference key="NSColor" ref="365730878"/>
+								</object>
+								<object class="NSButtonCell" key="NSSearchButtonCell">
+									<int key="NSCellFlags">130560</int>
+									<int key="NSCellFlags2">0</int>
+									<string key="NSContents">search</string>
+									<reference key="NSControlView" ref="841639270"/>
+									<string key="NSAction">_searchFieldSearch:</string>
+									<reference key="NSTarget" ref="41426839"/>
+									<int key="NSButtonFlags">138690815</int>
+									<int key="NSButtonFlags2">0</int>
+									<string key="NSKeyEquivalent"/>
+									<int key="NSPeriodicDelay">400</int>
+									<int key="NSPeriodicInterval">75</int>
+								</object>
+								<object class="NSButtonCell" key="NSCancelButtonCell">
+									<int key="NSCellFlags">130560</int>
+									<int key="NSCellFlags2">0</int>
+									<string key="NSContents">clear</string>
+									<object class="NSMutableArray" key="NSAccessibilityOverriddenAttributes">
+										<bool key="EncodedWithXMLCoder">YES</bool>
+										<object class="NSMutableDictionary">
+											<bool key="EncodedWithXMLCoder">YES</bool>
+											<object class="NSArray" key="dict.sortedKeys">
+												<bool key="EncodedWithXMLCoder">YES</bool>
+												<string>AXDescription</string>
+												<string>NSAccessibilityEncodedAttributesValueType</string>
+											</object>
+											<object class="NSMutableArray" key="dict.values">
+												<bool key="EncodedWithXMLCoder">YES</bool>
+												<string>cancel</string>
+												<integer value="1"/>
+											</object>
+										</object>
+									</object>
+									<reference key="NSControlView" ref="841639270"/>
+									<string key="NSAction">_searchFieldCancel:</string>
+									<reference key="NSTarget" ref="41426839"/>
+									<int key="NSButtonFlags">138690815</int>
+									<int key="NSButtonFlags2">0</int>
+									<string key="NSKeyEquivalent"/>
+									<int key="NSPeriodicDelay">400</int>
+									<int key="NSPeriodicInterval">75</int>
+								</object>
+								<int key="NSMaximumRecents">255</int>
+							</object>
+						</object>
+					</object>
+					<string key="NSFrameSize">{452, 62}</string>
+					<reference key="NSSuperview"/>
+				</object>
+				<string key="NSScreenRect">{{0, 0}, {1920, 1178}}</string>
+				<string key="NSMaxSize">{1.79769e+308, 1.79769e+308}</string>
+			</object>
 		</object>
 		<object class="IBObjectContainer" key="IBDocument.Objects">
 			<object class="NSMutableArray" key="connectionRecords">
@@ -425,6 +513,22 @@
 					</object>
 					<int key="connectionID">67</int>
 				</object>
+				<object class="IBConnectionRecord">
+					<object class="IBActionConnection" key="connection">
+						<string key="label">find:</string>
+						<reference key="source" ref="1001"/>
+						<reference key="destination" ref="841639270"/>
+					</object>
+					<int key="connectionID">76</int>
+				</object>
+				<object class="IBConnectionRecord">
+					<object class="IBOutletConnection" key="connection">
+						<string key="label">findPanelWindow</string>
+						<reference key="source" ref="1001"/>
+						<reference key="destination" ref="833876351"/>
+					</object>
+					<int key="connectionID">77</int>
+				</object>
 			</object>
 			<object class="IBMutableOrderedSet" key="objectRecords">
 				<object class="NSArray" key="orderedObjects">
@@ -596,6 +700,38 @@
 						<reference key="object" ref="128750774"/>
 						<reference key="parent" ref="457655522"/>
 					</object>
+					<object class="IBObjectRecord">
+						<int key="objectID">70</int>
+						<reference key="object" ref="833876351"/>
+						<object class="NSMutableArray" key="children">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<reference ref="585866018"/>
+						</object>
+						<reference key="parent" ref="0"/>
+					</object>
+					<object class="IBObjectRecord">
+						<int key="objectID">71</int>
+						<reference key="object" ref="585866018"/>
+						<object class="NSMutableArray" key="children">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<reference ref="841639270"/>
+						</object>
+						<reference key="parent" ref="833876351"/>
+					</object>
+					<object class="IBObjectRecord">
+						<int key="objectID">74</int>
+						<reference key="object" ref="841639270"/>
+						<object class="NSMutableArray" key="children">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<reference ref="41426839"/>
+						</object>
+						<reference key="parent" ref="585866018"/>
+					</object>
+					<object class="IBObjectRecord">
+						<int key="objectID">75</int>
+						<reference key="object" ref="41426839"/>
+						<reference key="parent" ref="841639270"/>
+					</object>
 				</object>
 			</object>
 			<object class="NSMutableDictionary" key="flattenedProperties">
@@ -627,13 +763,21 @@
 					<string>56.CustomClassName</string>
 					<string>57.CustomClassName</string>
 					<string>58.CustomClassName</string>
+					<string>70.IBEditorWindowLastContentRect</string>
+					<string>70.IBPluginDependency</string>
+					<string>70.IBWindowTemplateEditedContentRect</string>
+					<string>70.NSWindowTemplate.visibleAtLaunch</string>
+					<string>71.IBPluginDependency</string>
+					<string>74.IBPluginDependency</string>
+					<string>75.IBPluginDependency</string>
 					<string>9.IBPluginDependency</string>
+					<string>9.IBViewBoundsToFrameTransform</string>
 				</object>
 				<object class="NSMutableArray" key="dict.values">
 					<bool key="EncodedWithXMLCoder">YES</bool>
-					<string>{{276, 45}, {776, 608}}</string>
+					<string>{{404, 157}, {776, 608}}</string>
 					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
-					<string>{{276, 45}, {776, 608}}</string>
+					<string>{{404, 157}, {776, 608}}</string>
 					<integer value="1"/>
 					<string>{196, 240}</string>
 					<string>{{202, 428}, {480, 270}}</string>
@@ -656,7 +800,15 @@
 					<string>MBToolbarItem</string>
 					<string>MBToolbarItem</string>
 					<string>MBToolbarItem</string>
+					<string>{{558, 468}, {452, 62}}</string>
+					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
+					<string>{{558, 468}, {452, 62}}</string>
+					<boolean value="NO"/>
+					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
+					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
 					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
+					<string>com.apple.InterfaceBuilder.CocoaPlugin</string>
+					<object class="NSAffineTransform"/>
 				</object>
 			</object>
 			<object class="NSMutableDictionary" key="unlocalizedProperties">
@@ -675,7 +827,7 @@
 				</object>
 			</object>
 			<nil key="sourceID"/>
-			<int key="maxID">67</int>
+			<int key="maxID">77</int>
 		</object>
 		<object class="IBClassDescriber" key="IBDocument.Classes">
 			<object class="NSMutableArray" key="referencedPartialClassDescriptions">
@@ -687,13 +839,19 @@
 						<bool key="EncodedWithXMLCoder">YES</bool>
 						<object class="NSArray" key="dict.sortedKeys">
 							<bool key="EncodedWithXMLCoder">YES</bool>
+							<string>dumpSourceToConsole:</string>
 							<string>fetch:</string>
+							<string>find:</string>
 							<string>forceRepaint:</string>
 							<string>goBack:</string>
 							<string>goForward:</string>
 							<string>reload:</string>
 							<string>removeReinsertWebView:</string>
+							<string>resetZoom:</string>
 							<string>showHideWebView:</string>
+							<string>toggleZoomMode:</string>
+							<string>zoomIn:</string>
+							<string>zoomOut:</string>
 						</object>
 						<object class="NSMutableArray" key="dict.values">
 							<bool key="EncodedWithXMLCoder">YES</bool>
@@ -704,6 +862,86 @@
 							<string>id</string>
 							<string>id</string>
 							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+							<string>id</string>
+						</object>
+					</object>
+					<object class="NSMutableDictionary" key="actionInfosByName">
+						<bool key="EncodedWithXMLCoder">YES</bool>
+						<object class="NSArray" key="dict.sortedKeys">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<string>dumpSourceToConsole:</string>
+							<string>fetch:</string>
+							<string>find:</string>
+							<string>forceRepaint:</string>
+							<string>goBack:</string>
+							<string>goForward:</string>
+							<string>reload:</string>
+							<string>removeReinsertWebView:</string>
+							<string>resetZoom:</string>
+							<string>showHideWebView:</string>
+							<string>toggleZoomMode:</string>
+							<string>zoomIn:</string>
+							<string>zoomOut:</string>
+						</object>
+						<object class="NSMutableArray" key="dict.values">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<object class="IBActionInfo">
+								<string key="name">dumpSourceToConsole:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">fetch:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">find:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">forceRepaint:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">goBack:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">goForward:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">reload:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">removeReinsertWebView:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">resetZoom:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">showHideWebView:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">toggleZoomMode:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">zoomIn:</string>
+								<string key="candidateClassName">id</string>
+							</object>
+							<object class="IBActionInfo">
+								<string key="name">zoomOut:</string>
+								<string key="candidateClassName">id</string>
+							</object>
 						</object>
 					</object>
 					<object class="NSMutableDictionary" key="outlets">
@@ -712,6 +950,7 @@
 							<bool key="EncodedWithXMLCoder">YES</bool>
 							<string>backButton</string>
 							<string>containerView</string>
+							<string>findPanelWindow</string>
 							<string>forwardButton</string>
 							<string>progressIndicator</string>
 							<string>reloadButton</string>
@@ -722,6 +961,7 @@
 							<bool key="EncodedWithXMLCoder">YES</bool>
 							<string>NSButton</string>
 							<string>NSView</string>
+							<string>NSWindow</string>
 							<string>NSButton</string>
 							<string>NSProgressIndicator</string>
 							<string>NSButton</string>
@@ -729,6 +969,55 @@
 							<string>NSTextField</string>
 						</object>
 					</object>
+					<object class="NSMutableDictionary" key="toOneOutletInfosByName">
+						<bool key="EncodedWithXMLCoder">YES</bool>
+						<object class="NSArray" key="dict.sortedKeys">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<string>backButton</string>
+							<string>containerView</string>
+							<string>findPanelWindow</string>
+							<string>forwardButton</string>
+							<string>progressIndicator</string>
+							<string>reloadButton</string>
+							<string>toolbar</string>
+							<string>urlText</string>
+						</object>
+						<object class="NSMutableArray" key="dict.values">
+							<bool key="EncodedWithXMLCoder">YES</bool>
+							<object class="IBToOneOutletInfo">
+								<string key="name">backButton</string>
+								<string key="candidateClassName">NSButton</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">containerView</string>
+								<string key="candidateClassName">NSView</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">findPanelWindow</string>
+								<string key="candidateClassName">NSWindow</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">forwardButton</string>
+								<string key="candidateClassName">NSButton</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">progressIndicator</string>
+								<string key="candidateClassName">NSProgressIndicator</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">reloadButton</string>
+								<string key="candidateClassName">NSButton</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">toolbar</string>
+								<string key="candidateClassName">NSToolbar</string>
+							</object>
+							<object class="IBToOneOutletInfo">
+								<string key="name">urlText</string>
+								<string key="candidateClassName">NSTextField</string>
+							</object>
+						</object>
+					</object>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
 						<string key="majorKey">IBProjectSource</string>
 						<string key="minorKey">mac/BrowserWindowController.h</string>
@@ -1097,6 +1386,14 @@
 					</object>
 				</object>
 				<object class="IBPartialClassDescription">
+					<string key="className">NSPanel</string>
+					<string key="superclassName">NSWindow</string>
+					<object class="IBClassDescriptionSource" key="sourceIdentifier">
+						<string key="majorKey">IBFrameworkSource</string>
+						<string key="minorKey">AppKit.framework/Headers/NSPanel.h</string>
+					</object>
+				</object>
+				<object class="IBPartialClassDescription">
 					<string key="className">NSProgressIndicator</string>
 					<string key="superclassName">NSView</string>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
@@ -1120,6 +1417,22 @@
 					</object>
 				</object>
 				<object class="IBPartialClassDescription">
+					<string key="className">NSSearchField</string>
+					<string key="superclassName">NSTextField</string>
+					<object class="IBClassDescriptionSource" key="sourceIdentifier">
+						<string key="majorKey">IBFrameworkSource</string>
+						<string key="minorKey">AppKit.framework/Headers/NSSearchField.h</string>
+					</object>
+				</object>
+				<object class="IBPartialClassDescription">
+					<string key="className">NSSearchFieldCell</string>
+					<string key="superclassName">NSTextFieldCell</string>
+					<object class="IBClassDescriptionSource" key="sourceIdentifier">
+						<string key="majorKey">IBFrameworkSource</string>
+						<string key="minorKey">AppKit.framework/Headers/NSSearchFieldCell.h</string>
+					</object>
+				</object>
+				<object class="IBPartialClassDescription">
 					<string key="className">NSTextField</string>
 					<string key="superclassName">NSControl</string>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
@@ -1203,6 +1516,13 @@
 						<string key="NS.key.0">showWindow:</string>
 						<string key="NS.object.0">id</string>
 					</object>
+					<object class="NSMutableDictionary" key="actionInfosByName">
+						<string key="NS.key.0">showWindow:</string>
+						<object class="IBActionInfo" key="NS.object.0">
+							<string key="name">showWindow:</string>
+							<string key="candidateClassName">id</string>
+						</object>
+					</object>
 					<object class="IBClassDescriptionSource" key="sourceIdentifier">
 						<string key="majorKey">IBFrameworkSource</string>
 						<string key="minorKey">AppKit.framework/Headers/NSWindowController.h</string>
diff --git a/WebKitTools/MiniBrowser/mac/BrowserWindowController.h b/WebKitTools/MiniBrowser/mac/BrowserWindowController.h
index 98c6bf7..6b6aeb8 100644
--- a/WebKitTools/MiniBrowser/mac/BrowserWindowController.h
+++ b/WebKitTools/MiniBrowser/mac/BrowserWindowController.h
@@ -31,7 +31,9 @@
     IBOutlet NSToolbar *toolbar;
     IBOutlet NSTextField *urlText;
     IBOutlet NSView *containerView;
-
+    
+    IBOutlet NSWindow *findPanelWindow;
+    
     WKPageNamespaceRef _pageNamespace;
     WKView *_webView;
     BOOL _zoomTextOnly;
@@ -60,4 +62,6 @@
 
 - (IBAction)dumpSourceToConsole:(id)sender;
 
+- (IBAction)find:(id)sender;
+
 @end
diff --git a/WebKitTools/MiniBrowser/mac/BrowserWindowController.m b/WebKitTools/MiniBrowser/mac/BrowserWindowController.m
index cb4c56a..6fad41a 100644
--- a/WebKitTools/MiniBrowser/mac/BrowserWindowController.m
+++ b/WebKitTools/MiniBrowser/mac/BrowserWindowController.m
@@ -258,7 +258,7 @@ static void didReceiveServerRedirectForProvisionalLoadForFrame(WKPageRef page, W
     [(BrowserWindowController *)clientInfo didReceiveServerRedirectForProvisionalLoadForFrame:frame];
 }
 
-static void didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void *clientInfo)
+static void didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKErrorRef error, WKTypeRef userData, const void *clientInfo)
 {
     [(BrowserWindowController *)clientInfo didFailProvisionalLoadWithErrorForFrame:frame];
 }
@@ -278,7 +278,7 @@ static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef us
     LOG(@"didFinishLoadForFrame");
 }
 
-static void didFailLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void *clientInfo)
+static void didFailLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKErrorRef error, WKTypeRef userData, const void *clientInfo)
 {
     [(BrowserWindowController *)clientInfo didFailLoadWithErrorForFrame:frame];
 }
@@ -484,6 +484,46 @@ static void contentsSizeChanged(WKPageRef page, int width, int height, WKFrameRe
     LOG(@"contentsSizeChanged");
 }
 
+static WKRect getWindowFrame(WKPageRef page, const void* clientInfo)
+{
+    NSRect rect = [[(BrowserWindowController *)clientInfo window] frame];
+    WKRect wkRect;
+    wkRect.origin.x = rect.origin.x;
+    wkRect.origin.y = rect.origin.y;
+    wkRect.size.width = rect.size.width;
+    wkRect.size.height = rect.size.height;
+    return wkRect;
+}
+
+static void setWindowFrame(WKPageRef page, WKRect rect, const void* clientInfo)
+{
+    [[(BrowserWindowController *)clientInfo window] setFrame:NSMakeRect(rect.origin.x, rect.origin.y, rect.size.width, rect.size.height) display:YES];
+}
+
+static bool runBeforeUnloadConfirmPanel(WKPageRef page, WKStringRef message, WKFrameRef frame, const void* clientInfo)
+{
+    NSAlert *alert = [[NSAlert alloc] init];
+
+    WKURLRef wkURL = WKFrameCopyURL(frame);
+    CFURLRef cfURL = WKURLCopyCFURL(0, wkURL);
+    WKRelease(wkURL);
+
+    [alert setMessageText:[NSString stringWithFormat:@"BeforeUnload confirm dialog from %@.", [(NSURL *)cfURL absoluteString]]];
+    CFRelease(cfURL);
+
+    CFStringRef cfMessage = WKStringCopyCFString(0, message);
+    [alert setInformativeText:(NSString *)cfMessage];
+    CFRelease(cfMessage);
+
+    [alert addButtonWithTitle:@"OK"];
+    [alert addButtonWithTitle:@"Cancel"];
+
+    NSInteger button = [alert runModal];
+    [alert release];
+
+    return button == NSAlertFirstButtonReturn;
+}
+
 - (void)awakeFromNib
 {
     _webView = [[WKView alloc] initWithFrame:[containerView frame] pageNamespaceRef:_pageNamespace];
@@ -538,7 +578,11 @@ static void contentsSizeChanged(WKPageRef page, int width, int height, WKFrameRe
         setStatusText,
         mouseDidMoveOverElement,
         contentsSizeChanged,
-        0           /* didNotHandleKeyEvent */
+        0,          /* didNotHandleKeyEvent */
+        getWindowFrame,
+        setWindowFrame,
+        runBeforeUnloadConfirmPanel,
+        0          /* didDraw */
     };
     WKPageSetPageUIClient(_webView.pageRef, &uiClient);
 }
@@ -562,9 +606,15 @@ static void contentsSizeChanged(WKPageRef page, int width, int height, WKFrameRe
 
 - (void)updateProvisionalURLForFrame:(WKFrameRef)frame
 {
+    static WKURLRef emptyURL = 0;
+    if (!emptyURL)
+        emptyURL = WKURLCreateWithUTF8CString("");
+
     WKURLRef url = WKFrameCopyProvisionalURL(frame);
-    if (!url)
+    if (WKURLIsEqual(url, emptyURL)) {
+        WKRelease(url);
         return;
+    }
 
     CFURLRef cfSourceURL = WKURLCopyCFURL(0, url);
     WKRelease(url);
@@ -616,4 +666,17 @@ static void contentsSizeChanged(WKPageRef page, int width, int height, WKFrameRe
     [self fetch:nil];
 }
 
+- (IBAction)performFindPanelAction:(id)sender
+{
+    [findPanelWindow makeKeyAndOrderFront:sender];
+}
+
+- (IBAction)find:(id)sender
+{
+    WKStringRef string = WKStringCreateWithCFString((CFStringRef)[sender stringValue]);
+
+    WKPageFindString(_webView.pageRef, string, kWKFindDirectionForward, 
+                     kWKFindOptionsCaseInsensitive | kWKFindOptionsWrapAround | kWKFindOptionsShowFindIndicator | kWKFindOptionsShowOverlay, 100);
+}
+
 @end
diff --git a/WebKitTools/QtTestBrowser/mainwindow.cpp b/WebKitTools/QtTestBrowser/mainwindow.cpp
index fa8b87d..68002e1 100644
--- a/WebKitTools/QtTestBrowser/mainwindow.cpp
+++ b/WebKitTools/QtTestBrowser/mainwindow.cpp
@@ -38,6 +38,7 @@
 MainWindow::MainWindow()
     : m_page(new WebPage(this))
     , m_toolBar(0)
+    , urlEdit(0)
 {
     setAttribute(Qt::WA_DeleteOnClose);
     if (qgetenv("QTTESTBROWSER_USE_ARGB_VISUALS").toInt() == 1)
@@ -48,6 +49,9 @@ MainWindow::MainWindow()
 
 void MainWindow::buildUI()
 {
+#if defined(Q_OS_SYMBIAN)
+    delete urlEdit;
+#endif
     delete m_toolBar;
 
     m_toolBar = addToolBar("Navigation");
diff --git a/WebKitTools/QtTestBrowser/urlloader.cpp b/WebKitTools/QtTestBrowser/urlloader.cpp
index abe9902..2ae722b 100644
--- a/WebKitTools/QtTestBrowser/urlloader.cpp
+++ b/WebKitTools/QtTestBrowser/urlloader.cpp
@@ -30,12 +30,21 @@
 
 #include <QFile>
 #include <QDebug>
+#include <QWebPage>
 
 UrlLoader::UrlLoader(QWebFrame* frame, const QString& inputFileName, int timeoutSeconds, int extraTimeSeconds)
     : m_frame(frame)
     , m_stdOut(stdout)
     , m_loaded(0)
+    , m_numFramesLoading(0)
 {
+    m_checkIfFinishedTimer.setInterval(200);
+    m_checkIfFinishedTimer.setSingleShot(true);
+    connect(&m_checkIfFinishedTimer, SIGNAL(timeout()), this, SLOT(checkIfFinished()));
+    // loadStarted and loadFinished on QWebPage is emitted for each frame/sub-frame
+    connect(m_frame->page(), SIGNAL(loadStarted()), this, SLOT(frameLoadStarted()));
+    connect(m_frame->page(), SIGNAL(loadFinished(bool)), this, SLOT(frameLoadFinished()));
+
     if (timeoutSeconds) {
         m_timeoutTimer.setInterval(timeoutSeconds * 1000);
         m_timeoutTimer.setSingleShot(true);
@@ -45,10 +54,10 @@ UrlLoader::UrlLoader(QWebFrame* frame, const QString& inputFileName, int timeout
     if (extraTimeSeconds) {
         m_extraTimeTimer.setInterval(extraTimeSeconds * 1000);
         m_extraTimeTimer.setSingleShot(true);
-        connect(frame, SIGNAL(loadFinished(bool)), &m_extraTimeTimer, SLOT(start()));
+        connect(this, SIGNAL(pageLoadFinished()), &m_extraTimeTimer, SLOT(start()));
         connect(&m_extraTimeTimer, SIGNAL(timeout()), this, SLOT(loadNext()));
     } else
-        connect(frame, SIGNAL(loadFinished(bool)), this, SLOT(loadNext()));
+        connect(this, SIGNAL(pageLoadFinished()), this, SLOT(loadNext()));
     loadUrlList(inputFileName);
 }
 
@@ -56,6 +65,8 @@ void UrlLoader::loadNext()
 {
     m_timeoutTimer.stop();
     m_extraTimeTimer.stop();
+    m_checkIfFinishedTimer.stop();
+    m_numFramesLoading = 0;
     QString qstr;
     if (getUrl(qstr)) {
         QUrl url(qstr, QUrl::StrictMode);
@@ -68,6 +79,27 @@ void UrlLoader::loadNext()
         disconnect(m_frame, 0, this, 0);
 }
 
+void UrlLoader::checkIfFinished()
+{
+    if (!m_numFramesLoading)
+        emit pageLoadFinished();
+}
+
+void UrlLoader::frameLoadStarted()
+{
+    ++m_numFramesLoading;
+    m_checkIfFinishedTimer.stop();
+}
+
+void UrlLoader::frameLoadFinished()
+{
+    Q_ASSERT(m_numFramesLoading > 0);
+    --m_numFramesLoading;
+    // Once our frame has finished loading, wait a moment to call loadNext for cases
+    // where a sub-frame starts loading or another frame is loaded through JavaScript.
+    m_checkIfFinishedTimer.start();
+}
+
 void UrlLoader::loadUrlList(const QString& inputFileName)
 {
     QFile inputFile(inputFileName);
diff --git a/WebKitTools/QtTestBrowser/urlloader.h b/WebKitTools/QtTestBrowser/urlloader.h
index e2a6d87..8ce24c0 100644
--- a/WebKitTools/QtTestBrowser/urlloader.h
+++ b/WebKitTools/QtTestBrowser/urlloader.h
@@ -44,6 +44,14 @@ public:
 public slots:
     void loadNext();
 
+private slots:
+    void checkIfFinished();
+    void frameLoadStarted();
+    void frameLoadFinished();
+
+signals:
+    void pageLoadFinished();
+
 private:
     void loadUrlList(const QString& inputFileName);
     bool getUrl(QString& qstr);
@@ -56,6 +64,8 @@ private:
     int m_loaded;
     QTimer m_timeoutTimer;
     QTimer m_extraTimeTimer;
+    QTimer m_checkIfFinishedTimer;
+    int m_numFramesLoading;
 };
 
 #endif
diff --git a/WebKitTools/QueueStatusServer/app.yaml b/WebKitTools/QueueStatusServer/app.yaml
index 76d8963..e320eb0 100644
--- a/WebKitTools/QueueStatusServer/app.yaml
+++ b/WebKitTools/QueueStatusServer/app.yaml
@@ -3,13 +3,13 @@ version: 1
 runtime: python
 api_version: 1
 
+builtins:
+- datastore_admin: on
+- remote_api: on
+
 handlers:
 - url: /stylesheets
   static_dir: stylesheets
 
-- url: /remote_api
-  script: $PYTHON_LIB/google/appengine/ext/remote_api/handler.py
-  login: admin
-
 - url: /.*
   script: main.py
diff --git a/WebKitTools/QueueStatusServer/handlers/dashboard.py b/WebKitTools/QueueStatusServer/handlers/dashboard.py
index 26de263..660c595 100644
--- a/WebKitTools/QueueStatusServer/handlers/dashboard.py
+++ b/WebKitTools/QueueStatusServer/handlers/dashboard.py
@@ -32,31 +32,16 @@ from google.appengine.ext import webapp
 from google.appengine.ext.webapp import template
 
 from model.attachment import Attachment
-from model.queues import queues
+from model.queues import Queue
 
 
 class Dashboard(webapp.RequestHandler):
+    # We may want to sort these?
+    _ordered_queues = Queue.all()
+    _header_names = [queue.short_name() for queue in _ordered_queues]
 
-    # FIXME: This list probably belongs as part of a Queue object in queues.py
-    # Arrays are bubble_name, queue_name
-    # FIXME: Can this be unified with StatusBubble._queues_to_display?
-    _queues_to_display = [
-        ["Style", "style-queue"],
-        ["Cr-Linux", "chromium-ews"],
-        ["Qt", "qt-ews"],
-        ["Gtk", "gtk-ews"],
-        ["Mac", "mac-ews"],
-        ["Win", "win-ews"],
-        ["Commit", "commit-queue"],
-    ]
-    # Split the zipped list into component parts
-    _header_names, _ordered_queue_names = zip(*_queues_to_display)
-
-    # This asserts that all of the queues listed above are valid queue names.
-    assert(reduce(operator.and_, map(lambda name: name in queues, _ordered_queue_names)))
-
-    def _build_bubble(self, attachment, queue_name):
-        queue_status = attachment.status_for_queue(queue_name)
+    def _build_bubble(self, attachment, queue):
+        queue_status = attachment.status_for_queue(queue)
         bubble = {
             "status_class": attachment.state_from_queue_status(queue_status) if queue_status else "none",
             "status_date": queue_status.date if queue_status else None,
@@ -67,7 +52,7 @@ class Dashboard(webapp.RequestHandler):
         row = {
             "bug_id": attachment.bug_id(),
             "attachment_id": attachment.id,
-            "bubbles": [self._build_bubble(attachment, queue_name) for queue_name in self._ordered_queue_names],
+            "bubbles": [self._build_bubble(attachment, queue) for queue in self._ordered_queues],
         }
         return row
 
diff --git a/WebKitTools/QueueStatusServer/handlers/nextpatch.py b/WebKitTools/QueueStatusServer/handlers/nextpatch.py
index edb702a..5f6d71d 100644
--- a/WebKitTools/QueueStatusServer/handlers/nextpatch.py
+++ b/WebKitTools/QueueStatusServer/handlers/nextpatch.py
@@ -26,26 +26,24 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from datetime import datetime
+
 from google.appengine.ext import db
 from google.appengine.ext import webapp
 
-from model.workitems import WorkItems
-from model.activeworkitems import ActiveWorkItems
-from model import queuestatus
-
-from datetime import datetime, timedelta
+from model.queues import Queue
 
 
 class NextPatch(webapp.RequestHandler):
-    def _get_next_patch_id(self, queue_name):
-        work_items = WorkItems.all().filter("queue_name =", queue_name).get()
-        if not work_items:
-            return None
-        active_work_items = ActiveWorkItems.get_or_insert(key_name=queue_name, queue_name=queue_name)
-        return db.run_in_transaction(self._assign_patch, active_work_items.key(), work_items.item_ids)
-
+    # FIXME: This should probably be a post, or an explict lock_patch
+    # since GET requests shouldn't really modify the datastore.
     def get(self, queue_name):
-        patch_id = self._get_next_patch_id(queue_name)
+        queue = Queue.queue_with_name(queue_name)
+        if not queue:
+            self.error(404)
+            return
+        # FIXME: Patch assignment should probably move into Queue.
+        patch_id = db.run_in_transaction(self._assign_patch, queue.active_work_items().key(), queue.work_items().item_ids)
         if not patch_id:
             self.error(404)
             return
diff --git a/WebKitTools/QueueStatusServer/handlers/queuestatus.py b/WebKitTools/QueueStatusServer/handlers/queuestatus.py
index 0259c37..5c31537 100644
--- a/WebKitTools/QueueStatusServer/handlers/queuestatus.py
+++ b/WebKitTools/QueueStatusServer/handlers/queuestatus.py
@@ -29,15 +29,15 @@
 from google.appengine.ext import webapp
 from google.appengine.ext.webapp import template
 
-from model.queues import queues, display_name_for_queue
-from model.workitems import WorkItems
-from model.activeworkitems import ActiveWorkItems
+from model.queues import Queue
 
 from model import queuestatus
 
 
 class QueueStatus(webapp.RequestHandler):
-    def _rows_for_work_items(self, queued_items, active_items):
+    def _rows_for_work_items(self, queue):
+        queued_items = queue.work_items()
+        active_items = queue.active_work_items()
         if not queued_items:
             return []
         rows = []
@@ -50,14 +50,17 @@ class QueueStatus(webapp.RequestHandler):
         return rows
 
     def get(self, queue_name):
-        queued_items = WorkItems.all().filter("queue_name =", queue_name).get()
-        active_items = ActiveWorkItems.all().filter("queue_name =", queue_name).get()
-        statuses = queuestatus.QueueStatus.all().filter("queue_name =", queue_name).order("-date").fetch(15)
+        queue_name = queue_name.lower()
+        queue = Queue.queue_with_name(queue_name)
+        if not queue:
+            self.error(404)
+            return
 
         status_groups = []
         last_patch_id = None
         synthetic_patch_id_counter = 0
 
+        statuses = queuestatus.QueueStatus.all().filter("queue_name =", queue.name()).order("-date").fetch(15)
         for status in statuses:
             patch_id = status.active_patch_id
             if not patch_id or last_patch_id != patch_id:
@@ -69,8 +72,8 @@ class QueueStatus(webapp.RequestHandler):
             last_patch_id = patch_id
 
         template_values = {
-            "display_queue_name": display_name_for_queue(queue_name),
-            "work_item_rows": self._rows_for_work_items(queued_items, active_items),
+            "display_queue_name": queue.display_name(),
+            "work_item_rows": self._rows_for_work_items(queue),
             "status_groups": status_groups,
         }
         self.response.out.write(template.render("templates/queuestatus.html", template_values))
diff --git a/WebKitTools/QueueStatusServer/handlers/recentstatus.py b/WebKitTools/QueueStatusServer/handlers/recentstatus.py
index e2b8c2f..fddc93a 100644
--- a/WebKitTools/QueueStatusServer/handlers/recentstatus.py
+++ b/WebKitTools/QueueStatusServer/handlers/recentstatus.py
@@ -31,23 +31,24 @@ import datetime
 from google.appengine.ext import webapp
 from google.appengine.ext.webapp import template
 
-from model.queues import queues, display_name_for_queue
+from model.queues import Queue
 from model.queuestatus import QueueStatus
 from model.workitems import WorkItems
 
 
 class QueueBubble(object):
     """View support class for recentstatus.html"""
-    def __init__(self, queue_name):
-        self._queue_name = queue_name
-        self._work_items = WorkItems.all().filter("queue_name =", queue_name).get()
-        self._last_status = QueueStatus.all().filter("queue_name =", queue_name).order("-date").get()
+    def __init__(self, queue):
+        self._queue = queue
+        self._work_items = queue.work_items()
+        self._last_status = QueueStatus.all().filter("queue_name =", queue.name()).order("-date").get()
 
+    # FIXME: name and display_name should be replaced by a .queue() accessor.
     def name(self):
-        return self._queue_name
+        return self._queue.name()
 
     def display_name(self):
-        return display_name_for_queue(self._queue_name)
+        return self._queue.display_name()
 
     def _last_status_date(self):
         if not self._last_status:
@@ -88,6 +89,6 @@ class QueuesOverview(webapp.RequestHandler):
 
     def get(self):
         template_values = {
-            "queues": [QueueBubble(queue_name) for queue_name in queues],
+            "queues": [QueueBubble(queue) for queue in Queue.all()],
         }
         self.response.out.write(template.render("templates/recentstatus.html", template_values))
diff --git a/WebKitTools/QueueStatusServer/handlers/releasepatch.py b/WebKitTools/QueueStatusServer/handlers/releasepatch.py
new file mode 100644
index 0000000..0e46e69
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/handlers/releasepatch.py
@@ -0,0 +1,62 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from google.appengine.ext import webapp, db
+from google.appengine.ext.webapp import template
+
+from handlers.updatebase import UpdateBase
+from model.attachment import Attachment
+from model.queues import Queue
+
+
+class ReleasePatch(UpdateBase):
+    def get(self):
+        self.response.out.write(template.render("templates/releasepatch.html", None))
+
+    def post(self):
+        queue_name = self.request.get("queue_name")
+        # FIXME: This queue lookup should be shared between handlers.
+        queue = Queue.queue_with_name(queue_name)
+        if not queue:
+            self.error(404)
+            return
+
+        attachment_id = self._int_from_request("attachment_id")
+        attachment = Attachment(attachment_id)
+        last_status = attachment.status_for_queue(queue)
+
+        # Ideally we should use a transaction for the calls to
+        # WorkItems and ActiveWorkItems.
+
+        # Only remove it from the queue if the last message is not a retry request.
+        # Allow removing it from the queue even if there is no last_status for easier testing.
+        if not last_status or not last_status.is_retry_request():
+            queue.work_items().remove_work_item(attachment_id)
+
+        # Always release the lock on the item.
+        queue.active_work_items().expire_item(attachment_id)
diff --git a/WebKitTools/QueueStatusServer/handlers/statusbubble.py b/WebKitTools/QueueStatusServer/handlers/statusbubble.py
index bfbe958..5690484 100644
--- a/WebKitTools/QueueStatusServer/handlers/statusbubble.py
+++ b/WebKitTools/QueueStatusServer/handlers/statusbubble.py
@@ -33,33 +33,18 @@ from google.appengine.ext.webapp import template
 
 from model.attachment import Attachment
 from model.workitems import WorkItems
-from model.queues import queues, name_with_underscores
+from model.queues import Queue
 
 
 class StatusBubble(webapp.RequestHandler):
-    # FIXME: This list probably belongs as part of a Queue object in queues.py
-    # Arrays are bubble_name, queue_name
-    _queues_to_display = [
-        ["style", "style-queue"],
-        ["cr-linux", "chromium-ews"],
-        ["gtk", "gtk-ews"],
-        ["qt", "qt-ews"],
-        ["mac", "mac-ews"],
-        ["win", "win-ews"],
-    ]
+    _queues_to_display = [queue for queue in Queue.all() if queue.is_ews()]
 
-    # This asserts that all of the queues listed above are valid queue names.
-    assert(reduce(operator.and_, map(lambda name_pair: name_pair[1] in queues, _queues_to_display)))
-
-    def _build_bubble(self, queue_name_pair, attachment):
-        bubble_name = queue_name_pair[0]
-        queue_name = queue_name_pair[1]
-
-        queue_status = attachment.status_for_queue(queue_name)
+    def _build_bubble(self, queue, attachment):
+        queue_status = attachment.status_for_queue(queue)
         bubble = {
-            "name": bubble_name,
+            "name": queue.short_name().lower(),
             "attachment_id": attachment.id,
-            "queue_position": attachment.position_in_queue(queue_name),
+            "queue_position": attachment.position_in_queue(queue),
             "state": attachment.state_from_queue_status(queue_status) if queue_status else "none",
             "status": queue_status,
         }
@@ -67,7 +52,7 @@ class StatusBubble(webapp.RequestHandler):
 
     def get(self, attachment_id):
         attachment = Attachment(int(attachment_id))
-        bubbles = [self._build_bubble(name_pair, attachment) for name_pair in self._queues_to_display]
+        bubbles = [self._build_bubble(queue, attachment) for queue in self._queues_to_display]
         template_values = {
             "bubbles": bubbles,
         }
diff --git a/WebKitTools/QueueStatusServer/handlers/statusbubble_unittest.py b/WebKitTools/QueueStatusServer/handlers/statusbubble_unittest.py
new file mode 100644
index 0000000..3ffbdaf
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/handlers/statusbubble_unittest.py
@@ -0,0 +1,62 @@
+# Copyright (C) 2010 Google, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Research in Motion Ltd. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+
+from handlers.statusbubble import StatusBubble
+from model.queues import Queue
+
+
+class MockAttachment(object):
+    def __init__(self):
+        self.id = 1
+
+    def status_for_queue(self, queue):
+        return None
+
+    def position_in_queue(self, queue):
+        return 1
+
+
+class StatusBubbleTest(unittest.TestCase):
+    def test_build_bubble(self):
+        bubble = StatusBubble()
+        queue = Queue("mac-ews")
+        attachment = MockAttachment()
+        bubble_dict = bubble._build_bubble(queue, attachment)
+        # FIXME: assertDictEqual (in Python 2.7) would be better to use here.
+        self.assertEqual(bubble_dict["name"], "mac")
+        self.assertEqual(bubble_dict["attachment_id"], 1)
+        self.assertEqual(bubble_dict["queue_position"], 1)
+        self.assertEqual(bubble_dict["state"], "none")
+        self.assertEqual(bubble_dict["status"], None)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/QueueStatusServer/handlers/submittoews.py b/WebKitTools/QueueStatusServer/handlers/submittoews.py
new file mode 100644
index 0000000..3ba4373
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/handlers/submittoews.py
@@ -0,0 +1,64 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+from google.appengine.ext import webapp, db
+from google.appengine.ext.webapp import template
+
+from handlers.updatebase import UpdateBase
+from model.attachment import Attachment
+from model.queues import Queue
+
+
+class SubmitToEWS(UpdateBase):
+    def get(self):
+        self.response.out.write(template.render("templates/submittoews.html", None))
+
+    def _should_add_to_ews_queue(self, queue, attachment):
+        # This assert() is here to make sure we're not submitting to the commit-queue.
+        # The commit-queue clients check each patch anyway, but there is not sense
+        # in adding things to the commit-queue when they won't be processed by it.
+        assert(queue.is_ews())
+        latest_status = attachment.status_for_queue(queue)
+        if not latest_status:
+            return True
+        # Only ever re-submit to the EWS if the EWS specifically requested a retry.
+        # This allows us to restart the EWS feeder queue, without all r? patches
+        # being retried as a result of that restart!
+        # In some future version we might add a "force" button to allow the user
+        # to override this restriction.
+        return latest_status.is_retry_request()
+
+    def _add_attachment_to_ews_queues(self, attachment):
+        for queue in Queue.all_ews():  # all_ews() currently includes the style-queue
+            if self._should_add_to_ews_queue(queue, attachment):
+                queue.work_items().add_work_item(attachment.id)
+
+    def post(self):
+        attachment_id = self._int_from_request("attachment_id")
+        attachment = Attachment(attachment_id)
+        self._add_attachment_to_ews_queues(attachment)
diff --git a/WebKitTools/QueueStatusServer/handlers/updatestatus.py b/WebKitTools/QueueStatusServer/handlers/updatestatus.py
index 89858b6..7301101 100644
--- a/WebKitTools/QueueStatusServer/handlers/updatestatus.py
+++ b/WebKitTools/QueueStatusServer/handlers/updatestatus.py
@@ -31,10 +31,10 @@ from google.appengine.ext import webapp, db
 from google.appengine.ext.webapp import template
 
 from handlers.updatebase import UpdateBase
-from model.activeworkitems import ActiveWorkItems
 from model.attachment import Attachment
 from model.queuestatus import QueueStatus
 
+
 class UpdateStatus(UpdateBase):
     def get(self):
         self.response.out.write(template.render("templates/updatestatus.html", None))
@@ -49,7 +49,9 @@ class UpdateStatus(UpdateBase):
         bug_id = self._int_from_request("bug_id")
         patch_id = self._int_from_request("patch_id")
         queue_name = self.request.get("queue_name")
+        bot_id = self.request.get("bot_id")
         queue_status.queue_name = queue_name
+        queue_status.bot_id = bot_id
         queue_status.active_bug_id = bug_id
         queue_status.active_patch_id = patch_id
         queue_status.message = self.request.get("status")
@@ -57,24 +59,8 @@ class UpdateStatus(UpdateBase):
         queue_status.results_file = db.Blob(str(results_file))
         return queue_status
 
-    @staticmethod
-    def _expire_item(key, item_id):
-        active_work_items = db.get(key)
-        active_work_items.expire_item(item_id)
-        active_work_items.put()
-
-    # FIXME: An explicit lock_release request would be cleaner than this magical "Retry" status.
-    def _update_active_work_items(self, queue_status):
-        if queue_status.message != "Retry":  # From AbstractQueue._retry_status
-            return
-        active_items = ActiveWorkItems.all().filter("queue_name =", queue_status.queue_name).get()
-        if not active_items:
-            return
-        return db.run_in_transaction(self._expire_item, active_items.key(), queue_status.active_patch_id)
-
     def post(self):
         queue_status = self._queue_status_from_request()
         queue_status.put()
-        self._update_active_work_items(queue_status)
         Attachment.dirty(queue_status.active_patch_id)
         self.response.out.write(queue_status.key().id())
diff --git a/WebKitTools/QueueStatusServer/handlers/updateworkitems.py b/WebKitTools/QueueStatusServer/handlers/updateworkitems.py
index f91beb4..16a9d49 100644
--- a/WebKitTools/QueueStatusServer/handlers/updateworkitems.py
+++ b/WebKitTools/QueueStatusServer/handlers/updateworkitems.py
@@ -30,7 +30,7 @@ from google.appengine.ext import webapp, db
 from google.appengine.ext.webapp import template
 
 from handlers.updatebase import UpdateBase
-from model.queues import queues
+from model.queues import Queue
 from model.workitems import WorkItems
 
 from datetime import datetime
@@ -40,16 +40,6 @@ class UpdateWorkItems(UpdateBase):
     def get(self):
         self.response.out.write(template.render("templates/updateworkitems.html", None))
 
-    def _work_items_for_queue(self, queue_name):
-        if queue_name not in queues:
-            self.response.out.write("\"%s\" is not in queues %s" % (queue_name, queues))
-            return None
-        work_items = WorkItems.all().filter("queue_name =", queue_name).get()
-        if not work_items:
-            work_items = WorkItems()
-            work_items.queue_name = queue_name
-        return work_items
-
     def _parse_work_items_string(self, items_string):
         # Our parsing could be much more robust.
         item_strings = items_string.split(" ") if items_string else []
@@ -57,10 +47,13 @@ class UpdateWorkItems(UpdateBase):
 
     def _work_items_from_request(self):
         queue_name = self.request.get("queue_name")
-        work_items = self._work_items_for_queue(queue_name)
-        if not work_items:
+        queue = Queue.queue_with_name(queue_name)
+        if not queue:
+            self.response.out.write("\"%s\" is not in queues %s" % (queue_name, Queue.all()))
             return None
+
         items_string = self.request.get("work_items")
+        work_items = queue.work_items()
         work_items.item_ids = self._parse_work_items_string(items_string)
         work_items.date = datetime.now()
         return work_items
diff --git a/WebKitTools/QueueStatusServer/main.py b/WebKitTools/QueueStatusServer/main.py
index 93227ca..3fbee5c 100644
--- a/WebKitTools/QueueStatusServer/main.py
+++ b/WebKitTools/QueueStatusServer/main.py
@@ -40,8 +40,10 @@ from handlers.patch import Patch
 from handlers.patchstatus import PatchStatus
 from handlers.queuestatus import QueueStatus
 from handlers.recentstatus import QueuesOverview
+from handlers.releasepatch import ReleasePatch
 from handlers.showresults import ShowResults
 from handlers.statusbubble import StatusBubble
+from handlers.submittoews import SubmitToEWS
 from handlers.svnrevision import SVNRevision
 from handlers.updatestatus import UpdateStatus
 from handlers.updatesvnrevision import UpdateSVNRevision
@@ -56,11 +58,13 @@ routes = [
     ('/gc', GC),
     (r'/patch-status/(.*)/(.*)', PatchStatus),
     (r'/patch/(.*)', Patch),
+    (r'/submit-to-ews', SubmitToEWS),
     (r'/results/(.*)', ShowResults),
     (r'/status-bubble/(.*)', StatusBubble),
     (r'/svn-revision/(.*)', SVNRevision),
     (r'/queue-status/(.*)', QueueStatus),
     (r'/next-patch/(.*)', NextPatch),
+    (r'/release-patch', ReleasePatch),
     ('/update-status', UpdateStatus),
     ('/update-work-items', UpdateWorkItems),
     ('/update-svn-revision', UpdateSVNRevision),
diff --git a/WebKitTools/QueueStatusServer/model/activeworkitems.py b/WebKitTools/QueueStatusServer/model/activeworkitems.py
index a244c7d..ab5d7a6 100644
--- a/WebKitTools/QueueStatusServer/model/activeworkitems.py
+++ b/WebKitTools/QueueStatusServer/model/activeworkitems.py
@@ -31,8 +31,10 @@ from google.appengine.ext import db
 from datetime import timedelta, datetime
 import time
 
+from model.queuepropertymixin import QueuePropertyMixin
 
-class ActiveWorkItems(db.Model):
+
+class ActiveWorkItems(db.Model, QueuePropertyMixin):
     queue_name = db.StringProperty()
     item_ids = db.ListProperty(int)
     item_dates = db.ListProperty(float)
@@ -55,10 +57,19 @@ class ActiveWorkItems(db.Model):
         self.item_ids.append(pair[0])
         self.item_dates.append(pair[1])
 
-    def expire_item(self, item_id):
+    def _remove_item(self, item_id):
         nonexpired_pairs = [pair for pair in self._item_time_pairs() if pair[0] != item_id]
         self._set_item_time_pairs(nonexpired_pairs)
 
+    @staticmethod
+    def _expire_item(key, item_id):
+        active_work_items = db.get(key)
+        active_work_items._remove_item(item_id)
+        active_work_items.put()
+
+    def expire_item(self, item_id):
+        return db.run_in_transaction(self._expire_item, self.key(), item_id)
+
     def deactivate_expired(self, now):
         one_hour_ago = time.mktime((now - timedelta(minutes=60)).timetuple())
         nonexpired_pairs = [pair for pair in self._item_time_pairs() if pair[1] > one_hour_ago]
diff --git a/WebKitTools/QueueStatusServer/model/activeworkitems_unitest.py b/WebKitTools/QueueStatusServer/model/activeworkitems_unitest.py
new file mode 100644
index 0000000..6d915a1
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/model/activeworkitems_unitest.py
@@ -0,0 +1,52 @@
+# Copyright (C) 2010 Google, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Research in Motion Ltd. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+from datetime import datetime
+
+from model.activeworkitems import ActiveWorkItems
+
+
+class ActiveWorkItemsTest(unittest.TestCase):
+    def test_basic(self):
+        items = ActiveWorkItems()
+        queued_items = [1, 2]
+        time = datetime.now()
+        self.assertEqual(items.next_item(queued_items, time), 1)
+        self.assertEqual(items.next_item([1], time), None)
+        self.assertEqual(items.next_item([], time), None)
+
+        self.assertEqual(items.time_for_item(1), time)
+        self.assertEqual(items.time_for_item(2), None)
+
+        items.expire_item(1)
+        self.assertEqual(items.time_for_item(1), None)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/QueueStatusServer/model/attachment.py b/WebKitTools/QueueStatusServer/model/attachment.py
index 9ae59e8..f98f265 100644
--- a/WebKitTools/QueueStatusServer/model/attachment.py
+++ b/WebKitTools/QueueStatusServer/model/attachment.py
@@ -30,7 +30,7 @@ import re
 
 from google.appengine.api import memcache
 
-from model.queues import queues, name_with_underscores
+from model.queues import Queue
 from model.queuestatus import QueueStatus
 from model.workitems import WorkItems
 
@@ -87,13 +87,12 @@ class Attachment(object):
             return "pending"
         return None
 
-    def position_in_queue(self, queue_name):
-        return self._queue_positions().get(queue_name)
+    def position_in_queue(self, queue):
+        return self._queue_positions().get(queue.name())
 
-    def status_for_queue(self, queue_name):
-        underscore_queue_name = name_with_underscores(queue_name)
+    def status_for_queue(self, queue):
         # summary() is a horrible API and should be killed.
-        queue_summary = self.summary().get(underscore_queue_name)
+        queue_summary = self.summary().get(queue.name_with_underscores())
         if not queue_summary:
             return None
         return queue_summary.get("status")
@@ -109,16 +108,8 @@ class Attachment(object):
         return self._cached_queue_positions
 
     def _calculate_queue_positions(self):
-        queue_positions = {}
-        for work_items in WorkItems.all().fetch(limit=len(queues)):
-            queue_name = str(work_items.queue_name)
-            try:
-                position = work_items.item_ids.index(self.id)
-                # Display 1-based indecies to the user.
-                queue_positions[queue_name] = position + 1
-            except ValueError, e:
-                queue_positions[queue_name] = None
-        return queue_positions
+        all_work_items = WorkItems.all().fetch(limit=len(Queue.all()))
+        return dict([(items.queue.name(), items.display_position_for_attachment(self.id)) for items in all_work_items])
 
     # FIXME: This is controller/view code and does not belong in a model.
     def _fetch_summary(self):
@@ -130,11 +121,12 @@ class Attachment(object):
             return summary
         summary["bug_id"] = first_status.active_bug_id
 
-        for queue in queues:
-            summary[queue] = None
-            status = QueueStatus.all().filter('queue_name =', queue).filter('active_patch_id =', self.id).order('-date').get()
+        for queue in Queue.all():
+            summary[queue.name_with_underscores()] = None
+            status = QueueStatus.all().filter('queue_name =', queue.name()).filter('active_patch_id =', self.id).order('-date').get()
             if status:
-                summary[name_with_underscores(queue)] = {
+                # summary() is a horrible API and should be killed.
+                summary[queue.name_with_underscores()] = {
                     "state": self.state_from_queue_status(status),
                     "status": status,
                 }
diff --git a/WebKitTools/QueueStatusServer/model/queuepropertymixin.py b/WebKitTools/QueueStatusServer/model/queuepropertymixin.py
new file mode 100644
index 0000000..a462586
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/model/queuepropertymixin.py
@@ -0,0 +1,39 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+class QueuePropertyMixin(object):
+    def _queue_getter(self):
+        # Import at runtime to avoid circular imports
+        from model.queues import Queue
+        return Queue.queue_with_name(self.queue_name)
+
+    def _queue_setter(self, queue):
+        self.queue_name = queue.name() if queue else None
+
+    queue = property(_queue_getter, _queue_setter)
diff --git a/WebKitTools/QueueStatusServer/model/queuepropertymixin_unittest.py b/WebKitTools/QueueStatusServer/model/queuepropertymixin_unittest.py
new file mode 100644
index 0000000..9a301fe
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/model/queuepropertymixin_unittest.py
@@ -0,0 +1,52 @@
+# Copyright (C) 2010 Google, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Research in Motion Ltd. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from model.queuepropertymixin import QueuePropertyMixin
+from model.queues import Queue
+
+
+class ObjectWithQueueName(QueuePropertyMixin):
+    def __init__(self):
+        self.queue_name = None
+
+
+class QueuePropertyMixinTest(unittest.TestCase):
+    def test_queue_property(self):
+        test_object = ObjectWithQueueName()
+        mac_ews = Queue("mac-ews")
+        test_object.queue = mac_ews
+        self.assertEquals(test_object.queue.name(), "mac-ews")
+        self.assertEquals(test_object.queue_name, "mac-ews")
+        test_object.queue = None
+        self.assertEquals(test_object.queue_name, None)
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/QueueStatusServer/model/queues.py b/WebKitTools/QueueStatusServer/model/queues.py
index 9658dd4..1d46f89 100644
--- a/WebKitTools/QueueStatusServer/model/queues.py
+++ b/WebKitTools/QueueStatusServer/model/queues.py
@@ -26,39 +26,88 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+
 import re
 
+from model.activeworkitems import ActiveWorkItems
+from model.workitems import WorkItems
+
+
+class Queue(object):
+
+    # Eventually the list of queues may be stored in the data store.
+    _all_queue_names = [
+        "commit-queue",
+        "style-queue",
+        "chromium-ews",
+        "qt-ews",
+        "gtk-ews",
+        "mac-ews",
+        "win-ews",
+        "efl-ews",
+        "cr-mac-ews",
+    ]
+
+    def __init__(self, name):
+        assert(name in self._all_queue_names)
+        self._name = name
+
+    @classmethod
+    def queue_with_name(cls, queue_name):
+        if queue_name not in cls._all_queue_names:
+            return None
+        return Queue(queue_name)
+
+    @classmethod
+    def all(cls):
+        return [Queue(name) for name in cls._all_queue_names]
+
+    @classmethod
+    def all_ews(cls):
+        return [queue for queue in cls.all() if queue.is_ews()]
+
+    def name(self):
+        return self._name
+
+    def work_items(self):
+        key_name = "work-items-%s" % (self._name)
+        return WorkItems.get_or_insert(key_name=key_name, queue_name=self._name)
 
-queues = [
-    "commit-queue",
-    "style-queue",
-    "chromium-ews",
-    "qt-ews",
-    "gtk-ews",
-    "mac-ews",
-    "win-ews",
-    "efl-ews",
-]
+    # FIXME: active_work_items is a bad name for this lock-table.
+    def active_work_items(self):
+        key_name = "active-work-items-%s" % (self._name)
+        return ActiveWorkItems.get_or_insert(key_name=key_name, queue_name=self._name)
 
+    def _caplitalize_after_dash(self, string):
+        return "-".join([word[0].upper() + word[1:] for word in string.split("-")])
 
-# FIXME: We need some sort of Queue object.
-def _title_case(string):
-    words = string.split(" ")
-    words = map(lambda word: word.capitalize(), words)
-    return " ".join(words)
+    # For use in status bubbles or table headers
+    def short_name(self):
+        # HACK: chromium-ews is incorrectly named.
+        short_name = self._name.replace("chromium-ews", "Cr-Linux-ews")
+        short_name = short_name.replace("-ews", "")
+        short_name = short_name.replace("-queue", "")
+        return self._caplitalize_after_dash(short_name.capitalize())
 
+    def display_name(self):
+        # HACK: chromium-ews is incorrectly named.
+        display_name = self._name.replace("chromium-ews", "cr-linux-ews")
 
-def display_name_for_queue(queue_name):
-    # HACK: chromium-ews is incorrectly named.
-    display_name = queue_name.replace("chromium-ews", "cr-linux-ews")
+        display_name = display_name.replace("-", " ")
+        display_name = display_name.replace("cr", "chromium")
+        display_name = display_name.title()
+        display_name = display_name.replace("Ews", "EWS")
+        return display_name
 
-    display_name = display_name.replace("-", " ")
-    display_name = display_name.replace("cr", "chromium")
-    display_name = _title_case(display_name)
-    display_name = display_name.replace("Ews", "EWS")
-    return display_name
+    _dash_regexp = re.compile("-")
 
+    def name_with_underscores(self):
+        return self._dash_regexp.sub("_", self._name)
 
-def name_with_underscores(dashed_name):
-    regexp = re.compile("-")
-    return regexp.sub("_", dashed_name)
+    def is_ews(self):
+        # Note: The style-queue is just like an EWS in that it has an EWS
+        # bubble, and it works off of the r? patches.  If at some later
+        # point code wants to not treat the style-queue as an EWS
+        # (e.g. expecting is_ews() queues to have build results?)
+        # then we should fix all callers and change this check.
+        return self._name.endswith("-ews") or self._name == "style-queue"
diff --git a/WebKitTools/QueueStatusServer/model/queues_unittest.py b/WebKitTools/QueueStatusServer/model/queues_unittest.py
new file mode 100644
index 0000000..33070a8
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/model/queues_unittest.py
@@ -0,0 +1,73 @@
+# Copyright (C) 2010 Google, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Research in Motion Ltd. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+
+from model.queues import Queue
+
+
+class QueueTest(unittest.TestCase):
+    def test_is_ews(self):
+        mac_ews = Queue("mac-ews")
+        self.assertTrue(mac_ews.is_ews())
+
+    def test_queue_with_name(self):
+        self.assertEqual(Queue.queue_with_name("bogus"), None)
+        self.assertEqual(Queue.queue_with_name("mac-ews").name(), "mac-ews")
+        self.assertRaises(AssertionError, Queue, ("bogus"))
+
+    def _assert_short_name(self, queue_name, short_name):
+        self.assertEquals(Queue(queue_name).short_name(), short_name)
+
+    def test_short_name(self):
+        self._assert_short_name("mac-ews", "Mac")
+        self._assert_short_name("chromium-ews", "Cr-Linux")
+        self._assert_short_name("commit-queue", "Commit")
+        self._assert_short_name("style-queue", "Style")
+
+    def _assert_display_name(self, queue_name, short_name):
+        self.assertEquals(Queue(queue_name).display_name(), short_name)
+
+    def test_display_name(self):
+        self._assert_display_name("mac-ews", "Mac EWS")
+        self._assert_display_name("chromium-ews", "Chromium Linux EWS")
+        self._assert_display_name("commit-queue", "Commit Queue")
+        self._assert_display_name("style-queue", "Style Queue")
+
+    def _assert_name_with_underscores(self, queue_name, short_name):
+        self.assertEquals(Queue(queue_name).name_with_underscores(), short_name)
+
+    def test_name_with_underscores(self):
+        self._assert_name_with_underscores("mac-ews", "mac_ews")
+        self._assert_name_with_underscores("chromium-ews", "chromium_ews")
+        self._assert_name_with_underscores("commit-queue", "commit_queue")
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/QueueStatusServer/model/queuestatus.py b/WebKitTools/QueueStatusServer/model/queuestatus.py
index 3d7e599..8002f89 100644
--- a/WebKitTools/QueueStatusServer/model/queuestatus.py
+++ b/WebKitTools/QueueStatusServer/model/queuestatus.py
@@ -27,12 +27,18 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 from google.appengine.ext import db
+from model.queuepropertymixin import QueuePropertyMixin
 
-class QueueStatus(db.Model):
+
+class QueueStatus(db.Model, QueuePropertyMixin):
     author = db.UserProperty()
     queue_name = db.StringProperty()
+    bot_id = db.StringProperty()
     active_bug_id = db.IntegerProperty()
     active_patch_id = db.IntegerProperty()
     message = db.StringProperty(multiline=True)
     date = db.DateTimeProperty(auto_now_add=True)
     results_file = db.BlobProperty()
+
+    def is_retry_request(self):
+        return self.message == "Retry"  # From AbstractQueue._retry_status
diff --git a/WebKitTools/QueueStatusServer/model/svnrevision.py b/WebKitTools/QueueStatusServer/model/svnrevision.py
index 70ec0cc..f5d3644 100644
--- a/WebKitTools/QueueStatusServer/model/svnrevision.py
+++ b/WebKitTools/QueueStatusServer/model/svnrevision.py
@@ -28,6 +28,7 @@
 
 from google.appengine.ext import db
 
+
 class SVNRevision(db.Model):
     number = db.IntegerProperty()
     broken_bots = db.StringListProperty(default=[])
diff --git a/WebKitTools/QueueStatusServer/model/workitems.py b/WebKitTools/QueueStatusServer/model/workitems.py
index 3ea59cb..fae6830 100644
--- a/WebKitTools/QueueStatusServer/model/workitems.py
+++ b/WebKitTools/QueueStatusServer/model/workitems.py
@@ -28,8 +28,40 @@
 
 from google.appengine.ext import db
 
+from model.queuepropertymixin import QueuePropertyMixin
 
-class WorkItems(db.Model):
+
+class WorkItems(db.Model, QueuePropertyMixin):
     queue_name = db.StringProperty()
     item_ids = db.ListProperty(int)
     date = db.DateTimeProperty(auto_now_add=True)
+
+    def display_position_for_attachment(self, attachment_id):
+        """Returns a 1-based index corresponding to the position
+        of the attachment_id in the queue.  If the attachment is
+        not in this queue, this returns None"""
+        if attachment_id in self.item_ids:
+            return self.item_ids.index(attachment_id) + 1
+        return None
+
+    @staticmethod
+    def _unguarded_add(key, attachment_id):
+        work_items = db.get(key)
+        if attachment_id in work_items.item_ids:
+            return
+        work_items.item_ids.append(attachment_id)
+        work_items.put()
+
+    def add_work_item(self, attachment_id):
+        db.run_in_transaction(self._unguarded_add, self.key(), attachment_id)
+
+    @staticmethod
+    def _unguarded_remove(key, attachment_id):
+        work_items = db.get(key)
+        if attachment_id in work_items.item_ids:
+            # We should never have more than one entry for a work item, so we only need remove the first.
+            work_items.item_ids.remove(attachment_id)
+        work_items.put()
+
+    def remove_work_item(self, attachment_id):
+        db.run_in_transaction(self._unguarded_remove, self.key(), attachment_id)
diff --git a/WebKitTools/QueueStatusServer/model/workitems_unittest.py b/WebKitTools/QueueStatusServer/model/workitems_unittest.py
new file mode 100644
index 0000000..d53302e
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/model/workitems_unittest.py
@@ -0,0 +1,53 @@
+# Copyright (C) 2010 Google, Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Research in Motion Ltd. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+
+from model.workitems import WorkItems
+
+
+class WorkItemsTest(unittest.TestCase):
+    def test_display_position_for_attachment(self):
+        items = WorkItems()
+        items.item_ids = [0, 1, 2]
+        self.assertEquals(items.display_position_for_attachment(0), 1)
+        self.assertEquals(items.display_position_for_attachment(1), 2)
+        self.assertEquals(items.display_position_for_attachment(3), None)
+
+    def test_remove_work_item(self):
+        items = WorkItems()
+        items.item_ids = [0, 1, 2]
+        items.remove_work_item(0)
+        self.assertEqual(items.item_ids, [1, 2])
+        items.remove_work_item(4)  # Should not throw
+        self.assertEqual(items.item_ids, [1, 2])
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/QueueStatusServer/templates/releasepatch.html b/WebKitTools/QueueStatusServer/templates/releasepatch.html
new file mode 100644
index 0000000..cbd6d6f
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/templates/releasepatch.html
@@ -0,0 +1,3 @@
+<form name="release_patch" enctype="multipart/form-data" method="post">
+Patch to release: <input name="attachment_id"> from <input name="queue_name"><input type="submit" value="Release locks and remove from queue"></div>
+</form>
diff --git a/WebKitTools/QueueStatusServer/templates/statusbubble.html b/WebKitTools/QueueStatusServer/templates/statusbubble.html
index 3102741..f11544d 100644
--- a/WebKitTools/QueueStatusServer/templates/statusbubble.html
+++ b/WebKitTools/QueueStatusServer/templates/statusbubble.html
@@ -39,6 +39,9 @@ body {
   background-color: #E0B0FF;
   border: 1px solid #ACA0B3;
 }
+.queue_position {
+    font-size: 9px;
+}
 </style>
 <script>
 function statusDetail(patch_id) {
@@ -53,7 +56,7 @@ function statusDetail(patch_id) {
     title="{{ bubble.status.date|timesince }} ago"{% endif %}>
   {{ bubble.name }}
   {% if bubble.queue_position %}
-  (#{{ bubble.queue_position }})
+  <span class="queue_position">#{{ bubble.queue_position }}</span>
   {% endif %}
 </div>
 {% endfor %}
diff --git a/WebKitTools/QueueStatusServer/templates/submittoews.html b/WebKitTools/QueueStatusServer/templates/submittoews.html
new file mode 100644
index 0000000..fb9d8aa
--- /dev/null
+++ b/WebKitTools/QueueStatusServer/templates/submittoews.html
@@ -0,0 +1,3 @@
+<form name="submit_to_ews" enctype="multipart/form-data" method="post">
+Patch to submit: <input name="attachment_id"><input type="submit" value="Submit for EWS Processing"></div>
+</form>
diff --git a/WebKitTools/QueueStatusServer/templates/updatestatus.html b/WebKitTools/QueueStatusServer/templates/updatestatus.html
index 9343c60..0f98ba4 100644
--- a/WebKitTools/QueueStatusServer/templates/updatestatus.html
+++ b/WebKitTools/QueueStatusServer/templates/updatestatus.html
@@ -1,6 +1,10 @@
 <form name="update_status" enctype="multipart/form-data" method="post">
 Update status for a queue: <input name="queue_name">
  <div>
+     Bot Id:
+    <input name="bot_id">
+ </div>
+ <div>
      Active Bug Id:
     <input name="bug_id">
  </div>
diff --git a/WebKitTools/Scripts/VCSUtils.pm b/WebKitTools/Scripts/VCSUtils.pm
index dd08baa..8d7e766 100644
--- a/WebKitTools/Scripts/VCSUtils.pm
+++ b/WebKitTools/Scripts/VCSUtils.pm
@@ -1,5 +1,6 @@
 # Copyright (C) 2007, 2008, 2009 Apple Inc.  All rights reserved.
 # Copyright (C) 2009, 2010 Chris Jerdonek (chris.jerdonek@gmail.com)
+# Copyright (C) Research In Motion Limited 2010. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -136,6 +137,18 @@ sub toWindowsLineEndings
     return $text;
 }
 
+# Note, this method will not error if the file corresponding to the $source path does not exist.
+sub scmMoveOrRenameFile
+{
+    my ($source, $destination) = @_;
+    return if ! -e $source;
+    if (isSVN()) {
+        system("svn", "move", $source, $destination);
+    } elsif (isGit()) {
+        system("git", "mv", $source, $destination);
+    }
+}
+
 # Note, this method will not error if the file corresponding to the path does not exist.
 sub scmToggleExecutableBit
 {
@@ -1284,6 +1297,16 @@ sub setChangeLogDateAndReviewer($$$)
 # context.
 #
 # This subroutine has unit tests in VCSUtils_unittest.pl.
+#
+# Returns $changeLogHashRef:
+#   $changeLogHashRef: a hash reference representing a change log patch.
+#     patch: a ChangeLog patch equivalent to the given one, but with the
+#            newest ChangeLog entry inserted at the top of the file, if possible.
+#     hasOverlappingLines: the value 1 if the change log entry overlaps
+#                          some lines of another change log entry. This can
+#                          happen when deliberately inserting a new ChangeLog
+#                          entry earlier in the file above an entry with
+#                          the same date and author.                     
 sub fixChangeLogPatch($)
 {
     my $patch = shift; # $patch will only contain patch fragments for ChangeLog.
@@ -1301,10 +1324,12 @@ sub fixChangeLogPatch($)
         }
     }
     my $chunkStartIndex = ++$i;
+    my %changeLogHashRef;
 
     # Optimization: do not process if new lines already begin the chunk.
     if (substr($lines[$i], 0, 1) eq "+") {
-        return $patch;
+        $changeLogHashRef{patch} = $patch;
+        return \%changeLogHashRef;
     }
 
     # Skip to first line of newly added ChangeLog entry.
@@ -1321,10 +1346,12 @@ sub fixChangeLogPatch($)
         } elsif ($firstChar eq " " or $firstChar eq "+") {
             next;
         }
-        return $patch; # Do not change if, for example, "-" or "@" found.
+        $changeLogHashRef{patch} = $patch; # Do not change if, for example, "-" or "@" found.
+        return \%changeLogHashRef;
     }
     if ($i >= @lines) {
-        return $patch; # Do not change if date not found.
+        $changeLogHashRef{patch} = $patch; # Do not change if date not found.
+        return \%changeLogHashRef;
     }
     my $dateStartIndex = $i;
 
@@ -1367,7 +1394,8 @@ sub fixChangeLogPatch($)
         my $text = substr($line, 1);
         my $newLine = pop(@overlappingLines);
         if ($text ne substr($newLine, 1)) {
-            return $patch; # Unexpected difference.
+            $changeLogHashRef{patch} = $patch; # Unexpected difference.
+            return \%changeLogHashRef;
         }
         $lines[$i] = "+$text";
     }
@@ -1379,7 +1407,8 @@ sub fixChangeLogPatch($)
         # FIXME: Handle errors differently from ChangeLog files that
         # are okay but should not be altered. That way we can find out
         # if improvements to the script ever become necessary.
-        return $patch; # Error: unexpected patch string format.
+        $changeLogHashRef{patch} = $patch; # Error: unexpected patch string format.
+        return \%changeLogHashRef;
     }
     my $skippedFirstLineCount = $1 - 1;
     my $oldSourceLineCount = $2;
@@ -1388,7 +1417,9 @@ sub fixChangeLogPatch($)
     if (@overlappingLines != $skippedFirstLineCount) {
         # This can happen, for example, when deliberately inserting
         # a new ChangeLog entry earlier in the file.
-        return $patch;
+        $changeLogHashRef{hasOverlappingLines} = 1;
+        $changeLogHashRef{patch} = $patch;
+        return \%changeLogHashRef;
     }
     # If @overlappingLines > 0, this is where we make use of the
     # assumption that the beginning of the source file was not modified.
@@ -1398,7 +1429,8 @@ sub fixChangeLogPatch($)
     my $targetLineCount = $oldTargetLineCount + @overlappingLines - $deletedLineCount;
     $lines[$chunkStartIndex - 1] = "@@ -1,$sourceLineCount +1,$targetLineCount @@";
 
-    return join($lineEnding, @lines) . "\n"; # patch(1) expects an extra trailing newline.
+    $changeLogHashRef{patch} = join($lineEnding, @lines) . "\n"; # patch(1) expects an extra trailing newline.
+    return \%changeLogHashRef;
 }
 
 # This is a supporting method for runPatchCommand.
@@ -1550,7 +1582,12 @@ sub mergeChangeLogs($$$)
     unlink("${fileNewer}.rej");
 
     open(PATCH, "| patch --force --fuzz=3 --binary $fileNewer > " . File::Spec->devnull()) or die $!;
-    print PATCH ($traditionalReject ? $patch : fixChangeLogPatch($patch));
+    if ($traditionalReject) {
+        print PATCH $patch;
+    } else {
+        my $changeLogHash = fixChangeLogPatch($patch);
+        print PATCH $changeLogHash->{patch};
+    }
     close(PATCH);
 
     my $result = !exitStatus($?);
diff --git a/WebKitTools/Scripts/build-api-tests b/WebKitTools/Scripts/build-api-tests
new file mode 100755
index 0000000..9db6653
--- /dev/null
+++ b/WebKitTools/Scripts/build-api-tests
@@ -0,0 +1,70 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+use strict;
+use File::Basename;
+use FindBin;
+use Getopt::Long qw(:config pass_through);
+use lib $FindBin::Bin;
+use webkitdirs;
+use POSIX;
+
+my $showHelp = 0;
+my $clean = 0;
+
+my $programName = basename($0);
+my $usage = <<EOF;
+Usage: $programName [options] [options to pass to build system]
+  --help        Show this help message
+  --clean       Clean up the build directory
+EOF
+
+GetOptions(
+    'help' => \$showHelp,
+    'clean' => \$clean,
+);
+
+if ($showHelp) {
+   print STDERR $usage;
+   exit 1;
+}
+
+checkRequiredSystemConfig();
+setConfiguration();
+chdirWebKit();
+
+# Build
+chdir "WebKitTools/TestWebKitAPI" or die;
+
+my $result;
+if (isAppleMacWebKit()) {
+    $result = buildXCodeProject("TestWebKitAPI", $clean, XcodeOptions(), @ARGV);
+} elsif (isAppleWinWebKit()) {
+    $result = buildVisualStudioProject("win/TestWebKitAPI.sln", $clean);
+} else {
+    die "TestWebKitAPI is not supported on this platform.\n";
+}
+
+exit exitStatus($result);
diff --git a/WebKitTools/Scripts/build-webkit b/WebKitTools/Scripts/build-webkit
index bc1e8ad..e7f9d1f 100755
--- a/WebKitTools/Scripts/build-webkit
+++ b/WebKitTools/Scripts/build-webkit
@@ -57,7 +57,7 @@ my $prefixPath;
 my $makeArgs;
 my $startTime = time();
 
-my ($linkPrefetchSupport, $threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $clientBasedGeolocationSupport, $databaseSupport, $datagridSupport, $datalistSupport,
+my ($linkPrefetchSupport, $accelerated2dCanvasSupport, $threeDCanvasSupport, $threeDRenderingSupport, $channelMessagingSupport, $clientBasedGeolocationSupport, $databaseSupport, $datagridSupport, $datalistSupport,
     $domStorageSupport, $eventsourceSupport, $filtersSupport, $geolocationSupport, $iconDatabaseSupport, $imageResizerSupport, $indexedDatabaseSupport, $inputSpeechSupport,
     $javaScriptDebuggerSupport, $mathmlSupport, $offlineWebApplicationSupport, $rubySupport, $systemMallocSupport, $sandboxSupport, $sharedWorkersSupport,
     $svgSupport, $svgAnimationSupport, $svgAsImageSupport, $svgDOMObjCBindingsSupport, $svgFontsSupport,
@@ -69,6 +69,9 @@ my @features = (
     { option => "link-prefetch", desc => "Toggle pre fetching support",
       define => "ENABLE_LINK_PREFETCH", default => 0, value => \$linkPrefetchSupport },
 
+    { option => "accelerated-2d-canvas", desc => "Toggle accelerated 2D canvas support",
+      define => "ENABLE_ACCELERATED_2D_CANVAS", default => 0, value => \$accelerated2dCanvasSupport },
+
     { option => "3d-canvas", desc => "Toggle 3D canvas support",
       define => "ENABLE_3D_CANVAS", default => (isAppleMacWebKit() && !isTiger() && !isLeopard()), value => \$threeDCanvasSupport },
 
@@ -241,7 +244,7 @@ Usage: $programName [options] [options to pass to build system]
   --help                            Show this help message
   --clean                           Cleanup the build directory
   --debug                           Compile in debug mode
-  --cairo-win32                     Build using Cairo (rather than CoreGraphics) on Windows
+  --wincairo                        Build using Cairo (rather than CoreGraphics) on Windows
   --chromium                        Build the Chromium port on Mac/Win/Linux
   --gtk                             Build the GTK+ port
   --qt                              Build the Qt port
diff --git a/WebKitTools/Scripts/build-webkittestrunner b/WebKitTools/Scripts/build-webkittestrunner
index dbc36d1..6cb6ac8 100755
--- a/WebKitTools/Scripts/build-webkittestrunner
+++ b/WebKitTools/Scripts/build-webkittestrunner
@@ -63,6 +63,9 @@ if (isAppleMacWebKit()) {
     $result = buildXCodeProject("WebKitTestRunner", $clean, XcodeOptions(), @ARGV);
 } elsif (isAppleWinWebKit()) {
     $result = buildVisualStudioProject("WebKitTestRunner.sln", $clean);
+} elsif (isQt()) {
+    # Qt builds everything in one shot. No need to build anything here.
+    $result = 0;
 } else {
     die "WebKitTestRunner is not supported on this platform.\n";
 }
diff --git a/WebKitTools/Scripts/check-Xcode-source-file-types b/WebKitTools/Scripts/check-Xcode-source-file-types
new file mode 100755
index 0000000..57a70b9
--- /dev/null
+++ b/WebKitTools/Scripts/check-Xcode-source-file-types
@@ -0,0 +1,168 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2007, 2008, 2009, 2010 Apple Inc.  All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Script to check that source file extensions match file types in Xcode project.pbxproj files.
+
+# TODO
+# - Add support for file types other than source code files.
+# - Can't differentiate between sourcecode.c.h and sourcecode.cpp.h.
+#   (Hint: Use gcc -x c/objective-c/c++/objective-c++ -E.  It will
+#   take time to check each header using gcc, so make it a switch.)
+
+use strict;
+
+use File::Basename;
+use File::Spec;
+use File::Temp qw(tempfile);
+use Getopt::Long;
+
+# Map of Xcode file types to file extensions.
+my %typeExtensionMap = qw(
+    sourcecode.c.c        .c
+    sourcecode.c.h        .h
+    sourcecode.c.objc     .m
+    sourcecode.cpp.h      .h
+    sourcecode.cpp.cpp    .cpp
+    sourcecode.cpp.objcpp .mm
+    sourcecode.exports    .exp
+    sourcecode.javascript .js
+    sourcecode.make       .make
+    sourcecode.mig        .defs
+    sourcecode.yacc       .y
+);
+
+# Map of file extensions to Xcode file types.
+my %extensionTypeMap = map { $typeExtensionMap{$_} => $_ } keys %typeExtensionMap;
+$extensionTypeMap{'.h'} = 'sourcecode.c.h'; # See TODO list.
+
+my $shouldFixIssues = 0;
+my $printWarnings = 1;
+my $showHelp;
+
+my $getOptionsResult = GetOptions(
+    'f|fix'          => \$shouldFixIssues,
+    'h|help'         => \$showHelp,
+    'w|warnings!'    => \$printWarnings,
+);
+
+if (scalar(@ARGV) == 0 && !$showHelp) {
+    print STDERR "ERROR: No Xcode project files (project.pbxproj) listed on command-line.\n";
+    undef $getOptionsResult;
+}
+
+if (!$getOptionsResult || $showHelp) {
+    print STDERR <<__END__;
+Usage: @{[ basename($0) ]} [options] path/to/project.pbxproj [path/to/project.pbxproj ...]
+  -f|--fix            fix mismatched types in Xcode project file
+  -h|--help           show this help message
+  -w|--[no-]warnings  show or suppress warnings (default: show warnings)
+__END__
+    exit 1;
+}
+
+for my $projectFile (@ARGV) {
+    my $issuesFound = 0;
+    my $issuesFixed = 0;
+
+    if (basename($projectFile) =~ /\.xcodeproj$/) {
+        $projectFile = File::Spec->catfile($projectFile, "project.pbxproj");
+    }
+
+    if (basename($projectFile) ne "project.pbxproj") {
+        print STDERR "WARNING: Not an Xcode project file: $projectFile\n" if $printWarnings;
+        next;
+    }
+
+    open(IN, "< $projectFile") || die "Could not open $projectFile: $!";
+
+    my ($OUT, $tempFileName);
+    if ($shouldFixIssues) {
+        ($OUT, $tempFileName) = tempfile(
+            basename($projectFile) . "-XXXXXXXX",
+            DIR => dirname($projectFile),
+            UNLINK => 0,
+        );
+
+        # Clean up temp file in case of die()
+        $SIG{__DIE__} = sub {
+            close(IN);
+            close($OUT);
+            unlink($tempFileName);
+        };
+    }
+
+    # Fast-forward to "Begin PBXFileReference section".
+    while (my $line = <IN>) {
+        print $OUT $line if $shouldFixIssues;
+        last if $line =~ m#^\Q/* Begin PBXFileReference section */\E$#;
+    }
+
+    while (my $line = <IN>) {
+        if ($line =~ m#^\Q/* End PBXFileReference section */\E$#) {
+            print $OUT $line if $shouldFixIssues;
+            last;
+        }
+
+        if ($line =~ m#^\s*[A-Z0-9]{24} /\* (.+) \*/\s+=\s+\{.*\s+explicitFileType = (sourcecode[^;]*);.*\s+path = ([^;]+);.*\};$#) {
+            my $fileName = $1;
+            my $fileType = $2;
+            my $filePath = $3;
+            my (undef, undef, $fileExtension) = map { lc($_) } fileparse(basename($filePath), qr{\.[^.]+$});
+
+            if (!exists $typeExtensionMap{$fileType}) {
+                $issuesFound++;
+                print STDERR "WARNING: Unknown file type '$fileType' for file '$filePath'.\n" if $printWarnings;
+            } elsif ($typeExtensionMap{$fileType} ne $fileExtension) {
+                $issuesFound++;
+                print STDERR "WARNING: Incorrect file type '$fileType' for file '$filePath'.\n" if $printWarnings;
+                $line =~ s/(\s+)explicitFileType( = )(sourcecode[^;]*);/$1lastKnownFileType$2$extensionTypeMap{$fileExtension};/;
+                $issuesFixed++ if $shouldFixIssues;
+            }
+        }
+
+        print $OUT $line if $shouldFixIssues;
+    }
+
+    # Output the rest of the file.
+    print $OUT <IN> if $shouldFixIssues;
+
+    close(IN);
+
+    if ($shouldFixIssues) {
+        close($OUT);
+
+        unlink($projectFile) || die "Could not delete $projectFile: $!";
+        rename($tempFileName, $projectFile) || die "Could not rename $tempFileName to $projectFile: $!";
+    }
+
+    if ($printWarnings) {
+        printf STDERR "%s issues found for $projectFile.\n", ($issuesFound ? $issuesFound : "No");
+        print STDERR "$issuesFixed issues fixed for $projectFile.\n" if $issuesFixed && $shouldFixIssues;
+        print STDERR "NOTE: Open $projectFile in Xcode to let it have its way with the file.\n" if $issuesFixed;
+        print STDERR "\n";
+    }
+}
+
+exit 0;
diff --git a/WebKitTools/Scripts/do-file-rename b/WebKitTools/Scripts/do-file-rename
index ac5099e..b81b9dc 100755
--- a/WebKitTools/Scripts/do-file-rename
+++ b/WebKitTools/Scripts/do-file-rename
@@ -29,10 +29,11 @@
 # Script to do file renaming.
 
 use strict;
+use File::Find;
 use FindBin;
 use lib $FindBin::Bin;
 use webkitdirs;
-use File::Find;
+use VCSUtils;
 
 setConfiguration();
 chdirWebKit();
@@ -86,7 +87,7 @@ for my $file (sort @paths) {
     if ($newFile{$file}) {
         my $newFile = $newFile{$file};
         print "Renaming $file to $newFile\n";
-        system "svn move $file $newFile";
+        scmMoveOrRenameFile($file, $newFile);
     }
 }
 
diff --git a/WebKitTools/Scripts/do-webcore-rename b/WebKitTools/Scripts/do-webcore-rename
index a1674de..6dcb719 100755
--- a/WebKitTools/Scripts/do-webcore-rename
+++ b/WebKitTools/Scripts/do-webcore-rename
@@ -207,18 +207,11 @@ for my $file (sort @paths) {
     }
 }
 
-
-my $isGit = isGit();
-
 for my $file (sort @paths) {
     if ($newFile{$file}) {
         my $newFile = $newFile{$file};
         print "Renaming $file to $newFile\n";
-        if ($isGit) {
-            system "git mv $file $newFile";
-        } else {
-            system "svn move $file $newFile";
-        }
+        scmMoveOrRenameFile($file, $newFile);
     }
 }
 
diff --git a/WebKitTools/Scripts/generate-forwarding-headers.pl b/WebKitTools/Scripts/generate-forwarding-headers.pl
new file mode 100755
index 0000000..ed58702
--- /dev/null
+++ b/WebKitTools/Scripts/generate-forwarding-headers.pl
@@ -0,0 +1,99 @@
+#!/usr/bin/perl -w
+# Copyright (C) 2010 Andras Becsi (abecsi@inf.u-szeged.hu), University of Szeged
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# A script which searches for headers included by WebKit2 files
+# and generates forwarding headers for these headers.
+
+use strict;
+use Cwd qw(abs_path realpath);
+use File::Find;
+use File::Basename;
+use File::Spec::Functions;
+
+my $srcRoot = realpath(File::Spec->catfile(dirname(abs_path($0)), "../.."));
+my $incFromRoot = abs_path($ARGV[0]);
+my @platformPrefixes = ("android", "brew", "cf", "chromium", "curl", "efl", "gtk", "haiku", "mac", "qt", "soup", "v8", "win", "wx");
+my @frameworks = ( "JavaScriptCore", "WebCore", "WebKit2");
+my @skippedPrefixes;
+my @frameworkHeaders;
+my $framework;
+my %neededHeaders;
+
+shift;
+my $outputDirectory = $ARGV[0];
+shift;
+my $platform  = $ARGV[0];
+
+foreach my $prefix (@platformPrefixes) {
+    push(@skippedPrefixes, $prefix) unless ($prefix =~ $platform);
+}
+
+foreach (@frameworks) {
+    $framework = $_;
+    find(\&collectNeededHeaders, $incFromRoot);
+    find(\&collectFameworkHeaderPaths, File::Spec->catfile($srcRoot, $framework));
+    createForwardingHeadersForFramework();
+}
+
+sub collectNeededHeaders {
+    my $filePath = $File::Find::name;
+    my $file = $_;
+    if ($filePath =~ '\.h$|\.cpp$') {
+        open(FILE, "<$file") or die "Could not open $filePath.\n";
+        while (<FILE>) {
+           if (m/^#.*<$framework\/(.*\.h)/) {
+               $neededHeaders{$1} = 1;
+           }
+        }
+        close(FILE);
+    }
+}
+
+sub collectFameworkHeaderPaths {
+    my $filePath = $File::Find::name;
+    my $file = $_;
+    if ($filePath =~ '\.h$' && $filePath !~ "ForwardingHeaders" && grep{$file eq $_} keys %neededHeaders) {
+        my $headerPath = substr($filePath, length("$srcRoot/$framework/"));
+        push(@frameworkHeaders, $headerPath) unless (grep($headerPath =~ "$_/", @skippedPrefixes));
+    }
+}
+
+sub createForwardingHeadersForFramework {
+    foreach my $header (@frameworkHeaders) {
+        my $forwardingHeaderPath = File::Spec->catfile($outputDirectory, $framework, basename($header));
+        my $expectedIncludeStatement = "#include \"$header\"";
+        my $foundIncludeStatement = 0;
+        $foundIncludeStatement = <EXISTING_HEADER> if open(EXISTING_HEADER, "<$forwardingHeaderPath");
+        chomp($foundIncludeStatement);
+        if (! $foundIncludeStatement || $foundIncludeStatement ne $expectedIncludeStatement) {
+            print "[Creating forwarding header for $framework/$header]\n";
+            open(FORWARDING_HEADER, ">$forwardingHeaderPath") or die "Could not open $forwardingHeaderPath.";
+            print FORWARDING_HEADER "$expectedIncludeStatement\n";
+            close(FORWARDING_HEADER);
+        }
+        close(EXISTING_HEADER);
+    }
+}
+
diff --git a/WebKitTools/Scripts/old-run-webkit-tests b/WebKitTools/Scripts/old-run-webkit-tests
index 80801dc..a468b4d 100755
--- a/WebKitTools/Scripts/old-run-webkit-tests
+++ b/WebKitTools/Scripts/old-run-webkit-tests
@@ -49,6 +49,7 @@
 use strict;
 use warnings;
 
+use Config;
 use Cwd;
 use Data::Dumper;
 use Fcntl qw(F_GETFL F_SETFL O_NONBLOCK);
@@ -157,7 +158,7 @@ my $testHTTP = 1;
 my $testWebSocket = 1;
 my $testMedia = 1;
 my $tmpDir = "/tmp";
-my $testResultsDirectory = File::Spec->catfile($tmpDir, "layout-test-results");
+my $testResultsDirectory = File::Spec->catdir($tmpDir, "layout-test-results");
 my $testsPerDumpTool = 1000;
 my $threaded = 0;
 # DumpRenderTree has an internal timeout of 30 seconds, so this must be > 30.
@@ -180,6 +181,8 @@ if (isWindows() || isMsys()) {
 # Default to --no-http for wx for now.
 $testHTTP = 0 if (isWx());
 
+my $perlInterpreter = "perl";
+
 my $expectedTag = "expected";
 my $actualTag = "actual";
 my $prettyDiffTag = "pretty-diff";
@@ -224,7 +227,7 @@ if (isAppleMacWebKit()) {
     $platform = "gtk";
 } elsif (isWx()) {
     $platform = "wx";
-} elsif (isCygwin()) {
+} elsif (isCygwin() || isWindows()) {
     if (isWindowsXP()) {
         $platform = "win-xp";
     } elsif (isWindowsVista()) {
@@ -236,7 +239,7 @@ if (isAppleMacWebKit()) {
     }
 }
 
-if (isQt() || isCygwin()) {
+if (isQt() || isAppleWinWebKit()) {
     my $testfontPath = $ENV{"WEBKIT_TESTFONTS"};
     if (!$testfontPath || !-d "$testfontPath") {
         print "The WEBKIT_TESTFONTS environment variable is not defined or not set properly\n";
@@ -364,6 +367,9 @@ if ($useWebKitTestRunner) {
         $stripEditingCallbacks = 0 unless defined $stripEditingCallbacks;
         $realPlatform = $platform;
         $platform = "win-wk2";
+    } elsif (isQt()) {
+        $realPlatform = $platform;
+        $platform = "qt-wk2";
     }
 }
 
@@ -409,8 +415,11 @@ if (!defined($root)) {
 
 my $dumpToolName = $useWebKitTestRunner ? "WebKitTestRunner" : "DumpRenderTree";
 
-$dumpToolName .= "_debug" if isCygwin() && configurationForVisualStudio() !~ /^Release|Debug_Internal$/;
-my $dumpTool = "$productDir/$dumpToolName";
+if (isAppleWinWebKit()) {
+    $dumpToolName .= "_debug" if configurationForVisualStudio() !~ /^Release|Debug_Internal$/;
+    $dumpToolName .= $Config{_exe};
+}
+my $dumpTool = File::Spec->catfile($productDir, $dumpToolName);
 die "can't find executable $dumpToolName (looked in $productDir)\n" unless -x $dumpTool;
 
 my $imageDiffTool = "$productDir/ImageDiff";
@@ -501,7 +510,7 @@ my $supportedFeaturesResult = "";
 if (isCygwin()) {
     # Collect supported features list
     setPathForRunningWebKitApp(\%ENV);
-    my $supportedFeaturesCommand = $dumpTool . " --print-supported-features 2>&1";
+    my $supportedFeaturesCommand = "\"$dumpTool\" --print-supported-features 2>&1";
     $supportedFeaturesResult = `$supportedFeaturesCommand 2>&1`;
 }
 
@@ -681,7 +690,7 @@ for my $test (@tests) {
     my $suffixExpectedHash = "";
     if ($pixelTests && !$resetResults) {
         my $expectedPixelDir = expectedDirectoryForTest($base, 0, "png");
-        if (open EXPECTEDHASH, "$expectedPixelDir/$base-$expectedTag.checksum") {
+        if (open EXPECTEDHASH, File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.checksum")) {
             my $expectedHash = <EXPECTEDHASH>;
             chomp($expectedHash);
             close EXPECTEDHASH;
@@ -693,7 +702,34 @@ for my $test (@tests) {
 
     if ($test =~ /^http\//) {
         configureAndOpenHTTPDIfNeeded();
-        if ($test !~ /^http\/tests\/local\// && $test !~ /^http\/tests\/ssl\// && $test !~ /^http\/tests\/wml\// && $test !~ /^http\/tests\/media\//) {
+        if ($test =~ /^http\/tests\/websocket\//) {
+            if ($test =~ /^websocket\/tests\/local\//) {
+                my $testPath = "$testDirectory/$test";
+                if (isCygwin()) {
+                    $testPath = toWindowsPath($testPath);
+                } else {
+                    $testPath = canonpath($testPath);
+                }
+                print OUT "$testPath\n";
+            } else {
+                if (openWebSocketServerIfNeeded()) {
+                    my $path = canonpath($test);
+                    if ($test =~ /^http\/tests\/websocket\/tests\/ssl\//) {
+                        # wss is disabled until all platforms support pyOpenSSL.
+                        print STDERR "Error: wss is disabled until all platforms support pyOpenSSL.";
+                    } else {
+                        $path =~ s/^http\/tests\///;
+                        print OUT "http://127.0.0.1:$httpdPort/$path\n";
+                    }
+                } else {
+                    # We failed to launch the WebSocket server.  Display a useful error message rather than attempting
+                    # to run tests that expect the server to be available.
+                    my $errorMessagePath = "$testDirectory/http/tests/websocket/resources/server-failed-to-start.html";
+                    $errorMessagePath = isCygwin() ? toWindowsPath($errorMessagePath) : canonpath($errorMessagePath);
+                    print OUT "$errorMessagePath\n";
+                }
+            }
+        } elsif ($test !~ /^http\/tests\/local\// && $test !~ /^http\/tests\/ssl\// && $test !~ /^http\/tests\/wml\// && $test !~ /^http\/tests\/media\//) {
             my $path = canonpath($test);
             $path =~ s/^http\/tests\///;
             print OUT "http://127.0.0.1:$httpdPort/$path$suffixExpectedHash\n";
@@ -710,33 +746,6 @@ for my $test (@tests) {
             }
             print OUT "$testPath$suffixExpectedHash\n";
         }
-    } elsif ($test =~ /^websocket\//) {
-        if ($test =~ /^websocket\/tests\/local\//) {
-            my $testPath = "$testDirectory/$test";
-            if (isCygwin()) {
-                $testPath = toWindowsPath($testPath);
-            } else {
-                $testPath = canonpath($testPath);
-            }
-            print OUT "$testPath\n";
-        } else {
-            if (openWebSocketServerIfNeeded()) {
-                my $path = canonpath($test);
-                if ($test =~ /^websocket\/tests\/ssl\//) {
-                    # wss is disabled until all platforms support pyOpenSSL.
-                    print STDERR "Error: wss is disabled until all platforms support pyOpenSSL.";
-                    # print OUT "https://127.0.0.1:$webSocketSecurePort/$path\n";
-                } else {
-                    print OUT "http://127.0.0.1:$webSocketPort/$path\n";
-                }
-            } else {
-                # We failed to launch the WebSocket server.  Display a useful error message rather than attempting
-                # to run tests that expect the server to be available.
-                my $errorMessagePath = "$testDirectory/websocket/resources/server-failed-to-start.html";
-                $errorMessagePath = isCygwin() ? toWindowsPath($errorMessagePath) : canonpath($errorMessagePath);
-                print OUT "$errorMessagePath\n";
-            }
-        }
     } else {
         my $testPath = "$testDirectory/$test";
         if (isCygwin()) {
@@ -763,7 +772,7 @@ for my $test (@tests) {
     my $isText = isTextOnlyTest($actual);
 
     my $expectedDir = expectedDirectoryForTest($base, $isText, $expectedExtension);
-    $expectedResultPaths{$base} = "$expectedDir/$expectedFileName";
+    $expectedResultPaths{$base} = File::Spec->catfile($expectedDir, $expectedFileName);
 
     unless ($readResults->{status} eq "success") {
         my $crashed = $readResults->{status} eq "crashed";
@@ -777,7 +786,7 @@ for my $test (@tests) {
 
     my $expected;
 
-    if (!$resetResults && open EXPECTED, "<", "$expectedDir/$expectedFileName") {
+    if (!$resetResults && open EXPECTED, "<", $expectedResultPaths{$base}) {
         $expected = "";
         while (<EXPECTED>) {
             next if $stripEditingCallbacks && $_ =~ /^EDITING DELEGATE:/;
@@ -827,12 +836,13 @@ for my $test (@tests) {
 
     if ($actualPNGSize > 0) {
         my $expectedPixelDir = expectedDirectoryForTest($base, 0, "png");
+        my $expectedPNGPath = File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.png");
 
         if (!$resetResults && ($expectedHash ne $actualHash || ($actualHash eq "" && $expectedHash eq ""))) {
-            if (-f "$expectedPixelDir/$base-$expectedTag.png") {
-                my $expectedPNGSize = -s "$expectedPixelDir/$base-$expectedTag.png";
+            if (-f $expectedPNGPath) {
+                my $expectedPNGSize = -s $expectedPNGPath;
                 my $expectedPNG = "";
-                open EXPECTEDPNG, "$expectedPixelDir/$base-$expectedTag.png";
+                open EXPECTEDPNG, $expectedPNGPath;
                 read(EXPECTEDPNG, $expectedPNG, $expectedPNGSize);
 
                 openDiffTool();
@@ -863,13 +873,14 @@ for my $test (@tests) {
             }
         }
 
-        if ($resetResults || !-f "$expectedPixelDir/$base-$expectedTag.png") {
+        if ($resetResults || !-f $expectedPNGPath) {
             mkpath catfile($expectedPixelDir, dirname($base)) if $testDirectory ne $expectedPixelDir;
-            writeToFile("$expectedPixelDir/$base-$expectedTag.png", $actualPNG);
+            writeToFile($expectedPNGPath, $actualPNG);
         }
 
-        if ($actualHash ne "" && ($resetResults || !-f "$expectedPixelDir/$base-$expectedTag.checksum")) {
-            writeToFile("$expectedPixelDir/$base-$expectedTag.checksum", $actualHash);
+        my $expectedChecksumPath = File::Spec->catfile($expectedPixelDir, "$base-$expectedTag.checksum");
+        if ($actualHash ne "" && ($resetResults || !-f $expectedChecksumPath)) {
+            writeToFile($expectedChecksumPath, $actualHash);
         }
     }
 
@@ -1006,11 +1017,10 @@ for my $test (@tests) {
     }
 
     if ($error) {
-        my $dir = "$testResultsDirectory/$base";
-        $dir =~ s|/([^/]+)$|| or die "Failed to find test name from base\n";
+        my $dir = dirname(File::Spec->catdir($testResultsDirectory, $base));
         mkpath $dir;
         
-        writeToFile("$testResultsDirectory/$base-$errorTag.txt", $error);
+        writeToFile(File::Spec->catfile($testResultsDirectory, "$base-$errorTag.txt"), $error);
         
         $counts{error}++;
         push @{$tests{error}}, $test;
@@ -1118,6 +1128,8 @@ if (isGtk()) {
   system "WebKitTools/Scripts/run-launcher", @configurationArgs, "file://".$testResults if $launchSafari;
 } elsif (isCygwin()) {
   system "cygstart", $testResults if $launchSafari;
+} elsif (isWindows()) {
+  system "start", $testResults if $launchSafari;
 } else {
   system "WebKitTools/Scripts/run-safari", @configurationArgs, "-NSOpen", $testResults if $launchSafari;
 }
@@ -1319,7 +1331,7 @@ sub launchWithEnv(\@\%)
     unshift @{$args}, "\"$allEnvVars\"";
 
     my $execScript = File::Spec->catfile(sourceDir(), qw(WebKitTools Scripts execAppWithEnv));
-    unshift @{$args}, $execScript;
+    unshift @{$args}, $perlInterpreter, $execScript;
     return @{$args};
 }
 
@@ -1361,7 +1373,7 @@ sub buildDumpTool($)
     }
 
     my @args = argumentsForConfiguration();
-    my $buildProcess = open3($childIn, $childOut, $childErr, "WebKitTools/Scripts/$dumpToolBuildScript", @args) or die "Failed to run build-dumprendertree";
+    my $buildProcess = open3($childIn, $childOut, $childErr, $perlInterpreter, File::Spec->catfile(qw(WebKitTools Scripts), $dumpToolBuildScript), @args) or die "Failed to run build-dumprendertree";
     close($childIn);
     waitpid $buildProcess, 0;
     my $buildResult = $?;
@@ -1504,7 +1516,7 @@ sub configureAndOpenHTTPDIfNeeded()
 sub checkPythonVersion()
 {
     # we have not chdir to sourceDir yet.
-    system sourceDir() . "/WebKitTools/Scripts/ensure-valid-python", "--check-only";
+    system $perlInterpreter, File::Spec->catfile(sourceDir(), qw(WebKitTools Scripts ensure-valid-python)), "--check-only";
     return exitStatus($?) == 0;
 }
 
@@ -1607,12 +1619,12 @@ sub expectedDirectoryForTest($;$;$)
     my ($base, $isText, $expectedExtension) = @_;
 
     my @directories = @platformResultHierarchy;
-    push @directories, map { catdir($platformBaseDirectory, $_) } qw(mac-snowleopard mac) if isCygwin();
+    push @directories, map { catdir($platformBaseDirectory, $_) } qw(mac-snowleopard mac) if isAppleWinWebKit();
     push @directories, $expectedDirectory;
 
     # If we already have expected results, just return their location.
     foreach my $directory (@directories) {
-        return $directory if (-f "$directory/$base-$expectedTag.$expectedExtension");
+        return $directory if -f File::Spec->catfile($directory, "$base-$expectedTag.$expectedExtension");
     }
 
     # For cross-platform tests, text-only results should go in the cross-platform directory,
@@ -1628,9 +1640,9 @@ sub countFinishedTest($$$$)
         if ($shouldCheckLeaks) {
             my $fileName;
             if ($testsPerDumpTool == 1) {
-                $fileName = "$testResultsDirectory/$base-leaks.txt";
+                $fileName = File::Spec->catfile($testResultsDirectory, "$base-leaks.txt");
             } else {
-                $fileName = "$testResultsDirectory/" . fileNameWithNumber($dumpToolName, $leaksOutputFileNumber) . "-leaks.txt";
+                $fileName = File::Spec->catfile($testResultsDirectory, fileNameWithNumber($dumpToolName, $leaksOutputFileNumber) . "-leaks.txt");
             }
             my $leakCount = countAndPrintLeaks($dumpToolName, $dumpToolPID, $fileName);
             $totalLeaks += $leakCount;
@@ -1653,14 +1665,13 @@ sub testCrashedOrTimedOut($$$$$)
 
     sampleDumpTool() unless $didCrash;
 
-    my $dir = "$testResultsDirectory/$base";
-    $dir =~ s|/([^/]+)$|| or die "Failed to find test name from base\n";
+    my $dir = dirname(File::Spec->catdir($testResultsDirectory, $base));
     mkpath $dir;
 
     deleteExpectedAndActualResults($base);
 
     if (defined($error) && length($error)) {
-        writeToFile("$testResultsDirectory/$base-$errorTag.txt", $error);
+        writeToFile(File::Spec->catfile($testResultsDirectory, "$base-$errorTag.txt"), $error);
     }
 
     recordActualResultsAndDiff($base, $actual);
@@ -1898,8 +1909,8 @@ sub recordActualResultsAndDiff($$)
 
     my $expectedResultPath = $expectedResultPaths{$base};
     my ($expectedResultFileNameMinusExtension, $expectedResultDirectoryPath, $expectedResultExtension) = fileparse($expectedResultPath, qr{\.[^.]+$});
-    my $actualResultsPath = "$testResultsDirectory/$base-$actualTag$expectedResultExtension";
-    my $copiedExpectedResultsPath = "$testResultsDirectory/$base-$expectedTag$expectedResultExtension";
+    my $actualResultsPath = File::Spec->catfile($testResultsDirectory, "$base-$actualTag$expectedResultExtension");
+    my $copiedExpectedResultsPath = File::Spec->catfile($testResultsDirectory, "$base-$expectedTag$expectedResultExtension");
 
     mkpath(dirname($actualResultsPath));
     writeToFile("$actualResultsPath", $actualResults);
@@ -1911,7 +1922,7 @@ sub recordActualResultsAndDiff($$)
         close EMPTY;
     }
 
-    my $diffOuputBasePath = "$testResultsDirectory/$base";
+    my $diffOuputBasePath = File::Spec->catfile($testResultsDirectory, $base);
     my $diffOutputPath = "$diffOuputBasePath-$diffsTag.txt";
     system "diff -u \"$copiedExpectedResultsPath\" \"$actualResultsPath\" > \"$diffOutputPath\"";
 
@@ -2271,7 +2282,7 @@ sub findTestsToRun
     my @testsToRun = ();
 
     for my $test (@ARGV) {
-        $test =~ s/^($layoutTestsName|$testDirectory)\///;
+        $test =~ s/^(\Q$layoutTestsName\E|\Q$testDirectory\E)\///;
         my $fullPath = catfile($testDirectory, $test);
         if (file_name_is_absolute($test)) {
             print "can't run test $test outside $testDirectory\n";
diff --git a/WebKitTools/Scripts/run-api-tests b/WebKitTools/Scripts/run-api-tests
new file mode 100755
index 0000000..3d08013
--- /dev/null
+++ b/WebKitTools/Scripts/run-api-tests
@@ -0,0 +1,246 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+# AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+# THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+# BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+# CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+# SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+# INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+# CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+# THE POSSIBILITY OF SUCH DAMAGE.
+
+# Features to add:
+#   - Command line option to run a single test.
+#   - Command line option to run all tests in a suite.
+
+use strict;
+use warnings;
+
+use File::Basename;
+use FindBin;
+use Getopt::Long qw(:config pass_through);
+use IPC::Open3;
+use lib $FindBin::Bin;
+use webkitdirs;
+use Term::ANSIColor qw(:constants);
+
+sub dumpAllTests();
+sub runAllTests();
+sub runAllTestsInSuite($);
+sub runTest($$);
+sub populateTests();
+sub buildTestTool();
+
+my $showHelp = 0;
+my $quiet = 0;
+my $dump = 0;
+
+my $programName = basename($0);
+my $usage = <<EOF;
+Usage: $programName [options]
+  --help                Show this help message
+  -q|--quite            Less verbose output
+  -d|--dump-tests       Dump the names of testcases without running them
+EOF
+
+GetOptions(
+    'help' => \$showHelp,
+    'quiet|q' => \$quiet,
+    'dump|d' => \$dump,
+);
+
+if ($showHelp) {
+   print STDERR $usage;
+   exit 1;
+}
+
+setConfiguration();
+buildTestTool();
+setPathForRunningWebKitApp(\%ENV);
+my %testsToRun = populateTests();
+
+if ($dump) {
+    dumpAllTests();
+    exit 0;
+}
+
+runAllTests();
+
+sub dumpAllTests()
+{
+    print "Dumping test cases\n";
+    print "------------------\n";
+    for my $suite (keys %testsToRun) {
+        print $suite . ":\n";
+        print map { "    " . $_ . "\n" } @{ $testsToRun{$suite} };
+    }
+    print "------------------\n";
+}
+
+sub runAllTests()
+{
+    my $anyFailures = 0;
+    for my $suite (keys %testsToRun) {
+        my $failed = runAllTestsInSuite($suite);
+        if ($failed) {
+            $anyFailures = 1;
+        }
+    }
+    return $anyFailures;
+}
+
+sub runAllTestsInSuite($)
+{
+    my ($suite) = @_;
+    print "Suite: $suite\n";
+
+    my $anyFailures = 0;
+    for my $test (@{$testsToRun{$suite}}) {
+        my $failed = runTest($suite, $test);
+        if ($failed) {
+            $anyFailures = 1;
+        }
+    }
+    
+    return $anyFailures;
+}
+
+sub runTest($$)
+{
+    my ($suite, $testName) = @_;
+    my $test = $suite . "/" . $testName;
+
+    print "    Test: $testName -> ";
+
+    my $result = 0;
+    if (isAppleMacWebKit()) {
+        my $productDir = productDir();
+        $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
+        $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = "YES";
+        my $apiTesterPath = "$productDir/TestWebKitAPI";
+        if (architecture()) {
+            $result = system "arch", "-" . architecture(), $apiTesterPath, $test, @ARGV;
+        } else {
+            $result = system $apiTesterPath, $test, @ARGV;
+        }
+    } elsif (isAppleWinWebKit()) {
+        my $apiTesterNameSuffix;
+        if (configurationForVisualStudio() =~ /^Release|Debug_Internal$/) {
+            $apiTesterNameSuffix = "";
+        } else {
+            $apiTesterNameSuffix = "_debug";
+        }
+        my $apiTesterPath = File::Spec->catfile(productDir(), "TestWebKitAPI$apiTesterNameSuffix.exe");
+        $result = system $apiTesterPath, $test, @ARGV;
+    } else {
+        die "run-api-tests is not supported on this platform.\n"
+    }
+    
+    if ($result == 0) {
+        print BOLD GREEN, "Passed", RESET, "\n";
+    } else {
+        print BOLD RED, "Failed", RESET, "\n";
+    }
+}
+
+
+sub populateTests()
+{
+    my @tests;
+
+    if (isAppleMacWebKit()) {
+        my $productDir = productDir();
+        $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
+        $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = "YES";
+        my $apiTesterPath = "$productDir/TestWebKitAPI";
+
+        my ($pid, $childIn, $childOut);
+        if (architecture()) {
+            $pid = open3($childIn, $childOut, ">&STDERR", "arch", "-" . architecture(), $apiTesterPath, "--dump-tests") or die "Failed to build list of tests!";
+        } else {
+            $pid = open3($childIn, $childOut, ">&STDERR", $apiTesterPath, "--dump-tests") or die "Failed to build list of tests!";
+        }
+        close($childIn);
+        @tests = <$childOut>;
+        close($childOut);
+
+        waitpid($pid, 0);
+        my $result = $?;
+
+        if ($result) {
+            print STDERR "Failed to build list of tests!\n";
+            exit exitStatus($result);
+        }
+    } elsif (isAppleWinWebKit()) {
+        my $apiTesterNameSuffix;
+        if (configurationForVisualStudio() =~ /^Release|Debug_Internal$/) {
+            $apiTesterNameSuffix = "";
+        } else {
+            $apiTesterNameSuffix = "_debug";
+        }
+        my $apiTesterPath = File::Spec->catfile(productDir(), "TestWebKitAPI$apiTesterNameSuffix.exe");
+        open(TESTS, "-|", $apiTesterPath, "--dump-tests") or die $!;
+        @tests = <TESTS>;
+        close(TESTS) or die $!;
+    } else {
+        die "run-api-tests is not supported on this platform.\n"
+    }
+
+    my %keyedTests = ();
+    for my $test (@tests) {
+        $test =~ s/[\r\n]*$//;
+        my ($suite, $testName) = split(/\//, $test);
+        push @{$keyedTests{$suite}}, $testName;
+    }
+    
+    return %keyedTests;
+}
+
+sub buildTestTool()
+{
+    chdirWebKit();
+
+    my $buildTestTool = "build-api-tests";
+    print STDERR "Running $buildTestTool\n";
+
+    local *DEVNULL;
+    my ($childIn, $childOut, $childErr);
+    if ($quiet) {
+        open(DEVNULL, ">", File::Spec->devnull()) or die "Failed to open /dev/null";
+        $childOut = ">&DEVNULL";
+        $childErr = ">&DEVNULL";
+    } else {
+        # When not quiet, let the child use our stdout/stderr.
+        $childOut = ">&STDOUT";
+        $childErr = ">&STDERR";
+    }
+
+    my @args = argumentsForConfiguration();
+    my $buildProcess = open3($childIn, $childOut, $childErr, "WebKitTools/Scripts/$buildTestTool", @args) or die "Failed to run " . $buildTestTool;
+    close($childIn);
+    waitpid $buildProcess, 0;
+    my $buildResult = $?;
+    close($childOut);
+    close($childErr);
+
+    close DEVNULL if ($quiet);
+
+    if ($buildResult) {
+        print STDERR "Compiling TestWebKitAPI failed!\n";
+        exit exitStatus($buildResult);
+    }
+}
diff --git a/WebKitTools/Scripts/run-test-webkit-api b/WebKitTools/Scripts/run-test-webkit-api
new file mode 100755
index 0000000..dfd85d5
--- /dev/null
+++ b/WebKitTools/Scripts/run-test-webkit-api
@@ -0,0 +1,38 @@
+#!/usr/bin/perl -w
+
+# Copyright (C) 2010 Apple Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+#
+# 1.  Redistributions of source code must retain the above copyright
+#     notice, this list of conditions and the following disclaimer. 
+# 2.  Redistributions in binary form must reproduce the above copyright
+#     notice, this list of conditions and the following disclaimer in the
+#     documentation and/or other materials provided with the distribution. 
+# 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+#     its contributors may be used to endorse or promote products derived
+#     from this software without specific prior written permission. 
+#
+# THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+# DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+# DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+# (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+# LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+# ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+# THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Simplified "run" script for launching the WebKit2 estWebKitAPI.
+
+use strict;
+use FindBin;
+use lib $FindBin::Bin;
+use webkitdirs;
+
+setConfiguration();
+
+exit exitStatus(runTestWebKitAPI());
diff --git a/WebKitTools/Scripts/run-webkit-tests b/WebKitTools/Scripts/run-webkit-tests
index 8fe8360..6b530e1 100755
--- a/WebKitTools/Scripts/run-webkit-tests
+++ b/WebKitTools/Scripts/run-webkit-tests
@@ -41,6 +41,7 @@
 use strict;
 use warnings;
 
+use File::Spec;
 use FindBin;
 use lib $FindBin::Bin;
 use webkitdirs;
@@ -79,5 +80,5 @@ if (useNewRunWebKitTests()) {
     }
 }
 
-my $harnessPath = sprintf("%s/%s", relativeScriptsDir(), $harnessName);
+my $harnessPath = File::Spec->catfile(relativeScriptsDir(), $harnessName);
 exec $harnessPath ($harnessPath, @ARGV) or die "Failed to execute $harnessPath";
diff --git a/WebKitTools/Scripts/sort-Xcode-project-file b/WebKitTools/Scripts/sort-Xcode-project-file
index 044186f..705b41d 100755
--- a/WebKitTools/Scripts/sort-Xcode-project-file
+++ b/WebKitTools/Scripts/sort-Xcode-project-file
@@ -1,6 +1,6 @@
 #!/usr/bin/perl -w
 
-# Copyright (C) 2007, 2008 Apple Inc.  All rights reserved.
+# Copyright (C) 2007, 2008, 2009, 2010 Apple Inc.  All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions
@@ -31,6 +31,7 @@
 use strict;
 
 use File::Basename;
+use File::Spec;
 use File::Temp qw(tempfile);
 use Getopt::Long;
 
@@ -54,7 +55,7 @@ my $getOptionsResult = GetOptions(
     'w|warnings!'    => \$printWarnings,
 );
 
-if (scalar(@ARGV) == 0) {
+if (scalar(@ARGV) == 0 && !$showHelp) {
     print STDERR "ERROR: No Xcode project files (project.pbxproj) listed on command-line.\n";
     undef $getOptionsResult;
 }
@@ -69,6 +70,10 @@ __END__
 }
 
 for my $projectFile (@ARGV) {
+    if (basename($projectFile) =~ /\.xcodeproj$/) {
+        $projectFile = File::Spec->catfile($projectFile, "project.pbxproj");
+    }
+
     if (basename($projectFile) ne "project.pbxproj") {
         print STDERR "WARNING: Not an Xcode project file: $projectFile\n" if $printWarnings;
         next;
diff --git a/WebKitTools/Scripts/sunspider-compare-results b/WebKitTools/Scripts/sunspider-compare-results
index 8c3f7f5..193ee8f 100755
--- a/WebKitTools/Scripts/sunspider-compare-results
+++ b/WebKitTools/Scripts/sunspider-compare-results
@@ -55,7 +55,7 @@ Usage: $programName [options] FILE FILE
   --parse-only      Use the parse-only benchmark suite. Same as --suite=parse-only
 EOF
 
-GetOptions('root=s' => sub { my ($argName, $value) = @_; setConfigurationProductDir(Cwd::abs_path($value)); },
+GetOptions('root=s' => sub { my ($argName, $value) = @_; setConfigurationProductDir(Cwd::abs_path($value)); $root = $value; },
            'suite=s' => \$suite,
            'ubench' => \$ubench,
            'v8' => \$v8,
diff --git a/WebKitTools/Scripts/svn-apply b/WebKitTools/Scripts/svn-apply
index 1cf9c01..cab7fb4 100755
--- a/WebKitTools/Scripts/svn-apply
+++ b/WebKitTools/Scripts/svn-apply
@@ -316,7 +316,8 @@ sub patch($)
         # Standard patch, patch tool can handle this.
         if (basename($fullPath) eq "ChangeLog") {
             my $changeLogDotOrigExisted = -f "${fullPath}.orig";
-            my $newPatch = setChangeLogDateAndReviewer(fixChangeLogPatch($patch), $reviewer, $epochTime);
+            my $changeLogHash = fixChangeLogPatch($patch);
+            my $newPatch = setChangeLogDateAndReviewer($changeLogHash->{patch}, $reviewer, $epochTime);
             applyPatch($newPatch, $fullPath, ["--fuzz=3"]);
             unlink("${fullPath}.orig") if (! $changeLogDotOrigExisted);
         } else {
diff --git a/WebKitTools/Scripts/svn-create-patch b/WebKitTools/Scripts/svn-create-patch
index 5aead2e..863998d 100755
--- a/WebKitTools/Scripts/svn-create-patch
+++ b/WebKitTools/Scripts/svn-create-patch
@@ -232,7 +232,10 @@ sub generateDiff($$)
         $patch .= $_;
     }
     close DIFF;
-    $patch = fixChangeLogPatch($patch) if basename($file) eq "ChangeLog";
+    if (basename($file) eq "ChangeLog") {
+        my $changeLogHash = fixChangeLogPatch($patch);
+        $patch = $changeLogHash->{patch};   
+    }
     print $patch;
     if ($fileData->{isBinary}) {
         print "\n" if ($patch && $patch =~ m/\n\S+$/m);
diff --git a/WebKitTools/Scripts/svn-unapply b/WebKitTools/Scripts/svn-unapply
index 53ab1b5..1dca11c 100755
--- a/WebKitTools/Scripts/svn-unapply
+++ b/WebKitTools/Scripts/svn-unapply
@@ -158,7 +158,8 @@ sub patch($)
         # Standard patch, patch tool can handle this.
         if (basename($fullPath) eq "ChangeLog") {
             my $changeLogDotOrigExisted = -f "${fullPath}.orig";
-            unapplyPatch(unsetChangeLogDate($fullPath, fixChangeLogPatch($patch)), $fullPath, ["--fuzz=3"]);
+            my $changeLogHash = fixChangeLogPatch($patch);
+            unapplyPatch(unsetChangeLogDate($fullPath, $changeLogHash->{patch}), $fullPath, ["--fuzz=3"]);
             unlink("${fullPath}.orig") if (! $changeLogDotOrigExisted);
         } else {
             unapplyPatch($patch, $fullPath);
diff --git a/WebKitTools/Scripts/test-webkitpy b/WebKitTools/Scripts/test-webkitpy
index be7e870..fcff4b4 100755
--- a/WebKitTools/Scripts/test-webkitpy
+++ b/WebKitTools/Scripts/test-webkitpy
@@ -227,9 +227,30 @@ def init(command_args, external_package_paths):
         _log.warn(message)
 
 
-if __name__ == "__main__":
+def _path_from_webkit_root(*components):
+    webkit_root = os.path.dirname(os.path.dirname(os.path.dirname(__file__)))
+    return os.path.join(webkit_root, *components)
+
+
+def _test_import(module_path):
+    try:
+        sys.path.append(os.path.dirname(module_path))
+        module_name = os.path.basename(module_path)
+        __import__(module_name)
+        return True
+    except Exception, e:
+        message = "Skipping tests in %s due to failure (%s)." % (module_path, e)
+        if module_name.endswith("QueueStatusServer"):
+            message += "  This module is optional.  The failure is likely due to a missing Google AppEngine install.  (http://code.google.com/appengine/downloads.html)"
+        _log.warn(message)
+        return False
 
-    external_package_paths = [os.path.join(os.path.dirname(os.path.dirname(os.path.dirname(__file__))), 'WebKit2', 'Scripts', 'webkit2')]
+if __name__ == "__main__":
+    # FIXME: We should probably test each package separately to avoid naming conflicts.
+    external_package_paths = [
+        _path_from_webkit_root('WebKit2', 'Scripts', 'webkit2'),
+        _path_from_webkit_root('WebKitTools', 'QueueStatusServer'),
+    ]
     init(sys.argv[1:], external_package_paths)
 
     # We import the unit test code after init() to ensure that any
@@ -240,4 +261,6 @@ if __name__ == "__main__":
     # running the unit tests.
     from webkitpy.test.main import Tester
 
+    external_package_paths = filter(_test_import, external_package_paths)
+
     Tester().run_tests(sys.argv, external_package_paths)
diff --git a/WebKitTools/Scripts/update-webkit-support-libs b/WebKitTools/Scripts/update-webkit-support-libs
index 7065293..fa2afd0 100755
--- a/WebKitTools/Scripts/update-webkit-support-libs
+++ b/WebKitTools/Scripts/update-webkit-support-libs
@@ -38,43 +38,33 @@ use FindBin;
 use lib $FindBin::Bin;
 use webkitdirs;
 
-my $expectedMD5 = "a1341aadbcce1ef26dad2b2895457314";
-
 my $sourceDir = sourceDir();
 my $file = "WebKitSupportLibrary";
 my $zipFile = "$file.zip"; 
 my $zipDirectory = toUnixPath($ENV{'WEBKITSUPPORTLIBRARIESZIPDIR'}) || $sourceDir;
 my $pathToZip = File::Spec->catfile($zipDirectory, $zipFile);
 my $webkitLibrariesDir = toUnixPath($ENV{'WEBKITLIBRARIESDIR'}) || "$sourceDir/WebKitLibraries/win";
+my $versionFile = $file . "Version";
+my $pathToVersionFile = File::Spec->catfile($webkitLibrariesDir, $versionFile);
 my $tmpDir = File::Spec->rel2abs(File::Temp::tempdir("webkitlibsXXXXXXX", TMPDIR => 1, CLEANUP => 1));
 
-# Make sure the file zipfile exists and matches the expected MD5 before doing anything.
-
--f $pathToZip or dieAndInstructToDownload("$zipFile could not be find in your root source directory.");
-
-`md5sum "$pathToZip"` =~ /^([0-9a-fA-F]{32}).*/ or die "Error running md5sum on \"$pathToZip\"";
-my $actualMD5 = $1;
-$actualMD5 eq $expectedMD5 or dieAndInstructToDownload("$zipFile is out of date.");
-
-print "Checking mod-date of $zipFile...\n";
-open MOD, ">$tmpDir/$file.modified" or die "Couldn't open $tmpDir/$file.modified for writing";
-print MOD (stat $pathToZip)[9] . "\n";
-close MOD;
+chomp(my $expectedVersion = `curl -s http://developer.apple.com/opensource/internet/$versionFile`);
 
-if (open NEW, "$tmpDir/$file.modified") {
-    my $new = <NEW>;
-    close NEW;
-
-    if (open OLD, "$webkitLibrariesDir/$file.modified") {
-        my $old = <OLD>;
-        close OLD;
-        if ($old eq $new) {
-            print "Current $file is up to date\n";
-            exit 0;
-        }
+# Check whether the extracted library is up-to-date. If it is, we don't have anything to do.
+if (open VERSION, "<", $pathToVersionFile) {
+    chomp(my $extractedVersion = <VERSION>);
+    close VERSION;
+    if ($extractedVersion eq $expectedVersion) {
+        print "$file is up-to-date.\n";
+        exit;
     }
 }
 
+# Check whether the downloaded library is up-to-date. If it isn't, the user needs to download it.
+-f $pathToZip or dieAndInstructToDownload("$zipFile could not be found in $zipDirectory.");
+chomp(my $zipFileVersion = `unzip -p "$pathToZip" $file/win/$versionFile`);
+dieAndInstructToDownload("$zipFile is out-of-date.") if $zipFileVersion ne $expectedVersion;
+
 my $result = system "unzip", "-q", "-d", $tmpDir, $pathToZip;
 die "Couldn't unzip $zipFile." if $result;
 
@@ -95,9 +85,6 @@ sub wanted
 
 File::Find::find(\&wanted, "$tmpDir/$file");
 
-$result = system "mv", "$tmpDir/$file.modified", $webkitLibrariesDir;
-print STDERR "Couldn't move $file.modified to $webkitLibrariesDir" . ".\n" if $result;
-
 print "The $file has been sucessfully installed in\n $webkitLibrariesDir\n";
 exit;
 
diff --git a/WebKitTools/Scripts/webkitdirs.pm b/WebKitTools/Scripts/webkitdirs.pm
index 08e14ab..fa85667 100644
--- a/WebKitTools/Scripts/webkitdirs.pm
+++ b/WebKitTools/Scripts/webkitdirs.pm
@@ -71,7 +71,6 @@ my $isInspectorFrontend;
 
 # Variables for Win32 support
 my $vcBuildPath;
-my $windowsTmpPath;
 my $windowsSourceDir;
 my $winVersion;
 my $willUseVCExpressWhenBuilding = 0;
@@ -173,9 +172,6 @@ sub determineBaseProductDir
         my $dosBuildPath = `cygpath --windows \"$baseProductDir\"`;
         chomp $dosBuildPath;
         $ENV{"WEBKITOUTPUTDIR"} = $dosBuildPath;
-    }
-
-    if (isAppleWinWebKit()) {
         my $unixBuildPath = `cygpath --unix \"$baseProductDir\"`;
         chomp $unixBuildPath;
         $baseProductDir = $unixBuildPath;
@@ -289,8 +285,9 @@ sub determineConfigurationForVisualStudio
     $configurationForVisualStudio = $configuration;
     return unless $configuration eq "Debug";
     setupCygwinEnv();
-    chomp(my $dir = `cygpath -ua '$ENV{WEBKITLIBRARIESDIR}'`);
-    $configurationForVisualStudio = "Debug_Internal" if -f "$dir/bin/CoreFoundation_debug.dll";
+    my $dir = $ENV{WEBKITLIBRARIESDIR};
+    chomp($dir = `cygpath -ua '$dir'`) if isCygwin();
+    $configurationForVisualStudio = "Debug_Internal" if -f File::Spec->catfile($dir, "bin", "CoreFoundation_debug.dll");
 }
 
 sub determineConfigurationProductDir
@@ -299,7 +296,7 @@ sub determineConfigurationProductDir
     determineBaseProductDir();
     determineConfiguration();
     if (isAppleWinWebKit() && !isWx()) {
-        $configurationProductDir = "$baseProductDir/bin";
+        $configurationProductDir = File::Spec->catdir($baseProductDir, "bin");
     } else {
         # [Gtk][Efl] We don't have Release/Debug configurations in straight
         # autotool builds (non build-webkit). In this case and if
@@ -415,7 +412,7 @@ sub determinePassedConfiguration
     return if $searchedForPassedConfiguration;
     $searchedForPassedConfiguration = 1;
 
-    my $isWinCairo = checkForArgumentAndRemoveFromARGV("--cairo-win32");
+    my $isWinCairo = checkForArgumentAndRemoveFromARGV("--wincairo");
 
     for my $i (0 .. $#ARGV) {
         my $opt = $ARGV[$i];
@@ -529,7 +526,7 @@ sub installedSafariPath
     } elsif (isAppleWinWebKit()) {
         $safariBundle = `"$configurationProductDir/FindSafari.exe"`;
         $safariBundle =~ s/[\r\n]+$//;
-        $safariBundle = `cygpath -u '$safariBundle'`;
+        $safariBundle = `cygpath -u '$safariBundle'` if isCygwin();
         $safariBundle =~ s/[\r\n]+$//;
         $safariBundle .= "Safari.exe";
     }
@@ -624,7 +621,7 @@ sub builtDylibPathForName
 # Check to see that all the frameworks are built.
 sub checkFrameworks # FIXME: This is a poor name since only the Mac calls built WebCore a Framework.
 {
-    return if isCygwin();
+    return if isCygwin() || isWindows();
     my @frameworks = ("JavaScriptCore", "WebCore");
     push(@frameworks, "WebKit") if isAppleMacWebKit(); # FIXME: This seems wrong, all ports should have a WebKit these days.
     for my $framework (@frameworks) {
@@ -873,7 +870,7 @@ sub isAppleMacWebKit()
 
 sub isAppleWinWebKit()
 {
-    return isAppleWebKit() && isCygwin();
+    return isAppleWebKit() && (isCygwin() || isWindows());
 }
 
 sub isPerianInstalled()
@@ -1009,8 +1006,8 @@ sub checkRequiredSystemConfig
 sub determineWindowsSourceDir()
 {
     return if $windowsSourceDir;
-    my $sourceDir = sourceDir();
-    chomp($windowsSourceDir = `cygpath -w '$sourceDir'`);
+    $windowsSourceDir = sourceDir();
+    chomp($windowsSourceDir = `cygpath -w '$windowsSourceDir'`) if isCygwin();
 }
 
 sub windowsSourceDir()
@@ -1070,25 +1067,25 @@ sub setupAppleWinEnv()
 
 sub setupCygwinEnv()
 {
-    return if !isCygwin();
+    return if !isCygwin() && !isWindows();
     return if $vcBuildPath;
 
     my $vsInstallDir;
-    my $programFilesPath = $ENV{'PROGRAMFILES'} || "C:\\Program Files";
+    my $programFilesPath = $ENV{'PROGRAMFILES(X86)'} || $ENV{'PROGRAMFILES'} || "C:\\Program Files";
     if ($ENV{'VSINSTALLDIR'}) {
         $vsInstallDir = $ENV{'VSINSTALLDIR'};
     } else {
-        $vsInstallDir = "$programFilesPath/Microsoft Visual Studio 8";
+        $vsInstallDir = File::Spec->catdir($programFilesPath, "Microsoft Visual Studio 8");
     }
-    $vsInstallDir = `cygpath "$vsInstallDir"`;
-    chomp $vsInstallDir;
-    $vcBuildPath = "$vsInstallDir/Common7/IDE/devenv.com";
+    chomp($vsInstallDir = `cygpath "$vsInstallDir"`) if isCygwin();
+    $vcBuildPath = File::Spec->catfile($vsInstallDir, qw(Common7 IDE devenv.com));
     if (-e $vcBuildPath) {
         # Visual Studio is installed; we can use pdevenv to build.
-        $vcBuildPath = File::Spec->catfile(sourceDir(), qw(WebKitTools Scripts pdevenv));
+        # FIXME: Make pdevenv work with non-Cygwin Perl.
+        $vcBuildPath = File::Spec->catfile(sourceDir(), qw(WebKitTools Scripts pdevenv)) if isCygwin();
     } else {
         # Visual Studio not found, try VC++ Express
-        $vcBuildPath = "$vsInstallDir/Common7/IDE/VCExpress.exe";
+        $vcBuildPath = File::Spec->catfile($vsInstallDir, qw(Common7 IDE VCExpress.exe));
         if (! -e $vcBuildPath) {
             print "*************************************************************\n";
             print "Cannot find '$vcBuildPath'\n";
@@ -1101,7 +1098,7 @@ sub setupCygwinEnv()
         $willUseVCExpressWhenBuilding = 1;
     }
 
-    my $qtSDKPath = "$programFilesPath/QuickTime SDK";
+    my $qtSDKPath = File::Spec->catdir($programFilesPath, "QuickTime SDK");
     if (0 && ! -e $qtSDKPath) {
         print "*************************************************************\n";
         print "Cannot find '$qtSDKPath'\n";
@@ -1111,10 +1108,11 @@ sub setupCygwinEnv()
         die;
     }
     
-    chomp($ENV{'WEBKITLIBRARIESDIR'} = `cygpath -wa "$sourceDir/WebKitLibraries/win"`) unless $ENV{'WEBKITLIBRARIESDIR'};
+    unless ($ENV{WEBKITLIBRARIESDIR}) {
+        $ENV{'WEBKITLIBRARIESDIR'} = File::Spec->catdir($sourceDir, "WebKitLibraries", "win");
+        chomp($ENV{WEBKITLIBRARIESDIR} = `cygpath -wa $ENV{WEBKITLIBRARIESDIR}`) if isCygwin();
+    }
 
-    $windowsTmpPath = `cygpath -w /tmp`;
-    chomp $windowsTmpPath;
     print "Building results into: ", baseProductDir(), "\n";
     print "WEBKITOUTPUTDIR is set to: ", $ENV{"WEBKITOUTPUTDIR"}, "\n";
     print "WEBKITLIBRARIESDIR is set to: ", $ENV{"WEBKITLIBRARIESDIR"}, "\n";
@@ -1197,14 +1195,14 @@ sub buildVisualStudioProject
 
     dieIfWindowsPlatformSDKNotInstalled() if $willUseVCExpressWhenBuilding;
 
-    chomp(my $winProjectPath = `cygpath -w "$project"`);
+    chomp($project = `cygpath -w "$project"`) if isCygwin();
     
     my $action = "/build";
     if ($clean) {
         $action = "/clean";
     }
 
-    my @command = ($vcBuildPath, $winProjectPath, $action, $config);
+    my @command = ($vcBuildPath, $project, $action, $config);
 
     print join(" ", @command), "\n";
     return system @command;
@@ -1461,6 +1459,9 @@ sub buildCMakeProject($@)
 
         print "Calling '$make $makeArgs' in " . $dir . "\n\n";
         $result = system "$make $makeArgs";
+        if ($result ne 0) {
+            die "Failed to build $port port\n";
+        }
 
         chdir ".." or die;
     }
@@ -1530,6 +1531,7 @@ sub buildQMakeProject($@)
     my @subdirs = ("JavaScriptCore", "WebCore", "WebKit/qt/Api");
     if (grep { $_ eq "CONFIG+=webkit2"} @buildArgs) {
         push @subdirs, "WebKit2";
+        push @subdirs, "WebKitTools/WebKitTestRunner";
     }
 
     for my $subdir (@subdirs) {
@@ -1831,4 +1833,22 @@ sub debugWebKitTestRunner
     return 1;
 }
 
+sub runTestWebKitAPI
+{
+    if (isAppleMacWebKit()) {
+        my $productDir = productDir();
+        print "Starting TestWebKitAPI with DYLD_FRAMEWORK_PATH set to point to $productDir.\n";
+        $ENV{DYLD_FRAMEWORK_PATH} = $productDir;
+        $ENV{WEBKIT_UNSET_DYLD_FRAMEWORK_PATH} = "YES";
+        my $testWebKitAPIPath = "$productDir/TestWebKitAPI";
+        if (!isTiger() && architecture()) {
+            return system "arch", "-" . architecture(), $testWebKitAPIPath, @ARGV;
+        } else {
+            return system $testWebKitAPIPath, @ARGV;
+        }
+    }
+
+    return 1;
+}
+
 1;
diff --git a/WebKitTools/Scripts/webkitperl/VCSUtils_unittest/fixChangeLogPatch.pl b/WebKitTools/Scripts/webkitperl/VCSUtils_unittest/fixChangeLogPatch.pl
index ee258da..a7282c7 100644
--- a/WebKitTools/Scripts/webkitperl/VCSUtils_unittest/fixChangeLogPatch.pl
+++ b/WebKitTools/Scripts/webkitperl/VCSUtils_unittest/fixChangeLogPatch.pl
@@ -1,6 +1,7 @@
 #!/usr/bin/perl
 #
 # Copyright (C) 2009, 2010 Chris Jerdonek (chris.jerdonek@gmail.com)
+# Copyright (C) Research In Motion 2010. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -30,7 +31,10 @@
 
 # Unit tests of VCSUtils::fixChangeLogPatch().
 
-use Test::Simple tests => 12;
+use strict;
+use warnings;
+
+use Test::More;
 use VCSUtils;
 
 # The source ChangeLog for these tests is the following:
@@ -53,14 +57,10 @@ use VCSUtils;
 #         * File:
 #         * File2:
 
-my $title;
-my $in;
-my $out;
-
-# New test
-$title = "fixChangeLogPatch: [no change] In-place change.";
-
-$in = <<'END';
+my @testCaseHashRefs = (
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] In-place change.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -1,5 +1,5 @@
@@ -71,13 +71,23 @@ $in = <<'END';
  
          Changed some code on 2010-12-22.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] Remove first entry.";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -1,5 +1,5 @@
+ 2010-12-22  Bob  <bob@email.address>
+ 
+-        Reviewed by Sue.
++        Reviewed by Ray.
+ 
+         Changed some code on 2010-12-22.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] Remove first entry.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -1,11 +1,3 @@
@@ -93,13 +103,28 @@ $in = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] Remove entry in the middle.";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -1,11 +1,3 @@
+-2010-12-22  Bob  <bob@email.address>
+-
+-        Reviewed by Ray.
+-
+-        Changed some code on 2010-12-22.
+-
+-        * File:
+-
+ 2010-12-22  Alice  <alice@email.address>
+ 
+         Reviewed by Ray.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] Remove entry in the middle.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@@ -7,10 +7,6 @@
@@ -114,13 +139,27 @@ $in = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] Far apart changes (i.e. more than one chunk).";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@@ -7,10 +7,6 @@
+ 
+         * File:
+ 
+-2010-12-22  Bob  <bob@email.address>
+-
+-        Changed some code on 2010-12-22.
+-
+ 2010-12-22  Alice  <alice@email.address>
+ 
+         Reviewed by Ray.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] Far apart changes (i.e. more than one chunk).",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -7,7 +7,7 @@
@@ -141,13 +180,33 @@ $in = <<'END';
  
          Changed some code on 2010-12-21.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] First line is new line.";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -7,7 +7,7 @@
+ 
+         * File:
+ 
+-2010-12-22  Bob  <bob@email.address>
++2010-12-22  Bobby <bob@email.address>
+ 
+         Changed some code on 2010-12-22.
+ 
+@@ -21,7 +21,7 @@
+ 
+         * File2:
+ 
+-2010-12-21  Bob  <bob@email.address>
++2010-12-21  Bobby <bob@email.address>
+ 
+         Changed some code on 2010-12-21.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] First line is new line.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -1,3 +1,11 @@
@@ -163,13 +222,28 @@ $in = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] No date string.";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -1,3 +1,11 @@
++2009-12-22  Bob  <bob@email.address>
++
++        Reviewed by Ray.
++
++        Changed some more code on 2009-12-22.
++
++        * File:
++
+ 2009-12-22  Alice  <alice@email.address>
+ 
+         Reviewed by Ray.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] No date string.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -6,6 +6,7 @@
@@ -181,13 +255,24 @@ $in = <<'END';
  2009-12-21  Alice  <alice@email.address>
  
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] New entry inserted in middle.";
-
-$in = <<'END';
+    expectedReturn => {
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -6,6 +6,7 @@
+ 
+         * File:
+         * File2:
++        * File3:
+ 
+ 2009-12-21  Alice  <alice@email.address>
+ 
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] New entry inserted in middle.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -11,6 +11,14 @@
@@ -206,13 +291,32 @@ $in = <<'END';
  
          * File:
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: [no change] New entry inserted earlier in the file, but after an entry with the same author and date.";
-
-$in = <<'END';
+    expectedReturn => {
+    hasOverlappingLines => 1,
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -11,6 +11,14 @@
+ 
+         Reviewed by Ray.
+ 
++        Changed some more code on 2009-12-21.
++
++        * File:
++
++2009-12-21  Alice  <alice@email.address>
++
++        Reviewed by Ray.
++
+         Changed some code on 2009-12-21.
+ 
+         * File:
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: [no change] New entry inserted earlier in the file, but after an entry with the same author and date.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -70,6 +70,14 @@
@@ -231,13 +335,32 @@ $in = <<'END';
  
          Changed some code on 2009-12-22.
 END
-
-ok(fixChangeLogPatch($in) eq $in, $title);
-
-# New test
-$title = "fixChangeLogPatch: Leading context includes first line.";
-
-$in = <<'END';
+    expectedReturn => {
+    hasOverlappingLines => 1,
+    patch => <<'END',
+--- ChangeLog
++++ ChangeLog
+@@ -70,6 +70,14 @@
+ 
+ 2009-12-22  Alice  <alice@email.address>
+ 
++        Reviewed by Sue.
++
++        Changed some more code on 2009-12-22.
++
++        * File:
++
++2009-12-22  Alice  <alice@email.address>
++
+         Reviewed by Ray.
+ 
+         Changed some code on 2009-12-22.
+END
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: Leading context includes first line.",
+    inputText => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -1,5 +1,13 @@
@@ -255,8 +378,8 @@ $in = <<'END';
  
          Changed some code on 2009-12-22.
 END
-
-$out = <<'END';
+    expectedReturn => {
+    patch => <<'END',
 --- ChangeLog
 +++ ChangeLog
 @@ -1,3 +1,11 @@
@@ -272,13 +395,11 @@ $out = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $out, $title);
-
-# New test
-$title = "fixChangeLogPatch: Leading context does not include first line.";
-
-$in = <<'END';
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: Leading context does not include first line.",
+    inputText => <<'END',
 @@ -2,6 +2,14 @@
  
          Reviewed by Ray.
@@ -295,8 +416,8 @@ $in = <<'END';
  
          * File:
 END
-
-$out = <<'END';
+    expectedReturn => {
+    patch => <<'END',
 @@ -1,3 +1,11 @@
 +2009-12-22  Alice  <alice@email.address>
 +
@@ -310,18 +431,17 @@ $out = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $out, $title);
-
-# New test
-$title = "fixChangeLogPatch: Non-consecutive line additions.";
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: Non-consecutive line additions.",
 
 # This can occur, for example, if the new ChangeLog entry includes
 # trailing white space in the first blank line but not the second.
 # A diff command can then match the second blank line of the new
 # ChangeLog entry with the first blank line of the old.
 # The svn diff command with the default --diff-cmd has done this.
-$in = <<'END';
+    inputText => <<'END',
 @@ -1,5 +1,11 @@
  2009-12-22  Alice  <alice@email.address>
 + <pretend-whitespace>
@@ -335,8 +455,8 @@ $in = <<'END';
  
          Changed some code on 2009-12-22.
 END
-
-$out = <<'END';
+    expectedReturn => {
+    patch => <<'END',
 @@ -1,3 +1,9 @@
 +2009-12-22  Alice  <alice@email.address>
 + <pretend-whitespace>
@@ -348,13 +468,11 @@ $out = <<'END';
  
          Reviewed by Ray.
 END
-
-ok(fixChangeLogPatch($in) eq $out, $title);
-
-# New test
-$title = "fixChangeLogPatch: Additional edits after new entry.";
-
-$in = <<'END';
+    }
+},
+{ # New test
+    diffName => "fixChangeLogPatch: Additional edits after new entry.",
+    inputText => <<'END',
 @@ -2,10 +2,17 @@
  
          Reviewed by Ray.
@@ -375,8 +493,8 @@ $in = <<'END';
  2009-12-21  Alice  <alice@email.address>
  
 END
-
-$out = <<'END';
+    expectedReturn => {
+    patch => <<'END',
 @@ -1,11 +1,18 @@
 +2009-12-22  Alice  <alice@email.address>
 +
@@ -398,5 +516,18 @@ $out = <<'END';
  2009-12-21  Alice  <alice@email.address>
  
 END
+    }
+},
+);
+
+my $testCasesCount = @testCaseHashRefs;
+plan(tests => $testCasesCount); # Total number of assertions.
 
-ok(fixChangeLogPatch($in) eq $out, $title);
+foreach my $testCase (@testCaseHashRefs) {
+    my $testNameStart = "fixChangeLogPatch(): $testCase->{diffName}: comparing";
+
+    my $got = VCSUtils::fixChangeLogPatch($testCase->{inputText});
+    my $expectedReturn = $testCase->{expectedReturn};
+ 
+    is_deeply($got, $expectedReturn, "$testNameStart return value.");
+}
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/api.py b/WebKitTools/Scripts/webkitpy/common/checkout/api.py
index ca28e32..72cad8d 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/api.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/api.py
@@ -83,13 +83,20 @@ class Checkout(object):
     def bug_id_for_revision(self, revision):
         return self.commit_info_for_revision(revision).bug_id()
 
-    def modified_changelogs(self, git_commit):
+    def _modified_files_matching_predicate(self, git_commit, predicate, changed_files=None):
         # SCM returns paths relative to scm.checkout_root
         # Callers (especially those using the ChangeLog class) may
         # expect absolute paths, so this method returns absolute paths.
-        changed_files = self._scm.changed_files(git_commit)
+        if not changed_files:
+            changed_files = self._scm.changed_files(git_commit)
         absolute_paths = [os.path.join(self._scm.checkout_root, path) for path in changed_files]
-        return [path for path in absolute_paths if self._is_path_to_changelog(path)]
+        return [path for path in absolute_paths if predicate(path)]
+
+    def modified_changelogs(self, git_commit, changed_files=None):
+        return self._modified_files_matching_predicate(git_commit, self._is_path_to_changelog, changed_files=changed_files)
+
+    def modified_non_changelogs(self, git_commit, changed_files=None):
+        return self._modified_files_matching_predicate(git_commit, lambda path: not self._is_path_to_changelog(path), changed_files=changed_files)
 
     def commit_message_for_this_commit(self, git_commit):
         changelog_paths = self.modified_changelogs(git_commit)
@@ -109,6 +116,17 @@ class Checkout(object):
         # FIXME: We should sort and label the ChangeLog messages like commit-log-editor does.
         return CommitMessage("".join(changelog_messages).splitlines())
 
+    def recent_commit_infos_for_files(self, paths):
+        revisions = set(sum(map(self._scm.revisions_changing_file, paths), []))
+        return set(map(self.commit_info_for_revision, revisions))
+
+    def suggested_reviewers(self, git_commit):
+        changed_files = self.modified_non_changelogs(git_commit)
+        commit_infos = self.recent_commit_infos_for_files(changed_files)
+        reviewers = [commit_info.reviewer() for commit_info in commit_infos if commit_info.reviewer()]
+        reviewers.extend([commit_info.author() for commit_info in commit_infos if commit_info.author() and commit_info.author().can_review])
+        return sorted(set(reviewers))
+
     def bug_id_for_this_commit(self, git_commit):
         try:
             return parse_bug_id(self.commit_message_for_this_commit(git_commit).message())
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/api_unittest.py b/WebKitTools/Scripts/webkitpy/common/checkout/api_unittest.py
index fdfd879..d7bd95e 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/api_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/api_unittest.py
@@ -173,3 +173,24 @@ class CheckoutTest(unittest.TestCase):
         checkout = Checkout(scm)
         expected_changlogs = ["/foo/bar/ChangeLog", "/foo/bar/relative/path/ChangeLog"]
         self.assertEqual(checkout.modified_changelogs(git_commit=None), expected_changlogs)
+
+    def test_suggested_reviewers(self):
+        def mock_changelog_entries_for_revision(revision):
+            if revision % 2 == 0:
+                return [ChangeLogEntry(_changelog1entry1)]
+            return [ChangeLogEntry(_changelog1entry2)]
+
+        def mock_revisions_changing_file(path, limit=5):
+            if path.endswith("ChangeLog"):
+                return [3]
+            return [4, 8]
+
+        scm = Mock()
+        scm.checkout_root = "/foo/bar"
+        scm.changed_files = lambda git_commit: ["file1", "file2", "relative/path/ChangeLog"]
+        scm.revisions_changing_file = mock_revisions_changing_file
+        checkout = Checkout(scm)
+        checkout.changelog_entries_for_revision = mock_changelog_entries_for_revision
+        reviewers = checkout.suggested_reviewers(git_commit=None)
+        reviewer_names = [reviewer.full_name for reviewer in reviewers]
+        self.assertEqual(reviewer_names, [u'Tor Arne Vestb\xf8'])
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/diff_parser.py b/WebKitTools/Scripts/webkitpy/common/checkout/diff_parser.py
index d8ebae6..a6ea756 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/diff_parser.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/diff_parser.py
@@ -33,9 +33,13 @@ import re
 
 _log = logging.getLogger("webkitpy.common.checkout.diff_parser")
 
+
+# FIXME: This is broken. We should compile our regexps up-front
+# instead of using a custom cache.
 _regexp_compile_cache = {}
 
 
+# FIXME: This function should be removed.
 def match(pattern, string):
     """Matches the string with the pattern, caching the compiled regexp."""
     if not pattern in _regexp_compile_cache:
@@ -43,12 +47,15 @@ def match(pattern, string):
     return _regexp_compile_cache[pattern].match(string)
 
 
+# FIXME: This belongs on DiffParser (e.g. as to_svn_diff()).
 def git_diff_to_svn_diff(line):
     """Converts a git formatted diff line to a svn formatted line.
 
     Args:
       line: A string representing a line of the diff.
     """
+    # FIXME: This list should be a class member on DiffParser.
+    # These regexp patterns should be compiled once instead of every time.
     conversion_patterns = (("^diff --git \w/(.+) \w/(?P<FilePath>.+)", lambda matched: "Index: " + matched.group('FilePath') + "\n"),
                            ("^new file.*", lambda matched: "\n"),
                            ("^index [0-9a-f]{7}\.\.[0-9a-f]{7} [0-9]{6}", lambda matched: "===================================================================\n"),
@@ -62,6 +69,7 @@ def git_diff_to_svn_diff(line):
     return line
 
 
+# FIXME: This method belongs on DiffParser
 def get_diff_converter(first_diff_line):
     """Gets a converter function of diff lines.
 
@@ -80,7 +88,7 @@ _DECLARED_FILE_PATH = 2
 _PROCESSING_CHUNK = 3
 
 
-class DiffFile:
+class DiffFile(object):
     """Contains the information for one file in a patch.
 
     The field "lines" is a list which contains tuples in this format:
@@ -88,6 +96,13 @@ class DiffFile:
     If deleted_line_number is zero, it means this line is newly added.
     If new_line_number is zero, it means this line is deleted.
     """
+    # FIXME: Tuples generally grow into classes.  We should consider
+    # adding a DiffLine object.
+
+    def added_or_modified_line_numbers(self):
+        # This logic was moved from patchreader.py, but may not be
+        # the right API for this object long-term.
+        return [line[1] for line in self.lines if not line[0]]
 
     def __init__(self, filename):
         self.filename = filename
@@ -103,13 +118,14 @@ class DiffFile:
         self.lines.append((deleted_line_number, new_line_number, line))
 
 
-class DiffParser:
+class DiffParser(object):
     """A parser for a patch file.
 
     The field "files" is a dict whose key is the filename and value is
     a DiffFile object.
     """
 
+    # FIXME: This function is way too long and needs to be broken up.
     def __init__(self, diff_input):
         """Parses a diff.
 
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/scm.py b/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
index 793d96d..4bd9ed6 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/scm.py
@@ -245,7 +245,10 @@ class SCM:
     def changed_files(self, git_commit=None):
         self._subclass_must_implement()
 
-    def changed_files_for_revision(self):
+    def changed_files_for_revision(self, revision):
+        self._subclass_must_implement()
+
+    def revisions_changing_file(self, path, limit=5):
         self._subclass_must_implement()
 
     def added_files(self):
@@ -257,7 +260,7 @@ class SCM:
     def display_name(self):
         self._subclass_must_implement()
 
-    def create_patch(self, git_commit=None):
+    def create_patch(self, git_commit=None, changed_files=[]):
         self._subclass_must_implement()
 
     def committer_email_for_revision(self, revision):
@@ -427,6 +430,16 @@ class SVN(SCM):
         status_command = ["svn", "diff", "--summarize", "-c", revision]
         return self.run_status_and_extract_filenames(status_command, self._status_regexp("ACDMR"))
 
+    def revisions_changing_file(self, path, limit=5):
+        revisions = []
+        log_command = ['svn', 'log', '--quiet', '--limit=%s' % limit, path]
+        for line in self.run(log_command, cwd=self.checkout_root).splitlines():
+            match = re.search('^r(?P<revision>\d+) ', line)
+            if not match:
+                continue
+            revisions.append(int(match.group('revision')))
+        return revisions
+
     def conflicted_files(self):
         return self.run_status_and_extract_filenames(self.status_command(), self._status_regexp("C"))
 
@@ -444,11 +457,11 @@ class SVN(SCM):
         return "svn"
 
     # FIXME: This method should be on Checkout.
-    def create_patch(self, git_commit=None):
+    def create_patch(self, git_commit=None, changed_files=[]):
         """Returns a byte array (str()) representing the patch file.
         Patch files are effectively binary since they may contain
         files of multiple different encodings."""
-        return self.run([self.script_path("svn-create-patch")],
+        return self.run([self.script_path("svn-create-patch")] + changed_files,
             cwd=self.checkout_root, return_stderr=False,
             decode_output=False)
 
@@ -653,6 +666,10 @@ class Git(SCM):
         commit_id = self.git_commit_from_svn_revision(revision)
         return self._changes_files_for_commit(commit_id)
 
+    def revisions_changing_file(self, path, limit=5):
+        commit_ids = self.run(["git", "log", "--pretty=format:%H", "-%s" % limit, path]).splitlines()
+        return filter(lambda revision: revision, map(self.svn_revision_from_git_commit, commit_ids))
+
     def conflicted_files(self):
         # We do not need to pass decode_output for this diff command
         # as we're passing --name-status which does not output any data.
@@ -672,12 +689,12 @@ class Git(SCM):
     def display_name(self):
         return "git"
 
-    def create_patch(self, git_commit=None):
+    def create_patch(self, git_commit=None, changed_files=[]):
         """Returns a byte array (str()) representing the patch file.
         Patch files are effectively binary since they may contain
         files of multiple different encodings."""
         # FIXME: This should probably use cwd=self.checkout_root
-        return self.run(['git', 'diff', '--binary', "--no-ext-diff", "--full-index", "-M", self.merge_base(git_commit)], decode_output=False)
+        return self.run(['git', 'diff', '--binary', "--no-ext-diff", "--full-index", "-M", self.merge_base(git_commit), "--"] + changed_files, decode_output=False)
 
     @classmethod
     def git_commit_from_svn_revision(cls, revision):
@@ -688,6 +705,12 @@ class Git(SCM):
             raise ScriptError(message='Failed to find git commit for revision %s, your checkout likely needs an update.' % revision)
         return git_commit
 
+    def svn_revision_from_git_commit(self, commit_id):
+        try:
+            return int(self.run(['git', 'svn', 'find-rev', commit_id]).rstrip())
+        except ValueError, e:
+            return None
+
     def contents_at_revision(self, path, revision):
         """Returns a byte array (str()) containing the contents
         of path @ revision in the repository."""
diff --git a/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py b/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
index 87d5539..4aa5279 100644
--- a/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/checkout/scm_unittest.py
@@ -352,6 +352,10 @@ class SCMTest(unittest.TestCase):
         self.assertRaises(ScriptError, self.scm.contents_at_revision, "test_file2", 2)
         self.assertRaises(ScriptError, self.scm.contents_at_revision, "does_not_exist", 2)
 
+    def _shared_test_revisions_changing_file(self):
+        self.assertEqual(self.scm.revisions_changing_file("test_file"), [5, 4, 3, 2])
+        self.assertRaises(ScriptError, self.scm.revisions_changing_file, "non_existent_file")
+
     def _shared_test_committer_email_for_revision(self):
         self.assertEqual(self.scm.committer_email_for_revision(3), getpass.getuser())  # Committer "email" will be the current user
 
@@ -696,6 +700,9 @@ Q1dTBx0AAAB42itg4GlgYJjGwMDDyODMxMDw34GBgQEAJPQDJA==
     def test_contents_at_revision(self):
         self._shared_test_contents_at_revision()
 
+    def test_revisions_changing_file(self):
+        self._shared_test_revisions_changing_file()
+
     def test_committer_email_for_revision(self):
         self._shared_test_committer_email_for_revision()
 
@@ -964,6 +971,10 @@ class GitSVNTest(SCMTest):
         self.scm.commit_locally_with_message("another test commit")
         self._two_local_commits()
 
+    def test_revisions_changing_files_with_local_commit(self):
+        self._one_local_commit()
+        self.assertEquals(self.scm.revisions_changing_file('test_file_commit1'), [])
+
     def test_commit_with_message(self):
         self._one_local_commit_plus_working_copy_changes()
         scm = detect_scm_system(self.git_checkout_path)
@@ -1087,6 +1098,20 @@ class GitSVNTest(SCMTest):
         self.assertTrue(re.search(r'test_file_commit2', patch))
         self.assertTrue(re.search(r'test_file_commit1', patch))
 
+    def test_create_patch_with_changed_files(self):
+        self._one_local_commit_plus_working_copy_changes()
+        scm = detect_scm_system(self.git_checkout_path)
+        patch = scm.create_patch(changed_files=['test_file_commit2'])
+        self.assertTrue(re.search(r'test_file_commit2', patch))
+
+    def test_create_patch_with_rm_and_changed_files(self):
+        self._one_local_commit_plus_working_copy_changes()
+        scm = detect_scm_system(self.git_checkout_path)
+        os.remove('test_file_commit1')
+        patch = scm.create_patch()
+        patch_with_changed_files = scm.create_patch(changed_files=['test_file_commit1', 'test_file_commit2'])
+        self.assertEquals(patch, patch_with_changed_files)
+
     def test_create_patch_git_commit(self):
         self._two_local_commits()
         scm = detect_scm_system(self.git_checkout_path)
@@ -1199,6 +1224,9 @@ class GitSVNTest(SCMTest):
     def test_contents_at_revision(self):
         self._shared_test_contents_at_revision()
 
+    def test_revisions_changing_file(self):
+        self._shared_test_revisions_changing_file()
+
     def test_added_files(self):
         self._shared_test_added_files()
 
diff --git a/WebKitTools/Scripts/webkitpy/common/config/committers.py b/WebKitTools/Scripts/webkitpy/common/config/committers.py
index 2d07158..f768cf9 100644
--- a/WebKitTools/Scripts/webkitpy/common/config/committers.py
+++ b/WebKitTools/Scripts/webkitpy/common/config/committers.py
@@ -73,6 +73,7 @@ committers_unable_to_review = [
     Committer("Andre Boule", "aboule@apple.com"),
     Committer("Andrei Popescu", "andreip@google.com", "andreip"),
     Committer("Andrew Wellington", ["andrew@webkit.org", "proton@wiretapped.net"], "proton"),
+    Committer("Andrey Kosyakov", "caseq@chromium.org", "caseq"),
     Committer("Andras Becsi", "abecsi@webkit.org", "bbandix"),
     Committer("Andy Estes", "aestes@apple.com", "estes"),
     Committer("Anthony Ricaud", "rik@webkit.org", "rik"),
@@ -104,6 +105,7 @@ committers_unable_to_review = [
     Committer("Eric Roman", "eroman@chromium.org", "eroman"),
     Committer("Evan Martin", "evan@chromium.org", "evmar"),
     Committer("Evan Stade", "estade@chromium.org", "estade"),
+    Committer("Fady Samuel", "fsamuel@chromium.org", "fsamuel"),
     Committer("Feng Qian", "feng@chromium.org"),
     Committer("Fumitoshi Ukai", "ukai@chromium.org", "ukai"),
     Committer("Gabor Loki", "loki@webkit.org", "loki04"),
@@ -144,10 +146,12 @@ committers_unable_to_review = [
     Committer("Luiz Agostini", ["luiz@webkit.org", "luiz.agostini@openbossa.org"], "lca"),
     Committer("Mads Ager", "ager@chromium.org"),
     Committer("Marcus Voltis Bulach", "bulach@chromium.org"),
+    Committer("Matt Delaney", "mdelaney@apple.com"),
     Committer("Matt Lilek", ["webkit@mattlilek.com", "pewtermoose@webkit.org"]),
     Committer("Matt Perry", "mpcomplete@chromium.org"),
     Committer("Maxime Britto", ["maxime.britto@gmail.com", "britto@apple.com"]),
     Committer("Maxime Simon", ["simon.maxime@gmail.com", "maxime.simon@webkit.org"], "maxime.simon"),
+    Committer("Michael Nordman", "michaeln@google.com", "michaeln"),
     Committer("Michael Saboff", "msaboff@apple.com"),
     Committer("Michelangelo De Simone", "michelangelo@webkit.org", "michelangelo"),
     Committer("Mihai Parparita", "mihaip@chromium.org", "mihaip"),
@@ -183,6 +187,7 @@ committers_unable_to_review = [
     Committer("Yaar Schnitman", ["yaar@chromium.org", "yaar@google.com"]),
     Committer("Yong Li", ["yong.li.webkit@gmail.com", "yong.li@torchmobile.com"], "yong"),
     Committer("Yongjun Zhang", "yongjun.zhang@nokia.com"),
+    Committer("Yuta Kitamura", "yutak@chromium.org", "yutak"),
     Committer("Yuzo Fujishima", "yuzo@google.com", "yuzo"),
     Committer("Zhenyao Mo", "zmo@google.com", "zhenyao"),
     Committer("Zoltan Herczeg", "zherczeg@webkit.org", "zherczeg"),
@@ -205,7 +210,7 @@ reviewers_list = [
     Reviewer("Alice Liu", "alice.liu@apple.com", "aliu"),
     Reviewer("Alp Toker", ["alp@nuanti.com", "alp@atoker.com", "alp@webkit.org"], "alp"),
     Reviewer("Anders Carlsson", ["andersca@apple.com", "acarlsson@apple.com"], "andersca"),
-    Reviewer("Andreas Kling", "andreas.kling@nokia.com", "kling"),
+    Reviewer("Andreas Kling", ["kling@webkit.org", "andreas.kling@nokia.com"], "kling"),
     Reviewer("Antonio Gomes", ["tonikitoo@webkit.org", "agomes@rim.com"], "tonikitoo"),
     Reviewer("Antti Koivisto", ["koivisto@iki.fi", "antti@apple.com", "antti.j.koivisto@nokia.com"], "anttik"),
     Reviewer("Ariya Hidayat", ["ariya@sencha.com", "ariya.hidayat@gmail.com", "ariya@webkit.org"], "ariya"),
@@ -256,7 +261,7 @@ reviewers_list = [
     Reviewer("Laszlo Gombos", "laszlo.1.gombos@nokia.com", "lgombos"),
     Reviewer("Maciej Stachowiak", "mjs@apple.com", "othermaciej"),
     Reviewer("Mark Rowe", "mrowe@apple.com", "bdash"),
-    Reviewer("Martin Robinson", ["mrobinson@igalia.com", "mrobinson@webkit.org", "martin.james.robinson@gmail.com"], "mrobinson"),
+    Reviewer("Martin Robinson", ["mrobinson@webkit.org", "mrobinson@igalia.com", "martin.james.robinson@gmail.com"], "mrobinson"),
     Reviewer("Nate Chapin", "japhet@chromium.org", "japhet"),
     Reviewer("Nikolas Zimmermann", ["zimmermann@kde.org", "zimmermann@physik.rwth-aachen.de", "zimmermann@webkit.org"], "wildfox"),
     Reviewer("Ojan Vafai", "ojan@chromium.org", "ojan"),
diff --git a/WebKitTools/Scripts/webkitpy/common/config/ports.py b/WebKitTools/Scripts/webkitpy/common/config/ports.py
index ebd88b1..d268865 100644
--- a/WebKitTools/Scripts/webkitpy/common/config/ports.py
+++ b/WebKitTools/Scripts/webkitpy/common/config/ports.py
@@ -45,6 +45,7 @@ class WebKitPort(object):
     def port(port_name):
         ports = {
             "chromium": ChromiumPort,
+            "chromium-xvfb": ChromiumXVFBPort,
             "gtk": GtkPort,
             "mac": MacPort,
             "win": WinPort,
@@ -102,6 +103,10 @@ class WebKitPort(object):
     def run_perl_unittests_command(cls):
         return [cls.script_path("test-webkitperl")]
 
+    @classmethod
+    def layout_tests_results_path(cls):
+        return "/tmp/layout-test-results/results.html"
+
 
 class MacPort(WebKitPort):
 
@@ -217,3 +222,28 @@ class ChromiumPort(WebKitPort):
         command = WebKitPort.build_webkit_command(build_style=build_style)
         command.append("--chromium")
         return command
+
+    @classmethod
+    def run_webkit_tests_command(cls):
+        return [
+            cls.script_path("new-run-webkit-tests"),
+            "--chromium",
+            "--use-drt",
+            "--no-pixel-tests",
+        ]
+
+    @classmethod
+    def run_javascriptcore_tests_command(cls):
+        return None
+
+
+class ChromiumXVFBPort(ChromiumPort):
+
+    @classmethod
+    def flag(cls):
+        return "--port=chromium-xvfb"
+
+    @classmethod
+    def run_webkit_tests_command(cls):
+        # FIXME: We should find a better way to do this.
+        return ["xvfb-run"] + ChromiumPort.run_webkit_tests_command()
diff --git a/WebKitTools/Scripts/webkitpy/common/config/ports_unittest.py b/WebKitTools/Scripts/webkitpy/common/config/ports_unittest.py
index 42c4f2d..3bdf0e6 100644
--- a/WebKitTools/Scripts/webkitpy/common/config/ports_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/config/ports_unittest.py
@@ -29,7 +29,7 @@
 
 import unittest
 
-from webkitpy.common.config.ports import WebKitPort, MacPort, GtkPort, QtPort, ChromiumPort
+from webkitpy.common.config.ports import *
 
 
 class WebKitPortTest(unittest.TestCase):
@@ -64,11 +64,13 @@ class WebKitPortTest(unittest.TestCase):
     def test_chromium_port(self):
         self.assertEquals(ChromiumPort.name(), "Chromium")
         self.assertEquals(ChromiumPort.flag(), "--port=chromium")
-        self.assertEquals(ChromiumPort.run_webkit_tests_command(), [WebKitPort.script_path("run-webkit-tests")])
+        self.assertEquals(ChromiumPort.run_webkit_tests_command(), [WebKitPort.script_path("new-run-webkit-tests"), "--chromium", "--use-drt", "--no-pixel-tests"])
         self.assertEquals(ChromiumPort.build_webkit_command(), [WebKitPort.script_path("build-webkit"), "--chromium"])
         self.assertEquals(ChromiumPort.build_webkit_command(build_style="debug"), [WebKitPort.script_path("build-webkit"), "--debug", "--chromium"])
         self.assertEquals(ChromiumPort.update_webkit_command(), [WebKitPort.script_path("update-webkit"), "--chromium"])
 
+    def test_chromium_xvfb_port(self):
+        self.assertEquals(ChromiumXVFBPort.run_webkit_tests_command(), ["xvfb-run", "WebKitTools/Scripts/new-run-webkit-tests", "--chromium", "--use-drt", "--no-pixel-tests"])
 
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/common/net/bugzilla.py b/WebKitTools/Scripts/webkitpy/common/net/bugzilla.py
index cc64fac..94519a7 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/bugzilla.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/bugzilla.py
@@ -301,15 +301,14 @@ class BugzillaQueries(object):
         review_queue_url = "buglist.cgi?query_format=advanced&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&field0-0-0=flagtypes.name&type0-0-0=equals&value0-0-0=review?"
         return self._fetch_bug_ids_advanced_query(review_queue_url)
 
+    # This method will make several requests to bugzilla.
     def fetch_patches_from_review_queue(self, limit=None):
         # [:None] returns the whole array.
         return sum([self._fetch_bug(bug_id).unreviewed_patches()
             for bug_id in self._fetch_bug_ids_from_review_queue()[:limit]], [])
 
-    # FIXME: Why do we have both fetch_patches_from_review_queue and
-    # fetch_attachment_ids_from_review_queue??
-    # NOTE: This is also the only client of _fetch_attachment_ids_request_query
-
+    # NOTE: This is the only client of _fetch_attachment_ids_request_query
+    # This method only makes one request to bugzilla.
     def fetch_attachment_ids_from_review_queue(self):
         review_queue_url = "request.cgi?action=queue&type=review&group=type"
         return self._fetch_attachment_ids_request_query(review_queue_url)
diff --git a/WebKitTools/Scripts/webkitpy/common/net/bugzilla_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/bugzilla_unittest.py
index 32f23cd..3a454d6 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/bugzilla_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/bugzilla_unittest.py
@@ -33,24 +33,11 @@ import datetime
 from webkitpy.common.config.committers import CommitterList, Reviewer, Committer
 from webkitpy.common.net.bugzilla import Bugzilla, BugzillaQueries, parse_bug_id, CommitterValidator, Bug
 from webkitpy.common.system.outputcapture import OutputCapture
+from webkitpy.tool.mocktool import MockBrowser
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup
 
 
-class MockBrowser(object):
-    def open(self, url):
-        pass
-
-    def select_form(self, name):
-        pass
-
-    def __setitem__(self, key, value):
-        pass
-
-    def submit(self):
-        pass
-
-
 class BugTest(unittest.TestCase):
     def test_is_unassigned(self):
         for email in Bug.unassigned_emails:
diff --git a/WebKitTools/Scripts/webkitpy/common/net/buildbot.py b/WebKitTools/Scripts/webkitpy/common/net/buildbot.py
index 17f6c7a..a14bc7f 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/buildbot.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/buildbot.py
@@ -35,12 +35,12 @@ import urllib2
 import xmlrpclib
 
 from webkitpy.common.net.failuremap import FailureMap
+from webkitpy.common.net.layouttestresults import LayoutTestResults
 from webkitpy.common.net.regressionwindow import RegressionWindow
 from webkitpy.common.system.logutils import get_logger
 from webkitpy.thirdparty.autoinstalled.mechanize import Browser
 from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup
 
-
 _log = get_logger(__file__)
 
 
@@ -108,6 +108,7 @@ class Builder(object):
 
     def _fetch_revision_to_build_map(self):
         # All _fetch requests go through _buildbot for easier mocking
+        # FIXME: This should use NetworkTransaction's 404 handling instead.
         try:
             # FIXME: This method is horribly slow due to the huge network load.
             # FIXME: This is a poor way to do revision -> build mapping.
@@ -166,22 +167,23 @@ class Builder(object):
                 failures = set(results.failing_tests())
                 if common_failures == None:
                     common_failures = failures
-                common_failures = common_failures.intersection(failures)
-                if not common_failures:
-                    # current_build doesn't have any failures in common with
-                    # the red build we're worried about.  We assume that any
-                    # failures in current_build were due to flakiness.
-                    break
+                else:
+                    common_failures = common_failures.intersection(failures)
+                    if not common_failures:
+                        # current_build doesn't have any failures in common with
+                        # the red build we're worried about.  We assume that any
+                        # failures in current_build were due to flakiness.
+                        break
             look_back_count += 1
             if look_back_count > look_back_limit:
-                return RegressionWindow(None, current_build, common_failures=common_failures)
+                return RegressionWindow(None, current_build, failing_tests=common_failures)
             build_after_current_build = current_build
             current_build = current_build.previous_build()
         # We must iterate at least once because red_build is red.
         assert(build_after_current_build)
         # Current build must either be green or have no failures in common
         # with red build, so we've found our failure transition.
-        return RegressionWindow(current_build, build_after_current_build, common_failures=common_failures)
+        return RegressionWindow(current_build, build_after_current_build, failing_tests=common_failures)
 
     def find_blameworthy_regression_window(self, red_build_number, look_back_limit=30, avoid_flakey_tests=True):
         red_build = self.build(red_build_number)
@@ -195,66 +197,6 @@ class Builder(object):
         return regression_window
 
 
-# FIXME: This should be unified with all the layout test results code in the layout_tests package
-class LayoutTestResults(object):
-    stderr_key = u'Tests that had stderr output:'
-    fail_key = u'Tests where results did not match expected results:'
-    timeout_key = u'Tests that timed out:'
-    crash_key = u'Tests that caused the DumpRenderTree tool to crash:'
-    missing_key = u'Tests that had no expected results (probably new):'
-
-    expected_keys = [
-        stderr_key,
-        fail_key,
-        crash_key,
-        timeout_key,
-        missing_key,
-    ]
-
-    @classmethod
-    def _parse_results_html(cls, page):
-        parsed_results = {}
-        tables = BeautifulSoup(page).findAll("table")
-        for table in tables:
-            table_title = unicode(table.findPreviousSibling("p").string)
-            if table_title not in cls.expected_keys:
-                # This Exception should only ever be hit if run-webkit-tests changes its results.html format.
-                raise Exception("Unhandled title: %s" % table_title)
-            # We might want to translate table titles into identifiers before storing.
-            parsed_results[table_title] = [unicode(row.find("a").string) for row in table.findAll("tr")]
-
-        return parsed_results
-
-    @classmethod
-    def _fetch_results_html(cls, base_url):
-        results_html = "%s/results.html" % base_url
-        # FIXME: We need to move this sort of 404 logic into NetworkTransaction or similar.
-        try:
-            page = urllib2.urlopen(results_html)
-            return cls._parse_results_html(page)
-        except urllib2.HTTPError, error:
-            if error.code != 404:
-                raise
-
-    @classmethod
-    def results_from_url(cls, base_url):
-        parsed_results = cls._fetch_results_html(base_url)
-        if not parsed_results:
-            return None
-        return cls(base_url, parsed_results)
-
-    def __init__(self, base_url, parsed_results):
-        self._base_url = base_url
-        self._parsed_results = parsed_results
-
-    def parsed_results(self):
-        return self._parsed_results
-
-    def failing_tests(self):
-        failing_keys = [self.fail_key, self.crash_key, self.timeout_key]
-        return sorted(sum([tests for key, tests in self._parsed_results.items() if key in failing_keys], []))
-
-
 class Build(object):
     def __init__(self, builder, build_number, revision, is_green):
         self._builder = builder
@@ -274,9 +216,19 @@ class Build(object):
         results_directory = "r%s (%s)" % (self.revision(), self._number)
         return "%s/%s" % (self._builder.results_url(), urllib.quote(results_directory))
 
+    def _fetch_results_html(self):
+        results_html = "%s/results.html" % (self.results_url())
+        # FIXME: This should use NetworkTransaction's 404 handling instead.
+        try:
+            return urllib2.urlopen(results_html)
+        except urllib2.HTTPError, error:
+            if error.code != 404:
+                raise
+
     def layout_test_results(self):
         if not self._layout_test_results:
-            self._layout_test_results = LayoutTestResults.results_from_url(self.results_url())
+            # FIXME: This should cache that the result was a 404 and stop hitting the network.
+            self._layout_test_results = LayoutTestResults.results_from_string(self._fetch_results_html())
         return self._layout_test_results
 
     def builder(self):
@@ -461,7 +413,8 @@ class BuildBot(object):
                 continue
             builder = self.builder_with_name(builder_status["name"])
             regression_window = builder.find_blameworthy_regression_window(builder_status["build_number"])
-            failure_map.add_regression_window(builder, regression_window)
+            if regression_window:
+                failure_map.add_regression_window(builder, regression_window)
         return failure_map
 
     # This makes fewer requests than calling Builder.latest_build would.  It grabs all builder
diff --git a/WebKitTools/Scripts/webkitpy/common/net/buildbot_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/buildbot_unittest.py
index c99ab32..afc9a39 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/buildbot_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/buildbot_unittest.py
@@ -29,7 +29,6 @@
 import unittest
 
 from webkitpy.common.net.buildbot import BuildBot, Builder, Build, LayoutTestResults
-
 from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup
 
 
@@ -42,10 +41,8 @@ class BuilderTest(unittest.TestCase):
                 revision=build_number + 1000,
                 is_green=build_number < 4
             )
-            build._layout_test_results = LayoutTestResults(
-                "http://buildbot.example.com/foo", {
-                    LayoutTestResults.fail_key: failure(build_number),
-                })
+            parsed_results = {LayoutTestResults.fail_key: failure(build_number)}
+            build._layout_test_results = LayoutTestResults(parsed_results)
             return build
         self.builder._fetch_build = _mock_fetch_build
 
@@ -114,45 +111,6 @@ class BuilderTest(unittest.TestCase):
             self.assertEqual(self.builder._revision_and_build_for_filename(filename), revision_and_build)
 
 
-class LayoutTestResultsTest(unittest.TestCase):
-    _example_results_html = """
-<html>
-<head>
-<title>Layout Test Results</title>
-</head>
-<body>
-<p>Tests that had stderr output:</p>
-<table>
-<tr>
-<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/accessibility/aria-activedescendant-crash.html">accessibility/aria-activedescendant-crash.html</a></td>
-<td><a href="accessibility/aria-activedescendant-crash-stderr.txt">stderr</a></td>
-</tr>
-<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/http/tests/security/canvas-remote-read-svg-image.html">http/tests/security/canvas-remote-read-svg-image.html</a></td>
-<td><a href="http/tests/security/canvas-remote-read-svg-image-stderr.txt">stderr</a></td>
-</tr>
-</table><p>Tests that had no expected results (probably new):</p>
-<table>
-<tr>
-<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/fast/repaint/no-caret-repaint-in-non-content-editable-element.html">fast/repaint/no-caret-repaint-in-non-content-editable-element.html</a></td>
-<td><a href="fast/repaint/no-caret-repaint-in-non-content-editable-element-actual.txt">result</a></td>
-</tr>
-</table></body>
-</html>
-"""
-
-    _expected_layout_test_results = {
-        'Tests that had stderr output:' : [
-            'accessibility/aria-activedescendant-crash.html'
-        ],
-        'Tests that had no expected results (probably new):' : [
-            'fast/repaint/no-caret-repaint-in-non-content-editable-element.html'
-        ]
-    }
-    def test_parse_layout_test_results(self):
-        results = LayoutTestResults._parse_results_html(self._example_results_html)
-        self.assertEqual(self._expected_layout_test_results, results)
-
-
 class BuildBotTest(unittest.TestCase):
 
     _example_one_box_status = '''
diff --git a/WebKitTools/Scripts/webkitpy/common/net/failuremap.py b/WebKitTools/Scripts/webkitpy/common/net/failuremap.py
index 98e4b8f..e2d53ae 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/failuremap.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/failuremap.py
@@ -37,12 +37,48 @@ class FailureMap(object):
             'regression_window': regression_window,
         })
 
-    def revisions_causing_failures(self):
-        revision_to_failing_bots = {}
-        for failure_info in self._failures:
-            revisions = failure_info['regression_window'].revisions()
-            for revision in revisions:
-                failing_bots = revision_to_failing_bots.get(revision, [])
-                failing_bots.append(failure_info['builder'])
-                revision_to_failing_bots[revision] = failing_bots
-        return revision_to_failing_bots
+    def is_empty(self):
+        return not self._failures
+
+    def failing_revisions(self):
+        failing_revisions = [failure_info['regression_window'].revisions()
+                             for failure_info in self._failures]
+        return sorted(set(sum(failing_revisions, [])))
+
+    def builders_failing_for(self, revision):
+        return self._builders_failing_because_of([revision])
+
+    def tests_failing_for(self, revision):
+        tests = [failure_info['regression_window'].failing_tests()
+                 for failure_info in self._failures
+                 if revision in failure_info['regression_window'].revisions()
+                    and failure_info['regression_window'].failing_tests()]
+        result = set()
+        for test in tests:
+            result = result.union(test)
+        return sorted(result)
+
+    def _old_failures(self, is_old_failure):
+        return filter(lambda revision: is_old_failure(revision),
+                      self.failing_revisions())
+
+    def _builders_failing_because_of(self, revisions):
+        revision_set = set(revisions)
+        return [failure_info['builder'] for failure_info in self._failures
+                if revision_set.intersection(
+                    failure_info['regression_window'].revisions())]
+
+    # FIXME: We should re-process old failures after some time delay.
+    # https://bugs.webkit.org/show_bug.cgi?id=36581
+    def filter_out_old_failures(self, is_old_failure):
+        old_failures = self._old_failures(is_old_failure)
+        old_failing_builder_names = set([builder.name()
+            for builder in self._builders_failing_because_of(old_failures)])
+
+        # We filter out all the failing builders that could have been caused
+        # by old_failures.  We could miss some new failures this way, but
+        # emperically, this reduces the amount of spam we generate.
+        failures = self._failures
+        self._failures = [failure_info for failure_info in failures
+            if failure_info['builder'].name() not in old_failing_builder_names]
+        self._cache = {}
diff --git a/WebKitTools/Scripts/webkitpy/common/net/failuremap_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/failuremap_unittest.py
new file mode 100644
index 0000000..2f0b49d
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/common/net/failuremap_unittest.py
@@ -0,0 +1,76 @@
+# Copyright (c) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.net.buildbot import Build
+from webkitpy.common.net.failuremap import *
+from webkitpy.common.net.regressionwindow import RegressionWindow
+from webkitpy.tool.mocktool import MockBuilder
+
+
+class FailureMapTest(unittest.TestCase):
+    builder1 = MockBuilder("Builder1")
+    builder2 = MockBuilder("Builder2")
+
+    build1a = Build(builder1, build_number=22, revision=1233, is_green=True)
+    build1b = Build(builder1, build_number=23, revision=1234, is_green=False)
+    build2a = Build(builder2, build_number=89, revision=1233, is_green=True)
+    build2b = Build(builder2, build_number=90, revision=1235, is_green=False)
+
+    regression_window1 = RegressionWindow(build1a, build1b, failing_tests=[u'test1', u'test1'])
+    regression_window2 = RegressionWindow(build2a, build2b, failing_tests=[u'test1'])
+
+    def _make_failure_map(self):
+        failure_map = FailureMap()
+        failure_map.add_regression_window(self.builder1, self.regression_window1)
+        failure_map.add_regression_window(self.builder2, self.regression_window2)
+        return failure_map
+
+    def test_failing_revisions(self):
+        failure_map = self._make_failure_map()
+        self.assertEquals(failure_map.failing_revisions(), [1234, 1235])
+
+    def test_new_failures(self):
+        failure_map = self._make_failure_map()
+        failure_map.filter_out_old_failures(lambda revision: False)
+        self.assertEquals(failure_map.failing_revisions(), [1234, 1235])
+
+    def test_new_failures_with_old_revisions(self):
+        failure_map = self._make_failure_map()
+        failure_map.filter_out_old_failures(lambda revision: revision == 1234)
+        self.assertEquals(failure_map.failing_revisions(), [])
+
+    def test_new_failures_with_more_old_revisions(self):
+        failure_map = self._make_failure_map()
+        failure_map.filter_out_old_failures(lambda revision: revision == 1235)
+        self.assertEquals(failure_map.failing_revisions(), [1234])
+
+    def test_tests_failing_for(self):
+        failure_map = self._make_failure_map()
+        self.assertEquals(failure_map.tests_failing_for(1234), [u'test1'])
diff --git a/WebKitTools/Scripts/webkitpy/common/net/layouttestresults.py b/WebKitTools/Scripts/webkitpy/common/net/layouttestresults.py
new file mode 100644
index 0000000..2f7b3e6
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/common/net/layouttestresults.py
@@ -0,0 +1,88 @@
+# Copyright (c) 2010, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+#
+# A module for parsing results.html files generated by old-run-webkit-tests
+
+from webkitpy.thirdparty.BeautifulSoup import BeautifulSoup, SoupStrainer
+
+
+# FIXME: This should be unified with all the layout test results code in the layout_tests package
+# This doesn't belong in common.net, but we don't have a better place for it yet.
+def path_for_layout_test(test_name):
+    return "LayoutTests/%s" % test_name
+
+
+# FIXME: This should be unified with all the layout test results code in the layout_tests package
+# This doesn't belong in common.net, but we don't have a better place for it yet.
+class LayoutTestResults(object):
+    """This class knows how to parse old-run-webkit-tests results.html files."""
+
+    stderr_key = u'Tests that had stderr output:'
+    fail_key = u'Tests where results did not match expected results:'
+    timeout_key = u'Tests that timed out:'
+    crash_key = u'Tests that caused the DumpRenderTree tool to crash:'
+    missing_key = u'Tests that had no expected results (probably new):'
+
+    expected_keys = [
+        stderr_key,
+        fail_key,
+        crash_key,
+        timeout_key,
+        missing_key,
+    ]
+
+    @classmethod
+    def _parse_results_html(cls, page):
+        parsed_results = {}
+        tables = BeautifulSoup(page).findAll("table")
+        for table in tables:
+            table_title = unicode(table.findPreviousSibling("p").string)
+            if table_title not in cls.expected_keys:
+                # This Exception should only ever be hit if run-webkit-tests changes its results.html format.
+                raise Exception("Unhandled title: %s" % table_title)
+            # We might want to translate table titles into identifiers before storing.
+            parsed_results[table_title] = [unicode(row.find("a").string) for row in table.findAll("tr")]
+
+        return parsed_results
+
+    @classmethod
+    def results_from_string(cls, string):
+        parsed_results = cls._parse_results_html(string)
+        if not parsed_results:
+            return None
+        return cls(parsed_results)
+
+    def __init__(self, parsed_results):
+        self._parsed_results = parsed_results
+
+    def parsed_results(self):
+        return self._parsed_results
+
+    def failing_tests(self):
+        failing_keys = [self.fail_key, self.crash_key, self.timeout_key]
+        return sorted(sum([tests for key, tests in self._parsed_results.items() if key in failing_keys], []))
diff --git a/WebKitTools/Scripts/webkitpy/common/net/layouttestresults_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/layouttestresults_unittest.py
new file mode 100644
index 0000000..44e4dbc
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/common/net/layouttestresults_unittest.py
@@ -0,0 +1,76 @@
+# Copyright (c) 2010, Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from webkitpy.common.net.layouttestresults import LayoutTestResults
+
+
+class LayoutTestResultsTest(unittest.TestCase):
+    _example_results_html = """
+<html>
+<head>
+<title>Layout Test Results</title>
+</head>
+<body>
+<p>Tests that had stderr output:</p>
+<table>
+<tr>
+<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/accessibility/aria-activedescendant-crash.html">accessibility/aria-activedescendant-crash.html</a></td>
+<td><a href="accessibility/aria-activedescendant-crash-stderr.txt">stderr</a></td>
+</tr>
+<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/http/tests/security/canvas-remote-read-svg-image.html">http/tests/security/canvas-remote-read-svg-image.html</a></td>
+<td><a href="http/tests/security/canvas-remote-read-svg-image-stderr.txt">stderr</a></td>
+</tr>
+</table><p>Tests that had no expected results (probably new):</p>
+<table>
+<tr>
+<td><a href="/var/lib/buildbot/build/gtk-linux-64-release/build/LayoutTests/fast/repaint/no-caret-repaint-in-non-content-editable-element.html">fast/repaint/no-caret-repaint-in-non-content-editable-element.html</a></td>
+<td><a href="fast/repaint/no-caret-repaint-in-non-content-editable-element-actual.txt">result</a></td>
+</tr>
+</table></body>
+</html>
+"""
+
+    _expected_layout_test_results = {
+        'Tests that had stderr output:': [
+            'accessibility/aria-activedescendant-crash.html',
+        ],
+        'Tests that had no expected results (probably new):': [
+            'fast/repaint/no-caret-repaint-in-non-content-editable-element.html',
+        ],
+    }
+
+    def test_parse_layout_test_results(self):
+        results = LayoutTestResults._parse_results_html(self._example_results_html)
+        self.assertEqual(self._expected_layout_test_results, results)
+
+    def test_results_from_string(self):
+        self.assertEqual(LayoutTestResults.results_from_string(""), None)
+        results = LayoutTestResults.results_from_string(self._example_results_html)
+        self.assertEqual(len(results.failing_tests()), 0)
diff --git a/WebKitTools/Scripts/webkitpy/common/net/networktransaction.py b/WebKitTools/Scripts/webkitpy/common/net/networktransaction.py
index c82fc6f..de19e94 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/networktransaction.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/networktransaction.py
@@ -29,7 +29,7 @@
 import logging
 import time
 
-from webkitpy.thirdparty.autoinstalled.mechanize import HTTPError
+from webkitpy.thirdparty.autoinstalled import mechanize
 from webkitpy.common.system.deprecated_logging import log
 
 
@@ -41,10 +41,11 @@ class NetworkTimeout(Exception):
 
 
 class NetworkTransaction(object):
-    def __init__(self, initial_backoff_seconds=10, grown_factor=1.5, timeout_seconds=10*60):
+    def __init__(self, initial_backoff_seconds=10, grown_factor=1.5, timeout_seconds=(10 * 60), convert_404_to_None=False):
         self._initial_backoff_seconds = initial_backoff_seconds
         self._grown_factor = grown_factor
         self._timeout_seconds = timeout_seconds
+        self._convert_404_to_None = convert_404_to_None
 
     def run(self, request):
         self._total_sleep = 0
@@ -52,7 +53,10 @@ class NetworkTransaction(object):
         while True:
             try:
                 return request()
-            except HTTPError, e:
+            # FIXME: We should catch urllib2.HTTPError here too.
+            except mechanize.HTTPError, e:
+                if self._convert_404_to_None and e.code == 404:
+                    return None
                 self._check_for_timeout()
                 _log.warn("Received HTTP status %s from server.  Retrying in "
                           "%s seconds..." % (e.code, self._backoff_seconds))
diff --git a/WebKitTools/Scripts/webkitpy/common/net/networktransaction_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/networktransaction_unittest.py
index cd0702b..49aaeed 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/networktransaction_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/networktransaction_unittest.py
@@ -56,29 +56,36 @@ class NetworkTransactionTest(LoggingTestCase):
         self.assertTrue(did_throw_exception)
         self.assertTrue(did_process_exception)
 
-    def _raise_http_error(self):
+    def _raise_500_error(self):
         self._run_count += 1
         if self._run_count < 3:
-            raise HTTPError("http://example.com/", 500, "inteneral server error", None, None)
+            raise HTTPError("http://example.com/", 500, "internal server error", None, None)
         return 42
 
+    def _raise_404_error(self):
+        raise HTTPError("http://foo.com/", 404, "not found", None, None)
+
     def test_retry(self):
         self._run_count = 0
         transaction = NetworkTransaction(initial_backoff_seconds=0)
-        self.assertEqual(transaction.run(lambda: self._raise_http_error()), 42)
+        self.assertEqual(transaction.run(lambda: self._raise_500_error()), 42)
         self.assertEqual(self._run_count, 3)
         self.assertLog(['WARNING: Received HTTP status 500 from server.  '
                         'Retrying in 0 seconds...\n',
                         'WARNING: Received HTTP status 500 from server.  '
                         'Retrying in 0.0 seconds...\n'])
 
+    def test_convert_404_to_None(self):
+        transaction = NetworkTransaction(convert_404_to_None=True)
+        self.assertEqual(transaction.run(lambda: self._raise_404_error()), None)
+
     def test_timeout(self):
         self._run_count = 0
         transaction = NetworkTransaction(initial_backoff_seconds=60*60, timeout_seconds=60)
         did_process_exception = False
         did_throw_exception = True
         try:
-            transaction.run(lambda: self._raise_http_error())
+            transaction.run(lambda: self._raise_500_error())
             did_throw_exception = False
         except NetworkTimeout, e:
             did_process_exception = True
diff --git a/WebKitTools/Scripts/webkitpy/common/net/regressionwindow.py b/WebKitTools/Scripts/webkitpy/common/net/regressionwindow.py
index 231459f..ad89815 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/regressionwindow.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/regressionwindow.py
@@ -28,10 +28,11 @@
 
 
 class RegressionWindow(object):
-    def __init__(self, build_before_failure, failing_build, common_failures=None):
+    def __init__(self, build_before_failure, failing_build, failing_tests=None):
         self._build_before_failure = build_before_failure
         self._failing_build = failing_build
-        self._common_failures = common_failures
+        self._failing_tests = failing_tests
+        self._revisions = None
 
     def build_before_failure(self):
         return self._build_before_failure
@@ -39,10 +40,12 @@ class RegressionWindow(object):
     def failing_build(self):
         return self._failing_build
 
-    def common_failures(self):
-        return self._common_failures
+    def failing_tests(self):
+        return self._failing_tests
 
     def revisions(self):
-        revisions = range(self._failing_build.revision(), self._build_before_failure.revision(), -1)
-        revisions.reverse()
-        return revisions
+        # Cache revisions to avoid excessive allocations.
+        if not self._revisions:
+            self._revisions = range(self._failing_build.revision(), self._build_before_failure.revision(), -1)
+            self._revisions.reverse()
+        return self._revisions
diff --git a/WebKitTools/Scripts/webkitpy/common/net/statusserver.py b/WebKitTools/Scripts/webkitpy/common/net/statusserver.py
index 57390b8..3d03dcd 100644
--- a/WebKitTools/Scripts/webkitpy/common/net/statusserver.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/statusserver.py
@@ -41,14 +41,18 @@ _log = logging.getLogger("webkitpy.common.net.statusserver")
 class StatusServer:
     default_host = "queues.webkit.org"
 
-    def __init__(self, host=default_host):
+    def __init__(self, host=default_host, browser=None, bot_id=None):
         self.set_host(host)
-        self.browser = Browser()
+        self._browser = browser or Browser()
+        self.set_bot_id(bot_id)
 
     def set_host(self, host):
         self.host = host
         self.url = "http://%s" % self.host
 
+    def set_bot_id(self, bot_id):
+        self.bot_id = bot_id
+
     def results_url_for_status(self, status_id):
         return "%s/results/%s" % (self.url, status_id)
 
@@ -56,14 +60,14 @@ class StatusServer:
         if not patch:
             return
         if patch.bug_id():
-            self.browser["bug_id"] = unicode(patch.bug_id())
+            self._browser["bug_id"] = unicode(patch.bug_id())
         if patch.id():
-            self.browser["patch_id"] = unicode(patch.id())
+            self._browser["patch_id"] = unicode(patch.id())
 
     def _add_results_file(self, results_file):
         if not results_file:
             return
-        self.browser.add_file(results_file, "text/plain", "results.txt", 'results_file')
+        self._browser.add_file(results_file, "text/plain", "results.txt", 'results_file')
 
     def _post_status_to_server(self, queue_name, status, patch, results_file):
         if results_file:
@@ -71,36 +75,61 @@ class StatusServer:
             results_file.seek(0)
 
         update_status_url = "%s/update-status" % self.url
-        self.browser.open(update_status_url)
-        self.browser.select_form(name="update_status")
-        self.browser["queue_name"] = queue_name
+        self._browser.open(update_status_url)
+        self._browser.select_form(name="update_status")
+        self._browser["queue_name"] = queue_name
+        if self.bot_id:
+            self._browser["bot_id"] = self.bot_id
         self._add_patch(patch)
-        self.browser["status"] = status
+        self._browser["status"] = status
         self._add_results_file(results_file)
-        return self.browser.submit().read() # This is the id of the newly created status object.
+        return self._browser.submit().read()  # This is the id of the newly created status object.
 
     def _post_svn_revision_to_server(self, svn_revision_number, broken_bot):
         update_svn_revision_url = "%s/update-svn-revision" % self.url
-        self.browser.open(update_svn_revision_url)
-        self.browser.select_form(name="update_svn_revision")
-        self.browser["number"] = unicode(svn_revision_number)
-        self.browser["broken_bot"] = broken_bot
-        return self.browser.submit().read()
+        self._browser.open(update_svn_revision_url)
+        self._browser.select_form(name="update_svn_revision")
+        self._browser["number"] = unicode(svn_revision_number)
+        self._browser["broken_bot"] = broken_bot
+        return self._browser.submit().read()
 
     def _post_work_items_to_server(self, queue_name, work_items):
         update_work_items_url = "%s/update-work-items" % self.url
-        self.browser.open(update_work_items_url)
-        self.browser.select_form(name="update_work_items")
-        self.browser["queue_name"] = queue_name
+        self._browser.open(update_work_items_url)
+        self._browser.select_form(name="update_work_items")
+        self._browser["queue_name"] = queue_name
         work_items = map(unicode, work_items)  # .join expects strings
-        self.browser["work_items"] = " ".join(work_items)
-        return self.browser.submit().read()
+        self._browser["work_items"] = " ".join(work_items)
+        return self._browser.submit().read()
+
+    def _post_work_item_to_ews(self, attachment_id):
+        submit_to_ews_url = "%s/submit-to-ews" % self.url
+        self._browser.open(submit_to_ews_url)
+        self._browser.select_form(name="submit_to_ews")
+        self._browser["attachment_id"] = unicode(attachment_id)
+        self._browser.submit()
+
+    def submit_to_ews(self, attachment_id):
+        _log.info("Submitting attachment %s to EWS queues" % attachment_id)
+        return NetworkTransaction().run(lambda: self._post_work_item_to_ews(attachment_id))
 
     def next_work_item(self, queue_name):
         _log.debug("Fetching next work item for %s" % queue_name)
         patch_status_url = "%s/next-patch/%s" % (self.url, queue_name)
         return self._fetch_url(patch_status_url)
 
+    def _post_release_work_item(self, queue_name, patch):
+        release_patch_url = "%s/release-patch" % (self.url)
+        self._browser.open(release_patch_url)
+        self._browser.select_form(name="release_patch")
+        self._browser["queue_name"] = queue_name
+        self._browser["attachment_id"] = unicode(patch.id())
+        self._browser.submit()
+
+    def release_work_item(self, queue_name, patch):
+        _log.debug("Releasing work item %s from %s" % (patch.id(), queue_name))
+        return NetworkTransaction(convert_404_to_None=True).run(lambda: self._post_release_work_item(queue_name, patch))
+
     def update_work_items(self, queue_name, work_items):
         _log.debug("Recording work items: %s for %s" % (work_items, queue_name))
         return NetworkTransaction().run(lambda: self._post_work_items_to_server(queue_name, work_items))
@@ -114,6 +143,7 @@ class StatusServer:
         return NetworkTransaction().run(lambda: self._post_svn_revision_to_server(svn_revision_number, broken_bot))
 
     def _fetch_url(self, url):
+        # FIXME: This should use NetworkTransaction's 404 handling instead.
         try:
             return urllib2.urlopen(url).read()
         except urllib2.HTTPError, e:
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/patchcollection_unittest.py b/WebKitTools/Scripts/webkitpy/common/net/statusserver_unittest.py
index 4ec6e25..1169ba0 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/patchcollection_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/net/statusserver_unittest.py
@@ -1,9 +1,9 @@
-# Copyright (c) 2009 Google Inc. All rights reserved.
+# Copyright (c) 2010 Google Inc. All rights reserved.
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
-# 
+#
 #     * Redistributions of source code must retain the above copyright
 # notice, this list of conditions and the following disclaimer.
 #     * Redistributions in binary form must reproduce the above
@@ -13,7 +13,7 @@
 #     * Neither the name of Google Inc. nor the names of its
 # contributors may be used to endorse or promote products derived from
 # this software without specific prior written permission.
-# 
+#
 # THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 # "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 # LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
@@ -28,25 +28,16 @@
 
 import unittest
 
-from webkitpy.tool.bot.patchcollection import PersistentPatchCollection, PersistentPatchCollectionDelegate
-from webkitpy.thirdparty.mock import Mock
-
-
-class TestPersistentPatchCollectionDelegate(PersistentPatchCollectionDelegate):
-    def collection_name(self):
-        return "test-collection"
-
-    def fetch_potential_patch_ids(self):
-        return [42, 192, 87]
-
-    def status_server(self):
-        return Mock()
-
-    def is_terminal_status(self, status):
-        return False
+from webkitpy.common.net.statusserver import StatusServer
+from webkitpy.common.system.outputcapture import OutputCaptureTestCaseBase
+from webkitpy.tool.mocktool import MockBrowser
 
 
-class PersistentPatchCollectionTest(unittest.TestCase):
-    def test_next(self):
-        collection = PersistentPatchCollection(TestPersistentPatchCollectionDelegate())
-        collection.next()
+class StatusServerTest(OutputCaptureTestCaseBase):
+    def test_url_for_issue(self):
+        mock_browser = MockBrowser()
+        status_server = StatusServer(browser=mock_browser, bot_id='123')
+        status_server.update_status('queue name', 'the status')
+        self.assertEqual('queue name', mock_browser.params['queue_name'])
+        self.assertEqual('the status', mock_browser.params['status'])
+        self.assertEqual('123', mock_browser.params['bot_id'])
diff --git a/WebKitTools/Scripts/webkitpy/common/system/executive.py b/WebKitTools/Scripts/webkitpy/common/system/executive.py
index 7c00f22..216cf58 100644
--- a/WebKitTools/Scripts/webkitpy/common/system/executive.py
+++ b/WebKitTools/Scripts/webkitpy/common/system/executive.py
@@ -103,6 +103,13 @@ class Executive(object):
 
     def _run_command_with_teed_output(self, args, teed_output):
         args = map(unicode, args)  # Popen will throw an exception if args are non-strings (like int())
+        if sys.platform == 'cygwin':
+            # Cygwin's Python's os.execv doesn't support unicode command
+            # arguments, and neither does Cygwin's execv itself.
+            # FIXME: Using UTF-8 here will confuse Windows-native commands
+            # which will expect arguments to be encoded using the current code
+            # page.
+            args = [arg.encode('utf-8') for arg in args]
         child_process = subprocess.Popen(args,
                                          stdout=subprocess.PIPE,
                                          stderr=subprocess.STDOUT,
@@ -281,6 +288,13 @@ class Executive(object):
         assert(isinstance(args, list) or isinstance(args, tuple))
         start_time = time.time()
         args = map(unicode, args)  # Popen will throw an exception if args are non-strings (like int())
+        if sys.platform == 'cygwin':
+            # Cygwin's Python's os.execv doesn't support unicode command
+            # arguments, and neither does Cygwin's execv itself.
+            # FIXME: Using UTF-8 here will confuse Windows-native commands
+            # which will expect arguments to be encoded using the current code
+            # page.
+            args = [arg.encode('utf-8') for arg in args]
         stdin, string_to_communicate = self._compute_stdin(input)
         stderr = subprocess.STDOUT if return_stderr else None
 
diff --git a/WebKitTools/Scripts/webkitpy/common/system/outputcapture.py b/WebKitTools/Scripts/webkitpy/common/system/outputcapture.py
index 68a3919..45e0e3f 100644
--- a/WebKitTools/Scripts/webkitpy/common/system/outputcapture.py
+++ b/WebKitTools/Scripts/webkitpy/common/system/outputcapture.py
@@ -29,6 +29,7 @@
 # Class for unittest support.  Used for capturing stderr/stdout.
 
 import sys
+import unittest
 from StringIO import StringIO
 
 class OutputCapture(object):
@@ -37,7 +38,9 @@ class OutputCapture(object):
 
     def _capture_output_with_name(self, output_name):
         self.saved_outputs[output_name] = getattr(sys, output_name)
-        setattr(sys, output_name, StringIO())
+        captured_output = StringIO()
+        setattr(sys, output_name, captured_output)
+        return captured_output
 
     def _restore_output_with_name(self, output_name):
         captured_output = getattr(sys, output_name).getvalue()
@@ -46,8 +49,7 @@ class OutputCapture(object):
         return captured_output
 
     def capture_output(self):
-        self._capture_output_with_name("stdout")
-        self._capture_output_with_name("stderr")
+        return (self._capture_output_with_name("stdout"), self._capture_output_with_name("stderr"))
 
     def restore_output(self):
         return (self._restore_output_with_name("stdout"), self._restore_output_with_name("stderr"))
@@ -63,3 +65,22 @@ class OutputCapture(object):
         testcase.assertEqual(stderr_string, expected_stderr)
         # This is a little strange, but I don't know where else to return this information.
         return return_value
+
+
+class OutputCaptureTestCaseBase(unittest.TestCase):
+    def setUp(self):
+        unittest.TestCase.setUp(self)
+        self.output_capture = OutputCapture()
+        (self.__captured_stdout, self.__captured_stderr) = self.output_capture.capture_output()
+
+    def tearDown(self):
+        del self.__captured_stdout
+        del self.__captured_stderr
+        self.output_capture.restore_output()
+        unittest.TestCase.tearDown(self)
+
+    def assertStdout(self, expected_stdout):
+        self.assertEquals(expected_stdout, self.__captured_stdout.getvalue())
+
+    def assertStderr(self, expected_stderr):
+        self.assertEquals(expected_stderr, self.__captured_stderr.getvalue())
diff --git a/WebKitTools/Scripts/webkitpy/common/system/path.py b/WebKitTools/Scripts/webkitpy/common/system/path.py
new file mode 100644
index 0000000..43c6410
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/common/system/path.py
@@ -0,0 +1,134 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#     * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""generic routines to convert platform-specific paths to URIs."""
+from __future__ import with_statement
+
+import atexit
+import subprocess
+import sys
+import threading
+import urllib
+
+
+def abspath_to_uri(path, platform=None):
+    """Converts a platform-specific absolute path to a file: URL."""
+    if platform is None:
+        platform = sys.platform
+    return "file:" + _escape(_convert_path(path, platform))
+
+
+def cygpath(path):
+    """Converts a cygwin path to Windows path."""
+    return _CygPath.convert_using_singleton(path)
+
+
+# Note that this object is not threadsafe and must only be called
+# from multiple threads under protection of a lock (as is done in cygpath())
+class _CygPath(object):
+    """Manages a long-running 'cygpath' process for file conversion."""
+    _lock = None
+    _singleton = None
+
+    @staticmethod
+    def stop_cygpath_subprocess():
+        if not _CygPath._lock:
+            return
+
+        with _CygPath._lock:
+            if _CygPath._singleton:
+                _CygPath._singleton.stop()
+
+    @staticmethod
+    def convert_using_singleton(path):
+        if not _CygPath._lock:
+            _CygPath._lock = threading.Lock()
+
+        with _CygPath._lock:
+            if not _CygPath._singleton:
+                _CygPath._singleton = _CygPath()
+                # Make sure the cygpath subprocess always gets shutdown cleanly.
+                atexit.register(_CygPath.stop_cygpath_subprocess)
+
+            return _CygPath._singleton.convert(path)
+
+    def __init__(self):
+        self._child_process = None
+
+    def start(self):
+        assert(self._child_process is None)
+        args = ['cygpath', '-f', '-', '-wa']
+        self._child_process = subprocess.Popen(args,
+                                               stdin=subprocess.PIPE,
+                                               stdout=subprocess.PIPE)
+
+    def is_running(self):
+        if not self._child_process:
+            return False
+        return self._child_process.returncode is None
+
+    def stop(self):
+        if self._child_process:
+            self._child_process.stdin.close()
+            self._child_process.wait()
+        self._child_process = None
+
+    def convert(self, path):
+        if not self.is_running():
+            self.start()
+        self._child_process.stdin.write("%s\r\n" % path)
+        self._child_process.stdin.flush()
+        return self._child_process.stdout.readline().rstrip()
+
+
+def _escape(path):
+    """Handle any characters in the path that should be escaped."""
+    # FIXME: web browsers don't appear to blindly quote every character
+    # when converting filenames to files. Instead of using urllib's default
+    # rules, we allow a small list of other characters through un-escaped.
+    # It's unclear if this is the best possible solution.
+    return urllib.quote(path, safe='/+:')
+
+
+def _convert_path(path, platform):
+    """Handles any os-specific path separators, mappings, etc."""
+    if platform == 'win32':
+        return _winpath_to_uri(path)
+    if platform == 'cygwin':
+        return _winpath_to_uri(cygpath(path))
+    return _unixypath_to_uri(path)
+
+
+def _winpath_to_uri(path):
+    """Converts a window absolute path to a file: URL."""
+    return "///" + path.replace("\\", "/")
+
+
+def _unixypath_to_uri(path):
+    """Converts a unix-style path to a file: URL."""
+    return "//" + path
diff --git a/WebKitTools/Scripts/webkitpy/common/system/path_unittest.py b/WebKitTools/Scripts/webkitpy/common/system/path_unittest.py
new file mode 100644
index 0000000..4dbd38a
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/common/system/path_unittest.py
@@ -0,0 +1,105 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+import sys
+
+import path
+
+class AbspathTest(unittest.TestCase):
+    def assertMatch(self, test_path, expected_uri,
+                    platform=None):
+        if platform == 'cygwin' and sys.platform != 'cygwin':
+            return
+        self.assertEqual(path.abspath_to_uri(test_path, platform=platform),
+                         expected_uri)
+
+    def test_abspath_to_uri_cygwin(self):
+        if sys.platform != 'cygwin':
+            return
+
+        self.assertMatch('/cygdrive/c/foo/bar.html',
+                         'file:///C:/foo/bar.html',
+                         platform='cygwin')
+        self.assertEqual(path.abspath_to_uri('/cygdrive/c/foo/bar.html',
+                                             platform='cygwin'),
+                         'file:///C:/foo/bar.html')
+
+    def test_abspath_to_uri_darwin(self):
+        self.assertMatch('/foo/bar.html',
+                         'file:///foo/bar.html',
+                         platform='darwin')
+        self.assertEqual(path.abspath_to_uri("/foo/bar.html",
+                                             platform='darwin'),
+                         "file:///foo/bar.html")
+
+    def test_abspath_to_uri_linux2(self):
+        self.assertMatch('/foo/bar.html',
+                         'file:///foo/bar.html',
+                         platform='darwin')
+        self.assertEqual(path.abspath_to_uri("/foo/bar.html",
+                                             platform='linux2'),
+                         "file:///foo/bar.html")
+
+    def test_abspath_to_uri_win(self):
+        self.assertMatch('c:\\foo\\bar.html',
+                         'file:///c:/foo/bar.html',
+                         platform='win32')
+        self.assertEqual(path.abspath_to_uri("c:\\foo\\bar.html",
+                                             platform='win32'),
+                         "file:///c:/foo/bar.html")
+
+    def test_abspath_to_uri_escaping(self):
+        self.assertMatch('/foo/bar + baz%?.html',
+                         'file:///foo/bar%20+%20baz%25%3F.html',
+                         platform='darwin')
+        self.assertMatch('/foo/bar + baz%?.html',
+                         'file:///foo/bar%20+%20baz%25%3F.html',
+                         platform='linux2')
+
+        # Note that you can't have '?' in a filename on windows.
+        self.assertMatch('/cygdrive/c/foo/bar + baz%.html',
+                         'file:///C:/foo/bar%20+%20baz%25.html',
+                         platform='cygwin')
+
+    def test_stop_cygpath_subprocess(self):
+        if sys.platform != 'cygwin':
+            return
+
+        # Call cygpath to ensure the subprocess is running.
+        path.cygpath("/cygdrive/c/foo.txt")
+        self.assertTrue(path._CygPath._singleton.is_running())
+
+        # Stop it.
+        path._CygPath.stop_cygpath_subprocess()
+
+        # Ensure that it is stopped.
+        self.assertFalse(path._CygPath._singleton.is_running())
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/common/system/user.py b/WebKitTools/Scripts/webkitpy/common/system/user.py
index 240b67b..8917137 100644
--- a/WebKitTools/Scripts/webkitpy/common/system/user.py
+++ b/WebKitTools/Scripts/webkitpy/common/system/user.py
@@ -96,6 +96,10 @@ class User(object):
         # Note: Not thread safe: http://bugs.python.org/issue2320
         subprocess.call(args + files)
 
+    def _warn_if_application_is_xcode(self, edit_application):
+        if "Xcode" in edit_application:
+            print "Instead of using Xcode.app, consider using EDITOR=\"xed --wait\"."
+
     def edit_changelog(self, files):
         edit_application = os.environ.get("CHANGE_LOG_EDIT_APPLICATION")
         if edit_application and sys.platform == "darwin":
@@ -103,8 +107,7 @@ class User(object):
             args = shlex.split(edit_application)
             print "Using editor in the CHANGE_LOG_EDIT_APPLICATION environment variable."
             print "Please quit the editor application when done editing."
-            if edit_application.find("Xcode.app"):
-                print "Instead of using Xcode.app, consider using EDITOR=\"xed --wait\"."
+            self._warn_if_application_is_xcode(edit_application)
             subprocess.call(["open", "-W", "-n", "-a"] + args + files)
             return
         self.edit(files)
diff --git a/WebKitTools/Scripts/webkitpy/common/system/user_unittest.py b/WebKitTools/Scripts/webkitpy/common/system/user_unittest.py
index ae1bad5..7ec9b34 100644
--- a/WebKitTools/Scripts/webkitpy/common/system/user_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/common/system/user_unittest.py
@@ -97,5 +97,13 @@ class UserTest(unittest.TestCase):
                                     raw_input=mock_raw_input)
             self.assertEquals(expected[1], result)
 
-if __name__ == '__main__':
-    unittest.main()
+    def test_warn_if_application_is_xcode(self):
+        output = OutputCapture()
+        user = User()
+        output.assert_outputs(self, user._warn_if_application_is_xcode, ["TextMate"])
+        output.assert_outputs(self, user._warn_if_application_is_xcode, ["/Applications/TextMate.app"])
+        output.assert_outputs(self, user._warn_if_application_is_xcode, ["XCode"])  # case sensitive matching
+
+        xcode_warning = "Instead of using Xcode.app, consider using EDITOR=\"xed --wait\".\n"
+        output.assert_outputs(self, user._warn_if_application_is_xcode, ["Xcode"], expected_stdout=xcode_warning)
+        output.assert_outputs(self, user._warn_if_application_is_xcode, ["/Developer/Applications/Xcode.app"], expected_stdout=xcode_warning)
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/deduplicate_tests_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/deduplicate_tests_unittest.py
index bb9604f..309bf8d 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/deduplicate_tests_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/deduplicate_tests_unittest.py
@@ -205,3 +205,6 @@ class ListDuplicatesTest(unittest.TestCase):
         for expected, inputs in test_cases:
             self.assertEquals(expected,
                               deduplicate_tests.get_relative_test_path(*inputs))
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py b/WebKitTools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
index 970de60..e0fd1b6 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/layout_package/dump_render_tree_thread.py
@@ -1,5 +1,6 @@
 #!/usr/bin/env python
 # Copyright (C) 2010 Google Inc. All rights reserved.
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -271,23 +272,26 @@ class TestShellThread(WatchableThread):
         self._test_types = test_types
         self._test_args = test_args
         self._driver = None
-        self._directory_timing_stats = {}
+        self._test_group_timing_stats = {}
         self._test_results = []
         self._num_tests = 0
         self._start_time = 0
         self._stop_time = 0
-
-        # Current directory of tests we're running.
-        self._current_dir = None
-        # Number of tests in self._current_dir.
-        self._num_tests_in_current_dir = None
-        # Time at which we started running tests from self._current_dir.
-        self._current_dir_start_time = None
-
-    def get_directory_timing_stats(self):
-        """Returns a dictionary mapping test directory to a tuple of
-        (number of tests in that directory, time to run the tests)"""
-        return self._directory_timing_stats
+        self._have_http_lock = False
+        self._http_lock_wait_begin = 0
+        self._http_lock_wait_end = 0
+
+        # Current group of tests we're running.
+        self._current_group = None
+        # Number of tests in self._current_group.
+        self._num_tests_in_current_group = None
+        # Time at which we started running tests from self._current_group.
+        self._current_group_start_time = None
+
+    def get_test_group_timing_stats(self):
+        """Returns a dictionary mapping test group to a tuple of
+        (number of tests in that group, time to run the tests)"""
+        return self._test_group_timing_stats
 
     def get_test_results(self):
         """Return the list of all tests run on this thread.
@@ -298,7 +302,8 @@ class TestShellThread(WatchableThread):
         return self._test_results
 
     def get_total_time(self):
-        return max(self._stop_time - self._start_time, 0.0)
+        return max(self._stop_time - self._start_time -
+                   self._http_lock_wait_time(), 0.0)
 
     def get_num_tests(self):
         return self._num_tests
@@ -337,6 +342,25 @@ class TestShellThread(WatchableThread):
         do multi-threaded debugging."""
         self._run(test_runner, result_summary)
 
+    def cancel(self):
+        """Clean up http lock and set a flag telling this thread to quit."""
+        self._stop_http_lock()
+        WatchableThread.cancel(self)
+
+    def next_timeout(self):
+        """Return the time the test is supposed to finish by."""
+        if self._next_timeout:
+            return self._next_timeout + self._http_lock_wait_time()
+        return self._next_timeout
+
+    def _http_lock_wait_time(self):
+        """Return the time what http locking takes."""
+        if self._http_lock_wait_begin == 0:
+            return 0
+        if self._http_lock_wait_end == 0:
+            return time.time() - self._http_lock_wait_begin
+        return self._http_lock_wait_end - self._http_lock_wait_begin
+
     def _run(self, test_runner, result_summary):
         """Main work entry point of the thread. Basically we pull urls from the
         filename queue and run the tests until we run out of urls.
@@ -359,21 +383,35 @@ class TestShellThread(WatchableThread):
                 return
 
             if len(self._filename_list) is 0:
-                if self._current_dir is not None:
-                    self._directory_timing_stats[self._current_dir] = \
-                        (self._num_tests_in_current_dir,
-                         time.time() - self._current_dir_start_time)
+                if self._current_group is not None:
+                    self._test_group_timing_stats[self._current_group] = \
+                        (self._num_tests_in_current_group,
+                         time.time() - self._current_group_start_time)
 
                 try:
-                    self._current_dir, self._filename_list = \
+                    self._current_group, self._filename_list = \
                         self._filename_list_queue.get_nowait()
                 except Queue.Empty:
+                    self._stop_http_lock()
                     self._kill_dump_render_tree()
                     tests_run_file.close()
                     return
 
-                self._num_tests_in_current_dir = len(self._filename_list)
-                self._current_dir_start_time = time.time()
+                if self._options.wait_for_httpd:
+                    if self._current_group == "tests_to_http_lock":
+                        self._http_lock_wait_begin = time.time()
+                        self._port.acquire_http_lock()
+
+                        self._port.start_http_server()
+                        self._port.start_websocket_server()
+
+                        self._have_http_lock = True
+                        self._http_lock_wait_end = time.time()
+                    elif self._have_http_lock:
+                        self._stop_http_lock()
+
+                self._num_tests_in_current_group = len(self._filename_list)
+                self._current_group_start_time = time.time()
 
             test_info = self._filename_list.pop()
 
@@ -517,6 +555,14 @@ class TestShellThread(WatchableThread):
                                                     self._options)
             self._driver.start()
 
+    def _stop_http_lock(self):
+        """Stop the servers and release http lock."""
+        if self._have_http_lock:
+            self._port.stop_http_server()
+            self._port.stop_websocket_server()
+            self._port.release_http_lock()
+            self._have_http_lock = False
+
     def _kill_dump_render_tree(self):
         """Kill the DumpRenderTree process if it's running."""
         if self._driver:
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/base.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/base.py
index 6a5d43b..cd7d663 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/base.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/base.py
@@ -42,33 +42,35 @@ import sys
 import time
 
 import apache_http_server
-import test_files
+import http_lock
 import http_server
+import test_files
 import websocket_server
 
 from webkitpy.common.system import logutils
 from webkitpy.common.system.executive import Executive, ScriptError
+from webkitpy.common.system.path import abspath_to_uri
 from webkitpy.common.system.user import User
 
 
 _log = logutils.get_logger(__file__)
 
 
-# Python's Popen has a bug that causes any pipes opened to a
-# process that can't be executed to be leaked.  Since this
-# code is specifically designed to tolerate exec failures
-# to gracefully handle cases where wdiff is not installed,
-# the bug results in a massive file descriptor leak. As a
-# workaround, if an exec failure is ever experienced for
-# wdiff, assume it's not available.  This will leak one
-# file descriptor but that's better than leaking each time
-# wdiff would be run.
-#
-# http://mail.python.org/pipermail/python-list/
-#    2008-August/505753.html
-# http://bugs.python.org/issue3210
-_wdiff_available = True
-_pretty_patch_available = True
+class DummyOptions(object):
+    """Fake implementation of optparse.Values. Cloned from
+    webkitpy.tool.mocktool.MockOptions.
+
+    """
+
+    def __init__(self, **kwargs):
+        # The caller can set option values using keyword arguments. We don't
+        # set any values by default because we don't know how this
+        # object will be used. Generally speaking unit tests should
+        # subclass this or provider wrapper functions that set a common
+        # set of options.
+        for key, value in kwargs.items():
+            self.__dict__[key] = value
+
 
 # FIXME: This class should merge with webkitpy.webkit_port at some point.
 class Port(object):
@@ -85,13 +87,41 @@ class Port(object):
 
     def __init__(self, **kwargs):
         self._name = kwargs.get('port_name', None)
-        self._options = kwargs.get('options', None)
+        self._options = kwargs.get('options')
+        if self._options is None:
+            # FIXME: Ideally we'd have a package-wide way to get a
+            # well-formed options object that had all of the necessary
+            # options defined on it.
+            self._options = DummyOptions()
         self._executive = kwargs.get('executive', Executive())
         self._user = kwargs.get('user', User())
         self._helper = None
         self._http_server = None
         self._webkit_base_dir = None
         self._websocket_server = None
+        self._http_lock = None
+
+        # Python's Popen has a bug that causes any pipes opened to a
+        # process that can't be executed to be leaked.  Since this
+        # code is specifically designed to tolerate exec failures
+        # to gracefully handle cases where wdiff is not installed,
+        # the bug results in a massive file descriptor leak. As a
+        # workaround, if an exec failure is ever experienced for
+        # wdiff, assume it's not available.  This will leak one
+        # file descriptor but that's better than leaking each time
+        # wdiff would be run.
+        #
+        # http://mail.python.org/pipermail/python-list/
+        #    2008-August/505753.html
+        # http://bugs.python.org/issue3210
+        self._wdiff_available = True
+
+        self._pretty_patch_path = self.path_from_webkit_base("BugsSite",
+              "PrettyPatch", "prettify.rb")
+        self._pretty_patch_available = True
+        self.set_option_default('configuration', None)
+        if self._options.configuration is None:
+            self._options.configuration = self.default_configuration()
 
     def default_child_processes(self):
         """Return the number of DumpRenderTree instances to use for this
@@ -125,6 +155,27 @@ class Port(object):
         """This routine is used to check whether image_diff binary exists."""
         raise NotImplementedError('Port.check_image_diff')
 
+    def check_pretty_patch(self):
+        """Checks whether we can use the PrettyPatch ruby script."""
+
+        # check if Ruby is installed
+        try:
+            result = self._executive.run_command(['ruby', '--version'])
+        except OSError, e:
+            if e.errno in [errno.ENOENT, errno.EACCES, errno.ECHILD]:
+                _log.error("Ruby is not installed; "
+                           "can't generate pretty patches.")
+                _log.error('')
+                return False
+
+        if not self.path_exists(self._pretty_patch_path):
+            _log.error('Unable to find %s .' % self._pretty_patch_path)
+            _log.error("Can't generate pretty patches.")
+            _log.error('')
+            return False
+
+        return True
+
     def compare_text(self, expected_text, actual_text):
         """Return whether or not the two strings are *not* equal. This
         routine is used to diff text output.
@@ -259,7 +310,10 @@ class Port(object):
         path = self.expected_filename(test, extension)
         if not os.path.exists(path):
             return None
-        with codecs.open(path, 'r', encoding) as file:
+        open_mode = 'r'
+        if encoding is None:
+            open_mode = 'r+b'
+        with codecs.open(path, open_mode, encoding) as file:
             return file.read()
 
     def expected_checksum(self, test):
@@ -281,22 +335,18 @@ class Port(object):
         return text.strip("\r\n").replace("\r\n", "\n") + "\n"
 
     def filename_to_uri(self, filename):
-        """Convert a test file to a URI."""
+        """Convert a test file (which is an absolute path) to a URI."""
         LAYOUTTEST_HTTP_DIR = "http/tests/"
-        LAYOUTTEST_WEBSOCKET_DIR = "websocket/tests/"
+        LAYOUTTEST_WEBSOCKET_DIR = "http/tests/websocket/tests/"
 
         relative_path = self.relative_test_filename(filename)
         port = None
         use_ssl = False
 
-        if relative_path.startswith(LAYOUTTEST_HTTP_DIR):
-            # http/tests/ run off port 8000 and ssl/ off 8443
+        if (relative_path.startswith(LAYOUTTEST_WEBSOCKET_DIR)
+            or relative_path.startswith(LAYOUTTEST_HTTP_DIR)):
             relative_path = relative_path[len(LAYOUTTEST_HTTP_DIR):]
             port = 8000
-        elif relative_path.startswith(LAYOUTTEST_WEBSOCKET_DIR):
-            # websocket/tests/ run off port 8880 and 9323
-            # Note: the root is /, not websocket/tests/
-            port = 8880
 
         # Make http/tests/local run as local files. This is to mimic the
         # logic in run-webkit-tests.
@@ -311,9 +361,7 @@ class Port(object):
                 protocol = "http"
             return "%s://127.0.0.1:%u/%s" % (protocol, port, relative_path)
 
-        if sys.platform in ('cygwin', 'win32'):
-            return "file:///" + self.get_absolute_path(filename)
-        return "file://" + self.get_absolute_path(filename)
+        return abspath_to_uri(os.path.abspath(filename))
 
     def tests(self, paths):
         """Return the list of tests found (relative to layout_tests_dir()."""
@@ -349,7 +397,10 @@ class Port(object):
             data: contents of the baseline.
             encoding: file encoding to use for the baseline.
         """
-        with codecs.open(path, "w", encoding=encoding) as file:
+        write_mode = "w"
+        if encoding is None:
+            write_mode = "wb"
+        with codecs.open(path, write_mode, encoding=encoding) as file:
             file.write(data)
 
     def uri_to_test_name(self, uri):
@@ -362,12 +413,8 @@ class Port(object):
         """
         test = uri
         if uri.startswith("file:///"):
-            if sys.platform == 'win32':
-                test = test.replace('file:///', '')
-                test = test.replace('/', '\\')
-            else:
-                test = test.replace('file://', '')
-            return self.relative_test_filename(test)
+            prefix = abspath_to_uri(self.layout_tests_dir()) + "/"
+            return test[len(prefix):]
 
         if uri.startswith("http://127.0.0.1:8880/"):
             # websocket tests
@@ -382,13 +429,6 @@ class Port(object):
 
         raise NotImplementedError('unknown url type: %s' % uri)
 
-    def get_absolute_path(self, filename):
-        """Return the absolute path in unix format for the given filename.
-
-        This routine exists so that platforms that don't use unix filenames
-        can convert accordingly."""
-        return os.path.abspath(filename)
-
     def layout_tests_dir(self):
         """Return the absolute path to the top of the LayoutTests directory."""
         return self.path_from_webkit_base('LayoutTests')
@@ -420,6 +460,18 @@ class Port(object):
         may be different (e.g., 'win-xp' instead of 'chromium-win-xp'."""
         return self._name
 
+    def get_option(self, name, default_value=None):
+        # FIXME: Eventually we should not have to do a test for
+        # hasattr(), and we should be able to just do
+        # self.options.value. See additional FIXME in the constructor.
+        if hasattr(self._options, name):
+            return getattr(self._options, name)
+        return default_value
+
+    def set_option_default(self, name, default_value):
+        if not hasattr(self._options, name):
+            return setattr(self._options, name, default_value)
+
     # FIXME: This could be replaced by functions in webkitpy.common.checkout.scm.
     def path_from_webkit_base(self, *comps):
         """Returns the full path to path made by joining the top of the
@@ -445,7 +497,7 @@ class Port(object):
         """Relative unix-style path for a filename under the LayoutTests
         directory. Filenames outside the LayoutTests directory should raise
         an error."""
-        assert(filename.startswith(self.layout_tests_dir()))
+        #assert(filename.startswith(self.layout_tests_dir()))
         return filename[len(self.layout_tests_dir()) + 1:]
 
     def results_directory(self):
@@ -484,12 +536,12 @@ class Port(object):
         """Start a web server if it is available. Do nothing if
         it isn't. This routine is allowed to (and may) fail if a server
         is already running."""
-        if self._options.use_apache:
+        if self.get_option('use_apache'):
             self._http_server = apache_http_server.LayoutTestApacheHttpd(self,
-                self._options.results_directory)
+                self.get_option('results_directory'))
         else:
             self._http_server = http_server.Lighttpd(self,
-                self._options.results_directory)
+                self.get_option('results_directory'))
         self._http_server.start()
 
     def start_websocket_server(self):
@@ -497,9 +549,13 @@ class Port(object):
         it isn't. This routine is allowed to (and may) fail if a server
         is already running."""
         self._websocket_server = websocket_server.PyWebSocket(self,
-            self._options.results_directory)
+            self.get_option('results_directory'))
         self._websocket_server.start()
 
+    def acquire_http_lock(self):
+        self._http_lock = http_lock.HttpLock(None)
+        self._http_lock.wait_for_httpd_lock()
+
     def stop_helper(self):
         """Shut down the test helper if it is running. Do nothing if
         it isn't, or it isn't available. If a port overrides start_helper()
@@ -518,6 +574,10 @@ class Port(object):
         if self._websocket_server:
             self._websocket_server.stop()
 
+    def release_http_lock(self):
+        if self._http_lock:
+            self._http_lock.cleanup_http_lock()
+
     def test_expectations(self):
         """Returns the test expectations for this port.
 
@@ -628,8 +688,7 @@ class Port(object):
         """Returns a string of HTML indicating the word-level diff of the
         contents of the two filenames. Returns an empty string if word-level
         diffing isn't available."""
-        global _wdiff_available  # See explaination at top of file.
-        if not _wdiff_available:
+        if not self._wdiff_available:
             return ""
         try:
             # It's possible to raise a ScriptError we pass wdiff invalid paths.
@@ -637,33 +696,33 @@ class Port(object):
         except OSError, e:
             if e.errno in [errno.ENOENT, errno.EACCES, errno.ECHILD]:
                 # Silently ignore cases where wdiff is missing.
-                _wdiff_available = False
+                self._wdiff_available = False
                 return ""
             raise
 
-    _pretty_patch_error_html = "Failed to run PrettyPatch, see error console."
+    # This is a class variable so we can test error output easily.
+    _pretty_patch_error_html = "Failed to run PrettyPatch, see error log."
 
     def pretty_patch_text(self, diff_path):
-        # FIXME: Much of this function could move to prettypatch.rb
-        global _pretty_patch_available
-        if not _pretty_patch_available:
+        if not self._pretty_patch_available:
             return self._pretty_patch_error_html
-        pretty_patch_path = self.path_from_webkit_base("BugsSite", "PrettyPatch")
-        prettify_path = os.path.join(pretty_patch_path, "prettify.rb")
-        command = ["ruby", "-I", pretty_patch_path, prettify_path, diff_path]
+        command = ("ruby", "-I", os.path.dirname(self._pretty_patch_path),
+                   self._pretty_patch_path, diff_path)
         try:
             # Diffs are treated as binary (we pass decode_output=False) as they
             # may contain multiple files of conflicting encodings.
             return self._executive.run_command(command, decode_output=False)
         except OSError, e:
             # If the system is missing ruby log the error and stop trying.
-            _pretty_patch_available = False
+            self._pretty_patch_available = False
             _log.error("Failed to run PrettyPatch (%s): %s" % (command, e))
             return self._pretty_patch_error_html
         except ScriptError, e:
-            # If ruby failed to run for some reason, log the command output and stop trying.
-            _pretty_patch_available = False
-            _log.error("Failed to run PrettyPatch (%s):\n%s" % (command, e.message_with_output()))
+            # If ruby failed to run for some reason, log the command
+            # output and stop trying.
+            self._pretty_patch_available = False
+            _log.error("Failed to run PrettyPatch (%s):\n%s" % (command,
+                       e.message_with_output()))
             return self._pretty_patch_error_html
 
     def _webkit_build_directory(self, args):
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/base_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/base_unittest.py
index 71877b3..93f8808 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/base_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/base_unittest.py
@@ -26,16 +26,19 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import base
+import optparse
 import os
 import StringIO
 import sys
 import tempfile
 import unittest
 
+from webkitpy.common.system.path import abspath_to_uri
 from webkitpy.common.system.executive import Executive, ScriptError
 from webkitpy.thirdparty.mock import Mock
+from webkitpy.tool import mocktool
 
+import base
 
 # FIXME: This makes StringIO objects work with "with". Remove
 # when we upgrade to 2.6.
@@ -139,11 +142,11 @@ class PortTest(unittest.TestCase):
             expected_wdiff = "<head><style>.del { background: #faa; } .add { background: #afa; }</style></head><pre><span class=del>foo</span><span class=add>bar</span></pre>"
             self.assertEqual(wdiff, expected_wdiff)
             # Running the full wdiff_text method should give the same result.
-            base._wdiff_available = True  # In case it's somehow already disabled.
+            port._wdiff_available = True  # In case it's somehow already disabled.
             wdiff = port.wdiff_text(actual.name, expected.name)
             self.assertEqual(wdiff, expected_wdiff)
             # wdiff should still be available after running wdiff_text with a valid diff.
-            self.assertTrue(base._wdiff_available)
+            self.assertTrue(port._wdiff_available)
             actual.close()
             expected.close()
 
@@ -151,7 +154,7 @@ class PortTest(unittest.TestCase):
             self.assertRaises(ScriptError, port._run_wdiff, "/does/not/exist", "/does/not/exist2")
             self.assertRaises(ScriptError, port.wdiff_text, "/does/not/exist", "/does/not/exist2")
             # wdiff will still be available after running wdiff_text with invalid paths.
-            self.assertTrue(base._wdiff_available)
+            self.assertTrue(port._wdiff_available)
             base._wdiff_available = True
 
         # If wdiff does not exist _run_wdiff should throw an OSError.
@@ -161,8 +164,7 @@ class PortTest(unittest.TestCase):
         # wdiff_text should not throw an error if wdiff does not exist.
         self.assertEqual(port.wdiff_text("foo", "bar"), "")
         # However wdiff should not be available after running wdiff_text if wdiff is missing.
-        self.assertFalse(base._wdiff_available)
-        base._wdiff_available = True
+        self.assertFalse(port._wdiff_available)
 
     def test_diff_text(self):
         port = base.Port()
@@ -226,6 +228,63 @@ class PortTest(unittest.TestCase):
         self.assertTrue('canvas' in dirs)
         self.assertTrue('css2.1' in dirs)
 
+    def test_filename_to_uri(self):
+
+        port = base.Port()
+        layout_test_dir = port.layout_tests_dir()
+        test_file = os.path.join(layout_test_dir, "foo", "bar.html")
+
+        # On Windows, absolute paths are of the form "c:\foo.txt". However,
+        # all current browsers (except for Opera) normalize file URLs by
+        # prepending an additional "/" as if the absolute path was
+        # "/c:/foo.txt". This means that all file URLs end up with "file:///"
+        # at the beginning.
+        if sys.platform == 'win32':
+            prefix = "file:///"
+            path = test_file.replace("\\", "/")
+        else:
+            prefix = "file://"
+            path = test_file
+
+        self.assertEqual(port.filename_to_uri(test_file),
+                         abspath_to_uri(test_file))
+
+    def test_get_option__set(self):
+        options, args = optparse.OptionParser().parse_args()
+        options.foo = 'bar'
+        port = base.Port(options=options)
+        self.assertEqual(port.get_option('foo'), 'bar')
+
+    def test_get_option__unset(self):
+        port = base.Port()
+        self.assertEqual(port.get_option('foo'), None)
+
+    def test_get_option__default(self):
+        port = base.Port()
+        self.assertEqual(port.get_option('foo', 'bar'), 'bar')
+
+    def test_set_option_default__unset(self):
+        port = base.Port()
+        port.set_option_default('foo', 'bar')
+        self.assertEqual(port.get_option('foo'), 'bar')
+
+    def test_set_option_default__set(self):
+        options, args = optparse.OptionParser().parse_args()
+        options.foo = 'bar'
+        port = base.Port(options=options)
+        # This call should have no effect.
+        port.set_option_default('foo', 'new_bar')
+        self.assertEqual(port.get_option('foo'), 'bar')
+
+    def test_name__unset(self):
+        port = base.Port()
+        self.assertEqual(port.name(), None)
+
+    def test_name__set(self):
+        port = base.Port(port_name='foo')
+        self.assertEqual(port.name(), 'foo')
+
+
 class VirtualTest(unittest.TestCase):
     """Tests that various methods expected to be virtual are."""
     def assertVirtual(self, method, *args, **kwargs):
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium.py
index a72627a..4d17b51 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium.py
@@ -43,6 +43,10 @@ import tempfile
 import time
 import webbrowser
 
+from webkitpy.common.system.executive import Executive
+from webkitpy.common.system.path import cygpath
+from webkitpy.layout_tests.layout_package import test_expectations
+
 import base
 import http_server
 
@@ -84,11 +88,6 @@ class ChromiumPort(base.Port):
 
     def __init__(self, **kwargs):
         base.Port.__init__(self, **kwargs)
-        if 'options' in kwargs:
-            options = kwargs['options']
-            if (options and (not hasattr(options, 'configuration') or
-                             options.configuration is None)):
-                options.configuration = self.default_configuration()
         self._chromium_base_dir = None
 
     def baseline_path(self):
@@ -100,9 +99,9 @@ class ChromiumPort(base.Port):
         dump_render_tree_binary_path = self._path_to_driver()
         result = check_file_exists(dump_render_tree_binary_path,
                                     'test driver') and result
-        if result and self._options.build:
+        if result and self.get_option('build'):
             result = self._check_driver_build_up_to_date(
-                self._options.configuration)
+                self.get_option('configuration'))
         else:
             _log.error('')
 
@@ -111,10 +110,14 @@ class ChromiumPort(base.Port):
             result = check_file_exists(helper_path,
                                        'layout test helper') and result
 
-        if self._options.pixel_tests:
+        if self.get_option('pixel_tests'):
             result = self.check_image_diff(
                 'To override, invoke with --no-pixel-tests') and result
 
+        # It's okay if pretty patch isn't available, but we will at
+        # least log a message.
+        self.check_pretty_patch()
+
         return result
 
     def check_sys_deps(self, needs_http):
@@ -134,28 +137,43 @@ class ChromiumPort(base.Port):
     def diff_image(self, expected_contents, actual_contents,
                    diff_filename=None, tolerance=0):
         executable = self._path_to_image_diff()
-        expected_tmpfile = tempfile.NamedTemporaryFile()
-        expected_tmpfile.write(expected_contents)
-        actual_tmpfile = tempfile.NamedTemporaryFile()
-        actual_tmpfile.write(actual_contents)
+
+        tempdir = tempfile.mkdtemp()
+        expected_filename = os.path.join(tempdir, "expected.png")
+        with open(expected_filename, 'w+b') as file:
+            file.write(expected_contents)
+        actual_filename = os.path.join(tempdir, "actual.png")
+        with open(actual_filename, 'w+b') as file:
+            file.write(actual_contents)
+
         if diff_filename:
-            cmd = [executable, '--diff', expected_tmpfile.name,
-                   actual_tmpfile.name, diff_filename]
+            cmd = [executable, '--diff', expected_filename,
+                   actual_filename, diff_filename]
         else:
-            cmd = [executable, expected_tmpfile.name, actual_tmpfile.name]
+            cmd = [executable, expected_filename, actual_filename]
 
         result = True
         try:
-            if self._executive.run_command(cmd, return_exit_code=True) == 0:
-                return False
+            exit_code = self._executive.run_command(cmd, return_exit_code=True)
+            if exit_code == 0:
+                # The images are the same.
+                result = False
+            elif exit_code != 1:
+                _log.error("image diff returned an exit code of "
+                           + str(exit_code))
+                # Returning False here causes the script to think that we
+                # successfully created the diff even though we didn't.  If
+                # we return True, we think that the images match but the hashes
+                # don't match.
+                # FIXME: Figure out why image_diff returns other values.
+                result = False
         except OSError, e:
             if e.errno == errno.ENOENT or e.errno == errno.EACCES:
                 _compare_available = False
             else:
                 raise e
         finally:
-            expected_tmpfile.close()
-            actual_tmpfile.close()
+            shutil.rmtree(tempdir, ignore_errors=True)
         return result
 
     def driver_name(self):
@@ -182,10 +200,11 @@ class ChromiumPort(base.Port):
     def results_directory(self):
         try:
             return self.path_from_chromium_base('webkit',
-                self._options.configuration, self._options.results_directory)
+                self.get_option('configuration'),
+                self.get_option('results_directory'))
         except AssertionError:
-            return self._build_path(self._options.configuration,
-                                    self._options.results_directory)
+            return self._build_path(self.get_option('configuration'),
+                                    self.get_option('results_directory'))
 
     def setup_test_run(self):
         # Delete the disk cache if any to ensure a clean test run.
@@ -239,7 +258,7 @@ class ChromiumPort(base.Port):
         # FIXME: This drt_overrides handling should be removed when we switch
         # from tes_shell to DRT.
         drt_overrides = ''
-        if self._options and self._options.use_drt:
+        if self.get_option('use_drt'):
             drt_overrides_path = self.path_from_webkit_base('LayoutTests',
                 'platform', 'chromium', 'drt_expectations.txt')
             if os.path.exists(drt_overrides_path):
@@ -325,11 +344,18 @@ class ChromiumPort(base.Port):
             platform = self.name()
         return self.path_from_webkit_base('LayoutTests', 'platform', platform)
 
+    def _convert_path(self, path):
+        """Handles filename conversion for subprocess command line args."""
+        # See note above in diff_image() for why we need this.
+        if sys.platform == 'cygwin':
+            return cygpath(path)
+        return path
+
     def _path_to_image_diff(self):
         binary_name = 'image_diff'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'ImageDiff'
-        return self._build_path(self._options.configuration, binary_name)
+        return self._build_path(self.get_option('configuration'), binary_name)
 
 
 class ChromiumDriver(base.Driver):
@@ -344,29 +370,31 @@ class ChromiumDriver(base.Driver):
     def _driver_args(self):
         driver_args = []
         if self._image_path:
-            driver_args.append("--pixel-tests=" + self._image_path)
+            # See note above in diff_image() for why we need _convert_path().
+            driver_args.append("--pixel-tests=" +
+                               self._port._convert_path(self._image_path))
 
-        if self._options.use_drt:
+        if self._port.get_option('use_drt'):
             driver_args.append('--test-shell')
         else:
             driver_args.append('--layout-tests')
 
-        if self._options.startup_dialog:
+        if self._port.get_option('startup_dialog'):
             driver_args.append('--testshell-startup-dialog')
 
-        if self._options.gp_fault_error_box:
+        if self._port.get_option('gp_fault_error_box'):
             driver_args.append('--gp-fault-error-box')
 
-        if self._options.accelerated_compositing:
+        if self._port.get_option('accelerated_compositing'):
             driver_args.append('--enable-accelerated-compositing')
 
-        if self._options.accelerated_2d_canvas:
+        if self._port.get_option('accelerated_2d_canvas'):
             driver_args.append('--enable-accelerated-2d-canvas')
         return driver_args
 
     def start(self):
         # FIXME: Should be an error to call this method twice.
-        cmd = self._command_wrapper(self._options.wrapper)
+        cmd = self._command_wrapper(self._port.get_option('wrapper'))
         cmd.append(self._port._path_to_driver())
         cmd += self._driver_args()
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
index 80602d9..95c716e 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu.py
@@ -66,7 +66,7 @@ def get(**kwargs):
 def _set_gpu_options(options):
     if options:
         if options.accelerated_compositing is None:
-            options.accelerated_composting = True
+            options.accelerated_compositing = True
         if options.accelerated_2d_canvas is None:
             options.accelerated_2d_canvas = True
 
@@ -90,7 +90,8 @@ class ChromiumGpuLinuxPort(chromium_linux.ChromiumLinuxPort):
         chromium_linux.ChromiumLinuxPort.__init__(self, **kwargs)
 
     def baseline_search_path(self):
-        return ([self._webkit_baseline_path('chromium-gpu-linux')] +
+        # Mimic the Linux -> Win expectations fallback in the ordinary Chromium port.
+        return (map(self._webkit_baseline_path, ['chromium-gpu-linux', 'chromium-gpu-win', 'chromium-gpu']) +
                 chromium_linux.ChromiumLinuxPort.baseline_search_path(self))
 
     def path_to_test_expectations_file(self):
@@ -108,7 +109,7 @@ class ChromiumGpuMacPort(chromium_mac.ChromiumMacPort):
         chromium_mac.ChromiumMacPort.__init__(self, **kwargs)
 
     def baseline_search_path(self):
-        return ([self._webkit_baseline_path('chromium-gpu-mac')] +
+        return (map(self._webkit_baseline_path, ['chromium-gpu-mac', 'chromium-gpu']) +
                 chromium_mac.ChromiumMacPort.baseline_search_path(self))
 
     def path_to_test_expectations_file(self):
@@ -126,7 +127,7 @@ class ChromiumGpuWinPort(chromium_win.ChromiumWinPort):
         chromium_win.ChromiumWinPort.__init__(self, **kwargs)
 
     def baseline_search_path(self):
-        return ([self._webkit_baseline_path('chromium-gpu-win')] +
+        return (map(self._webkit_baseline_path, ['chromium-gpu-win', 'chromium-gpu']) +
                 chromium_win.ChromiumWinPort.baseline_search_path(self))
 
     def path_to_test_expectations_file(self):
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py
index 5c79a3f..7a13b1c 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_gpu_unittest.py
@@ -26,6 +26,8 @@
 
 import os
 import unittest
+
+from webkitpy.tool import mocktool
 import chromium_gpu
 
 
@@ -41,16 +43,25 @@ class ChromiumGpuTest(unittest.TestCase):
 
     def assertOverridesWorked(self, port_name):
         # test that we got the right port
-        port = chromium_gpu.get(port_name=port_name, options=None)
+        mock_options = mocktool.MockOptions(accelerated_compositing=None,
+                                            accelerated_2d_canvas=None)
+        port = chromium_gpu.get(port_name=port_name, options=mock_options)
+        self.assertTrue(port._options.accelerated_compositing)
+        self.assertTrue(port._options.accelerated_2d_canvas)
 
         # we use startswith() instead of Equal to gloss over platform versions.
         self.assertTrue(port.name().startswith(port_name))
 
-        # test that it has the right directory in front of the search path.
-        path = port.baseline_search_path()[0]
-        self.assertEqual(port._webkit_baseline_path(port_name), path)
+        # test that it has the right directories in front of the search path.
+        paths = port.baseline_search_path()
+        self.assertEqual(port._webkit_baseline_path(port_name), paths[0])
+        if port_name == 'chromium-gpu-linux':
+            self.assertEqual(port._webkit_baseline_path('chromium-gpu-win'), paths[1])
+            self.assertEqual(port._webkit_baseline_path('chromium-gpu'), paths[2])
+        else:
+            self.assertEqual(port._webkit_baseline_path('chromium-gpu'), paths[1])
 
-        # test that we have the right expectations file.
+        # Test that we have the right expectations file.
         self.assertTrue('chromium-gpu' in
                         port.path_to_test_expectations_file())
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_linux.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
index 176991b..b26a6b5 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_linux.py
@@ -52,7 +52,7 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
     def check_build(self, needs_http):
         result = chromium.ChromiumPort.check_build(self, needs_http)
         if needs_http:
-            if self._options.use_apache:
+            if self.get_option('use_apache'):
                 result = self._check_apache_install() and result
             else:
                 result = self._check_lighttpd_install() and result
@@ -81,7 +81,7 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
         base = self.path_from_chromium_base()
         if os.path.exists(os.path.join(base, 'sconsbuild')):
             return os.path.join(base, 'sconsbuild', *comps)
-        if os.path.exists(os.path.join(base, 'out', *comps)) or not self._options.use_drt:
+        if os.path.exists(os.path.join(base, 'out', *comps)) or not self.get_option('use_drt'):
             return os.path.join(base, 'out', *comps)
         base = self.path_from_webkit_base()
         if os.path.exists(os.path.join(base, 'sconsbuild')):
@@ -147,9 +147,9 @@ class ChromiumLinuxPort(chromium.ChromiumPort):
 
     def _path_to_driver(self, configuration=None):
         if not configuration:
-            configuration = self._options.configuration
+            configuration = self.get_option('configuration')
         binary_name = 'test_shell'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'DumpRenderTree'
         return self._build_path(configuration, binary_name)
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_mac.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
index 64016ab..d1c383c 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_mac.py
@@ -73,7 +73,7 @@ class ChromiumMacPort(chromium.ChromiumPort):
 
     def driver_name(self):
         """name for this port's equivalent of DumpRenderTree."""
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             return "DumpRenderTree"
         return "TestShell"
 
@@ -100,7 +100,7 @@ class ChromiumMacPort(chromium.ChromiumPort):
 
     def _build_path(self, *comps):
         path = self.path_from_chromium_base('xcodebuild', *comps)
-        if os.path.exists(path) or not self._options.use_drt:
+        if os.path.exists(path) or not self.get_option('use_drt'):
             return path
         return self.path_from_webkit_base('WebKit', 'chromium', 'xcodebuild',
                                           *comps)
@@ -138,15 +138,15 @@ class ChromiumMacPort(chromium.ChromiumPort):
         # FIXME: make |configuration| happy with case-sensitive file
         # systems.
         if not configuration:
-            configuration = self._options.configuration
+            configuration = self.get_option('configuration')
         return self._build_path(configuration, self.driver_name() + '.app',
             'Contents', 'MacOS', self.driver_name())
 
     def _path_to_helper(self):
         binary_name = 'layout_test_helper'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'LayoutTestHelper'
-        return self._build_path(self._options.configuration, binary_name)
+        return self._build_path(self.get_option('configuration'), binary_name)
 
     def _path_to_wdiff(self):
         return 'wdiff'
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
index a4a9ea6..cb45430 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_unittest.py
@@ -26,24 +26,22 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-import chromium
-import chromium_linux
-import chromium_mac
-import chromium_win
+import os
 import unittest
 import StringIO
-import os
 
+from webkitpy.tool import mocktool
 from webkitpy.thirdparty.mock import Mock
 
+import chromium
+import chromium_linux
+import chromium_mac
+import chromium_win
 
 class ChromiumDriverTest(unittest.TestCase):
 
     def setUp(self):
         mock_port = Mock()
-        # FIXME: The Driver should not be grabbing at port._options!
-        mock_port._options = Mock()
-        mock_port._options.wrapper = ""
         self.driver = chromium.ChromiumDriver(mock_port, image_path=None, options=None)
 
     def test_test_shell_command(self):
@@ -106,25 +104,19 @@ class ChromiumPortTest(unittest.TestCase):
             return 'default'
 
     def test_path_to_image_diff(self):
-        class MockOptions:
-            def __init__(self):
-                self.use_drt = True
-
-        port = ChromiumPortTest.TestLinuxPort(options=MockOptions())
+        mock_options = mocktool.MockOptions(use_drt=True)
+        port = ChromiumPortTest.TestLinuxPort(options=mock_options)
         self.assertTrue(port._path_to_image_diff().endswith(
             '/out/default/ImageDiff'), msg=port._path_to_image_diff())
-        port = ChromiumPortTest.TestMacPort(options=MockOptions())
+        port = ChromiumPortTest.TestMacPort(options=mock_options)
         self.assertTrue(port._path_to_image_diff().endswith(
             '/xcodebuild/default/ImageDiff'))
         # FIXME: Figure out how this is going to work on Windows.
         #port = chromium_win.ChromiumWinPort('test-port', options=MockOptions())
 
     def test_skipped_layout_tests(self):
-        class MockOptions:
-            def __init__(self):
-                self.use_drt = True
-
-        port = ChromiumPortTest.TestLinuxPort(options=MockOptions())
+        mock_options = mocktool.MockOptions(use_drt=True)
+        port = ChromiumPortTest.TestLinuxPort(options=mock_options)
 
         fake_test = os.path.join(port.layout_tests_dir(), "fast/js/not-good.js")
 
@@ -138,23 +130,56 @@ DEFER LINUX WIN : fast/js/very-good.js = TIMEOUT PASS"""
         self.assertTrue("fast/js/not-good.js" in skipped_tests)
 
     def test_default_configuration(self):
-        class EmptyOptions:
-            def __init__(self):
-                pass
-
-        options = EmptyOptions()
-        port = ChromiumPortTest.TestLinuxPort(options)
-        self.assertEquals(options.configuration, 'default')
+        mock_options = mocktool.MockOptions()
+        port = ChromiumPortTest.TestLinuxPort(options=mock_options)
+        self.assertEquals(mock_options.configuration, 'default')
         self.assertTrue(port.default_configuration_called)
 
-        class OptionsWithUnsetConfiguration:
-            def __init__(self):
-                self.configuration = None
-
-        options = OptionsWithUnsetConfiguration()
-        port = ChromiumPortTest.TestLinuxPort(options)
-        self.assertEquals(options.configuration, 'default')
+        mock_options = mocktool.MockOptions(configuration=None)
+        port = ChromiumPortTest.TestLinuxPort(mock_options)
+        self.assertEquals(mock_options.configuration, 'default')
         self.assertTrue(port.default_configuration_called)
 
+    def test_diff_image(self):
+        class TestPort(ChromiumPortTest.TestLinuxPort):
+            def _path_to_image_diff(self):
+                return "/path/to/image_diff"
+
+        class MockExecute:
+            def __init__(self, result):
+                self._result = result
+
+            def run_command(self,
+                            args,
+                            cwd=None,
+                            input=None,
+                            error_handler=None,
+                            return_exit_code=False,
+                            return_stderr=True,
+                            decode_output=False):
+                if return_exit_code:
+                    return self._result
+                return ''
+
+        mock_options = mocktool.MockOptions(use_drt=False)
+        port = ChromiumPortTest.TestLinuxPort(mock_options)
+
+        # Images are different.
+        port._executive = MockExecute(0)
+        self.assertEquals(False, port.diff_image("EXPECTED", "ACTUAL"))
+
+        # Images are the same.
+        port._executive = MockExecute(1)
+        self.assertEquals(True, port.diff_image("EXPECTED", "ACTUAL"))
+
+        # There was some error running image_diff.
+        port._executive = MockExecute(2)
+        exception_raised = False
+        try:
+            port.diff_image("EXPECTED", "ACTUAL")
+        except ValueError, e:
+            exception_raised = True
+        self.assertFalse(exception_raised)
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_win.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_win.py
index d2b0265..69b529a 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_win.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/chromium_win.py
@@ -55,9 +55,7 @@ class ChromiumWinPort(chromium.ChromiumPort):
         # python executable to run cgi program.
         env["CYGWIN_PATH"] = self.path_from_chromium_base(
             "third_party", "cygwin", "bin")
-        if (sys.platform == "win32" and self._options and
-            hasattr(self._options, "register_cygwin") and
-            self._options.register_cygwin):
+        if (sys.platform == "win32" and self.get_option('register_cygwin')):
             setup_mount = self.path_from_chromium_base("third_party",
                                                        "cygwin",
                                                        "setup_mount.bat")
@@ -84,11 +82,6 @@ class ChromiumWinPort(chromium.ChromiumPort):
                        'build-instructions-windows')
         return result
 
-    def get_absolute_path(self, filename):
-        """Return the absolute path in unix format for the given filename."""
-        abspath = os.path.abspath(filename)
-        return abspath.replace('\\', '/')
-
     def relative_test_filename(self, filename):
         path = filename[len(self.layout_tests_dir()) + 1:]
         return path.replace('\\', '/')
@@ -118,7 +111,7 @@ class ChromiumWinPort(chromium.ChromiumPort):
         if os.path.exists(p):
             return p
         p = self.path_from_chromium_base('chrome', *comps)
-        if os.path.exists(p) or not self._options.use_drt:
+        if os.path.exists(p) or not self.get_option('use_drt'):
             return p
         return os.path.join(self.path_from_webkit_base(), 'WebKit', 'chromium',
                             *comps)
@@ -146,23 +139,23 @@ class ChromiumWinPort(chromium.ChromiumPort):
 
     def _path_to_driver(self, configuration=None):
         if not configuration:
-            configuration = self._options.configuration
+            configuration = self.get_option('configuration')
         binary_name = 'test_shell.exe'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'DumpRenderTree.exe'
         return self._build_path(configuration, binary_name)
 
     def _path_to_helper(self):
         binary_name = 'layout_test_helper.exe'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'LayoutTestHelper.exe'
-        return self._build_path(self._options.configuration, binary_name)
+        return self._build_path(self.get_option('configuration'), binary_name)
 
     def _path_to_image_diff(self):
         binary_name = 'image_diff.exe'
-        if self._options.use_drt:
+        if self.get_option('use_drt'):
             binary_name = 'ImageDiff.exe'
-        return self._build_path(self._options.configuration, binary_name)
+        return self._build_path(self.get_option('configuration'), binary_name)
 
     def _path_to_wdiff(self):
         return self.path_from_chromium_base('third_party', 'cygwin', 'bin',
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/dryrun.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/dryrun.py
index 648ccad..8a6af56 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/dryrun.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/dryrun.py
@@ -101,7 +101,6 @@ class DryrunDriver(base.Driver):
 
     def __init__(self, port, image_path, options, executive):
         self._port = port
-        self._options = options
         self._image_path = image_path
         self._executive = executive
         self._layout_tests_dir = None
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/factory_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
index 81c3732..978a557 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/factory_unittest.py
@@ -29,6 +29,8 @@
 import sys
 import unittest
 
+from webkitpy.tool import mocktool
+
 import chromium_gpu
 import chromium_linux
 import chromium_mac
@@ -52,21 +54,11 @@ class FactoryTest(unittest.TestCase):
     # FIXME: The ports themselves should expose what options they require,
     # instead of passing generic "options".
 
-    class WebKitOptions(object):
-        """Represents the minimum options for WebKit port."""
-        def __init__(self):
-            self.pixel_tests = False
-
-    class ChromiumOptions(WebKitOptions):
-        """Represents minimum options for Chromium port."""
-        def __init__(self):
-            FactoryTest.WebKitOptions.__init__(self)
-            self.chromium = True
-
     def setUp(self):
         self.real_sys_platform = sys.platform
-        self.webkit_options = FactoryTest.WebKitOptions()
-        self.chromium_options = FactoryTest.ChromiumOptions()
+        self.webkit_options = mocktool.MockOptions(pixel_tests=False)
+        self.chromium_options = mocktool.MockOptions(pixel_tests=False,
+                                                    chromium=True)
 
     def tearDown(self):
         sys.platform = self.real_sys_platform
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome.py
index bffc860..8d94bb5 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome.py
@@ -24,6 +24,30 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from __future__ import with_statement
+
+import codecs
+import os
+
+
+def _test_expectations_overrides(port, super):
+    # The chrome ports use the regular overrides plus anything in the
+    # official test_expectations as well. Hopefully we don't get collisions.
+    chromium_overrides = super.test_expectations_overrides(port)
+
+    # FIXME: It used to be that AssertionError would get raised by
+    # path_from_chromium_base() if we weren't in a Chromium checkout, but
+    # this changed in r60427. This should probably be changed back.
+    overrides_path = port.path_from_chromium_base('webkit', 'tools',
+            'layout_tests', 'test_expectations_chrome.txt')
+    if not os.path.exists(overrides_path):
+        return chromium_overrides
+
+    with codecs.open(overrides_path, "r", "utf-8") as file:
+        if chromium_overrides:
+            return chromium_overrides + file.read()
+        else:
+            return file.read()
 
 def GetGoogleChromePort(**kwargs):
     """Some tests have slightly different results when compiled as Google
@@ -41,6 +65,11 @@ def GetGoogleChromePort(**kwargs):
                 paths.insert(0, self._webkit_baseline_path(
                     'google-chrome-linux32'))
                 return paths
+
+            def test_expectations_overrides(self):
+                return _test_expectations_overrides(self,
+                    chromium_linux.ChromiumLinuxPort)
+
         return GoogleChromeLinux32Port(**kwargs)
     elif port_name == 'google-chrome-linux64':
         import chromium_linux
@@ -52,6 +81,11 @@ def GetGoogleChromePort(**kwargs):
                 paths.insert(0, self._webkit_baseline_path(
                     'google-chrome-linux64'))
                 return paths
+
+            def test_expectations_overrides(self):
+                return _test_expectations_overrides(self,
+                    chromium_linux.ChromiumLinuxPort)
+
         return GoogleChromeLinux64Port(**kwargs)
     elif port_name.startswith('google-chrome-mac'):
         import chromium_mac
@@ -63,6 +97,11 @@ def GetGoogleChromePort(**kwargs):
                 paths.insert(0, self._webkit_baseline_path(
                     'google-chrome-mac'))
                 return paths
+
+            def test_expectations_overrides(self):
+                return _test_expectations_overrides(self,
+                    chromium_mac.ChromiumMacPort)
+
         return GoogleChromeMacPort(**kwargs)
     elif port_name.startswith('google-chrome-win'):
         import chromium_win
@@ -74,5 +113,10 @@ def GetGoogleChromePort(**kwargs):
                 paths.insert(0, self._webkit_baseline_path(
                     'google-chrome-win'))
                 return paths
+
+            def test_expectations_overrides(self):
+                return _test_expectations_overrides(self,
+                    chromium_win.ChromiumWinPort)
+
         return GoogleChromeWinPort(**kwargs)
     raise NotImplementedError('unsupported port: %s' % port_name)
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py
index 85e9338..c4c885d 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/google_chrome_unittest.py
@@ -24,8 +24,12 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import codecs
 import os
 import unittest
+
+import base_unittest
+import factory
 import google_chrome
 
 
@@ -35,6 +39,7 @@ class GetGoogleChromePortTest(unittest.TestCase):
             'google-chrome-mac', 'google-chrome-win')
         for port in test_ports:
             self._verify_baseline_path(port, port)
+            self._verify_expectations_overrides(port)
 
         self._verify_baseline_path('google-chrome-mac', 'google-chrome-mac-leopard')
         self._verify_baseline_path('google-chrome-win', 'google-chrome-win-xp')
@@ -45,3 +50,53 @@ class GetGoogleChromePortTest(unittest.TestCase):
                                                  options=None)
         path = port.baseline_search_path()[0]
         self.assertEqual(expected_path, os.path.split(path)[1])
+
+    def _verify_expectations_overrides(self, port_name):
+        # FIXME: make this more robust when we have the Tree() abstraction.
+        # we should be able to test for the files existing or not, and
+        # be able to control the contents better.
+
+        chromium_port = factory.get("chromium-mac")
+        chromium_overrides = chromium_port.test_expectations_overrides()
+        port = google_chrome.GetGoogleChromePort(port_name=port_name,
+                                                 options=None)
+
+        orig_exists = os.path.exists
+        orig_open = codecs.open
+        expected_string = "// hello, world\n"
+
+        def mock_exists_chrome_not_found(path):
+            if 'test_expectations_chrome.txt' in path:
+                return False
+            return orig_exists(path)
+
+        def mock_exists_chrome_found(path):
+            if 'test_expectations_chrome.txt' in path:
+                return True
+            return orig_exists(path)
+
+        def mock_open(path, mode, encoding):
+            if 'test_expectations_chrome.txt' in path:
+                return base_unittest.NewStringIO(expected_string)
+            return orig_open(path, mode, encoding)
+
+        try:
+            os.path.exists = mock_exists_chrome_not_found
+            chrome_overrides = port.test_expectations_overrides()
+            self.assertEqual(chromium_overrides, chrome_overrides)
+
+            os.path.exists = mock_exists_chrome_found
+            codecs.open = mock_open
+            chrome_overrides = port.test_expectations_overrides()
+            if chromium_overrides:
+                self.assertEqual(chrome_overrides,
+                                 chromium_overrides + expected_string)
+            else:
+                self.assertEqual(chrome_overrides, expected_string)
+        finally:
+            os.path.exists = orig_exists
+            codecs.open = orig_open
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock.py
new file mode 100644
index 0000000..73200a0
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock.py
@@ -0,0 +1,125 @@
+#!/usr/bin/env python
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
+# Copyright (C) 2010 Andras Becsi (abecsi@inf.u-szeged.hu), University of Szeged
+#
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"""This class helps to block NRWT threads when more NRWTs run
+http and websocket tests in a same time."""
+
+import glob
+import os
+import sys
+import tempfile
+import time
+
+
+class HttpLock(object):
+
+    def __init__(self, lock_path, lock_file_prefix="WebKitHttpd.lock.",
+                 guard_lock="WebKit.lock"):
+        if not lock_path:
+            self._lock_path = tempfile.gettempdir()
+        self._lock_file_prefix = lock_file_prefix
+        self._lock_file_path_prefix = os.path.join(self._lock_path,
+                                                   self._lock_file_prefix)
+        self._guard_lock_file = os.path.join(self._lock_path, guard_lock)
+        self._process_lock_file_name = ""
+
+    def cleanup_http_lock(self):
+        """Delete the lock file if exists."""
+        if os.path.exists(self._process_lock_file_name):
+            os.unlink(self._process_lock_file_name)
+
+    def _extract_lock_number(self, lock_file_name):
+        """Return the lock number from lock file."""
+        prefix_length = len(self._lock_file_path_prefix)
+        return int(lock_file_name[prefix_length:])
+
+    def _lock_file_list(self):
+        """Return the list of lock files sequentially."""
+        lock_list = glob.glob(self._lock_file_path_prefix + '*')
+        lock_list.sort(key=self._extract_lock_number)
+        return lock_list
+
+    def _next_lock_number(self):
+        """Return the next available lock number."""
+        lock_list = self._lock_file_list()
+        if not lock_list:
+            return 0
+        return self._extract_lock_number(lock_list[-1]) + 1
+
+    def _check_pid(self, current_pid):
+        """Return True if pid is alive, otherwise return False."""
+        try:
+            os.kill(current_pid, 0)
+        except OSError:
+            return False
+        else:
+            return True
+
+    def _curent_lock_pid(self):
+        """Return with the current lock pid. If the lock is not valid
+        it deletes the lock file."""
+        lock_list = self._lock_file_list()
+        if not lock_list:
+            return
+        try:
+            current_lock_file = open(lock_list[0], 'r')
+            current_pid = current_lock_file.readline()
+            current_lock_file.close()
+            if not (current_pid and
+              sys.platform in ('darwin', 'linux2') and
+              self._check_pid(int(current_pid))):
+                os.unlink(lock_list[0])
+                return
+        except IOError, OSError:
+            return
+        return int(current_pid)
+
+    def _create_lock_file(self):
+        """The lock files are used to schedule the running test sessions in first
+        come first served order. The sequential guard lock ensures that the lock
+        numbers are sequential."""
+        while(True):
+            try:
+                sequential_guard_lock = os.open(self._guard_lock_file,
+                                                os.O_CREAT | os.O_NONBLOCK | os.O_EXCL)
+
+                self._process_lock_file_name = (self._lock_file_path_prefix +
+                                                str(self._next_lock_number()))
+                lock_file = open(self._process_lock_file_name, 'w')
+                lock_file.write(str(os.getpid()))
+                lock_file.close()
+                os.close(sequential_guard_lock)
+                os.unlink(self._guard_lock_file)
+                break
+            except OSError:
+                pass
+
+    def wait_for_httpd_lock(self):
+        """Create a lock file and wait until it's turn comes."""
+        self._create_lock_file()
+        while self._curent_lock_pid() != os.getpid():
+            time.sleep(1)
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock_unittest.py
new file mode 100644
index 0000000..85c760a
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/http_lock_unittest.py
@@ -0,0 +1,111 @@
+#!/usr/bin/env python
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
+#
+# All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions
+# are met:
+# 1. Redistributions of source code must retain the above copyright
+#    notice, this list of conditions and the following disclaimer.
+# 2. Redistributions in binary form must reproduce the above copyright
+#    notice, this list of conditions and the following disclaimer in the
+#    documentation and/or other materials provided with the distribution.
+#
+# THIS SOFTWARE IS PROVIDED BY UNIVERSITY OF SZEGED ``AS IS'' AND ANY
+# EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+# IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+# PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL UNIVERSITY OF SZEGED OR
+# CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+# EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+# PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+# OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import glob
+import http_lock
+import os
+import unittest
+
+
+class HttpLockTest(unittest.TestCase):
+
+    def __init__(self, testFunc):
+        self.http_lock_obj = http_lock.HttpLock(None, "WebKitTestHttpd.lock.", "WebKitTest.lock")
+        self.lock_file_path_prefix = os.path.join(self.http_lock_obj._lock_path,
+                                                  self.http_lock_obj._lock_file_prefix)
+        self.lock_file_name = self.lock_file_path_prefix + "0"
+        self.guard_lock_file = self.http_lock_obj._guard_lock_file
+        self.clean_all_lockfile()
+        unittest.TestCase.__init__(self, testFunc)
+
+    def clean_all_lockfile(self):
+        if os.path.exists(self.guard_lock_file):
+            os.unlink(self.guard_lock_file)
+        lock_list = glob.glob(self.lock_file_path_prefix + '*')
+        for file_name in lock_list:
+            os.unlink(file_name)
+
+    def assertEqual(self, first, second):
+        if first != second:
+            self.clean_all_lockfile()
+        unittest.TestCase.assertEqual(self, first, second)
+
+    def _check_lock_file(self):
+        if os.path.exists(self.lock_file_name):
+            pid = os.getpid()
+            lock_file = open(self.lock_file_name, 'r')
+            lock_file_pid = lock_file.readline()
+            lock_file.close()
+            self.assertEqual(pid, int(lock_file_pid))
+            return True
+        return False
+
+    def test_lock_lifecycle(self):
+        self.http_lock_obj._create_lock_file()
+
+        self.assertEqual(True, self._check_lock_file())
+        self.assertEqual(1, self.http_lock_obj._next_lock_number())
+
+        self.http_lock_obj.cleanup_http_lock()
+
+        self.assertEqual(False, self._check_lock_file())
+        self.assertEqual(0, self.http_lock_obj._next_lock_number())
+
+    def test_extract_lock_number(self,):
+        lock_file_list = (
+            self.lock_file_path_prefix + "00",
+            self.lock_file_path_prefix + "9",
+            self.lock_file_path_prefix + "001",
+            self.lock_file_path_prefix + "021",
+        )
+
+        expected_number_list = (0, 9, 1, 21)
+
+        for lock_file, expected in zip(lock_file_list, expected_number_list):
+            self.assertEqual(self.http_lock_obj._extract_lock_number(lock_file), expected)
+
+    def test_lock_file_list(self):
+        lock_file_list = [
+            self.lock_file_path_prefix + "6",
+            self.lock_file_path_prefix + "1",
+            self.lock_file_path_prefix + "4",
+            self.lock_file_path_prefix + "3",
+        ]
+
+        expected_file_list = [
+            self.lock_file_path_prefix + "1",
+            self.lock_file_path_prefix + "3",
+            self.lock_file_path_prefix + "4",
+            self.lock_file_path_prefix + "6",
+        ]
+
+        for file_name in lock_file_list:
+            open(file_name, 'w')
+
+        self.assertEqual(self.http_lock_obj._lock_file_list(), expected_file_list)
+
+        for file_name in lock_file_list:
+            os.unlink(file_name)
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/mac_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
index 327b19e..d383a4c 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/mac_unittest.py
@@ -35,7 +35,7 @@ import port_testcase
 
 
 class MacTest(port_testcase.PortTestCase):
-    def make_port(self, options=port_testcase.MockOptions()):
+    def make_port(self, options=port_testcase.mock_options):
         if sys.platform != 'darwin':
             return None
         port_obj = mac.MacPort(options=options)
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/port_testcase.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/port_testcase.py
index 47597d6..04ada50 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/port_testcase.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/port_testcase.py
@@ -32,20 +32,15 @@ import os
 import tempfile
 import unittest
 
-
-class MockOptions(object):
-    def __init__(self,
-                 results_directory='layout-test-results',
-                 use_apache=True,
-                 configuration='Release'):
-        self.results_directory = results_directory
-        self.use_apache = use_apache
-        self.configuration = configuration
+from webkitpy.tool import mocktool
+mock_options = mocktool.MockOptions(results_directory='layout-test-results',
+                                    use_apache=True,
+                                    configuration='Release')
 
 
 class PortTestCase(unittest.TestCase):
     """Tests the WebKit port implementation."""
-    def make_port(self, options=MockOptions()):
+    def make_port(self, options=mock_options):
         """Override in subclass."""
         raise NotImplementedError()
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/test.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/test.py
index 3b81167..3691c5a 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/test.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/test.py
@@ -215,14 +215,11 @@ class TestPort(base.Port):
     def name(self):
         return self._name
 
-    def options(self):
-        return self._options
-
     def _path_to_wdiff(self):
         return None
 
     def results_directory(self):
-        return '/tmp/' + self._options.results_directory
+        return '/tmp/' + self.get_option('results_directory')
 
     def setup_test_run(self):
         pass
@@ -285,7 +282,6 @@ class TestDriver(base.Driver):
     def __init__(self, port, image_path, options, executive):
         self._port = port
         self._image_path = image_path
-        self._options = options
         self._executive = executive
         self._image_written = False
 
@@ -302,7 +298,7 @@ class TestDriver(base.Driver):
         if test.hang:
             time.sleep((float(timeoutms) * 4) / 1000.0)
 
-        if self._port.options().pixel_tests and test.actual_image:
+        if self._port.get_option('pixel_tests') and test.actual_image:
             with open(self._image_path, 'w') as file:
                 file.write(test.actual_image)
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/webkit.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/webkit.py
index ed19c09..c940f1e 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/webkit.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/webkit.py
@@ -65,9 +65,7 @@ class WebKitPort(base.Port):
 
         # FIXME: disable pixel tests until they are run by default on the
         # build machines.
-        if self._options and (not hasattr(self._options, "pixel_tests") or
-           self._options.pixel_tests is None):
-            self._options.pixel_tests = False
+        self.set_option_default('pixel_tests', False)
 
     def baseline_path(self):
         return self._webkit_baseline_path(self._name)
@@ -86,7 +84,7 @@ class WebKitPort(base.Port):
     def _build_driver(self):
         exit_code = self._executive.run_command([
             self.script_path("build-dumprendertree"),
-            self.flag_from_configuration(self._options.configuration),
+            self.flag_from_configuration(self.get_option('configuration')),
         ], return_exit_code=True)
         if exit_code != 0:
             _log.error("Failed to build DumpRenderTree")
@@ -101,11 +99,11 @@ class WebKitPort(base.Port):
         return True
 
     def check_build(self, needs_http):
-        if self._options.build and not self._build_driver():
+        if self.get_option('build') and not self._build_driver():
             return False
         if not self._check_driver():
             return False
-        if self._options.pixel_tests:
+        if self.get_option('pixel_tests'):
             if not self.check_image_diff():
                 return False
         if not self._check_port_build():
@@ -184,7 +182,7 @@ class WebKitPort(base.Port):
     def results_directory(self):
         # Results are store relative to the built products to make it easy
         # to have multiple copies of webkit checked out and built.
-        return self._build_path(self._options.results_directory)
+        return self._build_path(self.get_option('results_directory'))
 
     def setup_test_run(self):
         # This port doesn't require any specific configuration.
@@ -360,7 +358,7 @@ class WebKitPort(base.Port):
         if not self._cached_build_root:
             self._cached_build_root = self._webkit_build_directory([
                 "--configuration",
-                self.flag_from_configuration(self._options.configuration),
+                self.flag_from_configuration(self.get_option('configuration')),
             ])
         return os.path.join(self._cached_build_root, *comps)
 
@@ -401,7 +399,6 @@ class WebKitDriver(base.Driver):
     def __init__(self, port, image_path, options, executive=Executive()):
         self._port = port
         self._image_path = image_path
-        self._options = options
         self._executive = executive
         self._driver_tempdir = tempfile.mkdtemp(prefix='DumpRenderTree-')
 
@@ -414,17 +411,17 @@ class WebKitDriver(base.Driver):
         if self._image_path:
             driver_args.append('--pixel-tests')
 
-        if self._options.use_drt:
-            if self._options.accelerated_compositing:
+        if self._port.get_option('use_drt'):
+            if self._port.get_option('accelerated_compositing'):
                 driver_args.append('--enable-accelerated-compositing')
 
-            if self._options.accelerated_2d_canvas:
+            if self._port.get_option('accelerated_2d_canvas'):
                 driver_args.append('--enable-accelerated-2d-canvas')
 
         return driver_args
 
     def start(self):
-        command = self._command_wrapper(self._options.wrapper)
+        command = self._command_wrapper(self._port.get_option('wrapper'))
         command += [self._port._path_to_driver(), '-']
         command += self._driver_args()
 
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/port/websocket_server.py b/WebKitTools/Scripts/webkitpy/layout_tests/port/websocket_server.py
index 7346671..926bc04 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/port/websocket_server.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/port/websocket_server.py
@@ -124,12 +124,13 @@ class PyWebSocket(http_server.Lighttpd):
         if self._root:
             self._layout_tests = os.path.abspath(self._root)
             self._web_socket_tests = os.path.abspath(
-                os.path.join(self._root, 'websocket', 'tests'))
+                os.path.join(self._root, 'http', 'tests',
+                             'websocket', 'tests'))
         else:
             try:
                 self._layout_tests = self._port_obj.layout_tests_dir()
                 self._web_socket_tests = os.path.join(self._layout_tests,
-                     'websocket', 'tests')
+                     'http', 'tests', 'websocket', 'tests')
             except:
                 self._web_socket_tests = None
 
@@ -164,10 +165,10 @@ class PyWebSocket(http_server.Lighttpd):
         pywebsocket_script = os.path.join(pywebsocket_base, 'mod_pywebsocket',
             'standalone.py')
         start_cmd = [
-            python_interp, pywebsocket_script,
+            python_interp, '-u', pywebsocket_script,
             '--server-host', '127.0.0.1',
             '--port', str(self._port),
-            '--document-root', self._layout_tests,
+            '--document-root', os.path.join(self._layout_tests, 'http', 'tests'),
             '--scan-dir', self._web_socket_tests,
             '--cgi-paths', '/websocket/tests',
             '--log-file', error_log,
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
index e57ceb2..a47370d 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests.py
@@ -57,8 +57,9 @@ import time
 import urllib
 import zipfile
 
+from webkitpy.common.system import path
 from webkitpy.common.system import user
-from webkitpy.common.system.executive import run_command, ScriptError
+from webkitpy.common.system.executive import Executive, ScriptError
 import webkitpy.common.checkout.scm as scm
 
 import port
@@ -81,58 +82,6 @@ ARCHIVE_DIR_NAME_DICT = {'win': 'webkit-rel',
                          'linux-canary': 'webkit-rel-linux-webkit-org'}
 
 
-# FIXME: Should be rolled into webkitpy.Executive
-def run_shell_with_return_code(command, print_output=False):
-    """Executes a command and returns the output and process return code.
-
-    Args:
-      command: program and arguments.
-      print_output: if true, print the command results to standard output.
-
-    Returns:
-      command output, return code
-    """
-
-    # Use a shell for subcommands on Windows to get a PATH search.
-    # FIXME: shell=True is a trail of tears, and should be removed.
-    use_shell = sys.platform.startswith('win')
-    # Note: Not thread safe: http://bugs.python.org/issue2320
-    p = subprocess.Popen(command, stdout=subprocess.PIPE,
-                         stderr=subprocess.STDOUT, shell=use_shell)
-    if print_output:
-        output_array = []
-        while True:
-            line = p.stdout.readline()
-            if not line:
-                break
-            if print_output:
-                print line.strip('\n')
-            output_array.append(line)
-        output = ''.join(output_array)
-    else:
-        output = p.stdout.read()
-    p.wait()
-    p.stdout.close()
-
-    return output, p.returncode
-
-
-# FIXME: Should be rolled into webkitpy.Executive
-def run_shell(command, print_output=False):
-    """Executes a command and returns the output.
-
-    Args:
-      command: program and arguments.
-      print_output: if true, print the command results to standard output.
-
-    Returns:
-      command output
-    """
-
-    output, return_code = run_shell_with_return_code(command, print_output)
-    return output
-
-
 def log_dashed_string(text, platform, logging_level=logging.INFO):
     """Log text message with dashes on both sides."""
 
@@ -547,7 +496,7 @@ class Rebaseliner(object):
         """
 
         if is_image:
-            return self._port.diff_image(output1, output2)
+            return self._port.diff_image(output1, output2, None, 0)
         else:
             return self._port.compare_text(output1, output2)
 
@@ -628,7 +577,6 @@ class Rebaseliner(object):
         base_file = get_result_file_fullpath(self._options.html_directory,
                                              baseline_filename, self._platform,
                                              'old')
-        # FIXME: This assumes run_shell returns a byte array.
         # We should be using an explicit encoding here.
         with open(base_file, "wb") as file:
             file.write(output)
@@ -642,12 +590,12 @@ class Rebaseliner(object):
                 diff_file = get_result_file_fullpath(
                     self._options.html_directory, baseline_filename,
                     self._platform, 'diff')
-                # FIXME: This assumes run_shell returns a byte array, not unicode()
                 with open(diff_file, 'wb') as file:
                     file.write(output)
                 _log.info('  Html: created baseline diff file: "%s".',
                           diff_file)
 
+
 class HtmlGenerator(object):
     """Class to generate rebaselining result comparison html."""
 
@@ -694,14 +642,20 @@ class HtmlGenerator(object):
                         '<img style="width: 200" src="%(uri)s" /></a></td>')
     HTML_TR = '<tr>%s</tr>'
 
-    def __init__(self, target_port, options, platforms, rebaselining_tests):
+    def __init__(self, target_port, options, platforms, rebaselining_tests,
+                 executive):
         self._html_directory = options.html_directory
         self._target_port = target_port
         self._platforms = platforms
         self._rebaselining_tests = rebaselining_tests
+        self._executive = executive
         self._html_file = os.path.join(options.html_directory,
                                        'rebaseline.html')
 
+    def abspath_to_uri(self, filename):
+        """Converts an absolute path to a file: URI."""
+        return path.abspath_to_uri(filename, self._executive)
+
     def generate_html(self):
         """Generate html file for rebaselining result comparison."""
 
@@ -769,14 +723,13 @@ class HtmlGenerator(object):
         links = ''
         if os.path.exists(old_file):
             links += html_td_link % {
-                'uri': self._target_port.filename_to_uri(old_file),
+                'uri': self.abspath_to_uri(old_file),
                 'name': baseline_filename}
         else:
             _log.info('    No old baseline file: "%s"', old_file)
             links += self.HTML_TD_NOLINK % ''
 
-        links += html_td_link % {'uri': self._target_port.filename_to_uri(
-                                     new_file),
+        links += html_td_link % {'uri': self.abspath_to_uri(new_file),
                                  'name': baseline_filename}
 
         diff_file = get_result_file_fullpath(self._html_directory,
@@ -784,8 +737,8 @@ class HtmlGenerator(object):
                                              'diff')
         _log.info('    Baseline diff file: "%s"', diff_file)
         if os.path.exists(diff_file):
-            links += html_td_link % {'uri': self._target_port.filename_to_uri(
-                diff_file), 'name': 'Diff'}
+            links += html_td_link % {'uri': self.abspath_to_uri(diff_file),
+                                     'name': 'Diff'}
         else:
             _log.info('    No baseline diff file: "%s"', diff_file)
             links += self.HTML_TD_NOLINK % ''
@@ -825,8 +778,7 @@ class HtmlGenerator(object):
         if rows:
             test_path = os.path.join(self._target_port.layout_tests_dir(),
                                      test)
-            html = self.HTML_TR_TEST % (
-                self._target_port.filename_to_uri(test_path), test)
+            html = self.HTML_TR_TEST % (self.abspath_to_uri(test_path), test)
             html += self.HTML_TEST_DETAIL % ' '.join(rows)
 
             _log.debug('    html for test: %s', html)
@@ -867,7 +819,7 @@ def get_host_port_object(options):
     return port_obj
 
 
-def main():
+def main(executive=Executive()):
     """Main function to produce new baselines."""
 
     option_parser = optparse.OptionParser()
@@ -992,7 +944,8 @@ def main():
     html_generator = HtmlGenerator(target_port_obj,
                                    options,
                                    rebaseline_platforms,
-                                   rebaselining_tests)
+                                   rebaselining_tests,
+                                   executive=executive)
     html_generator.generate_html()
     if not options.quiet:
         html_generator.show_html()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
index 9ba3d6b..ef33a47 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/rebaseline_chromium_webkit_tests_unittest.py
@@ -30,10 +30,13 @@
 """Unit tests for rebaseline_chromium_webkit_tests.py."""
 
 import os
+import sys
 import unittest
 
+from webkitpy.tool import mocktool
 from webkitpy.layout_tests import port
 from webkitpy.layout_tests import rebaseline_chromium_webkit_tests
+from webkitpy.common.system.executive import Executive, ScriptError
 
 
 class MockPort(object):
@@ -44,11 +47,6 @@ class MockPort(object):
         return self.image_diff_exists
 
 
-class MockOptions(object):
-    def __init__(self):
-        self.configuration = None
-
-
 def get_mock_get(config_expectations):
     def mock_get(port_name, options):
         return MockPort(config_expectations[options.configuration])
@@ -61,7 +59,8 @@ class TestGetHostPortObject(unittest.TestCase):
         # that Image diff is (or isn't) present in the two configs.
         port.get = get_mock_get({'Release': release_present,
                                  'Debug': debug_present})
-        options = MockOptions()
+        options = mocktool.MockOptions(configuration=None,
+                                       html_directory=None)
         port_obj = rebaseline_chromium_webkit_tests.get_host_port_object(
             options)
         if valid_port_obj:
@@ -87,7 +86,8 @@ class TestGetHostPortObject(unittest.TestCase):
 
 class TestRebaseliner(unittest.TestCase):
     def make_rebaseliner(self):
-        options = MockOptions()
+        options = mocktool.MockOptions(configuration=None,
+                                       html_directory=None)
         host_port_obj = port.get('test', options)
         target_options = options
         target_port_obj = port.get('test', target_options)
@@ -118,5 +118,32 @@ class TestRebaseliner(unittest.TestCase):
         self.assertFalse(rebaseliner._diff_baselines(image, image,
                                                      is_image=True))
 
+
+class TestHtmlGenerator(unittest.TestCase):
+    def make_generator(self, tests):
+        return rebaseline_chromium_webkit_tests.HtmlGenerator(
+            target_port=None,
+            options=mocktool.MockOptions(configuration=None,
+                                         html_directory='/tmp'),
+            platforms=['mac'],
+            rebaselining_tests=tests,
+            executive=Executive())
+
+    def test_generate_baseline_links(self):
+        orig_platform = sys.platform
+        orig_exists = os.path.exists
+
+        try:
+            sys.platform = 'darwin'
+            os.path.exists = lambda x: True
+            generator = self.make_generator(["foo.txt"])
+            links = generator._generate_baseline_links("foo", ".txt", "mac")
+            expected_links = '<td align=center><a href="file:///tmp/foo-expected-mac-old.txt">foo-expected.txt</a></td><td align=center><a href="file:///tmp/foo-expected-mac-new.txt">foo-expected.txt</a></td><td align=center><a href="file:///tmp/foo-expected-mac-diff.txt">Diff</a></td>'
+            self.assertEqual(links, expected_links)
+        finally:
+            sys.platform = orig_platform
+            os.path.exists = orig_exists
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests.py b/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
index e9c6d2c..9cc7895 100755
--- a/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests.py
@@ -1,5 +1,6 @@
 #!/usr/bin/env python
 # Copyright (C) 2010 Google Inc. All rights reserved.
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -498,6 +499,12 @@ class TestRunner:
                             self._options.slow_time_out_ms)
         return TestInfo(self._port, test_file, self._options.time_out_ms)
 
+    def _test_requires_lock(self, test_file):
+        """Return True if the test needs to be locked when
+        running multiple copies of NRWTs."""
+        split_path = test_file.split(os.sep)
+        return 'http' in split_path or 'websocket' in split_path
+
     def _get_test_file_queue(self, test_files):
         """Create the thread safe queue of lists of (test filenames, test URIs)
         tuples. Each TestShellThread pulls a list from this queue and runs
@@ -511,46 +518,47 @@ class TestRunner:
           The Queue of lists of TestInfo objects.
         """
 
+        test_lists = []
+        tests_to_http_lock = []
         if (self._options.experimental_fully_parallel or
             self._is_single_threaded()):
-            filename_queue = Queue.Queue()
             for test_file in test_files:
-                filename_queue.put(
-                    ('.', [self._get_test_info_for_file(test_file)]))
-            return filename_queue
-
-        tests_by_dir = {}
-        for test_file in test_files:
-            directory = self._get_dir_for_test_file(test_file)
-            tests_by_dir.setdefault(directory, [])
-            tests_by_dir[directory].append(
-                self._get_test_info_for_file(test_file))
-
-        # Sort by the number of tests in the dir so that the ones with the
-        # most tests get run first in order to maximize parallelization.
-        # Number of tests is a good enough, but not perfect, approximation
-        # of how long that set of tests will take to run. We can't just use
-        # a PriorityQueue until we move # to Python 2.6.
-        test_lists = []
-        http_tests = None
-        for directory in tests_by_dir:
-            test_list = tests_by_dir[directory]
-            # Keep the tests in alphabetical order.
-            # TODO: Remove once tests are fixed so they can be run in any
-            # order.
-            test_list.reverse()
-            test_list_tuple = (directory, test_list)
-            if directory == 'LayoutTests' + os.sep + 'http':
-                http_tests = test_list_tuple
-            else:
+                test_info = self._get_test_info_for_file(test_file)
+                if self._test_requires_lock(test_file):
+                    tests_to_http_lock.append(test_info)
+                else:
+                    test_lists.append((".", [test_info]))
+        else:
+            tests_by_dir = {}
+            for test_file in test_files:
+                directory = self._get_dir_for_test_file(test_file)
+                test_info = self._get_test_info_for_file(test_file)
+                if self._test_requires_lock(test_file):
+                    tests_to_http_lock.append(test_info)
+                else:
+                    tests_by_dir.setdefault(directory, [])
+                    tests_by_dir[directory].append(test_info)
+            # Sort by the number of tests in the dir so that the ones with the
+            # most tests get run first in order to maximize parallelization.
+            # Number of tests is a good enough, but not perfect, approximation
+            # of how long that set of tests will take to run. We can't just use
+            # a PriorityQueue until we move to Python 2.6.
+            for directory in tests_by_dir:
+                test_list = tests_by_dir[directory]
+                # Keep the tests in alphabetical order.
+                # FIXME: Remove once tests are fixed so they can be run in any
+                # order.
+                test_list.reverse()
+                test_list_tuple = (directory, test_list)
                 test_lists.append(test_list_tuple)
-        test_lists.sort(lambda a, b: cmp(len(b[1]), len(a[1])))
+            test_lists.sort(lambda a, b: cmp(len(b[1]), len(a[1])))
 
         # Put the http tests first. There are only a couple hundred of them,
         # but each http test takes a very long time to run, so sorting by the
         # number of tests doesn't accurately capture how long they take to run.
-        if http_tests:
-            test_lists.insert(0, http_tests)
+        if tests_to_http_lock:
+            tests_to_http_lock.reverse()
+            test_lists.insert(0, ("tests_to_http_lock", tests_to_http_lock))
 
         filename_queue = Queue.Queue()
         for item in test_lists:
@@ -687,7 +695,7 @@ class TestRunner:
             thread_timings.append({'name': thread.getName(),
                                    'num_tests': thread.get_num_tests(),
                                    'total_time': thread.get_total_time()})
-            test_timings.update(thread.get_directory_timing_stats())
+            test_timings.update(thread.get_test_group_timing_stats())
             individual_test_timings.extend(thread.get_test_results())
 
         return (thread_timings, test_timings, individual_test_timings)
@@ -696,6 +704,10 @@ class TestRunner:
         """Returns whether the test runner needs an HTTP server."""
         return self._contains_tests(self.HTTP_SUBDIR)
 
+    def needs_websocket(self):
+        """Returns whether the test runner needs a WEBSOCKET server."""
+        return self._contains_tests(self.WEBSOCKET_SUBDIR)
+
     def set_up_run(self):
         """Configures the system to be ready to run tests.
 
@@ -728,14 +740,16 @@ class TestRunner:
         if not result_summary:
             return None
 
-        if self.needs_http():
-            self._printer.print_update('Starting HTTP server ...')
-            self._port.start_http_server()
+        # Do not start when http locking is enabled.
+        if not self._options.wait_for_httpd:
+            if self.needs_http():
+                self._printer.print_update('Starting HTTP server ...')
+                self._port.start_http_server()
 
-        if self._contains_tests(self.WEBSOCKET_SUBDIR):
-            self._printer.print_update('Starting WebSocket server ...')
-            self._port.start_websocket_server()
-            # self._websocket_secure_server.Start()
+            if self.needs_websocket():
+                self._printer.print_update('Starting WebSocket server ...')
+                self._port.start_websocket_server()
+                # self._websocket_secure_server.Start()
 
         return result_summary
 
@@ -826,10 +840,11 @@ class TestRunner:
         sys.stdout.flush()
         _log.debug("flushing stderr")
         sys.stderr.flush()
-        _log.debug("stopping http server")
-        self._port.stop_http_server()
-        _log.debug("stopping websocket server")
-        self._port.stop_websocket_server()
+        if not self._options.wait_for_httpd:
+            _log.debug("stopping http server")
+            self._port.stop_http_server()
+            _log.debug("stopping websocket server")
+            self._port.stop_websocket_server()
         _log.debug("stopping helper")
         self._port.stop_helper()
 
@@ -1432,13 +1447,10 @@ def _set_up_derived_options(port_obj, options):
     if not options.use_apache:
         options.use_apache = sys.platform in ('darwin', 'linux2')
 
-    if options.results_directory.startswith("/"):
-        # Assume it's an absolute path and normalize.
-        options.results_directory = port_obj.get_absolute_path(
-            options.results_directory)
-    else:
-        # If it's a relative path, make the output directory relative to
-        # Debug or Release.
+    if not os.path.isabs(options.results_directory):
+        # This normalizes the path to the build dir.
+        # FIXME: how this happens is not at all obvious; this is a dumb
+        # interface and should be cleaned up.
         options.results_directory = port_obj.results_directory()
 
     if not options.time_out_ms:
@@ -1588,13 +1600,12 @@ def parse_args(args=None):
         optparse.make_option("--no-record-results", action="store_false",
             default=True, dest="record_results",
             help="Don't record the results."),
+        optparse.make_option("--wait-for-httpd", action="store_true",
+            default=False, dest="wait_for_httpd",
+            help="Wait for http locks."),
         # old-run-webkit-tests also has HTTP toggle options:
         # --[no-]http                     Run (or do not run) http tests
         #                                 (default: run)
-        # --[no-]wait-for-httpd           Wait for httpd if some other test
-        #                                 session is using it already (same
-        #                                 as WEBKIT_WAIT_FOR_HTTPD=1).
-        #                                 (default: 0)
     ]
 
     test_options = [
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py b/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
index 6fe99d6..a716cec 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/run_webkit_tests_unittest.py
@@ -1,5 +1,6 @@
 #!/usr/bin/python
 # Copyright (C) 2010 Google Inc. All rights reserved.
+# Copyright (C) 2010 Gabor Rapcsanyi (rgabor@inf.u-szeged.hu), University of Szeged
 #
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
@@ -33,6 +34,7 @@ import codecs
 import logging
 import os
 import Queue
+import shutil
 import sys
 import tempfile
 import thread
@@ -70,7 +72,7 @@ def passing_run(args=[], port_obj=None, record_results=False,
         # We use the glob to test that globbing works.
         new_args.extend(['passes',
                          'http/tests',
-                         'websocket/tests',
+                         'http/tests/websocket/tests',
                          'failures/expected/*'])
     options, parsed_args = run_webkit_tests.parse_args(new_args)
     if port_obj is None:
@@ -88,7 +90,7 @@ def logging_run(args=[], tests_included=False):
     if not tests_included:
         new_args.extend(['passes',
                          'http/tests',
-                         'websocket/tests',
+                         'http/tests/websocket/tests',
                          'failures/expected/*'])
     options, parsed_args = run_webkit_tests.parse_args(new_args)
     user = MockUser()
@@ -232,10 +234,37 @@ class MainTest(unittest.TestCase):
         self.assertFalse(err.empty())
         self.assertEqual(user.url, '/tmp/layout-test-results/results.html')
 
+    def test_results_directory_absolute(self):
+        # We run a configuration that should fail, to generate output, then
+        # look for what the output results url was.
+
+        tmpdir = tempfile.mkdtemp()
+        res, out, err, user = logging_run(['--results-directory=' + tmpdir],
+                                          tests_included=True)
+        self.assertEqual(user.url, os.path.join(tmpdir, 'results.html'))
+        shutil.rmtree(tmpdir, ignore_errors=True)
+
+    def test_results_directory_default(self):
+        # We run a configuration that should fail, to generate output, then
+        # look for what the output results url was.
+
+        # This is the default location.
+        res, out, err, user = logging_run(tests_included=True)
+        self.assertEqual(user.url, '/tmp/layout-test-results/results.html')
+
+    def test_results_directory_relative(self):
+        # We run a configuration that should fail, to generate output, then
+        # look for what the output results url was.
+
+        res, out, err, user = logging_run(['--results-directory=foo'],
+                                          tests_included=True)
+        self.assertEqual(user.url, '/tmp/foo/results.html')
+
+
 
 def _mocked_open(original_open, file_list):
     def _wrapper(name, mode, encoding):
-        if name.find("-expected.") != -1 and mode == "w":
+        if name.find("-expected.") != -1 and mode.find("w") != -1:
             # we don't want to actually write new baselines, so stub these out
             name.replace('\\', '/')
             file_list.append(name)
@@ -251,7 +280,10 @@ class RebaselineTest(unittest.TestCase):
             baseline = file + "-expected" + ext
             self.assertTrue(any(f.find(baseline) != -1 for f in file_list))
 
-    def test_reset_results(self):
+    # FIXME: This test is failing on the bots. Also, this test touches the
+    #        file system.  Unit tests should not read or write the file system.
+    #        https://bugs.webkit.org/show_bug.cgi?id=47879
+    def disabled_test_reset_results(self):
         file_list = []
         original_open = codecs.open
         try:
@@ -294,6 +326,11 @@ class RebaselineTest(unittest.TestCase):
             codecs.open = original_open
 
 
+class TestRunnerWrapper(run_webkit_tests.TestRunner):
+    def _get_test_info_for_file(self, test_file):
+        return test_file
+
+
 class TestRunnerTest(unittest.TestCase):
     def test_results_html(self):
         mock_port = Mock()
@@ -314,6 +351,52 @@ class TestRunnerTest(unittest.TestCase):
         html = runner._results_html(["test_path"], {}, "Title", override_time="time")
         self.assertEqual(html, expected_html)
 
+    def queue_to_list(self, queue):
+        queue_list = []
+        while(True):
+            try:
+                queue_list.append(queue.get_nowait())
+            except Queue.Empty:
+                break
+        return queue_list
+
+    def test_get_test_file_queue(self):
+        # Test that _get_test_file_queue in run_webkit_tests.TestRunner really
+        # put the http tests first in the queue.
+        runner = TestRunnerWrapper(port=Mock(), options=Mock(), printer=Mock())
+        runner._options.experimental_fully_parallel = False
+
+        test_list = [
+          "LayoutTests/websocket/tests/unicode.htm",
+          "LayoutTests/animations/keyframes.html",
+          "LayoutTests/http/tests/security/view-source-no-refresh.html",
+          "LayoutTests/websocket/tests/websocket-protocol-ignored.html",
+          "LayoutTests/fast/css/display-none-inline-style-change-crash.html",
+          "LayoutTests/http/tests/xmlhttprequest/supported-xml-content-types.html",
+          "LayoutTests/dom/html/level2/html/HTMLAnchorElement03.html",
+          "LayoutTests/ietestcenter/Javascript/11.1.5_4-4-c-1.html",
+          "LayoutTests/dom/html/level2/html/HTMLAnchorElement06.html",
+        ]
+
+        expected_tests_to_http_lock = set([
+          'LayoutTests/websocket/tests/unicode.htm',
+          'LayoutTests/http/tests/security/view-source-no-refresh.html',
+          'LayoutTests/websocket/tests/websocket-protocol-ignored.html',
+          'LayoutTests/http/tests/xmlhttprequest/supported-xml-content-types.html',
+        ])
+
+        runner._options.child_processes = 1
+        test_queue_for_single_thread = runner._get_test_file_queue(test_list)
+        runner._options.child_processes = 2
+        test_queue_for_multi_thread = runner._get_test_file_queue(test_list)
+
+        single_thread_results = self.queue_to_list(test_queue_for_single_thread)
+        multi_thread_results = self.queue_to_list(test_queue_for_multi_thread)
+
+        self.assertEqual("tests_to_http_lock", single_thread_results[0][0])
+        self.assertEqual(expected_tests_to_http_lock, set(single_thread_results[0][1]))
+        self.assertEqual("tests_to_http_lock", multi_thread_results[0][0])
+        self.assertEqual(expected_tests_to_http_lock, set(multi_thread_results[0][1]))
 
 class DryrunTest(unittest.TestCase):
     # FIXME: it's hard to know which platforms are safe to test; the
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/test_types/image_diff.py b/WebKitTools/Scripts/webkitpy/layout_tests/test_types/image_diff.py
index 1ad0fe6..0b05802 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/test_types/image_diff.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/test_types/image_diff.py
@@ -104,7 +104,7 @@ class ImageDiff(test_type_base.TestTypeBase):
           self.FILENAME_SUFFIX_EXPECTED + '.png')
 
         expected_image = port.expected_image(filename)
-        with codecs.open(actual_filename, 'r', None) as file:
+        with codecs.open(actual_filename, 'r+b', None) as file:
             actual_image = file.read()
 
         result = port.diff_image(expected_image, actual_image,
diff --git a/WebKitTools/Scripts/webkitpy/layout_tests/test_types/test_type_base.py b/WebKitTools/Scripts/webkitpy/layout_tests/test_types/test_type_base.py
index 3a6e92b..dcc64a3 100644
--- a/WebKitTools/Scripts/webkitpy/layout_tests/test_types/test_type_base.py
+++ b/WebKitTools/Scripts/webkitpy/layout_tests/test_types/test_type_base.py
@@ -161,7 +161,10 @@ class TestTypeBase(object):
     def _write_into_file_at_path(self, file_path, contents, encoding):
         """This method assumes that byte_array is already encoded
         into the right format."""
-        with codecs.open(file_path, "w", encoding=encoding) as file:
+        open_mode = 'w'
+        if encoding is None:
+            open_mode = 'w+b'
+        with codecs.open(file_path, open_mode, encoding=encoding) as file:
             file.write(contents)
 
     def write_output_files(self, filename, file_type,
diff --git a/WebKitTools/Scripts/webkitpy/style/checker.py b/WebKitTools/Scripts/webkitpy/style/checker.py
index f8eefa4..e0c956f 100644
--- a/WebKitTools/Scripts/webkitpy/style/checker.py
+++ b/WebKitTools/Scripts/webkitpy/style/checker.py
@@ -134,6 +134,7 @@ _PATH_RULES_SPECIFIER = [
     ([# The GTK+ APIs use GTK+ naming style, which includes
       # lower-cased, underscore-separated values.
       # Also, GTK+ allows the use of NULL.
+      "WebCore/bindings/scripts/test/GObject",
       "WebKit/gtk/webkit/",
       "WebKitTools/DumpRenderTree/gtk/"],
      ["-readability/naming",
@@ -142,6 +143,10 @@ _PATH_RULES_SPECIFIER = [
       # exceptional header guards (e.g., WebCore_FWD_Debugger_h).
       "/ForwardingHeaders/"],
      ["-build/header_guard"]),
+    ([# assembler has lots of opcodes that use underscores, so
+      # we don't check for underscores in that directory.
+      "/JavaScriptCore/assembler/"],
+     ["-readability/naming"]),
 
     # For third-party Python code, keep only the following checks--
     #
diff --git a/WebKitTools/Scripts/webkitpy/style/checkers/cpp.py b/WebKitTools/Scripts/webkitpy/style/checkers/cpp.py
index f8ebeff..7c1cb3e 100644
--- a/WebKitTools/Scripts/webkitpy/style/checkers/cpp.py
+++ b/WebKitTools/Scripts/webkitpy/style/checkers/cpp.py
@@ -2512,7 +2512,7 @@ def check_identifier_name_in_declaration(filename, line_number, line, error):
         modified_identifier = sub(r'(^|(?<=::))[ms]_', '', identifier)
         if modified_identifier.find('_') >= 0:
             # Various exceptions to the rule: JavaScript op codes functions, const_iterator.
-            if (not (filename.find('JavaScriptCore') >= 0 and modified_identifier.find('_op_') >= 0)
+            if (not (filename.find('JavaScriptCore') >= 0 and modified_identifier.find('op_') >= 0)
                 and not modified_identifier.startswith('tst_')
                 and not modified_identifier.startswith('webkit_dom_object_')
                 and not modified_identifier.startswith('NPN_')
@@ -2521,7 +2521,8 @@ def check_identifier_name_in_declaration(filename, line_number, line, error):
                 and not modified_identifier.startswith('qt_')
                 and not modified_identifier.startswith('cairo_')
                 and not modified_identifier.find('::qt_') >= 0
-                and not modified_identifier == "const_iterator"):
+                and not modified_identifier == "const_iterator"
+                and not modified_identifier == "vm_throw"):
                 error(line_number, 'readability/naming', 4, identifier + " is incorrectly named. Don't use underscores in your identifier names.")
 
         # Check for variables named 'l', these are too easy to confuse with '1' in some fonts
diff --git a/WebKitTools/Scripts/webkitpy/style/checkers/cpp_unittest.py b/WebKitTools/Scripts/webkitpy/style/checkers/cpp_unittest.py
index 2f54305..071ce50 100644
--- a/WebKitTools/Scripts/webkitpy/style/checkers/cpp_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/style/checkers/cpp_unittest.py
@@ -3690,6 +3690,7 @@ class WebKitStyleTest(CppStyleTestBase):
 
         # There is an exception for op code functions but only in the JavaScriptCore directory.
         self.assert_lint('void this_op_code(int var1, int var2)', '', 'JavaScriptCore/foo.cpp')
+        self.assert_lint('void op_code(int var1, int var2)', '', 'JavaScriptCore/foo.cpp')
         self.assert_lint('void this_op_code(int var1, int var2)', 'this_op_code' + name_underscore_error_message)
 
         # GObject requires certain magical names in class declarations.
@@ -3716,6 +3717,9 @@ class WebKitStyleTest(CppStyleTestBase):
         # const_iterator is allowed as well.
         self.assert_lint('typedef VectorType::const_iterator const_iterator;', '')
 
+        # vm_throw is allowed as well.
+        self.assert_lint('int vm_throw;', '')
+
         # Bitfields.
         self.assert_lint('unsigned _fillRule : 1;',
                          '_fillRule' + name_underscore_error_message)
diff --git a/WebKitTools/Scripts/webkitpy/style/patchreader.py b/WebKitTools/Scripts/webkitpy/style/patchreader.py
index 576504a..f44839d 100644
--- a/WebKitTools/Scripts/webkitpy/style/patchreader.py
+++ b/WebKitTools/Scripts/webkitpy/style/patchreader.py
@@ -37,7 +37,6 @@ _log = logging.getLogger("webkitpy.style.patchreader")
 
 
 class PatchReader(object):
-
     """Supports checking style in patches."""
 
     def __init__(self, text_file_reader):
@@ -53,28 +52,15 @@ class PatchReader(object):
         """Check style in the given patch."""
         patch_files = DiffParser(patch_string.splitlines()).files
 
-        # The diff variable is a DiffFile instance.
-        for path, diff in patch_files.iteritems():
-            line_numbers = set()
-            for line in diff.lines:
-                # When deleted line is not set, it means that
-                # the line is newly added (or modified).
-                if not line[0]:
-                    line_numbers.add(line[1])
-
-            _log.debug('Found %s new or modified lines in: %s'
-                       % (len(line_numbers), path))
+        for path, diff_file in patch_files.iteritems():
+            line_numbers = diff_file.added_or_modified_line_numbers()
+            _log.debug('Found %s new or modified lines in: %s' % (len(line_numbers), path))
 
-            # If line_numbers is empty, the file has no new or
-            # modified lines.  In this case, we don't check the file
-            # because we'll never output errors for the file.
-            # This optimization also prevents the program from exiting
-            # due to a deleted file.
-            if line_numbers:
-                self._text_file_reader.process_file(file_path=path,
-                                                    line_numbers=line_numbers)
-            else:
-                # We don't check the file which contains deleted lines only
-                # but would like to treat it as to be processed so that
-                # we count up number of such files.
+            if not line_numbers:
+                # Don't check files which contain only deleted lines
+                # as they can never add style errors. However, mark them as
+                # processed so that we count up number of such files.
                 self._text_file_reader.count_delete_only_file()
+                continue
+
+            self._text_file_reader.process_file(file_path=path, line_numbers=line_numbers)
diff --git a/WebKitTools/Scripts/webkitpy/style/patchreader_unittest.py b/WebKitTools/Scripts/webkitpy/style/patchreader_unittest.py
index 2453c6b..b121082 100644
--- a/WebKitTools/Scripts/webkitpy/style/patchreader_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/style/patchreader_unittest.py
@@ -78,7 +78,7 @@ index ef65bee..e3db70e 100644
  # Required for Python to search this directory for module files
 +# New line
 """)
-        self._assert_checked([("__init__.py", set([2]))], 0)
+        self._assert_checked([("__init__.py", [2])], 0)
 
     def test_check_patch_with_deletion(self):
         self._call_check_patch("""Index: __init__.py
diff --git a/WebKitTools/Scripts/webkitpy/test/main.py b/WebKitTools/Scripts/webkitpy/test/main.py
index 9351768..1038d82 100644
--- a/WebKitTools/Scripts/webkitpy/test/main.py
+++ b/WebKitTools/Scripts/webkitpy/test/main.py
@@ -50,12 +50,12 @@ class Tester(object):
 
         return unittest_paths
 
-    def _modules_from_paths(self, webkitpy_dir, paths):
+    def _modules_from_paths(self, package_root, paths):
         """Return a list of fully-qualified module names given paths."""
-        webkitpy_dir = os.path.abspath(webkitpy_dir)
-        webkitpy_name = os.path.split(webkitpy_dir)[1]  # Equals "webkitpy".
+        package_path = os.path.abspath(package_root)
+        root_package_name = os.path.split(package_path)[1]  # Equals "webkitpy".
 
-        prefix_length = len(webkitpy_dir)
+        prefix_length = len(package_path)
 
         modules = []
         for path in paths:
@@ -72,7 +72,8 @@ class Tester(object):
                     break
                 parts.insert(0, tail)
             # We now have, for example: common.config.ports_unittest
-            parts.insert(0, webkitpy_name)  # Put "webkitpy" at the beginning.
+            # FIXME: This is all a hack around the fact that we always prefix webkitpy includes with "webkitpy."
+            parts.insert(0, root_package_name)  # Put "webkitpy" at the beginning.
             module = ".".join(parts)
             modules.append(module)
 
@@ -91,6 +92,9 @@ class Tester(object):
         if external_package_paths is None:
             external_package_paths = []
         else:
+            # FIXME: We should consider moving webkitpy off of using "webkitpy." to prefix
+            # all includes.  If we did that, then this would use path instead of dirname(path).
+            # QueueStatusServer.__init__ has a sys.path import hack due to this code.
             sys.path.extend(set(os.path.dirname(path) for path in external_package_paths))
 
         if len(sys_argv) > 1 and not sys_argv[-1].startswith("-"):
@@ -101,6 +105,7 @@ class Tester(object):
 
         # Otherwise, auto-detect all unit tests.
 
+        # FIXME: This should be combined with the external_package_paths code above.
         webkitpy_dir = os.path.dirname(webkitpy.__file__)
 
         modules = []
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask.py b/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask.py
index a347972..02e203c 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask.py
@@ -27,19 +27,39 @@
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 from webkitpy.common.system.executive import ScriptError
+from webkitpy.common.net.layouttestresults import LayoutTestResults
+
+
+class CommitQueueTaskDelegate(object):
+    def run_command(self, command):
+        raise NotImplementedError("subclasses must implement")
+
+    def command_passed(self, message, patch):
+        raise NotImplementedError("subclasses must implement")
+
+    def command_failed(self, message, script_error, patch):
+        raise NotImplementedError("subclasses must implement")
+
+    def refetch_patch(self, patch):
+        raise NotImplementedError("subclasses must implement")
+
+    def layout_test_results(self):
+        raise NotImplementedError("subclasses must implement")
+
+    def report_flaky_tests(self, patch, flaky_tests):
+        raise NotImplementedError("subclasses must implement")
 
 
 class CommitQueueTask(object):
-    def __init__(self, tool, commit_queue, patch):
-        self._tool = tool
-        self._commit_queue = commit_queue
+    def __init__(self, delegate, patch):
+        self._delegate = delegate
         self._patch = patch
         self._script_error = None
 
     def _validate(self):
         # Bugs might get closed, or patches might be obsoleted or r-'d while the
         # commit-queue is processing.
-        self._patch = self._tool.bugs.fetch_attachment(self._patch.id())
+        self._patch = self._delegate.refetch_patch(self._patch)
         if self._patch.is_obsolete():
             return False
         if self._patch.bug().is_closed():
@@ -52,12 +72,12 @@ class CommitQueueTask(object):
 
     def _run_command(self, command, success_message, failure_message):
         try:
-            self._commit_queue.run_webkit_patch(command)
-            self._commit_queue.command_passed(success_message, patch=self._patch)
+            self._delegate.run_command(command)
+            self._delegate.command_passed(success_message, patch=self._patch)
             return True
         except ScriptError, e:
             self._script_error = e
-            self.failure_status_id = self._commit_queue.command_failed(failure_message, script_error=self._script_error, patch=self._patch)
+            self.failure_status_id = self._delegate.command_failed(failure_message, script_error=self._script_error, patch=self._patch)
             return False
 
     def _apply(self):
@@ -76,7 +96,6 @@ class CommitQueueTask(object):
             "build",
             "--no-clean",
             "--no-update",
-            "--build",
             "--build-style=both",
             "--quiet",
         ],
@@ -88,7 +107,6 @@ class CommitQueueTask(object):
             "build",
             "--force-clean",
             "--no-update",
-            "--build",
             "--build-style=both",
             "--quiet",
         ],
@@ -121,6 +139,12 @@ class CommitQueueTask(object):
         "Able to pass tests without patch",
         "Unable to pass tests without patch (tree is red?)")
 
+    def _failing_tests_from_last_run(self):
+        results = self._delegate.layout_test_results()
+        if not results:
+            return None
+        return results.failing_tests()
+
     def _land(self):
         return self._run_command([
             "land-attachment",
@@ -134,6 +158,29 @@ class CommitQueueTask(object):
         "Landed patch",
         "Unable to land patch")
 
+    def _report_flaky_tests(self, flaky_tests):
+        self._delegate.report_flaky_tests(self._patch, flaky_tests)
+
+    def _test_patch(self):
+        if self._patch.is_rollout():
+            return True
+        if self._test():
+            return True
+
+        first_failing_tests = self._failing_tests_from_last_run()
+        if self._test():
+            self._report_flaky_tests(first_failing_tests)
+            return True
+
+        second_failing_tests = self._failing_tests_from_last_run()
+        if first_failing_tests != second_failing_tests:
+            self._report_flaky_tests(first_failing_tests + second_failing_tests)
+            return False
+
+        if self._build_and_test_without_patch():
+            raise self._script_error  # The error from the previous ._test() run is real, report it.
+        return False  # Tree must be red, just retry later.
+
     def run(self):
         if not self._validate():
             return False
@@ -143,12 +190,8 @@ class CommitQueueTask(object):
             if not self._build_without_patch():
                 return False
             raise self._script_error
-        if not self._patch.is_rollout():
-            if not self._test():
-                if not self._test():
-                    if not self._build_and_test_without_patch():
-                        return False
-                    raise self._script_error
+        if not self._test_patch():
+            return False
         # Make sure the patch is still valid before landing (e.g., make sure
         # no one has set commit-queue- since we started working on the patch.)
         if not self._validate():
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py b/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
index 8b46146..6fa0667 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/commitqueuetask_unittest.py
@@ -36,11 +36,11 @@ from webkitpy.tool.bot.commitqueuetask import *
 from webkitpy.tool.mocktool import MockTool
 
 
-class MockCommitQueue:
+class MockCommitQueue(CommitQueueTaskDelegate):
     def __init__(self, error_plan):
         self._error_plan = error_plan
 
-    def run_webkit_patch(self, command):
+    def run_command(self, command):
         log("run_webkit_patch: %s" % command)
         if self._error_plan:
             error = self._error_plan.pop(0)
@@ -56,19 +56,28 @@ class MockCommitQueue:
             failure_message, script_error, patch.id()))
         return 3947
 
+    def refetch_patch(self, patch):
+        return patch
+
+    def layout_test_results(self):
+        return None
+
+    def report_flaky_tests(self, patch, flaky_tests):
+        log("report_flaky_tests: patch='%s' flaky_tests='%s'" % (patch.id(), flaky_tests))
+
 
 class CommitQueueTaskTest(unittest.TestCase):
     def _run_through_task(self, commit_queue, expected_stderr, expected_exception=None):
         tool = MockTool(log_executive=True)
         patch = tool.bugs.fetch_attachment(197)
-        task = CommitQueueTask(tool, commit_queue, patch)
+        task = CommitQueueTask(commit_queue, patch)
         OutputCapture().assert_outputs(self, task.run, expected_stderr=expected_stderr, expected_exception=expected_exception)
 
     def test_success_case(self):
         commit_queue = MockCommitQueue([])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Built patch' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_passed: success_message='Passed tests' patch='197'
@@ -93,9 +102,9 @@ command_failed: failure_message='Patch does not apply' script_error='MOCK apply
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_failed: failure_message='Patch does not build' script_error='MOCK build failure' patch='197'
-run_webkit_patch: ['build', '--force-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--force-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Able to build without patch' patch='197'
 """
         self._run_through_task(commit_queue, expected_stderr, ScriptError)
@@ -108,9 +117,9 @@ command_passed: success_message='Able to build without patch' patch='197'
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_failed: failure_message='Patch does not build' script_error='MOCK build failure' patch='197'
-run_webkit_patch: ['build', '--force-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--force-clean', '--no-update', '--build-style=both', '--quiet']
 command_failed: failure_message='Unable to build without patch' script_error='MOCK clean build failure' patch='197'
 """
         self._run_through_task(commit_queue, expected_stderr)
@@ -123,12 +132,13 @@ command_failed: failure_message='Unable to build without patch' script_error='MO
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Built patch' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_failed: failure_message='Patch does not pass tests' script_error='MOCK tests failure' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_passed: success_message='Passed tests' patch='197'
+report_flaky_tests: patch='197' flaky_tests='None'
 run_webkit_patch: ['land-attachment', '--force-clean', '--ignore-builders', '--quiet', '--non-interactive', '--parent-command=commit-queue', 197]
 command_passed: success_message='Landed patch' patch='197'
 """
@@ -143,7 +153,7 @@ command_passed: success_message='Landed patch' patch='197'
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Built patch' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_failed: failure_message='Patch does not pass tests' script_error='MOCK test failure' patch='197'
@@ -164,7 +174,7 @@ command_passed: success_message='Able to pass tests without patch' patch='197'
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Built patch' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_failed: failure_message='Patch does not pass tests' script_error='MOCK test failure' patch='197'
@@ -184,7 +194,7 @@ command_failed: failure_message='Unable to pass tests without patch (tree is red
         ])
         expected_stderr = """run_webkit_patch: ['apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 command_passed: success_message='Applied patch' patch='197'
-run_webkit_patch: ['build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+run_webkit_patch: ['build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 command_passed: success_message='Built patch' patch='197'
 run_webkit_patch: ['build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 command_passed: success_message='Passed tests' patch='197'
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/feeders.py b/WebKitTools/Scripts/webkitpy/tool/bot/feeders.py
index 15eaaf3..dc892a4 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/feeders.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/feeders.py
@@ -28,18 +28,15 @@
 
 from webkitpy.common.system.deprecated_logging import log
 from webkitpy.common.net.bugzilla import CommitterValidator
+from webkitpy.tool.grammar import pluralize
 
 
 class AbstractFeeder(object):
     def __init__(self, tool):
         self._tool = tool
 
-    def feed(tool):
-        raise NotImplementedError, "subclasses must implement"
-
-    def update_work_items(self, item_ids):
-        self._tool.status_server.update_work_items(self.queue_name, item_ids)
-        log("Feeding %s items %s" % (self.queue_name, item_ids))
+    def feed(self):
+        raise NotImplementedError("subclasses must implement")
 
 
 class CommitQueueFeeder(AbstractFeeder):
@@ -49,11 +46,17 @@ class CommitQueueFeeder(AbstractFeeder):
         AbstractFeeder.__init__(self, tool)
         self.committer_validator = CommitterValidator(self._tool.bugs)
 
+    def _update_work_items(self, item_ids):
+        # FIXME: This is the last use of update_work_items, the commit-queue
+        # should move to feeding patches one at a time like the EWS does.
+        self._tool.status_server.update_work_items(self.queue_name, item_ids)
+        log("Feeding %s items %s" % (self.queue_name, item_ids))
+
     def feed(self):
         patches = self._validate_patches()
         patches = sorted(patches, self._patch_cmp)
         patch_ids = [patch.id() for patch in patches]
-        self.update_work_items(patch_ids)
+        self._update_work_items(patch_ids)
 
     def _patches_for_bug(self, bug_id):
         return self._tool.bugs.fetch_bug(bug_id).commit_queued_patches(include_invalid=True)
@@ -71,3 +74,17 @@ class CommitQueueFeeder(AbstractFeeder):
         if rollout_cmp != 0:
             return rollout_cmp
         return cmp(a.attach_date(), b.attach_date())
+
+
+class EWSFeeder(AbstractFeeder):
+    def __init__(self, tool):
+        self._ids_sent_to_server = set()
+        AbstractFeeder.__init__(self, tool)
+
+    def feed(self):
+        ids_needing_review = set(self._tool.bugs.queries.fetch_attachment_ids_from_review_queue())
+        new_ids = ids_needing_review.difference(self._ids_sent_to_server)
+        log("Feeding EWS (%s, %s new)" % (pluralize("r? patch", len(ids_needing_review)), len(new_ids)))
+        for attachment_id in new_ids:  # Order doesn't really matter for the EWS.
+            self._tool.status_server.submit_to_ews(attachment_id)
+            self._ids_sent_to_server.add(attachment_id)
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/patchcollection.py b/WebKitTools/Scripts/webkitpy/tool/bot/patchcollection.py
deleted file mode 100644
index 6100cf8..0000000
--- a/WebKitTools/Scripts/webkitpy/tool/bot/patchcollection.py
+++ /dev/null
@@ -1,78 +0,0 @@
-# Copyright (c) 2010 Google Inc. All rights reserved.
-#
-# Redistribution and use in source and binary forms, with or without
-# modification, are permitted provided that the following conditions are
-# met:
-# 
-#     * Redistributions of source code must retain the above copyright
-# notice, this list of conditions and the following disclaimer.
-#     * Redistributions in binary form must reproduce the above
-# copyright notice, this list of conditions and the following disclaimer
-# in the documentation and/or other materials provided with the
-# distribution.
-#     * Neither the name of Google Inc. nor the names of its
-# contributors may be used to endorse or promote products derived from
-# this software without specific prior written permission.
-# 
-# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-
-class PersistentPatchCollectionDelegate:
-    def collection_name(self):
-        raise NotImplementedError, "subclasses must implement"
-
-    def fetch_potential_patch_ids(self):
-        raise NotImplementedError, "subclasses must implement"
-
-    def status_server(self):
-        raise NotImplementedError, "subclasses must implement"
-
-    def is_terminal_status(self, status):
-        raise NotImplementedError, "subclasses must implement"
-
-
-class PersistentPatchCollection:
-    def __init__(self, delegate):
-        self._delegate = delegate
-        self._name = self._delegate.collection_name()
-        self._status = self._delegate.status_server()
-        self._status_cache = {}
-
-    def _cached_status(self, patch_id):
-        cached = self._status_cache.get(patch_id)
-        if cached:
-            return cached
-        status = self._status.patch_status(self._name, patch_id)
-        if status and self._delegate.is_terminal_status(status):
-            self._status_cache[patch_id] = status
-        return status
-
-    def _is_active_patch_id(self, patch_id):
-        """Active patches are patches waiting to be processed from this collection."""
-        status = self._cached_status(patch_id)
-        return not status or not self._delegate.is_terminal_status(status)
-
-    def _fetch_active_patch_ids(self):
-        patch_ids = self._delegate.fetch_potential_patch_ids()
-        return filter(lambda patch_id: self._is_active_patch_id(patch_id), patch_ids)
-
-    def next(self):
-        # Note: We only fetch all the ids so we can post them back to the server.
-        # This will go away once we have a feeder queue and all other queues are
-        # just pulling their next work item from the server.
-        patch_ids = self._fetch_active_patch_ids()
-        # FIXME: We're assuming self._name is a valid queue-name.
-        self._status.update_work_items(self._name, patch_ids)
-        if not patch_ids:
-            return None
-        return patch_ids[0]
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/queueengine.py b/WebKitTools/Scripts/webkitpy/tool/bot/queueengine.py
index 8118653..8b016e8 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/queueengine.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/queueengine.py
@@ -125,8 +125,8 @@ class QueueEngine:
                 traceback.print_exc()
                 # Don't try tell the status bot, in case telling it causes an exception.
                 self._sleep("Exception while preparing queue")
-        # Never reached.
-        self._ensure_work_log_closed()
+        self._stopping("Delegate terminated queue.")
+        return 0
 
     def _stopping(self, message):
         log("\n%s" % message)
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/queueengine_unittest.py b/WebKitTools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
index bfec401..37d8502 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/queueengine_unittest.py
@@ -43,6 +43,7 @@ class LoggingDelegate(QueueEngineDelegate):
         self._test = test
         self._callbacks = []
         self._run_before = False
+        self.stop_message = None
 
     expected_callbacks = [
         'queue_log_path',
@@ -52,7 +53,8 @@ class LoggingDelegate(QueueEngineDelegate):
         'should_proceed_with_work_item',
         'work_item_log_path',
         'process_work_item',
-        'should_continue_work_queue'
+        'should_continue_work_queue',
+        'stop_work_queue',
     ]
 
     def record(self, method_name):
@@ -95,21 +97,20 @@ class LoggingDelegate(QueueEngineDelegate):
         self.record("handle_unexpected_error")
         self._test.assertEquals(work_item, "work_item")
 
+    def stop_work_queue(self, message):
+        self.record("stop_work_queue")
+        self.stop_message = message
+
 
 class RaisingDelegate(LoggingDelegate):
     def __init__(self, test, exception):
         LoggingDelegate.__init__(self, test)
         self._exception = exception
-        self.stop_message = None
 
     def process_work_item(self, work_item):
         self.record("process_work_item")
         raise self._exception
 
-    def stop_work_queue(self, message):
-        self.record("stop_work_queue")
-        self.stop_message = message
-
 
 class NotSafeToProceedDelegate(LoggingDelegate):
     def should_proceed_with_work_item(self, work_item):
@@ -132,16 +133,15 @@ class FastQueueEngine(QueueEngine):
 class QueueEngineTest(unittest.TestCase):
     def test_trivial(self):
         delegate = LoggingDelegate(self)
-        work_queue = QueueEngine("trivial-queue", delegate, threading.Event())
-        work_queue.run()
+        self._run_engine(delegate)
+        self.assertEquals(delegate.stop_message, "Delegate terminated queue.")
         self.assertEquals(delegate._callbacks, LoggingDelegate.expected_callbacks)
         self.assertTrue(os.path.exists(os.path.join(self.temp_dir, "queue_log_path")))
         self.assertTrue(os.path.exists(os.path.join(self.temp_dir, "work_log_path", "work_item.log")))
 
     def test_unexpected_error(self):
         delegate = RaisingDelegate(self, ScriptError(exit_code=3))
-        work_queue = QueueEngine("error-queue", delegate, threading.Event())
-        work_queue.run()
+        self._run_engine(delegate)
         expected_callbacks = LoggingDelegate.expected_callbacks[:]
         work_item_index = expected_callbacks.index('process_work_item')
         # The unexpected error should be handled right after process_work_item starts
@@ -151,11 +151,18 @@ class QueueEngineTest(unittest.TestCase):
 
     def test_handled_error(self):
         delegate = RaisingDelegate(self, ScriptError(exit_code=QueueEngine.handled_error_code))
-        work_queue = QueueEngine("handled-error-queue", delegate, threading.Event())
-        work_queue.run()
+        self._run_engine(delegate)
         self.assertEquals(delegate._callbacks, LoggingDelegate.expected_callbacks)
 
-    def _test_terminating_queue(self, exception, expected_message):
+    def _run_engine(self, delegate, engine=None, termination_message=None):
+        if not engine:
+            engine = QueueEngine("test-queue", delegate, threading.Event())
+        if not termination_message:
+            termination_message = "Delegate terminated queue."
+        expected_stderr = "\n%s\n" % termination_message
+        OutputCapture().assert_outputs(self, engine.run, [], expected_stderr=expected_stderr)
+
+    def _test_terminating_queue(self, exception, termination_message):
         work_item_index = LoggingDelegate.expected_callbacks.index('process_work_item')
         # The terminating error should be handled right after process_work_item.
         # There should be no other callbacks after stop_work_queue.
@@ -163,14 +170,10 @@ class QueueEngineTest(unittest.TestCase):
         expected_callbacks.append("stop_work_queue")
 
         delegate = RaisingDelegate(self, exception)
-        work_queue = QueueEngine("terminating-queue", delegate, threading.Event())
-
-        output = OutputCapture()
-        expected_stderr = "\n%s\n" % expected_message
-        output.assert_outputs(self, work_queue.run, [], expected_stderr=expected_stderr)
+        self._run_engine(delegate, termination_message=termination_message)
 
         self.assertEquals(delegate._callbacks, expected_callbacks)
-        self.assertEquals(delegate.stop_message, expected_message)
+        self.assertEquals(delegate.stop_message, termination_message)
 
     def test_terminating_error(self):
         self._test_terminating_queue(KeyboardInterrupt(), "User terminated queue.")
@@ -178,15 +181,10 @@ class QueueEngineTest(unittest.TestCase):
 
     def test_not_safe_to_proceed(self):
         delegate = NotSafeToProceedDelegate(self)
-        work_queue = FastQueueEngine(delegate)
-        work_queue.run()
+        self._run_engine(delegate, engine=FastQueueEngine(delegate))
         expected_callbacks = LoggingDelegate.expected_callbacks[:]
-        next_work_item_index = expected_callbacks.index('next_work_item')
-        # We slice out the common part of the expected callbacks.
-        # We add 2 here to include should_proceed_with_work_item, which is
-        # a pain to search for directly because it occurs twice.
-        expected_callbacks = expected_callbacks[:next_work_item_index + 2]
-        expected_callbacks.append('should_continue_work_queue')
+        expected_callbacks.remove('work_item_log_path')
+        expected_callbacks.remove('process_work_item')
         self.assertEquals(delegate._callbacks, expected_callbacks)
 
     def test_now(self):
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/sheriff.py b/WebKitTools/Scripts/webkitpy/tool/bot/sheriff.py
index a38c3cf..da506bc 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/sheriff.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/sheriff.py
@@ -77,55 +77,15 @@ class Sheriff(object):
         ])
         return parse_bug_id(output)
 
-    def _rollout_reason(self, builders):
-        # FIXME: This should explain which layout tests failed
-        # however, that would require Build objects here, either passed
-        # in through failure_info, or through Builder.latest_build.
-        names = [builder.name() for builder in builders]
-        return "Caused builders %s to fail." % join_with_separators(names)
-
-    def post_automatic_rollout_patch(self, commit_info, builders):
-        # For now we're only posting rollout patches for commit-queue patches.
-        commit_bot_email = "eseidel@chromium.org"
-        if commit_bot_email == commit_info.committer_email():
-            try:
-                self.post_rollout_patch(commit_info.revision(),
-                                        self._rollout_reason(builders))
-            except ScriptError, e:
-                log("Failed to create-rollout.")
-
-    def post_blame_comment_on_bug(self, commit_info, builders, blame_list):
+    def post_blame_comment_on_bug(self, commit_info, builders, tests):
         if not commit_info.bug_id():
             return
         comment = "%s might have broken %s" % (
             view_source_url(commit_info.revision()),
             join_with_separators([builder.name() for builder in builders]))
-        if len(blame_list) > 1:
-            comment += "\nThe following changes are on the blame list:\n"
-            comment += "\n".join(map(view_source_url, blame_list))
+        if tests:
+            comment += "\nThe following tests are not passing:\n"
+            comment += "\n".join(tests)
         self._tool.bugs.post_comment_to_bug(commit_info.bug_id(),
                                             comment,
                                             cc=self._sheriffbot.watchers)
-
-    # FIXME: Should some of this logic be on BuildBot?
-    def provoke_flaky_builders(self, revisions_causing_failures):
-        # We force_build builders that are red but have not "failed" (i.e.,
-        # been red twice). We do this to avoid a deadlock situation where a
-        # flaky test blocks the commit-queue and there aren't any other
-        # patches being landed to re-spin the builder.
-        failed_builders = sum([revisions_causing_failures[key] for
-                               key in revisions_causing_failures.keys()], [])
-        failed_builder_names = \
-            set([builder.name() for builder in failed_builders])
-        idle_red_builder_names = \
-            set([builder["name"]
-                 for builder in self._tool.buildbot.idle_red_core_builders()])
-
-        # We only want to provoke these builders if they are idle and have not
-        # yet "failed" (i.e., been red twice) to avoid overloading the bots.
-        flaky_builder_names = idle_red_builder_names - failed_builder_names
-
-        for name in flaky_builder_names:
-            flaky_builder = self._tool.buildbot.builder_with_name(name)
-            flaky_builder.force_build(username=self._sheriffbot.name,
-                                      comments="Probe for flakiness.")
diff --git a/WebKitTools/Scripts/webkitpy/tool/bot/sheriff_unittest.py b/WebKitTools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
index c375ff9..690af1f 100644
--- a/WebKitTools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/bot/sheriff_unittest.py
@@ -47,15 +47,6 @@ class MockSheriffBot(object):
 
 
 class SheriffTest(unittest.TestCase):
-    def test_rollout_reason(self):
-        sheriff = Sheriff(MockTool(), MockSheriffBot())
-        builders = [
-            Builder("Foo", None),
-            Builder("Bar", None),
-        ]
-        reason = "Caused builders Foo and Bar to fail."
-        self.assertEquals(sheriff._rollout_reason(builders), reason)
-
     def test_post_blame_comment_on_bug(self):
         def run():
             sheriff = Sheriff(MockTool(), MockSheriffBot())
@@ -68,38 +59,32 @@ class SheriffTest(unittest.TestCase):
             commit_info.revision = lambda: 4321
             # Should do nothing with no bug_id
             sheriff.post_blame_comment_on_bug(commit_info, builders, [])
-            sheriff.post_blame_comment_on_bug(commit_info, builders, [2468, 5646])
+            sheriff.post_blame_comment_on_bug(commit_info, builders, ["mock-test-1", "mock-test-2"])
             # Should try to post a comment to the bug, but MockTool.bugs does nothing.
             commit_info.bug_id = lambda: 1234
             sheriff.post_blame_comment_on_bug(commit_info, builders, [])
-            sheriff.post_blame_comment_on_bug(commit_info, builders, [3432])
-            sheriff.post_blame_comment_on_bug(commit_info, builders, [841, 5646])
+            sheriff.post_blame_comment_on_bug(commit_info, builders, ["mock-test-1"])
+            sheriff.post_blame_comment_on_bug(commit_info, builders, ["mock-test-1", "mock-test-2"])
 
-        expected_stderr = u"MOCK bug comment: bug_id=1234, cc=['watcher@example.com']\n--- Begin comment ---\\http://trac.webkit.org/changeset/4321 might have broken Foo and Bar\n--- End comment ---\n\nMOCK bug comment: bug_id=1234, cc=['watcher@example.com']\n--- Begin comment ---\\http://trac.webkit.org/changeset/4321 might have broken Foo and Bar\n--- End comment ---\n\nMOCK bug comment: bug_id=1234, cc=['watcher@example.com']\n--- Begin comment ---\\http://trac.webkit.org/changeset/4321 might have broken Foo and Bar\nThe following changes are on the blame list:\nhttp://trac.webkit.org/changeset/841\nhttp://trac.webkit.org/changeset/5646\n--- End comment ---\n\n"
-        OutputCapture().assert_outputs(self, run, expected_stderr=expected_stderr)
+        expected_stderr = u"""MOCK bug comment: bug_id=1234, cc=['watcher@example.com']
+--- Begin comment ---
+http://trac.webkit.org/changeset/4321 might have broken Foo and Bar
+--- End comment ---
 
-    def test_provoke_flaky_builders(self):
-        def run():
-            tool = MockTool()
-            tool.buildbot.light_tree_on_fire()
-            sheriff = Sheriff(tool, MockSheriffBot())
-            revisions_causing_failures = {}
-            sheriff.provoke_flaky_builders(revisions_causing_failures)
-        expected_stderr = "MOCK: force_build: name=Builder2, username=mock-sheriff-bot, comments=Probe for flakiness.\n"
-        OutputCapture().assert_outputs(self, run, expected_stderr=expected_stderr)
+MOCK bug comment: bug_id=1234, cc=['watcher@example.com']
+--- Begin comment ---
+http://trac.webkit.org/changeset/4321 might have broken Foo and Bar
+The following tests are not passing:
+mock-test-1
+--- End comment ---
 
-    def test_post_blame_comment_on_bug(self):
-        sheriff = Sheriff(MockTool(), MockSheriffBot())
-        builders = [
-            Builder("Foo", None),
-            Builder("Bar", None),
-        ]
-        commit_info = Mock()
-        commit_info.bug_id = lambda: None
-        commit_info.revision = lambda: 4321
-        commit_info.committer = lambda: None
-        commit_info.committer_email = lambda: "foo@example.com"
-        commit_info.reviewer = lambda: None
-        commit_info.author = lambda: None
-        sheriff.post_automatic_rollout_patch(commit_info, builders)
+MOCK bug comment: bug_id=1234, cc=['watcher@example.com']
+--- Begin comment ---
+http://trac.webkit.org/changeset/4321 might have broken Foo and Bar
+The following tests are not passing:
+mock-test-1
+mock-test-2
+--- End comment ---
 
+"""
+        OutputCapture().assert_outputs(self, run, expected_stderr=expected_stderr)
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/commandtest.py b/WebKitTools/Scripts/webkitpy/tool/commands/commandtest.py
index de92cd3..adc6d81 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/commandtest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/commandtest.py
@@ -33,5 +33,16 @@ from webkitpy.tool.mocktool import MockOptions, MockTool
 
 class CommandsTest(unittest.TestCase):
     def assert_execute_outputs(self, command, args, expected_stdout="", expected_stderr="", options=MockOptions(), tool=MockTool()):
+        options.blocks = True
+        options.cc = 'MOCK cc'
+        options.component = 'MOCK component'
+        options.confirm = True
+        options.email = 'MOCK email'
+        options.git_commit = 'MOCK git commit'
+        options.obsolete_patches = True
+        options.open_bug = True
+        options.port = 'MOCK port'
+        options.quiet = True
+        options.reviewer = 'MOCK reviewer'
         command.bind_to_tool(tool)
         OutputCapture().assert_outputs(self, command.execute, [options, args, tool], expected_stdout=expected_stdout, expected_stderr=expected_stderr)
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/download.py b/WebKitTools/Scripts/webkitpy/tool/commands/download.py
index 9916523..ed5c604 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/download.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/download.py
@@ -43,6 +43,17 @@ from webkitpy.tool.multicommandtool import AbstractDeclarativeCommand
 from webkitpy.common.system.deprecated_logging import error, log
 
 
+class Clean(AbstractSequencedCommand):
+    name = "clean"
+    help_text = "Clean the working copy"
+    steps = [
+        steps.CleanWorkingDirectory,
+    ]
+
+    def _prepare_state(self, options, args, tool):
+        options.force_clean = True
+
+
 class Update(AbstractSequencedCommand):
     name = "update"
     help_text = "Update working copy (used internally)"
@@ -61,6 +72,9 @@ class Build(AbstractSequencedCommand):
         steps.Build,
     ]
 
+    def _prepare_state(self, options, args, tool):
+        options.build = True
+
 
 class BuildAndTest(AbstractSequencedCommand):
     name = "build-and-test"
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/download_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/download_unittest.py
index faddd50..6af1f64 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/download_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/download_unittest.py
@@ -57,15 +57,19 @@ class AbstractRolloutPrepCommandTest(unittest.TestCase):
 class DownloadCommandsTest(CommandsTest):
     def _default_options(self):
         options = MockOptions()
-        options.force_clean = False
-        options.clean = True
+        options.build = True
+        options.build_style = True
         options.check_builders = True
-        options.quiet = False
+        options.check_style = True
+        options.clean = True
+        options.close_bug = True
+        options.force_clean = False
+        options.force_patch = True
         options.non_interactive = False
-        options.update = True
-        options.build = True
+        options.parent_command = 'MOCK parent command'
+        options.quiet = False
         options.test = True
-        options.close_bug = True
+        options.update = True
         return options
 
     def test_build(self):
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem.py b/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
index 86e2e15..5ec468e 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem.py
@@ -48,7 +48,6 @@ class AbstractEarlyWarningSystem(AbstractReviewQueue):
             self.run_webkit_patch([
                 "build",
                 self.port.flag(),
-                "--build",
                 "--build-style=%s" % self._build_style,
                 "--force-clean",
                 "--no-update",
@@ -149,10 +148,6 @@ class ChromiumWindowsEWS(AbstractChromiumEWS):
     name = "cr-win-ews"
 
 
-class ChromiumMacEWS(AbstractChromiumEWS):
-    name = "cr-mac-ews"
-
-
 # For platforms that we can't run inside a VM (like Mac OS X), we require
 # patches to be uploaded by committers, who are generally trustworthy folk. :)
 class AbstractCommitterOnlyEWS(AbstractEarlyWarningSystem):
@@ -167,6 +162,14 @@ class AbstractCommitterOnlyEWS(AbstractEarlyWarningSystem):
         return AbstractEarlyWarningSystem.process_work_item(self, patch)
 
 
+# FIXME: Inheriting from AbstractCommitterOnlyEWS is kinda a hack, but it
+# happens to work because AbstractChromiumEWS and AbstractCommitterOnlyEWS
+# provide disjoint sets of functionality, and Python is otherwise smart
+# enough to handle the diamond inheritance.
+class ChromiumMacEWS(AbstractChromiumEWS, AbstractCommitterOnlyEWS):
+    name = "cr-mac-ews"
+
+
 class MacEWS(AbstractCommitterOnlyEWS):
     name = "mac-ews"
     port_name = "mac"
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
index 3b0ea47..c400f81 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/earlywarningsystem_unittest.py
@@ -48,9 +48,9 @@ class EarlyWarningSytemTest(QueuesTest):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr(ews.name, os.getcwd()),  # FIXME: Use of os.getcwd() is wrong, should be scm.checkout_root
             "handle_unexpected_error": "Mock error message\n",
-            "next_work_item": "MOCK: update_work_items: %(name)s [103]\n" % string_replacemnts,
-            "process_work_item": "MOCK: update_status: %(name)s Pass\n" % string_replacemnts,
-            "handle_script_error": "MOCK: update_status: %(name)s ScriptError error message\nMOCK bug comment: bug_id=142, cc=%(watchers)s\n--- Begin comment ---\\Attachment 197 did not build on %(port)s:\nBuild output: http://dummy_url\n--- End comment ---\n\n" % string_replacemnts,
+            "next_work_item": "",
+            "process_work_item": "MOCK: update_status: %(name)s Pass\nMOCK: release_work_item: %(name)s 197\n" % string_replacemnts,
+            "handle_script_error": "MOCK: update_status: %(name)s ScriptError error message\nMOCK bug comment: bug_id=142, cc=%(watchers)s\n--- Begin comment ---\nAttachment 197 did not build on %(port)s:\nBuild output: http://dummy_url\n--- End comment ---\n\n" % string_replacemnts,
         }
         return expected_stderr
 
@@ -85,3 +85,12 @@ class EarlyWarningSytemTest(QueuesTest):
             "handle_script_error": SystemExit,
         }
         self.assert_queue_outputs(ews, expected_stderr=expected_stderr, expected_exceptions=expected_exceptions)
+
+    def test_chromium_mac_ews(self):
+        ews = ChromiumMacEWS()
+        expected_stderr = self._default_expected_stderr(ews)
+        expected_stderr["process_work_item"] = "MOCK: update_status: cr-mac-ews Error: cr-mac-ews cannot process patches from non-committers :(\n"
+        expected_exceptions = {
+            "handle_script_error": SystemExit,
+        }
+        self.assert_queue_outputs(ews, expected_stderr=expected_stderr, expected_exceptions=expected_exceptions)
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/queries.py b/WebKitTools/Scripts/webkitpy/tool/commands/queries.py
index c6e45aa..16ddc2c 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/queries.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/queries.py
@@ -30,6 +30,8 @@
 
 from optparse import make_option
 
+import webkitpy.tool.steps as steps
+
 from webkitpy.common.checkout.commitinfo import CommitInfo
 from webkitpy.common.config.committers import CommitterList
 from webkitpy.common.net.buildbot import BuildBot
@@ -41,6 +43,21 @@ from webkitpy.common.system.deprecated_logging import log
 from webkitpy.layout_tests import port
 
 
+class SuggestReviewers(AbstractDeclarativeCommand):
+    name = "suggest-reviewers"
+    help_text = "Suggest reviewers for a patch based on recent changes to the modified files."
+
+    def __init__(self):
+        options = [
+            steps.Options.git_commit,
+        ]
+        AbstractDeclarativeCommand.__init__(self, options=options)
+
+    def execute(self, options, args, tool):
+        reviewers = tool.checkout().suggested_reviewers(options.git_commit)
+        print "\n".join([reviewer.full_name for reviewer in reviewers])
+
+
 class BugsToCommit(AbstractDeclarativeCommand):
     name = "bugs-to-commit"
     help_text = "List bugs in the commit-queue"
@@ -162,15 +179,6 @@ class WhatBroke(AbstractDeclarativeCommand):
             print "All builders are passing!"
 
 
-class WhoBrokeIt(AbstractDeclarativeCommand):
-    name = "who-broke-it"
-    help_text = "Print a list of revisions causing failures on %s" % BuildBot.default_host
-
-    def execute(self, options, args, tool):
-        for revision, builders in self._tool.buildbot.failure_map(False).revisions_causing_failures().items():
-            print "r%s appears to have broken %s" % (revision, [builder.name() for builder in builders])
-
-
 class ResultsFor(AbstractDeclarativeCommand):
     name = "results-for"
     help_text = "Print a list of failures for the passed revision from bots on %s" % BuildBot.default_host
@@ -197,17 +205,21 @@ class FailureReason(AbstractDeclarativeCommand):
     name = "failure-reason"
     help_text = "Lists revisions where individual test failures started at %s" % BuildBot.default_host
 
-    def _print_blame_information_for_transition(self, green_build, red_build, failing_tests):
-        regression_window = RegressionWindow(green_build, red_build)
-        revisions = regression_window.revisions()
+    def _blame_line_for_revision(self, revision):
+        try:
+            commit_info = self._tool.checkout().commit_info_for_revision(revision)
+        except Exception, e:
+            return "FAILED to fetch CommitInfo for r%s, exception: %s" % (revision, e)
+        if not commit_info:
+            return "FAILED to fetch CommitInfo for r%s, likely missing ChangeLog" % revision
+        return commit_info.blame_string(self._tool.bugs)
+
+    def _print_blame_information_for_transition(self, regression_window, failing_tests):
+        red_build = regression_window.failing_build()
         print "SUCCESS: Build %s (r%s) was the first to show failures: %s" % (red_build._number, red_build.revision(), failing_tests)
         print "Suspect revisions:"
-        for revision in revisions:
-            commit_info = self._tool.checkout().commit_info_for_revision(revision)
-            if commit_info:
-                print commit_info.blame_string(self._tool.bugs)
-            else:
-                print "FAILED to fetch CommitInfo for r%s, likely missing ChangeLog" % revision
+        for revision in regression_window.revisions():
+            print self._blame_line_for_revision(revision)
 
     def _explain_failures_for_builder(self, builder, start_revision):
         print "Examining failures for \"%s\", starting at r%s" % (builder.name(), start_revision)
@@ -244,7 +256,8 @@ class FailureReason(AbstractDeclarativeCommand):
                 print "No change in build %s (r%s), %s unexplained failures (%s in this build)" % (build._number, build.revision(), len(results_to_explain), len(failures))
                 last_build_with_results = build
                 continue
-            self._print_blame_information_for_transition(build, last_build_with_results, fixed_results)
+            regression_window = RegressionWindow(build, last_build_with_results)
+            self._print_blame_information_for_transition(regression_window, fixed_results)
             last_build_with_results = build
             results_to_explain -= fixed_results
         if results_to_explain:
@@ -274,6 +287,75 @@ class FailureReason(AbstractDeclarativeCommand):
         return self._explain_failures_for_builder(builder, start_revision=int(start_revision))
 
 
+class FindFlakyTests(AbstractDeclarativeCommand):
+    name = "find-flaky-tests"
+    help_text = "Lists tests that often fail for a single build at %s" % BuildBot.default_host
+
+    def _find_failures(self, builder, revision):
+        build = builder.build_for_revision(revision, allow_failed_lookups=True)
+        if not build:
+            print "No build for %s" % revision
+            return (None, None)
+        results = build.layout_test_results()
+        if not results:
+            print "No results build %s (r%s)" % (build._number, build.revision())
+            return (None, None)
+        failures = set(results.failing_tests())
+        if len(failures) >= 20:
+            # FIXME: We may need to move this logic into the LayoutTestResults class.
+            # The buildbot stops runs after 20 failures so we don't have full results to work with here.
+            print "Too many failures in build %s (r%s), ignoring." % (build._number, build.revision())
+            return (None, None)
+        return (build, failures)
+
+    def _increment_statistics(self, flaky_tests, flaky_test_statistics):
+        for test in flaky_tests:
+            count = flaky_test_statistics.get(test, 0)
+            flaky_test_statistics[test] = count + 1
+
+    def _print_statistics(self, statistics):
+        print "=== Results ==="
+        print "Occurances Test name"
+        for value, key in sorted([(value, key) for key, value in statistics.items()]):
+            print "%10d %s" % (value, key)
+
+    def _walk_backwards_from(self, builder, start_revision, limit):
+        flaky_test_statistics = {}
+        all_previous_failures = set([])
+        one_time_previous_failures = set([])
+        previous_build = None
+        for i in range(limit):
+            revision = start_revision - i
+            print "Analyzing %s ... " % revision,
+            (build, failures) = self._find_failures(builder, revision)
+            if failures == None:
+                # Notice that we don't loop on the empty set!
+                continue
+            print "has %s failures" % len(failures)
+            flaky_tests = one_time_previous_failures - failures
+            if flaky_tests:
+                print "Flaky tests: %s %s" % (sorted(flaky_tests),
+                                              previous_build.results_url())
+            self._increment_statistics(flaky_tests, flaky_test_statistics)
+            one_time_previous_failures = failures - all_previous_failures
+            all_previous_failures = failures
+            previous_build = build
+        self._print_statistics(flaky_test_statistics)
+
+    def _builder_to_analyze(self):
+        statuses = self._tool.buildbot.builder_statuses()
+        choices = [status["name"] for status in statuses]
+        chosen_name = User.prompt_with_list("Which builder to analyze:", choices)
+        for status in statuses:
+            if status["name"] == chosen_name:
+                return (self._tool.buildbot.builder_with_name(chosen_name), status["built_revision"])
+
+    def execute(self, options, args, tool):
+        (builder, latest_revision) = self._builder_to_analyze()
+        limit = self._tool.user.prompt("How many revisions to look through? [10000] ") or 10000
+        return self._walk_backwards_from(builder, latest_revision, limit=int(limit))
+
+
 class TreeStatus(AbstractDeclarativeCommand):
     name = "tree-status"
     help_text = "Print the status of the %s buildbots" % BuildBot.default_host
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/queries_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/queries_unittest.py
index 7dddfe7..05a4a5c 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/queries_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/queries_unittest.py
@@ -26,12 +26,15 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+import unittest
+
 from webkitpy.common.net.bugzilla import Bugzilla
 from webkitpy.thirdparty.mock import Mock
 from webkitpy.tool.commands.commandtest import CommandsTest
 from webkitpy.tool.commands.queries import *
 from webkitpy.tool.mocktool import MockTool
 
+
 class QueryCommandsTest(CommandsTest):
     def test_bugs_to_commit(self):
         expected_stderr = "Warning, attachment 128 on bug 42 has invalid committer (non-committer@example.com)\n"
@@ -71,3 +74,17 @@ class QueryCommandsTest(CommandsTest):
 
         expected_stdout = "Test 'media' is not skipped by any port.\n"
         self.assert_execute_outputs(SkippedPorts(), ("media",), expected_stdout)
+
+
+class FailureReasonTest(unittest.TestCase):
+    def test_blame_line_for_revision(self):
+        tool = MockTool()
+        command = FailureReason()
+        command.bind_to_tool(tool)
+        # This is an artificial example, mostly to test the CommitInfo lookup failure case.
+        self.assertEquals(command._blame_line_for_revision(None), "FAILED to fetch CommitInfo for rNone, likely missing ChangeLog")
+
+        def raising_mock(self):
+            raise Exception("MESSAGE")
+        tool.checkout().commit_info_for_revision = raising_mock
+        self.assertEquals(command._blame_line_for_revision(None), "FAILED to fetch CommitInfo for rNone, exception: MESSAGE")
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/queues.py b/WebKitTools/Scripts/webkitpy/tool/commands/queues.py
index 80fd2ea..7b3002a 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/queues.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/queues.py
@@ -27,6 +27,9 @@
 # (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 # OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+from __future__ import with_statement
+
+import codecs
 import time
 import traceback
 import os
@@ -36,17 +39,18 @@ from optparse import make_option
 from StringIO import StringIO
 
 from webkitpy.common.net.bugzilla import CommitterValidator
+from webkitpy.common.net.layouttestresults import path_for_layout_test, LayoutTestResults
 from webkitpy.common.net.statusserver import StatusServer
 from webkitpy.common.system.executive import ScriptError
 from webkitpy.common.system.deprecated_logging import error, log
 from webkitpy.tool.commands.stepsequence import StepSequenceErrorHandler
-from webkitpy.tool.bot.commitqueuetask import CommitQueueTask
-from webkitpy.tool.bot.feeders import CommitQueueFeeder
-from webkitpy.tool.bot.patchcollection import PersistentPatchCollection, PersistentPatchCollectionDelegate
+from webkitpy.tool.bot.commitqueuetask import CommitQueueTask, CommitQueueTaskDelegate
+from webkitpy.tool.bot.feeders import CommitQueueFeeder, EWSFeeder
 from webkitpy.tool.bot.queueengine import QueueEngine, QueueEngineDelegate
 from webkitpy.tool.grammar import pluralize
 from webkitpy.tool.multicommandtool import Command, TryAgain
 
+
 class AbstractQueue(Command, QueueEngineDelegate):
     watchers = [
     ]
@@ -78,6 +82,10 @@ class AbstractQueue(Command, QueueEngineDelegate):
         # because our global option code looks for the first argument which does
         # not begin with "-" and assumes that is the command name.
         webkit_patch_args += ["--status-host=%s" % self._tool.status_server.host]
+        if self._tool.status_server.bot_id:
+            webkit_patch_args += ["--bot-id=%s" % self._tool.status_server.bot_id]
+        if self._options.port:
+            webkit_patch_args += ["--port=%s" % self._options.port]
         webkit_patch_args.extend(args)
         return self._tool.executive.run_and_throw_if_fail(webkit_patch_args)
 
@@ -94,7 +102,7 @@ class AbstractQueue(Command, QueueEngineDelegate):
 
     def begin_work_queue(self):
         log("CAUTION: %s will discard all local changes in \"%s\"" % (self.name, self._tool.scm().checkout_root))
-        if self.options.confirm:
+        if self._options.confirm:
             response = self._tool.user.prompt("Are you sure?  Type \"yes\" to continue: ")
             if (response != "yes"):
                 error("User declined.")
@@ -106,7 +114,7 @@ class AbstractQueue(Command, QueueEngineDelegate):
 
     def should_continue_work_queue(self):
         self._iteration_count += 1
-        return not self.options.iterations or self._iteration_count <= self.options.iterations
+        return not self._options.iterations or self._iteration_count <= self._options.iterations
 
     def next_work_item(self):
         raise NotImplementedError, "subclasses must implement"
@@ -123,7 +131,7 @@ class AbstractQueue(Command, QueueEngineDelegate):
     # Command methods
 
     def execute(self, options, args, tool, engine=QueueEngine):
-        self.options = options  # FIXME: This code is wrong.  Command.options is a list, this assumes an Options element!
+        self._options = options # FIXME: This code is wrong.  Command.options is a list, this assumes an Options element!
         self._tool = tool  # FIXME: This code is wrong too!  Command.bind_to_tool handles this!
         return engine(self.name, self, self._tool.wakeup_event).run()
 
@@ -159,6 +167,7 @@ class FeederQueue(AbstractQueue):
         AbstractQueue.begin_work_queue(self)
         self.feeders = [
             CommitQueueFeeder(self._tool),
+            EWSFeeder(self._tool),
         ]
 
     def next_work_item(self):
@@ -190,6 +199,9 @@ class AbstractPatchQueue(AbstractQueue):
     def _fetch_next_work_item(self):
         return self._tool.status_server.next_work_item(self.name)
 
+    def _release_work_item(self, patch):
+        self._tool.status_server.release_work_item(self.name, patch)
+
     def _did_pass(self, patch):
         self._update_status(self._pass_status, patch)
 
@@ -207,7 +219,7 @@ class AbstractPatchQueue(AbstractQueue):
         return os.path.join(self._log_directory(), "%s.log" % patch.bug_id())
 
 
-class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler):
+class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler, CommitQueueTaskDelegate):
     name = "commit-queue"
 
     # AbstractPatchQueue methods
@@ -229,7 +241,7 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler):
 
     def process_work_item(self, patch):
         self._cc_watchers(patch.bug_id())
-        task = CommitQueueTask(self._tool, self, patch)
+        task = CommitQueueTask(self, patch)
         try:
             if task.run():
                 self._did_pass(patch)
@@ -239,10 +251,22 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler):
             validator = CommitterValidator(self._tool.bugs)
             validator.reject_patch_from_commit_queue(patch.id(), self._error_message_for_bug(task.failure_status_id, e))
             self._did_fail(patch)
+        self._release_work_item(patch)
+
+    def _error_message_for_bug(self, status_id, script_error):
+        if not script_error.output:
+            return script_error.message_with_output()
+        results_link = self._tool.status_server.results_url_for_status(status_id)
+        return "%s\nFull output: %s" % (script_error.message_with_output(), results_link)
 
     def handle_unexpected_error(self, patch, message):
         self.committer_validator.reject_patch_from_commit_queue(patch.id(), message)
 
+    # CommitQueueTaskDelegate methods
+
+    def run_command(self, command):
+        self.run_webkit_patch(command)
+
     def command_passed(self, message, patch):
         self._update_status(message, patch=patch)
 
@@ -250,11 +274,36 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler):
         failure_log = self._log_from_script_error_for_upload(script_error)
         return self._update_status(message, patch=patch, results_file=failure_log)
 
-    def _error_message_for_bug(self, status_id, script_error):
-        if not script_error.output:
-            return script_error.message_with_output()
-        results_link = self._tool.status_server.results_url_for_status(status_id)
-        return "%s\nFull output: %s" % (script_error.message_with_output(), results_link)
+    # FIXME: This exists for mocking, but should instead be mocked via
+    # some sort of tool.filesystem() object.
+    def _read_file_contents(self, path):
+        try:
+            with codecs.open(path, "r", "utf-8") as open_file:
+                return open_file.read()
+        except OSError, e:  # File does not exist or can't be read.
+            return None
+
+    # FIXME: This may belong on the Port object.
+    def layout_test_results(self):
+        results_path = self._tool.port().layout_tests_results_path()
+        results_html = self._read_file_contents(results_path)
+        if not results_html:
+            return None
+        return LayoutTestResults.results_from_string(results_html)
+
+    def refetch_patch(self, patch):
+        return self._tool.bugs.fetch_attachment(patch.id())
+
+    def _author_emails_for_tests(self, flaky_tests):
+        test_paths = map(path_for_layout_test, flaky_tests)
+        commit_infos = self._tool.checkout().recent_commit_infos_for_files(test_paths)
+        return [commit_info.author().bugzilla_email() for commit_info in commit_infos if commit_info.author()]
+
+    def report_flaky_tests(self, patch, flaky_tests):
+        authors = self._author_emails_for_tests(flaky_tests)
+        cc_explaination = "  The author(s) of the test(s) have been CCed on this bug." if authors else ""
+        message = "The %s encountered the following flaky tests while processing attachment %s:\n\n%s\n\nPlease file bugs against the tests.%s  The commit-queue is continuing to process your patch." % (self.name, patch.id(), "\n".join(flaky_tests), cc_explaination)
+        self._tool.bugs.post_comment_to_bug(patch.bug_id(), message, cc=authors)
 
     # StepSequenceErrorHandler methods
 
@@ -278,6 +327,7 @@ class CommitQueue(AbstractPatchQueue, StepSequenceErrorHandler):
         raise TryAgain()
 
 
+# FIXME: All the Rietveld code is no longer used and should be deleted.
 class RietveldUploadQueue(AbstractPatchQueue, StepSequenceErrorHandler):
     name = "rietveld-upload-queue"
 
@@ -323,40 +373,27 @@ class RietveldUploadQueue(AbstractPatchQueue, StepSequenceErrorHandler):
         cls._reject_patch(tool, state["patch"].id())
 
 
-class AbstractReviewQueue(AbstractPatchQueue, PersistentPatchCollectionDelegate, StepSequenceErrorHandler):
+class AbstractReviewQueue(AbstractPatchQueue, StepSequenceErrorHandler):
+    """This is the base-class for the EWS queues and the style-queue."""
     def __init__(self, options=None):
         AbstractPatchQueue.__init__(self, options)
 
     def review_patch(self, patch):
-        raise NotImplementedError, "subclasses must implement"
-
-    # PersistentPatchCollectionDelegate methods
-
-    def collection_name(self):
-        return self.name
-
-    def fetch_potential_patch_ids(self):
-        return self._tool.bugs.queries.fetch_attachment_ids_from_review_queue()
-
-    def status_server(self):
-        return self._tool.status_server
-
-    def is_terminal_status(self, status):
-        return status == "Pass" or status == "Fail" or status.startswith("Error:")
+        raise NotImplementedError("subclasses must implement")
 
     # AbstractPatchQueue methods
 
     def begin_work_queue(self):
         AbstractPatchQueue.begin_work_queue(self)
-        self._patches = PersistentPatchCollection(self)
 
     def next_work_item(self):
-        patch_id = self._patches.next()
-        if patch_id:
-            return self._tool.bugs.fetch_attachment(patch_id)
+        patch_id = self._fetch_next_work_item()
+        if not patch_id:
+            return None
+        return self._tool.bugs.fetch_attachment(patch_id)
 
     def should_proceed_with_work_item(self, patch):
-        raise NotImplementedError, "subclasses must implement"
+        raise NotImplementedError("subclasses must implement")
 
     def process_work_item(self, patch):
         try:
@@ -368,6 +405,8 @@ class AbstractReviewQueue(AbstractPatchQueue, PersistentPatchCollectionDelegate,
             if e.exit_code != QueueEngine.handled_error_code:
                 self._did_fail(patch)
             raise e
+        finally:
+            self._release_work_item(patch)
 
     def handle_unexpected_error(self, patch, message):
         log(message)
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/queues_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/queues_unittest.py
index 029814e..b37b5dc 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/queues_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/queues_unittest.py
@@ -60,24 +60,31 @@ class AbstractQueueTest(CommandsTest):
     def test_log_directory(self):
         self.assertEquals(TestQueue()._log_directory(), "test-queue-logs")
 
-    def _assert_run_webkit_patch(self, run_args):
+    def _assert_run_webkit_patch(self, run_args, port=None):
         queue = TestQueue()
         tool = MockTool()
+        tool.status_server.bot_id = "gort"
         tool.executive = Mock()
         queue.bind_to_tool(tool)
+        queue._options = Mock()
+        queue._options.port = port
 
         queue.run_webkit_patch(run_args)
-        expected_run_args = ["echo", "--status-host=example.com"] + run_args
+        expected_run_args = ["echo", "--status-host=example.com", "--bot-id=gort"]
+        if port:
+            expected_run_args.append("--port=%s" % port)
+        expected_run_args.extend(run_args)
         tool.executive.run_and_throw_if_fail.assert_called_with(expected_run_args)
 
     def test_run_webkit_patch(self):
         self._assert_run_webkit_patch([1])
         self._assert_run_webkit_patch(["one", 2])
+        self._assert_run_webkit_patch([1], port="mockport")
 
     def test_iteration_count(self):
         queue = TestQueue()
-        queue.options = Mock()
-        queue.options.iterations = 3
+        queue._options = Mock()
+        queue._options.iterations = 3
         self.assertTrue(queue.should_continue_work_queue())
         self.assertTrue(queue.should_continue_work_queue())
         self.assertTrue(queue.should_continue_work_queue())
@@ -85,7 +92,7 @@ class AbstractQueueTest(CommandsTest):
 
     def test_no_iteration_count(self):
         queue = TestQueue()
-        queue.options = Mock()
+        queue._options = Mock()
         self.assertTrue(queue.should_continue_work_queue())
         self.assertTrue(queue.should_continue_work_queue())
         self.assertTrue(queue.should_continue_work_queue())
@@ -128,6 +135,8 @@ MOCK setting flag 'commit-queue' to '-' on attachment '128' with comment 'Reject
 - If you have committer rights please correct the error in WebKitTools/Scripts/webkitpy/common/config/committers.py by adding yourself to the file (no review needed).  The commit-queue restarts itself every 2 hours.  After restart the commit-queue will correctly respect your committer rights.'
 MOCK: update_work_items: commit-queue [106, 197]
 Feeding commit-queue items [106, 197]
+Feeding EWS (1 r? patch, 1 new)
+MOCK: submit_to_ews: 103
 """,
             "handle_unexpected_error": "Mock error message\n",
         }
@@ -139,25 +148,13 @@ class AbstractPatchQueueTest(CommandsTest):
         queue = AbstractPatchQueue()
         tool = MockTool()
         queue.bind_to_tool(tool)
+        queue._options = Mock()
+        queue._options.port = None
         self.assertEquals(queue._fetch_next_work_item(), None)
         tool.status_server = MockStatusServer(work_items=[2, 1, 3])
         self.assertEquals(queue._fetch_next_work_item(), 2)
 
 
-class AbstractReviewQueueTest(CommandsTest):
-    def test_patch_collection_delegate_methods(self):
-        queue = TestReviewQueue()
-        tool = MockTool()
-        queue.bind_to_tool(tool)
-        self.assertEquals(queue.collection_name(), "test-review-queue")
-        self.assertEquals(queue.fetch_potential_patch_ids(), [103])
-        queue.status_server()
-        self.assertTrue(queue.is_terminal_status("Pass"))
-        self.assertTrue(queue.is_terminal_status("Fail"))
-        self.assertTrue(queue.is_terminal_status("Error: Your patch exploded"))
-        self.assertFalse(queue.is_terminal_status("Foo"))
-
-
 class NeedsUpdateSequence(StepSequence):
     def _run(self, tool, options, state):
         raise CheckoutNeedsUpdate([], 1, "", None)
@@ -172,7 +169,20 @@ class AlwaysCommitQueueTool(object):
 
 
 class SecondThoughtsCommitQueue(CommitQueue):
-    def _build_and_test_patch(self, patch, first_run=True):
+    def __init__(self):
+        self._reject_patch = False
+        CommitQueue.__init__(self)
+
+    def run_command(self, command):
+        # We want to reject the patch after the first validation,
+        # so wait to reject it until after some other command has run.
+        self._reject_patch = True
+        return CommitQueue.run_command(self, command)
+
+    def refetch_patch(self, patch):
+        if not self._reject_patch:
+            return self._tool.bugs.fetch_attachment(patch.id())
+
         attachment_dictionary = {
             "id": patch.id(),
             "bug_id": patch.bug_id(),
@@ -185,9 +195,7 @@ class SecondThoughtsCommitQueue(CommitQueue):
             "committer_email": "foo@bar.com",
             "attacher_email": "Contributer1",
         }
-        patch = Attachment(attachment_dictionary, None)
-        self._tool.bugs.set_override_patch(patch)
-        return True
+        return Attachment(attachment_dictionary, None)
 
 
 class CommitQueueTest(QueuesTest):
@@ -215,6 +223,7 @@ MOCK: update_status: commit-queue Pass
             "process_work_item": """MOCK: update_status: commit-queue Patch does not apply
 MOCK setting flag 'commit-queue' to '-' on attachment '197' with comment 'Rejecting patch 197 from commit-queue.' and additional comment 'MOCK script error'
 MOCK: update_status: commit-queue Fail
+MOCK: release_work_item: commit-queue 197
 """,
             "handle_unexpected_error": "MOCK setting flag 'commit-queue' to '-' on attachment '197' with comment 'Rejecting patch 197 from commit-queue.' and additional comment 'Mock error message'\n",
             "handle_script_error": "ScriptError error message\n",
@@ -236,7 +245,7 @@ MOCK: update_status: commit-queue Fail
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 MOCK: update_status: commit-queue Applied patch
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 MOCK: update_status: commit-queue Built patch
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 MOCK: update_status: commit-queue Passed tests
@@ -259,7 +268,7 @@ MOCK: update_status: commit-queue Pass
             "next_work_item": "",
             "process_work_item": """MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'apply-attachment', '--force-clean', '--non-interactive', '--quiet', 197]
 MOCK: update_status: commit-queue Applied patch
-MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build', '--no-clean', '--no-update', '--build', '--build-style=both', '--quiet']
+MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build', '--no-clean', '--no-update', '--build-style=both', '--quiet']
 MOCK: update_status: commit-queue Built patch
 MOCK run_and_throw_if_fail: ['echo', '--status-host=example.com', 'build-and-test', '--no-clean', '--no-update', '--test', '--quiet', '--non-interactive']
 MOCK: update_status: commit-queue Passed tests
@@ -290,14 +299,39 @@ MOCK: update_status: commit-queue Pass
     def test_manual_reject_during_processing(self):
         queue = SecondThoughtsCommitQueue()
         queue.bind_to_tool(MockTool())
+        queue._options = Mock()
+        queue._options.port = None
         expected_stderr = """MOCK: update_status: commit-queue Applied patch
 MOCK: update_status: commit-queue Built patch
 MOCK: update_status: commit-queue Passed tests
-MOCK: update_status: commit-queue Landed patch
-MOCK: update_status: commit-queue Pass
+MOCK: update_status: commit-queue Retry
+MOCK: release_work_item: commit-queue 197
 """
         OutputCapture().assert_outputs(self, queue.process_work_item, [MockPatch()], expected_stderr=expected_stderr)
 
+    def test_report_flaky_tests(self):
+        queue = CommitQueue()
+        queue.bind_to_tool(MockTool())
+        expected_stderr = """MOCK bug comment: bug_id=142, cc=['abarth@webkit.org']
+--- Begin comment ---
+The commit-queue encountered the following flaky tests while processing attachment 197:
+
+foo/bar.html
+bar/baz.html
+
+Please file bugs against the tests.  The author(s) of the test(s) have been CCed on this bug.  The commit-queue is continuing to process your patch.
+--- End comment ---
+
+"""
+        OutputCapture().assert_outputs(self, queue.report_flaky_tests, [MockPatch(), ["foo/bar.html", "bar/baz.html"]], expected_stderr=expected_stderr)
+
+    def test_layout_test_results(self):
+        queue = CommitQueue()
+        queue.bind_to_tool(MockTool())
+        queue._read_file_contents = lambda path: None
+        self.assertEquals(queue.layout_test_results(), None)
+        queue._read_file_contents = lambda path: ""
+        self.assertEquals(queue.layout_test_results(), None)
 
 class RietveldUploadQueueTest(QueuesTest):
     def test_rietveld_upload_queue(self):
@@ -315,11 +349,11 @@ class StyleQueueTest(QueuesTest):
     def test_style_queue(self):
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("style-queue", MockSCM.fake_checkout_root),
-            "next_work_item": "MOCK: update_work_items: style-queue [103]\n",
+            "next_work_item": "",
             "should_proceed_with_work_item": "MOCK: update_status: style-queue Checking style\n",
-            "process_work_item": "MOCK: update_status: style-queue Pass\n",
+            "process_work_item": "MOCK: update_status: style-queue Pass\nMOCK: release_work_item: style-queue 197\n",
             "handle_unexpected_error": "Mock error message\n",
-            "handle_script_error": "MOCK: update_status: style-queue ScriptError error message\nMOCK bug comment: bug_id=142, cc=[]\n--- Begin comment ---\\Attachment 197 did not pass style-queue:\n\nScriptError error message\n\nIf any of these errors are false positives, please file a bug against check-webkit-style.\n--- End comment ---\n\n",
+            "handle_script_error": "MOCK: update_status: style-queue ScriptError error message\nMOCK bug comment: bug_id=142, cc=[]\n--- Begin comment ---\nAttachment 197 did not pass style-queue:\n\nScriptError error message\n\nIf any of these errors are false positives, please file a bug against check-webkit-style.\n--- End comment ---\n\n",
         }
         expected_exceptions = {
             "handle_script_error": SystemExit,
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/queuestest.py b/WebKitTools/Scripts/webkitpy/tool/commands/queuestest.py
index 9f3583d..379d380 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/queuestest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/queuestest.py
@@ -80,13 +80,18 @@ class QueuesTest(unittest.TestCase):
         string_replacements = {"name": name, 'checkout_dir': checkout_dir}
         return "CAUTION: %(name)s will discard all local changes in \"%(checkout_dir)s\"\nRunning WebKit %(name)s.\nMOCK: update_status: %(name)s Starting Queue\n" % string_replacements
 
-    def assert_queue_outputs(self, queue, args=None, work_item=None, expected_stdout=None, expected_stderr=None, expected_exceptions=None, options=Mock(), tool=MockTool()):
+    def assert_queue_outputs(self, queue, args=None, work_item=None, expected_stdout=None, expected_stderr=None, expected_exceptions=None, options=None, tool=None):
+        if not tool:
+            tool = MockTool()
         if not expected_stdout:
             expected_stdout = {}
         if not expected_stderr:
             expected_stderr = {}
         if not args:
             args = []
+        if not options:
+            options = Mock()
+            options.port = None
         if not work_item:
             work_item = self.mock_work_item
         tool.user.prompt = lambda message: "yes"
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot.py b/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot.py
index 23d013d..145f485 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot.py
@@ -54,77 +54,47 @@ class SheriffBot(AbstractQueue, StepSequenceErrorHandler):
         self._irc_bot = SheriffIRCBot(self._tool, self._sheriff)
         self._tool.ensure_irc_connected(self._irc_bot.irc_delegate())
 
-    def work_item_log_path(self, new_failures):
-        return os.path.join("%s-logs" % self.name, "%s.log" % new_failures.keys()[0])
-
-    def _new_failures(self, revisions_causing_failures, old_failing_svn_revisions):
-        # We ignore failures that might have been caused by svn_revisions that
-        # we've already complained about.  This is conservative in the sense
-        # that we might be ignoring some new failures, but our experience has
-        # been that skipping this check causes a lot of spam for builders that
-        # take a long time to cycle.
-        old_failing_builder_names = []
-        for svn_revision in old_failing_svn_revisions:
-            old_failing_builder_names.extend(
-                [builder.name() for builder in revisions_causing_failures[svn_revision]])
-
-        new_failures = {}
-        for svn_revision, builders in revisions_causing_failures.items():
-            if svn_revision in old_failing_svn_revisions:
-                # FIXME: We should re-process the work item after some time delay.
-                # https://bugs.webkit.org/show_bug.cgi?id=36581
-                continue
-            new_builders = [builder for builder in builders
-                            if builder.name() not in old_failing_builder_names]
-            if new_builders:
-                new_failures[svn_revision] = new_builders
-
-        return new_failures
+    def work_item_log_path(self, failure_map):
+        return None
+
+    def _is_old_failure(self, revision):
+        return self._tool.status_server.svn_revision(revision)
 
     def next_work_item(self):
         self._irc_bot.process_pending_messages()
         self._update()
 
-        # We do one read from buildbot to ensure a consistent view.
-        revisions_causing_failures = self._tool.buildbot.failure_map().revisions_causing_failures()
-
-        # Similarly, we read once from our the status_server.
-        old_failing_svn_revisions = []
-        for svn_revision in revisions_causing_failures.keys():
-            if self._tool.status_server.svn_revision(svn_revision):
-                old_failing_svn_revisions.append(svn_revision)
+        # FIXME: We need to figure out how to provoke_flaky_builders.
 
-        new_failures = self._new_failures(revisions_causing_failures,
-                                          old_failing_svn_revisions)
+        failure_map = self._tool.buildbot.failure_map()
+        failure_map.filter_out_old_failures(self._is_old_failure)
+        if failure_map.is_empty():
+            return None
+        return failure_map
 
-        self._sheriff.provoke_flaky_builders(revisions_causing_failures)
-        return new_failures
-
-    def should_proceed_with_work_item(self, new_failures):
+    def should_proceed_with_work_item(self, failure_map):
         # Currently, we don't have any reasons not to proceed with work items.
         return True
 
-    def process_work_item(self, new_failures):
-        blame_list = new_failures.keys()
-        for svn_revision, builders in new_failures.items():
+    def process_work_item(self, failure_map):
+        failing_revisions = failure_map.failing_revisions()
+        for revision in failing_revisions:
+            builders = failure_map.builders_failing_for(revision)
+            tests = failure_map.tests_failing_for(revision)
             try:
-                commit_info = self._tool.checkout().commit_info_for_revision(svn_revision)
+                commit_info = self._tool.checkout().commit_info_for_revision(revision)
                 if not commit_info:
                     print "FAILED to fetch CommitInfo for r%s, likely missing ChangeLog" % revision
                     continue
                 self._sheriff.post_irc_warning(commit_info, builders)
-                self._sheriff.post_blame_comment_on_bug(commit_info,
-                                                        builders,
-                                                        blame_list)
-                self._sheriff.post_automatic_rollout_patch(commit_info,
-                                                           builders)
+                self._sheriff.post_blame_comment_on_bug(commit_info, builders, tests)
+
             finally:
                 for builder in builders:
-                    self._tool.status_server.update_svn_revision(svn_revision,
-                                                                builder.name())
+                    self._tool.status_server.update_svn_revision(revision, builder.name())
         return True
 
-    def handle_unexpected_error(self, new_failures, message):
+    def handle_unexpected_error(self, failure_map, message):
         log(message)
 
     # StepSequenceErrorHandler methods
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
index a63ec24..32eb016 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/sheriffbot_unittest.py
@@ -30,7 +30,7 @@ import os
 
 from webkitpy.tool.commands.queuestest import QueuesTest
 from webkitpy.tool.commands.sheriffbot import SheriffBot
-from webkitpy.tool.mocktool import MockBuilder
+from webkitpy.tool.mocktool import *
 
 
 class SheriffBotTest(QueuesTest):
@@ -38,36 +38,19 @@ class SheriffBotTest(QueuesTest):
     builder2 = MockBuilder("Builder2")
 
     def test_sheriff_bot(self):
-        mock_work_item = {
-            29837: [self.builder1],
-        }
+        mock_work_item = MockFailureMap(MockTool().buildbot)
         expected_stderr = {
             "begin_work_queue": self._default_begin_work_queue_stderr("sheriff-bot", os.getcwd()),
             "next_work_item": "",
-            "process_work_item": "MOCK: irc.post: abarth, darin, eseidel: http://trac.webkit.org/changeset/29837 might have broken Builder1\nMOCK bug comment: bug_id=42, cc=['abarth@webkit.org', 'eric@webkit.org']\n--- Begin comment ---\\http://trac.webkit.org/changeset/29837 might have broken Builder1\n--- End comment ---\n\n",
+            "process_work_item": """MOCK: irc.post: abarth, darin, eseidel: http://trac.webkit.org/changeset/29837 might have broken Builder1
+MOCK bug comment: bug_id=42, cc=['abarth@webkit.org', 'eric@webkit.org']
+--- Begin comment ---
+http://trac.webkit.org/changeset/29837 might have broken Builder1
+The following tests are not passing:
+mock-test-1
+--- End comment ---
+
+""",
             "handle_unexpected_error": "Mock error message\n"
         }
         self.assert_queue_outputs(SheriffBot(), work_item=mock_work_item, expected_stderr=expected_stderr)
-
-    revisions_causing_failures = {
-        1234: [builder1],
-        1235: [builder1, builder2],
-    }
-
-    def test_new_failures(self):
-        old_failing_svn_revisions = []
-        self.assertEquals(SheriffBot()._new_failures(self.revisions_causing_failures,
-                                                     old_failing_svn_revisions),
-                          self.revisions_causing_failures)
-
-    def test_new_failures_with_old_revisions(self):
-        old_failing_svn_revisions = [1234]
-        self.assertEquals(SheriffBot()._new_failures(self.revisions_causing_failures,
-                                                     old_failing_svn_revisions),
-                          {1235: [builder2]})
-
-    def test_new_failures_with_old_revisions(self):
-        old_failing_svn_revisions = [1235]
-        self.assertEquals(SheriffBot()._new_failures(self.revisions_causing_failures,
-                                                     old_failing_svn_revisions),
-                          {})
diff --git a/WebKitTools/Scripts/webkitpy/tool/commands/upload_unittest.py b/WebKitTools/Scripts/webkitpy/tool/commands/upload_unittest.py
index 5f3f400..0d096b6 100644
--- a/WebKitTools/Scripts/webkitpy/tool/commands/upload_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/commands/upload_unittest.py
@@ -52,11 +52,12 @@ class UploadCommandsTest(CommandsTest):
 
     def test_post(self):
         options = MockOptions()
+        options.cc = None
+        options.check_style = True
+        options.comment = None
         options.description = "MOCK description"
         options.request_commit = False
         options.review = True
-        options.comment = None
-        options.cc = None
         expected_stderr = """Running check-webkit-style
 MOCK: user.open_url: file://...
 Obsoleting 2 old patches on bug 42
@@ -81,11 +82,12 @@ MOCK: user.open_url: http://example.com/42
 
     def test_upload(self):
         options = MockOptions()
+        options.cc = None
+        options.check_style = True
+        options.comment = None
         options.description = "MOCK description"
         options.request_commit = False
         options.review = True
-        options.comment = None
-        options.cc = None
         expected_stderr = """Running check-webkit-style
 MOCK: user.open_url: file://...
 Obsoleting 2 old patches on bug 42
@@ -103,7 +105,7 @@ MOCK: user.open_url: http://example.com/42
         options = Mock()
         options.bug_id = 42
         options.comment = "MOCK comment"
-        expected_stderr = "Bug: <http://example.com/42> Bug with two r+'d and cq+'d patches, one of which has an invalid commit-queue setter.\nRevision: 9876\nMOCK: user.open_url: http://example.com/42\nAdding comment to Bug 42.\nMOCK bug comment: bug_id=42, cc=None\n--- Begin comment ---\\MOCK comment\n\nCommitted r9876: <http://trac.webkit.org/changeset/9876>\n--- End comment ---\n\n"
+        expected_stderr = "Bug: <http://example.com/42> Bug with two r+'d and cq+'d patches, one of which has an invalid commit-queue setter.\nRevision: 9876\nMOCK: user.open_url: http://example.com/42\nAdding comment to Bug 42.\nMOCK bug comment: bug_id=42, cc=None\n--- Begin comment ---\nMOCK comment\n\nCommitted r9876: <http://trac.webkit.org/changeset/9876>\n--- End comment ---\n\n"
         self.assert_execute_outputs(MarkBugFixed(), [], expected_stderr=expected_stderr, tool=tool, options=options)
 
     def test_edit_changelog(self):
diff --git a/WebKitTools/Scripts/webkitpy/tool/main.py b/WebKitTools/Scripts/webkitpy/tool/main.py
index 9531b63..ce6666e 100755
--- a/WebKitTools/Scripts/webkitpy/tool/main.py
+++ b/WebKitTools/Scripts/webkitpy/tool/main.py
@@ -34,6 +34,7 @@ import threading
 
 from webkitpy.common.checkout.api import Checkout
 from webkitpy.common.checkout.scm import default_scm
+from webkitpy.common.config.ports import WebKitPort
 from webkitpy.common.net.bugzilla import Bugzilla
 from webkitpy.common.net.buildbot import BuildBot
 from webkitpy.common.net.rietveld import Rietveld
@@ -52,15 +53,16 @@ from webkitpy.tool.commands.queues import *
 from webkitpy.tool.commands.sheriffbot import *
 from webkitpy.tool.commands.upload import *
 from webkitpy.tool.multicommandtool import MultiCommandTool
-from webkitpy.common.system.deprecated_logging import log
 
 
 class WebKitPatch(MultiCommandTool):
     global_options = [
         make_option("-v", "--verbose", action="store_true", dest="verbose", default=False, help="enable all logging"),
         make_option("--dry-run", action="store_true", dest="dry_run", default=False, help="do not touch remote servers"),
-        make_option("--status-host", action="store", dest="status_host", type="string", nargs=1, help="Hostname (e.g. localhost or commit.webkit.org) where status updates should be posted."),
-        make_option("--irc-password", action="store", dest="irc_password", type="string", nargs=1, help="Password to use when communicating via IRC."),
+        make_option("--status-host", action="store", dest="status_host", type="string", help="Hostname (e.g. localhost or commit.webkit.org) where status updates should be posted."),
+        make_option("--bot-id", action="store", dest="bot_id", type="string", help="Identifier for this bot (if multiple bots are running for a queue)"),
+        make_option("--irc-password", action="store", dest="irc_password", type="string", help="Password to use when communicating via IRC."),
+        make_option("--port", action="store", dest="port", default=None, help="Specify a port (e.g., mac, qt, gtk, ...)."),
     ]
 
     def __init__(self, path):
@@ -72,6 +74,7 @@ class WebKitPatch(MultiCommandTool):
         self.buildbot = BuildBot()
         self.executive = Executive()
         self._irc = None
+        self._port = None
         self.user = User()
         self._scm = None
         self._checkout = None
@@ -90,6 +93,9 @@ class WebKitPatch(MultiCommandTool):
             self._checkout = Checkout(self.scm())
         return self._checkout
 
+    def port(self):
+        return self._port
+
     def ensure_irc_connected(self, irc_delegate):
         if not self._irc:
             self._irc = IRCProxy(irc_delegate)
@@ -123,8 +129,12 @@ class WebKitPatch(MultiCommandTool):
             self.codereview.dryrun = True
         if options.status_host:
             self.status_server.set_host(options.status_host)
+        if options.bot_id:
+            self.status_server.set_bot_id(options.bot_id)
         if options.irc_password:
             self.irc_password = options.irc_password
+        # If options.port is None, we'll get the default port for this platform.
+        self._port = WebKitPort.port(options.port)
 
     def should_execute_command(self, command):
         if command.requires_local_commits and not self.scm().supports_local_commits():
diff --git a/WebKitTools/Scripts/webkitpy/tool/mocktool.py b/WebKitTools/Scripts/webkitpy/tool/mocktool.py
index 277bd08..05b30dd 100644
--- a/WebKitTools/Scripts/webkitpy/tool/mocktool.py
+++ b/WebKitTools/Scripts/webkitpy/tool/mocktool.py
@@ -317,7 +317,7 @@ class MockBugzilla(Mock):
             flag_name, flag_value, attachment_id, comment_text, additional_comment_text))
 
     def post_comment_to_bug(self, bug_id, comment_text, cc=None):
-        log("MOCK bug comment: bug_id=%s, cc=%s\n--- Begin comment ---\%s\n--- End comment ---\n" % (
+        log("MOCK bug comment: bug_id=%s, cc=%s\n--- Begin comment ---\n%s\n--- End comment ---\n" % (
             bug_id, cc, comment_text))
 
     def add_patch_to_bug(self,
@@ -350,14 +350,24 @@ class MockBuilder(object):
             self._name, username, comments))
 
 
-class MockFailureMap():
+class MockFailureMap(object):
     def __init__(self, buildbot):
         self._buildbot = buildbot
 
-    def revisions_causing_failures(self):
-        return {
-            "29837": [self._buildbot.builder_with_name("Builder1")],
-        }
+    def is_empty(self):
+        return False
+
+    def filter_out_old_failures(self, is_old_revision):
+        pass
+
+    def failing_revisions(self):
+        return [29837]
+
+    def builders_failing_for(self, revision):
+        return [self._buildbot.builder_with_name("Builder1")]
+
+    def tests_failing_for(self, revision):
+        return ["mock-test-1"]
 
 
 class MockBuildBot(object):
@@ -419,7 +429,7 @@ class MockSCM(Mock):
         # will actually be the root.  Since getcwd() is wrong, use a globally fake root for now.
         self.checkout_root = self.fake_checkout_root
 
-    def create_patch(self, git_commit):
+    def create_patch(self, git_commit, changed_files=None):
         return "Patch1"
 
     def commit_ids_from_commitish_arguments(self, args):
@@ -447,6 +457,9 @@ class MockCheckout(object):
     _committer_list = CommitterList()
 
     def commit_info_for_revision(self, svn_revision):
+        # The real Checkout would probably throw an exception, but this is the only way tests have to get None back at the moment.
+        if not svn_revision:
+            return None
         return CommitInfo(svn_revision, "eric@webkit.org", {
             "bug_id": 42,
             "author_name": "Adam Barth",
@@ -459,7 +472,10 @@ class MockCheckout(object):
     def bug_id_for_revision(self, svn_revision):
         return 12345
 
-    def modified_changelogs(self, git_commit):
+    def recent_commit_infos_for_files(self, paths):
+        return [self.commit_info_for_revision(32)]
+
+    def modified_changelogs(self, git_commit, changed_files=None):
         # Ideally we'd return something more interesting here.  The problem is
         # that LandDiff will try to actually read the patch from disk!
         return []
@@ -515,8 +531,9 @@ class MockIRC(object):
 
 class MockStatusServer(object):
 
-    def __init__(self, work_items=None):
+    def __init__(self, bot_id=None, work_items=None):
         self.host = "example.com"
+        self.bot_id = bot_id
         self._work_items = work_items or []
 
     def patch_status(self, queue_name, patch_id):
@@ -530,10 +547,16 @@ class MockStatusServer(object):
             return None
         return self._work_items[0]
 
+    def release_work_item(self, queue_name, patch):
+        log("MOCK: release_work_item: %s %s" % (queue_name, patch.id()))
+
     def update_work_items(self, queue_name, work_items):
         self._work_items = work_items
         log("MOCK: update_work_items: %s %s" % (queue_name, work_items))
 
+    def submit_to_ews(self, patch_id):
+        log("MOCK: submit_to_ews: %s" % (patch_id))
+
     def update_status(self, queue_name, status, patch=None, results_file=None):
         log("MOCK: update_status: %s %s" % (queue_name, status))
         return 187
@@ -567,9 +590,17 @@ class MockExecute(Mock):
         return "MOCK output of child process"
 
 
-class MockOptions(Mock):
-    no_squash = False
-    squash = False
+class MockOptions(object):
+    """Mock implementation of optparse.Values."""
+
+    def __init__(self, **kwargs):
+        # The caller can set option values using keyword arguments. We don't
+        # set any values by default because we don't know how this
+        # object will be used. Generally speaking unit tests should
+        # subclass this or provider wrapper functions that set a common
+        # set of options.
+        for key, value in kwargs.items():
+            self.__dict__[key] = value
 
 
 class MockRietveld():
@@ -630,3 +661,22 @@ class MockTool():
 
     def path(self):
         return "echo"
+
+    def port(self):
+        return Mock()
+
+
+class MockBrowser(object):
+    params = {}
+
+    def open(self, url):
+        pass
+
+    def select_form(self, name):
+        pass
+
+    def __setitem__(self, key, value):
+        self.params[key] = value
+
+    def submit(self):
+        return Mock(file)
diff --git a/WebKitTools/Scripts/webkitpy/tool/mocktool_unittest.py b/WebKitTools/Scripts/webkitpy/tool/mocktool_unittest.py
new file mode 100644
index 0000000..cceaa2e
--- /dev/null
+++ b/WebKitTools/Scripts/webkitpy/tool/mocktool_unittest.py
@@ -0,0 +1,59 @@
+# Copyright (C) 2010 Google Inc. All rights reserved.
+#
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#    * Redistributions of source code must retain the above copyright
+# notice, this list of conditions and the following disclaimer.
+#    * Redistributions in binary form must reproduce the above
+# copyright notice, this list of conditions and the following disclaimer
+# in the documentation and/or other materials provided with the
+# distribution.
+#    * Neither the name of Google Inc. nor the names of its
+# contributors may be used to endorse or promote products derived from
+# this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import unittest
+
+from mocktool import MockOptions
+
+
+class MockOptionsTest(unittest.TestCase):
+    # MockOptions() should implement the same semantics that
+    # optparse.Values does.
+
+    def test_get__set(self):
+        # Test that we can still set options after we construct the
+        # object.
+        options = MockOptions()
+        options.foo = 'bar'
+        self.assertEqual(options.foo, 'bar')
+
+    def test_get__unset(self):
+        # Test that unset options raise an exception (regular Mock
+        # objects return an object and hence are different from
+        # optparse.Values()).
+        options = MockOptions()
+        self.assertRaises(AttributeError, lambda: options.foo)
+
+    def test_kwarg__set(self):
+        # Test that keyword arguments work in the constructor.
+        options = MockOptions(foo='bar')
+        self.assertEqual(options.foo, 'bar')
+
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/abstractstep.py b/WebKitTools/Scripts/webkitpy/tool/steps/abstractstep.py
index 9ceb2cb..5525ea0 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/abstractstep.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/abstractstep.py
@@ -36,27 +36,23 @@ class AbstractStep(object):
     def __init__(self, tool, options):
         self._tool = tool
         self._options = options
-        self._port = None
 
+    # FIXME: This should use tool.port()
     def _run_script(self, script_name, args=None, quiet=False, port=WebKitPort):
         log("Running %s" % script_name)
         command = [port.script_path(script_name)]
         if args:
             command.extend(args)
-        # FIXME: This should use self.port()
         self._tool.executive.run_and_throw_if_fail(command, quiet)
 
-    # FIXME: The port should live on the tool.
-    def port(self):
-        if self._port:
-            return self._port
-        self._port = WebKitPort.port(self._options.port)
-        return self._port
+    def _changed_files(self, state):
+        return self.cached_lookup(state, "changed_files")
 
     _well_known_keys = {
-        "diff": lambda self, state: self._tool.scm().create_patch(self._options.git_commit),
-        "changelogs": lambda self, state: self._tool.checkout().modified_changelogs(self._options.git_commit),
         "bug_title": lambda self, state: self._tool.bugs.fetch_bug(state["bug_id"]).title(),
+        "changed_files": lambda self, state: self._tool.scm().changed_files(self._options.git_commit),
+        "diff": lambda self, state: self._tool.scm().create_patch(self._options.git_commit, changed_files=self._changed_files(state)),
+        "changelogs": lambda self, state: self._tool.checkout().modified_changelogs(self._options.git_commit, changed_files=self._changed_files(state)),
     }
 
     def cached_lookup(self, state, key, promise=None):
@@ -67,6 +63,11 @@ class AbstractStep(object):
         state[key] = promise(self, state)
         return state[key]
 
+    def did_modify_checkout(self, state):
+        state["diff"] = None
+        state["changelogs"] = None
+        state["changed_files"] = None
+
     @classmethod
     def options(cls):
         return [
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/build.py b/WebKitTools/Scripts/webkitpy/tool/steps/build.py
index 456db25..0990b8b 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/build.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/build.py
@@ -41,7 +41,7 @@ class Build(AbstractStep):
         ]
 
     def build(self, build_style):
-        self._tool.executive.run_and_throw_if_fail(self.port().build_webkit_command(build_style=build_style), self._options.quiet)
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().build_webkit_command(build_style=build_style), self._options.quiet)
 
     def run(self, state):
         if not self._options.build:
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/editchangelog.py b/WebKitTools/Scripts/webkitpy/tool/steps/editchangelog.py
index de9b4e4..4d9646f 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/editchangelog.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/editchangelog.py
@@ -35,3 +35,4 @@ class EditChangeLog(AbstractStep):
     def run(self, state):
         os.chdir(self._tool.scm().checkout_root)
         self._tool.user.edit_changelog(self.cached_lookup(state, "changelogs"))
+        self.did_modify_checkout(state)
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/options.py b/WebKitTools/Scripts/webkitpy/tool/steps/options.py
index 3dc1963..835fdba 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/options.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/options.py
@@ -50,7 +50,6 @@ class Options(object):
     obsolete_patches = make_option("--no-obsolete", action="store_false", dest="obsolete_patches", default=True, help="Do not obsolete old patches before posting this one.")
     open_bug = make_option("--open-bug", action="store_true", dest="open_bug", default=False, help="Opens the associated bug in a browser.")
     parent_command = make_option("--parent-command", action="store", dest="parent_command", default=None, help="(Internal) The command that spawned this instance.")
-    port = make_option("--port", action="store", dest="port", default=None, help="Specify a port (e.g., mac, qt, gtk, ...).")
     quiet = make_option("--quiet", action="store_true", dest="quiet", default=False, help="Produce less console output.")
     request_commit = make_option("--request-commit", action="store_true", dest="request_commit", default=False, help="Mark the patch as needing auto-commit after review.")
     review = make_option("--no-review", action="store_false", dest="review", default=True, help="Do not mark the patch for review.")
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/preparechangelog.py b/WebKitTools/Scripts/webkitpy/tool/steps/preparechangelog.py
index ce04024..099dfe3 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/preparechangelog.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/preparechangelog.py
@@ -39,7 +39,6 @@ class PrepareChangeLog(AbstractStep):
     @classmethod
     def options(cls):
         return AbstractStep.options() + [
-            Options.port,
             Options.quiet,
             Options.email,
             Options.git_commit,
@@ -62,7 +61,7 @@ class PrepareChangeLog(AbstractStep):
             self._ensure_bug_url(state)
             return
         os.chdir(self._tool.scm().checkout_root)
-        args = [self.port().script_path("prepare-ChangeLog")]
+        args = [self._tool.port().script_path("prepare-ChangeLog")]
         if state.get("bug_id"):
             args.append("--bug=%s" % state["bug_id"])
         if self._options.email:
@@ -75,4 +74,4 @@ class PrepareChangeLog(AbstractStep):
             self._tool.executive.run_and_throw_if_fail(args, self._options.quiet)
         except ScriptError, e:
             error("Unable to prepare ChangeLogs.")
-        state["diff"] = None # We've changed the diff
+        self.did_modify_checkout(state)
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/runtests.py b/WebKitTools/Scripts/webkitpy/tool/steps/runtests.py
index aff1fd9..dcbfc44 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/runtests.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/runtests.py
@@ -37,7 +37,6 @@ class RunTests(AbstractStep):
             Options.test,
             Options.non_interactive,
             Options.quiet,
-            Options.port,
         ]
 
     def run(self, state):
@@ -46,14 +45,17 @@ class RunTests(AbstractStep):
 
         # Run the scripting unit tests first because they're quickest.
         log("Running Python unit tests")
-        self._tool.executive.run_and_throw_if_fail(self.port().run_python_unittests_command())
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().run_python_unittests_command())
         log("Running Perl unit tests")
-        self._tool.executive.run_and_throw_if_fail(self.port().run_perl_unittests_command())
-        log("Running JavaScriptCore tests")
-        self._tool.executive.run_and_throw_if_fail(self.port().run_javascriptcore_tests_command(), quiet=True)
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().run_perl_unittests_command())
+
+        javascriptcore_tests_command = self._tool.port().run_javascriptcore_tests_command()
+        if javascriptcore_tests_command:
+            log("Running JavaScriptCore tests")
+            self._tool.executive.run_and_throw_if_fail(javascriptcore_tests_command, quiet=True)
 
         log("Running run-webkit-tests")
-        args = self.port().run_webkit_tests_command()
+        args = self._tool.port().run_webkit_tests_command()
         if self._options.non_interactive:
             args.append("--no-launch-safari")
             args.append("--exit-after-n-failures=1")
@@ -61,7 +63,7 @@ class RunTests(AbstractStep):
             # FIXME: Hack to work around https://bugs.webkit.org/show_bug.cgi?id=38912
             # when running the commit-queue on a mac leopard machine since compositing
             # does not work reliably on Leopard due to various graphics driver/system bugs.
-            if self.port().name() == "Mac" and self.port().is_leopard():
+            if self._tool.port().name() == "Mac" and self._tool.port().is_leopard():
                 tests_to_ignore = []
                 tests_to_ignore.append("compositing")
 
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/steps_unittest.py b/WebKitTools/Scripts/webkitpy/tool/steps/steps_unittest.py
index 15f275a..7eb8e3a 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/steps_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/steps_unittest.py
@@ -37,39 +37,49 @@ from webkitpy.tool.steps.promptforbugortitle import PromptForBugOrTitle
 
 
 class StepsTest(unittest.TestCase):
+    def _step_options(self):
+        options = MockOptions()
+        options.non_interactive = True
+        options.port = 'MOCK port'
+        options.quiet = True
+        options.test = True
+        return options
+
     def _run_step(self, step, tool=None, options=None, state=None):
         if not tool:
             tool = MockTool()
         if not options:
-            options = MockOptions()
+            options = self._step_options()
         if not state:
             state = {}
         step(tool, options).run(state)
 
     def test_update_step(self):
-        options = MockOptions()
+        tool = MockTool()
+        options = self._step_options()
         options.update = True
         expected_stderr = "Updating working directory\n"
-        OutputCapture().assert_outputs(self, self._run_step, [Update, options], expected_stderr=expected_stderr)
+        OutputCapture().assert_outputs(self, self._run_step, [Update, tool, options], expected_stderr=expected_stderr)
 
     def test_prompt_for_bug_or_title_step(self):
         tool = MockTool()
         tool.user.prompt = lambda message: 42
         self._run_step(PromptForBugOrTitle, tool=tool)
 
-    def test_runtests_leopard_commit_queue_hack(self):
+    def test_runtests_leopard_commit_queue_hack_step(self):
         expected_stderr = "Running Python unit tests\nRunning Perl unit tests\nRunning JavaScriptCore tests\nRunning run-webkit-tests\n"
         OutputCapture().assert_outputs(self, self._run_step, [RunTests], expected_stderr=expected_stderr)
 
-    def test_runtests_leopard_commit_queue_hack(self):
-        mock_options = MockOptions()
-        mock_options.non_interactive = True
+    def test_runtests_leopard_commit_queue_hack_command(self):
+        mock_options = self._step_options()
         step = RunTests(MockTool(log_executive=True), mock_options)
         # FIXME: We shouldn't use a real port-object here, but there is too much to mock at the moment.
         mock_port = WebKitPort()
         mock_port.name = lambda: "Mac"
         mock_port.is_leopard = lambda: True
-        step.port = lambda: mock_port
+        tool = MockTool(log_executive=True)
+        tool.port = lambda: mock_port
+        step = RunTests(tool, mock_options)
         expected_stderr = """Running Python unit tests
 MOCK run_and_throw_if_fail: ['WebKitTools/Scripts/test-webkitpy']
 Running Perl unit tests
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/update.py b/WebKitTools/Scripts/webkitpy/tool/steps/update.py
index 0f450f3..cd1d4d8 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/update.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/update.py
@@ -36,11 +36,10 @@ class Update(AbstractStep):
     def options(cls):
         return AbstractStep.options() + [
             Options.update,
-            Options.port,
         ]
 
     def run(self, state):
         if not self._options.update:
             return
         log("Updating working directory")
-        self._tool.executive.run_and_throw_if_fail(self.port().update_webkit_command(), quiet=True)
+        self._tool.executive.run_and_throw_if_fail(self._tool.port().update_webkit_command(), quiet=True)
diff --git a/WebKitTools/Scripts/webkitpy/tool/steps/updatechangelogswithreview_unittest.py b/WebKitTools/Scripts/webkitpy/tool/steps/updatechangelogswithreview_unittest.py
index a037422..b475378 100644
--- a/WebKitTools/Scripts/webkitpy/tool/steps/updatechangelogswithreview_unittest.py
+++ b/WebKitTools/Scripts/webkitpy/tool/steps/updatechangelogswithreview_unittest.py
@@ -41,5 +41,8 @@ class UpdateChangeLogsWithReviewerTest(unittest.TestCase):
 
     def test_empty_state(self):
         capture = OutputCapture()
-        step = UpdateChangeLogsWithReviewer(MockTool(), MockOptions())
+        options = MockOptions()
+        options.reviewer = 'MOCK reviewer'
+        options.git_commit = 'MOCK git commit'
+        step = UpdateChangeLogsWithReviewer(MockTool(), options)
         capture.assert_outputs(self, step.run, [{}])
diff --git a/WebKitTools/TestResultServer/handlers/dashboardhandler.py b/WebKitTools/TestResultServer/handlers/dashboardhandler.py
index 587d737..c8b5ace 100644
--- a/WebKitTools/TestResultServer/handlers/dashboardhandler.py
+++ b/WebKitTools/TestResultServer/handlers/dashboardhandler.py
@@ -89,7 +89,9 @@ class UpdateDashboardFile(webapp.RequestHandler):
         if not files:
             files = ["flakiness_dashboard.html",
                      "dashboard_base.js",
-                     "aggregate_results.html"]
+                     "aggregate_results.html",
+                     "dygraph-combined.js",
+                     "timeline_explorer.html"]
 
         errors = []
         for file in files:
diff --git a/WebKitTools/TestWebKitAPI/Configurations/Base.xcconfig b/WebKitTools/TestWebKitAPI/Configurations/Base.xcconfig
new file mode 100644
index 0000000..feabe9a
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/Base.xcconfig
@@ -0,0 +1,71 @@
+// Copyright (C) 2010 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+HEADER_SEARCH_PATHS = $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders;
+FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
+GCC_PREPROCESSOR_DEFINITIONS = ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST;
+DEBUG_INFORMATION_FORMAT = dwarf
+PREBINDING = NO
+GCC_C_LANGUAGE_STANDARD = gnu99
+GCC_PRECOMPILE_PREFIX_HEADER = YES
+GCC_TREAT_WARNINGS_AS_ERRORS = YES
+GCC_WARN_UNUSED_FUNCTION = YES
+GCC_WARN_UNUSED_VARIABLE = YES
+GCC_WARN_ABOUT_DEPRECATED_FUNCTIONS = NO
+WARNING_CFLAGS = -Wall -W -Wno-unused-parameter
+LINKER_DISPLAYS_MANGLED_NAMES = YES;
+
+
+TARGET_MAC_OS_X_VERSION_MAJOR = $(MAC_OS_X_VERSION_MAJOR);
+
+
+// Use GCC 4.2 with Xcode 3.1, which includes GCC 4.2 but defaults to GCC 4.0.
+// Note that Xcode versions as new as 3.1.2 use XCODE_VERSION_ACTUAL for the minor version
+// number.  Newer versions of Xcode use XCODE_VERSION_MINOR for the minor version, and
+// XCODE_VERSION_ACTUAL for the full version number.
+TARGET_GCC_VERSION = $(TARGET_GCC_VERSION_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+TARGET_GCC_VERSION_ = $(TARGET_GCC_VERSION_1040);
+TARGET_GCC_VERSION_1040 = GCC_40;
+TARGET_GCC_VERSION_1050 = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_MINOR));
+TARGET_GCC_VERSION_1050_ = $(TARGET_GCC_VERSION_1050_$(XCODE_VERSION_ACTUAL));
+TARGET_GCC_VERSION_1050_0310 = GCC_42;
+TARGET_GCC_VERSION_1050_0320 = GCC_42;
+TARGET_GCC_VERSION_1060 = GCC_42;
+TARGET_GCC_VERSION_1070 = LLVM_GCC_42;
+
+GCC_VERSION = $(GCC_VERSION_$(TARGET_GCC_VERSION));
+GCC_VERSION_GCC_40 = 4.0;
+GCC_VERSION_GCC_42 = 4.2;
+GCC_VERSION_LLVM_GCC_42 = com.apple.compilers.llvmgcc42;
+
+// If the target Mac OS X version does not match the current Mac OS X version then we'll want to build using the target version's SDK.
+SDKROOT = $(SDKROOT_$(MAC_OS_X_VERSION_MAJOR)_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+SDKROOT_1050_1040 = macosx10.4;
+SDKROOT_1060_1040 = macosx10.4;
+SDKROOT_1060_1050 = macosx10.5;
+SDKROOT_1070_1040 = macosx10.4;
+SDKROOT_1070_1050 = macosx10.5;
+SDKROOT_1070_1060 = macosx10.6;
+
+WEBKIT_UMBRELLA_FRAMEWORKS_DIR = $(NEXT_ROOT)$(SYSTEM_LIBRARY_DIR)/Frameworks/WebKit.framework/Versions/A/Frameworks;
+WEBCORE_PRIVATE_HEADERS_DIR = $(WEBKIT_UMBRELLA_FRAMEWORKS_DIR)/WebCore.framework/PrivateHeaders;
diff --git a/WebKitTools/TestWebKitAPI/Configurations/DebugRelease.xcconfig b/WebKitTools/TestWebKitAPI/Configurations/DebugRelease.xcconfig
new file mode 100644
index 0000000..41600b1
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/DebugRelease.xcconfig
@@ -0,0 +1,42 @@
+// Copyright (C) 2010 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+#include "Base.xcconfig"
+
+ARCHS = $(ARCHS_$(TARGET_MAC_OS_X_VERSION_MAJOR));
+ARCHS_ = $(ARCHS_1040);
+ARCHS_1040 = $(NATIVE_ARCH);
+ARCHS_1050 = $(NATIVE_ARCH);
+ARCHS_1060 = $(ARCHS_STANDARD_32_64_BIT);
+ARCHS_1070 = $(ARCHS_STANDARD_32_64_BIT);
+
+ONLY_ACTIVE_ARCH = YES;
+
+MACOSX_DEPLOYMENT_TARGET = $(MACOSX_DEPLOYMENT_TARGET_$(TARGET_MAC_OS_X_VERSION_MAJOR))
+MACOSX_DEPLOYMENT_TARGET_ = 10.4;
+MACOSX_DEPLOYMENT_TARGET_1040 = 10.4;
+MACOSX_DEPLOYMENT_TARGET_1050 = 10.5;
+MACOSX_DEPLOYMENT_TARGET_1060 = 10.6;
+MACOSX_DEPLOYMENT_TARGET_1070 = 10.7;
+
+WEBKIT_UMBRELLA_FRAMEWORKS_DIR = $(BUILT_PRODUCTS_DIR);
diff --git a/WebKitTools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig b/WebKitTools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig
new file mode 100644
index 0000000..4d3d1ee
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/InjectedBundle.xcconfig
@@ -0,0 +1,24 @@
+// Copyright (C) 2010 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+PRODUCT_NAME = InjectedBundle
diff --git a/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig
new file mode 100644
index 0000000..5e69d0e
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPI.xcconfig
@@ -0,0 +1,26 @@
+// Copyright (C) 2010 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+//    notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+//    notice, this list of conditions and the following disclaimer in the
+//    documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+// IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+// PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL APPLE INC. OR
+// CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+// EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+// PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
+// PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY
+// OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
+
+PRODUCT_NAME = TestWebKitAPI
+GCC_ENABLE_OBJC_EXCEPTIONS = YES
+GCC_PREFIX_HEADER = TestWebKitAPIPrefix.h
diff --git a/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICFLite.vsprops b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICFLite.vsprops
new file mode 100644
index 0000000..61b6614
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICFLite.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="TestWebKitAPICFLite"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CFLite$(LibraryConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICommon.vsprops b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICommon.vsprops
new file mode 100644
index 0000000..1de3506
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICommon.vsprops
@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="TestWebKitAPICommon"

+	>

+	<Tool

+		Name="VCCLCompilerTool"

+		AdditionalIncludeDirectories="&quot;$(ProjectDir)&quot;;&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\include&quot;;&quot;$(WebKitOutputDir)\include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitOutputDir)\include\private&quot;;&quot;$(WebKitLibrariesDir)\include&quot;"

+		ForcedIncludeFiles="TestWebKitAPIPrefix.h"

+	/>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="WebKit$(WebKitDLLConfigSuffix).lib JavaScriptCore$(WebKitDLLConfigSuffix).lib"

+		SubSystem="1"

+	/>

+	<Tool

+		Name="VCPostBuildEventTool"

+		CommandLine="if exist &quot;$(WebKitOutputDir)\buildfailed&quot; del &quot;$(WebKitOutputDir)\buildfailed&quot;"

+	/>

+	<Tool

+		Name="VCPreBuildEventTool"

+		CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICoreFoundation.vsprops b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICoreFoundation.vsprops
new file mode 100644
index 0000000..ee139c0
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Configurations/TestWebKitAPICoreFoundation.vsprops
@@ -0,0 +1,11 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioPropertySheet

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="TestWebKitAPICoreFoundation"

+	>

+	<Tool

+		Name="VCLinkerTool"

+		AdditionalDependencies="CoreFoundation$(LibraryConfigSuffix).lib"

+	/>

+</VisualStudioPropertySheet>

diff --git a/WebKitTools/TestWebKitAPI/InjectedBundle-Info.plist b/WebKitTools/TestWebKitAPI/InjectedBundle-Info.plist
new file mode 100644
index 0000000..c285a47
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/InjectedBundle-Info.plist
@@ -0,0 +1,22 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+	<key>CFBundleDevelopmentRegion</key>
+	<string>English</string>
+	<key>CFBundleExecutable</key>
+	<string>${EXECUTABLE_NAME}</string>
+	<key>CFBundleIdentifier</key>
+	<string>com.yourcompany.${PRODUCT_NAME:rfc1034identifier}</string>
+	<key>CFBundleInfoDictionaryVersion</key>
+	<string>6.0</string>
+	<key>CFBundlePackageType</key>
+	<string>BNDL</string>
+	<key>CFBundleShortVersionString</key>
+	<string>1.0</string>
+	<key>CFBundleSignature</key>
+	<string>????</string>
+	<key>CFBundleVersion</key>
+	<string>1</string>
+</dict>
+</plist>
diff --git a/WebKitTools/TestWebKitAPI/InjectedBundleController.cpp b/WebKitTools/TestWebKitAPI/InjectedBundleController.cpp
new file mode 100644
index 0000000..dc563ac
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/InjectedBundleController.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundleController.h"
+
+#include "InjectedBundleTest.h"
+#include "PlatformUtilities.h"
+#include <WebKit2/WebKit2.h>
+#include <algorithm>
+#include <assert.h>
+
+namespace TestWebKitAPI {
+
+InjectedBundleController& InjectedBundleController::shared()
+{
+    static InjectedBundleController& shared = *new InjectedBundleController;
+    return shared;
+}
+
+InjectedBundleController::InjectedBundleController()
+    : m_bundle(0)
+    , m_currentTest(0)
+{
+}
+
+void InjectedBundleController::initialize(WKBundleRef bundle)
+{
+    m_bundle = bundle;
+
+    WKBundleClient client = {
+        0,
+        this,
+        didCreatePage,
+        willDestroyPage,
+        didReceiveMessage
+    };
+    WKBundleSetClient(m_bundle, &client);
+}
+
+void InjectedBundleController::didCreatePage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
+{
+    InjectedBundleController* self = static_cast<InjectedBundleController*>(const_cast<void*>(clientInfo));
+    assert(self->m_currentTest);
+    self->m_currentTest->didCreatePage(bundle, page);
+}
+
+void InjectedBundleController::willDestroyPage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo)
+{
+    InjectedBundleController* self = static_cast<InjectedBundleController*>(const_cast<void*>(clientInfo));
+    assert(self->m_currentTest);
+    self->m_currentTest->willDestroyPage(bundle, page);
+}
+
+void InjectedBundleController::didReceiveMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
+{
+    InjectedBundleController* self = static_cast<InjectedBundleController*>(const_cast<void*>(clientInfo));
+
+    if (WKStringIsEqualToUTF8CString(messageName, "BundleTestInstantiator")) {
+        assert(WKGetTypeID(messageBody) == WKStringGetTypeID());
+        WKStringRef messageBodyString = static_cast<WKStringRef>(messageBody);
+
+        self->initializeTestNamed(Util::toSTD(messageBodyString));
+
+        return;
+    }
+
+    assert(self->m_currentTest);
+    self->m_currentTest->didReceiveMessage(bundle, messageName, messageBody);
+}
+
+void InjectedBundleController::dumpTestNames()
+{
+    std::map<std::string, CreateInjectedBundleTestFunction>::const_iterator it = m_createInjectedBundleTestFunctions.begin();
+    std::map<std::string, CreateInjectedBundleTestFunction>::const_iterator end = m_createInjectedBundleTestFunctions.end();
+    for (; it != end; ++it)
+        printf("%s\n", (*it).first.c_str());
+}
+
+void InjectedBundleController::initializeTestNamed(const std::string& identifier)
+{
+    CreateInjectedBundleTestFunction createTestFunction = m_createInjectedBundleTestFunctions[identifier];
+    if (!createTestFunction) {
+        printf("ERROR: InjectedBundle test not found - %s\n", identifier.c_str());
+        exit(1);
+    }
+
+    m_currentTest = createTestFunction(identifier);
+    m_currentTest->initialize();
+}
+
+void InjectedBundleController::registerCreateInjectedBundleTestFunction(const std::string& identifier, CreateInjectedBundleTestFunction function)
+{
+    m_createInjectedBundleTestFunctions[identifier] = function;
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/InjectedBundleController.h b/WebKitTools/TestWebKitAPI/InjectedBundleController.h
new file mode 100644
index 0000000..89e2c5e
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/InjectedBundleController.h
@@ -0,0 +1,64 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedBundleController_h
+#define InjectedBundleController_h
+
+#include <WebKit2/WKBundle.h>
+#include <map>
+#include <string>
+
+namespace TestWebKitAPI {
+
+class InjectedBundleTest;
+
+class InjectedBundleController {
+public:
+    static InjectedBundleController& shared();
+
+    void initialize(WKBundleRef);
+
+    void dumpTestNames();
+    void initializeTestNamed(const std::string&);
+
+    typedef InjectedBundleTest* (*CreateInjectedBundleTestFunction)(const std::string&);
+    void registerCreateInjectedBundleTestFunction(const std::string&, CreateInjectedBundleTestFunction);
+
+private:
+    InjectedBundleController();
+    ~InjectedBundleController();
+
+    static void didCreatePage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo);
+    static void willDestroyPage(WKBundleRef bundle, WKBundlePageRef page, const void* clientInfo);
+    static void didReceiveMessage(WKBundleRef bundle, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo);
+
+    std::map<std::string, CreateInjectedBundleTestFunction> m_createInjectedBundleTestFunctions;
+    WKBundleRef m_bundle;
+    InjectedBundleTest* m_currentTest;
+};
+
+} // namespace TestWebKitAPI
+
+#endif // InjectedBundleController_h
diff --git a/WebKitTools/TestWebKitAPI/InjectedBundleMain.cpp b/WebKitTools/TestWebKitAPI/InjectedBundleMain.cpp
new file mode 100644
index 0000000..8f9e8ad
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/InjectedBundleMain.cpp
@@ -0,0 +1,37 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundleController.h"
+#include <WebKit2/WKBundleInitialize.h>
+
+#if defined(WIN32) || defined(_WIN32)
+extern "C" __declspec(dllexport) 
+#else
+extern "C"
+#endif
+void WKBundleInitialize(WKBundleRef bundle)
+{
+    TestWebKitAPI::InjectedBundleController::shared().initialize(bundle);
+}
diff --git a/WebKitTools/TestWebKitAPI/InjectedBundleTest.h b/WebKitTools/TestWebKitAPI/InjectedBundleTest.h
new file mode 100644
index 0000000..f3812ef
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/InjectedBundleTest.h
@@ -0,0 +1,70 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef InjectedBundleTest_h
+#define InjectedBundleTest_h
+
+#include "InjectedBundleController.h"
+
+namespace TestWebKitAPI {
+
+class InjectedBundleTest {
+public:
+    virtual ~InjectedBundleTest() { }
+
+    virtual void initialize() { }
+
+    virtual void didCreatePage(WKBundleRef, WKBundlePageRef) { }
+    virtual void willDestroyPage(WKBundleRef, WKBundlePageRef) { }
+    virtual void didReceiveMessage(WKBundleRef, WKStringRef messageName, WKTypeRef messageBody) { }
+
+    std::string name() const { return m_identifier; }
+    
+    template<typename TestClassTy> class Register {
+    public:
+        Register(const std::string& test)
+        {
+            InjectedBundleController::shared().registerCreateInjectedBundleTestFunction(test, Register::create);
+        }
+
+    private:
+        static InjectedBundleTest* create(const std::string& identifier) 
+        {
+            return new TestClassTy(identifier);
+        }
+    };
+
+protected:
+    InjectedBundleTest(const std::string& identifier)
+        : m_identifier(identifier)
+    {
+    }
+
+    std::string m_identifier;
+};
+
+} // namespace TestWebKitAPI
+
+#endif // InjectedBundleTest_h
diff --git a/WebKitTools/TestWebKitAPI/Makefile b/WebKitTools/TestWebKitAPI/Makefile
new file mode 100644
index 0000000..ed01cce
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Makefile
@@ -0,0 +1,21 @@
+# Build TestWebKitAPI only on Snow Leopard and later.
+
+OSX_VERSION ?= $(shell sw_vers -productVersion | cut -d. -f 2)
+BUILD_TESTWEBKITAPI = $(shell (( $(OSX_VERSION) >= 6 )) && echo "YES" )
+
+ifeq "$(BUILD_TESTWEBKITAPI)" "YES"
+
+SCRIPTS_PATH = ../Scripts
+include ../../Makefile.shared
+
+else
+
+all: ;
+
+debug d development dev develop: ;
+
+release r deployment dep deploy: ;
+
+clean: ;
+
+endif
diff --git a/WebKitTools/TestWebKitAPI/PlatformUtilities.cpp b/WebKitTools/TestWebKitAPI/PlatformUtilities.cpp
new file mode 100644
index 0000000..2fadf3a
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/PlatformUtilities.cpp
@@ -0,0 +1,59 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformUtilities.h"
+
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WebKit2.h>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/PassOwnArrayPtr.h>
+
+namespace TestWebKitAPI {
+namespace Util {
+
+WKContextRef createContextForInjectedBundleTest(const std::string& testName)
+{
+    WKRetainPtr<WKStringRef> injectedBundlePath(AdoptWK, createInjectedBundlePath());
+    WKContextRef context = WKContextCreateWithInjectedBundlePath(injectedBundlePath.get());
+    
+    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("BundleTestInstantiator"));
+    WKRetainPtr<WKStringRef> messageBody(AdoptWK, WKStringCreateWithUTF8CString(testName.c_str()));
+
+    // Enqueue message to instantiate the bundle test. 
+    WKContextPostMessageToInjectedBundle(context, messageName.get(), messageBody.get());
+    
+    return context;
+}
+
+std::string toSTD(WKStringRef string)
+{
+    size_t bufferSize = WKStringGetMaximumUTF8CStringSize(string);
+    OwnArrayPtr<char> buffer = adoptArrayPtr(new char[bufferSize]);
+    size_t stringLength = WKStringGetUTF8CString(string, buffer.get(), bufferSize);
+    return std::string(buffer.get(), stringLength - 1);
+}
+
+} // namespace Util
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/PlatformUtilities.h b/WebKitTools/TestWebKitAPI/PlatformUtilities.h
new file mode 100644
index 0000000..8ae347c
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/PlatformUtilities.h
@@ -0,0 +1,51 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformUtilities_h
+#define PlatformUtilities_h
+
+#include <WebKit2/WebKit2.h>
+#include <string>
+
+namespace TestWebKitAPI {
+namespace Util {
+
+// Runs a platform runloop until the 'done' is true. 
+void run(bool* done);
+
+WKContextRef createContextForInjectedBundleTest(const std::string&);
+
+WKStringRef createInjectedBundlePath();
+WKURLRef createURLForResource(const char* resource, const char* extension);
+WKURLRef URLForNonExistentResource();
+
+bool isKeyDown(WKNativeEventPtr);
+
+std::string toSTD(WKStringRef string);
+
+} // namespace Util
+} // namespace TestWebKitAPI
+
+#endif // PlatformUtilities_h
diff --git a/WebKitTools/TestWebKitAPI/PlatformWebView.h b/WebKitTools/TestWebKitAPI/PlatformWebView.h
new file mode 100644
index 0000000..7f4f057
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/PlatformWebView.h
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef PlatformWebView_h
+#define PlatformWebView_h
+
+#include <wtf/Platform.h>
+
+#ifdef __APPLE__
+#ifdef __OBJC__
+@class WKView;
+@class NSWindow;
+#else
+class WKView;
+class NSWindow;
+#endif
+typedef WKView *PlatformWKView;
+typedef NSWindow *PlatformWindow;
+#elif defined(WIN32) || defined(_WIN32)
+typedef WKViewRef PlatformWKView;
+typedef HWND PlatformWindow;
+#endif
+
+namespace TestWebKitAPI {
+
+#if PLATFORM(WIN)
+class WindowMessageObserver;
+#endif
+
+class PlatformWebView {
+public:
+    PlatformWebView(WKPageNamespaceRef);
+    ~PlatformWebView();
+
+    WKPageRef page();
+    PlatformWKView platformView() const { return m_view; }
+    void resizeTo(unsigned width, unsigned height);
+    void focus();
+
+    void simulateSpacebarKeyPress();
+    void simulateAltKeyPress();
+
+#if PLATFORM(WIN)
+    void setParentWindowMessageObserver(WindowMessageObserver* observer) { m_parentWindowMessageObserver = observer; }
+#endif
+
+private:
+#if PLATFORM(WIN)
+    static void registerWindowClass();
+    static LRESULT CALLBACK wndProc(HWND, UINT message, WPARAM, LPARAM);
+#endif
+
+    PlatformWKView m_view;
+    PlatformWindow m_window;
+
+#if PLATFORM(WIN)
+    WindowMessageObserver* m_parentWindowMessageObserver;
+#endif
+};
+
+} // namespace TestWebKitAPI
+
+#endif // PlatformWebView_h
diff --git a/WebKitTools/TestWebKitAPI/Test.h b/WebKitTools/TestWebKitAPI/Test.h
new file mode 100644
index 0000000..93bfd8b
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Test.h
@@ -0,0 +1,86 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef Test_h
+#define Test_h
+
+#include "TestsController.h"
+
+namespace TestWebKitAPI {
+
+// Abstract base class that all tests inherit from.
+class Test {
+public:
+    virtual ~Test() { }
+    
+    virtual void run() = 0;
+    std::string name() const { return m_identifier; }
+    
+    template<typename TestClassTy> class Register {
+    public:
+        Register(const std::string& testSuite, const std::string& testCase)
+        {
+            TestsController::shared().registerCreateTestFunction(testSuite + "/" + testCase, Register::create);
+        }
+    
+    private:
+        static Test* create(const std::string& identifier) 
+        {
+            return new TestClassTy(identifier);
+        }
+    };
+
+protected:
+    Test(const std::string& identifier)
+        : m_identifier(identifier)
+    {
+    }
+
+    std::string m_identifier;
+};
+
+#define TEST_CLASS_NAME(testSuite, testCaseName) testSuite##testCaseName##_Test
+#define TEST_REGISTRAR_NAME(testSuite, testCaseName) testSuite##testCaseName##_Registrar
+
+// Use this to define a new test.
+#define TEST(testSuite, testCaseName) \
+    class TEST_CLASS_NAME(testSuite, testCaseName) : public Test { \
+    public: \
+        TEST_CLASS_NAME(testSuite, testCaseName)(const std::string& identifier) \
+            : Test(identifier) \
+        { \
+        } \
+        virtual void run(); \
+    }; \
+    \
+    static Test::Register<TEST_CLASS_NAME(testSuite, testCaseName)> TEST_REGISTRAR_NAME(testSuite, testCaseName)(#testSuite, #testCaseName); \
+    \
+    void TEST_CLASS_NAME(testSuite, testCaseName)::run()
+
+#define TEST_ASSERT(expression) do { if (!(expression)) { TestsController::shared().testFailed(__FILE__, __LINE__, #expression); return; } } while (0)
+
+} // namespace TestWebKitAPI
+
+#endif // Test_h
diff --git a/WebKitTools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj b/WebKitTools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
new file mode 100644
index 0000000..fa967b7
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/TestWebKitAPI.xcodeproj/project.pbxproj
@@ -0,0 +1,473 @@
+// !$*UTF8*$!
+{
+	archiveVersion = 1;
+	classes = {
+	};
+	objectVersion = 45;
+	objects = {
+
+/* Begin PBXBuildFile section */
+		1A02C84F125D4A8400E3F4BD /* Find.cpp in Sources */ = {isa = PBXBuildFile; fileRef = 1A02C84E125D4A8400E3F4BD /* Find.cpp */; };
+		1A02C870125D4CFD00E3F4BD /* find.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = 1A02C84B125D4A5E00E3F4BD /* find.html */; };
+		BC131885117114B600B69727 /* PlatformUtilitiesMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC131884117114B600B69727 /* PlatformUtilitiesMac.mm */; };
+		BC131A9B1171316900B69727 /* main.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC131A9A1171316900B69727 /* main.mm */; };
+		BC131AA9117131FC00B69727 /* TestsController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC131AA8117131FC00B69727 /* TestsController.cpp */; };
+		BC575A90126E74D3006F0F12 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCB9E9F011235BDE00A137E0 /* Cocoa.framework */; };
+		BC575A91126E74D3006F0F12 /* WebKit2.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCA61DB411700EFD00460D1E /* WebKit2.framework */; };
+		BC575A92126E74D3006F0F12 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC90964D1255620C00083756 /* JavaScriptCore.framework */; };
+		BC575A97126E74F1006F0F12 /* InjectedBundleMain.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575946126E7351006F0F12 /* InjectedBundleMain.cpp */; };
+		BC575AA2126E7660006F0F12 /* InjectedBundleController.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575AA0126E7657006F0F12 /* InjectedBundleController.cpp */; };
+		BC575AAD126E83B9006F0F12 /* InjectedBundleBasic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575AAC126E83B9006F0F12 /* InjectedBundleBasic.cpp */; };
+		BC575AB0126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575AAF126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp */; };
+		BC575BC0126F5752006F0F12 /* PlatformUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575BBF126F5752006F0F12 /* PlatformUtilities.cpp */; };
+		BC575BD9126F58E2006F0F12 /* PlatformUtilities.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC575BBF126F5752006F0F12 /* PlatformUtilities.cpp */; };
+		BC575BE0126F590D006F0F12 /* PlatformUtilitiesMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC131884117114B600B69727 /* PlatformUtilitiesMac.mm */; };
+		BC90955D125548AA00083756 /* PlatformWebViewMac.mm in Sources */ = {isa = PBXBuildFile; fileRef = BC90955C125548AA00083756 /* PlatformWebViewMac.mm */; };
+		BC90964C125561BF00083756 /* VectorBasic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC90964B125561BF00083756 /* VectorBasic.cpp */; };
+		BC90964E1255620C00083756 /* JavaScriptCore.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BC90964D1255620C00083756 /* JavaScriptCore.framework */; };
+		BC90977A125571AB00083756 /* PageLoadBasic.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC909779125571AB00083756 /* PageLoadBasic.cpp */; };
+		BC909784125571CF00083756 /* simple.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = BC909778125571AB00083756 /* simple.html */; };
+		BC90995E12567BC100083756 /* WKString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC90995D12567BC100083756 /* WKString.cpp */; };
+		BC9099941256ACF100083756 /* WKStringJSString.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BC9099931256ACF100083756 /* WKStringJSString.cpp */; };
+		BCA61DB511700EFD00460D1E /* WebKit2.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCA61DB411700EFD00460D1E /* WebKit2.framework */; };
+		BCB9E9F111235BDE00A137E0 /* Cocoa.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = BCB9E9F011235BDE00A137E0 /* Cocoa.framework */; };
+		BCBD3710125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCBD370F125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp */; };
+		BCBD3737125ABBEB00D2C29F /* icon.png in Copy Resources */ = {isa = PBXBuildFile; fileRef = BCBD372E125ABBE600D2C29F /* icon.png */; };
+		BCBD3761125ABCFE00D2C29F /* FrameMIMETypePNG.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCBD3760125ABCFE00D2C29F /* FrameMIMETypePNG.cpp */; };
+		BCC8B95B12611F4700DE46A4 /* FailedLoad.cpp in Sources */ = {isa = PBXBuildFile; fileRef = BCC8B95A12611F4700DE46A4 /* FailedLoad.cpp */; };
+		C01A23F21266156700C9ED55 /* spacebar-scrolling.html in Copy Resources */ = {isa = PBXBuildFile; fileRef = C02B7882126615410026BF0F /* spacebar-scrolling.html */; };
+		C02B77F2126612140026BF0F /* SpacebarScrolling.cpp in Sources */ = {isa = PBXBuildFile; fileRef = C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */; };
+		C02B7854126613AE0026BF0F /* Carbon.framework in Frameworks */ = {isa = PBXBuildFile; fileRef = C02B7853126613AE0026BF0F /* Carbon.framework */; };
+/* End PBXBuildFile section */
+
+/* Begin PBXContainerItemProxy section */
+		BC575A95126E74E7006F0F12 /* PBXContainerItemProxy */ = {
+			isa = PBXContainerItemProxy;
+			containerPortal = 08FB7793FE84155DC02AAC07 /* Project object */;
+			proxyType = 1;
+			remoteGlobalIDString = BC57597F126E74AF006F0F12 /* InjectedBundle */;
+			remoteInfo = InjectedBundle;
+		};
+/* End PBXContainerItemProxy section */
+
+/* Begin PBXCopyFilesBuildPhase section */
+		8DD76F9E0486AA7600D96B5E /* CopyFiles */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 8;
+			dstPath = /usr/share/man/man1/;
+			dstSubfolderSpec = 0;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 1;
+		};
+		BCB9F4FB112384C000A137E0 /* Copy Resources */ = {
+			isa = PBXCopyFilesBuildPhase;
+			buildActionMask = 2147483647;
+			dstPath = "";
+			dstSubfolderSpec = 7;
+			files = (
+				BCBD3737125ABBEB00D2C29F /* icon.png in Copy Resources */,
+				1A02C870125D4CFD00E3F4BD /* find.html in Copy Resources */,
+				BC909784125571CF00083756 /* simple.html in Copy Resources */,
+				C01A23F21266156700C9ED55 /* spacebar-scrolling.html in Copy Resources */,
+			);
+			name = "Copy Resources";
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXCopyFilesBuildPhase section */
+
+/* Begin PBXFileReference section */
+		1A02C84B125D4A5E00E3F4BD /* find.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = find.html; sourceTree = "<group>"; };
+		1A02C84E125D4A8400E3F4BD /* Find.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = Find.cpp; sourceTree = "<group>"; };
+		8DD76FA10486AA7600D96B5E /* TestWebKitAPI */ = {isa = PBXFileReference; explicitFileType = "compiled.mach-o.executable"; includeInIndex = 0; path = TestWebKitAPI; sourceTree = BUILT_PRODUCTS_DIR; };
+		BC131883117114A800B69727 /* PlatformUtilities.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformUtilities.h; sourceTree = "<group>"; };
+		BC131884117114B600B69727 /* PlatformUtilitiesMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformUtilitiesMac.mm; sourceTree = "<group>"; };
+		BC131A9A1171316900B69727 /* main.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = main.mm; sourceTree = "<group>"; };
+		BC131A9E1171317C00B69727 /* TestWebKitAPIPrefix.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestWebKitAPIPrefix.h; sourceTree = "<group>"; };
+		BC131AA8117131FC00B69727 /* TestsController.cpp */ = {isa = PBXFileReference; explicitFileType = sourcecode.cpp.cpp; fileEncoding = 4; path = TestsController.cpp; sourceTree = "<group>"; };
+		BC575946126E7351006F0F12 /* InjectedBundleMain.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleMain.cpp; sourceTree = "<group>"; };
+		BC575980126E74AF006F0F12 /* InjectedBundle.bundle */ = {isa = PBXFileReference; explicitFileType = wrapper.cfbundle; includeInIndex = 0; path = InjectedBundle.bundle; sourceTree = BUILT_PRODUCTS_DIR; };
+		BC575981126E74AF006F0F12 /* InjectedBundle-Info.plist */ = {isa = PBXFileReference; lastKnownFileType = text.plist.xml; path = "InjectedBundle-Info.plist"; sourceTree = "<group>"; };
+		BC575A9E126E75FB006F0F12 /* InjectedBundleTest.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleTest.h; sourceTree = "<group>"; };
+		BC575A9F126E7657006F0F12 /* InjectedBundleController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = InjectedBundleController.h; sourceTree = "<group>"; };
+		BC575AA0126E7657006F0F12 /* InjectedBundleController.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleController.cpp; sourceTree = "<group>"; };
+		BC575AAC126E83B9006F0F12 /* InjectedBundleBasic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleBasic.cpp; sourceTree = "<group>"; };
+		BC575AAF126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = InjectedBundleBasic_Bundle.cpp; sourceTree = "<group>"; };
+		BC575AE2126E88B1006F0F12 /* InjectedBundle.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = InjectedBundle.xcconfig; sourceTree = "<group>"; };
+		BC575BBF126F5752006F0F12 /* PlatformUtilities.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PlatformUtilities.cpp; sourceTree = "<group>"; };
+		BC90951B125533D700083756 /* PlatformWebView.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = PlatformWebView.h; sourceTree = "<group>"; };
+		BC90955C125548AA00083756 /* PlatformWebViewMac.mm */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.objcpp; path = PlatformWebViewMac.mm; sourceTree = "<group>"; };
+		BC90957E12554CF900083756 /* Base.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = Base.xcconfig; sourceTree = "<group>"; };
+		BC90957F12554CF900083756 /* DebugRelease.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = DebugRelease.xcconfig; sourceTree = "<group>"; };
+		BC90958012554CF900083756 /* TestWebKitAPI.xcconfig */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.xcconfig; path = TestWebKitAPI.xcconfig; sourceTree = "<group>"; };
+		BC90964B125561BF00083756 /* VectorBasic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; name = VectorBasic.cpp; path = WTF/VectorBasic.cpp; sourceTree = "<group>"; };
+		BC90964D1255620C00083756 /* JavaScriptCore.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = JavaScriptCore.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		BC909778125571AB00083756 /* simple.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = simple.html; sourceTree = "<group>"; };
+		BC909779125571AB00083756 /* PageLoadBasic.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = PageLoadBasic.cpp; sourceTree = "<group>"; };
+		BC90995D12567BC100083756 /* WKString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKString.cpp; sourceTree = "<group>"; };
+		BC9099931256ACF100083756 /* WKStringJSString.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = WKStringJSString.cpp; sourceTree = "<group>"; };
+		BCA61DB411700EFD00460D1E /* WebKit2.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; path = WebKit2.framework; sourceTree = BUILT_PRODUCTS_DIR; };
+		BCB9E7C711234E3A00A137E0 /* TestsController.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = TestsController.h; sourceTree = "<group>"; };
+		BCB9E7FA112359A300A137E0 /* Test.h */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.c.h; path = Test.h; sourceTree = "<group>"; };
+		BCB9E9F011235BDE00A137E0 /* Cocoa.framework */ = {isa = PBXFileReference; lastKnownFileType = wrapper.framework; name = Cocoa.framework; path = System/Library/Frameworks/Cocoa.framework; sourceTree = SDKROOT; };
+		BCBD370F125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameMIMETypeHTML.cpp; sourceTree = "<group>"; };
+		BCBD372E125ABBE600D2C29F /* icon.png */ = {isa = PBXFileReference; lastKnownFileType = image.png; path = icon.png; sourceTree = "<group>"; };
+		BCBD3760125ABCFE00D2C29F /* FrameMIMETypePNG.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FrameMIMETypePNG.cpp; sourceTree = "<group>"; };
+		BCC8B95A12611F4700DE46A4 /* FailedLoad.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = FailedLoad.cpp; sourceTree = "<group>"; };
+		C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = sourcecode.cpp.cpp; path = SpacebarScrolling.cpp; sourceTree = "<group>"; };
+		C02B7853126613AE0026BF0F /* Carbon.framework */ = {isa = PBXFileReference; explicitFileType = wrapper.framework; name = Carbon.framework; sourceTree = SDKROOT; };
+		C02B7882126615410026BF0F /* spacebar-scrolling.html */ = {isa = PBXFileReference; fileEncoding = 4; lastKnownFileType = text.html; path = "spacebar-scrolling.html"; sourceTree = "<group>"; };
+/* End PBXFileReference section */
+
+/* Begin PBXFrameworksBuildPhase section */
+		8DD76F9B0486AA7600D96B5E /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BCB9E9F111235BDE00A137E0 /* Cocoa.framework in Frameworks */,
+				BCA61DB511700EFD00460D1E /* WebKit2.framework in Frameworks */,
+				BC90964E1255620C00083756 /* JavaScriptCore.framework in Frameworks */,
+				C02B7854126613AE0026BF0F /* Carbon.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		BC57597E126E74AF006F0F12 /* Frameworks */ = {
+			isa = PBXFrameworksBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC575A90126E74D3006F0F12 /* Cocoa.framework in Frameworks */,
+				BC575A91126E74D3006F0F12 /* WebKit2.framework in Frameworks */,
+				BC575A92126E74D3006F0F12 /* JavaScriptCore.framework in Frameworks */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXFrameworksBuildPhase section */
+
+/* Begin PBXGroup section */
+		08FB7794FE84155DC02AAC07 /* TestWebKitAPI */ = {
+			isa = PBXGroup;
+			children = (
+				08FB7795FE84155DC02AAC07 /* Source */,
+				BCB9EB66112366D800A137E0 /* Tests */,
+				BC90957D12554CEA00083756 /* Configurations */,
+				08FB779DFE84155DC02AAC07 /* External Frameworks and Libraries */,
+				1AB674ADFE9D54B511CA2CBB /* Products */,
+				BC575981126E74AF006F0F12 /* InjectedBundle-Info.plist */,
+			);
+			name = TestWebKitAPI;
+			sourceTree = "<group>";
+		};
+		08FB7795FE84155DC02AAC07 /* Source */ = {
+			isa = PBXGroup;
+			children = (
+				BCA61C3A11700B9400460D1E /* mac */,
+				BC575944126E733C006F0F12 /* InjectedBundle */,
+				BC131A9E1171317C00B69727 /* TestWebKitAPIPrefix.h */,
+				BC575BBF126F5752006F0F12 /* PlatformUtilities.cpp */,
+				BC131883117114A800B69727 /* PlatformUtilities.h */,
+				BC90951B125533D700083756 /* PlatformWebView.h */,
+				BCB9E7FA112359A300A137E0 /* Test.h */,
+				BC131AA8117131FC00B69727 /* TestsController.cpp */,
+				BCB9E7C711234E3A00A137E0 /* TestsController.h */,
+			);
+			name = Source;
+			sourceTree = "<group>";
+		};
+		08FB779DFE84155DC02AAC07 /* External Frameworks and Libraries */ = {
+			isa = PBXGroup;
+			children = (
+				BCB9E9F011235BDE00A137E0 /* Cocoa.framework */,
+				BC90964D1255620C00083756 /* JavaScriptCore.framework */,
+				BCA61DB411700EFD00460D1E /* WebKit2.framework */,
+				C02B7853126613AE0026BF0F /* Carbon.framework */,
+			);
+			name = "External Frameworks and Libraries";
+			sourceTree = "<group>";
+		};
+		1AB674ADFE9D54B511CA2CBB /* Products */ = {
+			isa = PBXGroup;
+			children = (
+				8DD76FA10486AA7600D96B5E /* TestWebKitAPI */,
+				BC575980126E74AF006F0F12 /* InjectedBundle.bundle */,
+			);
+			name = Products;
+			sourceTree = "<group>";
+		};
+		BC575944126E733C006F0F12 /* InjectedBundle */ = {
+			isa = PBXGroup;
+			children = (
+				BC575946126E7351006F0F12 /* InjectedBundleMain.cpp */,
+				BC575A9E126E75FB006F0F12 /* InjectedBundleTest.h */,
+				BC575A9F126E7657006F0F12 /* InjectedBundleController.h */,
+				BC575AA0126E7657006F0F12 /* InjectedBundleController.cpp */,
+			);
+			name = InjectedBundle;
+			sourceTree = "<group>";
+		};
+		BC90957D12554CEA00083756 /* Configurations */ = {
+			isa = PBXGroup;
+			children = (
+				BC90957E12554CF900083756 /* Base.xcconfig */,
+				BC90957F12554CF900083756 /* DebugRelease.xcconfig */,
+				BC575AE2126E88B1006F0F12 /* InjectedBundle.xcconfig */,
+				BC90958012554CF900083756 /* TestWebKitAPI.xcconfig */,
+			);
+			path = Configurations;
+			sourceTree = "<group>";
+		};
+		BC9096411255616000083756 /* WebKit2 */ = {
+			isa = PBXGroup;
+			children = (
+				BC90977B125571AE00083756 /* Resources */,
+				1A02C84E125D4A8400E3F4BD /* Find.cpp */,
+				BCBD370F125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp */,
+				BCBD3760125ABCFE00D2C29F /* FrameMIMETypePNG.cpp */,
+				BC909779125571AB00083756 /* PageLoadBasic.cpp */,
+				C02B77F1126612140026BF0F /* SpacebarScrolling.cpp */,
+				BC90995D12567BC100083756 /* WKString.cpp */,
+				BC9099931256ACF100083756 /* WKStringJSString.cpp */,
+				BCC8B95A12611F4700DE46A4 /* FailedLoad.cpp */,
+				BC575AAC126E83B9006F0F12 /* InjectedBundleBasic.cpp */,
+				BC575AAF126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp */,
+			);
+			path = WebKit2;
+			sourceTree = "<group>";
+		};
+		BC9096461255618900083756 /* WTF */ = {
+			isa = PBXGroup;
+			children = (
+				BC90964B125561BF00083756 /* VectorBasic.cpp */,
+			);
+			name = WTF;
+			sourceTree = "<group>";
+		};
+		BC90977B125571AE00083756 /* Resources */ = {
+			isa = PBXGroup;
+			children = (
+				BCBD372E125ABBE600D2C29F /* icon.png */,
+				1A02C84B125D4A5E00E3F4BD /* find.html */,
+				BC909778125571AB00083756 /* simple.html */,
+				C02B7882126615410026BF0F /* spacebar-scrolling.html */,
+			);
+			name = Resources;
+			sourceTree = "<group>";
+		};
+		BCA61C3A11700B9400460D1E /* mac */ = {
+			isa = PBXGroup;
+			children = (
+				BC131A9A1171316900B69727 /* main.mm */,
+				BC131884117114B600B69727 /* PlatformUtilitiesMac.mm */,
+				BC90955C125548AA00083756 /* PlatformWebViewMac.mm */,
+			);
+			path = mac;
+			sourceTree = "<group>";
+		};
+		BCB9EB66112366D800A137E0 /* Tests */ = {
+			isa = PBXGroup;
+			children = (
+				BC9096411255616000083756 /* WebKit2 */,
+				BC9096461255618900083756 /* WTF */,
+			);
+			path = Tests;
+			sourceTree = "<group>";
+		};
+/* End PBXGroup section */
+
+/* Begin PBXNativeTarget section */
+		8DD76F960486AA7600D96B5E /* TestWebKitAPI */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = 1DEB927408733DD40010E9CD /* Build configuration list for PBXNativeTarget "TestWebKitAPI" */;
+			buildPhases = (
+				8DD76F990486AA7600D96B5E /* Sources */,
+				8DD76F9B0486AA7600D96B5E /* Frameworks */,
+				8DD76F9E0486AA7600D96B5E /* CopyFiles */,
+				BCB9F4FB112384C000A137E0 /* Copy Resources */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+				BC575A96126E74E7006F0F12 /* PBXTargetDependency */,
+			);
+			name = TestWebKitAPI;
+			productInstallPath = "$(HOME)/bin";
+			productName = TestWebKitAPI;
+			productReference = 8DD76FA10486AA7600D96B5E /* TestWebKitAPI */;
+			productType = "com.apple.product-type.tool";
+		};
+		BC57597F126E74AF006F0F12 /* InjectedBundle */ = {
+			isa = PBXNativeTarget;
+			buildConfigurationList = BC575986126E74AF006F0F12 /* Build configuration list for PBXNativeTarget "InjectedBundle" */;
+			buildPhases = (
+				BC57597C126E74AF006F0F12 /* Resources */,
+				BC57597D126E74AF006F0F12 /* Sources */,
+				BC57597E126E74AF006F0F12 /* Frameworks */,
+			);
+			buildRules = (
+			);
+			dependencies = (
+			);
+			name = InjectedBundle;
+			productName = InjectedBundle;
+			productReference = BC575980126E74AF006F0F12 /* InjectedBundle.bundle */;
+			productType = "com.apple.product-type.bundle";
+		};
+/* End PBXNativeTarget section */
+
+/* Begin PBXProject section */
+		08FB7793FE84155DC02AAC07 /* Project object */ = {
+			isa = PBXProject;
+			buildConfigurationList = 1DEB927808733DD40010E9CD /* Build configuration list for PBXProject "TestWebKitAPI" */;
+			compatibilityVersion = "Xcode 3.1";
+			developmentRegion = English;
+			hasScannedForEncodings = 1;
+			knownRegions = (
+				English,
+				Japanese,
+				French,
+				German,
+			);
+			mainGroup = 08FB7794FE84155DC02AAC07 /* TestWebKitAPI */;
+			projectDirPath = "";
+			projectRoot = "";
+			targets = (
+				8DD76F960486AA7600D96B5E /* TestWebKitAPI */,
+				BC57597F126E74AF006F0F12 /* InjectedBundle */,
+			);
+		};
+/* End PBXProject section */
+
+/* Begin PBXResourcesBuildPhase section */
+		BC57597C126E74AF006F0F12 /* Resources */ = {
+			isa = PBXResourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXResourcesBuildPhase section */
+
+/* Begin PBXSourcesBuildPhase section */
+		8DD76F990486AA7600D96B5E /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC131885117114B600B69727 /* PlatformUtilitiesMac.mm in Sources */,
+				BC131A9B1171316900B69727 /* main.mm in Sources */,
+				BC131AA9117131FC00B69727 /* TestsController.cpp in Sources */,
+				BC90955D125548AA00083756 /* PlatformWebViewMac.mm in Sources */,
+				BC90964C125561BF00083756 /* VectorBasic.cpp in Sources */,
+				BC90977A125571AB00083756 /* PageLoadBasic.cpp in Sources */,
+				BC90995E12567BC100083756 /* WKString.cpp in Sources */,
+				BC9099941256ACF100083756 /* WKStringJSString.cpp in Sources */,
+				BCBD3710125AA2EB00D2C29F /* FrameMIMETypeHTML.cpp in Sources */,
+				BCBD3761125ABCFE00D2C29F /* FrameMIMETypePNG.cpp in Sources */,
+				1A02C84F125D4A8400E3F4BD /* Find.cpp in Sources */,
+				BCC8B95B12611F4700DE46A4 /* FailedLoad.cpp in Sources */,
+				C02B77F2126612140026BF0F /* SpacebarScrolling.cpp in Sources */,
+				BC575AAD126E83B9006F0F12 /* InjectedBundleBasic.cpp in Sources */,
+				BC575BC0126F5752006F0F12 /* PlatformUtilities.cpp in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+		BC57597D126E74AF006F0F12 /* Sources */ = {
+			isa = PBXSourcesBuildPhase;
+			buildActionMask = 2147483647;
+			files = (
+				BC575A97126E74F1006F0F12 /* InjectedBundleMain.cpp in Sources */,
+				BC575AA2126E7660006F0F12 /* InjectedBundleController.cpp in Sources */,
+				BC575AB0126E83C8006F0F12 /* InjectedBundleBasic_Bundle.cpp in Sources */,
+				BC575BD9126F58E2006F0F12 /* PlatformUtilities.cpp in Sources */,
+				BC575BE0126F590D006F0F12 /* PlatformUtilitiesMac.mm in Sources */,
+			);
+			runOnlyForDeploymentPostprocessing = 0;
+		};
+/* End PBXSourcesBuildPhase section */
+
+/* Begin PBXTargetDependency section */
+		BC575A96126E74E7006F0F12 /* PBXTargetDependency */ = {
+			isa = PBXTargetDependency;
+			target = BC57597F126E74AF006F0F12 /* InjectedBundle */;
+			targetProxy = BC575A95126E74E7006F0F12 /* PBXContainerItemProxy */;
+		};
+/* End PBXTargetDependency section */
+
+/* Begin XCBuildConfiguration section */
+		1DEB927508733DD40010E9CD /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC90958012554CF900083756 /* TestWebKitAPI.xcconfig */;
+			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = "$(inherited)";
+			};
+			name = Debug;
+		};
+		1DEB927608733DD40010E9CD /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC90958012554CF900083756 /* TestWebKitAPI.xcconfig */;
+			buildSettings = {
+				FRAMEWORK_SEARCH_PATHS = "$(inherited)";
+			};
+			name = Release;
+		};
+		1DEB927908733DD40010E9CD /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC90957F12554CF900083756 /* DebugRelease.xcconfig */;
+			buildSettings = {
+				GCC_OPTIMIZATION_LEVEL = 0;
+			};
+			name = Debug;
+		};
+		1DEB927A08733DD40010E9CD /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC90957F12554CF900083756 /* DebugRelease.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+		BC575984126E74AF006F0F12 /* Debug */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC575AE2126E88B1006F0F12 /* InjectedBundle.xcconfig */;
+			buildSettings = {
+			};
+			name = Debug;
+		};
+		BC575985126E74AF006F0F12 /* Release */ = {
+			isa = XCBuildConfiguration;
+			baseConfigurationReference = BC575AE2126E88B1006F0F12 /* InjectedBundle.xcconfig */;
+			buildSettings = {
+			};
+			name = Release;
+		};
+/* End XCBuildConfiguration section */
+
+/* Begin XCConfigurationList section */
+		1DEB927408733DD40010E9CD /* Build configuration list for PBXNativeTarget "TestWebKitAPI" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				1DEB927508733DD40010E9CD /* Debug */,
+				1DEB927608733DD40010E9CD /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		1DEB927808733DD40010E9CD /* Build configuration list for PBXProject "TestWebKitAPI" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				1DEB927908733DD40010E9CD /* Debug */,
+				1DEB927A08733DD40010E9CD /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+		BC575986126E74AF006F0F12 /* Build configuration list for PBXNativeTarget "InjectedBundle" */ = {
+			isa = XCConfigurationList;
+			buildConfigurations = (
+				BC575984126E74AF006F0F12 /* Debug */,
+				BC575985126E74AF006F0F12 /* Release */,
+			);
+			defaultConfigurationIsVisible = 0;
+			defaultConfigurationName = Release;
+		};
+/* End XCConfigurationList section */
+	};
+	rootObject = 08FB7793FE84155DC02AAC07 /* Project object */;
+}
diff --git a/WebKitTools/TestWebKitAPI/TestWebKitAPIPrefix.h b/WebKitTools/TestWebKitAPI/TestWebKitAPIPrefix.h
new file mode 100644
index 0000000..00e14ad
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/TestWebKitAPIPrefix.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+
+#if __APPLE__
+
+#ifdef __OBJC__
+#import <Cocoa/Cocoa.h>
+#endif
+
+#elif defined(WIN32) || defined(_WIN32)
+
+#define NOMINMAX
+
+#endif
+
+#include <stdint.h>
+
+#include <WebKit2/WebKit2.h>
diff --git a/WebKitTools/TestWebKitAPI/Tests/WTF/VectorBasic.cpp b/WebKitTools/TestWebKitAPI/Tests/WTF/VectorBasic.cpp
new file mode 100644
index 0000000..012fa27
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WTF/VectorBasic.cpp
@@ -0,0 +1,40 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include <JavaScriptCore/Vector.h>
+
+namespace TestWebKitAPI {
+
+TEST(WTF, VectorBasic)
+{
+    Vector<int> intVector;
+    TEST_ASSERT(intVector.isEmpty());
+    TEST_ASSERT(intVector.size() == 0);
+    TEST_ASSERT(intVector.capacity() == 0);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp
new file mode 100644
index 0000000..b7db746
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FailedLoad.cpp
@@ -0,0 +1,72 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+// FIXME: This should also test the that the load state after didFailLoadWithErrorForFrame is kWKFrameLoadStateFinished
+
+static bool testDone;
+
+static void didFailProvisionalLoadWithErrorForFrame(WKPageRef page, WKFrameRef frame, WKErrorRef error, WKTypeRef userData, const void* clientInfo)
+{
+    TEST_ASSERT(WKFrameGetFrameLoadState(frame) == kWKFrameLoadStateFinished);
+
+    WKURLRef url = WKFrameCopyProvisionalURL(frame);
+    WKURLRef emptyURL = WKURLCreateWithUTF8CString("");
+    TEST_ASSERT(WKURLIsEqual(url, emptyURL));
+    WKRelease(url);
+    WKRelease(emptyURL);
+
+    testDone = true;
+}
+
+TEST(WebKit2, FailedLoad)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.version = 0;
+    loaderClient.clientInfo = 0;
+    loaderClient.didFailProvisionalLoadWithErrorForFrame = didFailProvisionalLoadWithErrorForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::URLForNonExistentResource());
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&testDone);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/Find.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/Find.cpp
new file mode 100644
index 0000000..63bcea8
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/Find.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WebKit2.h>
+
+namespace TestWebKitAPI {
+
+static bool didFinishLoad = false;
+static bool didCallCountStringMatches = false;
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    didFinishLoad = true;
+}
+
+static void didCountStringMatches(WKPageRef page, WKStringRef string, unsigned numMatches, const void* clientInfo)
+{
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(string, "Hello"));
+    TEST_ASSERT(numMatches == 3);
+
+    didCallCountStringMatches = true;
+}
+
+TEST(WebKit2, Find)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+    
+    PlatformWebView webView(pageNamespace.get());
+    
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+    
+    loaderClient.version = 0;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKPageFindClient findClient;
+    memset(&findClient, 0, sizeof(findClient));
+
+    findClient.version = 0;
+    findClient.didCountStringMatches = didCountStringMatches;
+    WKPageSetPageFindClient(webView.page(), &findClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("find", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&didFinishLoad);
+
+    WKRetainPtr<WKStringRef> findString(AdoptWK, WKStringCreateWithUTF8CString("Hello"));
+    WKPageCountStringMatches(webView.page(), findString.get(), true, 100);
+
+    Util::run(&didCallCountStringMatches);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp
new file mode 100644
index 0000000..a270357
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypeHTML.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool testDone;
+
+static void didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEmpty(wkMIME.get()));
+}
+
+static void didCommitLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(wkMIME.get(), "text/html"));
+}
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(wkMIME.get(), "text/html"));
+
+    testDone = true;
+}
+
+TEST(WebKit2, FrameMIMETypeHTML)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.version = 0;
+    loaderClient.clientInfo = 0;
+    loaderClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
+    loaderClient.didCommitLoadForFrame = didCommitLoadForFrame;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("simple", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&testDone);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp
new file mode 100644
index 0000000..3588940
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/FrameMIMETypePNG.cpp
@@ -0,0 +1,79 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool testDone;
+
+static void didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEmpty(wkMIME.get()));
+}
+
+static void didCommitLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(wkMIME.get(), "image/png"));
+}
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    WKRetainPtr<WKStringRef> wkMIME(AdoptWK, WKFrameCopyMIMEType(frame));
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(wkMIME.get(), "image/png"));
+
+    testDone = true;
+}
+
+TEST(WebKit2, FrameMIMETypePNG)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.version = 0;
+    loaderClient.clientInfo = 0;
+    loaderClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
+    loaderClient.didCommitLoadForFrame = didCommitLoadForFrame;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("icon", "png"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&testDone);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic.cpp
new file mode 100644
index 0000000..1f4cce6
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic.cpp
@@ -0,0 +1,80 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool done;
+static bool loadDone;
+static bool messageReceived;
+
+void didReceiveMessageFromInjectedBundle(WKContextRef context, WKStringRef messageName, WKTypeRef messageBody, const void* clientInfo)
+{
+    messageReceived = true;
+    if (loadDone)
+        done = true;
+}
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    loadDone = true;
+    if (messageReceived)
+        done = true;
+}
+
+TEST(WebKit2, InjectedBundleBasic)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, Util::createContextForInjectedBundleTest("InjectedBundleBasicTest"));
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+
+    WKContextInjectedBundleClient injectedBundleClient;
+    memset(&injectedBundleClient, 0, sizeof(injectedBundleClient));
+    injectedBundleClient.version = 0;
+    injectedBundleClient.clientInfo = 0;
+    injectedBundleClient.didReceiveMessageFromInjectedBundle = didReceiveMessageFromInjectedBundle;
+    WKContextSetInjectedBundleClient(context.get(), &injectedBundleClient);
+ 
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+    loaderClient.version = 0;
+    loaderClient.clientInfo = 0;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("simple", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&done);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic_Bundle.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic_Bundle.cpp
new file mode 100644
index 0000000..67c062b
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/InjectedBundleBasic_Bundle.cpp
@@ -0,0 +1,49 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "InjectedBundleTest.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+class InjectedBundleBasicTest : public InjectedBundleTest {
+public:
+    InjectedBundleBasicTest(const std::string& identifier)
+        : InjectedBundleTest(identifier)
+    {
+    }
+
+    virtual void didCreatePage(WKBundleRef bundle, WKBundlePageRef page)
+    {
+        WKRetainPtr<WKStringRef> doneMessageName(AdoptWK, WKStringCreateWithUTF8CString("DoneMessageName"));
+        WKRetainPtr<WKStringRef> doneMessageBody(AdoptWK, WKStringCreateWithUTF8CString("DoneMessageBody"));
+        WKBundlePostMessage(bundle, doneMessageName.get(), doneMessageBody.get());
+    }
+};
+
+static InjectedBundleTest::Register<InjectedBundleBasicTest> registrar("InjectedBundleBasicTest");
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp
new file mode 100644
index 0000000..a0b4058
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/PageLoadBasic.cpp
@@ -0,0 +1,135 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WebKit2.h>
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+static bool test1Done;
+
+struct State {
+    State()
+        : didDecidePolicyForNavigationAction(false)
+        , didStartProvisionalLoadForFrame(false)
+        , didCommitLoadForFrame(false)
+    {
+    }
+
+    bool didDecidePolicyForNavigationAction;
+    bool didStartProvisionalLoadForFrame;
+    bool didCommitLoadForFrame;
+};
+
+static void didStartProvisionalLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    State* state = reinterpret_cast<State*>(const_cast<void*>(clientInfo));
+    TEST_ASSERT(state->didDecidePolicyForNavigationAction);
+    TEST_ASSERT(!state->didCommitLoadForFrame);
+    TEST_ASSERT(!state->didStartProvisionalLoadForFrame);
+
+    state->didStartProvisionalLoadForFrame = true;
+}
+
+static void didCommitLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    State* state = reinterpret_cast<State*>(const_cast<void*>(clientInfo));
+    TEST_ASSERT(state->didDecidePolicyForNavigationAction);
+    TEST_ASSERT(state->didStartProvisionalLoadForFrame);
+
+    state->didCommitLoadForFrame = true;
+}
+
+static void didFinishLoadForFrame(WKPageRef page, WKFrameRef frame, WKTypeRef userData, const void* clientInfo)
+{
+    State* state = reinterpret_cast<State*>(const_cast<void*>(clientInfo));
+    TEST_ASSERT(state->didDecidePolicyForNavigationAction);
+    TEST_ASSERT(state->didStartProvisionalLoadForFrame);
+    TEST_ASSERT(state->didCommitLoadForFrame);
+
+    test1Done = true;
+}
+
+static void decidePolicyForNavigationAction(WKPageRef page, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRef url, WKFrameRef frame, WKFramePolicyListenerRef listener, const void* clientInfo)
+{
+    State* state = reinterpret_cast<State*>(const_cast<void*>(clientInfo));
+    TEST_ASSERT(!state->didStartProvisionalLoadForFrame);
+    TEST_ASSERT(!state->didCommitLoadForFrame);
+
+    state->didDecidePolicyForNavigationAction = true;
+
+    WKFramePolicyListenerUse(listener);
+}
+
+static void decidePolicyForNewWindowAction(WKPageRef page, WKFrameNavigationType navigationType, WKEventModifiers modifiers, WKEventMouseButton mouseButton, WKURLRef url, WKFrameRef frame, WKFramePolicyListenerRef listener, const void* clientInfo)
+{
+    WKFramePolicyListenerUse(listener);
+}
+
+static void decidePolicyForMIMEType(WKPageRef page, WKStringRef MIMEType, WKURLRef url, WKFrameRef frame, WKFramePolicyListenerRef listener, const void* clientInfo)
+{
+    WKFramePolicyListenerUse(listener);
+}
+
+TEST(WebKit2, PageLoadBasic)
+{
+    State state;
+
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+ 
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+
+    loaderClient.version = 0;
+    loaderClient.clientInfo = &state;
+    loaderClient.didStartProvisionalLoadForFrame = didStartProvisionalLoadForFrame;
+    loaderClient.didCommitLoadForFrame = didCommitLoadForFrame;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKPagePolicyClient policyClient;
+    memset(&policyClient, 0, sizeof(policyClient));
+
+    policyClient.version = 0;
+    policyClient.clientInfo = &state;
+    policyClient.decidePolicyForNavigationAction = decidePolicyForNavigationAction;
+    policyClient.decidePolicyForNewWindowAction = decidePolicyForNewWindowAction;
+    policyClient.decidePolicyForMIMEType = decidePolicyForMIMEType;
+    WKPageSetPagePolicyClient(webView.page(), &policyClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("simple", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+
+    Util::run(&test1Done);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/SpacebarScrolling.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/SpacebarScrolling.cpp
new file mode 100644
index 0000000..a88db9f
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/SpacebarScrolling.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+struct JavaScriptCallbackContext {
+    JavaScriptCallbackContext(const char* expectedString) : didFinish(false), expectedString(expectedString), didMatchExpectedString(false) { }
+
+    bool didFinish;
+    const char* expectedString;
+    bool didMatchExpectedString;
+};
+
+static bool didFinishLoad;
+static bool didNotHandleKeyDownEvent;
+
+static void didFinishLoadForFrame(WKPageRef, WKFrameRef, WKTypeRef, const void*)
+{
+    didFinishLoad = true;
+}
+
+static void didNotHandleKeyEventCallback(WKPageRef, WKNativeEventPtr event, const void*)
+{
+    if (Util::isKeyDown(event))
+        didNotHandleKeyDownEvent = true;
+}
+
+static void javaScriptCallback(WKStringRef string, WKErrorRef error, void* ctx)
+{
+    JavaScriptCallbackContext* context = static_cast<JavaScriptCallbackContext*>(ctx);
+
+    context->didFinish = true;
+    context->didMatchExpectedString = WKStringIsEqualToUTF8CString(string, context->expectedString);
+
+    TEST_ASSERT(!error);
+}
+
+static WKRetainPtr<WKStringRef> wk(const char* utf8String)
+{
+    return WKRetainPtr<WKStringRef>(AdoptWK, WKStringCreateWithUTF8CString(utf8String));
+}
+
+static bool runJSTest(WKPageRef page, const char* script, const char* expectedResult)
+{
+    JavaScriptCallbackContext context(expectedResult);
+    WKPageRunJavaScriptInMainFrame(page, wk(script).get(), &context, javaScriptCallback);
+    Util::run(&context.didFinish);
+    return context.didMatchExpectedString;
+}
+
+TEST(WebKit2, SpacebarScrolling)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageLoaderClient loaderClient;
+    memset(&loaderClient, 0, sizeof(loaderClient));
+    
+    loaderClient.version = 0;
+    loaderClient.didFinishLoadForFrame = didFinishLoadForFrame;
+    WKPageSetPageLoaderClient(webView.page(), &loaderClient);
+
+    WKPageUIClient uiClient;
+    memset(&uiClient, 0, sizeof(uiClient));
+
+    uiClient.didNotHandleKeyEvent = didNotHandleKeyEventCallback;
+    WKPageSetPageUIClient(webView.page(), &uiClient);
+
+    WKRetainPtr<WKURLRef> url(AdoptWK, Util::createURLForResource("spacebar-scrolling", "html"));
+    WKPageLoadURL(webView.page(), url.get());
+    Util::run(&didFinishLoad);
+
+    TEST_ASSERT(runJSTest(webView.page(), "isDocumentScrolled()", "false"));
+    TEST_ASSERT(runJSTest(webView.page(), "textFieldContainsSpace()", "false"));
+
+    webView.simulateSpacebarKeyPress();
+
+    TEST_ASSERT(runJSTest(webView.page(), "isDocumentScrolled()", "false"));
+    TEST_ASSERT(runJSTest(webView.page(), "textFieldContainsSpace()", "true"));
+
+    // On Mac, a key down event represents both a raw key down and a key press. On Windows, a key
+    // down event only represents a raw key down. We expect the key press to be handled (because it
+    // inserts text into the text field). But the raw key down should not be handled.
+#if PLATFORM(MAC)
+    TEST_ASSERT(!didNotHandleKeyDownEvent);
+#elif PLATFORM(WIN)
+    TEST_ASSERT(didNotHandleKeyDownEvent);
+#endif
+
+    TEST_ASSERT(runJSTest(webView.page(), "blurTextField()", "undefined"));
+
+    didNotHandleKeyDownEvent = false;
+    webView.simulateSpacebarKeyPress();
+
+    TEST_ASSERT(runJSTest(webView.page(), "isDocumentScrolled()", "true"));
+    TEST_ASSERT(runJSTest(webView.page(), "textFieldContainsSpace()", "true"));
+#if PLATFORM(MAC)
+    TEST_ASSERT(!didNotHandleKeyDownEvent);
+#elif PLATFORM(WIN)
+    TEST_ASSERT(didNotHandleKeyDownEvent);
+#endif
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKString.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKString.cpp
new file mode 100644
index 0000000..b0b133d
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKString.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include <WebKit2/WKString.h>
+
+namespace TestWebKitAPI {
+
+TEST(WebKit2, WKString)
+{
+    WKStringRef string = WKStringCreateWithUTF8CString("hello");
+    TEST_ASSERT(!WKStringIsEmpty(string));
+    TEST_ASSERT(WKStringIsEqual(string, string));
+    TEST_ASSERT(WKStringIsEqualToUTF8CString(string, "hello"));
+    TEST_ASSERT(WKStringGetMaximumUTF8CStringSize(string) == 16);
+
+    size_t maxSize = WKStringGetMaximumUTF8CStringSize(string);
+    char* buffer = new char[maxSize];
+
+    size_t actualSize = WKStringGetUTF8CString(string, buffer, maxSize);
+    TEST_ASSERT(actualSize == 6);
+    TEST_ASSERT(strcmp(buffer, "hello") == 0);
+
+    delete[] buffer;
+    
+    WKRelease(string);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKStringJSString.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKStringJSString.cpp
new file mode 100644
index 0000000..0d6eca3
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/WKStringJSString.cpp
@@ -0,0 +1,52 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include <WebKit2/WKString.h>
+#include <WebKit2/WKStringPrivate.h>
+#include <JavaScriptCore/JSStringRef.h>
+
+namespace TestWebKitAPI {
+
+TEST(WebKit2, WKStringJSString)
+{
+    WKStringRef wkString = WKStringCreateWithUTF8CString("hello");
+    JSStringRef jsString = JSStringCreateWithUTF8CString("hello");
+    
+    WKStringRef convertedJSString = WKStringCreateWithJSString(jsString);
+    TEST_ASSERT(WKStringIsEqual(wkString, convertedJSString));
+    
+    JSStringRef convertedWKString = WKStringCopyJSString(wkString);
+    TEST_ASSERT(JSStringIsEqual(jsString, convertedWKString));
+
+    WKRelease(wkString);
+    WKRelease(convertedJSString);
+
+    JSStringRelease(jsString);
+    JSStringRelease(convertedWKString);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/find.html b/WebKitTools/TestWebKitAPI/Tests/WebKit2/find.html
new file mode 100644
index 0000000..d965911
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/find.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+  Test search. Hello Hello Hello!
+</body>
+</html>
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/icon.png b/WebKitTools/TestWebKitAPI/Tests/WebKit2/icon.png
new file mode 100644
index 0000000..79e4598
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/icon.png
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/simple.html b/WebKitTools/TestWebKitAPI/Tests/WebKit2/simple.html
new file mode 100644
index 0000000..12cf873
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/simple.html
@@ -0,0 +1,5 @@
+<html>
+<body>
+  Simple HTML file.
+</body>
+</html>
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/spacebar-scrolling.html b/WebKitTools/TestWebKitAPI/Tests/WebKit2/spacebar-scrolling.html
new file mode 100644
index 0000000..8da08b3
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/spacebar-scrolling.html
@@ -0,0 +1,26 @@
+<!DOCTYPE html>
+<script>
+    function textFieldContainsSpace()
+    {
+        return document.querySelector("input").value === " ";
+    }
+
+    function blurTextField()
+    {
+        document.querySelector("input").blur();
+    }
+
+    function isDocumentScrolled()
+    {
+        return scrollY !== 0;
+    }
+
+    function loaded()
+    {
+        document.querySelector("input").focus();
+    }
+
+    addEventListener("load", loaded);
+</script>
+<input>
+<div style="height: 3000px;"></div>
diff --git a/WebKitTools/TestWebKitAPI/Tests/WebKit2/win/AltKeyGeneratesWMSysCommand.cpp b/WebKitTools/TestWebKitAPI/Tests/WebKit2/win/AltKeyGeneratesWMSysCommand.cpp
new file mode 100644
index 0000000..c463cf0
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/Tests/WebKit2/win/AltKeyGeneratesWMSysCommand.cpp
@@ -0,0 +1,88 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "Test.h"
+
+#include "PlatformUtilities.h"
+#include "PlatformWebView.h"
+#include "WindowMessageObserver.h"
+#include <WebKit2/WKRetainPtr.h>
+
+namespace TestWebKitAPI {
+
+class WMSysCommandObserver : public WindowMessageObserver {
+public:
+    WMSysCommandObserver() : m_windowDidReceiveWMSysCommand(false) { }
+
+    bool windowDidReceiveWMSysCommand() const { return m_windowDidReceiveWMSysCommand; }
+
+private:
+    virtual void windowReceivedMessage(HWND, UINT message, WPARAM, LPARAM)
+    {
+        if (message == WM_SYSCOMMAND)
+            m_windowDidReceiveWMSysCommand = true;
+    }
+
+    bool m_windowDidReceiveWMSysCommand;
+};
+
+static bool didNotHandleWMSysKeyUp;
+
+static void didNotHandleKeyEventCallback(WKPageRef, WKNativeEventPtr event, const void*)
+{
+    if (event->message != WM_SYSKEYUP)
+        return;
+
+    didNotHandleWMSysKeyUp = true;
+}
+
+TEST(WebKit2, AltKeyGeneratesWMSysCommand)
+{
+    WKRetainPtr<WKContextRef> context(AdoptWK, WKContextCreate());
+    WKRetainPtr<WKPageNamespaceRef> pageNamespace(AdoptWK, WKPageNamespaceCreate(context.get()));
+
+    PlatformWebView webView(pageNamespace.get());
+
+    WKPageUIClient uiClient;
+    memset(&uiClient, 0, sizeof(uiClient));
+
+    uiClient.didNotHandleKeyEvent = didNotHandleKeyEventCallback;
+    WKPageSetPageUIClient(webView.page(), &uiClient);
+
+    WMSysCommandObserver observer;
+    webView.setParentWindowMessageObserver(&observer);
+
+    webView.simulateAltKeyPress();
+
+    Util::run(&didNotHandleWMSysKeyUp);
+
+    webView.setParentWindowMessageObserver(0);
+
+    // The WM_SYSKEYUP message should have generated a WM_SYSCOMMAND message that was sent to the
+    // WKView's parent window.
+    TEST_ASSERT(observer.windowDidReceiveWMSysCommand());
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/TestsController.cpp b/WebKitTools/TestWebKitAPI/TestsController.cpp
new file mode 100644
index 0000000..3499f2c
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/TestsController.cpp
@@ -0,0 +1,82 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "TestsController.h"
+
+#include "Test.h"
+#include <algorithm>
+#include <assert.h>
+
+namespace TestWebKitAPI {
+
+TestsController& TestsController::shared()
+{
+    static TestsController& shared = *new TestsController;
+    return shared;
+}
+
+TestsController::TestsController()
+    : m_testFailed(false)
+    , m_currentTest(0)
+{
+}
+
+void TestsController::dumpTestNames()
+{
+    std::map<std::string, CreateTestFunction>::const_iterator it = m_createTestFunctions.begin();
+    std::map<std::string, CreateTestFunction>::const_iterator end = m_createTestFunctions.end();
+    for (; it != end; ++it)
+        printf("%s\n", (*it).first.c_str());
+}
+
+bool TestsController::runTestNamed(const std::string& identifier)
+{
+    CreateTestFunction createTestFunction = m_createTestFunctions[identifier];
+    if (!createTestFunction) {
+        printf("ERROR: Test not found - %s\n", identifier.c_str());
+        return false;
+    }
+
+    m_currentTest = createTestFunction(identifier);
+    m_currentTest->run();
+
+    delete m_currentTest;
+    m_currentTest = 0;
+
+    return !m_testFailed;
+}
+
+void TestsController::testFailed(const char* file, int line, const char* message)
+{
+    m_testFailed = true;
+    printf("FAIL: %s\n\t%s (%s:%d)\n", m_currentTest->name().c_str(), message, file, line);
+}
+
+void TestsController::registerCreateTestFunction(const std::string& identifier, CreateTestFunction createTestFunction)
+{
+    m_createTestFunctions[identifier] = createTestFunction;
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/TestsController.h b/WebKitTools/TestWebKitAPI/TestsController.h
new file mode 100644
index 0000000..0ff1fc7
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/TestsController.h
@@ -0,0 +1,61 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef TestsController_h
+#define TestsController_h
+
+#include <map>
+#include <string>
+
+namespace TestWebKitAPI {
+
+class Test;
+
+class TestsController {
+public:
+    static TestsController& shared();
+
+    void dumpTestNames();
+    bool runTestNamed(const std::string&);
+
+    // Called by the tests themselves.
+    void testFailed(const char* file, int line, const char* message);
+
+    typedef Test* (*CreateTestFunction)(const std::string&);
+    void registerCreateTestFunction(const std::string&, CreateTestFunction);
+
+private:
+    TestsController();
+    ~TestsController();
+
+    bool m_testFailed;
+    Test* m_currentTest;
+
+    std::map<std::string, CreateTestFunction> m_createTestFunctions;
+};
+
+} // namespace TestWebKitAPI
+
+#endif // TestsController_h
diff --git a/WebKitTools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm b/WebKitTools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm
new file mode 100644
index 0000000..a9552fd
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/mac/PlatformUtilitiesMac.mm
@@ -0,0 +1,66 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformUtilities.h"
+
+#include <WebKit2/WKRetainPtr.h>
+#include <WebKit2/WKStringCF.h>
+#include <WebKit2/WKURLCF.h>
+#include <WebKit2/WebKit2.h>
+
+namespace TestWebKitAPI {
+namespace Util {
+
+void run(bool* done)
+{
+    while (!*done)
+        [[NSRunLoop currentRunLoop] runMode:NSDefaultRunLoopMode beforeDate:[NSDate distantFuture]];
+}
+
+WKStringRef createInjectedBundlePath()
+{
+    NSString *nsString = [[[NSBundle mainBundle] bundlePath] stringByAppendingPathComponent:@"InjectedBundle.bundle"];
+    return WKStringCreateWithCFString((CFStringRef)nsString);
+}
+
+WKURLRef createURLForResource(const char* resource, const char* extension)
+{
+    NSURL *nsURL = [[NSBundle mainBundle] URLForResource:[NSString stringWithUTF8String:resource] withExtension:[NSString stringWithUTF8String:extension]];
+    return WKURLCreateWithCFURL((CFURLRef)nsURL);
+}
+
+WKURLRef URLForNonExistentResource()
+{
+    NSURL *nsURL = [NSURL URLWithString:@"file:///does-not-exist.html"];
+    return WKURLCreateWithCFURL((CFURLRef)nsURL);
+}
+
+bool isKeyDown(WKNativeEventPtr event)
+{
+    return [event type] == NSKeyDown;
+}
+
+} // namespace Util
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/mac/PlatformWebViewMac.mm b/WebKitTools/TestWebKitAPI/mac/PlatformWebViewMac.mm
new file mode 100644
index 0000000..d4c31eb
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/mac/PlatformWebViewMac.mm
@@ -0,0 +1,97 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformWebView.h"
+
+#import <Carbon/Carbon.h>
+
+namespace TestWebKitAPI {
+
+PlatformWebView::PlatformWebView(WKPageNamespaceRef namespaceRef)
+{
+    NSRect rect = NSMakeRect(0, 0, 800, 600);
+    m_view = [[WKView alloc] initWithFrame:rect pageNamespaceRef:namespaceRef];
+
+    NSRect windowRect = NSOffsetRect(rect, -10000, [[[NSScreen screens] objectAtIndex:0] frame].size.height - rect.size.height + 10000);
+    m_window = [[NSWindow alloc] initWithContentRect:windowRect styleMask:NSBorderlessWindowMask backing:NSBackingStoreBuffered defer:YES];
+    [m_window setColorSpace:[[NSScreen mainScreen] colorSpace]];
+    [[m_window contentView] addSubview:m_view];
+    [m_window orderBack:nil];
+    [m_window setAutodisplay:NO];
+    [m_window setReleasedWhenClosed:NO];
+}
+
+void PlatformWebView::resizeTo(unsigned width, unsigned height)
+{
+    [m_view setFrame:NSMakeRect(0, 0, width, height)];
+}
+
+PlatformWebView::~PlatformWebView()
+{
+    [m_window close];
+    [m_window release];
+    [m_view release];
+}
+
+WKPageRef PlatformWebView::page()
+{
+    return [m_view pageRef];
+}
+
+void PlatformWebView::focus()
+{
+    // Implement.
+}
+
+void PlatformWebView::simulateSpacebarKeyPress()
+{
+    NSEvent *event = [NSEvent keyEventWithType:NSKeyDown
+                                      location:NSMakePoint(5, 5)
+                                 modifierFlags:0
+                                     timestamp:GetCurrentEventTime()
+                                  windowNumber:[m_window windowNumber]
+                                       context:[NSGraphicsContext currentContext]
+                                    characters:@" "
+                   charactersIgnoringModifiers:@" "
+                                     isARepeat:NO
+                                       keyCode:0x31];
+
+    [m_view keyDown:event];
+
+    event = [NSEvent keyEventWithType:NSKeyUp
+                             location:NSMakePoint(5, 5)
+                        modifierFlags:0
+                            timestamp:GetCurrentEventTime()
+                         windowNumber:[m_window windowNumber]
+                              context:[NSGraphicsContext currentContext]
+                           characters:@" "
+          charactersIgnoringModifiers:@" "
+                            isARepeat:NO
+                              keyCode:0x31];
+
+    [m_view keyUp:event];
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/mac/main.mm b/WebKitTools/TestWebKitAPI/mac/main.mm
new file mode 100644
index 0000000..e6dd4a6
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/mac/main.mm
@@ -0,0 +1,45 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#import "TestsController.h"
+
+int main(int argc, const char* argv[])
+{
+    NSAutoreleasePool *pool = [[NSAutoreleasePool alloc] init];
+
+    [NSApplication sharedApplication];
+
+    bool passed = true;
+
+    std::string argument(argv[1]);
+    if (argument == "--dump-tests")
+        TestWebKitAPI::TestsController::shared().dumpTestNames();
+    else   
+        passed = TestWebKitAPI::TestsController::shared().runTestNamed(argument);
+
+    [pool drain];
+
+    return passed ? EXIT_SUCCESS : EXIT_FAILURE;
+}
diff --git a/WebKitTools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp b/WebKitTools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
new file mode 100644
index 0000000..17d8dad
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/PlatformUtilitiesWin.cpp
@@ -0,0 +1,85 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformUtilities.h"
+
+#include <WebKit2/WKStringCF.h>
+#include <WebKit2/WKURLCF.h>
+#include <wtf/RetainPtr.h>
+
+namespace TestWebKitAPI {
+namespace Util {
+
+#if !defined(NDEBUG) && (!defined(DEBUG_INTERNAL) || defined(DEBUG_ALL))
+const char* injectedBundleDLL = "\\InjectedBundle_debug.dll";
+#else
+const char* injectedBundleDLL = "\\InjectedBundle.dll";
+#endif
+
+void run(bool* done)
+{
+    while (!*done) {
+        MSG msg;
+        BOOL result = ::GetMessageW(&msg, 0, 0, 0);
+        if (!result || result == -1)
+            break;
+        ::TranslateMessage(&msg);
+        ::DispatchMessage(&msg);
+    }
+}
+
+RetainPtr<CFStringRef> cf(const char* utf8String)
+{
+    return RetainPtr<CFStringRef>(AdoptCF, CFStringCreateWithCString(kCFAllocatorDefault, utf8String, kCFStringEncodingUTF8));
+}
+
+WKStringRef createInjectedBundlePath()
+{
+    RetainPtr<CFURLRef> executableURL(AdoptCF, CFBundleCopyExecutableURL(CFBundleGetMainBundle()));
+    RetainPtr<CFURLRef> executableContainerURL(AdoptCF, CFURLCreateCopyDeletingLastPathComponent(0, executableURL.get()));
+    RetainPtr<CFStringRef> dllFilename(AdoptCF, CFStringCreateWithCStringNoCopy(0, injectedBundleDLL, kCFStringEncodingWindowsLatin1, 0));
+    RetainPtr<CFURLRef> bundleURL(AdoptCF, CFURLCreateCopyAppendingPathComponent(0, executableContainerURL.get(), dllFilename.get(), false));
+    RetainPtr<CFStringRef> bundlePath(AdoptCF, CFURLCopyFileSystemPath(bundleURL.get(), kCFURLWindowsPathStyle));
+    return WKStringCreateWithCFString(bundlePath.get());
+}
+
+WKURLRef createURLForResource(const char* resource, const char* extension)
+{
+    RetainPtr<CFURLRef> url(AdoptCF, CFBundleCopyResourceURL(CFBundleGetMainBundle(), cf(resource).get(), cf(extension).get(), 0));
+    return WKURLCreateWithCFURL(url.get());
+}
+
+WKURLRef URLForNonExistentResource()
+{
+    return WKURLCreateWithUTF8CString("file:///does-not-exist.html");
+}
+
+bool isKeyDown(WKNativeEventPtr event)
+{
+    return event->message == WM_KEYDOWN;
+}
+
+} // namespace Util
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/win/PlatformWebViewWin.cpp b/WebKitTools/TestWebKitAPI/win/PlatformWebViewWin.cpp
new file mode 100644
index 0000000..65bdbc6
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/PlatformWebViewWin.cpp
@@ -0,0 +1,118 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformWebView.h"
+
+#include "WindowMessageObserver.h"
+
+namespace TestWebKitAPI {
+
+static const wchar_t* hostWindowClassName = L"org.WebKit.TestWebKitAPI.PlatformWebViewHostWindow";
+static const wchar_t* webViewPointerProperty = L"org.WebKit.TestWebKitAPI.PlatformWebView.InstancePointer";
+
+// These offsets come from rom <http://msdn.microsoft.com/en-us/library/ms646280(VS.85).aspx>.
+static const size_t repeatCountBitOffset = 0;
+static const size_t scanCodeBitOffset = 16;
+static const size_t contextCodeBitOffset = 29;
+static const size_t previousStateBitOffset = 30;
+static const size_t transitionStateBitOffset = 31;
+
+void PlatformWebView::registerWindowClass()
+{
+    static bool initialized;
+    if (initialized)
+        return;
+    initialized = true;
+
+    WNDCLASSEXW wndClass = {0};
+    wndClass.cbSize = sizeof(wndClass);
+    wndClass.style = CS_HREDRAW | CS_VREDRAW;
+    wndClass.lpfnWndProc = wndProc;
+    wndClass.hCursor = LoadCursor(0, IDC_ARROW);
+    wndClass.lpszClassName = hostWindowClassName;
+
+    ::RegisterClassExW(&wndClass);
+}
+
+PlatformWebView::PlatformWebView(WKPageNamespaceRef namespaceRef)
+    : m_parentWindowMessageObserver(0)
+{
+    registerWindowClass();
+
+    RECT viewRect = {0, 0, 800, 600};
+    m_window = CreateWindowExW(0, hostWindowClassName, L"TestWebKitAPI", WS_OVERLAPPEDWINDOW, viewRect.left, viewRect.top, viewRect.right, viewRect.bottom, 0, 0, 0, this);
+    m_view = WKViewCreate(viewRect, namespaceRef, m_window);
+}
+
+PlatformWebView::~PlatformWebView()
+{
+    ::DestroyWindow(m_window);
+    WKRelease(m_view);
+}
+
+WKPageRef PlatformWebView::page()
+{
+    return WKViewGetPage(m_view);
+}
+
+void PlatformWebView::simulateSpacebarKeyPress()
+{
+    HWND window = WKViewGetWindow(m_view);
+
+    // These values match what happens when you press the spacebar in Notepad, as observed by Spy++.
+    ::SendMessageW(window, WM_KEYDOWN, VK_SPACE, (1 << repeatCountBitOffset) | (39 << scanCodeBitOffset));
+    ::SendMessageW(window, WM_CHAR, ' ', (1 << repeatCountBitOffset) | (39 << scanCodeBitOffset));
+    ::SendMessageW(window, WM_KEYUP, VK_SPACE, (1 << repeatCountBitOffset) | (39 << scanCodeBitOffset) | (1 << previousStateBitOffset) | (1 << transitionStateBitOffset));
+}
+
+void PlatformWebView::simulateAltKeyPress()
+{
+    HWND window = WKViewGetWindow(m_view);
+
+    // These values match what happens when you press the Alt key in Notepad, as observed by Spy++.
+    ::SendMessageW(window, WM_SYSKEYDOWN, VK_MENU, (1 << repeatCountBitOffset) | (38 << scanCodeBitOffset) | (1 << contextCodeBitOffset));
+    ::SendMessageW(window, WM_SYSKEYUP, VK_MENU, (1 << repeatCountBitOffset) | (38 << scanCodeBitOffset) | (1 << previousStateBitOffset) | (1 << transitionStateBitOffset));
+}
+
+LRESULT PlatformWebView::wndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam)
+{
+    PlatformWebView* webView;
+    if (message == WM_CREATE) {
+        CREATESTRUCT* createStruct = reinterpret_cast<CREATESTRUCT*>(lParam);
+        webView = static_cast<PlatformWebView*>(createStruct->lpCreateParams);
+        ::SetPropW(hWnd, webViewPointerProperty, webView);
+    } else
+        webView = reinterpret_cast<PlatformWebView*>(::GetPropW(hWnd, webViewPointerProperty));
+
+    if (webView && webView->m_parentWindowMessageObserver)
+        webView->m_parentWindowMessageObserver->windowReceivedMessage(hWnd, message, wParam, lParam);
+
+    if (message == WM_NCDESTROY)
+        ::RemovePropW(hWnd, webViewPointerProperty);
+
+    return ::DefWindowProcW(hWnd, message, wParam, lParam);
+}
+
+} // namespace TestWebKitAPI
diff --git a/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.sln b/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.sln
new file mode 100644
index 0000000..e323372
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.sln
@@ -0,0 +1,54 @@
+

+Microsoft Visual Studio Solution File, Format Version 9.00

+# Visual Studio 2005

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestWebKitAPI", "TestWebKitAPI.vcproj", "{3E48AB23-D249-488F-A1C4-43CDF52FBD28}"

+	ProjectSection(ProjectDependencies) = postProject

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86} = {45C45411-7F0E-404D-919A-4EE9BB60BE86}

+	EndProjectSection

+EndProject

+Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TestWebKitAPIGenerated", "TestWebKitAPIGenerated.vcproj", "{45C45411-7F0E-404D-919A-4EE9BB60BE86}"

+EndProject

+Global

+	GlobalSection(SolutionConfigurationPlatforms) = preSolution

+		all|Win32 = all|Win32

+		Debug_All|Win32 = Debug_All|Win32

+		Debug_CFLite|Win32 = Debug_CFLite|Win32

+		Debug_Internal|Win32 = Debug_Internal|Win32

+		Debug|Win32 = Debug|Win32

+		Release_CFLite|Win32 = Release_CFLite|Win32

+		Release|Win32 = Release|Win32

+	EndGlobalSection

+	GlobalSection(ProjectConfigurationPlatforms) = postSolution

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.all|Win32.ActiveCfg = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.all|Win32.Build.0 = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_All|Win32.ActiveCfg = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_All|Win32.Build.0 = Debug_All|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_CFLite|Win32.ActiveCfg = Debug_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_CFLite|Win32.Build.0 = Debug_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Internal|Win32.ActiveCfg = Debug_Internal|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug_Internal|Win32.Build.0 = Debug_Internal|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.ActiveCfg = Debug|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Debug|Win32.Build.0 = Debug|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_CFLite|Win32.ActiveCfg = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release_CFLite|Win32.Build.0 = Release_CFLite|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.ActiveCfg = Release|Win32

+		{3E48AB23-D249-488F-A1C4-43CDF52FBD28}.Release|Win32.Build.0 = Release|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.all|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.all|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_All|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_CFLite|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_CFLite|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Internal|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug_Internal|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Debug|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_CFLite|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release_CFLite|Win32.Build.0 = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.ActiveCfg = all|Win32

+		{45C45411-7F0E-404D-919A-4EE9BB60BE86}.Release|Win32.Build.0 = all|Win32

+	EndGlobalSection

+	GlobalSection(SolutionProperties) = preSolution

+		HideSolutionNode = FALSE

+	EndGlobalSection

+EndGlobal

diff --git a/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.vcproj b/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.vcproj
new file mode 100644
index 0000000..44bf963
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/TestWebKitAPI.vcproj
@@ -0,0 +1,516 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="TestWebKitAPI"

+	ProjectGUID="{3E48AB23-D249-488F-A1C4-43CDF52FBD28}"

+	RootNamespace="TestWebKitAPI"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="Debug|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_Internal|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_All|Win32"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_internal.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_all.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICoreFoundation.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Debug_CFLite|Win32"

+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"

+			IntermediateDirectory="$(ConfigurationName)"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\debug_wincairo.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICFLite.vsprops"

+			CharacterSet="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+		<Configuration

+			Name="Release_CFLite|Win32"

+			OutputDirectory="$(SolutionDir)$(ConfigurationName)"

+			IntermediateDirectory="$(ConfigurationName)"

+			ConfigurationType="1"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops;$(WebKitLibrariesDir)\tools\vsprops\release.vsprops;..\Configurations\TestWebKitAPICommon.vsprops;..\Configurations\TestWebKitAPICFLite.vsprops"

+			CharacterSet="1"

+			WholeProgramOptimization="1"

+			>

+			<Tool

+				Name="VCPreBuildEventTool"

+			/>

+			<Tool

+				Name="VCCustomBuildTool"

+			/>

+			<Tool

+				Name="VCXMLDataGeneratorTool"

+			/>

+			<Tool

+				Name="VCWebServiceProxyGeneratorTool"

+			/>

+			<Tool

+				Name="VCMIDLTool"

+			/>

+			<Tool

+				Name="VCCLCompilerTool"

+			/>

+			<Tool

+				Name="VCManagedResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCResourceCompilerTool"

+			/>

+			<Tool

+				Name="VCPreLinkEventTool"

+			/>

+			<Tool

+				Name="VCLinkerTool"

+			/>

+			<Tool

+				Name="VCALinkTool"

+			/>

+			<Tool

+				Name="VCManifestTool"

+			/>

+			<Tool

+				Name="VCXDCMakeTool"

+			/>

+			<Tool

+				Name="VCBscMakeTool"

+			/>

+			<Tool

+				Name="VCFxCopTool"

+			/>

+			<Tool

+				Name="VCAppVerifierTool"

+			/>

+			<Tool

+				Name="VCWebDeploymentTool"

+			/>

+			<Tool

+				Name="VCPostBuildEventTool"

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<Filter

+			Name="win"

+			>

+			<File

+				RelativePath=".\main.cpp"

+				>

+			</File>

+			<File

+				RelativePath=".\PlatformUtilitiesWin.cpp"

+				>

+			</File>

+			<File

+				RelativePath=".\PlatformWebViewWin.cpp"

+				>

+			</File>

+			<File

+				RelativePath=".\WindowMessageObserver.h"

+				>

+			</File>

+		</Filter>

+		<Filter

+			Name="Tests"

+			>

+			<Filter

+				Name="WebKit2"

+				>

+				<File

+					RelativePath="..\Tests\WebKit2\FailedLoad.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\Find.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\find.html"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\FrameMIMETypeHTML.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\FrameMIMETypePNG.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\icon.png"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\PageLoadBasic.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\simple.html"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\spacebar-scrolling.html"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\SpacebarScrolling.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\WKString.cpp"

+					>

+				</File>

+				<File

+					RelativePath="..\Tests\WebKit2\WKStringJSString.cpp"

+					>

+				</File>

+				<Filter

+					Name="win"

+					>

+					<File

+						RelativePath="..\Tests\WebKit2\win\AltKeyGeneratesWMSysCommand.cpp"

+						>

+					</File>

+				</Filter>

+			</Filter>

+			<Filter

+				Name="WTF"

+				>

+				<File

+					RelativePath="..\Tests\WTF\VectorBasic.cpp"

+					>

+				</File>

+			</Filter>

+		</Filter>

+		<File

+			RelativePath="..\PlatformUtilities.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\PlatformUtilities.h"

+			>

+		</File>

+		<File

+			RelativePath="..\PlatformWebView.h"

+			>

+		</File>

+		<File

+			RelativePath="..\Test.h"

+			>

+		</File>

+		<File

+			RelativePath="..\TestsController.cpp"

+			>

+		</File>

+		<File

+			RelativePath="..\TestsController.h"

+			>

+		</File>

+		<File

+			RelativePath="..\TestWebKitAPIPrefix.h"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebKitTools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj b/WebKitTools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj
new file mode 100644
index 0000000..ce5afeb
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/TestWebKitAPIGenerated.vcproj
@@ -0,0 +1,47 @@
+<?xml version="1.0" encoding="Windows-1252"?>

+<VisualStudioProject

+	ProjectType="Visual C++"

+	Version="8.00"

+	Name="TestWebKitAPIGenerated"

+	ProjectGUID="{45C45411-7F0E-404D-919A-4EE9BB60BE86}"

+	Keyword="MakeFileProj"

+	>

+	<Platforms>

+		<Platform

+			Name="Win32"

+		/>

+	</Platforms>

+	<ToolFiles>

+	</ToolFiles>

+	<Configurations>

+		<Configuration

+			Name="all|Win32"

+			ConfigurationType="0"

+			InheritedPropertySheets="$(WebKitLibrariesDir)\tools\vsprops\common.vsprops"

+			>

+			<Tool

+				Name="VCNMakeTool"

+				BuildCommandLine="copy-resources.cmd"

+				ReBuildCommandLine="copy-resources.cmd rebuild"

+				CleanCommandLine="copy-resources.cmd clean"

+				Output=""

+				PreprocessorDefinitions=""

+				IncludeSearchPath=""

+				ForcedIncludes=""

+				AssemblySearchPath=""

+				ForcedUsingAssemblies=""

+				CompileAsManaged=""

+			/>

+		</Configuration>

+	</Configurations>

+	<References>

+	</References>

+	<Files>

+		<File

+			RelativePath=".\copy-resources.cmd"

+			>

+		</File>

+	</Files>

+	<Globals>

+	</Globals>

+</VisualStudioProject>

diff --git a/WebKitTools/TestWebKitAPI/win/WindowMessageObserver.h b/WebKitTools/TestWebKitAPI/win/WindowMessageObserver.h
new file mode 100644
index 0000000..3388816
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/WindowMessageObserver.h
@@ -0,0 +1,41 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#ifndef WindowMessageObserver_h
+#define WindowMessageObserver_h
+
+namespace TestWebKitAPI {
+
+class WindowMessageObserver {
+public:
+    virtual void windowReceivedMessage(HWND, UINT message, WPARAM, LPARAM) = 0;
+
+protected:
+    virtual ~WindowMessageObserver() { }
+};
+
+} // namespace TestWebKitAPI
+
+#endif // WindowMessageObserver_h
diff --git a/WebKitTools/TestWebKitAPI/win/copy-resources.cmd b/WebKitTools/TestWebKitAPI/win/copy-resources.cmd
new file mode 100755
index 0000000..a5b8406
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/copy-resources.cmd
@@ -0,0 +1,24 @@
+@echo off
+
+set ResourcesDirectory=%WebKitOutputDir%\bin\TestWebKitAPI.resources
+
+if "%1" EQU "clean" goto :clean
+if "%1" EQU "rebuild" call :clean
+
+echo Copying resources...
+mkdir 2>NUL "%ResourcesDirectory%"
+for %%f in (
+    ..\Tests\WebKit2\find.html
+    ..\Tests\WebKit2\icon.png
+    ..\Tests\WebKit2\simple.html
+    ..\Tests\WebKit2\spacebar-scrolling.html
+) do (
+    xcopy /y /d %%f "%ResourcesDirectory%"
+)
+
+goto :EOF
+
+:clean
+
+echo Deleting resources...
+del /s /q "%ResourcesDirectory%"
diff --git a/WebKitTools/TestWebKitAPI/win/main.cpp b/WebKitTools/TestWebKitAPI/win/main.cpp
new file mode 100644
index 0000000..3091819
--- /dev/null
+++ b/WebKitTools/TestWebKitAPI/win/main.cpp
@@ -0,0 +1,39 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "TestsController.h"
+
+int main(int argc, const char* argv[])
+{
+    bool passed = true;
+
+    std::string argument(argv[1]);
+    if (argument == "--dump-tests")
+        TestWebKitAPI::TestsController::shared().dumpTestNames();
+    else   
+        passed = TestWebKitAPI::TestsController::shared().runTestNamed(argument);
+
+    return passed ? EXIT_SUCCESS : EXIT_FAILURE;
+}
diff --git a/WebKitTools/WebKitTestRunner/Configurations/Base.xcconfig b/WebKitTools/WebKitTestRunner/Configurations/Base.xcconfig
index 7ceab07..feabe9a 100644
--- a/WebKitTools/WebKitTestRunner/Configurations/Base.xcconfig
+++ b/WebKitTools/WebKitTestRunner/Configurations/Base.xcconfig
@@ -21,7 +21,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. 
 
-HEADER_SEARCH_PATHS = ForwardingHeaders;
+HEADER_SEARCH_PATHS = $(WEBCORE_PRIVATE_HEADERS_DIR)/ForwardingHeaders;
 FRAMEWORK_SEARCH_PATHS = $(SYSTEM_LIBRARY_DIR)/Frameworks/Quartz.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/ApplicationServices.framework/Frameworks $(SYSTEM_LIBRARY_DIR)/Frameworks/CoreServices.framework/Frameworks;
 GCC_PREPROCESSOR_DEFINITIONS = ENABLE_DASHBOARD_SUPPORT WEBKIT_VERSION_MIN_REQUIRED=WEBKIT_VERSION_LATEST;
 DEBUG_INFORMATION_FORMAT = dwarf
diff --git a/WebKitTools/WebKitTestRunner/DerivedSources.pro b/WebKitTools/WebKitTestRunner/DerivedSources.pro
new file mode 100644
index 0000000..bab70cc
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/DerivedSources.pro
@@ -0,0 +1,57 @@
+# DerivedSources - qmake build info
+
+CONFIG -= debug_and_release
+
+TEMPLATE = lib
+TARGET = dummy
+
+QMAKE_EXTRA_TARGETS += generated_files
+
+GENERATED_SOURCES_DIR = generated
+
+IDL_BINDINGS += \
+    InjectedBundle/Bindings/EventSendingController.idl \
+    InjectedBundle/Bindings/GCController.idl \
+    InjectedBundle/Bindings/LayoutTestController.idl \
+
+defineTest(addExtraCompiler) {
+    eval($${1}.CONFIG = target_predeps no_link)
+    eval($${1}.variable_out =)
+    eval($${1}.dependency_type = TYPE_C)
+
+    wkScript = $$eval($${1}.wkScript)
+    eval($${1}.depends += $$wkScript)
+
+    export($${1}.CONFIG)
+    export($${1}.variable_out)
+    export($${1}.dependency_type)
+    export($${1}.depends)
+
+    QMAKE_EXTRA_COMPILERS += $$1
+    generated_files.depends += compiler_$${1}_make_all
+    export(QMAKE_EXTRA_COMPILERS)
+    export(generated_files.depends)
+    return(true)
+}
+
+SRC_ROOT_DIR = $$replace(PWD, /WebKitTools/WebKitTestRunner, /)
+
+# Make sure forwarded headers needed by this project are present
+fwheader_generator.commands = perl $${SRC_ROOT_DIR}/WebKitTools/Scripts/generate-forwarding-headers.pl $${SRC_ROOT_DIR}/WebKitTools/WebKitTestRunner $${OUTPUT_DIR}/include qt
+fwheader_generator.depends  = $${SRC_ROOT_DIR}/WebKitTools/Scripts/generate-forwarding-headers.pl
+generated_files.depends     += fwheader_generator
+QMAKE_EXTRA_TARGETS         += fwheader_generator
+
+# GENERATOR 1: IDL compiler
+idl.output = $${GENERATED_SOURCES_DIR}/JS${QMAKE_FILE_BASE}.cpp
+idl.input = IDL_BINDINGS
+idl.wkScript = $$PWD/../../WebCore/bindings/scripts/generate-bindings.pl
+idl.commands = perl -I$$PWD/../../WebCore/bindings/scripts -I$$PWD/InjectedBundle/Bindings $$idl.wkScript --defines \"\" --generator TestRunner --include $$PWD/InjectedBundle/Bindings --outputDir $$GENERATED_SOURCES_DIR --preprocessor \"$${QMAKE_MOC} -E\" ${QMAKE_FILE_NAME}
+idl.depends = $$PWD/../../WebCore/bindings/scripts/CodeGenerator.pm \
+              $$PWD/InjectedBundle/Bindings/CodeGeneratorTestRunner.pm \
+              $$PWD/../../WebCore/bindings/scripts/IDLParser.pm \
+              $$PWD/../../WebCore/bindings/scripts/IDLStructure.pm \
+              $$PWD/../../WebCore/bindings/scripts/InFilesParser.pm \
+              $$PWD/../../WebCore/bindings/scripts/generate-bindings.pl
+addExtraCompiler(idl)
+
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h
deleted file mode 100644
index f2258d2..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ASCIICType.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ASCIICType.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h
deleted file mode 100644
index 2144410..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Assertions.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Assertions.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h
deleted file mode 100644
index 37b1892..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Atomics.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Atomics.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h
deleted file mode 100644
index 1701231..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/FastMalloc.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/FastMalloc.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/GetPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/GetPtr.h
deleted file mode 100644
index aedd784..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/GetPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/GetPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h
deleted file mode 100644
index 9f262e2..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashMap.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/HashMap.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h
deleted file mode 100644
index cfe2d80..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashSet.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/HashSet.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h
deleted file mode 100644
index 412fa98..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/HashTraits.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/HashTraits.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h
deleted file mode 100644
index 75b0acd..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Locker.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Locker.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h
deleted file mode 100644
index ff75971..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MainThread.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/MainThread.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h
deleted file mode 100644
index 2955786..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/MathExtras.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/MathExtras.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h
deleted file mode 100644
index f8484d2..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Noncopyable.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Noncopyable.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h
deleted file mode 100644
index 9211d38..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/OwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h
deleted file mode 100644
index 6064e88..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/OwnPtrCommon.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/PassOwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h
deleted file mode 100644
index 6064e88..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassOwnPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/PassOwnPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h
deleted file mode 100644
index aafd1a2..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/PassRefPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/PassRefPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h
deleted file mode 100644
index 3b22955..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Platform.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Platform.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h
deleted file mode 100644
index 628a63b..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefCounted.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/RefCounted.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h
deleted file mode 100644
index 0ff6213..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RefPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/RefPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h
deleted file mode 100644
index 65fc27b..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/RetainPtr.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/RetainPtr.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h
deleted file mode 100644
index 063d500..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/StringExtras.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/StringExtras.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h
deleted file mode 100644
index 4a7a77f..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadSafeShared.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ThreadSafeShared.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h
deleted file mode 100644
index 17359e5..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Threading.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Threading.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h
deleted file mode 100644
index a7ee117..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/ThreadingPrimitives.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/ThreadingPrimitives.h>
diff --git a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h b/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h
deleted file mode 100644
index c6d15fd..0000000
--- a/WebKitTools/WebKitTestRunner/ForwardingHeaders/wtf/Vector.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <JavaScriptCore/Vector.h>
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/Bindings/JSWrappable.h b/WebKitTools/WebKitTestRunner/InjectedBundle/Bindings/JSWrappable.h
index 9cb97af..5ec7197 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/Bindings/JSWrappable.h
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/Bindings/JSWrappable.h
@@ -26,7 +26,7 @@
 #ifndef JSWrappable_h
 #define JSWrappable_h
 
-#include <JavaScriptCore/JavaScriptCore.h>
+#include <JavaScriptCore/JavaScript.h>
 #include <wtf/RefCounted.h>
 
 namespace WTR {
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
index ecc302f..af8bb69 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.cpp
@@ -32,10 +32,8 @@
 #include <WebKit2/WKBundlePagePrivate.h>
 #include <WebKit2/WKBundlePrivate.h>
 #include <WebKit2/WKRetainPtr.h>
-#include <WebKit2/WKStringCF.h>
 #include <WebKit2/WebKit2.h>
 #include <wtf/PassOwnPtr.h>
-#include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
 
 namespace WTR {
@@ -105,18 +103,19 @@ void InjectedBundle::willDestroyPage(WKBundlePageRef page)
 
 void InjectedBundle::didReceiveMessage(WKStringRef messageName, WKTypeRef messageBody)
 {
-    CFStringRef cfMessage = WKStringCopyCFString(0, messageName);
-    if (CFEqual(cfMessage, CFSTR("BeginTest"))) {
-        WKRetainPtr<WKStringRef> ackMessageName(AdoptWK, WKStringCreateWithCFString(CFSTR("Ack")));
-        WKRetainPtr<WKStringRef> ackMessageBody(AdoptWK, WKStringCreateWithCFString(CFSTR("BeginTest")));
+    if (WKStringIsEqualToUTF8CString(messageName, "BeginTest")) {
+        ASSERT(!messageBody);
+
+        WKRetainPtr<WKStringRef> ackMessageName(AdoptWK, WKStringCreateWithUTF8CString("Ack"));
+        WKRetainPtr<WKStringRef> ackMessageBody(AdoptWK, WKStringCreateWithUTF8CString("BeginTest"));
         WKBundlePostMessage(m_bundle, ackMessageName.get(), ackMessageBody.get());
 
         beginTesting();
         return;
     }
 
-    WKRetainPtr<WKStringRef> errorMessageName(AdoptWK, WKStringCreateWithCFString(CFSTR("Error")));
-    WKRetainPtr<WKStringRef> errorMessageBody(AdoptWK, WKStringCreateWithCFString(CFSTR("Unknown")));
+    WKRetainPtr<WKStringRef> errorMessageName(AdoptWK, WKStringCreateWithUTF8CString("Error"));
+    WKRetainPtr<WKStringRef> errorMessageBody(AdoptWK, WKStringCreateWithUTF8CString("Unknown"));
     WKBundlePostMessage(m_bundle, errorMessageName.get(), errorMessageBody.get());
 }
 
@@ -140,13 +139,12 @@ void InjectedBundle::beginTesting()
 
 void InjectedBundle::done()
 {
-    m_mainPage->stopLoading();
+    m_state = Stopping;
 
-    WKRetainPtr<WKStringRef> doneMessageName(AdoptWK, WKStringCreateWithCFString(CFSTR("Done")));
+    m_mainPage->stopLoading();
 
-    std::string output = m_outputStream.str();
-    RetainPtr<CFStringRef> outputCFString(AdoptCF, CFStringCreateWithCString(0, output.c_str(), kCFStringEncodingUTF8));
-    WKRetainPtr<WKStringRef> doneMessageBody(AdoptWK, WKStringCreateWithCFString(outputCFString.get()));
+    WKRetainPtr<WKStringRef> doneMessageName(AdoptWK, WKStringCreateWithUTF8CString("Done"));
+    WKRetainPtr<WKStringRef> doneMessageBody(AdoptWK, WKStringCreateWithUTF8CString(m_outputStream.str().c_str()));
 
     WKBundlePostMessage(m_bundle, doneMessageName.get(), doneMessageBody.get());
 
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
index 520ea1f..6c5c69e 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundle.h
@@ -88,7 +88,8 @@ private:
     
     enum State {
         Idle,
-        Testing
+        Testing,
+        Stopping
     };
     State m_state;
 };
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
index 32b92cb..22af6ff 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.cpp
@@ -27,6 +27,7 @@
 
 #include "InjectedBundle.h"
 #include "StringFunctions.h"
+#include <cmath>
 #include <JavaScriptCore/JSRetainPtr.h>
 #include <WebKit2/WKArray.h>
 #include <WebKit2/WKBundleFrame.h>
@@ -240,9 +241,9 @@ void InjectedBundlePage::didReceiveServerRedirectForProvisionalLoadForFrame(WKBu
     static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didReceiveServerRedirectForProvisionalLoadForFrame(frame);
 }
 
-void InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef*, const void *clientInfo)
+void InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, WKErrorRef error, WKTypeRef*, const void *clientInfo)
 {
-    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailProvisionalLoadWithErrorForFrame(frame);
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailProvisionalLoadWithErrorForFrame(frame, error);
 }
 
 void InjectedBundlePage::didCommitLoadForFrame(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef*, const void *clientInfo)
@@ -260,9 +261,9 @@ void InjectedBundlePage::didFinishDocumentLoadForFrame(WKBundlePageRef page, WKB
     static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFinishDocumentLoadForFrame(frame);
 }
 
-void InjectedBundlePage::didFailLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, WKTypeRef*, const void *clientInfo)
+void InjectedBundlePage::didFailLoadWithErrorForFrame(WKBundlePageRef page, WKBundleFrameRef frame, WKErrorRef error, WKTypeRef*, const void *clientInfo)
 {
-    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailLoadWithErrorForFrame(frame);
+    static_cast<InjectedBundlePage*>(const_cast<void*>(clientInfo))->didFailLoadWithErrorForFrame(frame, error);
 }
 
 void InjectedBundlePage::didReceiveTitleForFrame(WKBundlePageRef page, WKStringRef title, WKBundleFrameRef frame, WKTypeRef*, const void *clientInfo)
@@ -319,7 +320,7 @@ void InjectedBundlePage::didReceiveServerRedirectForProvisionalLoadForFrame(WKBu
 {
 }
 
-void InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef frame)
+void InjectedBundlePage::didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef frame, WKErrorRef error)
 {
 }
 
@@ -433,7 +434,7 @@ void InjectedBundlePage::didFinishLoadForFrame(WKBundleFrameRef frame)
     dump();
 }
 
-void InjectedBundlePage::didFailLoadWithErrorForFrame(WKBundleFrameRef frame)
+void InjectedBundlePage::didFailLoadWithErrorForFrame(WKBundleFrameRef frame, WKErrorRef)
 {
     if (!InjectedBundle::shared().isTestRunning())
         return;
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
index c814c85..737ad18 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/InjectedBundlePage.h
@@ -49,11 +49,11 @@ private:
     // Loader Client
     static void didStartProvisionalLoadForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
     static void didReceiveServerRedirectForProvisionalLoadForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
-    static void didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
+    static void didFailProvisionalLoadWithErrorForFrame(WKBundlePageRef, WKBundleFrameRef, WKErrorRef, WKTypeRef*, const void*);
     static void didCommitLoadForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
     static void didFinishLoadForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
     static void didFinishDocumentLoadForFrame(WKBundlePageRef, WKBundleFrameRef,  WKTypeRef*, const void*);
-    static void didFailLoadWithErrorForFrame(WKBundlePageRef, WKBundleFrameRef, WKTypeRef*, const void*);
+    static void didFailLoadWithErrorForFrame(WKBundlePageRef, WKBundleFrameRef, WKErrorRef, WKTypeRef*, const void*);
     static void didReceiveTitleForFrame(WKBundlePageRef, WKStringRef title, WKBundleFrameRef, WKTypeRef*, const void*);
     static void didClearWindowForFrame(WKBundlePageRef, WKBundleFrameRef, WKBundleScriptWorldRef, const void*);
     static void didCancelClientRedirectForFrame(WKBundlePageRef, WKBundleFrameRef, const void*);
@@ -64,10 +64,10 @@ private:
     static void didRunInsecureContentForFrame(WKBundlePageRef, WKBundleFrameRef, const void*);
     void didStartProvisionalLoadForFrame(WKBundleFrameRef);
     void didReceiveServerRedirectForProvisionalLoadForFrame(WKBundleFrameRef);
-    void didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef);
+    void didFailProvisionalLoadWithErrorForFrame(WKBundleFrameRef, WKErrorRef);
     void didCommitLoadForFrame(WKBundleFrameRef);
     void didFinishLoadForFrame(WKBundleFrameRef);
-    void didFailLoadWithErrorForFrame(WKBundleFrameRef);
+    void didFailLoadWithErrorForFrame(WKBundleFrameRef, WKErrorRef);
     void didReceiveTitleForFrame(WKStringRef title, WKBundleFrameRef);
     void didClearWindowForFrame(WKBundleFrameRef, WKBundleScriptWorldRef);
     void didCancelClientRedirectForFrame(WKBundleFrameRef);
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
index 6ae20d8..c892ba0 100644
--- a/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/LayoutTestController.h
@@ -28,9 +28,18 @@
 
 #include "JSWrappable.h"
 #include <JavaScriptCore/JSRetainPtr.h>
+#include <string>
 #include <wtf/PassRefPtr.h>
+
+#if PLATFORM(MAC)
 #include <wtf/RetainPtr.h>
-#include <string>
+typedef RetainPtr<CFRunLoopTimerRef> PlatformTimerRef;
+#elif PLATFORM(WIN)
+typedef UINT_PTR PlatformTimerRef;
+#elif PLATFORM(QT)
+#include <QTimer>
+typedef QTimer PlatformTimerRef;
+#endif
 
 namespace WTR {
 
@@ -124,11 +133,7 @@ private:
     bool m_testRepaint;
     bool m_testRepaintSweepHorizontally;
 
-#if PLATFORM(MAC)
-    RetainPtr<CFRunLoopTimerRef> m_waitToDumpWatchdogTimer;
-#elif PLATFORM(WIN)
-    UINT_PTR m_waitToDumpWatchdogTimer;
-#endif
+    PlatformTimerRef m_waitToDumpWatchdogTimer;
 };
 
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
new file mode 100644
index 0000000..ec920dc
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/ActivateFontsQt.cpp
@@ -0,0 +1,83 @@
+/*
+ * Copyright (C) 2005, 2006 Apple Computer, Inc.  All rights reserved.
+ * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ *
+ * 1.  Redistributions of source code must retain the above copyright
+ *     notice, this list of conditions and the following disclaimer.
+ * 2.  Redistributions in binary form must reproduce the above copyright
+ *     notice, this list of conditions and the following disclaimer in the
+ *     documentation and/or other materials provided with the distribution.
+ * 3.  Neither the name of Apple Computer, Inc. ("Apple") nor the names of
+ *     its contributors may be used to endorse or promote products derived
+ *     from this software without specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE AND ITS CONTRIBUTORS "AS IS" AND ANY
+ * EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+ * WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+ * DISCLAIMED. IN NO EVENT SHALL APPLE OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+ * DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+ * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+ * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
+ * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "ActivateFonts.h"
+
+#include <QByteArray>
+#include <QDir>
+
+#ifdef Q_WS_X11
+#include <fontconfig/fontconfig.h>
+#endif
+
+#include <limits.h>
+
+namespace WTR {
+
+void activateFonts()
+{
+#if defined(Q_WS_X11)
+    static int numFonts = -1;
+
+    // Some test cases may add or remove application fonts (via @font-face).
+    // Make sure to re-initialize the font set if necessary.
+    FcFontSet* appFontSet = FcConfigGetFonts(0, FcSetApplication);
+    if (appFontSet && numFonts >= 0 && appFontSet->nfont == numFonts)
+        return;
+
+    QByteArray fontDir = getenv("WEBKIT_TESTFONTS");
+    if (fontDir.isEmpty() || !QDir(fontDir).exists()) {
+        fprintf(stderr,
+                "\n\n"
+                "----------------------------------------------------------------------\n"
+                "WEBKIT_TESTFONTS environment variable is not set correctly.\n"
+                "This variable has to point to the directory containing the fonts\n"
+                "you can clone from git://gitorious.org/qtwebkit/testfonts.git\n"
+                "----------------------------------------------------------------------\n"
+               );
+        exit(1);
+    }
+    char currentPath[PATH_MAX+1];
+    if (!getcwd(currentPath, PATH_MAX))
+        qFatal("Couldn't get current working directory");
+    QByteArray configFile = currentPath;
+    FcConfig* config = FcConfigCreate();
+    configFile += "/WebKitTools/DumpRenderTree/qt/fonts.conf";
+    if (!FcConfigParseAndLoad (config, (FcChar8*) configFile.data(), true))
+        qFatal("Couldn't load font configuration file");
+    if (!FcConfigAppFontAddDir (config, (FcChar8*) fontDir.data()))
+        qFatal("Couldn't add font dir!");
+    FcConfigSetCurrent(config);
+
+    appFontSet = FcConfigGetFonts(config, FcSetApplication);
+    numFonts = appFontSet->nfont;
+#endif
+}
+
+}
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro
new file mode 100644
index 0000000..d596f33
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/InjectedBundle.pro
@@ -0,0 +1,69 @@
+TEMPLATE = lib
+
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../../..
+
+SOURCES += \
+    ../InjectedBundle.cpp \
+    ../InjectedBundle.h \
+    ../InjectedBundleMain.cpp \
+    ../InjectedBundlePage.cpp \
+    ../InjectedBundlePage.h \
+    ../EventSendingController.cpp \
+    ../EventSendingController.h \
+    ../GCController.cpp \
+    ../GCController.h \
+    ../LayoutTestController.cpp \
+    ../LayoutTestController.h \
+    ../Bindings/JSWrapper.cpp \
+    ActivateFontsQt.cpp \
+    LayoutTestControllerQt.cpp \
+    $$OUTPUT_DIR/WebKitTools/WebKitTestRunner/generated/JSEventSendingController.cpp \
+    $$OUTPUT_DIR/WebKitTools/WebKitTestRunner/generated/JSGCController.cpp \
+    $$OUTPUT_DIR/WebKitTools/WebKitTestRunner/generated/JSLayoutTestController.cpp \
+
+HEADERS += \
+    ../ActivateFonts.h \
+    ../EventSendingController.h \
+    ../GCController.h \
+    ../InjectedBundle.h \
+    ../InjectedBundlePage.h \
+    ../LayoutTestController.h \
+
+!CONFIG(release, debug|release) {
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    OBJECTS_DIR = obj/release
+}
+
+include(../../../../WebKit.pri)
+include(../../../../JavaScriptCore/JavaScriptCore.pri)
+addJavaScriptCoreLib(../../../../JavaScriptCore)
+include(../../../../WebKit2/WebKit2.pri)
+addWebKit2Lib(../../../../WebKit2)
+
+INCLUDEPATH += \
+    $$PWD \
+    $$PWD/.. \
+    $$PWD/../.. \
+    $$PWD/../Bindings \
+    $$PWD/../../../../JavaScriptCore \
+    $$PWD/../../../../JavaScriptCore/wtf \
+    $$PWD/../../../../WebKit2 \
+    $$PWD/../../../../WebKit2/Shared \
+    $$OUTPUT_DIR/WebKitTools/WebKitTestRunner/generated
+
+INCLUDEPATH += \
+    $$OUTPUT_DIR/include \
+    $$OUTPUT_DIR/WebCore/generated
+
+PREFIX_HEADER = $$PWD/../../WebKitTestRunnerPrefix.h
+QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
+
+unix:!mac {
+    CONFIG += link_pkgconfig
+    PKGCONFIG += fontconfig
+}
+
+TARGET = WTRInjectedBundle
+DESTDIR = $$OUTPUT_DIR/lib
+!CONFIG(standalone_package): CONFIG -= app_bundle
diff --git a/WebKitTools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
new file mode 100644
index 0000000..b515326
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/InjectedBundle/qt/LayoutTestControllerQt.cpp
@@ -0,0 +1,74 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "LayoutTestController.h"
+
+#include "InjectedBundle.h"
+#include <QObject>
+
+namespace WTR {
+
+class WatchdogTimerHelper : public QObject {
+    Q_OBJECT
+
+public:
+    static WatchdogTimerHelper* instance()
+    {
+        static WatchdogTimerHelper* theInstance = new WatchdogTimerHelper;
+        return theInstance;
+    }
+
+public slots:
+    void timerFired()
+    {
+        InjectedBundle::shared().layoutTestController()->waitToDumpWatchdogTimerFired();
+    }
+
+private:
+    WatchdogTimerHelper() {}
+};
+
+void LayoutTestController::platformInitialize()
+{
+    QObject::connect(&m_waitToDumpWatchdogTimer, SIGNAL(timeout()), WatchdogTimerHelper::instance(), SLOT(timerFired()));
+}
+
+void LayoutTestController::invalidateWaitToDumpWatchdogTimer()
+{
+    m_waitToDumpWatchdogTimer.stop();
+}
+
+void LayoutTestController::initializeWaitToDumpWatchdogTimerIfNeeded()
+{
+    if (m_waitToDumpWatchdogTimer.isActive())
+        return;
+
+    m_waitToDumpWatchdogTimer.start(waitToDumpWatchdogTimerInterval * 1000);
+}
+
+} // namespace WTR
+
+#include "LayoutTestControllerQt.moc"
diff --git a/WebKitTools/WebKitTestRunner/PlatformWebView.h b/WebKitTools/WebKitTestRunner/PlatformWebView.h
index 29c63ae..72de868 100644
--- a/WebKitTools/WebKitTestRunner/PlatformWebView.h
+++ b/WebKitTools/WebKitTestRunner/PlatformWebView.h
@@ -26,7 +26,14 @@
 #ifndef PlatformWebView_h
 #define PlatformWebView_h
 
-#if __APPLE__
+#if defined(BUILDING_QT__)
+namespace WTR {
+class WebView;
+}
+typedef WTR::WebView* PlatformWKView;
+class QMainWindow;
+typedef QMainWindow* PlatformWindow;
+#elif defined(__APPLE__) && __APPLE__
 #if __OBJC__
 @class WKView;
 @class NSWindow;
@@ -53,6 +60,9 @@ public:
     void resizeTo(unsigned width, unsigned height);
     void focus();
 
+    WKRect windowFrame();
+    void setWindowFrame(WKRect);
+
 private:
     PlatformWKView m_view;
     PlatformWindow m_window;
diff --git a/WebKitTools/WebKitTestRunner/StringFunctions.h b/WebKitTools/WebKitTestRunner/StringFunctions.h
index 8195606..2d0ca72 100644
--- a/WebKitTools/WebKitTestRunner/StringFunctions.h
+++ b/WebKitTools/WebKitTestRunner/StringFunctions.h
@@ -1,5 +1,6 @@
 /*
  * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
@@ -27,54 +28,35 @@
 #define StringFunctions_h
 
 #include <JavaScriptCore/JSRetainPtr.h>
-#include <JavaScriptCore/JavaScriptCore.h>
+#include <JavaScriptCore/JavaScript.h>
+#include <sstream>
+#include <string>
 #include <WebKit2/WKRetainPtr.h>
 #include <WebKit2/WKString.h>
-#include <WebKit2/WKStringCF.h>
+#include <WebKit2/WKStringPrivate.h>
 #include <WebKit2/WKURL.h>
-#include <WebKit2/WKURLCF.h>
-#include <sstream>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/PassOwnArrayPtr.h>
 #include <wtf/Platform.h>
-#include <wtf/RetainPtr.h>
 #include <wtf/Vector.h>
 
 namespace WTR {
 
 // Conversion functions
 
-inline RetainPtr<CFStringRef> toCF(JSStringRef string)
-{
-    return RetainPtr<CFStringRef>(AdoptCF, JSStringCopyCFString(0, string));
-}
-
-inline RetainPtr<CFStringRef> toCF(WKStringRef string)
-{
-    return RetainPtr<CFStringRef>(AdoptCF, WKStringCopyCFString(0, string));
-}
-
-inline RetainPtr<CFURLRef> toCF(WKURLRef url)
-{
-    return RetainPtr<CFURLRef>(AdoptCF, WKURLCopyCFURL(0, url));
-}
-
-inline RetainPtr<CFURLRef> toCF(const WKRetainPtr<WKURLRef>& url)
-{
-    return toCF(url.get());
-}
-
 inline WKRetainPtr<WKStringRef> toWK(JSStringRef string)
 {
-    return WKRetainPtr<WKStringRef>(AdoptWK, WKStringCreateWithCFString(toCF(string).get()));
+    return WKRetainPtr<WKStringRef>(AdoptWK, WKStringCreateWithJSString(string));
 }
 
 inline WKRetainPtr<WKStringRef> toWK(JSRetainPtr<JSStringRef> string)
 {
-    return WKRetainPtr<WKStringRef>(AdoptWK, WKStringCreateWithCFString(toCF(string.get()).get()));
+    return toWK(string.get());
 }
 
 inline JSRetainPtr<JSStringRef> toJS(WKStringRef string)
 {
-    return JSRetainPtr<JSStringRef>(Adopt, JSStringCreateWithCFString(toCF(string).get()));
+    return JSRetainPtr<JSStringRef>(Adopt, WKStringCopyJSString(string));
 }
 
 inline JSRetainPtr<JSStringRef> toJS(const WKRetainPtr<WKStringRef>& string)
@@ -82,29 +64,27 @@ inline JSRetainPtr<JSStringRef> toJS(const WKRetainPtr<WKStringRef>& string)
     return toJS(string.get());
 }
 
-// Streaming functions
-
-inline std::ostream& operator<<(std::ostream& out, CFStringRef stringRef)
+inline std::string toSTD(WKStringRef string)
 {
-    if (!stringRef)
-        return out;
-    CFIndex bufferLength = CFStringGetMaximumSizeForEncoding(CFStringGetLength(stringRef), kCFStringEncodingUTF8) + 1;
-    Vector<char> buffer(bufferLength);
-    if (!CFStringGetCString(stringRef, buffer.data(), bufferLength, kCFStringEncodingUTF8))
-        return out;
-    return out << buffer.data();
+    size_t bufferSize = WKStringGetMaximumUTF8CStringSize(string);
+    OwnArrayPtr<char> buffer = adoptArrayPtr(new char[bufferSize]);
+    size_t stringLength = WKStringGetUTF8CString(string, buffer.get(), bufferSize);
+    return std::string(buffer.get(), stringLength - 1);
 }
 
-inline std::ostream& operator<<(std::ostream& out, const RetainPtr<CFStringRef>& stringRef)
+inline std::string toSTD(const WKRetainPtr<WKStringRef>& string)
 {
-    return out << stringRef.get();
+    return toSTD(string.get());
 }
 
+// Streaming functions
+
 inline std::ostream& operator<<(std::ostream& out, WKStringRef stringRef)
 {
     if (!stringRef)
         return out;
-    return out << toCF(stringRef);
+
+    return out << toSTD(stringRef);
 }
 
 inline std::ostream& operator<<(std::ostream& out, const WKRetainPtr<WKStringRef>& stringRef)
@@ -112,24 +92,6 @@ inline std::ostream& operator<<(std::ostream& out, const WKRetainPtr<WKStringRef
     return out << stringRef.get();
 }
 
-// URL creation
-
-inline WKURLRef createWKURL(const char* pathOrURL)
-{
-    RetainPtr<CFStringRef> pathOrURLCFString(AdoptCF, CFStringCreateWithCString(0, pathOrURL, kCFStringEncodingUTF8));
-    RetainPtr<CFURLRef> cfURL;
-    if (CFStringHasPrefix(pathOrURLCFString.get(), CFSTR("http://")) || CFStringHasPrefix(pathOrURLCFString.get(), CFSTR("https://")))
-        cfURL.adoptCF(CFURLCreateWithString(0, pathOrURLCFString.get(), 0));
-    else
-#if PLATFORM(WIN)
-        cfURL.adoptCF(CFURLCreateWithFileSystemPath(0, pathOrURLCFString.get(), kCFURLWindowsPathStyle, false));
-#else
-        cfURL.adoptCF(CFURLCreateWithFileSystemPath(0, pathOrURLCFString.get(), kCFURLPOSIXPathStyle, false));
-#endif
-    return WKURLCreateWithCFURL(cfURL.get());
-}
-
-
 } // namespace WTR
 
 #endif // StringFunctions_h
diff --git a/WebKitTools/WebKitTestRunner/TestController.cpp b/WebKitTools/WebKitTestRunner/TestController.cpp
index fc2e28d..aff8798 100644
--- a/WebKitTools/WebKitTestRunner/TestController.cpp
+++ b/WebKitTools/WebKitTestRunner/TestController.cpp
@@ -28,12 +28,19 @@
 #include "PlatformWebView.h"
 #include "StringFunctions.h"
 #include "TestInvocation.h"
+#include <cstdio>
 #include <WebKit2/WKContextPrivate.h>
 #include <WebKit2/WKPreferencesPrivate.h>
 #include <wtf/PassOwnPtr.h>
 
 namespace WTR {
 
+static WKURLRef blankURL()
+{
+    static WKURLRef staticBlankURL = WKURLCreateWithUTF8CString("about:blank");
+    return staticBlankURL;
+}
+
 static TestController* controller;
 
 TestController& TestController::shared()
@@ -60,6 +67,30 @@ TestController::~TestController()
 {
 }
 
+static WKRect getWindowFrameMainPage(WKPageRef page, const void* clientInfo)
+{
+    PlatformWebView* view = static_cast<TestController*>(const_cast<void*>(clientInfo))->mainWebView();
+    return view->windowFrame();
+}
+
+static void setWindowFrameMainPage(WKPageRef page, WKRect frame, const void* clientInfo)
+{
+    PlatformWebView* view = static_cast<TestController*>(const_cast<void*>(clientInfo))->mainWebView();
+    view->setWindowFrame(frame);
+}
+
+static WKRect getWindowFrameOtherPage(WKPageRef page, const void* clientInfo)
+{
+    PlatformWebView* view = static_cast<PlatformWebView*>(const_cast<void*>(clientInfo));
+    return view->windowFrame();
+}
+
+static void setWindowFrameOtherPage(WKPageRef page, WKRect frame, const void* clientInfo)
+{
+    PlatformWebView* view = static_cast<PlatformWebView*>(const_cast<void*>(clientInfo));
+    view->setWindowFrame(frame);
+}
+
 static void closeOtherPage(WKPageRef page, const void* clientInfo)
 {
     WKPageClose(page);
@@ -78,15 +109,19 @@ static WKPageRef createOtherPage(WKPageRef oldPage, const void*)
         0,
         view,
         createOtherPage,
-        0,
+        0, // showPage
         closeOtherPage,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0
+        0, // runJavaScriptAlert        
+        0, // runJavaScriptConfirm
+        0, // runJavaScriptPrompt
+        0, // setStatusText
+        0, // mouseDidMoveOverElement
+        0, // contentsSizeChanged
+        0, // didNotHandleKeyEvent
+        getWindowFrameOtherPage,
+        setWindowFrameOtherPage,
+        0, // runBeforeUnloadConfirmPanel
+        0 // didDraw
     };
     WKPageSetPageUIClient(newPage, &otherPageUIClient);
 
@@ -159,39 +194,43 @@ void TestController::initialize(int argc, const char* argv[])
         0,
         this,
         createOtherPage,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0
+        0, // showPage
+        0, // close
+        0, // runJavaScriptAlert        
+        0, // runJavaScriptConfirm
+        0, // runJavaScriptPrompt
+        0, // setStatusText
+        0, // mouseDidMoveOverElement
+        0, // contentsSizeChanged
+        0, // didNotHandleKeyEvent
+        getWindowFrameMainPage,
+        setWindowFrameMainPage,
+        0, // runBeforeUnloadConfirmPanel
+        0 // didDraw
     };
     WKPageSetPageUIClient(m_mainWebView->page(), &pageUIClient);
 
     WKPageLoaderClient pageLoaderClient = {
         0,
         this,
-        0,
-        0,
-        0,
-        0,
-        0,
+        0, // didStartProvisionalLoadForFrame
+        0, // didReceiveServerRedirectForProvisionalLoadForFrame
+        0, // didFailProvisionalLoadWithErrorForFrame
+        0, // didCommitLoadForFrame
+        0, // didFinishDocumentLoadForFrame
         didFinishLoadForFrame,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0,
-        0
+        0, // didFailLoadWithErrorForFrame
+        0, // didReceiveTitleForFrame
+        0, // didFirstLayoutForFrame
+        0, // didFirstVisuallyNonEmptyLayoutForFrame
+        0, // didRemoveFrameFromHierarchy
+        0, // didStartProgress
+        0, // didChangeProgress
+        0, // didFinishProgress
+        0, // didBecomeUnresponsive
+        0, // didBecomeResponsive
+        0, // processDidExit
+        0 // didChangeBackForwardList
     };
     WKPageSetPageLoaderClient(m_mainWebView->page(), &pageLoaderClient);
 }
@@ -208,13 +247,26 @@ void TestController::resetStateToConsistentValues()
     WKPreferencesSetFontSmoothingLevel(preferences, kWKFontSmoothingLevelNoSubpixelAntiAliasing);
     WKPreferencesSetXSSAuditorEnabled(preferences, false);
 
+    static WKStringRef standardFontFamily = WKStringCreateWithUTF8CString("Times");
+    static WKStringRef cursiveFontFamily = WKStringCreateWithUTF8CString("Apple Chancery");
+    static WKStringRef fantasyFontFamily = WKStringCreateWithUTF8CString("Papyrus");
+    static WKStringRef fixedFontFamily = WKStringCreateWithUTF8CString("Courier");
+    static WKStringRef sansSerifFontFamily = WKStringCreateWithUTF8CString("Helvetica");
+    static WKStringRef serifFontFamily = WKStringCreateWithUTF8CString("Times");
+
+    WKPreferencesSetStandardFontFamily(preferences, standardFontFamily);
+    WKPreferencesSetCursiveFontFamily(preferences, cursiveFontFamily);
+    WKPreferencesSetFantasyFontFamily(preferences, fantasyFontFamily);
+    WKPreferencesSetFixedFontFamily(preferences, fixedFontFamily);
+    WKPreferencesSetSansSerifFontFamily(preferences, sansSerifFontFamily);
+    WKPreferencesSetSerifFontFamily(preferences, serifFontFamily);
+
     m_mainWebView->focus();
 
     // Reset main page back to about:blank
     m_doneResetting = false;
 
-    WKRetainPtr<WKURLRef> url(AdoptWK, createWKURL("about:blank"));
-    WKPageLoadURL(m_mainWebView->page(), url.get());
+    WKPageLoadURL(m_mainWebView->page(), blankURL());
     TestController::runUntil(m_doneResetting);
 }
 
@@ -281,9 +333,7 @@ void TestController::didFinishLoadForFrame(WKPageRef page, WKFrameRef frame)
         return;
 
     WKRetainPtr<WKURLRef> wkURL(AdoptWK, WKFrameCopyURL(frame));
-    RetainPtr<CFURLRef> cfURL= toCF(wkURL);
-    CFStringRef cfURLString = CFURLGetString(cfURL.get());
-    if (!CFEqual(cfURLString, CFSTR("about:blank")))
+    if (!WKURLIsEqual(wkURL.get(), blankURL()))
         return;
 
     m_doneResetting = true;
diff --git a/WebKitTools/WebKitTestRunner/TestInvocation.cpp b/WebKitTools/WebKitTestRunner/TestInvocation.cpp
index 47df66b..c1bf894 100644
--- a/WebKitTools/WebKitTestRunner/TestInvocation.cpp
+++ b/WebKitTools/WebKitTestRunner/TestInvocation.cpp
@@ -28,15 +28,62 @@
 #include "PlatformWebView.h"
 #include "StringFunctions.h"
 #include "TestController.h"
+#include <climits>
+#include <cstdio>
 #include <WebKit2/WKContextPrivate.h>
 #include <WebKit2/WKRetainPtr.h>
-#include <wtf/RetainPtr.h>
+#include <wtf/OwnArrayPtr.h>
+#include <wtf/PassOwnArrayPtr.h>
+
+#if OS(WINDOWS)
+#include <direct.h> // For _getcwd.
+#define getcwd _getcwd // MSDN says getcwd is deprecated.
+#define PATH_MAX _MAX_PATH
+#endif
 
 using namespace WebKit;
 using namespace std;
 
 namespace WTR {
 
+static WKURLRef createWKURL(const char* pathOrURL)
+{
+    if (strstr(pathOrURL, "http://") || strstr(pathOrURL, "https://") || strstr(pathOrURL, "file://"))
+        return WKURLCreateWithUTF8CString(pathOrURL);
+
+    // Creating from filesytem path.
+    size_t length = strlen(pathOrURL);
+    if (!length)
+        return 0;
+
+    const char* filePrefix = "file://";
+    static const size_t prefixLength = strlen(filePrefix);
+#if OS(WINDOWS)
+    const char separator = '\\';
+    bool isAbsolutePath = length >= 3 && pathOrURL[1] == ':' && pathOrURL[2] == separator;
+#else
+    const char separator = '/';
+    bool isAbsolutePath = pathOrURL[0] == separator;
+#endif
+
+    OwnArrayPtr<char> buffer;
+    if (isAbsolutePath) {
+        buffer = adoptArrayPtr(new char[prefixLength + length + 1]);
+        strcpy(buffer.get(), filePrefix);
+        strcpy(buffer.get() + prefixLength, pathOrURL);
+    } else {
+        buffer = adoptArrayPtr(new char[prefixLength + PATH_MAX + length + 2]); // 1 for the separator
+        strcpy(buffer.get(), filePrefix);
+        if (!getcwd(buffer.get() + prefixLength, PATH_MAX))
+            return 0;
+        size_t numCharacters = strlen(buffer.get());
+        buffer[numCharacters] = separator;
+        strcpy(buffer.get() + numCharacters + 1, pathOrURL);
+    }
+
+    return WKURLCreateWithUTF8CString(buffer.get());
+}
+
 TestInvocation::TestInvocation(const char* pathOrURL)
     : m_url(AdoptWK, createWKURL(pathOrURL))
     , m_pathOrURL(fastStrDup(pathOrURL))
@@ -70,9 +117,8 @@ void TestInvocation::invoke()
 {
     sizeWebViewForCurrentTest(m_pathOrURL);
 
-    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithCFString(CFSTR("BeginTest")));
-    WKRetainPtr<WKStringRef> messageBody(AdoptWK, WKStringCreateWithCFString(CFSTR("")));
-    WKContextPostMessageToInjectedBundle(TestController::shared().context(), messageName.get(), messageBody.get());
+    WKRetainPtr<WKStringRef> messageName(AdoptWK, WKStringCreateWithUTF8CString("BeginTest"));
+    WKContextPostMessageToInjectedBundle(TestController::shared().context(), messageName.get(), 0);
 
     TestController::runUntil(m_gotInitialResponse);
     if (m_error) {
@@ -104,8 +150,7 @@ void TestInvocation::dump(const char* stringToDump)
 
 void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName, WKTypeRef messageBody)
 {
-    RetainPtr<CFStringRef> cfMessageName(AdoptCF, WKStringCopyCFString(0, messageName));
-    if (CFEqual(cfMessageName.get(), CFSTR("Error"))) {
+    if (WKStringIsEqualToUTF8CString(messageName, "Error")) {
         // Set all states to true to stop spinning the runloop.
         m_gotInitialResponse = true;
         m_gotFinalMessage = true;
@@ -113,11 +158,10 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         return;
     }
 
-    if (CFEqual(cfMessageName.get(), CFSTR("Ack"))) {
+    if (WKStringIsEqualToUTF8CString(messageName, "Ack")) {
         ASSERT(WKGetTypeID(messageBody) == WKStringGetTypeID());
-        RetainPtr<CFStringRef> cfMessageBody(AdoptCF, WKStringCopyCFString(0, static_cast<WKStringRef>(messageBody)));
-
-        if (CFEqual(cfMessageBody.get(), CFSTR("BeginTest"))) {
+        WKStringRef messageBodyString = static_cast<WKStringRef>(messageBody);
+        if (WKStringIsEqualToUTF8CString(messageBodyString, "BeginTest")) {
             m_gotInitialResponse = true;
             return;
         }
@@ -125,12 +169,11 @@ void TestInvocation::didReceiveMessageFromInjectedBundle(WKStringRef messageName
         ASSERT_NOT_REACHED();
     }
 
-    if (CFEqual(cfMessageName.get(), CFSTR("Done"))) {
+    if (WKStringIsEqualToUTF8CString(messageName, "Done")) {
         ASSERT(WKGetTypeID(messageBody) == WKStringGetTypeID());
-        ostringstream out;
-        out << static_cast<WKStringRef>(messageBody);
+        WKStringRef messageBodyString = static_cast<WKStringRef>(messageBody);
 
-        dump(out.str().c_str());
+        dump(toSTD(messageBodyString).c_str());
 
         m_gotFinalMessage = true;
         return;
diff --git a/WebKitTools/WebKitTestRunner/WebKitTestRunner.pro b/WebKitTools/WebKitTestRunner/WebKitTestRunner.pro
new file mode 100644
index 0000000..677abb3
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/WebKitTestRunner.pro
@@ -0,0 +1,5 @@
+TEMPLATE = subdirs
+
+SUBDIRS = qt/WebKitTestRunner.pro \
+          InjectedBundle/qt/InjectedBundle.pro \
+
diff --git a/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj b/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
index 6ecbef9..599e09e 100644
--- a/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
+++ b/WebKitTools/WebKitTestRunner/WebKitTestRunner.xcodeproj/project.pbxproj
@@ -368,7 +368,14 @@
 			isa = PBXProject;
 			buildConfigurationList = 1DEB927808733DD40010E9CD /* Build configuration list for PBXProject "WebKitTestRunner" */;
 			compatibilityVersion = "Xcode 3.1";
+			developmentRegion = English;
 			hasScannedForEncodings = 1;
+			knownRegions = (
+				English,
+				Japanese,
+				French,
+				German,
+			);
 			mainGroup = 08FB7794FE84155DC02AAC07 /* WebKitTestRunner */;
 			projectDirPath = "";
 			projectRoot = "";
diff --git a/WebKitTools/WebKitTestRunner/mac/PlatformWebViewMac.mm b/WebKitTools/WebKitTestRunner/mac/PlatformWebViewMac.mm
index 96e6526..6080c1f 100644
--- a/WebKitTools/WebKitTestRunner/mac/PlatformWebViewMac.mm
+++ b/WebKitTools/WebKitTestRunner/mac/PlatformWebViewMac.mm
@@ -63,4 +63,21 @@ void PlatformWebView::focus()
     // Implement.
 }
 
+WKRect PlatformWebView::windowFrame()
+{
+    NSRect frame = [m_window frame];
+
+    WKRect wkFrame;
+    wkFrame.origin.x = frame.origin.x;
+    wkFrame.origin.y = frame.origin.y;
+    wkFrame.size.width = frame.size.width;
+    wkFrame.size.height = frame.size.height;
+    return wkFrame;
+}
+
+void PlatformWebView::setWindowFrame(WKRect frame)
+{
+    [m_window setFrame:NSMakeRect(frame.origin.x, frame.origin.y, frame.size.width, frame.size.height) display:YES];
+}
+
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/qt/PlatformWebViewQt.cpp b/WebKitTools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
new file mode 100644
index 0000000..d405a0f
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/qt/PlatformWebViewQt.cpp
@@ -0,0 +1,99 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "PlatformWebView.h"
+#include "qgraphicswkview.h"
+#include <QtGui>
+
+namespace WTR {
+
+class WebView : public QGraphicsView {
+public:
+    WebView(WKPageNamespaceRef);
+
+    QGraphicsWKView* wkView() const { return m_item; }
+
+    virtual ~WebView() { delete m_item; }
+
+private:
+    QGraphicsWKView* m_item;
+};
+
+WebView::WebView(WKPageNamespaceRef namespaceRef)
+    : QGraphicsView()
+    , m_item(new QGraphicsWKView(namespaceRef))
+{
+    setScene(new QGraphicsScene(this));
+    scene()->addItem(m_item);
+}
+
+PlatformWebView::PlatformWebView(WKPageNamespaceRef namespaceRef)
+    : m_view(new WebView(namespaceRef))
+    , m_window(new QMainWindow())
+{
+    m_view->setParent(m_window);
+    m_window->setCentralWidget(m_view);
+    m_window->setGeometry(0, 0, 800, 600);
+}
+
+PlatformWebView::~PlatformWebView()
+{
+    delete m_window;
+}
+
+void PlatformWebView::resizeTo(unsigned width, unsigned height)
+{
+    m_window->resize(width, height);
+}
+
+WKPageRef PlatformWebView::page()
+{
+    return m_view->wkView()->page()->pageRef();
+}
+
+void PlatformWebView::focus()
+{
+    m_view->setFocus(Qt::OtherFocusReason);
+}
+
+WKRect PlatformWebView::windowFrame()
+{
+    // Implement.
+
+    WKRect wkFrame;
+    wkFrame.origin.x = 0;
+    wkFrame.origin.y = 0;
+    wkFrame.size.width = 0;
+    wkFrame.size.height = 0;
+    return wkFrame;
+}
+
+void PlatformWebView::setWindowFrame(WKRect)
+{
+    // Implement.
+}
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/qt/TestControllerQt.cpp b/WebKitTools/WebKitTestRunner/qt/TestControllerQt.cpp
new file mode 100644
index 0000000..d3aee4a
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/qt/TestControllerQt.cpp
@@ -0,0 +1,134 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged. All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+ * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+ * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+ * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+ * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+ * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+ * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+ * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+ * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "TestController.h"
+
+#include "WKStringQt.h"
+
+#include <cstdlib>
+#include <QCoreApplication>
+#include <QEventLoop>
+#include <QFileInfo>
+#include <QLibrary>
+#include <QObject>
+#include <QtGlobal>
+#include <wtf/Platform.h>
+#include <wtf/text/WTFString.h>
+
+namespace WTR {
+
+// With a bigger interval we would waste to much time
+// after the test had been finished.
+static const unsigned kTimerIntervalMS = 1;
+
+class RunUntilConditionLoop : public QObject {
+    Q_OBJECT
+
+public:
+    static void start(bool& done)
+    {
+        static RunUntilConditionLoop* instance = new RunUntilConditionLoop;
+        instance->run(done);
+    }
+
+private:
+    RunUntilConditionLoop() {}
+
+    void run(bool& done)
+    {
+        m_condition = &done;
+        m_timerID = startTimer(kTimerIntervalMS);
+        ASSERT(m_timerID);
+        m_eventLoop.exec(QEventLoop::ExcludeUserInputEvents);
+    }
+
+    virtual void timerEvent(QTimerEvent*)
+    {
+        if (!*m_condition)
+            return;
+
+        killTimer(m_timerID);
+        m_eventLoop.exit();
+    }
+
+    QEventLoop m_eventLoop;
+    bool* m_condition;
+    int m_timerID;
+};
+
+void TestController::platformInitialize()
+{
+}
+
+void TestController::runUntil(bool& done)
+{
+    RunUntilConditionLoop::start(done);
+    ASSERT(done);
+}
+
+static bool isExistingLibrary(const QString& path)
+{
+#if OS(WINDOWS) || OS(SYMBIAN)
+    const char* librarySuffixes[] = { ".dll" };
+#elif PLATFORM(MAC)
+    const char* librarySuffixes[] = { ".bundle", ".dylib", ".so" };
+#elif OS(UNIX)
+    const char* librarySuffixes[] = { ".so" };
+#else
+#error Library path suffix should be specified for this platform
+#endif
+    for (unsigned i = 0; i < sizeof(librarySuffixes) / sizeof(const char*); ++i) {
+        if (QLibrary::isLibrary(path + librarySuffixes[i]))
+            return true;
+    }
+
+    return false;
+}
+
+void TestController::initializeInjectedBundlePath()
+{
+    QString path = QLatin1String(getenv("WTR_INJECTEDBUNDLE_PATH"));
+    if (path.isEmpty())
+        path = QFileInfo(QCoreApplication::applicationDirPath() + "/../lib/libWTRInjectedBundle").absoluteFilePath();
+    if (!isExistingLibrary(path))
+        qFatal("Cannot find the injected bundle at %s\n", qPrintable(path));
+
+    m_injectedBundlePath = WKStringCreateWithQString(path);
+}
+
+void TestController::initializeTestPluginDirectory()
+{
+    // This is called after initializeInjectedBundlePath.
+    m_testPluginDirectory = m_injectedBundlePath;
+}
+
+void TestController::platformInitializeContext()
+{
+}
+
+#include "TestControllerQt.moc"
+
+} // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/qt/WebKitTestRunner.pro b/WebKitTools/WebKitTestRunner/qt/WebKitTestRunner.pro
new file mode 100644
index 0000000..a638e65
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/qt/WebKitTestRunner.pro
@@ -0,0 +1,68 @@
+TARGET = WebKitTestRunner
+CONFIG -= app_bundle
+
+BASEDIR = $$PWD/../
+isEmpty(OUTPUT_DIR): OUTPUT_DIR = ../../..
+
+include(../../../WebKit.pri)
+
+!CONFIG(release, debug|release) {
+    OBJECTS_DIR = obj/debug
+} else { # Release
+    OBJECTS_DIR = obj/release
+}
+
+DEFINES += USE_SYSTEM_MALLOC
+
+INCLUDEPATH += \
+    $$BASEDIR \
+    $$BASEDIR/../../JavaScriptCore \
+    $$BASEDIR/../../WebKit2 \
+    $$BASEDIR/../../WebKit2/Shared \
+    $$BASEDIR/../../WebKit2/UIProcess/API/qt \
+    $$BASEDIR/../../WebKit2/UIProcess/API/cpp/qt \
+
+INCLUDEPATH += \
+    $$OUTPUT_DIR/include \
+
+
+DESTDIR = $$OUTPUT_DIR/bin
+
+unix:!mac {
+    CONFIG += link_pkgconfig
+    PKGCONFIG += fontconfig
+}
+
+QT = core gui network
+
+HEADERS = \
+    $$BASEDIR/PlatformWebView.h \
+    $$BASEDIR/StringFunctions.h \
+    $$BASEDIR/TestController.h \
+    $$BASEDIR/TestInvocation.h
+
+SOURCES = \
+    main.cpp \
+    PlatformWebViewQt.cpp \
+    TestControllerQt.cpp \
+    $$BASEDIR/TestController.cpp \
+    $$BASEDIR/TestInvocation.cpp \
+
+PREFIX_HEADER = $$BASEDIR/WebKitTestRunnerPrefix.h
+QMAKE_CXXFLAGS += "-include $$PREFIX_HEADER"
+
+linux-* {
+    # From Creator's src/rpath.pri:
+    # Do the rpath by hand since it's not possible to use ORIGIN in QMAKE_RPATHDIR
+    # this expands to $ORIGIN (after qmake and make), it does NOT read a qmake var.
+    QMAKE_RPATHDIR = \$\$ORIGIN/../lib $$QMAKE_RPATHDIR
+    MY_RPATH = $$join(QMAKE_RPATHDIR, ":")
+
+    QMAKE_LFLAGS += -Wl,-z,origin \'-Wl,-rpath,$${MY_RPATH}\'
+    QMAKE_RPATHDIR =
+} else {
+    QMAKE_RPATHDIR = $$OUTPUT_DIR/lib $$QMAKE_RPATHDIR
+}
+
+include(../../../JavaScriptCore/JavaScriptCore.pri)
+addJavaScriptCoreLib(../../../JavaScriptCore)
diff --git a/WebKitTools/WebKitTestRunner/qt/main.cpp b/WebKitTools/WebKitTestRunner/qt/main.cpp
new file mode 100644
index 0000000..4312a05
--- /dev/null
+++ b/WebKitTools/WebKitTestRunner/qt/main.cpp
@@ -0,0 +1,69 @@
+/*
+ * Copyright (C) 2010 Apple Inc. All rights reserved.
+ * Copyright (C) 2010 University of Szeged.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS''
+ * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+ * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS
+ * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
+ * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
+ * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
+ * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
+ * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
+ * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
+ * THE POSSIBILITY OF SUCH DAMAGE.
+ */
+
+#include "TestController.h"
+
+#include <QApplication>
+#include <QObject>
+#include <QTimer>
+
+class Launcher : public QObject {
+    Q_OBJECT
+
+public:
+    Launcher(int argc, char** argv)
+        : m_argc(argc)
+        , m_argv(argv)
+    {
+    }
+
+    ~Launcher()
+    {
+        delete m_controller;
+    }
+
+public slots:
+    void launch()
+    {
+        m_controller = new WTR::TestController(m_argc, const_cast<const char**>(m_argv));
+        QApplication::exit();
+    }
+
+private:
+    WTR::TestController* m_controller;
+    int m_argc;
+    char** m_argv;
+};
+
+int main(int argc, char** argv)
+{
+    QApplication app(argc, argv);
+    Launcher launcher(argc, argv);
+    QTimer::singleShot(0, &launcher, SLOT(launch()));
+    return app.exec();;
+}
+
+#include "main.moc"
diff --git a/WebKitTools/WebKitTestRunner/win/PlatformWebViewWin.cpp b/WebKitTools/WebKitTestRunner/win/PlatformWebViewWin.cpp
index b9854c4..9acd236 100644
--- a/WebKitTools/WebKitTestRunner/win/PlatformWebViewWin.cpp
+++ b/WebKitTools/WebKitTestRunner/win/PlatformWebViewWin.cpp
@@ -78,4 +78,21 @@ void PlatformWebView::focus()
     ::SetFocus(::WKViewGetWindow(m_view));
 }
 
+WKRect PlatformWebView::windowFrame()
+{
+    // Implement.
+
+    WKRect wkFrame;
+    wkFrame.origin.x = 0;
+    wkFrame.origin.y = 0;
+    wkFrame.size.width = 0;
+    wkFrame.size.height = 0;
+    return wkFrame;
+}
+
+void PlatformWebView::setWindowFrame(WKRect)
+{
+    // Implement.
+}
+
 } // namespace WTR
diff --git a/WebKitTools/WebKitTestRunner/win/WebKitTestRunner.vcproj b/WebKitTools/WebKitTestRunner/win/WebKitTestRunner.vcproj
index e4cd870..c852f64 100644
--- a/WebKitTools/WebKitTestRunner/win/WebKitTestRunner.vcproj
+++ b/WebKitTools/WebKitTestRunner/win/WebKitTestRunner.vcproj
@@ -23,7 +23,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -39,7 +39,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

@@ -95,7 +95,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -111,7 +111,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

@@ -166,7 +166,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -182,7 +182,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

@@ -236,7 +236,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -252,7 +252,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

@@ -308,7 +308,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -324,7 +324,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

@@ -382,7 +382,7 @@
 			>

 			<Tool

 				Name="VCPreBuildEventTool"

-				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders&quot;&#x0D;&#x0A;mkdir 2&gt;NUL &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;&#x0D;&#x0A;xcopy /y /d &quot;$(ProjectDir)\..\ForwardingHeaders\wtf\*.h&quot; &quot;$(WebKitOutputDir)\include\WebKitTestRunner\ForwardingHeaders\wtf&quot;&#x0D;&#x0A;"

+				CommandLine="%SystemDrive%\cygwin\bin\which.exe bash&#x0D;&#x0A;if errorlevel 1 set PATH=%SystemDrive%\cygwin\bin;%PATH%&#x0D;&#x0A;cmd /c&#x0D;&#x0A;if exist &quot;$(WebKitOutputDir)\buildfailed&quot; grep XX$(ProjectName)XX &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;if errorlevel 1 exit 1&#x0D;&#x0A;echo XX$(ProjectName)XX &gt; &quot;$(WebKitOutputDir)\buildfailed&quot;&#x0D;&#x0A;&#x0D;&#x0A;"

 			/>

 			<Tool

 				Name="VCCustomBuildTool"

@@ -398,7 +398,7 @@
 			/>

 			<Tool

 				Name="VCCLCompilerTool"

-				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebKitTestRunner\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

+				AdditionalIncludeDirectories="&quot;$(ProjectDir)\..&quot;;&quot;$(WebKitOutputDir)\Include&quot;;&quot;$(WebKitOutputDir)\Include\private&quot;;&quot;$(WebKitOutputDir)\Include\WebCore\ForwardingHeaders&quot;;&quot;$(WebKitLibrariesDir)\Include&quot;"

 				PreprocessorDefinitions="__WIN32__;_CONSOLE"

 				DisableSpecificWarnings="4146"

 				ForcedIncludeFiles="WebKitTestRunnerPrefix.h"

diff --git a/WebKitTools/gdb/webkit.py b/WebKitTools/gdb/webkit.py
index 2d3b47a..95c3d9c 100644
--- a/WebKitTools/gdb/webkit.py
+++ b/WebKitTools/gdb/webkit.py
@@ -100,6 +100,36 @@ class WTFStringPrinter(StringPrinter):
                                  self.get_length())
 
 
+class JSCUStringPrinter(StringPrinter):
+    "Print a JSC::UString"
+    def get_length(self):
+        if not self.val['m_impl']['m_ptr']:
+            return 0
+        return self.val['m_impl']['m_ptr']['m_length']
+
+    def to_string(self):
+        if self.get_length() == 0:
+            return ''
+
+        return ustring_to_string(self.val['m_impl']['m_ptr']['m_data'],
+                                 self.get_length())
+
+
+class JSCIdentifierPrinter(StringPrinter):
+    "Print a JSC::Identifier"
+    def to_string(self):
+        return JSCUStringPrinter(self.val['m_string']).to_string()
+
+
+class JSCJSStringPrinter(StringPrinter):
+    "Print a JSC::JSString"
+    def to_string(self):
+        if self.val['m_length'] == 0:
+            return ''
+
+        return JSCUStringPrinter(self.val['m_value']).to_string()
+
+
 class WebCoreQualifiedNamePrinter(StringPrinter):
     "Print a WebCore::QualifiedName"
 
@@ -198,13 +228,15 @@ class WTFVectorPrinter:
     def display_hint(self):
         return 'array'
 
-
 def add_pretty_printers():
     pretty_printers_dict = {
         re.compile("^WTF::Vector<.*>$"): WTFVectorPrinter,
         re.compile("^WTF::AtomicString$"): WTFAtomicStringPrinter,
         re.compile("^WTF::String$"): WTFStringPrinter,
         re.compile("^WebCore::QualifiedName$"): WebCoreQualifiedNamePrinter,
+        re.compile("^JSC::UString$"): JSCUStringPrinter,
+        re.compile("^JSC::Identifier$"): JSCIdentifierPrinter,
+        re.compile("^JSC::JSString$"): JSCJSStringPrinter,
     }
 
     def lookup_function(val):
diff --git a/autotools/webkit.m4 b/autotools/webkit.m4
index 379fa8f..6b44f30 100644
--- a/autotools/webkit.m4
+++ b/autotools/webkit.m4
@@ -108,7 +108,7 @@ AC_DEFUN_ONCE([_WEBKIT_CHECK_GLIB],
 [dnl
 dnl check for glib
 # Version requirements
-GLIB_REQUIRED_VERSION=2.21.3
+GLIB_REQUIRED_VERSION=2.24
 GOBJECT_REQUIRED_VERSION=2.0
 GTHREAD_REQUIRED_VERSION=2.0